A method for processing messages ensures that every message that enters a continuous processing system is fully processed in its entirety, even in the event of a failure within the system. Messages are pushed through an execution plan that includes a set of connected “primitives” that process the message, where the primitives may be distributed across a group of servers. Messages are pushed through in accordance with a protocol that does not permit unprocessed messages to be permanently lost as they travel from input sources, between primitives, and to output sources within the execution plan. The input queue, output queue, and state (if any) associated with each primitive are saved in persistent storage at select checkpoints. If a failure occurs on a server, the server, after it starts up again, restores the primitives on that server to the input queues, output queues, and states saved at the last applicable checkpoint.