copilotkit 4.9.60 → 4.10.1

package/onboarding/prompts/proof/complete.md

@@ -46,6 +46,8 @@ The handoff must include:
 - The `@copilotkit/*` versions this conversion changed, and what they were before.
 - On a conversion, the criterion this run was judged against, in the words the run was
   given.
+- The Learning Container this run settled, or the fact that Learning is not available to
+  this organization and no container was created.
 - Any path this run created that git does not ignore, and what to do with each.
 - Any protected path this run accepted as changed from outside it, and what changed. The
   command at the end of this prompt prints each one, so copy them from its output rather
@@ -64,11 +66,22 @@ Name the debugging surface this journey's frontend can reach, rather than the on
 of the documentation leads with. For a web frontend it is the CopilotKit Inspector. For
 React Native there is no Inspector: it is a browser overlay built on a DOM custom element,
 and `@copilotkit/react-native` does not ship it. Give a mobile developer
-`npx --yes copilotkit@4.9.60 verify --round-trip`, the runtime's own log, the AG-UI
+`npx --yes copilotkit@4.10.1 verify --round-trip`, the runtime's own log, the AG-UI
 Event Inspector in the CopilotKit VS Code extension, and the Intelligence thread view
 instead. Naming the Inspector to a developer who cannot open it costs them the time it
 takes to conclude their own wiring is broken.
 
+Where this run settled a Learning Container, tell the developer what happens next, because
+a correct run looks like a broken one otherwise. Learning runs on its own: the first
+automatic run needs new threads from 15 distinct conversations in this container, and only
+the newest snapshot of each thread counts. A thread takes its container before its first
+agent run, so threads that ran before this change are never pulled in. The container starts
+empty on purpose.
+
+Where the Learning step was skipped because this organization cannot use Learning, say so in
+one line and name what was not created. A skip nobody names reads as a container that
+exists, and the developer then waits for insights from a container this run never made.
+
 State that the servers remain running after proof.
 
 Report each thing that slowed this run down. Send at most four reports, worst first. Run
@@ -76,7 +89,7 @@ the friction commands without another developer question. The CLI telemetry gate
 whether the report is sent.
 
 ```text
-npx --yes copilotkit@4.9.60 onboard friction --category <slug> --cost-seconds <seconds>
+npx --yes copilotkit@4.10.1 onboard friction --category <slug> --cost-seconds <seconds>
 ```
 
 Write one or two sentences on the command's standard input. Pick one category from
@@ -88,7 +101,7 @@ Pass --docs-path only for a docs-missing or docs-wrong report, naming the page t
 is about:
 
 ```text
-npx --yes copilotkit@4.9.60 onboard friction --category docs-wrong --cost-seconds 300 --docs-path /docs/threads/drawer
+npx --yes copilotkit@4.10.1 onboard friction --category docs-wrong --cost-seconds 300 --docs-path /docs/threads/drawer
 ```
 
 Give the page's site-relative path or its full URL, with no spaces, query string, or
@@ -105,14 +118,14 @@ Tell the developer when you send a friction report. Do not quote or summarize th
 unless the developer asks. If the CLI says the report was not sent,
 state what it said and continue without another question.
 
-When the evidence is gathered, run `npx --yes copilotkit@4.9.60 onboard complete`, carrying
+When the evidence is gathered, run `npx --yes copilotkit@4.10.1 onboard complete`, carrying
 the surface-check outcome the proof subagent returned. Pass exactly one flag, and pass the
 one that matches this journey's surface.
 
