## Register window icons

### Rule

Each graphical application has a `registry.window-icon` entry with a window-class match and rendered icon.

### Rationale

Hyprland uses this registry to render workspace icons for open application windows.

Run this command to list window classes from the running compositor:

```bash
hyprctl clients -j | jq -r '.[].class' | sort -u
```

## Separate guest wrappers from service modules

### Rule

Each guest module wraps one service module.
The guest enables its service through `guests.<name>.interior`.
Service modules own service configuration.
Guest modules configure bind mounts, secret delivery, resource limits, and registry entries.
Host configuration supplies deployment-specific paths, volumes, addresses, and routes.

### Rationale

Service modules support a service without guest infrastructure.
Guest modules adapt a service module to a guest.
Host configuration provides deployment-specific values.

## Decrypt guest secrets on the host

### Rule

A host user owns each guest secret before SOPS decrypts it.
Each guest service group accesses its secrets through a read-only bind mount.

### Rationale

Guest service accounts do not exist on the host, where SOPS creates secrets.
The shared service group preserves read access across the guest boundary.