docs: mark D3 superseded and record the DevGuard binding identity rule

[novelKR]

Summary

This is the counterpart documentation for DevGuard design revision 2
(novelKR/DevGuard#20, head 9d223bbd3529d6996fb8ebabeedae5458d31f498).

• That revision records the owner's dependency policy of 2026-09-28: DevGuard may consume Codex and other external
  implementations behind declared adapters, with reviewed, immutable pins.
• Documentation only.
• Prepared for review; not to be merged without the owner's exact-head approval.
• Merge order. The DevGuard PR goes first. If its head changes before it merges, this PR's links are updated first.
• Link history.
  • Commit 4149ec1 linked revision 2 at W04: workspace registry and path policy #20's first head, 637627e.
  • W04: workspace registry and path policy #20 then gained commit 9d223bb, which classifies the new revision in its CI policy. Commit 8a414e8 therefore
    moves all four links to the new head.
  • The earlier green runs of this PR, CI 36725881292 and Documentation site 36725882621, are superseded and kept as
    evidence.

What changed

• docs/codex-reuse.md and its Korean counterpart.

  • The D3 bullet under "Reuse decisions for managed execution" keeps its dated wording.
  • It gains a dated annotation: superseded on 2026-09-28 by the owner's dependency policy, now recorded in DevGuard
    design revision 2. The revision is linked at its immutable head commit.
  • The hold notice is amended only to say that this D3 statement is superseded and no longer current.

• docs/upstream-update.md and its Korean counterpart. A dated addition at the end of "Boundaries for future crates
  and backends":

  • a DevGuard binding linked into a CodeSpace executable consumes Codex through this repository's gitlink;
  • the executable single-identity check arrives with the first DevGuard crate in a CodeSpace graph;
  • until then the rule is documentation policy, not an executable gate.

  The section notice is amended to point at the addition.

• docs/translations.json. After both languages were reviewed, the registry hashes and anchors were recorded with
  python3 -B scripts/check_docs.py record --id codex-reuse and --id upstream-update.

Search hits in this repository

• Changed:
  • the codex-reuse D3 bullet (row 10 of the DevGuard W0–W2 packet's inventory);
  • upstream-update (row 11).
• Reported and unchanged:
  • docs/codex-reuse.md:38: CodeSpace's own core crates have no direct Codex dependencies. That is CodeSpace-internal
    and still true.
  • docs/devguard-integration.md:80 and :139, docs/architecture.md:62, docs/execution-substrate.md:89, and their
    Korean counterparts: revision-1 facts, not Codex-free rules.
  • The dated .github/notes/ records.

What does not change

• No code, pin, dependency, scripts/**, CI or policy script. third_party/codex stays at 6b9826e (rust-v0.154.0).
• The hold notices stay, CS-RG stays suspended, and CodeSpace's pin process is unchanged.
• Nothing proposed is described as implemented.
• CodeSpace has no AGENTS.md, and none is added.

Verification

• python3 -B scripts/check_docs.py: 17 paired documents verified.
• python3 -B scripts/ci_plan.py --base origin/main --head HEAD: affected, with no Rust legs; docs/** is no_rust.
• git diff --check: clean.
• Not run locally: the docs-site build (npm test, npm run build, site.py check). Its dependencies are not
  installed in this working tree, and nothing was downloaded. The PR's Documentation site job runs it.

Rollback

Documentation only: revert the merge commit.

🤖 Generated with Claude Code