pub struct OperationId { /* private fields */ }Expand description
The name of one in-flight operation, carrying no claim on anything.
Returned by a push so a caller can refer to the operation it just
queued – to cancel it, to correlate it, or to feed
crate::contract::RingContract. It is Copy, has no Drop, and losing
one is harmless.
§A name, not a capability (D-71)
This deliberately carries no power to retrieve a payload. The ring hands a payload back only from the pop that observed its completion, which is what makes a use-after-free unrepresentable: there is no call that turns an identity into the memory an operation may still be using.
That is the same property Token::claim_if bought at runtime, and this
buys it structurally. The retired claim_if took a
crate::Completion rather than a usize precisely because a
Completion has no public constructor, so the only proof the kernel has
finished was one that had been popped; a caller-supplied integer would have
let safe code free a buffer the kernel was still writing into. M28.4.1d.3
removed the call rather than the argument: the payload now comes back from
the pop, so there is no second entry point to guard.
Handing an OperationId to a cancel stays safe for the reason it was always
safe to pass a token’s id there: a cancel returns no memory.