Public PvZ AI — release candidate, September 20

Prepared behavior

The normal hosted game uses the signed-in Yumina account. It reads the account's official/private selection, active owned API profile, saved model and current generation preferences. Dave, story choices, individual plants and Garden replies all use this path. There is no separate game API-key setup.

Private generation uses the exact active profile, including custom endpoint and format metadata. An OpenRouter model named anthropic/... stays on the selected OpenRouter profile even when that account also owns a direct Anthropic key. Keys are decrypted only on the server. Config responses contain no credentials or custom endpoint. A missing/deleted selection falls back to the newest owned profile; an invalid selected key does not try another key or official credits.

The game refreshes saved settings before a reply. A profile/account/provider change between config discovery and generation is rejected before authorization or provider spending. The shared Yumina generation resolver supplies temperature, sampling, penalties, context/output limits, reasoning and streaming preferences. Official requests retain the existing wallet, plan/model eligibility and atomic billing/notebook/usage transaction. Native gameplay remains available without AI.

Exact candidate

• Host branch: codex/pvz-release-20260920, in yumina-pvz-release.
• Account integration commit: 72740f8fa.
• Incorporated platform revision: 3b774ecb2 (merge into the isolated branch).
• Game compiled build: pvz-dave-adventure/output/public-ai-release.
• Normal online launch package: pvz-dave-adventure/output/public-ai-launch.
• Static build ID: 0c135b36f2; manifest.json records object keys, SHA-256 and cache headers. Upload these bytes, not raw wasm/shell.html.
• Art uses the already published immutable resource manifest b8fc45efed0a2fc7bf5024edf5dac6e2805531b60649173a6ed1166d8e6f511a.
• Required host features: source story, Garden conversation, Garlic choices, account AI settings, and the funny-v1 save edition.

Verification

• Full pnpm build: 5/5 tasks; pnpm typecheck: 8/8 tasks, after merging current main.
• 321 NPC/account/story/HTTP checks and 3 save/model-embed checks passed using the isolated server test launcher. Actual HTTP config checks cover two users, changed preferences and ownership. Resolver checks cover private routing and bad-key behavior; service checks reject a changed profile before spending.
• Compiled browser flow changes the saved model and profile while the game stays open. The real resolver/service fixture checks the second profile's key, endpoint, model and generation settings; a valid native Garlic order is applied, cancellation works and combat continues. This uses synthetic keys/provider output, not a paid external call.
• The normal launch package boots through the menu into source 1-1, strips copied preview-level parameters, disables debug skipping and uses the independent funny-v1 account save. No browser JavaScript errors were observed.
• Client model refresh and plant-promise checks: 11 passed; package checks: 4 passed.

Evidence: host pvz-public-full-build.log, pvz-public-full-typecheck.log, pvz-public-contracts.log, pvz-public-routes.log; game output/public-settings-browser/, output/public-ai-launch-check.log and output/launch-entry/result.json.

Remaining publication steps

1. Release this compatible host branch through Yumina's normal reviewed release process. This work has not pushed main, deployed Railway, changed production variables or written production data. The account integration adds no schema migration; existing encrypted profiles and notebook storage are reused.
2. With an authenticated account, check /api/game/npc/dave/config advertises account-ai-settings-v1 and the other NPC capabilities. Check the new save edition is supported. Do not install the new game shell against the older API.
3. Upload the manifest's hashed JavaScript/WASM objects to their pvz-page/ keys; verify their bytes, then replace both HTML objects last with no-store. Preserve the previous HTML for rollback and the old save slot. The existing packages/server/scripts/upload-pvz-page.mjs now accepts this manifest package directly. From packages/server, run node scripts/upload-pvz-page.mjs <public-ai-launch-directory> --dry-run to validate without credentials or uploads. After host verification and publication authorization, the same command without --dry-run verifies stored engines before updating HTML. Immutable collisions stop publication.
4. On the deployed same-origin /pvz/ page, smoke-test one official account and one BYOK account: a Dave reply, a story choice, a plant reply, a model/profile change and a saved-game reload. Verify expected usage accounting. Test a signed-out user and unavailable AI still leave ordinary gameplay usable.

The immutable CDN preview remains intentionally offline. It is not a public live AI acceptance test. Final deployed provider/auth/cookie checks remain outstanding until the compatible host and normal game package are published together.

Platform-controls follow-up

The embedded model picker now refreshes the current profile, credits and scoped pins before loading its catalog. Returning from another settings tab updates the selected model. A deleted profile follows the server's resolved owned profile locally, rather than mixing catalogs from every saved key. A profile changed while the picker is open cannot confirm a selection from the previous catalog; failed profile reads show recovery instead of a stale list.

Focus refresh preserves the trigger DOM node, so the first click into the game frame still opens the picker. The legacy separate-tab picker now accepts both official and private readiness, without telling an official user to add a key. Its EN/ZH/ES wording is provider-neutral. Shared Yumina model dialogs are reused.

Verification after these changes:

• Six app tests pass, including a real React adapter/store test reproducing the old-profile catalog bug, focus during a pending refresh, rejected stale profile selection, failed refresh and changed account.
• A browser run against the production-built app uses the actual model dialog: first click, private profile switch, acknowledged model selection back into the parent game frame, and official separate-tab fallback all pass with no page errors. This is a synthetic account transport, not production authentication.
• Twenty-one native-shell account/save/model tests pass, covering guest/account separation, stale tabs, save conflicts and offline recovery.
• Full build/typecheck passed; the final focus fix also passed a fresh app build.

Evidence: pvz-picker-green.log, pvz-smooth-build.log, pvz-smooth-typecheck.log, pvz-smooth-app-build.log, pvz-controls-browser.log, output/pvz-public-controls/; game output/public-account-flow.log. The game package remains 0c135b36f2 because this follow-up changes only the host controls. Include this follow-up commit in the compatible host release; publication steps above still apply.

For the requested large public launch, see scale release gates. The candidate now includes bounded AI admission, a read-only fast path for existing campaign notebooks and long-lived caching for immutable packaged art. These improvements do not replace staging capacity verification.