A filtered, keyset-paginated page of the fleet.

phase defaults to the open phases, which is what a fleet view means. Every single-phase query, deleted included, is index-addressable -- lifecycle_phase leads ix_sandbox_ledger_state_phase_transition, so an equality on it lets the index supply the ordering too. The all-phases query is the one the index cannot help: it matches everything, and the planner reads the table and sorts. Measured plans are in cloud_api/README.md.

gpuType, gpuCount, warmth and deploymentEnvironment have no index of their own, so each is a filter applied to rows a phase predicate already narrowed rather than a scan in its own right. See cloud_api/README.md for why no index was added.

userId filters on the principal who launched the box, which under a non-owner role is not the workspace owner orgId and workspaceId resolve through. It is the identity a runaway box has to be paged against.

email filters on the same column, resolved through users on the way in, and is what the dashboard offers -- an id is not something anyone holds. Both are kept: userId still addresses a principal that is not an account at all, such as the gateway's, and still honours a link someone bookmarked. Passing both narrows by both, so an address and an id naming different principals matches nothing, as the conjunction says it should. An address nobody owns yields an empty page rather than an unfiltered one.

notebookId answers "which box ran this notebook", the question an error report starts from -- it carries a notebook id and no sandbox id. It is an unindexed filter on the same terms as gpuType. Two limits are worth knowing before trusting a miss: the column holds the notebook recorded when the box was acquired, kept first-witness-wins by the drain, and a Modal ke- box is keyed on org/workspace/environment rather than on a notebook, so several notebooks share one row. A hit names the right box; a miss does not prove the notebook had none.

cursor is opaque and must be passed back exactly as it was received.