diff --git a/frontend/src/components/ChatArea.tsx b/frontend/src/components/ChatArea.tsx
index f86d58f29..0ce7bfb53 100644
--- a/frontend/src/components/ChatArea.tsx
+++ b/frontend/src/components/ChatArea.tsx
@@ -255,6 +255,7 @@ export function ChatArea({
           displayName={permission.displayName}
           tier={permission.tier}
           approvalScope={permission.approvalScope}
+          responseError={permission.responseError}
           onRespond={onPermissionRespond}
         />
       )}
diff --git a/frontend/src/components/PermissionBanner.tsx b/frontend/src/components/PermissionBanner.tsx
index d911f31a8..d7c3e3bfe 100644
--- a/frontend/src/components/PermissionBanner.tsx
+++ b/frontend/src/components/PermissionBanner.tsx
@@ -11,6 +11,7 @@ interface Props {
   displayName?: string;
   tier?: ToolTier;
   approvalScope?: 'session' | 'conversation';
+  responseError?: string;
   expiresAt?: number;
   questions?: UserQuestion[];
   onRespond: (
@@ -36,6 +37,7 @@ export function PermissionBanner({
   displayName,
   tier,
   approvalScope,
+  responseError,
   questions,
   expiresAt,
   onRespond,
@@ -184,6 +186,11 @@ export function PermissionBanner({
         )}
       </div>
       <div className="perm-banner-actions">
+        {responseError && (
+          <p className="perm-banner-response-error" role="alert">
+            {responseError}
+          </p>
+        )}
         {questions ? (
           <button
             className="perm-banner-btn perm-banner-btn--once"
diff --git a/frontend/src/components/__tests__/PermissionBanner.test.tsx b/frontend/src/components/__tests__/PermissionBanner.test.tsx
index 1e131ea13..b138b1fa1 100644
--- a/frontend/src/components/__tests__/PermissionBanner.test.tsx
+++ b/frontend/src/components/__tests__/PermissionBanner.test.tsx
@@ -74,6 +74,12 @@ describe('PermissionBanner', () => {
     expect(container.querySelector('.perm-banner-btn--deny')).toBeTruthy();
   });
 
+  it('shows a retryable permission response error without dismissing the prompt', () => {
+    render(<PermissionBanner {...defaultProps} responseError="Review the prompt and try again." />);
+    expect(screen.getByRole('alert').textContent).toContain('Review the prompt and try again.');
+    expect(screen.getByText('Allow Once')).toBeTruthy();
+  });
+
   it('adds perm-banner--visible class after mount', () => {
     const rafSpy = vi.spyOn(globalThis, 'requestAnimationFrame').mockImplementation((cb) => {
       cb(0);
diff --git a/frontend/src/styles/global.css b/frontend/src/styles/global.css
index a098e2a12..af7811ed0 100644
--- a/frontend/src/styles/global.css
+++ b/frontend/src/styles/global.css
@@ -3312,6 +3312,12 @@ textarea:focus {
   max-height: 72dvh;
   overflow: hidden;
 }
+.perm-banner--elevated {
+  border-top-color: var(--warning);
+}
+.perm-banner--unknown {
+  border-top-color: var(--text-dim);
+}
 .perm-banner-heading {
   display: flex;
   justify-content: space-between;
@@ -3367,11 +3373,19 @@ textarea:focus {
 }
 .perm-banner-actions {
   display: flex;
+  flex-wrap: wrap;
   gap: 8px;
   flex-shrink: 0;
   border-top: 1px solid var(--border);
   padding-top: 14px;
 }
+
+.perm-banner-response-error {
+  flex-basis: 100%;
+  margin: 0;
+  color: var(--error, #f87171);
+  font-size: 0.8rem;
+}
 .perm-banner-btn {
   flex: 1;
   min-height: 44px;
diff --git a/frontend/src/types/ws-messages.ts b/frontend/src/types/ws-messages.ts
index d966d2884..a813274f4 100644
--- a/frontend/src/types/ws-messages.ts
+++ b/frontend/src/types/ws-messages.ts
@@ -136,6 +136,13 @@ interface PermissionResolvedMsg {
   sessionId?: string;
 }
 
