docs(nix): clarify style rules

src/skills/style/nix/rules/dotfiles.md

@@ -16,23 +16,29 @@ Run this command to list window classes from the running compositor:
 hyprctl clients -j | jq -r '.[].class' | sort -u
 ```
 
-## Separate guest wiring from host deployment
+## Separate guest wrappers from service modules
 
 ### Rule
 
-Keep guest modules host-agnostic.
+Make each guest module a wrapper around its service module.
+Enable the service module through `guests.<name>.interior`.
+Keep service configuration in `modules.services.<name>`.
+Use the guest module to pass paths and secret files to the service module.
+Use the guest module to configure bind mounts, resource limits, and registry entries.
+Keep guest modules independent of hosts.
 Put host paths, served volumes, guest addresses, and routes in host configuration.
 
 ### Rationale
 
-Guest modules support multiple hosts.
+Service modules support a service without guest infrastructure.
-Host configuration owns deployment-specific infrastructure choices.
+Guest modules adapt a service module to a guest.
+Host configuration provides deployment-specific values.
 
 ## Decrypt guest secrets on the host
 
 ### Rule
 
-Set the owner of a guest secret decrypted by the host to a host user.
+Set the secret's owner to a host user before SOPS decrypts it.
 Give the guest service group read access through a read-only bind mount.
 
 ### Rationale

src/skills/style/nix/rules/general.md

@@ -26,8 +26,7 @@ The utility centralizes Nix file-name normalization.
 
 ### Rule
 
-Call library functions as `lib.<function>`.
+Keep library functions qualified as `lib.<function>`.
-Do not import individual functions with `inherit (lib)`.
 
 ### Rationale