"Safe" is unfortunately overloaded here. I wasn't trying to say anything about memory safety. `leak` and `forget` may be memory-safe, but they can only be implemented with `unsafe` code to circumvent the liveness/"relevant" guarantees of the type system.

While this is not the direction the standard library took, I think it would be possible to write an alternative stdlib that doesn't choose to allow leaks.

My original statement was probably too strong though. Leak-free code might be possible with rust-the-language, but is probably not possible with rust-the-ecosystem without significant development.