+interface PermissionResponseRejectedMsg {
+  type: 'permission_response_rejected';
+  permId: string;
+  sessionId?: string;
+  error: string;
+}
+
 interface ErrorMsg {
   type: 'error';
   error: string;
@@ -246,6 +253,7 @@ export type ServerMessage =
   | PermissionRequestMsg
   | PermissionTimeoutMsg
   | PermissionResolvedMsg
+  | PermissionResponseRejectedMsg
   | ErrorMsg
   | SessionTakeoverMsg
   | ModeChangedMsg
diff --git a/packages/client/__tests__/messages-slice.test.ts b/packages/client/__tests__/messages-slice.test.ts
index 40bf2eab6..335a38460 100644
--- a/packages/client/__tests__/messages-slice.test.ts
+++ b/packages/client/__tests__/messages-slice.test.ts
@@ -1703,3 +1703,19 @@ it('queues concurrent prompts and deduplicates reconnect replay', () => {
   state = messagesReducer(state, { type: 'PERMISSION_TIMEOUT', permId: 'p2' });
   expect(state.permission).toBeNull();
 });
+
+it('keeps streaming state and the prompt when a permission response is rejected', () => {
+  const permission = { permId: 'p1', toolName: 'Bash', toolInput: 'pwd' };
+  const state = messagesReducer(
+    {
+      ...INITIAL_MESSAGES_STATE,
+      running: true,
+      current: { messageId: 'm1', blocks: new Map(), blockOrder: [] },
+      permission,
+    },
+    { type: 'PERMISSION_REJECTED', permId: 'p1', error: 'Try again' },
+  );
+  expect(state.running).toBe(true);
+  expect(state.current?.messageId).toBe('m1');
+  expect(state.permission).toEqual({ ...permission, responseError: 'Try again' });
+});
diff --git a/packages/client/__tests__/protocol-parser.test.ts b/packages/client/__tests__/protocol-parser.test.ts
index 4b26d8ff4..ecf87a15a 100644
--- a/packages/client/__tests__/protocol-parser.test.ts
+++ b/packages/client/__tests__/protocol-parser.test.ts
@@ -353,6 +353,17 @@ describe('permission events', () => {
     );
     expect(r.messagesActions).toEqual([{ type: 'PERMISSION_TIMEOUT', permId: 'p1' }]);
   });
+  it('permission_response_rejected dispatches a nonterminal permission rejection', () => {
+    const r = parseServerMessage(
+      { type: 'permission_response_rejected', permId: 'p1', error: 'Try again' },
+      makeState(),
+      makeCallbacks(),
+      POOL_KEY,
+    );
+    expect(r.messagesActions).toEqual([
+      { type: 'PERMISSION_REJECTED', permId: 'p1', error: 'Try again' },
+    ]);
+  });
 });
 
 // ─── Error handling ──────────────────────────────────────────────────────────
diff --git a/packages/client/src/__tests__/sse-connection.test.ts b/packages/client/src/__tests__/sse-connection.test.ts
index ae7221e1e..a6af954a5 100644
--- a/packages/client/src/__tests__/sse-connection.test.ts
+++ b/packages/client/src/__tests__/sse-connection.test.ts
@@ -485,6 +485,34 @@ describe('SseConnection', () => {
     }
   });
 
+  it('reports permission POST failures as nonterminal permission rejections', async () => {
+    const fetch = vi.fn().mockResolvedValue({ ok: false, status: 400 });
+    const conn = new SseConnection(createConfig({ fetch }));
+    const listener = vi.fn();
+    conn.onMessage(listener);
+    conn.connect();
+    lastES()._emit('welcome', { type: 'welcome', protocolVersion: 2, connectionId: 'conn-abc' });
+    listener.mockClear();
+
+    conn.send({
+      type: 'permission_response',
+      sessionId: 'sess-1',
+      permId: 'perm-1',
+      decision: 'once',
+      answers: { question: ['   '] },
+    });
+
+    await vi.waitFor(() =>
+      expect(listener).toHaveBeenCalledWith({
+        type: 'permission_response_rejected',
+        sessionId: 'sess-1',
+        permId: 'perm-1',
+        error: 'Could not submit the permission response (400). Review the prompt and try again.',
+      }),
+    );
+    expect(listener).not.toHaveBeenCalledWith(expect.objectContaining({ type: 'error' }));
+  });
+
   it.each([
     ['switch_session', 'selected'],
     ['switch_session', null],
diff --git a/packages/client/src/protocol-parser.ts b/packages/client/src/protocol-parser.ts
index 8f5f49e67..fb15c2229 100644
--- a/packages/client/src/protocol-parser.ts
+++ b/packages/client/src/protocol-parser.ts
@@ -397,6 +397,14 @@ export function parseServerMessage(
       });
       break;
 
