diff --git a/.agents/skills/launch-openshell-gator/SKILL.md b/.agents/skills/launch-openshell-gator/SKILL.md
index 2a516754ee..85553a4f01 100644
--- a/.agents/skills/launch-openshell-gator/SKILL.md
+++ b/.agents/skills/launch-openshell-gator/SKILL.md
@@ -109,7 +109,7 @@ gateway_name="<selected-gateway-name>"
 openshell --gateway "$gateway_name" sandbox list
 ```
 
-Look for names like `gator-pr-<number>-supervised`. If one exists, inspect its log before deleting or relaunching.
+Look for names like `gtr-pr-<number>-watch`. If one exists, inspect its log before deleting or relaunching.
 
 ## Input Normalization
 
@@ -129,11 +129,14 @@ pr_number="<digits-only>"
 [[ "$pr_number" =~ ^[0-9]+$ ]] || { echo "invalid PR number" >&2; exit 1; }
 ```
 
-Use the portable Kubernetes DNS-1123 sandbox-name format even when the selected gateway currently uses another driver:
+Sandbox names must be DNS-1123 labels of at most **19 characters**, including
+any suffix. The gateway reserves room for workspace, sandbox, and service
+segments in one DNS label; this limit applies to every compute driver. Use
+short names and validate them before launching:
 
 ```bash
-sandbox_name="gator-pr-${pr_number}-supervised"
-[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
+sandbox_name="gtr-pr-${pr_number}-watch"
+[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,17}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
 ```
 
 For local image contexts passed to `--from`, use an agent-created path such as `mktemp -d`; do not pass raw user-supplied paths without validating that they are expected local Dockerfile contexts.
@@ -149,8 +152,8 @@ gateway_name="<selected-gateway-name>"
 pr_number="<digits-only>"
 [[ "$gateway_name" =~ ^[A-Za-z0-9_.-]+$ ]] || { echo "invalid gateway name" >&2; exit 1; }
 [[ "$pr_number" =~ ^[0-9]+$ ]] || { echo "invalid PR number" >&2; exit 1; }
-sandbox_name="gator-pr-${pr_number}-supervised"
-[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
+sandbox_name="gtr-pr-${pr_number}-watch"
+[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,17}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
 
 ./scripts/agents/run.sh \
   --agent gator \
@@ -171,8 +174,8 @@ gateway_name="<selected-gateway-name>"
 issue_number="<digits-only>"
 [[ "$gateway_name" =~ ^[A-Za-z0-9_.-]+$ ]] || { echo "invalid gateway name" >&2; exit 1; }
 [[ "$issue_number" =~ ^[0-9]+$ ]] || { echo "invalid issue number" >&2; exit 1; }
-sandbox_name="gator-issue-${issue_number}-supervised"
-[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
+sandbox_name="gtr-i-${issue_number}-watch"
+[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,17}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
 
 ./scripts/agents/run.sh \
   --agent gator \
@@ -191,8 +194,8 @@ issue_number="<digits-only>"
 [[ "$gateway_name" =~ ^[A-Za-z0-9_.-]+$ ]] || { echo "invalid gateway name" >&2; exit 1; }
 [[ "$pr_number" =~ ^[0-9]+$ ]] || { echo "invalid PR number" >&2; exit 1; }
 [[ "$issue_number" =~ ^[0-9]+$ ]] || { echo "invalid issue number" >&2; exit 1; }
-sandbox_name="gator-pr-${pr_number}-supervised"
-[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
+sandbox_name="gtr-pr-${pr_number}-watch"
+[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,17}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
 
 ./scripts/agents/run.sh \
   --agent gator \
@@ -211,8 +214,8 @@ gateway_name="<selected-gateway-name>"
 pr_number="<digits-only>"
 [[ "$gateway_name" =~ ^[A-Za-z0-9_.-]+$ ]] || { echo "invalid gateway name" >&2; exit 1; }
 [[ "$pr_number" =~ ^[0-9]+$ ]] || { echo "invalid PR number" >&2; exit 1; }
-sandbox_name="gator-pr-${pr_number}-supervised"
-[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
+sandbox_name="gtr-pr-${pr_number}-watch"
+[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,17}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
 
 ./scripts/agents/run.sh \
   --agent gator \
@@ -231,8 +234,8 @@ gateway_name="<selected-gateway-name>"
 pr_number="<digits-only>"
 [[ "$gateway_name" =~ ^[A-Za-z0-9_.-]+$ ]] || { echo "invalid gateway name" >&2; exit 1; }
 [[ "$pr_number" =~ ^[0-9]+$ ]] || { echo "invalid PR number" >&2; exit 1; }
-sandbox_name="gator-pr-${pr_number}-gpt56sol-supervised"
-[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
+sandbox_name="gtr-pr-${pr_number}-exp"
+[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,17}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
 
