One question I have is, how exactly does it record and what are the boundaries of the recording?
For example does it only record the userland execution of a single process, or does it have broader boundaries like including kernel code and/or execution of multiple processes? How does it handle shared memory regions that may be modified outside of the recording?
For the scripting languages and smart contract/ZK languages, we instrument the interpreters using high level hooking API-s or direct patches, and we produce a trace.
For system languages, we directly build on top of RR[1] recordings for now: RR can record multiple processes, and it works in userland. IIRC it doesn't support modifications of shared memory outside of the recording. It's very well documented in their paper: Engineering Record And Replay For Deployability: Extended Technical Report[2].