+    case 'permission_response_rejected':
+      result.messagesActions.push({
+        type: 'PERMISSION_REJECTED',
+        permId: msg.permId as string,
+        error: msg.error as string,
+      });
+      break;
+
     case 'native_command_result':
       result.messagesActions.push({
         type: 'NATIVE_COMMAND_RESULT',
diff --git a/packages/client/src/slices/messages.ts b/packages/client/src/slices/messages.ts
index acf0a62ee..009b14f44 100644
--- a/packages/client/src/slices/messages.ts
+++ b/packages/client/src/slices/messages.ts
@@ -161,6 +161,7 @@ export type MessagesAction =
   | { type: 'SESSION_STATE_CHANGED'; state: ClientSessionState }
   | { type: 'CONNECTION_LOST' }
   | { type: 'PERMISSION_REQUEST'; payload: PermissionRequest }
+  | { type: 'PERMISSION_REJECTED'; permId: string; error: string }
   | { type: 'PERMISSION_TIMEOUT'; permId: string }
   | { type: 'RESTORE'; messages: FinishedMessage[]; interrupted?: boolean }
   | {
@@ -404,6 +405,18 @@ export function messagesReducer(state: MessagesState, action: MessagesAction): M
         : { ...state, permission: action.payload };
     }
 
+    case 'PERMISSION_REJECTED': {
+      const update = (permission: PermissionRequest) =>
+        permission.permId === action.permId
+          ? { ...permission, responseError: action.error }
+          : permission;
+      return {
+        ...state,
+        permission: state.permission ? update(state.permission) : null,
+        permissionQueue: state.permissionQueue?.map(update),
+      };
+    }
+
     case 'PERMISSION_TIMEOUT': {
       const queue = (state.permissionQueue ?? []).filter((p) => p.permId !== action.permId);
       if (state.permission?.permId !== action.permId) return { ...state, permissionQueue: queue };
diff --git a/packages/client/src/sse-connection.ts b/packages/client/src/sse-connection.ts
index 40017f06c..4347289be 100644
--- a/packages/client/src/sse-connection.ts
+++ b/packages/client/src/sse-connection.ts
@@ -485,14 +485,32 @@ export class SseConnection implements ChatConnection {
         headers: { 'Content-Type': 'application/json', 'X-Connection-ID': this._connectionId },
         body: JSON.stringify(body),
       });
-      if (!res.ok)
+      if (!res.ok) {
+        if (endpoint === 'permission' && typeof body.permId === 'string') {
+          this.listener?.({
+            type: 'permission_response_rejected',
+            ...scope,
+            permId: body.permId,
+            error: `Could not submit the permission response (${res.status}). Review the prompt and try again.`,
+          });
+          return;
+        }
         this.listener?.({
           type: 'error',
           ...scope,
           error: `Could not ${endpoint} (${res.status}). Please retry.`,
         });
+      }
     } catch {
-      this.listener?.({ type: 'error', ...scope, error: `Could not ${endpoint}. Please retry.` });
+      if (endpoint === 'permission' && typeof body.permId === 'string')
+        this.listener?.({
+          type: 'permission_response_rejected',
+          ...scope,
+          permId: body.permId,
+          error: 'Could not submit the permission response. Review the prompt and try again.',
+        });
+      else
+        this.listener?.({ type: 'error', ...scope, error: `Could not ${endpoint}. Please retry.` });
     }
   }
 
diff --git a/packages/harness/__tests__/user-questions.test.ts b/packages/harness/__tests__/user-questions.test.ts
index f1c7d5741..1a2243a21 100644
--- a/packages/harness/__tests__/user-questions.test.ts
+++ b/packages/harness/__tests__/user-questions.test.ts
@@ -146,6 +146,44 @@ it('shows complete approval arguments rather than the notification summary', asy
   }
 });
 
