chore: package send sandbox evidence gate

docs/go-mcp-runbook.md

@@ -354,7 +354,52 @@ powershell -NoProfile -ExecutionPolicy Bypass -File .\scripts\validate-n12r-retu
 
 Keep the validation report outside `$captureRoot`; the returned package is evidence input and should remain unchanged.
 
-## 13. Troubleshooting
+## 13. R6c online sandbox send evidence package
+
+The local development machine cannot log in to iSphere. Do not attempt to prove production send locally.
+
+To prepare the online/internal sandbox evidence package:
+
+```powershell
+powershell -NoProfile -ExecutionPolicy Bypass -File scripts\package-send-sandbox-gate.ps1
+```
+
+Verify the package locally:
+
+```powershell
+powershell -NoProfile -ExecutionPolicy Bypass -File scripts\verify-send-sandbox-gate-package.ps1
+```
+
+Expected output includes:
+
+```json
+{
+  "ok": true,
+  "local_login_required": false,
+  "online_sandbox_required": true,
+  "production_send_enabled": false
+}
+```
+
+Generated package:
+
+```text
+runs\send-sandbox-gate-package.zip
+```
+
+Send that zip to the online/internal sandbox operator. The operator must follow `OPERATOR-STEPS.md` inside the package:
+
+1. fill `SANDBOX-SEND-INPUTS.json`;
+2. run `run-before-recorder.bat`;
+3. manually send exactly one sandbox message in the official client;
+4. fill `success_ack_or_sent_record`;
+5. run `run-after-recorder.bat`;
+6. run `make-return-zip.ps1`;
+7. return the generated zip.
+
+Production `isphere_send_message` remains blocked until the returned package is analyzed.
+
+## 14. Troubleshooting
 
 - If C# helper build fails, run `scripts\build-win-helper.ps1` directly and check for missing .NET Framework reference assemblies.
 - If `win_helper_version` fails, rerun `powershell -NoProfile -ExecutionPolicy Bypass -File scripts\verify-win-helper.ps1` first.