PvZ Adventure host integration — September 20

Prepared on codex/pvz-release-20260920 from main c530d25cd in an isolated worktree. This is a reviewable host change, not a deployment. Production remains unchanged.

Compatibility

• Existing /api/game/npc/dave, /dave/config, and /dave/notebook routes remain.
• Legacy 4× snapshots remain accepted; new source snapshots and classic 3× snapshots have explicit bounded schemas.
• Source choices, numeric replies, individual plant replies, Chomper meal selection, 3-3 head wager, 3-4 doubling trick and 4-1 gift shuffle use the same authenticated service.
• Hidden gift positions are removed from provider context. AI returns legal choice values, never executable code or arbitrary rewards.
• Existing selected provider/model, account checks, concurrency, timeout, private-key isolation, official-credit authorization and transactional usage recording are retained.
• Notebook JSON gains optional defaulted fields; this change adds no database migration. Existing memory tables and campaign notebook storage are reused.
• The legacy offer catalog stays supported; source plant replies cannot modify Dave's affection or manufacture another character's memory.

Only Dave modules, their tests, shared Dave contracts/exports, routes and a test fixture were carried over. Main's billing, provider, account, app, deployment and unrelated shared exports were retained.

Verification

• pnpm build: all five tasks passed (existing app bundle-size warning).
• pnpm typecheck: all eight tasks passed.
• 310 Dave module checks: initial run passed 309; the remaining test exposed an omitted test-only stdin fixture. The fixture was included and that test passes on rerun.
• Eight focused source-choice and HTTP route checks passed, covering malformed/oversized input, account changes, disabled generation, target validation before provider lookup and the real service fixture.

Evidence is in local pvz-full-build.log, pvz-full-typecheck.log, pvz-contract-tests.log, and pvz-route-tests.log. These checks use deterministic providers; separately recorded local preview checks have exercised the user's saved live provider.

Release dependency

The immutable S3 preview intentionally blocks platform APIs. Its offline bootstrap must not be mistaken for the normal hosted game. Release the normal game artifact only with this compatible host revision after deployment is authorized. This branch does not change Railway variables, push main, replace live game files, or write production data.

Full-game additions

Garden requests use a separate strict observation mode and individual pot context. Replies cannot offer rewards, change Dave's bond, append his notebook dialogue or execute a native action. Sprout species remain hidden. Normal garden care/growth/coins stay native. The frontend persists each pot's conversation in the account/profile save; moving/growing a pot preserves its reserved identity.

GET/PUT /api/game/pvz/save?edition=funny-v1 select game_player_state.module_id = pvz-funny-v1. Existing callers without the parameter keep pvz. Both slots retain account ownership, revision CAS and size/path bounds. No migration or legacy-save conversion is needed. Unknown editions are rejected. The new launch package advertises this host dependency and never sends its saves to the old slot. Preview documents remain local-only.

Verification: 314 Dave contract tests, 19 browser save lifecycle tests, PGlite SQL tests proving both editions coexist with independent revisions. Compiled EN/ZH Garden checks enter through the actual menu, address a plant, persist its identity and conversation, reload, and include the earlier exchange in the next request. Native Garden effects remain absent. Adventure Chomper conversation and one-meal targeting also survive a compiled save/reload.

Local-only commits so far: 475dfbaed, bba3ffa56, 732de7f4c. Final cloud-edition commit follows verification. The full source campaign actual-award audit passes all 21 source levels and four representative classic finales (25/25); earlier classic campaign coverage completes 22–50. Automated house protection is not evidence of human balance.

Latest additions: e3d180ca8 isolates the save edition and 0c531eaca tightens Garden voice. Garlic uses an individual, revision-bound capability for up/down/ ordinary routing. Its provider response cannot attach other effects, rewards or Dave relationship changes. Only an explicit command selects a route; native terrain validation and bite commitment remain authoritative. Current verification passes all 315 Dave contract tests, a fresh shared build and server typecheck. The new static manifest names classic-garlic-v1 as a host dependency.