Only a default constructor is supported; safe messages get initialised by adopting their handle from another instance, by downcasting from a received RMessage2 (ugly but safe since safe messages never add members or virtuals), or (rarely) by duplicating another instance, which diminishes safety.

Because we strive to maintain a single owner for a message and to pass by reference when ownership it's generally an error for the handle to be set upon destruction.

Take over a message. Beyond being a simple copy this resets the source's handle so that double-ownership is avoided

Complete the message with the given reason code, with detailed logging

Duplicate a message, including aliasing the handle & so raising the risk of a double-complete

Perform a read and kill the client if it has supplied a bad descriptor

Perform a read and kill the client if it has supplied a bad descriptor

Null the handle, so this safe message no longer references a client request. This is normally done automatically by completing or panicking the client or transferring message ownership, so this will seldom need to be called explicitly

Perform a write and kill the client if it has supplied a bad descriptor

Perform a write and kill the client if it has supplied a bad descriptor

Perform a write and kill the client if it has supplied a bad descriptor

Perform a write and kill the client if it has supplied a bad descriptor

Perform a write and kill the client if it has supplied a bad descriptor