[diegosouzapw]

Summary

Reconciles the Video Bridge follow-up backlog (VB-FU-01..09, umbrella #9760) documentation
against verified code and GitHub state, and corrects a real accuracy gap this audit found in the
public guardrail docs.

Ground truth was established first (per this repo's Documentation accuracy rule), then docs
were corrected to match — not the other way around. Method, evidence, and every command run are
recorded in the artifacts below.

What this PR actually does

1. Public doc fix (docs/security/GUARDRAILS.md): the transcript source field
   (client/embedded/audio-bridge) was documented as a validated enum without stating that
   OmniRoute does not yet verify the label came from a real server-side extraction. Any caller can
   set source: "embedded" today — confirmed by reading normalizeVideoTranscript in
   src/lib/guardrails/videoBridgeHelpers.ts:111-172. This is exactly the gap issue #11652 exists
   to close. Added one clarifying paragraph; no other public doc (docs/openapi.yaml,
   docs/security/ROUTE_GUARD_TIERS.md, CHANGELOG.md) needed correction — they already state
   VB-FU-07/VB-FU-09 promotion as HOLD and VB-FU-08 as not wired to production, accurately.
2. Changelog fragment: changelog.d/maintenance/11661-video-bridge-transcript-provenance-doc.md.
3. Private artifacts in the separate _tasks repo (pushed, not part of this PR's diff):
   • _tasks/research/2026-08-29-video-bridge-current-ledger.md — the one CURRENT authority for
     VB-FU-01..09, each item's implementation_state / verification_evidence /
     promotion_evidence traced to an exact merged commit (with git merge-base --is-ancestor
     checks) and to test runs performed in this session. No VPS receipts are claimed — this session
     has no VPS access, and every field that would require one says ABSENT.
   • _tasks/research/2026-08-17-video-bridge-skill-gap-matrix.md — marked
     historical/superseded with a banner identifying exactly which of its claims were false and
     why; original text preserved, nothing deleted.
   • _tasks/postmortems/2026-08-29-video-bridge-false-nine-of-nine-closure.md — root-cause
     postmortem on how a 2026-08-18 update wrongly declared VB-FU-01..09 "9 of 9 IMPLEMENTADO".

Ground-truth findings (the actual audit)

Item	State	Evidence
VB-FU-01 (result cache)	complete	PR #11362, commit 761d38f4 ancestor of HEAD; test passes
VB-FU-02 (scene-aware)	complete	PR #11344, commit 04d2a603 ancestor of HEAD; test passes
VB-FU-03 (dedup)	complete	PR #11382 landed as commit 7715825c (not the stacked-branch merge SHA gh reports) — ancestor of HEAD; test passes
VB-FU-04 (focus window)	complete	PR #11383, commit d23bfefe ancestor of HEAD; tests pass
VB-FU-05 (transcript provenance)	partial	baseline shape-validation exists; #11652's bounds/forgery-rejection are absent from code today (verified by reading normalizeVideoTranscript); PR #11680 (embedded subtitle + redaction) is still an open draft, not merged
VB-FU-06 (Audio Bridge fusion)	partial	PR #11681 merged (commit 46b8e7a9, ancestor of HEAD) fixes fusion timeline ordering only, per its own PR body — real Audio Bridge/STT orchestration (#11654's actual ask) does not exist in the codebase (extractAudio/PCM/16 kHz — zero matches)
VB-FU-07 (segment-aware + promotion)	partial	sampler merged (PR #11381, commit 9fedc1c4); model-quality promotion is HOLD per #11656, already stated accurately in GUARDRAILS.md
VB-FU-08 (drill-down/multi-res)	partial	isolated cache substrate merged (PR #11369, commit c83116e6); producer/consumer lifecycle and resolution variants absent (#11655), already stated accurately in GUARDRAILS.md
VB-FU-09 (contact sheets + promotion)	partial	mechanism merged (PR #11350, commit c8ad44e0); promotion HOLD per #11656, same as FU-07
deep pipeline refactor	not_started	no PR exists (#11657); zero matches for videoBridgePipeline/processVideoPart/port interfaces

TDD / validation evidence

This is a docs-only PR in the main repo — no production code changed, so no new test was written.
Existing tests were run to verify the ledger's claims, not to prove a code change:

node --import tsx/esm --test tests/unit/guardrails/videoBridge*.test.ts tests/unit/guardrails/videoAudioFusion.test.ts
  → tests 176, pass 174, fail 0, skipped 2

node --import tsx/esm --test tests/unit/video-bridge-*.test.ts
  → tests 39, pass 39, fail 0

Total: 213 passed, 0 failed, 2 skipped across the full local Video Bridge test surface.

Gates run (this PR's diff — docs + changelog fragment only)

Gate	Result
npm run check:docs-all	PASS (exit 0) — includes check:fabricated-docs --strict: "No fabricated API/env/CLI/hook/file references found"
npm run typecheck:core	PASS (exit 0)
npx eslint --suppressions-location config/quality/eslint-suppressions.json docs/security/GUARDRAILS.md	PASS (markdown is ESLint-ignored, 0 errors)
node scripts/check/check-test-discovery.mjs	PASS — 5,266 test files, 13 frozen orphans (unchanged)
Husky pre-commit (lint-staged, check-docs-sync, any-budget, tracked-artifacts)	PASS

check:complexity-ratchets, check:cycles, and check:file-size were not run — no src/,
open-sse/, or electron/ file was touched.

⚠️ base-red inherited: #11874 — Docs sync + fabricated-docs (strict): README.md does NOT mention
356 for providers. Unrelated to this PR's diff.

Pending live validation

This ticket's acceptance criteria ("every implementation PR merged and ancestral to
release/v3.8.51," "exact merged SHA passes the required VPS and CI matrix," "no required check
red/stale/cancelled/skipped/unattributed," "settings and temporary VPS artifacts restored") cannot
be truthfully claimed today:

• #11652, #11654, #11655, #11656, #11657, #11658, #11659 are all OPEN as of
  2026-08-29 and are being worked in parallel by other sessions per this ticket's own dispatch
  context.
• PR #11680 (would close #11658/#11659) is an open draft, not merged, and its own body
  says it does not authorize merge.
• No VPS 192.168.0.15 matrix, live smoke, build/pack/boot/UI receipt, or real-model STT/eval run
  was performed or is claimed anywhere in this PR or in the private ledger — this session has no
  VPS access.
• No CI-run attribution beyond what gh pr view reports for the cited PRs was collected.

This PR therefore uses Refs #11661, not Closes — closing #11661 truthfully requires the
sibling PRs above to merge first, then a follow-up pass to update the CURRENT ledger with their
actual landed state and, where available, real VPS evidence.

Refs #11661