docs: add N12R internal sandbox handoff workflow

docs/handoff-2026-07-06.md

@@ -378,4 +378,69 @@ Only after that should the team decide whether to:
 2. Ask for a better evidence package.
 3. Wait until current-environment live login becomes possible.
 4. Re-plan true N12.
-```
+```
+
+
+---
+
+## 12. Reality update - 2026-07-08
+
+The current repository environment is an outer-network coordination and analysis environment. iSphere / IMPlatformClient is internal-network only, so manual login cannot happen in the current environment.
+
+Do not keep waiting for current-environment login as the active path. The active live-capture route is now:
+
+```text
+N12R: Internal-sandbox live capture route
+```
+
+New operator documents:
+
+```text
+docs/internal-sandbox-live-capture-plan.md
+  Defines N12R node sequence, package contract, acceptance conditions, and boundaries.
+
+docs/n12r-final-handoff-checklist.md
+  Short final handoff checklist for internal-sandbox work, outer-network validation, boundaries, and next decision.
+
+docs/internal-sandbox-operator-runbook.md
+  Step-by-step instructions for the internal-network sandbox operator.
+
+docs/n12r-return-package-validation-checklist.md
+  Outer-network validation checklist for returned N12R packages.
+
+scripts/validate-n12r-return-package.ps1
+  One-command read-only validator for returned N12R packages. It writes validation reports outside the returned package root.
+
+scripts/test-validate-n12r-return-package.ps1
+  Local regression tests for the N12R package validator.
+```
+
+N12R package destination:
+
+```text
+runs/internal-sandbox-live-capture/<capture-id>/
+```
+
+Suggested outer-network validation command after a package returns:
+
+```powershell
+$captureRoot = "runs\internal-sandbox-live-capture\<capture-id>"
+$reportRoot = "runs\internal-sandbox-live-capture-reports"
+New-Item -ItemType Directory -Force -Path $reportRoot | Out-Null
+powershell -NoProfile -ExecutionPolicy Bypass -File .\scripts\validate-n12r-return-package.ps1 `
+  -PackageRoot $captureRoot `
+  -ReportPath (Join-Path $reportRoot "<capture-id>-validation.md")
+```
+
+N12-pre offline evidence remains useful for static analysis, but it does not replace N12R live UIA capture. Original current-environment N12 remains blocked unless the repository environment is moved into the internal network and can manually log in.
+
+The only allowed live operations in N12R remain:
+
+```text
+win_helper_version
+win_helper_self_check
+win_helper_scan_windows
+win_helper_dump_uia
+```
+
+Do not implement selector/action tools until N12R evidence is accepted and a separate selector design plan is approved.