It is still in the works. The current policy addresses
some of the problems. It has not been officially
released. You can find it at https://www.debian.org/doc/packaging-manuals/java-policy/.
The Java Policy can also be found in the java-policy
package.
Yes, some until under discussion. Please check out the bugs against the java-policy package. Thus it is very inconvenient to use several compilers of virtual machines since there is not one CLASSPATH setting for all of them.