 CODEX_MODEL=gpt-5.6-sol \
 ./scripts/agents/run.sh \
@@ -244,6 +247,8 @@ CODEX_MODEL=gpt-5.6-sol \
 ```
 
 If the installed Codex CLI is too old for a model, create a temporary copy of `scripts/agents/gator/`, adjust only that temporary Dockerfile, and launch with that generated context. Keep the repo Dockerfile unchanged unless the version bump is the intended code change.
+The short `-exp` suffix below identifies an experimental watcher; keep its full
+name within 19 characters.
 
 Example shape:
 
@@ -252,8 +257,8 @@ gateway_name="<selected-gateway-name>"
 pr_number="<digits-only>"
 [[ "$gateway_name" =~ ^[A-Za-z0-9_.-]+$ ]] || { echo "invalid gateway name" >&2; exit 1; }
 [[ "$pr_number" =~ ^[0-9]+$ ]] || { echo "invalid PR number" >&2; exit 1; }
-sandbox_name="gator-pr-${pr_number}-gpt56sol-supervised"
-[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
+sandbox_name="gtr-pr-${pr_number}-exp"
+[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,17}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
 tmp_context="$(mktemp -d "${TMPDIR:-/tmp}/gator-codex-XXXXXX")"
 cp -R scripts/agents/gator/. "$tmp_context"/
 
@@ -298,7 +303,7 @@ The launcher streams image-build and provisioning output to the terminal. Import
 gateway_name="<selected-gateway-name>"
 sandbox_name="<safe-sandbox-name>"
 [[ "$gateway_name" =~ ^[A-Za-z0-9_.-]+$ ]] || { echo "invalid gateway name" >&2; exit 1; }
-[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
+[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,17}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
 
 openshell --gateway "$gateway_name" sandbox list
 openshell --gateway "$gateway_name" sandbox get "$sandbox_name"
@@ -338,7 +343,7 @@ Before deleting, check that the sandbox is truly stale or that the operator aske
 gateway_name="<selected-gateway-name>"
 sandbox_name="<safe-sandbox-name>"
 [[ "$gateway_name" =~ ^[A-Za-z0-9_.-]+$ ]] || { echo "invalid gateway name" >&2; exit 1; }
-[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
+[[ "$sandbox_name" =~ ^[a-z0-9]([a-z0-9-]{0,17}[a-z0-9])?$ ]] || { echo "invalid sandbox name" >&2; exit 1; }
 
 openshell --gateway "$gateway_name" sandbox delete "$sandbox_name"
 ./scripts/agents/run.sh \
diff --git a/scripts/agents/README.md b/scripts/agents/README.md
index 6c8735f569..3f878160e1 100644
--- a/scripts/agents/README.md
+++ b/scripts/agents/README.md
@@ -28,6 +28,13 @@ prompt templates, provider profiles, policies, and references to skills or
 subagents. They should not contain `harnesses/codex`, `harnesses/opencode`, or
 similar runtime code.
 
+Sandbox names supplied through `--name`, `GATOR_SANDBOX_NAME`, or generated
+from the manifest prefix must be DNS-1123 labels of at most 19 characters.
+The launcher validates them before building images or changing gateway state.
+For example, use `gtr-pr-4633-watch` for a supervised Gator watcher. Generated
+names append a hyphen and a 14-digit timestamp, leaving four characters for
+the manifest's name prefix.
+
 ## Agent Manifest
 
 Each agent has an `agent.yaml` manifest. The launcher currently reads these
diff --git a/scripts/agents/run.sh b/scripts/agents/run.sh
index d778d33a72..2275aa69a3 100755
--- a/scripts/agents/run.sh
+++ b/scripts/agents/run.sh
@@ -32,7 +32,7 @@ usage() {
 Options:
   --agent NAME|PATH       Agent manifest directory or name under scripts/agents/
   --gateway NAME          Gateway name to use
-  --name NAME             Sandbox name
+  --name NAME             Sandbox name (DNS-1123 label, at most 19 characters)
   --from DOCKERFILE|DIR   Local Dockerfile source for the sandbox image
   --harness NAME          Agent harness to run
   --github-provider NAME  Override the github-gator provider instance name
@@ -513,6 +513,10 @@ configure_provider_refresh() {
 
 GATEWAY="${GATEWAY_OVERRIDE:-${GATOR_GATEWAY:-$GATEWAY_DEFAULT}}"
 SANDBOX_NAME="${SANDBOX_NAME_OVERRIDE:-${GATOR_SANDBOX_NAME:-$SANDBOX_NAME_PREFIX-$(date +%Y%m%d%H%M%S)}}"
+# Match the gateway's MAX_ROUTABLE_NAME_LEN: workspace, sandbox, and service
+# segments must fit together in one DNS label. Check before any build or writes.
+[[ ${#SANDBOX_NAME} -le 19 ]] || fail "invalid sandbox name '$SANDBOX_NAME': maximum length is 19 characters"
+[[ "$SANDBOX_NAME" =~ ^[a-z0-9]([a-z0-9-]*[a-z0-9])?$ ]] || fail "invalid sandbox name '$SANDBOX_NAME': expected a DNS-1123 label (lowercase letters, digits, internal hyphens)"
 SANDBOX_FROM="${SANDBOX_FROM_OVERRIDE:-${GATOR_SANDBOX_FROM:-$(resolve_manifest_path "$SANDBOX_FROM_DEFAULT")}}"
 RUN_MODE="${RUN_MODE_OVERRIDE:-$RUNTIME_MODE}"
 POLL_INTERVAL_SECONDS="${POLL_INTERVAL_OVERRIDE:-$RUNTIME_POLL_INTERVAL_SECONDS}"