Recovery model

TCC eliminates prefix replay when recovering from a committed continuation checkpoint.

Recovery loads the latest committed execution state and continues. Completed effect results are reused. Child identities stay stable. Waits are re-armed, not recreated.

If execution crashes here

Window	Recovery
Before the boundary commits	Previous committed state
After the boundary commits	The new committed state

That is the model. It is not a claim that recovery is constant-time, that external I/O is exactly-once, that execution is free, or that arbitrary TypeScript is supported today.

Side effects

If a process dies after an external call succeeds and before completion is committed, recovery may retry with the same identity. Idempotency keys are part of the model. Magical exactly-once I/O is not.

In the controlled evaluation, recovery stayed approximately 0.6–0.9 ms as tested history depth increased from 10 to 1,000 at fixed ~4 KB live state. Larger live state is slower. Those measurements characterize scaling behavior, not production-server performance.

Evidence: research. Scope: what TCC doesn’t claim.