diff --git a/README.md b/README.md
index daadd0c..4f4a174 100644
--- a/README.md
+++ b/README.md
@@ -7,7 +7,7 @@
   * (startupCount << 48) + counter
   * pass startup count to newRoutingTable function (or global?)
   * write / increment on startup
-* Use startup counter for trace IDs as well.
+* Use startup counter for trace IDs as well (see Globals)
 * Double buffering in IFReader and ConnReader ?
 * Clean up state machine - one class w/
   * type stateFunc func(msg any) stateFunc
diff --git a/peer/connreader.go b/peer/connreader.go
index 03ef38c..5427227 100644
--- a/peer/connreader.go
+++ b/peer/connreader.go
@@ -44,7 +44,3 @@ func (r *ConnReader) handleNextPacket() {
 
 	r.RemotePeers[h.SourceIP].Load().HandlePacket(h, remoteAddr, buf)
 }
-
-func (r *ConnReader) logf(format string, args ...any) {
-	log.Printf("[ConnReader] "+format, args...)
-}
diff --git a/peer/crypto_test.go b/peer/crypto_test.go
deleted file mode 100644
index b3c00f3..0000000
--- a/peer/crypto_test.go
+++ /dev/null
@@ -1,191 +0,0 @@
-package peer
-
-import (
-	"net/netip"
-	"reflect"
-	"testing"
-)
-
-func newRoutePairForTesting() (*remotePeer, *remotePeer) {
-	keys1 := generateKeys()
-	keys2 := generateKeys()
-
-	r1 := newRemotePeer(1)
-	r1.PubSignKey = keys1.PubSignKey
-	r1.ControlCipher = newControlCipher(keys1.PrivKey, keys2.PubKey)
-	r1.DataCipher = newDataCipher()
-
-	r2 := newRemotePeer(2)
-	r2.PubSignKey = keys2.PubSignKey
-	r2.ControlCipher = newControlCipher(keys2.PrivKey, keys1.PubKey)
-	r2.DataCipher = r1.DataCipher
-
-	return r1, r2
-}
-
-func TestDecryptControlPacket(t *testing.T) {
-	var (
-		r1, r2 = newRoutePairForTesting()
-		tmp    = make([]byte, bufferSize)
-		out    = make([]byte, bufferSize)
-	)
-
-	in := packetSyn{
-		TraceID:   newTraceID(),
-		SharedKey: r1.DataCipher.Key(),
-		Direct:    true,
-	}
-
-	enc := r1.EncryptControlPacket(in, tmp, out)
-	h := parseHeader(enc)
-
-	iMsg, err := r2.DecryptControlPacket(netip.AddrPort{}, h, enc, tmp)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	msg, ok := iMsg.(controlMsg[packetSyn])
-	if !ok {
-		t.Fatal(ok)
-	}
-
-	if !reflect.DeepEqual(msg.Packet, in) {
-		t.Fatal(msg)
-	}
-}
-
-/*
-	func TestDecryptControlPacket_decryptionFailed(t *testing.T) {
-		var (
-			r1, r2 = newRoutePairForTesting()
-			tmp    = make([]byte, bufferSize)
-			out    = make([]byte, bufferSize)
-		)
-
-		in := packetSyn{
-			TraceID:   newTraceID(),
-			SharedKey: r1.DataCipher.Key(),
-			Direct:    true,
-		}
-
-		enc := encryptControlPacket(r1.IP, r2, in, tmp, out)
-		h := parseHeader(enc)
-
-		for i := range enc {
-			x := bytes.Clone(enc)
-			x[i]++
-			_, err := decryptControlPacket(r2, netip.AddrPort{}, h, x, tmp)
-			if !errors.Is(err, errDecryptionFailed) {
-				t.Fatal(i, err)
-			}
-		}
-	}
-
-	func TestDecryptControlPacket_duplicate(t *testing.T) {
-		var (
-			r1, r2 = newRoutePairForTesting()
-			tmp    = make([]byte, bufferSize)
-			out    = make([]byte, bufferSize)
-		)
-
-		in := packetSyn{
-			TraceID:   newTraceID(),
-			SharedKey: r1.DataCipher.Key(),
-			Direct:    true,
-		}
-
-		enc := encryptControlPacket(r1.IP, r2, in, tmp, out)
-		h := parseHeader(enc)
-
-		if _, err := decryptControlPacket(r2, netip.AddrPort{}, h, enc, tmp); err != nil {
-			t.Fatal(err)
-		}
-
-		_, err := decryptControlPacket(r2, netip.AddrPort{}, h, enc, tmp)
-		if !errors.Is(err, errDuplicateSeqNum) {
-			t.Fatal(err)
-		}
-	}
-
-	func TestDecryptControlPacket_invalidPacket(t *testing.T) {
-		var (
-			r1, r2 = newRoutePairForTesting()
-			tmp    = make([]byte, bufferSize)
-			out    = make([]byte, bufferSize)
-		)
-
-		in := testPacket("hello!")
-
-		enc := encryptControlPacket(r1.IP, r2, in, tmp, out)
-		h := parseHeader(enc)
-
-		_, err := decryptControlPacket(r2, netip.AddrPort{}, h, enc, tmp)
-		if !errors.Is(err, errUnknownPacketType) {
-			t.Fatal(err)
-		}
-	}
-
-func TestDecryptDataPacket(t *testing.T) {
-	var (
-		r1, r2 = newRoutePairForTesting()
-		out    = make([]byte, bufferSize)
-		data   = make([]byte, 1024)
-	)
-
-	rand.Read(data)
-
-	enc := encryptDataPacket(r1.IP, r2.IP, r2, data, out)
-	h := parseHeader(enc)
-
-	out, err := decryptDataPacket(r1, h, bytes.Clone(enc), out)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if !bytes.Equal(data, out) {
-		t.Fatal(data, out)
-	}
-}
-
-func TestDecryptDataPacket_incorrectCipher(t *testing.T) {
-	var (
-		r1, r2 = newRoutePairForTesting()
-		out    = make([]byte, bufferSize)
-		data   = make([]byte, 1024)
-	)
-
-	rand.Read(data)
-
-	enc := encryptDataPacket(r1.IP, r2.IP, r2, data, bytes.Clone(out))
-	h := parseHeader(enc)
-
-	r1.DataCipher = newDataCipher()
-	_, err := decryptDataPacket(r1, h, enc, bytes.Clone(out))
-	if !errors.Is(err, errDecryptionFailed) {
-		t.Fatal(err)
-	}
-}
-
-func TestDecryptDataPacket_duplicate(t *testing.T) {
-	var (
-		r1, r2 = newRoutePairForTesting()
-		out    = make([]byte, bufferSize)
-		data   = make([]byte, 1024)
-	)
-
-	rand.Read(data)
-
-	enc := encryptDataPacket(r1.IP, r2.IP, r2, data, bytes.Clone(out))
-	h := parseHeader(enc)
-
-	_, err := decryptDataPacket(r1, h, enc, bytes.Clone(out))
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	_, err = decryptDataPacket(r1, h, enc, bytes.Clone(out))
-	if !errors.Is(err, errDuplicateSeqNum) {
-		t.Fatal(err)
-	}
-}
-*/
diff --git a/peer/errors.go b/peer/errors.go
index b1e07e2..5ab1df8 100644
--- a/peer/errors.go
+++ b/peer/errors.go
@@ -3,8 +3,6 @@ package peer
 import "errors"
 
