fix(docs): state the resolved flag conditions and the Sandbox selector exception

Describe the Sandbox entitlement by how the flags resolve, since an explicit SANDBOXES_ENABLED=false overrides the master switch. Say an unset or false twin hides the login page's SSO entry point and the Sandbox selector, name that selector as the one block field that still reads the browser's own configuration, and scope the remaining setup doctor mentions to Compose installs and source checkouts.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: icecrasher321

apps/docs/content/docs/platform/enterprise/self-hosted.mdx

@@ -16,7 +16,7 @@ There are two parts to getting this right, and skipping the second is the most c
 
 ## Enable the feature set
 
-Set the master switch and its client twin. Both are required. The server value decides access and what a workspace shows: settings sections and block fields read the deployment's server-resolved configuration, so the sidebar and the API answer the same question. The `NEXT_PUBLIC_` value covers what renders before a workspace loads — the SSO entry point on the login page. On a Compose install or source checkout, `npx sim-setup doctor` reports any pair that disagrees; see [Verify your install](/platform/self-hosting/verify).
+Set the master switch and its client twin. Both are required. The server value decides access and most of what a workspace shows: settings sections and nearly all block fields read the deployment's server-resolved configuration, so the sidebar and the API answer the same question. The `NEXT_PUBLIC_` value covers what still reads the browser's own configuration: the SSO entry point on the login page, which renders before any workspace loads, and the Function block's Sandbox selector. On a Compose install or source checkout, `npx sim-setup doctor` reports a twin that disagrees with its server flag; see [Verify your install](/platform/self-hosting/verify).
 
 ```bash
 ENTERPRISE_ENABLED=true
@@ -251,9 +251,9 @@ If a feature is enabled but nothing appears, check these in order.
 
 **The settings section is missing.** The server-side variable is not set, or the app was not restarted after adding it. Variables are read at boot from the container environment, so a restart is enough — no rebuild.
 
-**Settings → Sandboxes shows an upgrade notice instead of the sandbox list.** The deployment has no Sandbox entitlement (neither `SANDBOXES_ENABLED` nor the `ENTERPRISE_ENABLED` master switch is set), or the selected provider failed the server's readiness check — missing credentials, or a Function base that is not an immutable reference. The page stays in the sidebar either way. See [Sandboxes](/platform/self-hosting/sandboxes).
+**Settings → Sandboxes shows an upgrade notice instead of the sandbox list.** The Sandbox entitlement resolves off — `SANDBOXES_ENABLED=false`, or `SANDBOXES_ENABLED` unset without the `ENTERPRISE_ENABLED` master switch — or the selected provider failed the server's readiness check: missing credentials, or a Function base that is not an immutable reference. The page stays in the sidebar either way. See [Sandboxes](/platform/self-hosting/sandboxes).
 
-**The section appears but the login page has no SSO option, or the Function block has no Sandbox selector.** The `NEXT_PUBLIC_` twin is missing while the server-side variable is set. A workspace follows the server, but the login page renders before any workspace loads and reads the twin, and the Sandbox selector does too. Set both. On a Compose install or source checkout, `npx sim-setup doctor` reports a twin that disagrees with its server flag; for Sandboxes it compares `NEXT_PUBLIC_SANDBOXES_ENABLED` with the selected provider's readiness instead.
+**The section appears but the login page has no SSO option, or the Function block has no Sandbox selector.** The `NEXT_PUBLIC_` twin is unset or `false` while the server-side feature resolves on. A workspace follows the server, but the login page renders before any workspace loads and reads the twin, and the Sandbox selector does too. Set both. On a Compose install or source checkout, `npx sim-setup doctor` reports a twin that disagrees with its server flag; for Sandboxes it compares `NEXT_PUBLIC_SANDBOXES_ENABLED` with the selected provider's readiness instead.
 
 **The feature is on but has no effect inside a workspace.** The workspace is not owned by an organization. Check `workspace_mode` and `organization_id`:
 

apps/docs/content/docs/platform/self-hosting/environment-variables.mdx

@@ -144,7 +144,7 @@ Who may sign up and sign in — the allowlists, blocklists, `DISABLE_REGISTRATIO
 | `E2B_FUNCTION_TEMPLATE_GENERATION` | Monotonic release generation printed by the same build. Required for E2B |
