codex - 💡(How to fix) Fix Do not drain queued follow-ups after usage-limit or credits-exhausted errors

Problem

When Codex temporarily runs out of credits or hits a usage limit, it appears to treat the turn like a normal failed/completed turn. That means queued follow-up prompts can continue to auto-submit one by one, all failing for the same no-credit condition.

This is the most damaging part of the UX. The error itself is understandable: running out of credits should be a normal recoverable state. But draining the queued prompt list turns it into a destructive state. The user loses a carefully staged queue, and resuming later becomes much harder.

From the user perspective, the app should say "paused until credits return," not fail the current turn and then burn through the rest of the queue.

Current behavior

Based on local inspection of Codex Desktop 26.519.41501 / CLI 0.133.0-alpha.1 and upstream openai/codex:

• usage exhaustion is emitted as an error/completed turn;
• the TUI error path finalizes the turn and continues into queued-input handling;
• the desktop app queued follow-up worker reacts to codex_turn_completed;
• failed latest turns do not appear to block queued follow-up dispatch;
• queued items can be removed after turn-start succeeds, before the model failure proves credits are still exhausted.

So a temporary credit limit can become a queue-destructive cascade.

Related issues:

• #21073 asks for auto-resume when usage limit resets.
• #15788 asked for queueing around usage limits and was closed.
• #14787 and #8310 describe related queue/resume failure modes.

Expected behavior

On UsageLimitExceeded, insufficient_quota, credits-exhausted, or equivalent temporary usage-limit errors:

1. Stop queue drain immediately.
2. Preserve all queued follow-ups exactly as queued.
3. Preserve or restore the prompt that hit the limit if no meaningful model work actually started.
4. Mark the thread/queue as paused for usage limit.
5. Let the user resume, edit, reorder, or clear the queue after credits return.
6. Optionally generate a short resume handoff, but do not make handoff a prerequisite for fixing queue preservation.

Why this matters

A queued prompt list is user intent. If Codex knows the account cannot currently run more work, sending the rest of the queue is never useful.

Running out of credits should feel like a normal paused state, not a hard failure state that also consumes the rest of the user's queued work. The current behavior makes recovery substantially worse than the initial credit exhaustion.

Acceptance criteria

• If a turn fails due to usage-limit / credits-exhausted / insufficient-quota, no queued follow-up is auto-submitted afterward.
• Existing queued follow-ups remain visible and editable.
• The just-failed prompt is recoverable if it did not get meaningful model execution.
• The UI clearly indicates a paused usage-limit state.
• A "Resume when credits return" action can continue from the same queue.
• Tests cover one active prompt plus multiple queued prompts; after simulated usage-limit failure, queue length is unchanged except for the active recoverable prompt state.

Non-goals

This is not a request for quota bypass, account rotation, or automatic use of another subscription.

It is strictly a fail-closed queue preservation issue.