The dangerous implementation is not one that never works. It is one that works in a demo and loses its boundaries under real networks and real data volume. IPv6 may provide globally routable addresses without classic port mapping, yet host and router firewalls still block unsolicited traffic. Dual-stack peers gather both families and select from real checks, not appearance.
WebRTC decisions need evidence from both endpoints, negotiation versions, and the selected candidate pair. One browser callback cannot reveal glare, ICE route changes, or divergence after a peer refresh.
Engineering boundaries and tradeoffs
Write the following choices as reviewable rules instead of scattering them across callbacks and UI conditions. Explicit rules make scaling, compatibility, and diagnosis less dependent on guesswork.
- Preserve address family and protocol in the candidate model and check IPv4 and IPv6 pairs in parallel.
- Before publishing TURN AAAA records, verify listener, certificate, and relay addresses all support IPv6.
- Show IPv6 family and scope without exposing full temporary addresses or stable interface identifiers.
Treat IPv6 as a first-class candidate checked in parallel, neither forced nor disabled. Parsing, logging, and relay operations must be genuinely dual-stack.
How it fails in production
An abnormal path is more than an error banner. It decides how in-flight work stops, how the peer learns the outcome, what residue remains, and whether the next operation inherits it.
- Code splits host:port on colons and breaks bracketed IPv6 addresses.
- DNS returns AAAA for a service without IPv6 routing, delaying the IPv4 fallback.
- String-based deduplication treats equivalent compressed IPv6 forms as different candidates.
Turn testing into a closed loop
Build golden cases from known inputs and controlled faults, then align production metrics with those results. Verification extends to production only when signals detect the same degradation early.
- Run two-browser tests on native dual stack, IPv6-only with NAT64, IPv4-only, and inbound-filtered IPv6.
- Verify bracketed-address handling across URLs, redaction, candidate parsing, and TURN configuration.
- Blackhole AAAA connectivity and ensure fallback is timely and the final route label remains accurate.
The release bar is clear: users understand the current state, failures stop or recover, resources stay bounded, and operators can identify the phase from minimum necessary evidence.