Merge branch 'fix/g07' into fix/integrated

# Conflicts:
#	internal/ipc/api.go
#	internal/ipc/client.go
#	internal/llm/client.go

cmd/mavend/main.go

@@ -377,7 +377,11 @@ func run(args []string) error {
 	if locked {
 		srv.Check = func(ctx context.Context, m ipc.Method, _ json.RawMessage) error {
 			switch m {
-			case ipc.MethodAssertStepUp, ipc.MethodUnlock:
+			case ipc.MethodAssertStepUp, ipc.MethodUnlock, ipc.MethodPing:
+				// Ping is allowed for the same reason the two unlock methods
+				// are: it never reaches CoreAPI. It answers "she is up and
+				// locked", which is what mavupdate needs to tell a daemon
+				// waiting for a passkey apart from one that failed to start.
 				return nil // allowed in locked mode
 			default:
 				return errLocked
@@ -388,6 +392,7 @@ func run(args []string) error {
 	}
 
 	srv.StepUp = func(ctx context.Context) error { return passkeySess.Assert(ctx, auth.Scope{}) }
+	srv.LockedFn = dl.isLocked
 
 	// Mail ingestion (Vikunja #246): the hook stays nil unless an email block is
 	// configured and there is a llama-server to extract with, in which case