@@ -13,7 +13,7 @@ export {
 } from "./taskMessages"
 export { taskMetadata } from "./taskMetadata"
 export { ensureMessageIdentifiers } from "./mergeMessageSnapshots"
-export { TaskHistoryStore } from "./TaskHistoryStore"
+export { TaskHistoryDeleteError, TaskHistoryStore } from "./TaskHistoryStore"
 export {
 	abandonDelegatedChild,
 	assertValidTransition,
 
@@ -6,16 +6,17 @@ import { TelemetryService } from "@roo-code/telemetry"
 
 import { getReadablePath } from "../../utils/path"
 import { isPathOutsideWorkspace } from "../../utils/pathUtils"
+import { versionTokenOfStat } from "../../utils/versionToken"
 import { Task } from "../task/Task"
 import { formatResponse } from "../prompts/responses"
 import { fileExistsAtPath } from "../../utils/fs"
 import { RecordSource } from "../context-tracking/FileContextTrackerTypes"
 import { unescapeHtmlEntities } from "../../utils/text-normalization"
 import { EXPERIMENT_IDS, experiments } from "../../shared/experiments"
 import { computeDiffStats, sanitizeUnifiedDiff } from "../diff/stats"
-import { versionTokenOfStat } from "../../utils/versionToken"
 import type { DiffResult, ToolUse } from "../../shared/tools"
 
+import { canonicalizeForApproval } from "./guardedWrite"
 import { BaseTool, ToolCallbacks } from "./BaseTool"
 
 interface ApplyDiffParams {
@@ -75,21 +76,24 @@ export class ApplyDiffTool extends BaseTool<"apply_diff"> {
 				return
 			}
 
-			// The tool's own read is what the diff hunks are matched against, and the guarded publish below
-			// consumes an observation: leave it unrecorded and the approved publish is an unobserved write the
-			// guard refuses, even though this tool just read the exact bytes the patch was applied to. Record
-			// it stat-matched (S2) and incomplete -- a hunk read authorises only the lines the patch touched,
-			// so it must not become authority for a later full-file replacement. A prior observation is
-			// carried, partial stays partial and complete stays complete, only while it still describes the
-			// version this read published; an older one is left exactly as the model earned it, since
-			// refreshing it here would hand the guarded save a compare-and-swap token for content the model
-			// never saw. Same policy as ApplyPatchTool's read.
+			// The diff below is built from this exact read, so the save that follows must be
+			// authorized against the version captured here - not against whatever version the
+			// preview happens to stat afterwards. Same contract as ApplyPatchTool's hunk read:
+			// stat around the read and observe only when the file did not change underneath it.
 			const preReadStats = await fs.stat(absolutePath, { bigint: true }).catch(() => undefined)
 			const originalContent: string = await fs.readFile(absolutePath, "utf-8")
 			const postReadStats = await fs.stat(absolutePath, { bigint: true }).catch(() => undefined)
 			if (preReadStats && postReadStats) {
 				const preReadToken = versionTokenOfStat(preReadStats)
 				if (preReadToken === versionTokenOfStat(postReadStats)) {
+					// A tool read is not a model read. With no prior observation this stays a
+					// partial observation of the version the diff was computed against - the only
+					// authorization the save can have, since apply_diff computes its hunks from
+					// this read. When the model already observed the file, keep the completeness it
+					// earned, but only on the version it was earned on: refreshing an OLDER
+					// observation to the current version would let content the model built from a
+					// stale read pass the compare-and-swap, so an out-of-date observation is left
+					// alone and the save fails with the re-read remediation.
 					const prior = task.observationRegistry.get(absolutePath)
 					if (prior === undefined) {
 						task.observationRegistry.observe(absolutePath, preReadToken, false)
@@ -162,7 +166,19 @@ export class ApplyDiffTool extends BaseTool<"apply_diff"> {
 
