shouldnt service disabling be independent of sbleave ? Removing the endpoint from a network part of a sandbox must be decoupled from the service disabling. This helps in make before break scenarios. If its tightly coupled then we might end up with issue like the above. Just like enabling service  