docs(proposals): trust-boundary section + deprecate Account.sandbox

[bokelley]

Summary

Three doc-tidy items from PR #1453's expert reviews. No behavior change.

docs/proposals/lifecycle-state-and-sandbox-authority.md

Adds an explicit Trust boundary section at the top of the cross-implementation story. Names what the boundary IS (resolver-stamped Account.mode, sourced from the seller's tenant store keyed by authenticated principal) and what it is NOT:

• The wire AccountReference.sandbox flag (buyer input — buyer has every incentive to claim sandbox status when calling test-only surfaces against a live tenant).
• The presence of a sandbox_<id> prefix or similar seller-internal convention.
• An environment variable like ADCP_SANDBOX=1 (process-scoped, wrong granularity).

Calls out the resolver-discipline gotcha — spreading buyer input into the resolved account effectively moves the trust boundary onto the wire and defeats the framework gate. Includes a wrong/right code example.

Account.sandbox deprecation

Server-side Account.sandbox (in src/lib/server/decisioning/account.ts) is now @deprecated in favor of Account.mode. Existing adopters stamping sandbox: true keep working via getAccountMode's legacy fallback. The field will be removed in a future major.

Wire-side AccountReference.sandbox is unchanged — it's part of AdCP's natural-key disambiguation per the spec's core/account-ref.json. Deprecation is server-side only.

Changeset

Documents the deprecation queue so the next major-version bump knows what to drop.

Out of scope

Two related items the protocol-expert review flagged that don't fit this PR:

• Mock-server normative-status statement in docs/architecture/adcp-stack.md — that doc lives upstream on adcontextprotocol.org's protocol docs site, not in this repo. Filing as a separate upstream issue.
• Storyboard coverage gap for live-mode denial — filed as adcontextprotocol/adcp#4028.

Test plan

• npm run build clean
• npm run format:check clean
• No code-behavior changes — pure docs + JSDoc deprecation marker

Refs

• PR feat(server): framework-side sandbox gate auto-wired into comply controller (#1435 phase 2) #1453 (Phase 2: framework gate)
• spec/compliance: storyboard coverage gap — no scenario exercises comply_test_controller denial against live-mode accounts adcp#4028 (storyboard coverage gap, filed separately)

🤖 Generated with Claude Code