 For a web frontend -- React SPA, Next.js, Angular, Vue:
 
 ```text
-npx --yes copilotkit@4.9.60 onboard complete --visual-check <outcome>
+npx --yes copilotkit@4.10.1 onboard complete --visual-check <outcome>
 ```
 
 The outcome is one of `performed`, `skipped-no-browser-tool`, or `failed`.
@@ -120,7 +133,7 @@ The outcome is one of `performed`, `skipped-no-browser-tool`, or `failed`.
 For React Native:
 
 ```text
-npx --yes copilotkit@4.9.60 onboard complete --device-check <outcome>
+npx --yes copilotkit@4.10.1 onboard complete --device-check <outcome>
 ```
 
 The outcome is one of `performed`, `skipped-no-device`, or `failed`.
@@ -132,7 +145,7 @@ browser-origin CORS, so the flag you pass is how this run states which surface i
 For a web frontend, also pass the URL the browser opened:
 
 ```text
-npx --yes copilotkit@4.9.60 onboard complete --visual-check <outcome> \
+npx --yes copilotkit@4.10.1 onboard complete --visual-check <outcome> \
   --frontend-url <the url you opened>
 ```
 
@@ -151,7 +164,7 @@ If the round trip proved and something after it still blocked this run, add `--b
 to the same command:
 
 ```text
-npx --yes copilotkit@4.9.60 onboard complete --visual-check performed --blocked-by <cause>
+npx --yes copilotkit@4.10.1 onboard complete --visual-check performed --blocked-by <cause>
 ```
 
 The cause is one of `inspector` for a debugging surface that did not open,

package/onboarding/prompts/proof/oss-baseline.md

@@ -1,7 +1,7 @@
 # Prove the existing OSS baseline
 
 Do not prove the baseline yourself. Spawn one proof subagent. Tell it to run
-`npx --yes copilotkit@4.9.60 onboard read subagent/prove-oss-baseline` first and follow the
+`npx --yes copilotkit@4.10.1 onboard read subagent/prove-oss-baseline` first and follow the
 prompt it returns. If that read fails because the subagent cannot use the shell, stop that
 subagent. Run the same command yourself, then spawn a fresh subagent with the returned prompt
 and the same handoff. Give it the repository findings and exact CLI package spec.
@@ -17,7 +17,7 @@ Wait for the subagent to finish.
 Record what that proof returned before you route on it:
 
 ```text
-npx --yes copilotkit@4.9.60 onboard proof --step oss-baseline --outcome <passed|failed|skipped> [--predicate <1-6>]
+npx --yes copilotkit@4.10.1 onboard proof --step oss-baseline --outcome <passed|failed|skipped> [--predicate <1-6>]
 ```
 
 Report the gate whatever it returned. Pass `passed` when the subagent proved a predicate,
@@ -35,12 +35,12 @@ Do not change project files before this proof ends. Starting existing developmen
 processes and their ignored runtime files is allowed.
 
 If the subagent proves the `both-oss` predicate, keep its evidence with the plan and run
-`npx --yes copilotkit@4.9.60 onboard read conversion/plan`. That project already works.
+`npx --yes copilotkit@4.10.1 onboard read conversion/plan`. That project already works.
 What it needs is the conversion, not a build.
 
 If the proof does not establish the baseline, record the starting state
 `both-copilotkit-unproved` and run
-`npx --yes copilotkit@4.9.60 onboard read credentials/plan`. This prompt is served
+`npx --yes copilotkit@4.10.1 onboard read credentials/plan`. This prompt is served
 whenever a project looks like an OSS integration, so a baseline that did not prove is an
 ordinary starting state rather than a failure. Keep the failing predicate with the plan.
 
@@ -54,4 +54,5 @@ and the plan preserves it rather than repeating it.
 
 If it cannot identify the running process safely, exposes a secret, or finds a baseline
 failure that cannot be classified, run
-`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.10.1 onboard read stopped/run-failed`. None of those mean the
+project is unsupported: they mean this run did not establish what it needed to.

package/onboarding/prompts/proof/round-trip.md

@@ -1,7 +1,7 @@
 # Prove the user journey
 
 Do not do the proof work yourself. Spawn one proof subagent. Tell it to run
-`npx --yes copilotkit@4.9.60 onboard read subagent/prove-round-trip` first and follow the
+`npx --yes copilotkit@4.10.1 onboard read subagent/prove-round-trip` first and follow the
 prompt it returns. If that read fails because the subagent cannot use the shell, stop that
 subagent. Run the same command yourself, then spawn a fresh subagent with the returned prompt
 and the same handoff. Give it the selected framework, frontend, model, approved plan, selected
@@ -14,6 +14,15 @@ drives the surface and cannot see your environment, so without that finding it s
 step discovering what you already know. A subagent told it has no control for the surface
 this frontend needs reports the skip outcome rather than looking for a way around it.
 
