feat: overlay persisted image-region boxes (v2.13.2)

AGENTS.md

@@ -127,7 +127,10 @@ contextual-orchestrator owns model discovery and selection.
   retaining the original asset and provenance. Recognize image DOM/visual
   regions before OCR, descriptions, Keyman extraction, or embeddings. Store
   region-level evidence; never show an internal LLM instruction such as
-  `This post is an image` to a buyer.
+  `This post is an image` to a buyer. When a source image can be reattached,
+  draw only persisted visual-region boxes; never invent coordinates. If the
+  bitmap is missing or a box is invalid, keep the region list and do not
+  fabricate a locator (ADR 0110 / 0113).
 
 ## Source parsing and semantic units
 
@@ -150,7 +153,8 @@ contextual-orchestrator owns model discovery and selection.
   paragraphs, not the authoring application's spacing workaround.
 - Image descriptions, OCR text, and region evidence are analysis artifacts,
   not buyer-facing prompt instructions. Buyer UI shows the source content and
-  useful captions/evidence only, with provenance where appropriate.
+  useful captions/evidence only, with provenance where appropriate. Overlay
+  boxes use stored ratios; a missing image fails closed to the list.
 
 ## Pluggable channels: never fake a missing signal
 

CHANGELOG.d/2.13.2-image-region-overlays.md

@@ -0,0 +1,20 @@
+# 2.13.2 — Overlay persisted image-region boxes
+
+## Added
+
+- Buyer post figures now draw persisted visual-region boxes on a reattached
+  source image. Selecting a box announces that region's caption or OCR.
+- Invalid, missing, or out-of-bounds coordinates stay list-only. When the
+  bitmap cannot be reattached, the region list remains the fallback and no
+  locator is invented.
+
+## Changed
+
+- Image-region overlay and current-region labels are translated through the
+  five-locale catalog (Korean, English fallback, Chinese, Japanese,
+  Vietnamese).
+- Buyer image rendering now rejects script, SVG, external, and malformed
+  source URLs before they reach an image element.
+- The login, application shell, footer, and shared button styles remain
+  defined while the overlay stylesheet evolves; a new post image also clears
+  any selection from the previous post.

docs/adr/0113-buyer-image-region-overlays.md

@@ -0,0 +1,38 @@
+# ADR 0113: Overlay persisted visual-region boxes on the source image
+
+- Status: Accepted
+- Date: 2026-08-20
+- Depends on: [0067](0067-visual-region-vision-agent.md), [0091](0091-visual-region-embedding-persistence.md), [0110](0110-buyer-image-evidence-rendering.md)
+
+## Context
+
+ADR 0067 and ADR 0091 persist parent-relative `x_ratio`, `y_ratio`,
+`width_ratio`, and `height_ratio` for each accepted visual region. ADR 0110
+renders captions, OCR, tags, and a region list, but the buyer still cannot
+see which panel of the source image supplied that evidence.
+
+## Decision
+
+- When the source image can be reattached and a region has a finite persisted
+  box inside the unit square, draw that box on the figure as a
+  keyboard-focusable control. Selecting it announces the persisted caption or
+  OCR as the current image region.
+- Never invent coordinates. Invalid, missing, non-finite, zero-area, or
+  out-of-bounds boxes stay list-only. When the source image cannot be
+  reattached, keep the region list and do not draw empty overlays.
+- Do not surface LLM instructions from image `unit_text`. Overlay labels come
+  only from persisted region caption or extracted text.
+- Translate overlay and current-region labels through the five-locale UI
+  catalog.
+- Reset the selected region when the rendered source image changes, so a
+  stayed-open post popup cannot carry a selection into another post.
+- Keep the shared login, header, footer, and button selectors defined in the
+  same stylesheet; image-overlay work must not remove application chrome.
+
+## Consequences
+
+Buyers can locate panel-level evidence on the source image. Search and
+embedding remain bound to the existing region tables. A missing bitmap still
+fails closed to the list rather than fabricating a locator, and moving between
+posts does not show a stale selection. The shared-chrome selector regression
+also keeps the login and application shell usable while this feature evolves.

frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "frontend",
   "private": true,
-  "version": "2.12.6",
+  "version": "2.13.2",
   "type": "module",
   "scripts": {
     "dev": "vite",