Photograph a seed packet → it fills in the plant and the purchase. This is the
backend; the scan UI is a follow-up PR.

Vision model config (mirrors the agent model from #79):
- Migration 0011 adds instance_settings.vision_model; PANSY_VISION_MODEL is the
  env default. Precedence Settings → env → empty; the KEY stays in the env.
- EffectiveVision resolves it; /capabilities advertises "vision" only when a
  model + key are configured, so the UI offers the scan button only when it works.

Extraction is one-shot, NOT an agent loop (internal/vision):
- majordomo.Generate[SeedPacket] derives a JSON schema from the struct tags and
  hands the image to the vision model; it can't call a tool, so it can't touch
  the garden — it only reads a picture and returns data. Numeric fields are
  pointers, so a field the packet doesn't print comes back nil, not a made-up 0.
- Hermetic test: majordomo's fake provider returns canned packet JSON and
  Generate unmarshals it, image + derived schema included. No live model.

The image is normalized to JPEG at the upload boundary (imagenorm from #80),
which is where an iPhone HEIC becomes readable — majordomo's media path can't
decode HEIC. imagenorm now links into the binary (~7 MB, the cost #80 deferred).

The hard part is catalog matching, not OCR (internal/service/seed_packet.go):
- A wrong auto-match splits a variety's seed-lot history across duplicate rows,
  so the service NEVER auto-creates. matchPlants surfaces RANKED candidates
  (exact name → variety-in-name → same species, conservative and name-based),
  the user confirms, and CreateFromPacket makes the plant (new or existing) + the
  lot. Exactly one of plantId/newPlant, refused otherwise.
- Plants/lots aren't in the undo history (catalog/inventory), so no change set.
- The extractor is injectable (service.WithPacketExtractor) so ExtractSeedPacket
  and the /scan endpoint test end to end against a fake, no live model.

Endpoints: POST /seed-lots/scan (multipart image → proposal, reads only; extends
the read deadline for a slow phone upload, caps the body, maps too-large/unreadable
to clear statuses) and POST /seed-lots/from-packet (confirmed proposal → 201).

Docs: README (PANSY_VISION_MODEL), DESIGN (routes + the decision and why the
model can't touch the garden).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01H3zbym8Doka2d7D48maSgZ

@@ -207,1 +211,3 @@
-	c.JSON(http.StatusOK, gin.H{"agent": h.agent.get() != nil})
+	// vision advertises whether seed-packet scanning (#81) can be offered — a
+	// configured, resolvable vision model + a key. Read per-request so a settings
+	// change is reflected on the next poll, same as agent.

@@ -0,0 +33,4 @@
+func (h *handlers) scanSeedPacket(c *gin.Context) {
+	// Extend the read deadline for the (potentially large, potentially slow)
+	// upload. Best-effort: if the writer doesn't support it, the default applies.
+	_ = http.NewResponseController(c.Writer).SetReadDeadline(time.Now().Add(scanReadTimeout))

@@ -0,0 +41,4 @@
+		writeAPIError(c, http.StatusBadRequest, "INVALID_INPUT", "attach an image as the \"image\" field")
+		return
+	}
+	f, err := file.Open()

@@ -0,0 +51,4 @@
+	// Normalize to JPEG (decodes HEIC/webp/png/jpeg, downscales, re-encodes) so
+	// everything downstream — including the vision model — only sees a format it
+	// can read. This is where an iPhone HEIC becomes usable.
+	jpeg, format, err := imagenorm.Normalize(f, imagenorm.Options{})

@@ -0,0 +60,4 @@
+		writeAPIError(c, http.StatusBadRequest, "INVALID_INPUT", "that doesn't look like an image we can read (JPEG, PNG, HEIC or WebP)")
+		return
+	}
+	_ = format // available for logging if wanted

@@ -0,0 +80,4 @@
+// packetLotRequest is the lot half of a confirm. It's seedLotCreateRequest
+// WITHOUT plantId — the plant comes from the confirm's plantId/newPlant choice,
+// not the lot body, and reusing seedLotCreateRequest would wrongly require one.
+type packetLotRequest struct {

@@ -0,0 +86,4 @@
+	SKU            string   `json:"sku"`
+	LotCode        string   `json:"lotCode"`
+	PurchasedAt    *string  `json:"purchasedAt"`
+	PackedForYear  *int     `json:"packedForYear"`

@@ -64,13 +68,19 @@ func (h *handlers) settingsPayload(c *gin.Context, st *domain.InstanceSettings)
 	if err != nil {
 		return settingsResponse{}, err
 	}
+	vis, err := h.svc.EffectiveVision(c.Request.Context())

@@ -111,0 +128,4 @@
+}
+
+// EffectiveVision reads the settings row and layers it over the environment.
+func (s *Service) EffectiveVision(ctx context.Context) (EffectiveVision, error) {

@@ -0,0 +85,4 @@
+}
+
+// validCategory returns the packet's category if it's one pansy knows, else "".
+func validCategory(c string) string {

@@ -0,0 +200,4 @@
+	} else {
+		// Attach to an existing plant the actor can see. visiblePlant enforces the
+		// ACL (built-ins + their own); a plant they can't see is ErrNotFound.
+		plant, err := s.visiblePlant(ctx, actorID, *in.PlantID)

@@ -0,0 +211,4 @@
+	lotIn.PlantID = res.Plant.ID
+	lot, err := s.CreateSeedLot(ctx, actorID, lotIn)
+	if err != nil {
+		return nil, err

@@ -0,0 +27,4 @@
+// extractVia is Extract with a caller-supplied registry, so the test can point it
+// at a fake provider instead of resolving a live model. It mirrors Extract's body
+// exactly apart from where the model comes from.
+func extractVia(t *testing.T, m llm.Model, jpeg []byte) (SeedPacket, error) {

@@ -0,0 +33,4 @@
+		Messages: []majordomo.Message{
+			majordomo.UserParts(majordomo.Text(extractPrompt), majordomo.Image("image/jpeg", jpeg)),
+		},
+	})