The comment for ServiceContext::killOperation says that callers must be holding the Client lock before calling it. It would be helpful if the API for killOperation made it impossible to call without holding the Client lock, to avoid subtle programming errors.