Exact error
Match the message before using the fix
failed to connect to app-server remote control websocketHTTP error: 503 Service Unavailableupstream connect error or disconnect/reset before headershas_enrollment=trueQuick answer
Start here
If the log says `has_enrollment=true` and the Remote Control WebSocket returns 503 on two independent networks, preserve the timestamp, Cloudflare ray/region, app version, and exact route error. That evidence supports an upstream/routing branch, not a broken local pairing. Do not delete enrollment or authentication state before checking the service path and a current build.
Diagnosis
Why it happens
- The source report reproduced the same 503 through the same edge region on home internet and a cellular hotspot.
- An incomplete unauthenticated probe from another region returned a different status, which is a useful control but does not prove authenticated service health.
- A concurrent local HTTP 400 occurred independently and the report explicitly did not establish a shared root cause.
Safest first
Fixes, in order
Confirm enrollment and collect the transport signature
Applies when: The phone cannot connect to an enrolled desktop
A 503 with enrollment already present belongs to a different branch than first-time pairing.
- Record `has_enrollment`, app/CLI version, timestamp, HTTP status, reset reason, and edge ray/region.
- Confirm the desktop remains signed in and local Codex tasks still work.
- Do not copy cookies, tokens, enrollment IDs, or account identifiers.
Expected: You can distinguish remote transport failure from missing enrollment or total app failure.
Run one network A/B without resetting state
Applies when: The first network returns 503
A second independent network helps isolate a local router or proxy without destroying useful state.
- Disable only explicit VPN/proxy software for one controlled test.
- Try a cellular hotspot or another independent connection.
- Record whether the HTTP status and edge region remain the same.
Expected: A network-specific block changes the result, or the same 503 supports escalation beyond the local network.
Update and report the upstream branch
Applies when: The same 503 persists on multiple networks
The open report contains no confirmed local repair for this route-level failure.
- Update Codex Desktop and restart it once.
- Check the official service status page for a matching incident.
- Report the redacted timestamp, ray/region, version, enrollment-present flag, and A/B result.
Expected: The service recovers or the report contains enough routing evidence for upstream diagnosis.
Verification
Prove the fix worked
- Reconnect from the phone and confirm the desktop WebSocket reaches HTTP 101 rather than 503.
- Verify Remote Control can start one harmless interaction.
- Confirm local Codex tasks were not altered by the troubleshooting.
Escalation
If it still fails
- Do not delete auth or enrollment files while the logs already show `has_enrollment=true`.
- Do not treat an unauthenticated HTTP 400 control as proof that authenticated Remote Control works.
- Keep unrelated local HTTP 400 or large-context failures in a separate diagnostic branch.
Scope
Environment and version notes
- The primary report used Desktop 26.903.61454 and bundled CLI 0.153.4 on Apple Silicon macOS 27.
- It reproduced on two access networks and cited several related reports from the same period.
- Issue status rechecked September 23, 2026.
Evidence
Sources
Source labels describe the evidence available on the checked date. A closed issue is not automatically a shipped fix.