Decide lock requests from the current lock state (#14978)

The locked binding once read true after an unlock, though the request,
the session lock, and its secure state were all false. A lock before
suspend then took the session for locked and did nothing, and the
machine slept unlocked. Lock requests, the status reply, and stranded
lock recovery now read those three values directly.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

shell/plugins/lock/Service.qml

@@ -57,6 +57,13 @@ Item {
   property bool strandedLockResolved: false
 
   readonly property bool locked: lockRequested || sessionLock.locked || sessionLock.secure
+
+  // Decisions read the lock state afresh. A property binding that missed a change
+  // notification once reported locked after an unlock, and a lock request before
+  // suspend then took that for done and never locked the session.
+  function currentlyLocked() {
+    return lockRequested || sessionLock.locked || sessionLock.secure
+  }
   readonly property bool authenticating: authenticatingPassword || fingerprintAuthenticating
   readonly property var batteryService: shell && shell.services ? shell.firstPartyServiceFor("omarchy.battery") : null
   readonly property bool powerSaverActive: batteryService ? batteryService.powerSaverOnBattery : false
@@ -109,7 +116,7 @@ Item {
     if (strandedLockResolved || strandedLockCheckProc.running) return
 
     // A lock this shell took is nobody's orphan.
-    if (locked || lockRequested) {
+    if (currentlyLocked()) {
       strandedLockResolved = true
       return
     }
@@ -118,7 +125,7 @@ Item {
   }
 
   function recoverStrandedLock() {
-    if (!strandedLock || locked || !passwordPamConfigured) return
+    if (!strandedLock || currentlyLocked() || !passwordPamConfigured) return
 
     strandedLock = false
     logEvent("lock-stranded: recovering")
@@ -218,7 +225,7 @@ Item {
   }
 
   function finishUnlock() {
-    if (!root.locked && !lockRequested) return
+    if (!root.currentlyLocked()) return
 
     lockRequested = false
     pendingSessionLock = false
@@ -688,7 +695,7 @@ Item {
       root.strandedLockResolved = true
 
       // A lock taken while this was in flight is this shell's own.
-      root.strandedLock = exitCode === 0 && !root.locked && !root.lockRequested
+      root.strandedLock = exitCode === 0 && !root.currentlyLocked()
       root.recoverStrandedLock()
     }
   }
@@ -833,17 +840,17 @@ Item {
 
     function lock(): string {
       if (!root.passwordPamConfigured) return "missing-pam"
-      if (!root.locked && !root.beginLock()) return "failed"
+      if (!root.currentlyLocked() && !root.beginLock()) return "failed"
       return "ok"
     }
 
     function isLocked(): string {
-      return root.locked ? "true" : "false"
+      return root.currentlyLocked() ? "true" : "false"
     }
 
     function status(): string {
       return JSON.stringify({
-        locked: root.locked,
+        locked: root.currentlyLocked(),
         requested: root.lockRequested,
         pending: root.pendingSessionLock,
         sessionLocked: sessionLock.locked,