  Programmers learning Rust struggle to understand ownership types, Rust's core
mechanism for ensuring memory safety without garbage collection. This paper
describes our attempt to systematically design a pedagogy for ownership types.
First, we studied Rust developers' misconceptions of ownership to create the
Ownership Inventory, a new instrument for measuring a person's knowledge of
ownership. We found that Rust learners could not connect Rust's static and
dynamic semantics, such as determining why an ill-typed program would (or would
not) exhibit undefined behavior. Second, we created a conceptual model of
Rust's semantics that explains borrow checking in terms of flow-sensitive
permissions on paths into memory. Third, we implemented a Rust compiler plugin
that visualizes programs under the model. Fourth, we integrated the permissions
model and visualizations into a broader pedagogy of ownership by writing a new
ownership chapter for The Rust Programming Language, a popular Rust textbook.
Fifth, we evaluated an initial deployment of our pedagogy against the original
version, using reader responses to the Ownership Inventory as a point of
comparison. Thus far, the new pedagogy has improved learner scores on the
Ownership Inventory by an average of 9% ($N = 342, d = 0.56$).
