Where does crash recovery start replaying WAL?

Why this is the answer

Recovery reads pg_control, finds the last checkpoint, and replays forward from its REDO location, which can come earlier than the checkpoint record because the checkpoint runs for a while. Replay of older segments would be wasted work. PostgreSQL replays forward and never undoes. Replay from a base backup is archive recovery.