docs(internals): record that desktop Clerk UI floats on @clerk/ui@1

[rynfar]

#108 dropped the pinned Clerk UI canary so desktop would track stable. I went to verify that and found the range had already moved underneath us, which is worth writing down rather than rediscovering later.

What's actually happening

Desktop does not bundle Clerk's UI. @clerk/electron fetches it from Clerk's CDN at runtime, and @clerk/shared builds the URL as .../npm/@clerk/ui@<version>/dist/ui.browser.js from versionSelector(__internal_clerkUIVersion, "1.30.8") — where that second argument is a fallback hardcoded inside @clerk/shared, not something Pylon sets. Pylon passes no version, so the request is @clerk/ui@1: a floating major range resolved by the CDN on every launch.

It has already drifted:

	Version	Published
Old canary pin	1.30.5-canary	08-19
What @1 meant when #108 merged (08-27 00:16)	1.30.8	08-25
What @1 resolves to now	1.31.0	08-28 18:03

@clerk/ui is not a dependency of any Pylon package, so there is no lockfile entry and nothing to bisect. A minor version reached desktop with no commit, no release, and no CI signal.

What this PR does

Documents the tradeoff we are choosing to accept — Clerk's fixes arrive automatically, at the cost of untested bumps — plus how to tell a Clerk regression from a Pylon one, the npm view '@clerk/ui@1' version check, and how to pin as a stopgap. It also records that an automatic passkey prompt on the sign-in surface is the specific regression the original upstream pin existed to prevent, so a future reader recognizes it.

Docs only, no code change.

Verification

Every claim checked against source rather than memory: the versionSelector(..., "1.30.8") call and URL shape in @clerk/shared@4.30.1, the unpinned ElectronClerkProvider in apps/web/src/main.tsx, #108's merge date, and the live npm view resolution.

Model: Claude Opus 5. Harness: Claude Code.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	−16 B (−0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−4 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−12 B (−0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.5 KiB	55.5 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	9	9	0 (0.0%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	+27 B (+0.2%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−4 B (−0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+31 B (+0.5%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.3 KiB	56.4 KiB	+44 B (+0.1%)	66.4 KiB	✅
Claude	Live turn messages	9	10	+1 (+11.1%)	21	✅

Baseline: 864f7fb · PR result: e53ff18 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.