PvZ computer-model integration

PvZ previously interpreted account AI preferences as either a private API key or Yumina billing. A saved local/ selection could disappear from Dave's configuration, or be passed to an OpenRouter key as a cloud model. The game picker also ran outside AppShell, which normally resumes the browser courier.

The account-selected computer model now retains its own source identity and uses the authenticated owner's existing LocalBridgeProvider. Its selection survives a disconnected runtime; there is no automatic paid fallback, key lookup, or wallet debit. JSON mode and terminal stop reasons survive the server/browser/runtime round trip, so truncated answers cannot grant actions. Live browser heartbeats refresh the advertised inventory before its five-minute expiry. Ordinary non-JSON world turns retain their existing request shape.

Both PvZ picker paths persist only the model field before asking the native game to refresh its source identity. An optional account-binding header rejects a save if the login changed; existing settings clients remain compatible. The embedded picker resumes the already-enabled local connection and exposes its status and reconnect action. Computer models appear separately from the private key catalog, including when they disconnect. Parent-owned close messages are not echoed back into later openings.

Verification

• The new account-provider test first reproduced the wrong private-router path.
• Before the transport change, a browser job omitted JSON mode and a valid-looking gift with terminal length was accepted. Both regression checks now pass.
• 479 NPC, route, billing, account and provider checks passed through the isolated server launcher. The affected provider tests also pass after merging current main's local-model thinking change.
• Ten app bridge/handoff/account integration checks and five actual sandbox picker checks pass. The native companion passes 698 web/packaging checks.
• Hosted build/typecheck and the local OSS export verification passed. Required repository CI verifies the final committed tree.
• The local compiled-game browser runner uses the real platform picker and real LocalBridgeProvider/registry with an intercepted loopback runtime. It checks 1-1's unread question, retained draft/pause, account model handoff, and a reply round trip after closing/reopening settings. A synthetic HTTP rejection ends the native submission intentionally: this does not claim live-model writing quality or a completed level.

The native companion keeps its local courier iframe alive while controls are closed, resumes it when typing into a story choice, and disposes it on account cleanup/page exit. No native combat, story timing, save format, production variable, or database schema is changed by the host patch. Model availability still depends on the player's runtime/browser, as in other Yumina worlds.

Retained local evidence: output/npc-local-full.log, merged-bridge-tests.log, merged-app-tests.log, picker-local-section.log, build-merged.log, typecheck-merged.log, oss-local.log, and the compiled browser receipts. This is not physical-phone, full-campaign balance, or large-audience load proof.