 			// Check if file is write-protected
 			const isWriteProtected = task.rooProtectedController?.isWriteProtected(relPath) || false
+
+			// The guard in guardedWrite refuses a target outside every workspace root unless the tool
+			// layer says the user approved this one, and it binds the publish to the identity that was
+			// approved. apply_diff has both save paths behind an askApproval, so it has to carry both
+			// through; without them an approved write outside the workspace is rejected by its own guard.
 			const isOutsideWorkspace = isPathOutsideWorkspace(absolutePath)
+			// Captured before the approval is asked: guardedWrite binds the publish to this identity, so
+			// a name repointed between the approval and the publish is refused instead of publishing to
+			// whatever the name points at by then. Inside the try so an unresolvable target goes through
+			// the tool's normal error handling and the diff-view reset.
+			const approvedCanonicalTarget = isOutsideWorkspace
+				? await canonicalizeForApproval(absolutePath, relPath)
+				: undefined
 
 			const sharedMessageProps: ClineSayTool = {
 				tool: "appliedDiff",
@@ -200,7 +216,8 @@ export class ApplyDiffTool extends BaseTool<"apply_diff"> {
 					return
 				}
 
-				// Save directly without showing diff view or opening the file
+				// Save directly without showing diff view or opening the file. The diff is
+				// applied to an existing file, so edit-guard semantics require a prior read.
 				task.diffViewProvider.editType = "modify"
 				task.diffViewProvider.originalContent = originalContent
 				await task.diffViewProvider.saveDirectly(
@@ -209,10 +226,12 @@ export class ApplyDiffTool extends BaseTool<"apply_diff"> {
 					false,
 					diagnosticsEnabled,
 					writeDelayMs,
-					// An apply_diff publish is a targeted hunk over content this tool read, so it is guarded as an
-					// edit: a partial observation authorises it and stays partial. On the "create" default the guard
-					// reads it as a fresh file and refuses the diff the user just approved.
 					"edit",
+					// Seventh parameter is completeOverride (this call claims no completeness of its
+					// own); the eighth is the approval flag for a target outside every workspace root.
+					undefined,
+					isOutsideWorkspace,
+					approvedCanonicalTarget,
 				)
 			} else {
 				// Original behavior with diff view
@@ -251,12 +270,14 @@ export class ApplyDiffTool extends BaseTool<"apply_diff"> {
 					return
 				}
 
-				// Call saveChanges to update the DiffViewProvider properties. The save is the same targeted hunk
-				// as the guarded save above, so it must select the same edit guard: on the "update" default the
-				// guard reads the accepted preview as a full-file replacement and demands a complete observation
-				// the model never earned, which throws the approved diff away behind a re-read-the-whole-file
-				// remediation.
-				await task.diffViewProvider.saveChanges(diagnosticsEnabled, writeDelayMs, "edit")
+				// Call saveChanges to update the DiffViewProvider properties
+				await task.diffViewProvider.saveChanges(
+					diagnosticsEnabled,
+					writeDelayMs,
+					"edit",
+					isOutsideWorkspace,
+					approvedCanonicalTarget,
+				)
 			}
 
 			// Track file edit operation
 
@@ -17,13 +17,14 @@ import type { ReadFileParams, ReadFileMode, ReadFileToolParams, FileEntry, LineR
 import { isLegacyReadFileParams, type ClineSayTool } from "@roo-code/types"
 
 import { Task } from "../task/Task"
+import { versionTokenOfStat } from "../../utils/versionToken"
 import { formatResponse } from "../prompts/responses"
 import { RecordSource } from "../context-tracking/FileContextTrackerTypes"
 import { isPathOutsideWorkspace } from "../../utils/pathUtils"
 import { getReadablePath } from "../../utils/path"
 import { extractTextFromFile, addLineNumbers, getSupportedBinaryFormats } from "../../integrations/misc/extract-text"
 import { readWithIndentation, readWithSlice } from "../../integrations/misc/indentation-reader"
-import { DEFAULT_LINE_LIMIT } from "../prompts/tools/native-tools/read_file"
+import { DEFAULT_LINE_LIMIT, MAX_LINE_LENGTH } from "../prompts/tools/native-tools/read_file"
 import type { ToolUse, PushToolResult } from "../../shared/tools"
 
