Record Codex 0.138 prerelease checkpoint handoff

[yvette-carlisle]

Summary

• keep the existing social_candidate/v1 handoff for rust-v0.138.0-alpha.2
• add an explicit no_op checkpoint record for rust-v0.138.0-alpha.3, which was superseded before this run
• add a needs_upstream_analysis checkpoint handoff for rust-v0.138.0-alpha.4 with mode = watch_note
• record compare-derived release-window gaps for codex-upstream-radar-review / codex-code-analysis before any publishable release_pulse, watch_note, or release_rollup

Evidence consumed

• current release_delta/v1: site/src/content/release-deltas/openai-codex-latest.json generated 2026-06-02 for rust-v0.136.0 -> rust-v0.136.0-alpha.2
• public release metadata: rust-v0.138.0-alpha.2, rust-v0.138.0-alpha.3, and rust-v0.138.0-alpha.4; the latest two were published after the previous automation run and have sparse bodies
• GitHub compare metadata only: rust-v0.137.0...rust-v0.138.0-alpha.4, rust-v0.138.0-alpha.2...rust-v0.138.0-alpha.3, rust-v0.138.0-alpha.2...rust-v0.138.0-alpha.4, and rust-v0.138.0-alpha.3...rust-v0.138.0-alpha.4
• existing checked-in upstream_review/v1 and upstream_impact/v1 coverage for PR #25469 and PR #26254

Decision

• no X publishing
• no publishable candidate
• rust-v0.138.0-alpha.3: terminal outcome no_op, because alpha.4 superseded it before this run and carries the active handoff
• rust-v0.138.0-alpha.4: terminal outcome needs_upstream_analysis, because behavior claims would require unreviewed PR/commit evidence
• alpha.4 stable-to-prerelease compare gap: 45 commits / 44 PR-bearing commits; only #25469 and #26254 have checked-in review+impact coverage
• alpha.2-to-alpha.4 new checkpoint gap: 16 commits / 15 PR-bearing gaps, all missing checked-in upstream_review/v1

Validation

• jq empty artifacts/github/social-candidates/openai-codex-rust-v0.138.0-alpha.3-release-checkpoint.json artifacts/github/social-candidates/openai-codex-rust-v0.138.0-alpha.4-release-checkpoint.json
• cargo run -p decodex --bin decodex -- radar validate artifacts/github/social-candidates -> OK (6 Radar artifact JSON files validated)

Caveats

• compare metadata was used only to identify release-window gaps
• no fresh upstream source, patch, or PR-file analysis was performed
• repo labels codex and codex-automation were not present when checked, so no PR labels were applied

[yvette-carlisle]

Closing as part of the publisher/release automation reset. This PR is superseded by the new automation design pass; do not merge or use it as current publication/checkpoint authority.