`vulkro-sf org sandbox-refresh-lag`

Checks your sandboxes for stale refreshes and near expiry, so you do not test against a schema that no longer matches production.

vulkro-sf org sandbox-refresh-lag --target-org <devhub-alias>
vulkro-sf org sandbox-refresh-lag -o <devhub-alias> --format json

Point --target-org at your Dev Hub, not at a sandbox: sandbox records can only be read there.

Finding	Severity	Meaning
`SF-SANDBOX-001`	High	A sandbox was last refreshed more than 180 days ago.
`SF-SANDBOX-002`	Medium	A Full sandbox was last refreshed more than 90 days ago.
`SF-SANDBOX-003`	Low	A sandbox expires within 30 days.

Lag is judged by dates only. The command does not compare sandbox schema with production, and an old sandbox may be frozen on purpose.