Codex Desktop: capacity errors should preserve intent and auto-retry instead of handing model routing back to the user

Summary

When the selected model is temporarily at capacity, Codex Desktop currently shows a dead-end message:

Selected model is at capacity. Please try a different model.

This turns a transient backend/backpressure condition into a user-side routing problem. For a work-harness product like Codex, the better behavior would be to preserve the user's intent, queue or retry automatically, and offer model switching as an optional secondary action.

Observed behavior

During normal use, Codex Desktop can return an inline capacity message stating that the selected model is at capacity and asking the user to try a different model.

The user has to decide what to do next, even though the application already has the relevant context:

• the draft/user message
• the selected model
• the thread context
• attachments or screenshots
• tool/approval state, where applicable
• the fact that the failure is temporary capacity/backpressure

Expected behavior

Codex should treat transient model capacity as a recoverable execution state, not as abandonment of the user's request.

A better default flow would be:

This model is temporarily busy. Retrying in 10 seconds. You can switch models if you need speed over consistency.

For agent/tool runs, the wording should also preserve the approval boundary:

Queued. I'll continue when capacity is available. No external action will be taken without preserving the current draft and approval state.

Suggested product behavior

• Preserve the user's draft, attachments, selected model, and current thread state.
• Auto-retry with jittered backoff rather than requiring immediate user action.
• Show a retry countdown or queued state.
• Offer Switch model as a secondary action, not the primary recovery path.
• If switching models changes quality, tool behavior, cost, or capability, explain that tradeoff briefly.
• Never discard user input.
• Never imply the user caused the problem.
• For tool/agent runs, preserve approval state and do not take new external actions without the existing or renewed authorization boundary.

Why this matters

Codex is not just a chat surface. It is a work harness with persistent context, files, tools, approvals, and resumable task state. Capacity/backpressure should slow execution, not return ownership of the failure to the user.

The current message is understandable for a stateless chat product, but it is below the abstraction level of Codex. Codex already has enough state to preserve intent and resume work safely.

Principle

Backpressure should slow execution, not abandon the user.

Environment

• Product: Codex Desktop
• Platform: Windows
• Failure type: transient capacity / model availability UX
• Repro: intermittent; occurs when the selected model is at capacity