Before shipping it, separate protocol facts, product promises, and operating cost. Mixing those layers produces confident but incorrect decisions. Negotiation glare is routine: refresh, addTrack, ICE restart, and two Connect clicks can all create offers together. Perfect Negotiation resolves them in one state machine instead of feature-specific delays.
WebRTC decisions need evidence from both endpoints, negotiation versions, and the selected candidate pair. One browser callback cannot reveal glare, ICE route changes, or divergence after a peer refresh.
The parts that make the design practical
This capability crosses clients, networks, and servers, so a local optimization can create a system failure. Decisions must constrain both endpoints, persisted truth, and operating budgets together.
- Derive the polite role from a stable shared device ordering so it does not flip after reconnect.
- Detect collisions from makingOffer, isSettingRemoteAnswerPending, and signalingState together.
- Have the polite peer roll back and accept the remote offer while the impolite peer ignores the colliding offer and its candidates.
Perfect Negotiation matters because every renegotiating feature enters one queue with roles, versions, and rollback semantics—not because it saves a few catch blocks.
Keep false assumptions out of production
Boundaries turn hidden assumptions into incidents. Weak networks, refresh, concurrency, and capacity need combined coverage because retries can hide each one in isolation.
- The app ignores an offer but still adds its ICE candidates, producing misleading candidate errors.
- Roles derive from temporary connection IDs, so after refresh both peers become polite or both become impolite.
- Screen sharing gets a separate negotiation lock that can deadlock against the ICE restart lock.
What the release gate should inspect
A release gate combines deterministic regression, randomized timing, and real browser pairs. Preserve the seed and state trace from every failure as a permanent replay case.
- Trigger addTrack, ICE restart, and a manual connection request on both peers together; signaling must return to stable.
- Randomize offer, answer, and candidate delivery while proving stale versions cannot change the current connection.
- Run hundreds of glare rounds and assert one PeerConnection, one open channel, and one success notification.
Completion is not one passing path. Every terminal state reconciles, automation stays below user intent, and every operational cost has an explicit ceiling.