 var (
-	errDecryptionFailed  = errors.New("decryption failed")
-	errDuplicateSeqNum   = errors.New("duplicate sequence number")
 	errMalformedPacket   = errors.New("malformed packet")
 	errUnknownPacketType = errors.New("unknown packet type")
 )
diff --git a/peer/globals.go b/peer/globals.go
index 3e0e45c..16272d4 100644
--- a/peer/globals.go
+++ b/peer/globals.go
@@ -31,10 +31,6 @@ var multicastAddr = net.UDPAddrFromAddrPort(netip.AddrPortFrom(
 	netip.AddrFrom4([4]byte{224, 0, 0, 157}),
 	4560))
 
-type marshaller interface {
-	Marshal([]byte) []byte
-}
-
 // ----------------------------------------------------------------------------
 
 type Globals struct {
@@ -62,6 +58,7 @@ type Globals struct {
 	IFace io.ReadWriteCloser
 
 	// For trace ID.
+	NewTraceID func() uint64
 }
 
 func NewGlobals(
@@ -90,6 +87,12 @@ func NewGlobals(
 
 	g.IFace = iface
 
+	// TODO: Initialize w/ startup count.
+	traceID := uint64(time.Now().Unix()<<30) + 1
+	g.NewTraceID = func() uint64 {
+		return atomic.AddUint64(&traceID, 1)
+	}
+
 	for i := range g.RemotePeers {
 		g.RemotePeers[i] = &atomic.Pointer[Remote]{}
 	}
diff --git a/peer/packets-util.go b/peer/packets-util.go
index 3a8f50b..3bdfc67 100644
--- a/peer/packets-util.go
+++ b/peer/packets-util.go
@@ -2,18 +2,9 @@ package peer
 
 import (
 	"net/netip"
-	"sync/atomic"
-	"time"
 	"unsafe"
 )
 
