Summary

Replaces the format allow-list (12-char Base62 / 26-char ULID / 36-char UUID) in BoxID::is_valid with a permissive opaque-identifier rule: non-empty, length ≤ 128, bytes restricted to [A-Za-z0-9_-]. Server is the authority on identifier format; the client just stores and replays whatever it gets.

Motivated by the dev.boxlite.ai integration failure where the server returned UUIDs the SDK couldn't parse, and the SDK silently called BoxIDMint::mint() to invent a fresh local id (feedback_silent_id_fallback). Every box-scoped REST call afterwards 404'd. Adding a UUID arm fixes that one server; the next server format would break the SDK again. The right fix is to stop allow-listing.

This matches how comparable sandbox / container / cloud SDKs treat resource IDs:

• E2B Sandbox SDK (packages/python-sdk/e2b/sandbox/main.py) — Sandbox.connect(sandbox_id) stores the value verbatim, no validation.
• Modal Sandbox.from_id, Docker container ids/names, Kubernetes UIDs, Stripe object ids (pi_..., cus_...), AWS resource ids (i-..., vpc-...) — same pattern.

The remaining client-side checks are anti-corruption only (non-empty, length cap, URL-/path-safe charset) so the id can be embedded in REST paths and on-disk dirs without surprises.

Also propagates BoxResponse::to_box_info() parse errors instead of the silent mint, as belt-and-suspenders against the few corrupting shapes the new validator still rejects (empty, oversize, path-traversal, whitespace, URL-unsafe punctuation).

Changes

• src/boxlite/src/runtime/id.rs — replace FULL_LENGTH / LEGACY_LENGTH / UUID_LENGTH constants with a single MAX_LENGTH = 128. Drop is_uuid_format. Permissive is_valid. Length-aware short(). Add BoxIDMint::MINT_LENGTH.
• src/boxlite/src/rest/types.rs — to_box_info() returns BoxliteResult<BoxInfo>, propagating parse failures.
• src/boxlite/src/rest/{litebox,runtime}.rs — call sites updated with ?.
• src/boxlite/tests/lifecycle.rs — assertion uses BoxIDMint::MINT_LENGTH.
• openapi/rest-sandbox-open-api.yaml — box_id documented as opaque, minLength: 1, maxLength: 128. Concrete formats kept as non-normative examples.

Tests: 42 unit tests in id::tests::* (10 new positive/negative cases + rewritten proptests), 31 in rest::tests::*. Clippy -D warnings clean. cargo fmt --check clean.

Out of scope

The SSE reader / status-poller coordination work that was previously bundled here has been moved to a separate branch (rest-sdk-execution-wait-coordination) for a follow-up PR. That work touches different code, has different review concerns, and benefits from being reviewable in isolation.

Test plan

• cargo test -p boxlite --lib --features rest id — 42 passing
• cargo test -p boxlite --lib --features rest rest — 31 passing
• cargo clippy -p boxlite --features rest --tests -- -D warnings
• cargo fmt --check
• Smoke against dev.boxlite.ai (UUID server) and in-tree boxlite serve (Base62 server) once disk space allows