diff --git a/CLAUDE.md b/CLAUDE.md
index 49d01c6..94c3676 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -10,7 +10,7 @@ Personal NixOS configuration managing multiple hosts via a single flake. Each ho
 
 Defined in `flake.nix` under `nixosConfigurations`:
 
-- `fuji` — x86_64 laptop, Plasma6 + Sway, intel 13th gen, dual wireguard (one in a network namespace for ProtonVPN routed via `dnscrypt-proxy`)
+- `fuji` — x86_64 laptop, intel 13th gen, dual wireguard (one in a network namespace for ProtonVPN routed via `dnscrypt-proxy`). No desktop environment: `plasma6.enable = false`, greetd/tuigreet defaults to sway, river is offered as a second session via a hand-rolled `river-session` package. KDE *applications* (dolphin, okular, ark, kdenlive) are still installed — see the ksycoca note below.
 - `nixy` — x86_64 workstation (also builds the `nixy_iso` installer image)
 - `mediabox` — x86_64 media server (jellyfin/qbittorrent; uses the local `modules/qbittorrent.nix`)
 - `blue` — x86_64 (no sops-nix)
@@ -66,6 +66,10 @@ nix build .#nixosConfigurations.magpie.config.system.build.toplevel
 
 **Fuji's split-tunnel ProtonVPN.** `fuji/configuration.nix` builds a `wg` network namespace, brings up `proton_wg` inside it, and runs `dnscrypt-proxy_proton` bound to that namespace. Anything that should egress over Proton must be launched with `ip netns exec wg ...`. The main-host `wg0` interface is unrelated and connects to magpie for the personal mesh (`10.100.0.0/24`).
 
+**KDE apps outside Plasma need an XDG menu file.** `kbuildsycoca6` indexes only the `.desktop` files reachable from `"$XDG_MENU_PREFIX"applications.menu`; with no such file it builds a ksycoca containing zero applications, and every KIO consumer silently degrades — Dolphin stops honouring default handlers and its "Open With" chooser comes up empty. Plasma used to supply both halves (`XDG_MENU_PREFIX=plasma-` plus `plasma-applications.menu`); sway/river set no prefix, so `fuji/configuration.nix` installs `environment.etc."xdg/menus/applications.menu"` from `plasma-workspace` (already in the closure via the KDE portal backend, so it costs nothing). Note that `mimeapps.list` and `mimeinfo.cache` are *not* involved — `xdg-mime query default` will look correct while Dolphin is broken, so debug this with `strings -el ~/.cache/ksycoca6_* | grep -c '\.desktop'` instead.
+
+**mimeapps.list is read-only.** Home-manager symlinks both `~/.config/mimeapps.list` and `~/.local/share/applications/mimeapps.list` into the store, so "Remember application association" in any chooser fails to persist. Add associations to `xdg.mimeApps` in `home/<host>/home.nix` instead.
+
 **Home-manager backup extension.** `backupFileExtension = "home_backup"` is set on most hosts — if a switch fails on file conflicts, look for `*.home_backup` files in `$HOME`.
 
 **Hardening already in place on fuji** (mirror to other hosts when relevant): nftables firewall, scudo allocator, AppArmor, sysctl hardening (kptr_restrict, dmesg_restrict, rp_filter, redirect blocking), `sudo.execWheelOnly`, `firewall.logRefusedConnections`, doas, firejail, no coredumps, `KillUserProcesses`, ro nix store mount, systemd-boot editor disabled.