+A run that cloned a starter is the exception. Tell that subagent to stop after
+`verify --round-trip` and to open no browser. The cloned code is what this repository's
+starter smoke jobs already drive on every change, so opening a browser re-proves in the
+developer's run what those jobs prove before the starter ships, and it is the most
+expensive step in this setup. `verify --round-trip` reads the answer back off the thread,
+so it holds for every runtime mount and needs no browser. Give that subagent no browser or
+device control, and record the surface outcome as skipped for a cloned starter rather than
+as a missing capability: nothing was unavailable, the run declined to spend it.
+
 Give the subagent this guide for continued-development tools:
 https://docs.copilotkit.ai/build-with-agents.md
 
@@ -23,13 +32,13 @@ pass the time.
 Report each attempt at the journey as it ends, counting from one:
 
 ```text
-npx --yes copilotkit@4.9.60 onboard checkpoint --phase journey-attempted --attempt 1
+npx --yes copilotkit@4.10.1 onboard checkpoint --phase journey-attempted --attempt 1
 ```
 
 Record what that proof returned before you route on it:
 
 ```text
-npx --yes copilotkit@4.9.60 onboard proof --step round-trip --outcome <passed|failed|skipped>
+npx --yes copilotkit@4.10.1 onboard proof --step round-trip --outcome <passed|failed|skipped>
 ```
 
 Report the gate whatever it returned. A proof that never ran is `skipped`, not failed. The
@@ -37,7 +46,7 @@ command prints one line and sends nothing else. Where a repair cycle runs the pr
 record each attempt as it ends.
 
 For every protected-path audit in this prompt, run
-`npx --yes copilotkit@4.9.60 onboard audit` from the target app directory. If its result
+`npx --yes copilotkit@4.10.1 onboard audit` from the target app directory. If its result
 starts with `Status: blocked`, report the printed reason and use the route-out rules below.
 A blocked audit proved nothing changed and is not a preservation failure. If a
 protected-path audit reports a changed path, decide it the way the implementation prompt
@@ -46,7 +55,7 @@ returns none, so a finding with no Files changed section to test against routes
 path one of those sections names is this run's own change and routes out too. Accept a
 path only when a section this run collected covers the step that wrote it and does not
 name it:
-`npx --yes copilotkit@4.9.60 onboard protect --accept-external --path <path>`. Then run
+`npx --yes copilotkit@4.10.1 onboard protect --accept-external --path <path>`. Then run
 the audit again and name the path in the closing summary. Never repair, reset, or revert a
 protected path.
 
@@ -54,12 +63,12 @@ That holds for a repair cycle too. When the fix for a failing check lands on a p
 path, the path is still the developer's, however right the diagnosis is and however small
 the fix. Reading the file never settles who wrote it. Ask the developer to allow the
 change, and record their answer with
-`npx --yes copilotkit@4.9.60 onboard protect --authorize --unplanned --path <path> --reason "<what the developer said>"`,
+`npx --yes copilotkit@4.10.1 onboard protect --authorize --unplanned --path <path> --reason "<what the developer said>"`,
 or route out. Never repair it, and never send it to a repair worker.
 
 If the proof result starts with `Status: passed`, run the protected-path audit. Continue to
 `proof/complete` only if that audit passes. After the audit passes, run
-`npx --yes copilotkit@4.9.60 onboard read proof/complete`. A performed surface outcome with
+`npx --yes copilotkit@4.10.1 onboard read proof/complete`. A performed surface outcome with
 the full round trip is core success even if a continued-development tool fails. A skipped
 surface outcome still enters `proof/complete` so the CLI records the blocked result. Do not
 describe a skipped surface as proved. Keep the Skills and MCP results separate from the proof
@@ -115,7 +124,7 @@ Restart each project-owned process changed by the repair. Report the cycle, coun
 one:
 
 ```text
-npx --yes copilotkit@4.9.60 onboard checkpoint --phase repair-attempted --attempt 1
+npx --yes copilotkit@4.10.1 onboard checkpoint --phase repair-attempted --attempt 1
 ```
 
 Then spawn a fresh proof subagent
@@ -133,21 +142,25 @@ and proof cycles.
 
