E0026: REF() of what cannot be referenced

REF(x) gives a reference to the variable x (Ed.3 6.4.4.10.3), which stays valid as long as x exists and can be written through with ^. So x is a variable, or an element or field of one, that lives as long as the program and could be assigned:

• not a temporary: a VAR_TEMP, or any variable of a FUNCTION (its inputs, outputs, locals and result) but a VAR_EXTERNAL. Ed.3: “Applying the REF() operator to a temporary variable … is not permitted”; it is gone when the POU returns;
• not EN or ENO (Ed.3 6.6.1.5, rule 8);
• not a CONSTANT, and not a function block’s output taken from outside (REF(timer.Q)): writing through the reference would change what the checker keeps from being assigned (docs/dependencies.md);
• not a single bit of a bit string (REF(w.3)), a direct address (REF(%MW4): declare a variable AT %MW4), a literal or a call’s result.

FUNCTION_BLOCK fb
VAR_TEMP t : INT; END_VAR
VAR n : INT; r : REF_TO INT; END_VAR
r := REF(t);    (* E0026: t is gone when fb returns *)
r := REF(n);    (* fine: n lives as long as the instance *)
END_FUNCTION_BLOCK