should destroy!false be @system?

[Steven Schveighoffer]

On 2/23/23 12:45 PM, Paul Backus wrote:
> On Thursday, 23 February 2023 at 17:01:05 UTC, Steven Schveighoffer wrote:
>> is c) reasonable? Do we need to deprecate @safe calls to 
>> `destroy!false` for types that have destructors?
> 
> It doesn't actually matter if you make `destroy!false` `@system`, 
> because the user can still call `s.__dtor` directly--and you can't make 
> the destructor itself `@system` if you want `S` to be usable in `@safe` 
> code.

If we want truly `@safe` code, then we need to define what is expected. 
Should a destructor be expected to be called more than once on a struct 
that is "live", i.e. not the `.init` value?

If so, you have to defensively mark the struct as being "destroyed", if 
not, you can expect that the language has either done it for you, or 
will not call your destructor more than once.

So which is it?

-Steve