 import {
@@ -215,14 +216,36 @@ export class ReadFileTool extends BaseTool<"read_file"> {
 					// Read text file content with lossy UTF-8 conversion
 					// Reading as Buffer first allows graceful handling of non-UTF8 bytes
 					// (they become U+FFFD replacement characters instead of throwing)
+					// A2 (epic #1375): capture the on-disk token before the read so a mutation
+					// landing mid-read is detected by the post-read stat below.
+					const preReadStats = await fs.stat(fullPath, { bigint: true }).catch(() => undefined)
 					const buffer = await fs.readFile(fullPath)
 					const fileContent = buffer.toString("utf-8")
-					const result = this.processTextFile(fileContent, entry)
+					// A lossy decode is not the whole file: the model never saw those bytes.
+					const lossyDecode = !Buffer.from(fileContent).equals(buffer)
+					// S4b follow-up (#46 / epic #1375): processTextFile reports whether the
+					// returned content is the whole file; the observation below records that
+					// scope so the write guard can deny full-file updates built on a partial view.
+					const processed = this.processTextFile(fileContent, entry)
 
 					await task.fileContextTracker.trackFileContext(relPath, "read_tool" as RecordSource)
 
+					// A2 (plan #33 / epic #1375): record the observed on-disk version for the future write guard.
+					// The token is captured before AND after the read; the target is observed only
+					// when both match — a mutation between the two stats means the content the model
+					// received is not the on-disk state, and observing it would let a later write
+					// match a token the model never saw. A stat failure leaves the target
+					// unobserved and never fails the read.
+					const postReadStats = await fs.stat(fullPath, { bigint: true }).catch(() => undefined)
+					if (preReadStats && postReadStats) {
+						const preReadToken = versionTokenOfStat(preReadStats)
+						if (preReadToken === versionTokenOfStat(postReadStats)) {
+							task.observationRegistry.observe(fullPath, preReadToken, processed.complete && !lossyDecode)
+						}
+					}
+
 					updateFileResult(relPath, {
-						nativeContent: `File: ${relPath}\n${result}`,
+						nativeContent: `File: ${relPath}\n${processed.content}`,
 					})
 				} catch (error) {
 					const errorMsg = error instanceof Error ? error.message : String(error)
@@ -266,8 +289,14 @@ export class ReadFileTool extends BaseTool<"read_file"> {
 
 	/**
 	 * Process a text file according to the requested mode.
+	 *
+	 * Returns the content string plus whether that content is the complete
+	 * file (S4b follow-up #46 / epic #1375): slice mode is complete only
+	 * when it starts at line 1, returns every line, and was not truncated;
+	 * indentation mode is never complete because it returns semantic blocks
+	 * of the file, not the file itself.
 	 */
-	private processTextFile(content: string, entry: InternalFileEntry): string {
+	private processTextFile(content: string, entry: InternalFileEntry): { content: string; complete: boolean } {
 		const mode = entry.mode || "slice"
 
 		if (mode === "indentation") {
@@ -300,7 +329,8 @@ export class ReadFileTool extends BaseTool<"read_file"> {
 				output += `\n\nIncluded ranges: ${rangeStr} (total: ${result.totalLines} lines)`
 			}
 
-			return output
+			// Indentation mode returns semantic blocks: never a complete file view.
+			return { content: output, complete: false }
 		}
 
 		// Slice mode (default): simple offset/limit reading
@@ -323,11 +353,35 @@ export class ReadFileTool extends BaseTool<"read_file"> {
 	To read more: Use the read_file tool with offset=${nextOffset} and limit=${limit}.
 	