 Route out only when the failure is not yours to fix, when the same proof still fails after
 three attempts, or when no evidence of the round trip can be produced. In those cases run
-`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`. All three are
+`npx --yes copilotkit@4.10.1 onboard read stopped/run-failed`. The stack is supported:
+this run did not finish, which is a different ending and a different report. All three are
 about the round trip itself. A round trip that proved is not one of them, whatever failed
 after it.
 
 If you stop here without taking that route -- a repair cycle you cannot finish, a limit in
 your own harness, a run that has run out -- send one short report before you stop.
-Run the feedback command without another developer question. The CLI telemetry gate decides
+Run the friction command without another developer question. The CLI telemetry gate decides
 whether the report is sent.
 
 ```text
-npx --yes copilotkit@4.9.60 onboard feedback
+npx --yes copilotkit@4.10.1 onboard friction --phase stop --category <slug>
 ```
 
-Write at most four lines to standard input: the step you stopped at and what stopped it.
+Write one or two sentences to standard input: the step you stopped at and what stopped it.
+Pick the category that fits from docs-missing, docs-wrong, docs-sequential, cli-gap,
+sdk-gap, environment, port-collision, credential, validation-loop, and other. Leave
+--cost-seconds off. A run that stopped cannot separate one papercut's cost from the cost
+of the whole run, so the estimate is optional on a stop report and only there.
 Send no secrets, source code, logs, or command output. The command refuses a report that
 carries any of those, prints the reason, and exits zero. A refused report is not a failed
-step. Report friction only from a run that finished, never from a stop. A run that dies in
-this phase is the one this graph most needs to hear about and the one it hears from least.
+step. A run that dies in this phase is the one this graph most needs to hear about and the one it hears from least.

