The universal 60s idle-timeout footgun stated up front; the five-point contract any proxy must honor (incl. RUTSTER_TRUSTED_PROXIES + honest X-Forwarded-* for signature validation); complete snippets: nginx (explicitly not-recommended, snippet-only support), HAProxy (timeout tunnel in defaults per #2280; hard-stop-after warning), Traefik (pin the exact version — #10601 / v2.11.2 / #11405 WS-breaking patch history). Signed-off-by: Aaron D. Lee <himself@adlee.work>