The short answer
Execution continuity preserves mission progress across ownership changes by binding checkpoints to mission, assignment, membership epoch and fencing state. A replacement must recover from that context and revalidate protected effects, rather than resuming an unqualified snapshot.
Follow the bounded recovery loop
The recovery semantics begin with a detected and authenticated signal. Invalid work is stopped or fenced, predecessor evidence is preserved, and eligible peers and policy are re-evaluated. Reassignment or replanning stays within a configured budget.
A replacement resumes only after readiness and authority checks pass. Missing or conflicting evidence remains unresolved. This matters when a machine restarts successfully but its retained assignment no longer matches the collective's current state.
Example: a replacement continues a research mission
Consider an illustrative peer that saved a research result before losing connectivity. Another eligible peer takes responsibility after the configured recovery process. It should identify the result's mission and predecessor, inspect current assignment and determine which remaining work is permitted.
The replacement can reuse valid evidence without pretending it is the original executor. Retain both identities in the causal record. If the required checkpoint context is ambiguous, pausing that transition is different from discarding every useful artifact.
Continuity does not settle remote side effects
A checkpoint can explain local progress while leaving a remote API outcome unknown. The continuity documentation explicitly does not establish exactly-once execution of arbitrary external effects.
Revalidate effect-specific approval, idempotency and lease requirements at the boundary. If an external service processed an action but the acknowledgement was lost, use its supported reconciliation mechanism. Restarting from the latest checkpoint alone cannot prove whether that action occurred.
Distinguish this from the local Room crash example
The Room recovery example tests the narrower point after a result commits and before coordination acknowledges it. Collective continuity additionally concerns mission ownership and peer context. Do not generalize the local example to every distributed recovery condition.
- Inspect the checkpoint's mission and assignment context.
- Change ownership through the configured recovery path.
- Reject a stale executor's attempted continuation.
- Verify the replacement's readiness and current authority.
- Reconcile any uncertain external operation separately.
Retain the failure injection and resulting evidence so the report shows which continuity boundary was actually tested.
Sources and further reading
Documentation reviewed . Consult the linked documentation for current implementation details.