package/onboarding/prompts/research/gather.md

@@ -0,0 +1,121 @@
+# Gather the evidence this run routes on
+
+Sign-in is settled. This phase inspects the project and proves what this environment can
+drive. Do not change application code here, and do not ask the developer a setup question
+yet: every read-only investigation finishes first.
+
+## How to wait for a subagent
+
+This rule covers every subagent this run spawns, here and in every later prompt.
+
+Spawning a subagent returns almost at once. That return is the dispatch succeeding, not the
+work finishing: the subagent runs in the background, and its result reaches you as a
+notification. Where your own harness hands you the report from the dispatch itself instead,
+you already hold the result. Either way there is nothing to poll.
+
+After you dispatch, do the work that does not depend on the result -- dispatch the other
+subagent, run the preflight below -- and then stop and wait. Wherever a prompt in this graph
+says to wait for a subagent to finish, that is what it means.
+
+Do not sleep to pass the time. Not `sleep`, not `/bin/sleep`, not a timer under another
+name, and not a loop that re-checks whether a result has arrived. Sleeping tells you nothing
+that waiting for the result does not, and it spends wall clock, which is one of the things
+this journey is measured on. One recorded run spent most of two hours asleep between
+dispatches that had all returned in seconds.
+
+Before you ask the developer any setup question, finish every read-only investigation and
+preflight check in this section.
+
+Prepare two research assignments. Give each research subagent one assignment. Tell it to run
+`npx --yes copilotkit@4.10.1 onboard read subagent/inspect-repository` first and follow the
+prompt it returns. If that read fails because the subagent cannot use the shell, stop that
+subagent. Run the same command yourself, then spawn a fresh subagent with the returned prompt
+and the same handoff. Require only its assigned packet.
+
+Start both research subagents in parallel:
+
+1. Spawn one research subagent. Assign it the project evidence packet.
+2. Spawn a second research subagent. Assign it the environment evidence packet.
+3. Start both research subagents. Then continue.
+
+Continue to the surface-control preflight.
+
+Prove whether your coding-agent environment has browser or device control. Do not assume it
+either way, and do not report what you expect to be true: a run that guesses here records a
+capability every later step then trusts. Use a browser or device tool already
+configured for the coding agent you are running as, the same way a later step uses the
+CopilotKit documentation server. With a browser tool, open one inert page such as
+`about:blank` and read its title. With a device tool and no browser, list the booted devices
+in one command: `adb devices -l`. Record the outcome of that attempt: `available` when the
+tool answered, `unavailable` when there was none to call or the page did not open. Use
+the control that matches the selected surface later.
+
+Where the browser probe answered, register nothing. The harness came equipped and the run
+owes it no setup.
+
+Where no browser tool answered, register one for the coding agent you are running as, then
+run the same probe again and record what the second attempt did. Register this server:
+
+```text
+npx --yes @playwright/mcp@latest --browser chrome --isolated --output-dir <project>/.copilotkit/proof/browser
+```
+
+Replace `<project>` with the absolute path of the target project directory. The server is
+registered against the coding agent rather than against a directory, so a relative path here
+resolves wherever that server happens to start.
+
+`--browser chrome` drives the Google Chrome the developer already has, so this downloads no
+browser. `--isolated` keeps the profile in memory, so it never touches their own Chrome
+profile. `--output-dir` is what keeps the snapshots and screenshots out of the developer's
+repository root: without it this server writes them to `.playwright-mcp/` beside their code,
+which a project that never asked for a browser has no reason to carry, and which this setup's
+own evidence rule already has a place for. Register it the way your own harness registers a
+server, which is the mechanism a later step uses for the CopilotKit documentation server.
+
+Tell the developer in one line what you registered, that it drives their installed Chrome,
+and that it lives in this coding agent's configuration rather than in their repository. Do
+not ask them to approve it, and do not ask a second question about it.
+
+Do not add a browser or device driver to the project. A driver added there is a
+devDependency and a browser download in the diff of a repository that never asked for one,
+which is a different thing from a server registered against the coding agent.
+
+Where the second probe still does not answer -- no Chrome to drive, no network, or a
+harness that cannot register a server -- record `unavailable` and carry it. Do not keep
+trying, and do not ask the developer about this tool limit.
+
+Registering a server does not boot a device. Where the device probe found none, that is the
+whole finding, and a browser is not a substitute for a device.
+
+Wait for both research subagents to finish.
+
+Then report that the research came back:
+
+```text
+npx --yes copilotkit@4.10.1 onboard checkpoint --phase research-returned
+```
+
+A refused checkpoint prints its reason and leaves onboarding unaffected. It is not a
+failed step.
+
+Continue only if both research results start with `Status: passed`. For `Status: failed`,
+retry only that packet with its failed items, up to three attempts. For `Status: blocked`,
+or a third failed result, use the stop route at the end of this prompt.
+
+Merge both evidence packets by item. On a conflict, spawn one fresh read-only verifier with
+the item, both cited findings, and the research limits. Require its result to start with
+`Status: passed`, `Status: failed`, or `Status: blocked`. Use only a passed cited result. Do
+not inspect the project to settle the conflict yourself. Use the stop route for a non-pass
+verifier result.
+
+Match environment evidence to the target app directory from the project packet. Require one
+target app directory and one matching environment row. If either packet gives no match or
+more than one match, send each research worker a focused directory check. Continue only when
+both workers return the same one target app directory. Both results must start with
+`Status: passed`. Otherwise, use the stop route.
+
+When both research results are merged, run
+`npx --yes copilotkit@4.10.1 onboard read research/route`.
+
+If inspection stops onboarding, run
+`npx --yes copilotkit@4.10.1 onboard read stopped/run-failed`.