+it('rejects approval input that cannot be displayed in full', async () => {
+  const { applyTierOverrides } = await import('../src/tool-tiers.js');
+  applyTierOverrides({ Bash: 'unknown' });
+  try {
+    const { handler, sent, abort } = setup();
+    const command = 'x'.repeat(20_000);
+    const result = handler('Bash', { command }, { signal: abort.signal, toolUseID: 'b-large' });
+    await expect(result).resolves.toMatchObject({
+      behavior: 'deny',
+      message: expect.stringContaining('too large to review safely'),
+    });
+    expect(sent).toEqual([]);
+  } finally {
+    applyTierOverrides({});
+  }
+});
+
+it('rejects approval input that cannot be serialized for review', async () => {
+  const { applyTierOverrides } = await import('../src/tool-tiers.js');
+  applyTierOverrides({ CustomWrite: 'unknown' });
+  try {
+    const { handler, sent, abort } = setup();
+    const circular: Record<string, unknown> = {};
+    circular.self = circular;
+    const result = handler('CustomWrite', circular, {
+      signal: abort.signal,
+      toolUseID: 'custom-large',
+    });
+    await expect(result).resolves.toMatchObject({
+      behavior: 'deny',
+      message: expect.stringContaining('too large to review safely'),
+    });
+    expect(sent).toEqual([]);
+  } finally {
+    applyTierOverrides({});
+  }
+});
+
 it('keeps an unresolved question replayable when a transport closes during send', async () => {
   const { getPendingRequestsBySession } = await import('../src/permissions.js');
   const { handler, registry, abort } = setup();
diff --git a/packages/harness/src/permission-handler.ts b/packages/harness/src/permission-handler.ts
index 7e501d87a..49325017d 100644
--- a/packages/harness/src/permission-handler.ts
+++ b/packages/harness/src/permission-handler.ts
@@ -36,6 +36,25 @@ export const UserQuestionsSchema = z
   .max(4)
   .refine((questions) => new Set(questions.map((q) => q.question)).size === questions.length);
 
+const PERMISSION_INPUT_MAX_CHARS = 10_000;
+
+function permissionDisplayInput(
+  toolName: string,
+  input: Record<string, unknown>,
+): string | undefined {
+  let full: string | undefined;
+  try {
+    full =
+      toolName === 'Bash' && typeof input.command === 'string'
+        ? input.command
+        : JSON.stringify(input, null, 2);
+  } catch {
+    return undefined;
+  }
+  if (full === undefined) return undefined;
+  return full.length <= PERMISSION_INPUT_MAX_CHARS ? full : undefined;
+}
+
 function transportSend(transport: SessionTransport, data: Record<string, unknown>): void {
   try {
     if (transport.isOpen()) transport.send(data);
@@ -162,6 +181,12 @@ export function buildPermissionHandler(
       };
     }
 
+    const displayInput = questions ? '' : permissionDisplayInput(toolName, _toolInput);
+    if (displayInput === undefined)
+      return {
+        behavior: 'deny',
+        message: 'Tool input is too large to review safely. Split it into smaller operations.',
+      };
     const inputSummary = summarizeToolInput(toolName, _toolInput);
     const tier = getToolTier(toolName);
 
@@ -207,11 +232,7 @@ export function buildPermissionHandler(
       const request: PermissionRequest = {
         permId,
         toolName,
-        toolInput: questions
-          ? ''
-          : toolName === 'Bash' && typeof _toolInput.command === 'string'
-            ? _toolInput.command
-            : JSON.stringify(_toolInput, null, 2),
+        toolInput: displayInput,
         title: opts.title,
         description: opts.description,
         displayName: opts.displayName,
diff --git a/packages/protocol/__tests__/ws-schemas-v2.test.ts b/packages/protocol/__tests__/ws-schemas-v2.test.ts
index d88dd8c07..b038e7f93 100644
--- a/packages/protocol/__tests__/ws-schemas-v2.test.ts
+++ b/packages/protocol/__tests__/ws-schemas-v2.test.ts
@@ -194,6 +194,31 @@ describe('v2 interrupt / stop / permission_response / set_mode', () => {
     expect(r.success).toBe(true);
   });
 
