lock-dpms: the compositor reports LockedHint now, and the ordering is verified

All four faults were consequences of reporting the hint from the shell.
viewtop reports it instead: it is in the seat's session, SendLocked is the
moment the locked event goes out, and it can publish a level rather than
an edge so a cleared hint corrects itself.

Records the hardware result — lock-before-blank, lock-directive,
transition locked=True, panel-off locked=True, and no blank-without-lock.

docs/LOCK-DPMS-LESSONS.md

@@ -69,6 +69,30 @@ for three independent reasons, and any one of them was enough:
    `bootBloomActive`; the rule is that **a guard which drops a report must
    replay it when the guard opens.**
 
+**Who sets the hint now: the compositor.** All three faults above were
+consequences of reporting it from the shell, and a fourth followed from the same
+place — `Session.qml` fired on a QML *edge*, so a hint cleared by anything else
+was never re-asserted while the session stayed locked. viewtop reports it
+instead (`souveraine-viewtop` `284fbcc`), because it is the only thing that is
+simultaneously in the seat's session, authoritative about the protocol fact
+(`LockEffect::SendLocked` *is* the moment `ext_session_lock_v1.locked` goes
+out), and able to publish a **level** — `apply()` re-asserts on every lock
+transition, so a hint cleared behind our back corrects itself. This is not the
+compositor owning `locked`; sessiond still decides and logind still holds truth.
+It is the opposite of an internal `secure_session_locked()` bool: it publishes
+the attestation *into* the place doctrine calls truth.
+
+**Verified on hardware 2026-08-02**, which is the part that had never been done:
+
+```text
+lock-before-blank   locked=False
+lock-directive      locked=False
+transition          locked=True     ← the lock landed inside LOCK_ACK_BUDGET
+panel-off           locked=True     ← the blank went out with the lock held
+```
+
+No `blank-without-lock`. Before this the same test produced one on every attempt.
+
 **How to check this in one line, and do check it:**
 
 ```