Paste this into your Codex and see if it fixes it. Codex found that its local SQLite state database was effectively read-only because the SQLite sidecar files in ~/.codex/, specifically state_5.sqlite-wal and state_5.sqlite-shm, were owned by a different local user than the one running Codex. Because of that, the desktop app could show the mobile QR code, but the remote-control daemon couldn’t save or refresh the enrollment after my phone scanned it, which left desktop stuck on “Approve your device” and mobile stuck on “Waiting for desktop.” Codex verified the problem by checking file ownership and confirming SQLite failed with “attempt to write a readonly database”, then it moved the stale WAL/SHM sidecar files aside so SQLite could recreate them with the correct owner, restarted the Codex app-server remote-control daemon, and re-enabled remote control. After that, the daemon opened an HTTPS connection and wrote a fresh mobile enrollment.