 | `DAYTONA_FUNCTION_SNAPSHOT_ID` | Immutable snapshot **ID** (not a name) for the Function base image. Required for Daytona |
 | `E2B_PI_TEMPLATE_ID` / `DAYTONA_PI_SNAPSHOT_ID` | The image Pi runs on. Separate from the Function base — configuring the provider and Function image alone leaves Pi failing closed |
-| `SANDBOXES_ENABLED` / `NEXT_PUBLIC_SANDBOXES_ENABLED` | Enable custom sandboxes on a self-hosted deployment, bypassing the hosted-plan requirement. Neither is sufficient on its own — a provider key **and** an immutable Function base must also be configured. Set the `NEXT_PUBLIC_` twin only after the server side works; it enables nothing by itself — it reveals the Function block's Sandbox selector and lets `npx sim-setup doctor` confirm the two sides agree |
+| `SANDBOXES_ENABLED` / `NEXT_PUBLIC_SANDBOXES_ENABLED` | Enable custom sandboxes on a self-hosted deployment, bypassing the hosted-plan requirement. Neither is sufficient on its own — a provider key **and** an immutable Function base must also be configured. Set the `NEXT_PUBLIC_` twin only after the server side works; it enables nothing by itself — it reveals the Function block's Sandbox selector, and on a Compose install or source checkout `npx sim-setup doctor` confirms it agrees with the selected provider's readiness |
 | `IVM_MAX_EXECUTIONS_PER_WORKER` | Executions before an isolated-vm worker is recycled |
 | `IVM_MAX_BROKERS_PER_EXECUTION` | Host-call brokers per execution |
 | `IVM_MAX_BROKER_ARGS_JSON_CHARS` | Max argument payload size |

apps/docs/content/docs/platform/self-hosting/sandboxes.mdx

@@ -15,9 +15,9 @@ Until the base image is configured, those languages fail with an explicit config
 | Variable | Purpose |
 | --- | --- |
 | `SANDBOXES_ENABLED` | Grants the server-side self-hosted entitlement |
-| `NEXT_PUBLIC_SANDBOXES_ENABLED` | Browser gate for the Function block's Sandbox selector. An assertion of provider readiness, not a check; `npx sim-setup doctor` compares it with the selected provider's readiness |
+| `NEXT_PUBLIC_SANDBOXES_ENABLED` | Browser gate for the Function block's Sandbox selector. An assertion of provider readiness, not a check; on a Compose install or source checkout, `npx sim-setup doctor` compares it with the selected provider's readiness |
 
-Shell follows the server: a workspace offers it only when the deployment is entitled — `SANDBOXES_ENABLED`, or the `ENTERPRISE_ENABLED` master switch — and the server has verified the provider credentials and an immutable Function base. **Settings → Sandboxes** stays in the sidebar either way, but shows an upgrade notice instead of the sandbox list until that check passes. `NEXT_PUBLIC_SANDBOXES_ENABLED` is a browser gate for one control, the Function block's Sandbox selector. Whether Python or a selected sandbox actually runs depends on the server-side provider and Function image, so set it only after those work, or you surface a selector for sandboxes that cannot run.
+Shell follows the server: a workspace offers it only when the Sandbox entitlement resolves on — `SANDBOXES_ENABLED=true`, or the `ENTERPRISE_ENABLED` master switch with `SANDBOXES_ENABLED` left unset — and the server has verified the provider credentials and an immutable Function base. **Settings → Sandboxes** stays in the sidebar either way, but shows an upgrade notice instead of the sandbox list until that check passes. `NEXT_PUBLIC_SANDBOXES_ENABLED` is a browser gate for one control, the Function block's Sandbox selector. Whether Python or a selected sandbox actually runs depends on the server-side provider and Function image, so set it only after those work, or you surface a selector for sandboxes that cannot run.
 
 ## Building the Function base
 

apps/docs/content/docs/platform/self-hosting/security.mdx

@@ -133,9 +133,9 @@ Workflows can execute user-authored JavaScript and Python. Know which sandbox yo
 Python, Shell, JavaScript with external imports, and tooling-dependent blocks
 require a remote sandbox provider. On a billing-free self-host the provider and
 Function base are not sufficient on their own: `SANDBOXES_ENABLED` grants the
-server-side entitlement (so does the `ENTERPRISE_ENABLED` master switch), and without that
-entitlement a workspace offers no Shell language and the Sandboxes settings page shows an
-upgrade notice even when the provider is configured correctly. JavaScript without `import` or `require`
+server-side entitlement (so does the `ENTERPRISE_ENABLED` master switch when `SANDBOXES_ENABLED`
+is left unset), and without that entitlement a workspace offers no Shell language and the
+Sandboxes settings page shows an upgrade notice even when the provider is configured correctly. JavaScript without `import` or `require`
 continues to run in the in-process isolate when no remote provider is configured.
 
 <Callout type="warn">