Regarding the "locked" issue, when I run debug, I see that, without an API specified, both Train and Wallaby use compute API version 2.1. Train will allow versions up to 2.79 and Wallaby will allow up to 2,.88. The obvious difference is that Train sends 'tenant_id' and 'all_tenants' to the API, whereas Wallaby sends 'project_id' and 'all_projects'. Could this be what causes the "locked" flag to be ignored?

The other obvious difference is that the Wallaby client doesn't complain when I used "locked" and don't specify an API version. That seems like a bug, but it is probably not causing this issue.

Train:
Without --os-compute-api-version 2.73:
openstack server list --all-projects --locked --debug
compute API version 2.1, cmd group openstack.compute.v2
--os-compute-api-version 2.73 or greater is required to support the --locked option

With --os-compute-api-version 2.73:
openstack server list --all-projects --locked --os-compute-api-version 2.73 --debug
compute API version 2.73, cmd group openstack.compute.v2
search options: {'reservation_id': None, 'ip': None, 'ip6': None, 'name': None, 'instance_name': None, 'status': None, 'flavor': None, 'image': None, 'host': None, 'tenant_id': None, 'all_tenants': True, 'user_id': None, 'deleted': False, 'changes-before': None, 'changes-since': None, 'locked': True}
<returns correct list of only locked VMs>

Wallaby:
Without --os-compute-api-version 2.73:
openstack server list --all-projects --locked --debug
compute API version 2.1, cmd group openstack.compute.v2
search options: {'reservation_id': None, 'ip': None, 'ip6': None, 'name': None, 'status': None, 'flavor': None, 'image': None, 'host': None, 'project_id': None, 'all_projects': True, 'user_id': None, 'deleted': False, 'changes-before': None, 'changes-since': None, 'locked': True}
<returns all VMs>

With --os-compute-api-version 2.73:
openstack server list --all-projects --locked --os-compute-api-version 2.73 --debug
compute API version 2.73, cmd group openstack.compute.v2
search options: {'reservation_id': None, 'ip': None, 'ip6': None, 'name': None, 'status': None, 'flavor': None, 'image': None, 'host': None, 'project_id': None, 'all_projects': True, 'user_id': None, 'deleted': False, 'changes-before': None, 'changes-since': None, 'locked': True}
<returns all VMs>

With --os-compute-api-version 2.88:
openstack server list --all-projects --locked --os-compute-api-version 2.88 --debug
compute API version 2.88, cmd group openstack.compute.v2
search options: {'reservation_id': None, 'ip': None, 'ip6': None, 'name': None, 'status': None, 'flavor': None, 'image': None, 'host': None, 'project_id': None, 'all_projects': True, 'user_id': None, 'deleted': False, 'changes-before': None, 'changes-since': None, 'locked': True}
<returns all VMs>