Rust project goals: Immobile types and guaranteed destructors

Immobile types and guaranteed destructors Metadata Point of contact @lcnr Status Accepted What and why Let types opt out of being moved or forgotten, enabling scoped spawn, async drop, and pin-by-default Timespan 2026-2027 Roadmap Just add async Roadmap Rust for Linux Tracking issue [#635] Other tracking issues [rust-lang/rust#149607] Zulip channel #t-lang/move-trait [types] champion @lcnr [lang] champion @jackh726 Summary We propose to introduce new traits that describe what operations are possible on a type. Today Rust assumes all types can be moved (relocated in memory) and forgotten (via mem::forget). We will introduce traits like Move and Forget that make these capabilities explicit, allowing types to opt out. This follows the precedent set by the Sized hierarchy work, which relaxes the assumption that all types have a compile-time-known size. We will implement MVPs in the compiler, write RFCs, and validate viability through real-world testing in the Linux Kernel. Motivation The status quo Rust has historically assumed that all values can be moved (relocated in memory) and forgotten (via mem::forget, without running destructors). These assumptions are baked into the language: assignment moves values, and mem::forget is safe. But some types need to opt out of these capabilities: Immobile types: A lot of async futures want to be self-referential, but self-referential types can't be safely moved. The current solution is Pin, which encodes immovability as a property of places rather than types. This leads to significant complexity. As The Safe Pinned Initialization Problem describes, Pin struggles to safely encode self-referential types in systems like the Linux kernel. Guaranteed destructors: Some types need their destructors to run. A Transaction type might require commit() or rollback() before cleanup. A scoped task handle must join before the scope exits. But mem::forget is safe, so Rust can't guarantee destructors run. This blocks patterns like safe scoped spawn for async, where the spawned task borrows from the parent scope. What we propose to do about it We propose to generalize Rust's type system with new auto-traits that describe what operations are possible on a type. The framing is positive: traits represent capabilities. At the base layer, types may have no special capabilities. We then layer on the things we need: Move: The type can be relocated in memory. Destruct: The type can be implicitly dropped (destructor runs when it goes out of scope). Forget: The type can be forgotten via mem::forget without running its destructor. This follows the precedent set by the Sized hierarchy work. Just as that work relaxes "all types have compile-time-known size" to support scalable vectors, this work relaxes "all types can be moved" and "all types can be forgotten." The Move trait encodes movability as a property of types rather than places: #[lang = "move"] unsafe auto trait Move {} Types implementing !Move cannot be moved and must keep a stable address for their entire existence. This is simpler than Pin because immovability is a type property, not a place property. Construction of !Move types will rely on work from #t-lang/in-place-init. The Forget trait lets types opt out of being forgettable: // Types implementing !Forget must have their destructors run unsafe impl !Forget for ScopedTaskHandle {} With !Forget, we could build safe scoped spawn: the handle's destructor joins the task, and because the handle can't be forgotten, the join is guaranteed. This unblocks patterns that are currently impossible in safe Rust. Work items over the next year Move trait Let types opt out of being relocated in memory, encoding immovability as a type property rather than a place property. Task Owner(s) Notes Compiler implementation for Move @lcnr and @nia-e Write the Move RFC @yoshuawuyts Test in Linux kernel @BennoLossin RfL is an important Rust user which uses a lot of self-referential data