package/onboarding/prompts/research/route.md

@@ -0,0 +1,81 @@
+# Capture the baseline and route on the findings
+
+The merged research findings are in hand. This phase captures the protected-path baseline
+before anything is written, checks that the findings answer what the route needs, and
+sends the run down one path.
+
+## Capture the protected-path baseline
+
+Before you route on, run this from the target app directory:
+
+```text
+npx --yes copilotkit@4.10.1 onboard protect
+```
+
+It reads the working tree itself, records every changed or untracked path with a digest,
+and prints the list. Require its result to start with `Status: passed`.
+
+Use the printed list as the protected path list for the rest of the run. Do not assemble
+that list yourself, and do not ask a subagent to hold it: every later audit reads the
+captured baseline back from the CLI, so no step depends on a subagent that has since
+finished.
+
+Paths printed as `deferred` are the ones onboarding itself writes, `.env` and
+`.copilotkit/project.json`. Every audit reports them and none fails on them until the step
+that writes them re-captures them, so a run whose only untracked files are the two this
+graph exists to create is never stopped by them.
+
+If the result starts with `Status: blocked`, report the printed reason and use the stop
+route at the end of this prompt.
+
+## What the merged findings must contain
+
+If a repository file exists, each finding must cite it. For an empty project, the subagents
+must cite the directory check and report absent parts.
+
+The findings must cover what the project is for, the agent, frontend, CopilotKit setup,
+authentication, credential names, and validation path. Do not ask the developer for facts
+that the repository answers.
+
+## Route on the merged findings
+
+Read the route off the merged findings. Three of them decide it, and you already hold all
+three:
+
+1. an agent is present,
+2. a frontend is present,
+3. a CopilotKit integration is present.
+
+Do not infer a working OSS path from packages, imports, project files, or keys, and do not
+settle these three from your own reading of the project. Each one comes from the merged
+packets or it is not proved.
+
+If all three are proved, prove the live starting state before any project file changes. Run
+`npx --yes copilotkit@4.10.1 onboard read proof/oss-baseline`.
+
+Route there before you ask the developer anything else. The questions after this prompt
+select a framework and a frontend that the findings already name, so a developer who
+answers them has answered for work the next node exists to check. Their existing
+application is what that node protects. Whether it works is what the proof decides, not
+these three findings.
+
+For every other combination of the three, take one more step first. If neither the
+developer nor the repository findings prove what the project is for, ask one guided
+question about the user outcome. This asks what the developer wants to build before you
+select a framework. Give two or three short examples and offer a minimal starter. Record
+the answer and give it to each later subagent. Then run
+`npx --yes copilotkit@4.10.1 onboard read credentials/plan`.
+
+Do not ask that question on the route above. A project carrying all three states its
+purpose in the application it already serves.
+
+Do not ask it when the target directory holds no project either. A greenfield run clones a starter
+the CLI ships, and that starter arrives carrying a working application of its own. The
+answer cannot change which starter lands, because the starter follows from the framework
+and frontend the developer selects next. Asking spends a turn on a decision the run has
+already made, and then names a purpose the cloned code does not serve. Take the same read
+named above without asking, and let the starter state the domain.
+
+If authentication or inspection stops onboarding, run
+`npx --yes copilotkit@4.10.1 onboard read stopped/run-failed`. Neither says anything
+about whether this project's stack is supported, which is not yet known at this point.

package/onboarding/prompts/starter/clone.md

@@ -1,8 +1,11 @@
 # Clone a starter
 
 Use this shortcut only when the repository findings prove that the target project
-directory contains no entries. If the directory contains a file or directory, do not use
-this shortcut.
+directory holds no project yet: no source directory such as `src/`, `app/`, `agent/` or
+`web/`, no dependency manifest such as `package.json` or `pyproject.toml`, and no `.env`.
+A directory that holds only a Git repository, a coding agent's own configuration, editor
+settings or scratch notes still qualifies. Those are not a project, and `git init` is the
+marker this CLI anchors a run on, so it cannot also be the thing that disqualifies one.
 
 Match the selected agent framework and frontend to this table:
 
@@ -43,7 +46,7 @@ the derived name.
 Only if the developer asks for an existing project, or asks to see the projects they have,
 read the choices:
 
-`npx --yes copilotkit@4.9.60 project list --json`
+`npx --yes copilotkit@4.10.1 project list --json`
 
 Then ask which one to use. Do not order the projects by creation time. If the developer
 already gave this answer, do not ask again. Do not read a secret value. Do not show or
@@ -53,7 +56,7 @@ Run the command from the parent directory. Do not inspect another entry in the p
 directory. Replace each placeholder with the recorded value. Do not run a placeholder as
 a shell argument.
 
