Configuration docstrings point at deleted SandboxesApi.create_sandbox

[zfarrell]

Configuration's docstrings tell callers to obtain a session id by calling SandboxesApi.create_sandbox. That class was deleted from this SDK in b597d18 (2026-06-10), following the removal of the sandbox paths from the Hotdata OpenAPI spec (www 724ad21). The instruction cannot be followed.

On origin/main (5526588):

• .openapi-generator-templates/configuration.mustache:166-168 — :param session_id: ... "Obtain one by calling SandboxesApi.create_sandbox."
• .openapi-generator-templates/configuration.mustache:664-667 — same text on the property docstring
• .openapi-generator-templates/configuration.mustache:207 — "Workspace / sandbox scoping example:"

These regenerate into hotdata/configuration.py:148 and :549, so the template is the thing to change — editing the generated file alone will not hold.

Worth deciding the scope before fixing

The parameter these docstrings describe is now dead too, so a reword may be the wrong fix.

session_id sends X-Session-Id, which RuntimeDB used to enforce per-sandbox scoping. That enforcement was removed in runtimedb #988 (merged 2026-07-28, closing #630) — session_id now has zero occurrences under src/ on runtimedb main. The header is still published in the spec as the SessionId scheme and applied to /v1/query, /v1/results, and /v1/results/{id}, but nothing reads it. www #222 tracks removing it from the spec.

So the options are:

1. Delete session_id entirely, after www #222 removes the scheme from the spec. This is the real cleanup. Ordering is now safe — the server already stopped enforcing, so no caller can get a 403 from a stale value.
2. Just fix the docstrings if the parameter needs to stay for a deprecation window. In that case they should say the header is a no-op and name a removal version, not point at a deleted class.

Related dead surface in the same family, worth sweeping at the same time:

• hotdata/configuration.py:181 documents session_id='sb_xyz'. That format was never valid — RuntimeDB's validator required s_ plus 8 lowercase alphanumerics, so the documented example would have been rejected with a 400.
• sdk-rust reads HOTDATA_SESSION_ID from the environment (src/client.rs:229-240) and applies it on both the generated and Arrow paths.
• sdk-python-framework reads HOTDATA_SANDBOX into Configuration(session_id=...) (hotdata_framework/env.py:34-35), which feeds the streamlit / marimo / jupyter integrations.
• hotdata-ibis exposes session_id as a hotdata:// connection-URL parameter (src/ibis_hotdata/backend.py:85,118).