Provable transient recovery for frame-based, fault-tolerant computing systems