+  it('rejects whitespace-only question answers', () => {
+    const r = V2PermissionResponseMessage.safeParse({
+      type: 'permission_response',
+      sessionId: 'sess-1',
+      permId: 'p1',
+      decision: 'once',
+      answers: { question: ['   '] },
+    });
+    expect(r.success).toBe(false);
+  });
+
+  it('validates nonblank answers without changing provider keys or values', () => {
+    const opaqueId = 'x'.repeat(4001);
+    const answers = { '   ': [' option '], [opaqueId]: ['value'] };
+    const r = V2PermissionResponseMessage.safeParse({
+      type: 'permission_response',
+      sessionId: 'sess-1',
+      permId: 'p1',
+      decision: 'once',
+      answers,
+    });
+    expect(r.success).toBe(true);
+    if (r.success) expect(r.data.answers).toEqual(answers);
+  });
+
   it('accepts set_mode with sessionId', () => {
     const r = V2SetModeMessage.safeParse({
       type: 'set_mode',
diff --git a/packages/protocol/__tests__/ws-schemas.test.ts b/packages/protocol/__tests__/ws-schemas.test.ts
index 4ca9fa0bb..854755557 100644
--- a/packages/protocol/__tests__/ws-schemas.test.ts
+++ b/packages/protocol/__tests__/ws-schemas.test.ts
@@ -67,6 +67,30 @@ describe('WS message schemas', () => {
     expect(result.success).toBe(true);
   });
 
+  it('rejects whitespace-only permission answers', () => {
+    const result = IncomingWsMessage.safeParse({
+      type: 'permission_response',
+      permId: 'p1',
+      decision: 'once',
+      answers: { question: ['   '] },
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('validates nonblank answers without changing provider keys or values', () => {
+    const opaqueId = 'x'.repeat(4001);
+    const answers = { '   ': [' option '], [opaqueId]: ['value'] };
+    const result = IncomingWsMessage.safeParse({
+      type: 'permission_response',
+      permId: 'p1',
+      decision: 'once',
+      answers,
+    });
+    expect(result.success).toBe(true);
+    if (result.success && result.data.type === 'permission_response')
+      expect(result.data.answers).toEqual(answers);
+  });
+
   it('accepts set_mode', () => {
     const result = IncomingWsMessage.safeParse({ type: 'set_mode', mode: 'auto' });
     expect(result.success).toBe(true);
diff --git a/packages/protocol/src/types.ts b/packages/protocol/src/types.ts
index 3e12c61c2..9201ecd0d 100644
--- a/packages/protocol/src/types.ts
+++ b/packages/protocol/src/types.ts
@@ -190,6 +190,7 @@ export interface PermissionRequest {
   displayName?: string;
   tier?: ToolTier;
   approvalScope?: 'session' | 'conversation';
+  responseError?: string;
 }
 
 // --- Image attachment ---
diff --git a/packages/protocol/src/ws-schemas-v2.ts b/packages/protocol/src/ws-schemas-v2.ts
index 4af25ed4a..20dcb557f 100644
--- a/packages/protocol/src/ws-schemas-v2.ts
+++ b/packages/protocol/src/ws-schemas-v2.ts
@@ -113,14 +113,18 @@ export const V2StopMessage = z.object({
   sessionId: z.string().min(1),
 });
 
+const NonBlankPermissionText = z
+  .string()
+  .min(1)
+  .max(4000)
+  .refine((value) => value.trim().length > 0, 'Must not be blank');
+
 export const V2PermissionResponseMessage = z.object({
   type: z.literal('permission_response'),
   sessionId: z.string().min(1).optional(),
   permId: z.string(),
   decision: z.enum(['once', 'always', 'deny']).optional(),
-  answers: z
-    .record(z.string().min(1).max(4000), z.array(z.string().min(1).max(4000)).min(1).max(9))
-    .optional(),
+  answers: z.record(z.string(), z.array(NonBlankPermissionText).min(1).max(9)).optional(),
 });
 
 export const V2SetModeMessage = z.object({
diff --git a/packages/protocol/src/ws-schemas.ts b/packages/protocol/src/ws-schemas.ts
index cce4face5..0322bb208 100644
--- a/packages/protocol/src/ws-schemas.ts
+++ b/packages/protocol/src/ws-schemas.ts
@@ -48,13 +48,17 @@ export const StopMessage = z.object({
   traceparent,
 });
 
