fix: declare Hermes auto image support and migrate running accounts

control/README.md

@@ -114,6 +114,28 @@ ports. Strict outbound-only enforcement needs a separate host ingress firewall
 policy; host networking alone cannot guarantee that. Host networking does not
 bypass LAN ACLs or configure mDNS/DNS.
 
+## Image input capability
+
+The managed upstream `auto` model is explicitly declared with
+`providers.hope-upstream.models.auto.supports_vision: true`. This is an exact-model
+capability, not a global `model.supports_vision` override: account-selected models
+are not automatically declared vision-capable. Non-auto `HERMES_UPSTREAM_MODEL`
+overrides require independent qualification before declaring image support.
+
+New accounts receive this declaration. On control startup/reconciliation, retained
+accounts with an existing managed `auto` entry are migrated from a model list to a
+metadata mapping, preserving other model IDs, capability metadata and settings.
+Missing/custom provider declarations are not replaced with defaults. The migration
+only changes the verified `auto` capability and existing managed listener settings.
+
+A private `config-reload-pending` marker is written before an existing config is
+changed. Running owned containers restart by immutable ID to load it; new/stopped
+containers load it on start. The marker clears only after authenticated gateway
+and (when enabled) WebUI health pass. Failed restarts/readiness retain the marker
+for retry, including across control restarts. Expect brief per-account downtime
+and interruption of active runs during migration. Credentials, ports, homes and
+workspaces remain unchanged. Readiness rejects accounts awaiting this migration.
+
 ## Per-account Hermes WebUI
 
 Build `hermes-webui.Dockerfile` as `hope-hermes-webui:62e4d7b`. This packages the