diff --git a/AGENTS.md b/AGENTS.md
index 3158528e0c..22171afd74 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -60,6 +60,10 @@ pnpm run demo:cordis    # self-referential demo: the agent modifies its own runt
 pnpm run demo:acp       # ACP server agent (needs DEEPSEEK_API_KEY)
 ```
 
+### Host sandbox failures
+
+When required `gh`, `pnpm`, build, test, or generator commands fail because the agent sandbox blocks credentials, network, IPC, file watching, or nested `sandbox-exec`, retry unchanged with the narrowest host escalation before diagnosing authentication or project failure. Require sandbox evidence; never bypass genuine test failures or the product sandbox under test.
+
 ### Run the CI gates locally before marking a PR ready
 
 Run narrow checks during implementation and this CI-equivalent sequence before marking a PR ready. Fresh worktrees need `pnpm run build` before publint and NodeNext inspect `lib/`:
diff --git a/scripts/doc-budgets.manifest.json b/scripts/doc-budgets.manifest.json
index 72d2d74533..f8a39137aa 100644
--- a/scripts/doc-budgets.manifest.json
+++ b/scripts/doc-budgets.manifest.json
@@ -1,5 +1,5 @@
 {
-  "AGENTS.md": 1370,
+  "AGENTS.md": 1500,
   "docs/AGENTS.md": 1100,
   "docs/architecture.md": 1790,
   "docs/cordis-primer.md": 600,