How should WebSockets be designed for production?

For production, authenticate the connection, handle reconnects and heartbeats, bound message size and rate, plan horizontal scaling and connection affinity, and persist critical state outside individual socket processes. Add automated tests and observability around the critical behavior, document ownership and failure handling, and review the design when traffic, dependencies, or security requirements change.