Tracking the post-merge follow-ups for #706 (squash 490d093b, "rename Sandbox → Box, Part 1: apps/api epicenter"), which was admin-merged while WIP. These items shipped to main in a known-incomplete state and must be closed out before a production deploy / dependent parts.

🔴 P0 — verify before any deploy that auto-runs migrations

• Run DDL migration apps/api/src/migrations/post-deploy/1781016743403-migration.ts on staging. It renames table sandbox→box (+ sandbox_last_activity/sandbox_usage_periods/_archive), columns sandboxId→boxId and organization.sandbox_*/max_*_per_sandbox, enum sandbox_state_enum→box_state_enum, and ~16 sandbox_*_idx/idx_sandbox_* indexes. Never run against a real DB. Verify up() and down() on a staging clone; confirm the partial-index enum-cast predicates survive the ALTER TYPE … RENAME. Update 2026-06-10: fix(api,e2e): finish Sandbox → Box rename — 3 schema gaps + fixture column names #720 added catch-up migration 1781072797240 (3 schema gaps the original missed, incl. runner.currentStartedBoxes) — verify both, in order.

🔴 P0 — generated SDKs mismatch the live server

• Regenerate api-client, api-client-go, and analytics-api-client (api-client/api-client-go in chore(apps): restore Daytona API-client regen machinery + regenerate clients #716; analytics in chore(apps): rename analytics-api-client Sandbox -> Box via in-repo swagger spec #721 via committed in-repo spec; toolbox-api-client — found stale + its regen target broken — in chore(apps,e2e): sweep Sandbox→Box rename leftovers — regen toolbox client, fix dead env vars + stale refs #723, now drift-gated) from the (already-correct) api spec. They still declare WebhookEvent = "sandbox.created" etc., while the server now emits box.created → consumer mismatch. Source is correct; this is mechanical regen (nx run-many --target=generate:api-client).
  • Pin the generator to 7.12.0 (main's committed clients are 7.12.0; an ad-hoc regen produced 7.23.0, which adds unrelated AWS-SigV4 / Set-serialization scaffolding). Add an openapitools.json pin so the regen diff stays rename-only.
• Regenerate cli cobra docs (apps/cli/docs, apps/cli/hack/docs) + daemon swaggo docs (stale sandbox descriptions). (done in docs(cli,daemon): regenerate cobra docs and toolbox swagger after rename #718)
• Note: runner-api-client + runner swagger were already regenerated in the PR (so apps/api compiles).

🟠 P1 — CI / governance

• CodeQL alert triage — ~101 open alerts (45 go/path-injection mostly apps/runner, 32 actions/missing-workflow-permissions, 6 go/clear-text-logging, rest singletons incl. go/zipslip, go/insecure-hostkeycallback). Dismiss pre-existing/false-positives, fix real ones. (Correction: "CodeQL is red on main" was a misread — default setup was green; the red was ci(codeql): switch to advanced setup so fork PRs are scanned #708's advanced-setup workflow lying dormant behind an unset variable. Cutover executed 2026-06-10: default setup disabled, CODEQL_ADVANCED_SETUP_ENABLED=true, 6/6 languages green on main, fork-PR scanning live.)
• Confirm e2e passes on main.

🟡 follow-ups flagged during review

• Confirm the runnerAdapter ToolboxApi removal (part 4, b20fc6cb) was intentional — it was declared+initialized but never called on main (dead code), so removal looks safe; just confirm nothing external relied on it.
• This is Part 1 of N — runner/cli/dashboard wire + DB consumers; ensure the remaining installments land coherently (webhook event names, env vars, RBAC values were renamed in source).

Verification already complete (for reference)

• ✅ Source rename verified rename-only across all 937 changed files (94-agent normalize-and-classify sweep): 0 hidden logic changes attributable to the rename.