@@ -237,7 +237,7 @@ DATA_DRAINS_ENABLED=true
 NEXT_PUBLIC_DATA_DRAINS_ENABLED=true
 ```
 
-`DATA_DRAINS_ENABLED` shows the **Settings → Organization → Data drains** page and gates the server-side mutating endpoints and the cron dispatcher — when unset on a self-hosted deployment, the page is hidden, drain create/update/delete/run requests return `404`, and the dispatcher is a no-op. Set `NEXT_PUBLIC_DATA_DRAINS_ENABLED` to the same value so the browser's configuration matches the server's; on a Compose install or source checkout, `npx sim-setup doctor` reports the pair disagreeing.
+`DATA_DRAINS_ENABLED` shows the **Settings → Organization → Data drains** page and gates the server-side mutating endpoints and the cron dispatcher. When the feature resolves off on a self-hosted deployment — neither it nor `ENTERPRISE_ENABLED` is set, or it is set to `false` — the page is hidden, drain create/update/delete/run requests return `404`, and the dispatcher is a no-op. Set `NEXT_PUBLIC_DATA_DRAINS_ENABLED` to the same value so the browser's configuration matches the server's; on a Compose install or source checkout, `npx sim-setup doctor` reports the pair disagreeing.
 
 ### Scheduling the dispatcher
 
 
@@ -59,7 +59,7 @@ Three features do not need a flag at all: **custom branding**, **session policie
 | Sim Mailer inbox — on by default | `INBOX_ENABLED` | `NEXT_PUBLIC_INBOX_ENABLED` |
 | Sandboxes | `SANDBOXES_ENABLED` | `NEXT_PUBLIC_SANDBOXES_ENABLED` |
 
-Sandboxes also need a remote execution provider and a dedicated Function base image before they can run anything. `SANDBOXES_ENABLED` grants the server-side entitlement, and the server also verifies the provider credentials and an immutable Function base before it reports Sandboxes as available. Until then a workspace offers no Shell language, and **Settings → Sandboxes** stays in the sidebar but shows an upgrade notice instead of the sandbox list. `NEXT_PUBLIC_SANDBOXES_ENABLED` asserts that readiness to the browser rather than checking it: it reveals the Function block's Sandbox selector, and `npx sim-setup doctor` compares it with the server. Set it only after the selected provider has credentials and a valid immutable Function base configured.
+Sandboxes also need a remote execution provider and a dedicated Function base image before they can run anything. `SANDBOXES_ENABLED` grants the server-side entitlement, and the server also verifies the provider credentials and an immutable Function base before it reports Sandboxes as available. Until then a workspace offers no Shell language, and **Settings → Sandboxes** stays in the sidebar but shows an upgrade notice instead of the sandbox list. `NEXT_PUBLIC_SANDBOXES_ENABLED` asserts that readiness to the browser rather than checking it: it reveals the Function block's Sandbox selector, and `npx sim-setup doctor` compares it with the selected provider's readiness. Set it only after the selected provider has credentials and a valid immutable Function base configured.
 
 JavaScript without `import` or `require` does not use the remote provider and continues to run in the local isolated VM when all Sandbox flags are off. Python, Shell, JavaScript with external imports, and selected custom Sandboxes fail with an explicit configuration error until the remote Function base is ready.
 
@@ -251,9 +251,9 @@ If a feature is enabled but nothing appears, check these in order.
 
 **The settings section is missing.** The server-side variable is not set, or the app was not restarted after adding it. Variables are read at boot from the container environment, so a restart is enough — no rebuild.
 
-**Settings → Sandboxes shows an upgrade notice instead of the sandbox list.** `SANDBOXES_ENABLED` is unset, or the selected provider failed the server's readiness check — missing credentials, or a Function base that is not an immutable reference. The page stays in the sidebar either way. See [Sandboxes](/platform/self-hosting/sandboxes).
