acli: fix Windows TUI (run_command, wheel scroll) + bench-driven fixes - #188

Summary

Two user-facing Windows TUI repairs, plus the agent-side changes that came out of running the hard task set of terminal-bench, plus the v0.6.4 sync.

Windows TUI: the shell tool was unusable, and scrolling was broken

• run_command failed on every single call inside the TUI, with AttributeError: '_PrintCapture' object has no attribute 'encoding'. The decode path read sys.stdout.encoding, but textual replaces sys.stdout with a capture object that has no .encoding — and the read was guarded by an IS_WINDOWS branch, so POSIX short-circuited and never hit it. The command actually ran; only the decoding blew up, and the error surfaced as a tool failure, so the model retried the identical call until the turn died. The console encoding is now resolved once at import, before the TUI takes over stdout.
• The same block corrupted commands containing double quotes: powershell -Command "<cmd>" went through create_subprocess_shell, i.e. through cmd.exe first, so the command was parsed twice. It is now a single argv element via create_subprocess_exec, prefers pwsh (PowerShell 7) over the legacy powershell.exe, and adds -NoProfile — profile scripts were costing hundreds of milliseconds on every call.
• The mouse wheel moved the input box instead of scrolling the output. Mouse capture was defaulted off on Windows, so the terminal never learned the app wanted mouse events and translated the wheel into arrow keys: those hit CommandInput's history, so wheeling up walked backwards through previous inputs while the output area never moved, and wheeling down walked back to the draft. Alternatively the console host scrolled its own buffer and dragged the whole screen. Capture is now on everywhere; tui_mouse = false stays as the escape hatch for terminal-native selection (Alt/Option-drag to copy).

From the hard-task bench work

• Post-change verification rule + plan wiring — on receiving a requirement the agent must analyze, split the work, write a plan, set up verification (e.g. unit tests), and only then start editing files or running commands. Motivated by tasks where it declared itself done without ever executing a test.
• Budget-aware nudge + retry hardening — fewer turns lost to transient provider failures.
• oneshot --max-turns / --protocol overrides — callers driving acli non-interactively need to set the turn budget per task; the flags were previously ignored.
• Default model → qwen3.8-max across config, tongyi provider, SDK, embedded UI, setup preset and both examples.

Two generalizable agent defects surfaced while reading the failures, worth noting even though neither is fixed here:

• A task validated its own output with jsonschema.validate, passed its own check, and still got the result wrong — the schema constrained a field to "an object" but said nothing about the key names, which the grader indexes differently. Schema-valid is not spec-correct; literal output-contract details (key names, units) have to be checked against the task text.
• A turn burned on /bin/sh: 1: time: not found, because time is a shell builtin and is unavailable under sh -c.

The other observation is that these tasks are limited by per-turn model latency rather than by the turn budget: wall clock is dominated by waiting on the model between tool calls, and raising the turn ceiling changed no outcome. Per-call token usage is not captured yet, so "prompt too large" cannot be distinguished from "model slow" — that instrumentation is the prerequisite for optimizing further.

Also in this sync

• Executor confirm_mode = dangerous — only risky operations prompt for confirmation.
• TUI markdown table rendering; input draft restored around confirm prompts.
• New memory reflection module.

Test plan

• Upstream acli unit suite: 17 pre-existing failures (test_executor, test_governance_edge), no new ones.
• 7 new tests cover the Windows run_command path, reproduced on POSIX by forcing IS_WINDOWS and installing textual's real _PrintCapture — including the verbatim AttributeError the field report showed. 3 new tests pin the tui_mouse default and its config escape hatch.
• Mirrored tree passes black and the dashscope.acli import check run by scripts/sync_acli.sh.
• Needs a real Windows box: under PowerShell 7 in Windows Terminal, wheel-scroll the output (output must scroll, input box must not move) and run a command containing double quotes, e.g. python -c "import os; print(os.getcwd())".
• Confirm legacy conhost does not regress — that is where mouse capture was originally reported as crash-prone; tui_mouse = false reverts it.