diff --git a/packages/client/ui-permission/tests/browser-plugin.spec.ts b/packages/client/ui-permission/tests/browser-plugin.spec.ts
index 33fc94b3a0..b0beb2b9b9 100644
--- a/packages/client/ui-permission/tests/browser-plugin.spec.ts
+++ b/packages/client/ui-permission/tests/browser-plugin.spec.ts
@@ -81,6 +81,9 @@ describe('ui-permission browser plugin', () => {
     const again = await c.ui.options(proj, new AbortController().signal)
     expect(again.find(option => option.id === 'workspace-write')?.active).toBe(true)
     expect(again.find(option => option.id === 'read-only')?.detail).toBe('Reads only.')
+    // A projection that vanished between availability and open throws.
+    expect(() => c.ui.options({ sessionId: sid('ghost') }, new AbortController().signal))
+      .toThrow(/not available on this host/)
   })
 
   it('a pick submits the /permission line; rejection and unmatched throw', async () => {
diff --git a/packages/ui/permission/tests/permission.spec.ts b/packages/ui/permission/tests/permission.spec.ts
index 864f25629d..05a747de8d 100644
--- a/packages/ui/permission/tests/permission.spec.ts
+++ b/packages/ui/permission/tests/permission.spec.ts
@@ -34,6 +34,9 @@ describe('effectivePermissionPreset', () => {
     session.append('permission/preset', { preset: 'danger-full-access' })
     session.append('permission/preset', { preset: 'workspace-write' })
     expect(effectivePermissionPreset(session.events)).toBe('workspace-write')
+    // The backward scan steps over non-preset events to the latest selection.
+    session.append('sandbox/mode', { mode: 'read-only' })
+    expect(effectivePermissionPreset(session.events)).toBe('workspace-write')
   })
 })
 
diff --git a/vitest.config.ts b/vitest.config.ts
index 16f28449a5..55f172416f 100644
--- a/vitest.config.ts
+++ b/vitest.config.ts
@@ -138,6 +138,7 @@ export default defineConfig({
         'packages/client/ui-command/src/client/service.ts',
         'packages/client/ui-command/src/client/PopupSelectView.tsx',
         'packages/client/ui-model/src/index.ts',
+        'packages/client/ui-permission/src/index.ts',
         'packages/client/ui-model/src/client/ModelSelect.tsx',
         'packages/client/ui-model/src/client/directory.ts',
         'packages/client/ui-model/src/client/index.ts',