+**Settings → Sandboxes shows an upgrade notice instead of the sandbox list.** The deployment has no Sandbox entitlement (neither `SANDBOXES_ENABLED` nor the `ENTERPRISE_ENABLED` master switch is set), or the selected provider failed the server's readiness check — missing credentials, or a Function base that is not an immutable reference. The page stays in the sidebar either way. See [Sandboxes](/platform/self-hosting/sandboxes).
 
-**The section appears but the login page has no SSO option, or the Function block has no Sandbox selector.** The `NEXT_PUBLIC_` twin is missing while the server-side variable is set. A workspace follows the server, but the login page renders before any workspace loads and reads the twin, and the Sandbox selector does too. Set both; on a Compose install or source checkout, `npx sim-setup doctor` reports the pair disagreeing.
+**The section appears but the login page has no SSO option, or the Function block has no Sandbox selector.** The `NEXT_PUBLIC_` twin is missing while the server-side variable is set. A workspace follows the server, but the login page renders before any workspace loads and reads the twin, and the Sandbox selector does too. Set both. On a Compose install or source checkout, `npx sim-setup doctor` reports a twin that disagrees with its server flag; for Sandboxes it compares `NEXT_PUBLIC_SANDBOXES_ENABLED` with the selected provider's readiness instead.
 
 **The feature is on but has no effect inside a workspace.** The workspace is not owned by an organization. Check `workspace_mode` and `organization_id`:
 
 
@@ -15,9 +15,9 @@ Until the base image is configured, those languages fail with an explicit config
 | Variable | Purpose |
 | --- | --- |
 | `SANDBOXES_ENABLED` | Grants the server-side self-hosted entitlement |
-| `NEXT_PUBLIC_SANDBOXES_ENABLED` | Browser gate for the Function block's Sandbox selector. An assertion of provider readiness, not a check; `npx sim-setup doctor` compares it with the server |
+| `NEXT_PUBLIC_SANDBOXES_ENABLED` | Browser gate for the Function block's Sandbox selector. An assertion of provider readiness, not a check; `npx sim-setup doctor` compares it with the selected provider's readiness |
 
-Shell follows the server: a workspace offers it only when `SANDBOXES_ENABLED` is set and the server has verified the provider credentials and an immutable Function base. **Settings → Sandboxes** stays in the sidebar either way, but shows an upgrade notice instead of the sandbox list until that check passes. `NEXT_PUBLIC_SANDBOXES_ENABLED` is a browser gate for one control, the Function block's Sandbox selector. Whether Python or a selected sandbox actually runs depends on the server-side provider and Function image, so set it only after those work, or you surface a selector for sandboxes that cannot run.
+Shell follows the server: a workspace offers it only when the deployment is entitled — `SANDBOXES_ENABLED`, or the `ENTERPRISE_ENABLED` master switch — and the server has verified the provider credentials and an immutable Function base. **Settings → Sandboxes** stays in the sidebar either way, but shows an upgrade notice instead of the sandbox list until that check passes. `NEXT_PUBLIC_SANDBOXES_ENABLED` is a browser gate for one control, the Function block's Sandbox selector. Whether Python or a selected sandbox actually runs depends on the server-side provider and Function image, so set it only after those work, or you surface a selector for sandboxes that cannot run.
 
 ## Building the Function base
 
 
@@ -133,9 +133,9 @@ Workflows can execute user-authored JavaScript and Python. Know which sandbox yo
 Python, Shell, JavaScript with external imports, and tooling-dependent blocks
 require a remote sandbox provider. On a billing-free self-host the provider and
 Function base are not sufficient on their own: `SANDBOXES_ENABLED` grants the
-server-side entitlement, and without it a workspace offers no Shell language and the
-Sandboxes settings page shows an upgrade notice even when the provider is configured
-correctly. JavaScript without `import` or `require`
+server-side entitlement (so does the `ENTERPRISE_ENABLED` master switch), and without that
+entitlement a workspace offers no Shell language and the Sandboxes settings page shows an
+upgrade notice even when the provider is configured correctly. JavaScript without `import` or `require`
 continues to run in the in-process isolate when no remote provider is configured.
 
 <Callout type="warn">