url-09: fetched images become vision input — fetch_url og:image/body images ride as input_image, direct image urls ingested, data urls never in json tool text

specs/SPEC-011-url-reading.md

@@ -69,3 +69,20 @@ block's characters inside `<a>` and the block shorter than 200 chars
 boilerplate and removed. Body paragraphs with inline links survive.
 The default `url-max-chars` cap rises to 8000 now that the budget is
 spent on content, not chrome.
+
+### URL-09 — Fetched images become vision input (coverage: test)
+
+The images the URL reader already caches from a fetched page
+(`og:image` first, then body images, `url-max-images` cap, every
+candidate SSRF-guarded and magic-byte-sniffed by the image cache) now
+travel to the model as image input alongside the tool result — the
+model sees the picture, not just an `images_cached` count. A URL
+whose response is itself an image (content-type `image/*`) is
+ingested directly and returns text `(image)`; a body at the byte cap
+is treated as possibly truncated and not ingested. The data URLs
+ride in a `vision` key that the responder detaches before the JSON
+tool text is built (a base64 data URL would blow the 8000-char
+sanitizer cap): they are appended as `input_image` items on the
+Responses path and as `image_url` parts on the legacy path. Vision
+is per-turn — nothing extra is historised; the file stays in the
+image cache for later `picture_edit` (IMG-15).