Some time ago (1-2 weeks) I changed the link-test from
(if it fails three consecutive tests, each 30 seconds apart) to
(if it fails three consecutive tests, each 10 seconds apart).
We had a momentary failure today, failed over, failed back 44 seconds later. No disconnect from the VOIP service. The quicker detection was the probable reason - we failed-back before the firewall had a chance to close the idle UDP port.
I’m still chasing the cause of the temporary failures - the link ran problem-free for 20 months initially, so it is capable and can do the job - but there is a squirrel in there somewhere. I also put money in the budget to get some different hardware.
Thank you again, to all, for their input.