Make the saving of references in the permuation container a bit safer.

I'm still uncomfortable with references as ivars in an object, but this
seems to be working for now.
Make internal kernel class private.
Merge branch 'Safety'