[kaluli123123]

Summary

• Reject Direct reinitialization before side effects; preserve supported Direct-to-managed upgrades while clearing the old Direct cache after successful repository detection.

Closes #173.

Root cause

Initialization changed RepoState but reused a thread-keyed cached directory created for a different repository or sandbox mode.

Test plan and evidence

• RED before repair: The strengthened existing upgrade test wrote upgrade-marker.txt into the original repository before the repair.
• Focused: clone_repo_switch: 6 passed, including cached Direct upgrades, managed/Direct reinitialization refusal, non-VCS upgrades and failed clone preservation.
• Runtime: Actual cargo-run RAP smoke populated Direct cache, upgraded, executed writes only in the sandbox and confirmed original marker absent; non-VCS Direct upgrade moved cwd and kept originals unchanged.
• Rust formatting, workspace Clippy with warnings denied, and all-target compilation passed through ./check.bash.
• cargo test --locked --all-targets --no-fail-fast: 359 passed, 7 failed, 0 ignored. The exact same seven snapshot failures independently reproduced on clean base 1abc6fcff1f186124f924b56aa92c3a3684c90c5 (355 passed, 7 failed, 0 ignored), across tui_reflow_snapshots (6) and tui_submit_wrap_snapshots (1). No snapshots or thresholds were changed.
• cargo test --locked --doc: 45 passed, 1 ignored.
• Independent read-only review: no blocking findings.

Changed files

• crates/sandbox-core/src/server.rs
• crates/sandbox-local/tests/clone_repo_switch.rs
• docs/docs/infinity-code/rap-servers.md

Remaining gates

Draft: required full checks are not green. Remote CI and maintainer review remain outstanding. Docs/UI Prettier were skipped by the repository script because node_modules are absent; optional browser e2e and THIRD-PARTY verification were not reached after the test gate failed. No live model account was used.

One independent commit from base 1abc6fcff1f186124f924b56aa92c3a3684c90c5. No dependency or wire-protocol changes. No merge, deployment, or Issue closure performed.