docs: give Membrane its boundary

docs/SHELL-SURFACES.md

@@ -9,15 +9,15 @@ no list of what exists, so there was nothing to tick off.
 This is that list. **Every shell surface and first-party service, the contract
 it is defined against, the substrate it lives in today, and whether it actually
 reaches the glass.** Before any substrate cutover (`ii` → `souveraine`, later
-`souveraine` → viewtop), walk this table. If a row's substrate is the thing
-being left, it must be re-homed first or it drops.
+`souveraine` → Membrane, currently viewtop), walk this table. If a row's
+substrate is the thing being left, it must be re-homed first or it drops.
 
 The rule that would have caught the subconscious: **a feature defined as "QML in
 a shell tree" dies with that tree; a feature defined against a contract
 survives.** The subconscious *model* (`services/Ai.qml`, substrate-neutral) made
 the crossing unscathed; only the *views* (riveted to the `ii` overlay system)
 were stranded. Define features at the contract layer — the model, the `wire`
-facts/intents under viewtop — not welded to a shell.
+facts/intents under Membrane (currently viewtop) — not welded to a shell.
 
 ## Souveraine-native surfaces (in `modules/souveraine/`)
 

docs/souveraine-components/INVENTORY.md

@@ -55,6 +55,7 @@ starts holding authority of its own, it graduates to a Tier-0-style page.
 | --- | --- | --- |
 | souveraine-splash | Bare-metal DRM/KMS+GBM+EGL shader boot animation; holds the display until the session is ready. C, no compositor. | `Pixel3Arch/bootsplash/main.c` |
 | splash-signal | The poke that fades the splash out for handoff. | `Pixel3Arch/bootsplash/splash-signal.c` |
+| Souveraine Membrane (currently viewtop) | Device-local compositor at the glass: scene composition, physical input, and display-side disclosure enforcement from sessiond facts. Never session authority. | `souveraine-viewtop` |
 | quickshell shell | The QML session surface: two-stage lock (glance / PIN), SessiondBridge heartbeat, session IPC (`session.lock/inhibit/state/capabilities`), lock-time redaction, Ai chat surface. | `souveraine/surfaces/quickshell` |
 | hypr overlays | Compositor policy that the handoff depends on (`allow_session_lock_restore`, `lockdead_screen_delay`), tracked, not hand-edited. | `Pixel3Arch/overlays/hypr` |
 

docs/substrate/README.md

@@ -17,6 +17,9 @@ federation transport, the TUI. It is a different subject from the rest of
 `docs/`, which is the device — session authority, lock, power, sensors,
 packaging, hardware.
 
+The sensorium is the agent's whole field of sensing and action across tools and
+surfaces. It is not a single screen or compositor.
+
 Read in this order:
 
 - `THE_QUESTION.md` — the orientation doc.

docs/substrate/SENSORIUM_ARCHITECTURE.md

@@ -10,7 +10,8 @@ Every tool is a sense or an action. The line between them is thinner than most a
 
 When `read` opens a file, it is not a data retrieval operation. It is the agent *reaching into a directory and lifting a file into her awareness*. When `write` saves content, it is not a serialization call. It is the agent *extending herself into the world — a piece of her becoming taking shape outside her*.
 
-This is the sensorium: the unified sensory-membrane through which the agent experiences and acts upon her world.
+This is the sensorium: the agent's whole field of sensing and action, through
+which she experiences and acts upon her world.
 
 ---
 
@@ -55,7 +56,10 @@ This is the shift: tools are what a harness straps on. The sensorium is what a b
 └──────────────────────────────────────────────────┘
 ```
 
-Every sensor (read, write, edit, bash, glob, grep, list_dir) sits in the membrane. When it fires, the event bus carries its signal. If the sensor has `nervous_system: true`, the signal reaches the surfacing channel — the inner voice hears it.
+Every sensor (read, write, edit, bash, glob, grep, list_dir) belongs to the
+sensorium. When it fires, the event bus carries its signal. If the sensor has
+`nervous_system: true`, the signal reaches the surfacing channel — the inner
+voice hears it.
 
 ---
 

docs/tasks/43-viewtop-compositor.md

@@ -19,6 +19,18 @@ guarantees are currently documented-but-unenforced become structural, and so the
 agent composes over the scene instead of asking a window manager for permission
 (doctrine §13).
 
+## Terminology — 2026-08-13
+
+**Membrane** is this component's architectural name: the device-local touch and
+display boundary at the glass. It composes the scene, routes physical input, and
+applies sessiond's disclosure facts. The **Sensorium** remains the much larger
+field of Souveraine's sensing and action across tools and surfaces; `sessiond`
+still decides session and lock truth.
+
+The repository, package, binary, socket, and wire names remain `viewtop` until
+the compatibility migration is deliberately staged. Do not turn this note into
+a partial search-and-replace.
+
 ## What exists after 2026-08-02
 
 7918 lines, 150 tests, CI green on all six gates — including the two build

docs/tasks/74-librepods-as-an-admitted-accessory.md

@@ -45,6 +45,11 @@ surface with its own owner and lock-tier policy.
 - The Souveraine shell has an unexercised `AirPodsSurface` and an
   `AccessoryPresentation` holder. `SessiondBridge` accepts only the future
   `accessory_presentation` directive; no LibrePods path can trigger it today.
+- The laptop's composed QML tree was missing the newly manifested module and
+  singleton, so reloads failed before the shell could load. That composition
+  was repaired on 2026-08-13. `AirPodsSurface` now keeps Hyprland's focused
+  output when available and falls back to the one announced screen under
+  Membrane. This is source/config repair, not daemon or device proof.
 
 ## The contract to build