We need to restrict the relational calculus a bit.
We may say an expression is safe if all values that appear in the result are values from dom().