add sandbox rollback regression tests

test/test_docker_runtime.py

@@ -83,6 +83,7 @@ class FakeContainers:
         self.run_result = run_result or FakeContainer('container-123')
         self.get_result: FakeContainer | Exception | None = None
         self.list_result: list[object] = []
+        self.list_error: Exception | None = None
 
     def run(
         self,
@@ -114,6 +115,8 @@ class FakeContainers:
 
     def list(self, *, filters: dict[str, list[str]]) -> list[object]:
         self.list_calls.append({'filters': filters})
+        if self.list_error is not None:
+            raise self.list_error
         return self.list_result
 
 
@@ -690,3 +693,40 @@ def test_runtime_list_active_records_observability(tmp_path: Path) -> None:
         },
     )
     assert not span.errors
+
+
+def test_runtime_list_active_error_records_observability(tmp_path: Path) -> None:
+    config = build_config(tmp_path)
+    containers = FakeContainers()
+    containers.list_error = DockerException('boom')
+    metrics = RecordingMetrics()
+    tracer = RecordingTracer()
+    runtime = DockerSandboxRuntime(
+        config,
+        FakeDockerClient(containers),
+        metrics,
+        tracer,
+    )
+
+    with pytest.raises(SandboxError) as excinfo:
+        runtime.list_active_sessions()
+
+    assert str(excinfo.value) == 'sandbox_list_failed'
+    _find_increment_call(
+        metrics,
+        'sandbox.runtime.error.total',
+        attrs={'operation': 'list_active', 'error.type': 'DockerException'},
+    )
+    duration_call = _find_record_call(
+        metrics,
+        'sandbox.runtime.list_active.duration_ms',
+        attrs={'operation': 'list_active', 'result': 'error'},
+    )
+    assert duration_call[1] >= 0
+    span = _find_span(
+        tracer,
+        'adapter.docker.list_active_sandboxes',
+        span_attrs={'sandbox.result': 'error'},
+    )
+    assert isinstance(excinfo.value.__cause__, DockerException)
+    assert excinfo.value in span.errors