docs(video): document P1 transcript-retention (redacted log shadow + memory suppression)

docs/security/GUARDRAILS.md

@@ -476,6 +476,24 @@ fusion counters. The default Video Bridge path does not invoke speech-to-text
 or download a second media copy; without that explicit track, it remains
 video-only.
 
+**Transcript retention (opt-in feature, #12150 P1).** When a request renders any
+transcript cue (a caller-declared `transcript` or a fused `audioTranscript`), the
+guardrail marks it `videoBridgeObserved` and produces a redacted shadow of the
+video description — an identical rendering in which every cue's free-text body is
+replaced by `[redacted-video-transcript]`, built by substituting the structured
+cue field before the string is assembled (never by parsing the flattened text, so
+no cue content — adversarial or ordinary, including bodies containing `]` such as
+`[inaudible]`/`[music]` — can survive). The persisted call-log request body swaps
+each video-derived text part for that redacted shadow, matched by content
+equality (so it stays correct even after system-prompt/handoff/memory injection
+reshapes the message array); the body sent upstream to the model is unchanged.
+An observed request also populates no durable Memory (both request- and
+response-derived extraction are skipped), so the model's own reply cannot echo
+transcript text into Memory. Two further retention surfaces — the raw
+pre-guardrail client-request snapshot in the detailed-log artifact and
+`previous_response_id` continuation fail-closed — are tracked for a follow-up
+(P2) and are not yet closed.
+
 The internal `/api/modality-bridge/video/drilldown` lifecycle is a separate,
 loopback/token-authenticated cache substrate. Every operation also requires a
 canonical opaque principal ID. Before a production caller is enabled, it must