procedure RECOVER($p, c, INCNUM, S$)
  $INCNUM \leftarrow INCNUM$ + 1;
  save $INCNUM$ on stable storage;
  $INCVEC[p] \leftarrow INCNUM$;
  G $\leftarrow$ AG($\sigma_{p,c}$);

  for all $q \in S, q \neq p$ do
    $(INQ, AGQ) \leftarrow$ remote call $q$: GET_AG($p$);
    $G \leftarrow G \cup AGQ;$
    $INCVEC[q] \leftarrow INQ;$

  for all $q \in S, q \neq p$ do
    remote call $q$: SEND_INC($p, INCVEC$);

  $m \leftarrow$ max $j$ such that $\sigma_{p,j} \in G$;
  $STATEINDEX \leftarrow c;$

  while $STATEINDEX \leq m$ do
    execute up to next event without sending application
    messages;
    $STATEINDEX \leftarrow STATEINDEX$ + 1;

    if next event is a receive then
      request message from sender's log;
    else
      re-execute internal event;
  return;
  
  
procedure GET_AG($p$)
  save $AG$ on stable storage;
  $k \leftarrow$ max $j$ such that $\sigma_{p,j} \in AG$;
  $REJECTVEC[p] \leftarrow k;$
  return $(INCNUM, \sigma_{p,k})$;


procedure SEND_INC($p, INCVEC\_P$)
  for all $s \in S$ do
    $INCVEC[s] \leftarrow$ max ($INCVEC[s], INCVEC\_P[s]$);
    $REJECTVEC[p] \leftarrow \infty$;
    return;