node displays only local content

Are you viewing that page as a user with the "administer nodes" permission?

Node access rules do not apply to users with 'administer nodes' permissions. There is nothing that can be done about that.

Please read the documentation. Particularly, sections 3.4 and 5.5

----
3.4 Limitations

Due to the way node_access() works, the following limitations should be noted.

  - Any node that is assigned to more than one subdomain can be edited
    by any editor who belongs to one of the subdomains.

  - Users who look at the sites and have the 'administer nodes' permission 
    can always see all content on all sites, which can be confusing.  This is 
    unavoidable.  It is best to preview your site as an anonymous or 
    authenticated user who does not have special permissions.
    
  - Users who have the 'edit TYPE nodes' permission will be able to edit nodes
    that do not belong to their subdomain.
    
These limitations are due to the permissive nature of node_access().  If any 
access rule grants you permission, it cannot be taken away.

This is a core Drupal behavior. For technical reference, see http://api.drupal.org/api/function/node_access/5. Especially the lines:

  if (user_access('administer nodes')) {
    return TRUE;
  }

That overrides any other setting and grants access to users with 'administer nodes.'

Do you still have MultiDomain turned on?

It may be that MultiDomain is granting node access, which would account for the behavior. Unless you applied the "multiple node access" patch and expecitly set Domain Access to use the "AND logic" if one node access module grants access, it cannot be removed.

Possibly. But that is not what is currently implemented, and it's too late to change before the first release.

After looking at the code, I believe -- but could be wrong -- that multidomain can do this because it uses taxonomy terms to store its data. Therefore it can add a JOIN to the {term_node} table to any node query.

But for node_access modules, the queries already get run through {node} and {node_access}, so you'd have to test if and where the JOIN syntax could be applied.

OG, for example, only uses db_rewrite_sql() in cases where external modules want to load nodes based on OG groups. The module itself relies on {node_access}.

My opinion is that this is a limitation of the current node_access system. You could try implementing hook_db_rewrite_sql(). http://api.drupal.org/api/function/hook_db_rewrite_sql/5. Perhaps something like this would work:

function domain_db_rewrite_sql($query, $primary_table, $primary_field, $args) {
  global $_domain;
  switch ($primary_field) {
    case 'nid':
      // this query deals with node objects
      $return = array();
      $return['join'] = "LEFT JOIN {domain_access} da ON $primary_table.nid = da.nid";
      $return['where'] = '((da.realm = 'domain_id' AND da.gid = '. $_domain['domain_id'] .') OR da.realm = 'domain_site)';
      return $return;
      break;
  }
}

You might try pasting that into the module and seeing what happens. Use the Devel module to show the queries that result.

XML sitemap should not produce duplicate content. Install the 'custom_url' patch and code. Then add 'xmlsitemap' to the 'special page requests' setting.

Note that this issue no longer appears on my radar, so you'll need to open new issues.

Here's a proper version of the function:

function domain_db_rewrite_sql($query, $primary_table, $primary_field, $args) {
  // Only run for users with special privileges.
  if (user_access('administer nodes')) {
    global $_domain;
    switch ($primary_field) {
      case 'nid':
        // This query deals with node objects
        $return = array();
        $return['join'] = "LEFT JOIN {domain_access} da ON $primary_table.nid = da.nid";
        $return['where'] = "((da.realm = 'domain_id' AND da.gid = ". $_domain['domain_id'] .") OR da.realm = 'domain_site')";
        return $return;
        break;
    }
  }
}

Ideally, this would then have a module setting, enabling the if to include:

&& variable_get('domain_disable_admin_nodes', 0) == 1

I am a little unsure about how table prefixing might affect what you wrote, and since da was still used in the [JOIN]. Here's some compromise code.

function domain_db_rewrite_sql($query, $primary_table, $primary_field, $args) {
  // Only run for users with special privileges.
  if (user_access('administer nodes')) {
    global $_domain;
    switch ($primary_field) {
      case 'nid':
        // This query deals with node objects
        $return = array();
        $return['join'] = "LEFT JOIN {domain_access} dac ON $primary_table.nid = dac.nid";
        $return['where'] = "((dac.realm = 'domain_id' AND dac.gid = ". $_domain['domain_id'] .") OR dac.realm = 'domain_site')";
        return $return;
        break;
    }
  }
}