+const NonBlankPermissionText = z
+  .string()
+  .min(1)
+  .max(4000)
+  .refine((value) => value.trim().length > 0, 'Must not be blank');
+
 export const PermissionResponseMessage = z.object({
   type: z.literal('permission_response'),
   permId: z.string(),
   decision: z.enum(['once', 'always', 'deny']).optional(),
-  answers: z
-    .record(z.string().min(1).max(4000), z.array(z.string().min(1).max(4000)).min(1).max(9))
-    .optional(),
+  answers: z.record(z.string(), z.array(NonBlankPermissionText).min(1).max(9)).optional(),
   traceparent,
 });
 
diff --git a/server/__tests__/chat-rest-handler.test.ts b/server/__tests__/chat-rest-handler.test.ts
index ef20d8f28..f73c123d3 100644
--- a/server/__tests__/chat-rest-handler.test.ts
+++ b/server/__tests__/chat-rest-handler.test.ts
@@ -17,7 +17,7 @@ vi.mock('../ws-handler-v2.js', async (importOriginal) => {
     handleSendV2: vi.fn(),
     handleStopV2: vi.fn(),
     handleInterruptV2: vi.fn(),
-    handlePermissionResponseV2: vi.fn(),
+    handlePermissionResponseV2: vi.fn().mockReturnValue(true),
     handleSetModeV2: vi
       .fn()
       .mockResolvedValue({ ok: true, applied: true, persisted: true, mode: 'agent' }),
@@ -302,6 +302,49 @@ describe('chat-rest-handler', () => {
     expect(handlePermissionResponseV2).toHaveBeenCalledOnce();
   });
 
+  it('POST /permission returns a retryable rejection for schema-invalid answers', async () => {
+    const res = await request(testApp)
+      .post('/api/chat/permission')
+      .set('X-Connection-ID', CONNECTION_ID)
+      .send({
+        type: 'permission_response',
+        sessionId: 'sess-1',
+        permId: 'perm-1',
+        decision: 'once',
+        answers: { question: ['   '] },
+      });
+
+    expect(res.status).toBe(400);
+    expect(res.body).toEqual({
+      ok: false,
+      type: 'permission_response_rejected',
+      permId: 'perm-1',
+      error: 'Permission response was invalid or expired. Review the prompt and try again.',
+    });
+    expect(handlePermissionResponseV2).not.toHaveBeenCalled();
+  });
+
+  it('POST /permission returns a retryable rejection when the request expired', async () => {
+    vi.mocked(handlePermissionResponseV2).mockReturnValueOnce(false);
+    const res = await request(testApp)
+      .post('/api/chat/permission')
+      .set('X-Connection-ID', CONNECTION_ID)
+      .send({
+        type: 'permission_response',
+        sessionId: 'sess-1',
+        permId: 'expired-perm',
+        decision: 'once',
+      });
+
+    expect(res.status).toBe(409);
+    expect(res.body).toEqual({
+      ok: false,
+      type: 'permission_response_rejected',
+      permId: 'expired-perm',
+      error: 'Permission response was invalid or expired. Review the prompt and try again.',
+    });
+  });
+
   // ─── POST /api/chat/mode ───────────────────────────────────────────────
 
   it('POST /mode calls handleSetModeV2', async () => {
diff --git a/server/__tests__/ws-handler-v2.test.ts b/server/__tests__/ws-handler-v2.test.ts
index 991c516a1..433278eba 100644
--- a/server/__tests__/ws-handler-v2.test.ts
+++ b/server/__tests__/ws-handler-v2.test.ts
@@ -50,7 +50,11 @@ import {
 } from '../chat.js';
 import { setSkillPolicy, clearSkillPolicy } from '../skill-policy.js';
 import { resolveSlashCommand } from '../slash-commands.js';
-import { denyPendingBySession, getPendingRequestsBySession } from '../permissions.js';
+import {
+  denyPendingBySession,
+  getPendingRequestsBySession,
+  resolvePending,
+} from '../permissions.js';
 
