diff --git a/packages/client/ui-tool/src/client/tool/models/raw-tool-call.ts b/packages/client/ui-tool/src/client/tool/models/raw-tool-call.ts
index 204c83c75f..b2d895a930 100644
--- a/packages/client/ui-tool/src/client/tool/models/raw-tool-call.ts
+++ b/packages/client/ui-tool/src/client/tool/models/raw-tool-call.ts
@@ -52,8 +52,7 @@ export function singleResultText(block: ToolResultNode): string | undefined {
 }
 
 /**
- * Validate the optional escalation pair shared by first-party shell and file
- * mutation tools.
+ * Validate the optional escalation pair of first-party file mutation tools.
  * @param args - parsed open-root Tool arguments.
  * @returns whether the declared escalation fields form a valid pair.
  */
diff --git a/packages/client/ui-tool/src/client/tool/models/terminal-card-model.ts b/packages/client/ui-tool/src/client/tool/models/terminal-card-model.ts
index fbd3c4ab3a..85ba38f696 100644
--- a/packages/client/ui-tool/src/client/tool/models/terminal-card-model.ts
+++ b/packages/client/ui-tool/src/client/tool/models/terminal-card-model.ts
@@ -189,6 +189,9 @@ function shellCall(name: string, args: Record<string, unknown>): ShellCall | nul
   if (timeoutMs !== undefined && (typeof timeoutMs !== 'number' || !Number.isFinite(timeoutMs) || timeoutMs <= 0)) return null
   if (workdir !== undefined && typeof workdir !== 'string') return null
   if (background !== undefined && typeof background !== 'boolean') return null
+  // Escalation fields stay unchecked: their validity depends on the Session's
+  // sandbox mode, which only the Host knows, and a rejected call settles as an
+  // error result on the generic body.
   if (description === undefined) {
     // Standard dsh-tool-bash and dsh-tool-pwsh schemas require `description`;
     // persistent shell providers omit it. Their parameter roots stay open, so
diff --git a/packages/client/ui-tool/tests/diff-card.client.spec.tsx b/packages/client/ui-tool/tests/diff-card.client.spec.tsx
index 0274f74751..0f77dc0553 100644
--- a/packages/client/ui-tool/tests/diff-card.client.spec.tsx
+++ b/packages/client/ui-tool/tests/diff-card.client.spec.tsx
@@ -154,6 +154,8 @@ describe('diffCardModel', () => {
     })
     expect(diffCardModel(running({ argsRaw: args({ sandbox_permissions: 7, justification: 'Need access' }) }))).toBeNull()
     expect(diffCardModel(running({ argsRaw: args({ sandbox_permissions: 'workspace-write' }) }))).toBeNull()
+    expect(diffCardModel(running({ argsRaw: args({ sandbox_permissions: 'workspace-write', justification: ' ' }) }))).toBeNull()
+    expect(diffCardModel(running({ argsRaw: args({ sandbox_permissions: 'workspace-write', justification: 'Need access' }) }))).not.toBeNull()
     expect(diffCardModel(running({ argsRaw: args({ extension: { version: 1 } }) }))).not.toBeNull()
   })
 })