Feature: bounded same-thread auto-retry (or resumable hint) on "Selected model is at capacity" turn deaths

Component: openai-codex Claude Code plugin (codex-companion.mjs)
Type: Feature request / robustness

Summary

When a task turn dies with Codex error: Selected model is at capacity. Please try a different model., the companion process exits with code 1 and the turn's work is dropped, even though the thread state is preserved server-side and a plain --resume-last continues it flawlessly. I'd like the plugin to offer a bounded, same-thread auto-retry (with backoff) on capacity errors — or at minimum surface an explicit "resumable, run --resume-last" hint in the error path — so a transient capacity blip doesn't require manual orchestrator intervention.

Observed behavior (2 occurrences in one session)

Both during multi-batch, write-mode task runs:

• Occurrence 1: the model applied several batches of file edits, then the turn failed with Selected model is at capacity; the companion process exited with code 1, leaving the working tree mid-edit (a handful of partially-changed files).
• Occurrence 2: immediately after an in-turn cargo test invocation succeeded, the same capacity error killed the turn.

Recovery (worked both times): running task --resume-last --write --model <same-model> "<continue>" right after resumed the same thread — thread state was intact and, combined with the partially-edited working tree, the run completed normally.

Why this is distinct from the "stale running" cluster

Unlike the PID-liveness / stale-running reports (#517, #478, #222, ...), here the process dies cleanly with exit code 1, so status does not wedge at running and no cancel is needed. The gap is purely that a recoverable, transient failure is surfaced as a hard turn death with no built-in continuation.

Proposal

• On a Selected model is at capacity turn death, attempt a bounded same-thread resume (retry budget + backoff), respecting the idle watchdog / turn ceiling on the resumed leg.
• Alternatively (or additionally), make the error message state that the thread is resumable and name the exact --resume-last command.

Notes

• resumeThread already exists in scripts/lib/codex.mjs.
• Closely analogous to #363 (closed) which proposed bounded resume after a MAX_TURN hard-stop; this is the same resume-based remedy for a different trigger (capacity error rather than the turn ceiling).
• Caveat for consumers relying on the manual --resume-last workaround: it only reattaches to the right thread when the failed thread is still the most recent one. If another thread was started in between, --resume-last misroutes (see #230 / #467). A capacity-triggered auto-retry, keyed to the failing thread's own ID, would avoid that hazard.

Start in codex-companion.mjs by tracing the task turn error path for "Selected model is at capacity" and then read resumeThread in scripts/lib/codex.mjs. Determine how the failing thread ID and retry budget can be preserved, or where the resumable --resume-last hint belongs. Done means the chosen bounded retry or explicit recovery message is implemented without confusing this path with stale-running handling.