Docs: clarify cloud sandbox scope for evals, swarms, and user testing

docs/inspector/computer.mdx

@@ -116,6 +116,19 @@ Manage them from **Change** on the image strip.
   any one computer's disk — see [Data & persistence](#data-and-persistence).
 </Note>
 
+## Cloud sandboxes
+
+Several surfaces run computer commands in **MCPJam cloud sandboxes** — disposable machines that are provisioned on demand and torn down when the session ends. These sandboxes are always cloud-hosted, regardless of where the inspector itself runs.
+
+| Surface | Sandbox scope |
+|---|---|
+| **Chatboxes** (environment with pinned image) | Per conversation |
+| **Swarm sessions** | Per attempt |
+| **Eval iterations** | Per iteration |
+| **User Testing sessions** | Per conversation |
+
+Sandbox images (defined under **Computer → Images**) apply to all of these cloud runs. They never apply to the machine running the inspector itself.
+
 ## Chatbox sandbox
 
 When a chatbox is backed by an environment that has a pinned computer image,

docs/inspector/evals.mdx

@@ -194,6 +194,10 @@ The first run of a suite saves the set of MCP servers used as a frozen snapshot;
 
 In suite settings, the **Computer environment** select lets you pin a built Docker environment so every eval iteration boots a fresh sandbox from the same image. This keeps results comparable across runs and edits — each iteration gets an identical starting state.
 
+<Note>
+  Eval computer commands always run in **MCPJam cloud sandboxes** — never on the machine running this inspector. If this inspector cannot reach MCPJam cloud sandboxes, **Run all** is disabled for suites that pin a sandbox image.
+</Note>
+
 - Choose an environment from the list. Environments that have not finished building are labelled **(not built)**; selecting one will cause the run to fail immediately.
 - Choose **None (default image)** to run without a pinned environment.
 - The agent receives a `bash` tool inside the sandbox.