docs: record the pinentry theming fix in MIGRATION.md

The GPG PIN dialog was the last unthemed Qt6 app. pinentry-qt links Qt6
despite the name, but gpg-agent is spawned from .bashrc and reparented to
init, so it never inherits the QT_QPA_PLATFORMTHEME that Hyprland sets for
its own children, and every pinentry it spawns fell back to Fusion.

Also restructures the document: it was headed "phase 1 (rofi)" and now
covers more than rofi, so the phase is a section rather than the title.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015gbjA2bmswN8jyPDKzrvqe

1 files changed, 39 insertions, 7 deletions

diff --git a/docs/MIGRATION.md b/docs/MIGRATION.md
index 32d36ac..2066563 100644
--- a/docs/MIGRATION.md
+++ b/docs/MIGRATION.md
@@ -1,9 +1,11 @@
-# Migration record, phase 1 (rofi)
+# Migration record
 
-Files edited outside this repository, on 2026-09-11. Backups of every file
-listed here, taken immediately before the edits, are in `/data/udt-backup/`.
+Files edited outside this repository. Backups of every file listed here, taken
+immediately before the edits, are in `/data/udt-backup/`.
 
-## Call sites repointed
+## Phase 1 (rofi), 2026-09-11
+
+### Call sites repointed
 
 | File | Was | Now |
 | --- | --- | --- |
@@ -20,7 +22,7 @@ listed here, taken immediately before the edits, are in `/data/udt-backup/`.
 | `~/bin/blackpearl-appsmenu.sh` | `darknix/appmenu.rasi` | `udt/launcher.rasi` |
 | `~/.config/rofi/launchers/type-1/launcher.sh` | `launchers/type-1/style-5` | `udt/launcher.rasi` |
 
-## Other edits
+### Other edits
 
 - `~/bin/wallp`: `finalize()` now calls `udt-accent` with
   `~/.cache/wal/wpaper`, guarded so a failure cannot stop the wallpaper being
@@ -41,14 +43,14 @@ listed here, taken immediately before the edits, are in `/data/udt-backup/`.
   drawn in the theme's own Nerd Font. They are now the Material circled check
   and close, U+F05E0 and U+F0159, which Inconsolata Nerd Font Mono contains.
 
-## Not a call site
+### Not a call site
 
 `~/bin/ddgr_search.py` was listed in the original plan but is not a call site.
 It is a rofi script-mode plugin, invoked *by* rofi rather than invoking it, so
 its appearance comes from whatever command runs it. No keybinding or waybar
 button currently does.
 
-## Removed
+### Removed
 
 All five superseded theme directories were moved to
 `/data/udt-backup/old-rofi-themes/`: `darknix/`, `elegantVagrant/`,
@@ -71,6 +73,36 @@ first and were repointed at `udt/`:
 `rofi-symbols/`. The `colors/` directory (the adi1090x palettes) has no
 remaining references and could go too.
 
+## Phase 2 (Qt), 2026-09-11
+
+`~/.bashrc`, two edits. Backup in `/data/udt-backup/`.
+
+The GPG PIN dialog was the one Qt6 app the theme never reached. It is drawn by
+`pinentry-qt`, which despite the name links Qt6, so the theme should have
+applied. It did not, because `QT_QPA_PLATFORMTHEME` never reaches it.
+
+Hyprland sets that variable with `hl.env`, which only covers processes Hyprland
+itself spawns. `gpg-agent` is not one: `.bashrc` spawns it, via the
+`gpg-connect-agent updatestartuptty` call near the end of the file, and it then
+outlives that shell reparented to init. Every `pinentry` inherits the agent's
+environment, so the dialog fell back to Qt6's built-in Fusion style.
+
+- `export QT_QPA_PLATFORMTHEME=qt6ct` added immediately **above** the
+  `gpg-connect-agent` call. The position matters: the agent captures its
+  environment when it is spawned, so an export below that line is too late.
+  The agent persists for the session, so only the first login shell decides.
+
+- `SSH_ASKPASS` repointed from `pinentry-qt5` to `pinentry-qt`. The former is
+  genuinely Qt5 and was themed by nothing.
+
+The change takes effect for an agent started after it. To apply it without
+logging out: `gpgconf --kill gpg-agent`, then any shell command that touches
+gpg. That drops the cached PIN, so the next signature prompts once.
+
+Verify with:
+
+    tr '\0' '\n' < /proc/$(pgrep -x gpg-agent)/environ | grep QT_QPA
+
 ## Out of scope
 
 `ronema` (rofi NetworkManager applet) was excluded: no longer used, pending