ViewTop compositor

ViewTop is SouveraineOS’s compositor path. It is a purpose-built Wayland surface for the system rather than a generic desktop bolted onto a phone. It owns the pixel-facing side of lock, idle, windows and rendering while cooperating with the system session instead of duplicating it.

The goal is not a novelty compositor. It is a legible authority boundary:

• The lock surface is compositor-owned.
• Idle is a compositor protocol, visible to genuine inhibitors.
• Sleep coordinates through the system session only after the lock state is real.
• Shell surfaces ask the compositor for compositor facts; they do not scrape a different desktop’s control socket and hope the answer still means something.

ViewTop is the Pixel 3’s daily session compositor: greetd launches it, Hyprland is absent from that device’s session path, the shell’s surface tree composites through it, and Firefox has rendered and accepted touch on the phone. That is hardware evidence for the current separate-process shell path, not proof that every planned composition seam is finished.

Touch provenance

ViewTop does not collapse every event that reaches a client into the claim that a person touched the glass.

• A physical touch begins at the panel through libinput. It can reach the Wayland client, reset the idle budget and report a touch.active edge as evidence that somebody is at the device.
• A synthetic touch begins as an agent-originated compositor intent. It can reach the same Wayland touch path, but it occupies a disjoint slot namespace and produces no human-presence evidence.
• A software action such as focus, place or close remains a typed scene intent. It does not invent a touch merely because a touch could have reached the same result.

The client does not need to distinguish a physical contact from a synthetic one. ViewTop and sessiond do. Otherwise an agent tapping an application could raise its own observed_confidence, keep the idle budget alive in an empty room and make its action look like evidence about the world.

That is also why /dev/uinput is not the model. Injection there launders software intent into a physical input event inside the kernel, after which the compositor cannot recover its origin. ViewTop carries provenance from the source instead.

The physical Firefox touch above is hardware-verified. The source implements and tests the separate agent-touch route; this page does not treat that as a hardware readback of synthetic delivery.

The in-process Flutter shell remains open. Its engine embedding, client surfaces as external textures and wire-to-compositor bridge are not complete. A green build proves source; this page names hardware behavior only where the dated field record records it.