new DIP38: Safe references and rvalue references without runtime checks.

[Timothee Cour]

> Prevent valid code like T t2 = fooa(fooa(t)); in bar.

Thanks for the counter-example; I think I can still save the proposal
with the following conversion rules:

global => outref //global: gc-allocated, static, etc.
outref 'dot' field => outref // field access
ref function(args) where each outref arg of args is an outref
expression => outref
ref function(args) where at least one outref arg of args is not an
outref expression => local
inref => local
return outref => outref
return local => local // compile error if this is a ref return function

(I've also updated the DIP38).

Can you break these rules?