Call waiting and MNCC_RTP_CREATE

Hello Osmocom CNI community, I am writing my own software that talks MNCC to OsmoMSC instead of using osmo-sip-connector, and I am seeing perplexing behaviour with call waiting. Normally when I send an MT call toward GSM with MNCC_SETUP_REQ, the response from OsmoMSC consists of MNCC_CALL_CONF_IND (when the called phone confirms the call), followed by MNCC_RTP_CREATE (when OsmoMSC assigns the call), and finally followed by MNCC_ALERT_IND when the called phone starts alerting. Likewise on MO calls I get an MNCC_RTP_CREATE message on the MNCC interface when the call is assigned, typically in response to MNCC_CALL_PROC_REQ. But now consider a call waiting scenario: call 1 is already in progress (fully connected, parties talking), and there is a second incoming call. I send a new MNCC_SETUP_REQ to OpenMSC for call 2, with a new callref, the phone receives it and starts making call-waiting beeps. The response on the MNCC socket for call 2 is that I get MNCC_CALL_CONF_IND followed by MNCC_ALERT_IND (and then MNCC_SETUP_CNF if the target phone puts call 1 on hold and answers call 2) - but there is no MNCC_RTP_CREATE! I can see how MNCC_RTP_CREATE is sent by OsmoMSC when the call has been assigned and there is a TCH cross-connected through OsmoMGW, and I can see how the call assignment step will naturally be omitted in the call waiting scenario when TCH is already there for call 1. But the call gateway (be it osmo-sip-connector or an independent reimplementation) feeding MT call 2 to MNCC has to have some way of obtaining RTP connection information for this call without having to know how to associate it with another previous call, and if it doesn't get MNCC_RTP_CREATE, how would it get this vital info? This is one of those "how does it work for everyone else?" moments - while I am certainly unique in writing my own MNCC software instead of running osmo-sip-connector, surely o-s-c also needs to receive MNCC_RTP_CREATE with RTP info from OsmoMSC in order to successfully connect call 2... And given that someone implemented call hold and retrieve operations in o-s-c, I reason that someone must be using the call waiting feature and it must be working for them - but how? One thing which o-s-c does differently from my sw is that o-s-c sends an empty MNCC_RTP_CREATE (the "command" version of this packet) to OsmoMSC in response to MNCC_CALL_CONF_IND, which my sw doesn't do at the moment. But I looked in the OsmoMSC code, and I don't see any difference: the function that handles MNCC_RTP_CREATE command (tch_rtp_create()) simply calls msc_a_try_call_assignment(trans), and the exact same call is made in the gsm48_cc_rx_call_conf() function that sends MNCC_CALL_CONF_IND. So I don't see any code path that can result in call 2 receiving MNCC_RTP_CREATE from OsmoMSC in the call waiting scenario when TCH is already there from call 1. So, how does the call waiting feature work for others in the community, and what am I missing? I am running the tagged release from 2021-11. M~