 import {
   handleHello,
@@ -1531,6 +1535,27 @@ describe('handlePermissionResponseV2', () => {
       ),
     ).not.toThrow();
   });
+
+  it('keeps an invalid response retryable and reports the rejection', () => {
+    vi.mocked(resolvePending).mockReturnValueOnce(false);
+    const ctx = createContext();
+    const transport = mockTransport();
+    ctx.connRegistry.register('c1', transport);
+
+    const resolved = handlePermissionResponseV2(
+      'c1',
+      { type: 'permission_response', sessionId: 'sess-1', permId: 'p1', decision: 'once' },
+      ctx,
+    );
+
+    expect(transport.sent).toContainEqual({
+      type: 'permission_response_rejected',
+      sessionId: 'sess-1',
+      permId: 'p1',
+      error: 'Permission response was invalid or expired. Review the prompt and try again.',
+    });
+    expect(resolved).toBe(false);
+  });
 });
 
 // ─── handleReconnect — no running field in summary ──────────────────────────
@@ -2024,6 +2049,32 @@ describe('dispatchV2Message', () => {
     expect(transport.sent).toHaveLength(0);
   });
 
+  it('reports a malformed permission response as a retryable rejection', async () => {
+    const ctx = createContext();
+    const transport = mockTransport();
+    ctx.connRegistry.register('c1', transport);
+
+    await dispatchV2Message(
+      'c1',
+      transport,
+      JSON.stringify({
+        type: 'permission_response',
+        sessionId: 'sess-1',
+        permId: 'p1',
+        decision: 'once',
+        answers: { question: ['   '] },
+      }),
+      ctx,
+    );
+
+    expect(transport.sent).toContainEqual({
+      type: 'permission_response_rejected',
+      sessionId: 'sess-1',
+      permId: 'p1',
+      error: 'Permission response was invalid or expired. Review the prompt and try again.',
+    });
+  });
+
   it('ignores duplicate hello messages', async () => {
     const ctx = createContext();
     const transport = mockTransport();
diff --git a/server/chat-rest-handler.ts b/server/chat-rest-handler.ts
index a9f952077..5582e330e 100644
--- a/server/chat-rest-handler.ts
+++ b/server/chat-rest-handler.ts
@@ -231,10 +231,27 @@ export function createChatRestRouter(
     const connectionId = getConnectionId(req, res);
     if (!connectionId) return;
     if (!requireConnection(connectionId, ctx.connRegistry, res)) return;
-    const msg = validateBody(V2PermissionResponseMessage, req.body, res);
-    if (!msg) return;
+    const parsed = V2PermissionResponseMessage.safeParse(req.body);
+    if (!parsed.success) {
+      res.status(400).json({
+        ok: false,
+        type: 'permission_response_rejected',
+        permId: typeof req.body?.permId === 'string' ? req.body.permId : '',
+        error: 'Permission response was invalid or expired. Review the prompt and try again.',
+      });
+      return;
+    }
+    const msg = parsed.data;
     try {
-      handlePermissionResponseV2(connectionId, msg, ctx);
+      if (!handlePermissionResponseV2(connectionId, msg, ctx)) {
+        res.status(409).json({
+          ok: false,
+          type: 'permission_response_rejected',
+          permId: msg.permId,
+          error: 'Permission response was invalid or expired. Review the prompt and try again.',
+        });
+        return;
+      }
       res.json({ ok: true });
     } catch (err) {
       log.error('POST /chat/permission failed', { connectionId, error: String(err) });
diff --git a/server/index.ts b/server/index.ts
index 023b61b7b..9da383631 100644
--- a/server/index.ts
+++ b/server/index.ts
@@ -897,6 +897,21 @@ function handleChatWs(
       const result = IncomingWsMessage.safeParse(parsed);
 
