docs: record the autofill activities' Compose UI in the spec

The autofill activities cannot join MainActivity's graph, so they keep
opening the PGP key import through the setup intent; the spec and the
ponytail note no longer promise otherwise. The spec gains an Autofill
section.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2 files changed, 21 insertions, 3 deletions

diff --git a/app/src/main/java/app/passwordstore/ui/main/MainActivity.kt b/app/src/main/java/app/passwordstore/ui/main/MainActivity.kt
index 75062f6b..a381ca84 100644
--- a/app/src/main/java/app/passwordstore/ui/main/MainActivity.kt
+++ b/app/src/main/java/app/passwordstore/ui/main/MainActivity.kt
@@ -263,8 +263,9 @@ class MainActivity : BaseGitActivity() {
      * missing key). Leaving that screen finishes the instance; the PGP keys screen sets RESULT_OK
      * once a key was imported.
      */
-    // ponytail: a second instance instead of in-graph navigation, until step 7 moves autofill
-    // into the graph and the git operations' dialogs become Compose dialogs.
+    // ponytail: a second instance instead of in-graph navigation. Autofill's activities stay
+    // outside the graph for good (the autofill service starts them); the git operations' "No SSH
+    // key" dialog could navigate in-graph once it becomes a Compose dialog.
     fun setupIntent(context: Context, start: SetupStart): Intent =
       Intent(context, MainActivity::class.java).putExtra(EXTRA_SETUP, start.name)
   }
diff --git a/docs/superpowers/specs/2026-11-02-compose-ui-overhaul-design.md b/docs/superpowers/specs/2026-11-02-compose-ui-overhaul-design.md
index b3d0f0cd..3282c270 100644
--- a/docs/superpowers/specs/2026-11-02-compose-ui-overhaul-design.md
+++ b/docs/superpowers/specs/2026-11-02-compose-ui-overhaul-design.md
@@ -66,7 +66,8 @@ the maintainer's phone stays on 0.1.4 until then.
   `pass init <key ID>` does), and imports the key a store needs: after a clone that no
   imported key can decrypt, and when an entry is opened with no key imported.
 - Settings opens these within the graph. Autofill, the git operations' "No SSH key" dialog and
-  the entry view's key import open them through a `MainActivity` setup intent until step 7.
+  the entry view's key import open them through a `MainActivity` setup intent: the autofill
+  activities live outside the graph, and the other two wait for a result.
 
 ### Settings
 
@@ -82,6 +83,22 @@ the maintainer's phone stays on 0.1.4 until then.
 - The list's sort orders are folders first and recently used; "files first" and "type
   independent" are gone, and stored values fall back to folders first.
 
+### Autofill
+
+- The autofill service's activities keep their windows (floating picker and warning, transparent
+  decryption) and draw them with the shared theme. The picker shows the site or app being filled,
+  a search prefilled with it, entry rows named by their origin identifier, and the
+  phishing-resistant search, match and clear-matches switches.
+- The publisher warning offers "Keep Autofill disabled" first; re-enabling stays behind "Advanced
+  information", which shows the package and certificate details above the "Re-enable Autofill"
+  button, so a double tap cannot re-enable autofill. Touches through another app's window are
+  ignored.
+- The decryption shows only the "no keys" and passphrase dialogs and starts once the window has
+  focus. It caches only a passphrase the user typed, and only after a successful screen lock
+  prompt, as the entry view does. An invalid `.gpg-id` closes it without filling. Saving and
+  generating host the editor.
+- Intents, extras, results and matching are unchanged.
+
 ## Architecture
 
 ### Activities