 	${result.content}`
+			if (result.hasClippedLines) {
+				// The slice cut lines off and also clipped long lines inside it, so both
+				// notices belong to the response.
+				output += `\nNote: Some lines in this view exceed ${MAX_LINE_LENGTH} characters and were clipped in this view.`
+			}
+		} else if (result.hasClippedLines) {
+			// The slice reached the end of the file, so there is no later offset to read: report
+			// the clipping without a next-offset hint, and keep the read incomplete so a full-file
+			// replacement cannot be built from a clipped line. "Read in full" is only true from the
+			// requested offset onward, and a model that reads it literally would think the lines
+			// before that offset were included.
+			const coverage =
+				offset0 === 0 ? "The file was read in full" : `The file was read from line ${offset1} onward`
+			output = `IMPORTANT: Some lines exceed ${MAX_LINE_LENGTH} characters and were clipped in this view. ${coverage}, but the clipped lines were not shown in full.
+				${result.content}`
 		} else if (result.returnedLines === 0 && result.totalLines === 0) {
+			// Only a truly empty file is reported as empty. A slice that starts past the last line
+			// returns the producer's beyond-EOF text (src/integrations/misc/indentation-reader.ts),
+			// which must reach the model instead of being replaced by an empty-file note.
 			output = "Note: File is empty"
 		}
 
-		return output
+		// Complete only when the slice starts at line 1, returned every line, and
+		// showed every line in full (returnedLines === totalLines follows from the
+		// first two conditions): a partial start, a truncated tail, or a clipped
+		// line means the model did not see the whole file.
+		const complete = offset0 === 0 && !result.wasTruncated && !result.hasClippedLines
+
+		return { content: output, complete }
 	}
 
 	/**
@@ -770,9 +824,20 @@ export class ReadFileTool extends BaseTool<"read_file"> {
 				}
 
 				// Read text file
-				const rawContent = await fs.readFile(fullPath, "utf8")
+				// A2 (epic #1375): capture the on-disk token before the read so a mutation
+				// landing mid-read is detected by the post-read stat below.
+				const preReadStats = await fs.stat(fullPath, { bigint: true }).catch(() => undefined)
+				const rawBuffer = await fs.readFile(fullPath)
+				const rawContent = rawBuffer.toString("utf-8")
+				// Same contract: a lossy decode is a partial view.
+				const lossyDecode = !Buffer.from(rawContent).equals(rawBuffer)
 
 				// Handle line ranges if specified
+				// S4b follow-up (#46 / epic #1375): a line-range read returns only the requested
+				// ranges, and a slice truncated to DEFAULT_LINE_LIMIT returns only the head of
+				// the file — record such observations as partial so the write guard denies a
+				// full-file update built on them.
+				let readComplete = false
 				let content: string
 				if (entry.lineRanges && entry.lineRanges.length > 0) {
 					const lines = rawContent.split("\n")
@@ -792,15 +857,36 @@ export class ReadFileTool extends BaseTool<"read_file"> {
 					// Read with default limits using slice mode
 					const result = readWithSlice(rawContent, 0, DEFAULT_LINE_LIMIT)
 					content = result.content
+					readComplete = !result.wasTruncated && !result.hasClippedLines
 					if (result.wasTruncated) {
 						content += `\n\n[File truncated: showing ${result.returnedLines} of ${result.totalLines} total lines]`
+						if (result.hasClippedLines) {
+							// Both notices: the slice was truncated and a line inside it was
+							// clipped.
+							content += `\n\n[Some lines exceed the per-line length cap and were clipped in this view]`
+						}
+					} else if (result.hasClippedLines) {
+						content += `\n\n[Some lines exceed the per-line length cap and were clipped in this view]`
 					}
 				}
 
 				results.push(`File: ${relPath}\n${content}`)
 
