PvZ account and AI integration audit — September 20

PvZ already used the authenticated account's official/private provider selection, active owned API profile, saved model and generation settings. Its prompt assembly did not include the current persona or enabled global prompts. This was a real parity gap with regular Yumina games, reproduced through the actual NPC route.

Changes

• Resolve the current account persona from the primary database on each generated turn, using resolvePersonaForWorld. With no persona, use the same account username/display-name fallback as regular worlds. Persona edits and selection changes affect later turns; historical dialogue and saves are not rewritten.
• Reuse regular chat's global-prompt loader, including disabled-folder filtering, and the engine's prompt builder for ordering, depth, post-history and macros. follows the current identity and follows the actual speaker, including hiding a Garden sprout's unrevealed species.
• Apply this context to Dave, authored-choice replies, battlefield plant dialogue and Garden dialogue. Client payloads cannot supply persona/profile fields. Private persona notes, emails, key material and other accounts' data are excluded.
• Include the extra context in the existing context-budget check before model calls or billing. Native actions still require a valid, current engine decision.
• A live BYOK test found Garden providers sometimes returning plain dialogue despite JSON mode. Strengthen the output instruction and accept bounded plain Garden speech only. Partial JSON, markup, directives, oversized output and truncated replies still fail. Battlefield prose never becomes an action.

The prompt loader was extracted without changing regular chat's filtering logic. PvZ does not import conversations from other worlds. Its existing campaign-scoped memory, affection, source-event observations and save ownership remain separate. No database migration, account preference edit, art update or new game UI is needed.

Evidence

• The persona integration regression failed before the fix: the outgoing model prompt contained no selected persona. Route tests now cover account isolation, switching personas, editing a persona, clearing the selection, prompt disabling, macro expansion, generation settings, response shape and forged client fields.
• Service checks cover Dave, source plants, classic plants and Garden plants; oversized account context is rejected before authorization/provider work.
• Garden plain-speech regression reproduced invalid_reply before the fix.
• Two final real-provider requests through the updated service used the dedicated development account's existing private profile, model, generation settings and selected persona. English 1-1 chose the authored novice branch and used the correct name. Chinese Garden dialogue used the same identity and accepted the nickname without granting any reward. Both final outputs were valid JSON. Earlier plain-speech failures remain covered by a deterministic regression.
• The live check reads the development DB in a READ ONLY transaction. It writes neither account settings nor notebooks/billing to a real database. Receipts are local. This is live BYOK evidence, not signed-in production billing evidence.

Local receipts in the isolated worktree: output/pvz-account-final-tests.log, output/pvz-account-final-build.log, output/pvz-account-final-typecheck.log, output/pvz-account-live-final.json. The manual two-request checker is packages/server/scripts/pvz-account-live-check.mts; it requires an explicit environment file, designated account email and output path.

Public launch limits

This fixes account-context parity; it does not establish that all game branches are bug-free or that the deployment can serve the advertising audience at peak. The prior native acceptance run covered all 50 levels with assisted combat and mid-level save/reload; mobile browser checks used emulation, not physical phones.

Still required before scaling paid acquisition: signed-in production official credit and private-provider flows with cross-device saves; actual iOS/Android loading and sustained play; an authenticated traffic ramp against deployed infrastructure; full regional Versus matches/reconnects; ordinary human balance and story review beyond the opening world. Later classic combat remains the accepted baseline, with fewer connected story payoffs than the user's first world.