Renaming subject->topic wasn't enough (both email and topic still got credential autofill offers, and autocomplete=off is ignored). The three messaging inputs are now readonly until the first pointerdown/focus — managers skip readonly fields at scan time — backed up by the vendor ignore attributes (1Password/LastPass/Bitwarden).