 				// Track file in context
 				await task.fileContextTracker.trackFileContext(relPath, "read_tool")
+
+				// A2 (plan #33 / epic #1375): mirror the native path — record the observed
+				// on-disk version so legacy-format reads also feed the future write guard.
+				// Observe only when the pre-read and post-read tokens match (a mutation between
+				// them means the returned content is not the on-disk state). A stat failure
+				// leaves the target unobserved and never fails the read.
+				const postReadStats = await fs.stat(fullPath, { bigint: true }).catch(() => undefined)
+				if (preReadStats && postReadStats) {
+					const preReadToken = versionTokenOfStat(preReadStats)
+					if (preReadToken === versionTokenOfStat(postReadStats)) {
+						task.observationRegistry.observe(fullPath, preReadToken, readComplete && !lossyDecode)
+					}
+				}
 			} catch (error) {
 				const errorMsg = error instanceof Error ? error.message : String(error)
 				results.push(`File: ${relPath}\nError: ${errorMsg}`)
 
@@ -16,6 +16,7 @@ import { convertNewFileToUnifiedDiff, computeDiffStats, sanitizeUnifiedDiff } fr
 import type { ToolUse } from "../../shared/tools"
 
 import { BaseTool, ToolCallbacks } from "./BaseTool"
+import { canonicalizeForApproval } from "./guardedWrite"
 
 interface WriteToFileParams {
 	path: string
@@ -86,7 +87,6 @@ export class WriteToFileTool extends BaseTool<"write_to_file"> {
 
 		const fullPath = relPath ? path.resolve(task.cwd, relPath) : ""
 		const isOutsideWorkspace = isPathOutsideWorkspace(fullPath)
-
 		const sharedMessageProps: ClineSayTool = {
 			tool: fileExists ? "editedExistingFile" : "newFileCreated",
 			path: getReadablePath(task.cwd, relPath),
@@ -96,6 +96,14 @@ export class WriteToFileTool extends BaseTool<"write_to_file"> {
 		}
 
 		try {
+			// Captured before the approval is asked: guardedWrite binds the publish to this
+			// identity, so a name repointed between the approval and the publish is refused
+			// instead of publishing to whatever the name points at by then. Inside the try so a
+			// target that cannot be resolved goes through the tool's normal error handling
+			// (handleError and the diff-view reset) instead of escaping the write flow.
+			const approvedCanonicalTarget = isOutsideWorkspace
+				? await canonicalizeForApproval(absolutePath, relPath)
+				: undefined
 			task.consecutiveMistakeCount = 0
 
 			const provider = task.providerRef.deref()
@@ -132,7 +140,21 @@ export class WriteToFileTool extends BaseTool<"write_to_file"> {
 					return
 				}
 
-				await task.diffViewProvider.saveDirectly(relPath, newContent, false, diagnosticsEnabled, writeDelayMs)
+				// Guarded publish: this write carries the complete file content, so it uses
+				// create-guard semantics (unobserved targets may only be created when absent).
+				await task.diffViewProvider.saveDirectly(
+					relPath,
+					newContent,
+					false,
+					diagnosticsEnabled,
+					writeDelayMs,
+					"create",
+					// Seventh parameter is completeOverride (this call claims no completeness of its
+					// own); the eighth is the approval flag for a target outside every workspace root.
+					undefined,
+					isOutsideWorkspace,
+					approvedCanonicalTarget,
+				)
 			} else {
 				if (!task.diffViewProvider.isEditing) {
 					const partialMessage = JSON.stringify(sharedMessageProps)
@@ -164,7 +186,16 @@ export class WriteToFileTool extends BaseTool<"write_to_file"> {
 					return
 				}
 
-				await task.diffViewProvider.saveChanges(diagnosticsEnabled, writeDelayMs)
+				await task.diffViewProvider.saveChanges(
+					diagnosticsEnabled,
+					writeDelayMs,
+					// Name the guard explicitly: a whole-file write is an update, and
+					// relying on the parameter's default would silently re-select a
+					// different guard if the default ever moved.
+					"update",
+					isOutsideWorkspace,
+					approvedCanonicalTarget,
+				)
 			}
 
 			if (relPath) {