I think "memory that is never swapped to disk" would fit nicely into Rust's ownership/borrowing model. It would probably just be a variant on Box that makes more guarantees, but which exposes the same safe interfaces? Having a safe API built on top of unsafe calls is more or less how everything in Rust works (maybe how any safe language works?), when you drill down far enough.

That said, I guess you'd have to be careful to avoid creating something like a NoSwapBox<Vec>, because the NoSwap property would only apply to the (ptr, capacity, length) triple of the vec, and not to its actual heap allocation that you probably care about. Maybe the answer there is something like requiring that the contents of NoSwapBox implement Copy, or some other way of saying "this is plain old data"? I don't know enough about the plans for custom allocators to say anything intelligent :p