docs(nix): clarify dotfiles style rules

src/skills/style/nix/rules/dotfiles.md

@@ -1,41 +1,39 @@
-## Register desktop window icons
+## Register window icons
 
 ### Rule
 
-Register each graphical desktop application in `registry.window-icon`.
+When adding a graphical application, register its window-class match and rendered icon in `registry.window-icon`.
-Match the entry to the window class.
-Store the icon as its rendered string.
 
 ### Rationale
 
-The Hyprland workspace indicator uses the registry to replace its default glyph.
+Hyprland uses this registry to render workspace icons for open application windows.
 
 ### Examples
 
-List active window classes with:
+Run this command to list window classes from the running compositor:
 
 ```bash
 hyprctl clients -j | jq -r '.[].class' | sort -u
 ```
 
-## Separate guest wiring from deployment configuration
+## Separate guest wiring from host deployment
 
 ### Rule
 
-Keep guest modules host agnostic.
+Keep guest modules host-agnostic.
 Put host paths, served volumes, guest addresses, and routes in host configuration.
 
 ### Rationale
 
-A guest module supports multiple hosts.
+Guest modules support multiple hosts.
-Host configuration owns each deployment's infrastructure choices.
+Host configuration owns deployment-specific infrastructure choices.
 
 ## Decrypt guest secrets on the host
 
 ### Rule
 
-Set the owner of a host-decrypted guest secret to a host user.
+Set the owner of a guest secret decrypted by the host to a host user.
-Grant guest services access with a shared group and a read-only guest mount.
+Give the guest service group read access through a read-only bind mount.
 
 ### Rationale