Your Agent Is Durable. You Cannot Restore It.

Q3 2026 architecture reviews are rubber-stamping "durable agents" as the production bar.

The stack looks complete: LangGraph and LangChain production checkpointers; Temporal and Restate for agent workflows; Cloudflare Agents on Durable Objects; Microsoft Copilot Studio persistent sessions; AWS Bedrock Agents with session state; MCP as the default tool bus, so the catalog can theoretically follow the model.

The pitch is tight. If the worker dies, the graph resumes. If the process restarts, the session comes back. If tools speak MCP, you are not locked to one runtime. Crash-resume plus interoperability, they tell you, is operational control.

It is not. Durability is crash-recovery for control flow, not a restore plane for cognition, bindings, or policy. A checkpointer will put the graph back on the last node. It will not give you a vendor-neutral, point-in-time snapshot of memory, tool bindings, credentials, working files, and the policy context that authorized the last action. Teams are buying "durable" and thinking they bought "recoverable." Those are different primitives, and this planning cycle is when the confusion gets written into RFPs.

The Primitive Mix-Up

Treat the agent like any other stateful system and the split is obvious.

Control flow is where the graph is: which node, which pending tool call, which await, which retry counter. LangGraph's PostgresSaver persists that. Temporal's event history replays it. Restate journals invocations. Cloudflare Durable Objects keep an actor alive across isolates. That is durability. It answers: if this process dies, can this workflow continue?

Operational state is what the agent is: memory, the chunks it is conditioning on, MCP server list and tokens, filesystem scratch, adapter config (OpenClaw vs Claude vs OpenAI), system prompt version, and the policy decision that authorized the last tool call. That is reconstructability. It answers: if this agent is wrong, poisoned, or bound to a runtime you are leaving, can you rebuild the exact agent somewhere else?

A checkpoint is a cursor in an execution. A snapshot is a cut of the agent. Confusing them is how you pass a bake-off on "production ready" and still fail the first poisoned-tool event. MCP makes this worse, not better. Interoperability moves a tool schema. It does not move the binding, the credential, the allowlist, or the last authorized call graph.

What a Checkpointer Actually Stores

Walk a LangGraph production graph. The checkpointer serializes channel values and the superstep. Resume works. The thread continues. What it typically does not serialize as a portable cut:

• Long-term memory outside graph channels: vector stores, file-backed notes, private scratch
• Host-side tool bindings: MCP URLs, OAuth tokens, adapter env keys, Cursor or Windsurf project rules
• Working files written between nodes and never put back on a channel
• Policy context: guardrail version, human approval, identity the last side effect ran as
• Adapter identity; the graph does not know it will be replayed under a different model or SDK

Temporal is honest if you read it as a workflow engine. The history is a log of decisions, not a dump of the agent's mind. Replay after a model swap and you get a different agent on the same control path, or a history that no longer matches new activity signatures. Copilot Studio and Bedrock sessions are more explicit: the session is owned by the runtime. You resume there. You do not export a reconstructable agent and bring it up under OpenClaw on Monday.

We already treated backup as a category in why backup strategies are the new ai imperative, not as a platform feature. The mistake this quarter is letting the durability row in the RFP stand in for that category. Durability keeps the run alive. Reconstructability lets you choose the run.

Reconstructability as a Bake-Off Row

If you are scoring LangGraph, Copilot Studio, Bedrock Agents, OpenClaw, and Temporal or Restate this quarter, add a row the vendors will not volunteer.

After each of these, can you restore the exact agent, independently of the runtime that was executing it?

1. Poisoned tool. An MCP server returns hostile content. You need the agent as it existed before that server was trusted. Resuming the last checkpoint continues the contamination.
2. Bad action. Control-flow rewind without operational-state rewind re-attempts the same action with the same memory.
3. Model swap. Durability replay is model-coupled. Reconstructability loads a snapshot onto a new adapter and lets you decide what to replay.
4. Adapter change. OpenClaw to Claude to OpenAI. If the snapshot is not vendor-neutral, you are migrating a corpse.

Score four questions. Yes or no. No marketing language.

reconstructability:
  rpo_operational_state: "<wall-clock staleness of memory, bindings, files, policy>"
  independent_of_runtime: yes # without the original checkpointer / Durable Object / Copilot session
  adapter_portable: yes       # loads under a different adapter
  policy_context_in_cut: yes  # includes why the last action was allowed

If independent_of_runtime means "resume the thread," that is crash recovery, not a restore plane. That is also your ai infrastructure has a single point of failure youre not monitoring when session state exists only inside the runtime. Durability concentrates that ownership. Reconstructability refuses it.

What You Should Do This Planning Cycle

Do not rip out LangGraph or Temporal. Use them as a control-flow durability layer. Then refuse to let that layer absorb restore.

1. Split the scorecard. Durability and reconstructability are two rows. Collapse them and you fail the evaluation, not the vendor.
2. Define the cut. Inventory memory stores, MCP bindings, credentials, working directories, adapter config, policy decisions. If it is not in the cut, it is not restorable.
3. Demand a restore drill that changes the runtime. Snapshot. Kill the original graph, session, or Durable Object. Restore onto a different adapter. If that is science fiction, you have happy-path resume, not reconstructability.
4. Set RPO on operational state. A 30-second checkpointer with a 24-hour memory export is a 24-hour agent RPO and a misleading dashboard.
5. Keep the snapshot format outside the runtime. A Temporal history or LangGraph checkpoint blob couples restore to the execution engine. That coupling is the lock-in.

H2 2026 is when "durable agent" lands in reference architectures. Once that language is the production bar, reconstructability becomes optional, and you spend the next year resuming graphs you cannot rebuild.

SaveState's job on that scorecard is the snapshot row: a vendor-neutral cut of agent config and operational state you can restore across adapters (OpenClaw, Claude, OpenAI, Cursor, Windsurf), independent of whichever runtime happened to be executing. Use it, or build the equivalent yourself.

If you are in a vendor meeting this week, ask one question and wait: after a poisoned tool, can you restore the exact agent without this runtime? Score the answer as a primitive, not a feature checkbox.