       if (!result.success) {
+        if (parsed?.type === 'permission_response' && typeof parsed.permId === 'string') {
+          try {
+            transport.send({
+              type: 'permission_response_rejected',
+              permId: parsed.permId,
+              error: 'Permission response was invalid or expired. Review the prompt and try again.',
+            });
+          } catch (error) {
+            log.warn('permission response error delivery failed', {
+              clientId,
+              permId: parsed.permId,
+              error,
+            });
+          }
+        }
         log.debug('unrecognized WS message', { clientId, type: parsed?.type });
         return;
       }
@@ -1121,12 +1136,28 @@ function handleChatWs(
             'ws.decision': msg.decision || 'deny',
           },
           () => {
-            resolvePending(
+            const resolved = resolvePending(
               msg.permId,
               msg.decision || 'deny',
               msg.answers,
               registry.get(clientId)?.sessionId,
             );
+            if (!resolved) {
+              try {
+                transport.send({
+                  type: 'permission_response_rejected',
+                  permId: msg.permId,
+                  error:
+                    'Permission response was invalid or expired. Review the prompt and try again.',
+                });
+              } catch (error) {
+                log.warn('permission response error delivery failed', {
+                  clientId,
+                  permId: msg.permId,
+                  error,
+                });
+              }
+            }
           },
           contextFromTraceparent(traceparent),
         );
diff --git a/server/ws-handler-v2.ts b/server/ws-handler-v2.ts
index d3143830b..745175cce 100644
--- a/server/ws-handler-v2.ts
+++ b/server/ws-handler-v2.ts
@@ -911,12 +911,38 @@ export function handleInterruptV2(
   );
 }
 
+const PERMISSION_RESPONSE_REJECTED_MESSAGE =
+  'Permission response was invalid or expired. Review the prompt and try again.';
+
+function sendPermissionResponseRejected(
+  transport: SessionTransport | undefined,
+  connectionId: string,
+  permId: string,
+  sessionId?: string,
+) {
+  try {
+    transport?.send({
+      type: 'permission_response_rejected',
+      sessionId,
+      permId,
+      error: PERMISSION_RESPONSE_REJECTED_MESSAGE,
+    });
+  } catch (error) {
+    log.warn('permission response error delivery failed', {
+      connectionId,
+      sessionId,
+      permId,
+      error,
+    });
+  }
+}
+
 export function handlePermissionResponseV2(
   connectionId: string,
   msg: PermissionMsg,
-  _ctx: V2HandlerContext,
-): void {
-  withSpan(
+  ctx: V2HandlerContext,
+): boolean {
+  return withSpan(
     'ws.permission_response',
     {
       'ws.connectionId': connectionId,
@@ -924,12 +950,26 @@ export function handlePermissionResponseV2(
       'ws.permId': msg.permId,
     },
     () => {
-      resolvePending(msg.permId, msg.decision ?? 'deny', msg.answers, msg.sessionId);
+      const resolved = resolvePending(
+        msg.permId,
+        msg.decision ?? 'deny',
+        msg.answers,
+        msg.sessionId,
+      );
+      if (!resolved) {
+        sendPermissionResponseRejected(
+          ctx.connRegistry.get(connectionId)?.transport,
+          connectionId,
+          msg.permId,
+          msg.sessionId,
+        );
+      }
       log.info('permission_response', {
         connectionId,
         sessionId: msg.sessionId,
         permId: msg.permId,
       });
+      return resolved;
     },
   );
 }
@@ -1266,9 +1306,17 @@ export async function dispatchV2Message(
 
   const result = IncomingWsMessageV2.safeParse(parsed);
   if (!result.success) {
+    const candidate = parsed as Record<string, unknown>;
+    if (candidate?.type === 'permission_response' && typeof candidate.permId === 'string')
+      sendPermissionResponseRejected(
+        transport,
+        connectionId,
+        candidate.permId,
+        typeof candidate.sessionId === 'string' ? candidate.sessionId : undefined,
+      );
     log.debug('unrecognized v2 message', {
       connectionId,
-      type: (parsed as Record<string, unknown>)?.type,
+      type: candidate?.type,
     });
     return;
   }
@@ -1329,12 +1377,11 @@ export function scheduleV2Message(
 ): Promise<void> {
   let isControl = false;
   try {
-    const parsed = IncomingWsMessageV2.safeParse(JSON.parse(raw));
+    const rawMessage = JSON.parse(raw) as Record<string, unknown>;
+    const parsed = IncomingWsMessageV2.safeParse(rawMessage);
     isControl =
-      parsed.success &&
-      (parsed.data.type === 'stop' ||
-        parsed.data.type === 'interrupt' ||
-        parsed.data.type === 'permission_response');
+      rawMessage.type === 'permission_response' ||
+      (parsed.success && (parsed.data.type === 'stop' || parsed.data.type === 'interrupt'));
   } catch {
     // Malformed messages stay on the ordinary FIFO and are ignored by dispatch.
   }