The visible problem may look like one API or tuning value, but reliability is decided by state ownership, resource bounds, and recovery after failure. Nearest geography ignores ISP routing, while last-sample fastest chases noise. Hard-filter health server-side, then score remaining nodes stably.
Data and models enter decisions only with a defined purpose, minimum inputs, and repeatable evaluation. Deterministic policy owns permissions and side effects; models provide evidence, confidence, and safe abstention.
Make the implementation decisions explicit
Start from facts the data and protocol can guarantee, then decide what the interface may promise. Each rule below needs an owner, a bound, and a compatibility policy rather than an oral convention from one review.
- Score regional p95, headroom, and anonymous network-bucket history, reserve 5–10 percent exploration, require sustained advantage plus dwell time, and return two or three candidates.
- Give state one owner, a version, and terminal states; callbacks may mutate only the version that created them.
- Treat cleanup as protocol behavior: timers, handles, queues, and temporary data must be safely releasable in every terminal state.
The delivery standard for Adaptive TURN Region Selection Without Global Oscillation is a usable normal path, convergent failures, bounded resources, and a state users can understand. The result is a production capability that can be explained, degraded safely, and rolled back—not a demo that works once.
Failure paths that are easy to miss
Production failures often appear when two individually valid actions overlap. Inspect stale messages, duplicate effects, exhausted resources, and mixed versions instead of patching only the current stack frame.
- Sending everyone to the momentary fastest region overloads it and causes herd oscillation, while learning from exact IP exceeds privacy need.
- Fixing only the UI leaves queues, locks, or expired credentials for the next operation to inherit and fail again.
- Without backpressure or quota, a slow consumer raises memory, queue depth, and tail latency until unrelated users are affected.
How to verify it before release
Observe both endpoints, persisted records, and operational signals during verification. One button state or one successful response cannot prove the complete loop.
- Replay capacity changes, regional jitter, cold start, and unusual ISP routes; compare success, p95, switch count, exploration cost, and peak load.
- Disconnect, change networks, and recover mid-operation; reconcile endpoint state, persistence, and resource counts.
- Before release, record success rate, p50/p95/p99 latency, error classes, and resource high-water marks with explicit rollback thresholds.
The release standard is practical: the normal path is fast, abnormal paths converge, recovery never overrides an explicit user decision, and operators can diagnose faults from limited, privacy-safe evidence.