fix(server): retain sandboxes across compute driver changes

crates/openshell-cli/src/run.rs

@@ -2942,18 +2942,20 @@ pub async fn sandbox_list(
     // Print header
     if all_workspaces {
         println!(
-            "{:<ws_width$}  {:<name_width$}  {:<created_width$}  {}",
+            "{:<ws_width$}  {:<name_width$}  {:<created_width$}  {}  {}",
             "WORKSPACE".bold(),
             "NAME".bold(),
             "CREATED".bold(),
             "PHASE".bold(),
+            "REASON".bold(),
         );
     } else {
         println!(
-            "{:<name_width$}  {:<created_width$}  {}",
+            "{:<name_width$}  {:<created_width$}  {}  {}",
             "NAME".bold(),
             "CREATED".bold(),
             "PHASE".bold(),
+            "REASON".bold(),
         );
     }
 
@@ -2981,27 +2983,42 @@ pub async fn sandbox_list(
                 .as_ref()
                 .map_or(0, |m| proto_timestamp_ms(m.created_time.as_ref())),
         );
+        let reason = sandbox_list_driver_reason(&sandbox);
         if all_workspaces {
             println!(
-                "{:<ws_width$}  {:<name_width$}  {:<created_width$}  {}",
+                "{:<ws_width$}  {:<name_width$}  {:<created_width$}  {}  {}",
                 sandbox.object_workspace().to_string(),
                 sandbox.object_name().to_string(),
                 created,
                 phase_colored,
+                reason,
             );
         } else {
             println!(
-                "{:<name_width$}  {:<created_width$}  {}",
+                "{:<name_width$}  {:<created_width$}  {}  {}",
                 sandbox.object_name().to_string(),
                 created,
                 phase_colored,
+                reason,
             );
         }
     }
 
     Ok(())
 }
 
+fn sandbox_list_driver_reason(sandbox: &Sandbox) -> &str {
+    sandbox
+        .status
+        .as_ref()
+        .and_then(|status| {
+            status.conditions.iter().find(|condition| {
+                condition.r#type == "Ready" && condition.reason == "ComputeDriverMismatch"
+            })
+        })
+        .map_or("-", |condition| condition.message.as_str())
+}
+
 fn configuration_failure_message(sandbox: &Sandbox) -> Option<&str> {
     sandbox
         .status

crates/openshell-server/src/compute/image_update.rs

@@ -61,6 +61,7 @@ impl ComputeRuntime {
             .await
             .map_err(|_| Status::internal("fetch sandbox failed"))?
             .ok_or_else(|| Status::not_found("sandbox not found"))?;
+        self.validate_compute_driver_binding(&current)?;
         ensure_image_update_stopped(&current)?;
         if current.get_resource_version() != expected_resource_version {
             return Err(crate::grpc::persistence_error_to_status(
@@ -454,6 +455,9 @@ impl ComputeRuntime {
             self.update_recovery_backoff.lock().await.remove(id);
             return Ok(());
         };
+        if self.other_driver_owner(&sandbox).is_some() {
+            return Ok(());
+        }
         if sandbox.phase() == SandboxPhase::Deleting as i32 {
             self.update_recovery_backoff.lock().await.remove(id);
             return Ok(());
@@ -691,6 +695,79 @@ mod tests {
             .collect()
     }
 
+    #[tokio::test]
+    async fn foreign_driver_update_is_not_sent_or_recovered() {
+        let (runtime, driver, original) = fixture(true).await;
+        let mut foreign = original.clone();
+        foreign.metadata.as_mut().unwrap().annotations.insert(
+            crate::compute::CREATED_BY_DRIVER_ANNOTATION.into(),
+            "vm".into(),
+        );
+        runtime.store.put_message(&foreign).await.unwrap();
+        let current = runtime
+            .store
+            .get_message::<Sandbox>(foreign.object_id())
+            .await
+            .unwrap()
+            .unwrap();
+        driver.clear_calls();
+
+        let error = runtime
+            .update_sandbox_image(
+                current.object_id(),
+                "example/workload:new".into(),
+                current.get_resource_version(),
+            )
+            .await
+            .unwrap_err();
+        assert_eq!(error.code(), Code::FailedPrecondition);
+        assert!(error.message().contains("compute driver 'vm'"));
+        assert!(image_calls(&driver).is_empty());
+
+        runtime
+            .store
+            .begin_sandbox_image_update(
+                current.object_id(),
+                current.get_resource_version(),
+                0,
+                &SandboxImageUpdate {
+                    operation_id: "foreign-operation".into(),
+                    previous_image: "example/workload:old".into(),
+                    image: "example/workload:new".into(),
+                    revision: 1,
+                    ..Default::default()
+                },
+            )
+            .await
+            .unwrap();
+        let pending = runtime
+            .store
+            .get_message::<Sandbox>(foreign.object_id())
+            .await
+            .unwrap()
+            .unwrap();
+        runtime.recover_pending_sandbox_updates().await.unwrap();
+        drop(runtime.update_recovery_sweep.acquire().await.unwrap());
+        let retained = runtime
+            .store
+            .get_message::<Sandbox>(foreign.object_id())
+            .await
+            .unwrap()
+            .unwrap();
+        assert_eq!(retained, pending);
+        assert!(image_calls(&driver).is_empty());
+        assert!(
+            runtime
+                .store
+                .get_sandbox_image_state(foreign.object_id())
+                .await
+                .unwrap()
+                .unwrap()
+                .pending
+                .is_some()
+        );
+    }
+
     #[tokio::test]
     async fn recovery_drains_multiple_pending_pages_with_updates_disabled() {
         let (mut runtime, driver, original) = fixture(true).await;