Lockout notifications need a session path; systemd user services start with an empty Environment, which made notify-send silently unreachable. Installer now writes the current DISPLAY and the user-bus address (XDG runtime dir) into the unit; deploy + daemon-reload + restart applied live and verified (7 listeners, routed profiles answer 200).