21. One-shot ownership and races

approve(request, k) {
  const first = resume(k, true)
  return resume(k, false)        // defect ContinuationAlreadyConsumed, raised here (T2)
}

socket.once("connect") {
  if (!waiter.resume(socket)) socket.destroy()   // lost the race to cancellation: still ours to release
}

Both snippets consume a continuation a second time, or too late, and the machine answers differently in each case. One representation has three holders, and the law for a second consumption depends on the holder:

States

                       resume(k, x) / resumeWith(k, program)
        suspended ─────────────────────────────────────────► resumed
          │   ▲
          │   └── transfer(k), standard library only: owner := the Scope region
          │       around the handler (a second transfer revokes the first)
          │
          │ abandon(k), or its owner exits: the clause returns, fails, or is
          │ interrupted; the owning Scope region closes; or the capturing fiber exits
          └─────────────────────────────────────────────────► abandoned

  resume on resumed or abandoned        → defect ContinuationAlreadyConsumed at the caller   [T2, O03, K13a]
  abandon on resumed or abandoned       → no effect                                          [Kernel]
  resume, abandon, or transfer from another fiber → defect ContinuationWrongFiber            [O04, T14, O06]

Owners

[Kernel] [Rule]

• The clause. By default, k is owned by the clause invocation that received it, through an Owner(k) frame under the clause. If the clause exits by any path while k is still suspended, k is abandoned before control leaves the clause (T3, T4). An Owner nested inside a captured segment abandons its own continuation when that segment is abandoned (O01, O02).
• A Scope region, after transfer. transfer(k) moves ownership to the Scope region around the handler, the Scope in the clause's Context, and returns a Suspended handle that resume, resumeWith, and abandon accept (T10). Closing that region abandons k if it is still suspended and still owned by that transfer (O03). A second transfer revokes the first (O08). Transfer into the Scope parked inside k itself, a direct ownership cycle, is a defect (O07). Transfer into a Scope with parallel finalizers is a defect, TransferIntoParallelScope, because Effect runs each parallel finalizer on a forked fiber, which could never abandon k (K13e).
• The capturing fiber, always. A transferred continuation never outlives the fiber that captured it. The first transfer on a fiber puts a FiberExit frame at the bottom of its stack, and when the fiber's computation ends by any path, that frame abandons every transferred continuation still suspended, newest first, before the fiber's exit is published; cleanup failures join that exit (K13a-K13d). Without it, a child that transferred into a Scope inherited from its parent and then exited left a segment no fiber could release (review probe R5).

transfer stays inside the standard library in v0 (D16). Producers' external iteration uses it on one fiber, where every rule above holds. One case is still a defect rather than a release: closing the owning Scope from another fiber while the capturing fiber is alive raises ContinuationWrongFiber at the closer, and the segment is released when the capturing fiber exits (K13c). Routing that close to the capturing fiber is G3.

Every consumption is fiber-affine, transfer and abandonment included. Effect frames are closures over the fiber that pushed them: updateContext's restore frame calls setContext on that fiber (internal/effect.ts:2200-2208) [Effect]. An earlier kernel version abandoned on whichever fiber closed the Scope; T14b caught it rewriting the capturing fiber's live Context.

Garbage collection is never the cleanup mechanism. A suspended continuation with no owner cannot exist: capture assigns an owner atomically. No production runtime cleans up abandoned continuations from the collector; OCaml's attempt stalled over deadlocks (continuation-prior-art.md rule 4). Development builds may register suspended continuations with a FinalizationRegistry to report one collected while still suspended, as Swift's checked continuations log "leaked its continuation". That report is a diagnostic, never cleanup [Rule].

Double resumption

A second consumption is a defect raised at the second caller (T2). Nothing in the continuation runs twice. This differs from Effect.callback, which silently ignores every resume after the first (F5). Silent dropping suits racing external callbacks, which is why root waits report instead; it is wrong for a handler that resumes twice by mistake.

Cancellation versus resumption

JavaScript runs one fiber step at a time, so a race between a resume and an interruption is decided by which one reaches the fiber first.

A delivered value is an ownership transfer [Rule]. A value that needs release (a socket, a lease) is owned by exactly one party at every instant: the producer until the gate accepts it, the kernel while a delivery is in flight, and the receiving computation's Scope after delivery. The receiving side registers release before any interruption can be accepted: Effect.acquireRelease registers it under its mask after acquisition succeeds, in both policies (internal/effect.ts:4143-4159). Which policy a resource uses is the resource's choice, and using adds none (D25).