Node WebSocket clients only stay healthy when endpoint retirement is treated as a config deploy, not an outage mystery. Prefer a single connection factory that pins host, port, and path from config, fail closed when the handshake target is unknown, and keep reconnect backoff capped so a retired listener cannot open a reconnect storm against the old address. Separate auth refresh from socket reconnect so a token renew cannot multiply sockets.

Ops prove-out after cutting over the endpoint: open a canary client against the new host and port and confirm the handshake succeeds while an intentional old-port probe fails fast, then kill the socket mid-stream and confirm a single reconnect lands on the new target. Watch active socket count, reconnect rate, and auth-error rate for one deploy window — a spike in reconnects with flat successful streams usually means stale config still points at the retired listener. Keep a canary process on the prior endpoint mapping for one release so you can tell a bad cutover from a broker-side regression.