All this is connected with the ability marker step, a completely undocumented (and apparently unknown to Twilio) way.
In order for twilio logs to identify the VoIP endpoint that caused the conference, we had to bind the client ID to allow_client_incoming and make sure the ID was direct alphanumeric (for example, a dash in the line prevented the ID from entering).
In the step of creating a server-side token (ruby), it looks something like this:
capability.allow_client_incoming sanitized_client_id
mygzi source share