fix: declare Hermes auto image support and migrate running accounts

QUALIFICATION.md

@@ -15,6 +15,41 @@ credentials; requires manual iOS profile installation + full trust for WSS. Priv
 key URL remains404. Do not expose the entire cert directory. Initial container-copy
 profile disappeared during intervening deployment; persistent alias fixed it.
 
+## Hermes auto image input — live receipt 2026-10-02
+
+Verified upstream `/v1/responses` with model `auto`, an inline PNG containing
+red-left/blue-right panels, and reasoning effort `none`: HTTP200, served model
+`Qwen3.8-27b`, answer `Red Blue`, zero reasoning tokens. The initial control-exec
+probe was interrupted with exit137 during a control replacement; the successful
+probe ran from the stable administrator Hermes container.
+
+The shared provisioner now declares only
+`providers.hope-upstream.models.auto.supports_vision: true`. Existing managed
+model lists migrate to metadata mappings, preserving other settings. A durable
+private reload marker ensures restart retries survive control interruption.
+No global vision override was added for other selectable models.
+
+Deployed control image `hope-voice-control:vision-auto-v1`, also tagged `latest`,
+image `sha256:570319b3fd60c8161741a6c46cfc61f16a214383b8f8114c5692e00ca506197d`.
+Startup migrated and restarted both currently deployed accounts in place:
+
+- `hope-hermes-admin-69101358`: ready; real authenticated gateway image request
+  at port20000 returned HTTP200 and `Blue, red` for a blue-left/red-right PNG.
+- `hope-hermes-shane-fc44d140`: ready; real authenticated gateway image request
+  at port20001 returned HTTP200 and `Green, red.` for a green-left/red-right PNG.
+
+Both runtime capability lookups returned true for the custom provider's `auto`;
+both retained configs have the declaration and no pending reload marker. Account
+settings, credentials, container identities, ports and bind mounts were retained;
+voice remained healthy and control health returned OK. No unrelated deployment
+was changed. This qualifies gateway image input, not a browser upload workflow.
+
+Protected config backups/control inspect receipt are under
+`/mnt/user/appdata/hope-voice/rollback/vision-20261002T201506Z`; original control is
+retained stopped as `hope-control-pre-vision-20261002T201506Z`. Clean source was
+staged separately; the NAS development checkout was not overwritten. Offline
+account/provisioning/bootstrap/deployment rollback regression:44 passed.
+
 ## Per-account Hermes WebUI — live receipt 2026-10-02
 
 Installed pinned nesquena/hermes-webui `62e4d7b9e2560f9d49c0c29c2dc1414fbd4e2d12`