Problem

Users keep reporting that complete_step "fails all the time". Session forensics (local logs + #2917's attached transcript) show 5 of 18 real complete_step calls rejected, every one a false negative: the step was genuinely done and verified, but the citation didn't byte-match the receipt. Each rejection then cascades into a todo_write failure (its guard wants a prior complete_step), and in the worst case the model gives up and overclaims in the final answer (#2917).

The observed failure shapes, all from real transcripts:

1. Dropped cd prefix — ran cd /repo && git merge upstream/main-v2 --ff-only, cited git merge upstream/main-v2 --ff-only ([Bug]: todo_write / complete_step 失败后，Agent 仍允许最终回答“全部完成” #2917). Not a prefix relation, so the fix(agent): reduce evidence verification false signals #3587 session fallback missed it too.
2. Flag/quote drift — ran rm -v x && ls -la x 2>&1 || true, cited rm -v x && ls x 2>&1; ran echo "deleted", cited echo 'deleted'.
3. Compound-segment citation — ran seq …; cat x; wc -l x, cited just wc -l x.
4. Negative verification dead end — ran ls deleted-file to prove a deletion; it exits 2, so no successful receipt can ever exist. The old error was indistinguishable from "never ran".
5. Schema said command/paths were optional while the host requires them — models follow the schema and get rejected.
6. Shell-redirect files — seq … > file leaves no reader/writer receipt, so files evidence for the file always failed; models recovered by re-writing the whole file with write_file just to mint a receipt.

Fix

• Segment matching (evidence.CommandMatches): split cited and ran commands on &&/||/;/|/newlines, quote-strip and whitespace-normalize tokens; a cited segment is covered by a ran segment that equals it or token-supersets it under the same head token. One-token citations still require exact equality; an aggregated citation that no single command covers is still rejected (anti-fabrication holds — a condensed made-up command in the e2e run was still refused).
• Session fallback hardened: uses the same matcher and now skips calls whose recorded result is an error or block, closing the false positive where any attempted command counted as proof.
• Actionable rejections: ran-but-nonzero is now distinguished from never-ran (with a || true hint for negative verification); never-ran rejections list the turn's actual receipts; todo_write's cascade error explains the complete_step-first order. In e2e, every remaining legitimate rejection self-corrected in 1–2 rounds instead of looping blind.
• Schema truthful: command is marked REQUIRED for verification, paths for diff/files.
• Redirect-created files: a successful bash command whose text names the path now counts as a files receipt.

Verification

• Unit replays of all observed failures, verbatim from the transcripts (completestep_test.go, commandmatch_test.go).
• End-to-end A/B against the real DeepSeek API (deepseek-v4-flash, the same scenario the June 2 sessions failed on — create 20-line file → append → delete lines → delete file → negative-verify):
  • base (origin/main-v2): 4/8 complete_step calls rejected, 21 rounds.
  • fixed: 4/4 complete_step first-try, 0 todo_write failures, 16 rounds, all sign-offs host-verified 1, manual/unverified 0.
• go test ./internal/evidence/... ./internal/tool/builtin/... ./internal/agent/... ./internal/cli/... ./internal/control/... green; go vet clean.

Related: #2917, #3469, #3911, #3587.