- 새 모듈 `crates/kebab-parse-image/src/ocr.rs` 추가. spec 의 `OcrEngine`
  trait 그대로 + `OllamaVisionOcr` default 구현 + `apply_ocr` 헬퍼.
- `OllamaVisionOcr`: `<endpoint>/api/generate` 비스트리밍 호출,
  `images: [base64]` 필드로 이미지 전달, 프롬프트는 언어 힌트
  + 화이트리스트 언어 목록 포함. 응답 prose 를 `OcrText.joined` 로,
  prepared image 전체 영역 단일 region (confidence 1.0) 으로 wrap.
  기본 모델 `gemma4:e4b`. endpoint 비어 있으면 `models.llm.endpoint`
  로 fallback.
- 이미지 전처리: long-edge `config.image.ocr.max_pixels` (기본 1600,
  256~4096 클램프) 초과 시 PNG 로 재인코딩 (image::imageops::resize,
  Triangle filter). PNG 입력이 max 이내면 zero-copy passthrough.
- `apply_ocr` 는 OCR 성공 시 block.ocr 를 Some 으로 채우고
  ProvenanceKind::OcrApplied 이벤트 추가. 실패 시 block.ocr 는
  None 그대로 + provenance 미기록 (부분 상태 누출 금지).
- `kebab-config`: 새 `ImageCfg.ocr: OcrCfg` 블록 (enabled/engine/model
  /endpoint/languages/max_pixels). `#[serde(default)]` 로 pre-P6
  TOML 호환. `KEBAB_IMAGE_OCR_*` 환경변수 5종 추가.

## Spec deviation

원래 P6-2 spec 은 Tesseract 를 default OCR 엔진으로 지정했으나, dev /
CI 호스트에서 `libtesseract-dev` 시스템 패키지 설치를 피하려고
Ollama-vision 으로 default 를 교체. `OcrEngine` trait 추상화는 spec
그대로 보존 — Tesseract / Apple Vision / PaddleOCR 어댑터는 같은
trait 으로 추후 feature-gate 추가 가능. 자세한 내역은
`tasks/HOTFIXES.md` 2026-05-02 항목 참조.

Trust 측면: vision LM 은 hallucinate 가능. `OcrText.engine = "ollama-vision"`
필드로 consumer 가 엔진 별 신뢰 분기 가능.

## 테스트

- 신규 (`tests/ocr.rs`, 8 + 1 ignored):
  - 200 happy → OcrText 디코딩 (joined / engine / engine_version /
    region count / bbox / confidence)
  - 빈 응답 → 빈 regions
  - 5xx → Err with status + body 포함
  - 200 error envelope → Err
  - apply_ocr → block.ocr Some + Provenance OcrApplied 1건
  - apply_ocr error → block.ocr None 유지 + events 미기록
  - 4000×3000 PNG → max_pixels=1024 까지 다운스케일, aspect ratio 보존
  - from_parts max_pixels 클램프
  - opt-in `KEBAB_OCR_INTEGRATION=1` 통합 (실제 192.168.0.47 Ollama
    `gemma4:e4b` 로 \"Hello World 2026\" 전사 검증 완료)
- 신규 (`src/ocr.rs` unit): truncate, build_prompt 언어/힌트 처리
- `kebab-config` 테스트 +3: defaults, env override, pre-P6 TOML 호환

전체: `cargo test -p kebab-parse-image` 28 pass + 1 ignored,
`cargo test -p kebab-config` 20 pass,
`cargo clippy --workspace --all-targets -- -D warnings` pass.

contract: docs/superpowers/specs/2026-04-27-kebab-final-form-design.md
sections: §3.4 ImageRefBlock.ocr, §3.7a OcrText / OcrRegion, §9.1 OCR
vs caption provenance.

@@ -101,0 +139,4 @@
+    /// HTTP endpoint for the OCR engine. Empty string means "fall back
+    /// to `models.llm.endpoint`" — convenient when the same Ollama
+    /// host serves both LLM and vision.
+    pub endpoint: String,

@@ -24,0 +28,4 @@
+# rustls-tls) so both crates share the same TLS backend and the
+# transitive tokio runtime is brought in once.
+reqwest      = { version = "0.12", default-features = false, features = ["blocking", "json", "rustls-tls"] }
+base64       = "0.22"

@@ -0,0 +300,4 @@
+/// Bypasses encode work when the source already fits — we simply pass
+/// the bytes through. PNG re-encode is only paid when downscaling is
+/// actually needed.
+fn downscale_to_long_edge(bytes: &[u8], max_long_edge: u32) -> Result<(Vec<u8>, u32, u32)> {

@@ -0,0 +361,4 @@
+struct OllamaGenerateRequest<'a> {
+    model: &'a str,
+    prompt: &'a str,
+    images: Vec<&'a str>,

@@ -0,0 +379,4 @@
+    #[serde(default)]
+    error: Option<String>,
+    #[serde(flatten)]
+    _other: std::collections::HashMap<String, Value>,

@@ -46,0 +64,4 @@
+/// `/usr/share/fonts/truetype/dejavu/`) — common across most Linux dev
+/// boxes. Falls back to a tiny built-in glyph map if the font is
+/// missing so the helper compiles even without DejaVu installed.
+pub fn hello_world_png() -> Vec<u8> {

@@ -0,0 +320,4 @@
+// ── from_parts construction ──────────────────────────────────────────────
+
+#[test]
+fn from_parts_clamps_max_pixels_into_legal_range() {

@@ -0,0 +147,4 @@
+        if model.is_empty() {
+            anyhow::bail!("OllamaVisionOcr: image.ocr.model is empty");
+        }
+        let max_pixels = ocr.max_pixels.clamp(MIN_LONG_EDGE, MAX_LONG_EDGE);

@@ -0,0 +163,4 @@
+
+    /// Build directly from explicit fields. Useful for tests that need
+    /// to point at a wiremock host without going through `Config`.
+    pub fn from_parts(

@@ -0,0 +340,4 @@
+    } else {
+        let scale = max_long_edge as f32 / long as f32;
+        let new_w = ((w as f32) * scale).round().max(1.0) as u32;
+        let new_h = ((h as f32) * scale).round().max(1.0) as u32;

@@ -0,0 +359,4 @@
+#[tokio::test]
+#[ignore = "hits a real Ollama daemon; gated behind KEBAB_OCR_INTEGRATION=1"]
+async fn ocr_integration_real_ollama_transcribes_text() {
+    if std::env::var("KEBAB_OCR_INTEGRATION").ok().as_deref() != Some("1") {

@@ -9,3 +12,3 @@
 //!
 //! Per design §3.4 (Block::ImageRef + ImageRefBlock), §3.7a (OcrText /
-//! ModelCaption stubs), §9.1 (image extraction policy), §9 (versioning).
+//! ModelCaption stubs), §9.1 (image extraction policy / OCR vs caption

@@ -0,0 +192,4 @@
+            languages,
+            max_pixels,
+        })
+    }

@@ -9,0 +11,4 @@
+//! [`ImageRefBlock`] in place. Trust note — the LLM-driven default
+//! can hallucinate; `OcrText.engine` carries the source identity so
+//! consumers can branch trust by engine (Tesseract / Apple Vision
+//! adapters, when added, will write a different `engine` string).