With the new DTLS transport logging I could see the real failure mode
for inbound calls:
meta peer: DTLS state changed state=connecting
meta peer: DTLS state changed state=FAILED (~2.4s later)
Not a timeout — a fatal DTLS alert. Meta was rejecting our ClientHello
because it hadn't yet seen our SDP answer (the answer flows to Meta via
Rails' pre_accept_call / accept_call *after* create_session returns, so
for ~1 second Meta has no fingerprint to verify us against). Pion
treats the alert as fatal and closes the PC, which drops every later
audio packet we tried to forward to Meta → Meta times out at 20s with
error 138021.
Flip the roles with SetAnsweringDTLSRole(DTLSRoleServer). Meta now
answers its own offer's actpass as the DTLS client, and Meta only
starts ClientHello after it has our answer (so our fingerprint is
already known when we receive it). We've been idle until then and have
everything we need to complete the handshake in one round trip.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
