X_SOCKET_ORIGIN_REFUSED

the websocket upgrade came from another origin

a browser page asked the sync node for a socket from an origin — scheme, host and port, compared exactly — that is not APP_URL's origin when one is declared; with none declared, not the origin the node was reached on. The session cookie would have ridden it. The same host name on another port, or over plain http, is another origin. The cause names the origin that asked and every origin the node admits; x dev also admits its own web role's origin and the origin it was reached on beside a declared one

export APP_URL=https://www.example.com on the sync role — the refusal renders the origin that asked in its place; run it only when that is where the pages are served — or pass syncNode({ allowedOrigins })