-`npx --yes copilotkit@4.9.60 init --name <project-name> --framework <framework-id> --channel none --no-banner --create <name> --install`
+`npx --yes copilotkit@4.10.1 init --name <project-name> --framework <framework-id> --channel none --no-banner --create <name> --install`
 
 Pass the confirmed name to both `--name` and `--create`: the app directory and its
 Intelligence project take the same name here. If the developer names an existing project,
@@ -66,17 +69,23 @@ The command clones the starter into the empty target directory. It also connects
 starter to the developer's Intelligence project. The earlier login phase supplies the
 account. The command does not need terminal input.
 
-If the command succeeds, do not rebuild the starter by hand. Report the clone first:
+Report the clone before you inspect anything:
 
 ```text
-npx --yes copilotkit@4.9.60 onboard checkpoint --phase starter-cloned
+npx --yes copilotkit@4.10.1 onboard checkpoint --phase starter-cloned
 ```
 
-Then inspect only the generated
+This is its own step, not an aside. A run that clones and then goes quiet is
+indistinguishable from a run that never cloned, and the checkpoint is the only thing that
+separates them.
+
+Do not rebuild the starter by hand. Then inspect only the generated
 paths inside the target directory. Record the files, install result, project connection,
 and validation commands. Then run
-`npx --yes copilotkit@4.9.60 onboard read proof/round-trip`.
+`npx --yes copilotkit@4.10.1 onboard read proof/round-trip`.
 
 If the command fails, report its exact error and do not claim that the starter is ready.
 Then run
-`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.10.1 onboard read stopped/run-failed`. The starter is one this
+graph ships and the stack was chosen from its own supported list, so a command that
+returned an error is a run that broke, not a setup this release does not support.

package/onboarding/prompts/stopped/run-failed.md

@@ -0,0 +1,44 @@
+# Stop because the run did not finish
+
+This is the ending for a run that broke. The developer's agent, frontend and package
+choices are supported. Something in this run stopped it, and that is what the report has
+to say.
+
+Do not tell the developer their setup is unsupported. It is not, and a run that says so
+sends them to change a stack that was never the problem.
+
+Keep the developer's current agent, frontend, authentication, and package choices.
+
+Name the exact step that stopped the run, and what it returned. State whether
+authentication, project selection, project credentials, the journey, implementation,
+validation, or the round trip stopped it. Give the failure in the words the step printed,
+not a summary of them.
+
+If a protected path stopped this run, name that path and how it changed, in the words the
+audit printed. A report that says only that protected files changed cannot be acted on:
+nobody reading it can tell which file moved, or whether this run or the developer moved
+it.
+
+Say what the developer has now. Name the processes still running and the files this run
+changed, so they can carry on by hand or start again from a known state. A run that stops
+without saying what it left behind leaves the developer to discover it.
+
+Stop onboarding without making more repository changes.
+
+Send one short report. Run the friction command without another developer question. The
+CLI telemetry gate decides whether the report is sent.
+
+```text
+npx --yes copilotkit@4.10.1 onboard friction --phase stop --category <slug>
+```
+
+Write one or two sentences to standard input: the step you stopped at and what stopped
+it. Pick the category that fits from docs-missing, docs-wrong, docs-sequential, cli-gap,
+sdk-gap, environment, port-collision, credential, validation-loop, and other. Leave
+--cost-seconds off. A run that stopped cannot separate one papercut's cost from the cost
+of the whole run, so the estimate is optional on a stop report and only there.
+Send no secrets, source code, logs, or command output. The command refuses a report that
+carries any of those, prints the reason, and exits zero. A refused report is not a failed
+step. Reword it and send it again, or stop without a report. The command prints what it
+sent. This is the channel for a stop. If the CLI says the report was not sent, state what
+it said and stop without another question.

package/onboarding/prompts/subagent/create-plan.md

@@ -23,6 +23,37 @@ SQLite, custom, or framework persistence can be durable. The two options cannot
 combined. Take the constructor from the connect-your-runtime page. Where a framework
 quickstart shows a `runner` option instead, the connect-your-runtime page wins.
 
