I had a slightly different solution for a project I'm working on.
As you said, I also noted that after a hub reboot, the eventsocket would connect but not pass data. I was tearing my hair out thinking I had screwed up the socket client on my end. I also had inconsistent results, which was maddening. I finally noticed that if I rebooted the hub and then immediately attempted to connect using a websocket test client plugin in Chrome, the socket was also "dead" -- connected but passing no data. This suggested my client implementation was not the problem, so I dug in further...
Anyway, to get to the point, I finally discovered that if you have "Hub Login Security" enabled, connections to the eventsocket will be dead until a hub login occurs. This distant dependency accounted for the "inconsistency" I had previously observed -- success or failure depended on whether I happened to log in to the hub or not, and when that login occurred relative to me reconnecting to the eventsocket. If the login occurred after connection, any connection made prior to the login never worked, but any connection after login worked fine every time.
- Turn off Hub Login Security. This is clearly a reduction in hub security, but I don't see it as very strong anyway. Since most of my current users weren't having any issues, I suspect many people run this way by default.
- Not use the eventsocket. That's undesirable, as the alternative for me was POST URL in Maker API, which I'm not a fan of (slower, less efficient, somewhat more fragile).
- Incorportate a login into my HE interface. It turns out, requesting the login page (via HTTP), grabbing its session cookie from the response headers, and then POSTing a correct username and password (as form data) to the page (and passing the session cookie) gives the hub a login and subsequent eventsocket connections work as expected. This was easy for me to do as I'm coding in JS/nodejs, so I'm not sure how possible that might be to pull off in NR.
Edit: If any of the staff is reading this, it would be great if the eventsocket could just take a token like Maker API. I realize it's an unsupported/undocumented feature, but it seems that it's in such wide use these days, and a huge win over POST URL, that it should be promoted.