From r the verifier reconstructs the candidate points R with x-coordinate r (two y-values, and rarely r + n) and computes Q = r⁻¹·(s·R − z·G). A recovery id selects the candidate, usually 0 or 1 for the parity of R's y-coordinate. Ethereum puts it in v: 27 or 28 for personal_sign and legacy messages, chainId × 2 + 35 or + 36 for EIP-155 transactions, and 0 or 1 in typed transactions. Bitcoin's signed-message format puts it in a header byte (27–42 depending on address type, BIP-137).
The ecrecover precompile at address 0x01 returns the 20-byte address of the recovered key; that is how contracts check personal_sign, EIP-712 and permit signatures without storing public keys. Recovery always yields some key for a well-formed signature, so it proves nothing until the result is compared with the expected address, and ecrecover returns the zero address on failure, which contracts must reject.
Recovery works for ECDSA on any curve, including P-256. Schnorr signatures (BIP-340) and EdDSA do not allow it, because their challenge hash commits to the public key.