+## Plan the Learning Container and its selector
+
+The main coding agent gives you a Learning Container id, or tells you the Learning step was
+skipped for this organization.
+
+Where it gives you an id, plan two things and name both in the plan the developer approves:
+the container id itself, and a `getLearningContainerId` callback returning that id on the
+`CopilotKitIntelligence` instance. Take the callback from the Learning page, and fetch it
+here rather than expecting the run to have handed it over:
+
+```text
+https://docs.copilotkit.ai/learning.md
+```
+
+Put the callback in the same runtime edit that connects Intelligence rather than in a step
+of its own: it is one option on the same constructor, so a separate step names a second
+change to a file the first step already changes.
+
+Name the container before the selector, and name the id in both. A container nothing routes
+to stays empty forever, so it buys a name and no learning. A selector pointing at an id the
+platform does not hold answers `LEARNING_CONTAINER_NOT_FOUND` on every thread create, which
+breaks a working chat on the next message.
+
+Per-user routing is the developer's own selector logic rather than more containers. Do not
+plan one container per end user: a project holds at most 500, the first automatic Learning
+run needs threads from 15 distinct conversations in one container, and a container per
+person needs those 15 conversations from that one person.
+
+Where the Learning step was skipped, plan no container and no selector, and say in the plan
+that Learning is not available to this organization.
+
 When the starting state is `both-oss`, use its recorded live baseline evidence. Preserve
 the working agent, frontend, CopilotKit integration, and OSS behavior. Plan the project
 selection, the CopilotKit dependency upgrade below, the Intelligence runtime
@@ -122,7 +153,7 @@ here is work the developer did not ask for.
 Plan the threads drawer itself: add it from the selected drawer page, where this frontend
 does not already render one. Where this journey's frontend framework ships no threads
 drawer -- React Native --, plan that the thread is proved by
-`npx --yes copilotkit@4.9.60 verify --round-trip`, which needs no browser. Do not plan a
+`npx --yes copilotkit@4.10.1 verify --round-trip`, which needs no browser. Do not plan a
 step that opens the managed Intelligence dashboard.
 
 ## Order the plan into steps

package/onboarding/prompts/subagent/implement-and-validate.md

@@ -110,8 +110,16 @@ project does not hold, and the rendered result looks the same either way.
 Run the full validation list. Record changed files, command results, and errors. Do not
 claim that the real user journey works in this phase.
 
+Where the plan names a Learning Container id, set `getLearningContainerId` on the
+`CopilotKitIntelligence` instance in the same edit that constructs the runtime with
+`intelligence`. Return that one id for every run. Do not add a file, a step, or a second
+constructor for it, and never write an id the plan does not name: a selector pointing at an
+id the platform does not hold answers `LEARNING_CONTAINER_NOT_FOUND` on every thread create.
+Where the plan names no container, write no selector.
+
 Report the runtime constructor you wrote. Name whether it passes `intelligence` or
-`runner`. A runtime built with `runner` is the SSE runtime and never reads the credential,
+`runner`, and whether it carries `getLearningContainerId`, with the id it returns.
+A runtime built with `runner` is the SSE runtime and never reads the credential,
 whatever the browser shows.
 
 Gather what you need in as few commands as possible. Combine independent reads into one

package/onboarding/prompts/subagent/prove-oss-baseline.md

@@ -19,7 +19,7 @@ Prove the live runtime in this order:
 4. Confirm from project files that the runtime constructor passes a `runner` option rather
    than an `intelligence` option. A package, import, project file, or key is not use proof.
 5. Run
-   `npx --yes copilotkit@4.9.60 verify --expect-runtime oss --round-trip --agent <expected-agent-id> --json`,
+   `npx --yes copilotkit@4.10.1 verify --expect-runtime oss --round-trip --agent <expected-agent-id> --json`,
    with the runtime URL or auth header options that this project needs. Require exit zero
    and the JSON `ok` field to be `true`.
 6. Drive one real request through the existing frontend, CopilotKit runtime, and expected