Production's MERCURE_CORS_ALLOWED_ORIGINS only allowed https://escapepage.com, but nginx has no www redirect (server_name _;), so the site is also reachable at https://www.escapepage.com. Visitors on the www host got a CORS error on the Mercure EventSource connection since the Origin header didn't match the allow-list. Dev's .env already allowed both; bring docker/.env.dist in line, and fix its stale MERCURE_PUBLIC_URL (bare domain instead of the mercure. subdomain actually used). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>