Merge branch 'fix/g07' into fix/integrated

# Conflicts:
#	internal/ipc/api.go
#	internal/ipc/client.go
#	internal/llm/client.go

internal/ipc/unlock_test.go

@@ -139,3 +139,39 @@ func TestLockedCheckDefaultDenies(t *testing.T) {
 		t.Error("UnlockFn never ran")
 	}
 }
+
+// A locked daemon has to be able to say it is alive. Every CoreAPI method is
+// refused before unlock, so a health check built on one of those cannot tell a
+// daemon waiting for a passkey apart from a daemon that failed to start. That
+// is what turned a good update into the manual-recovery case in
+// internal/update. MethodPing reaches no store, so it answers either way.
+func TestPingAnswersWhileLocked(t *testing.T) {
+	_, srv, cli, _ := newServerWithStore(t)
+	srv.LockedFn = func() bool { return true }
+	locked := errors.New("daemon locked")
+	srv.Check = func(_ context.Context, m Method, _ json.RawMessage) error {
+		switch m {
+		case MethodAssertStepUp, MethodUnlock, MethodPing:
+			return nil
+		default:
+			return locked
+		}
+	}
+	ctx := context.Background()
+	p, err := cli.Ping(ctx)
+	if err != nil {
+		t.Fatalf("Ping while locked: %v", err)
+	}
+	if !p.Alive || !p.Locked {
+		t.Errorf("Ping = %+v; want alive and locked", p)
+	}
+	// And the read it replaces is still refused, which is the whole point.
+	if _, err := cli.Presence(ctx); err == nil {
+		t.Error("Presence answered while locked")
+	}
+
+	srv.LockedFn = func() bool { return false }
+	if p, err := cli.Ping(ctx); err != nil || p.Locked {
+		t.Errorf("Ping after unlock = %+v, %v; want alive and not locked", p, err)
+	}
+}