-// TODO: Initialize w/ startup counter.
-var traceIDCounter uint64 = uint64(time.Now().Unix()<<30) + 1
-
-func newTraceID() uint64 {
-	return atomic.AddUint64(&traceIDCounter, 1)
-}
-
 // ----------------------------------------------------------------------------
 
 type binWriter struct {
diff --git a/peer/peer.go b/peer/peer.go
index 56adea5..8c7cfab 100644
--- a/peer/peer.go
+++ b/peer/peer.go
@@ -55,7 +55,6 @@ func newPeerMain(args mainArgs) *peerMain {
 
 	localPeer := state.Peers[config.LocalPeerIP]
 
-	log.Printf("XXXXX %v %v", config.LocalPeerIP, localPeer)
 	myAddr, err := net.ResolveUDPAddr("udp", fmt.Sprintf(":%d", localPeer.Port))
 	if err != nil {
 		log.Fatalf("Failed to resolve UDP address: %v", err)
diff --git a/peer/peer_test.go b/peer/peer_test.go
deleted file mode 100644
index 863ca8f..0000000
--- a/peer/peer_test.go
+++ /dev/null
@@ -1,114 +0,0 @@
-package peer
-
-import (
-	"bytes"
-	"crypto/rand"
-	mrand "math/rand"
-	"net/netip"
-	"sync/atomic"
-)
-
-// A test peer.
-type P struct {
-	cryptoKeys
-	RT         *atomic.Pointer[routingTable]
-	Conn       *TestUDPConn
-	IFace      *TestIFace
-	ConnReader *ConnReader
-	IFReader   *IFReader
-}
-
-func NewPeerForTesting(n *TestNetwork, ip byte, addr netip.AddrPort) P {
-	p := P{
-		cryptoKeys: generateKeys(),
-		RT:         &atomic.Pointer[routingTable]{},
-		IFace:      NewTestIFace(),
-	}
-
-	rt := newRoutingTable(ip, addr)
-	p.RT.Store(&rt)
-	p.Conn = n.NewUDPConn(addr)
-	//p.ConnWriter = NewConnWriter(p.Conn.WriteToUDPAddrPort, p.RT)
-
-	return p
-}
-
-func ConnectPeers(p1, p2 *P) {
-	rt1 := p1.RT.Load()
-	rt2 := p2.RT.Load()
-
-	ip1 := rt1.LocalIP
-	ip2 := rt2.LocalIP
-
-	rt1.Peers[ip2].Up = true
-	rt1.Peers[ip2].Direct = true
-	rt1.Peers[ip2].Relay = true
-	rt1.Peers[ip2].DirectAddr = rt2.LocalAddr
-	rt1.Peers[ip2].PubSignKey = p2.PubSignKey
-	rt1.Peers[ip2].ControlCipher = newControlCipher(p1.PrivKey, p2.PubKey)
-	rt1.Peers[ip2].DataCipher = newDataCipher()
-
-	rt2.Peers[ip1].Up = true
-	rt2.Peers[ip1].Direct = true
-	rt2.Peers[ip1].Relay = true
-	rt2.Peers[ip1].DirectAddr = rt1.LocalAddr
-	rt2.Peers[ip1].PubSignKey = p1.PubSignKey
-	rt2.Peers[ip1].ControlCipher = newControlCipher(p2.PrivKey, p1.PubKey)
-	rt2.Peers[ip1].DataCipher = rt1.Peers[ip2].DataCipher
-}
-
-func NewPeersForTesting() (p1, p2, p3 P) {
-	n := NewTestNetwork()
-
-	p1 = NewPeerForTesting(
-		n,
-		1,
-		netip.AddrPortFrom(netip.AddrFrom4([4]byte{1, 1, 1, 1}), 100))
-
-	p2 = NewPeerForTesting(
-		n,
-		2,
-		netip.AddrPortFrom(netip.AddrFrom4([4]byte{1, 1, 1, 2}), 200))
-
-	p3 = NewPeerForTesting(
-		n,
-		3,
-		netip.AddrPortFrom(netip.AddrFrom4([4]byte{1, 1, 1, 3}), 300))
-
-	ConnectPeers(&p1, &p2)
-	ConnectPeers(&p1, &p3)
-	ConnectPeers(&p2, &p3)
-
-	return
-}
-
-func RandPacket() []byte {
-	n := mrand.Intn(1200)
-	b := make([]byte, n)
-	rand.Read(b)
-	return b
-}
-
-func ModifyPacket(in []byte) []byte {
-	x := make([]byte, 1)
-
-	for {
-		rand.Read(x)
-		out := bytes.Clone(in)
-		idx := mrand.Intn(len(out))
-		if out[idx] != x[0] {
-			out[idx] = x[0]
-			return out
-		}
-	}
-}
-
-// ----------------------------------------------------------------------------
-
-type UnknownControlPacket struct {
-	TraceID uint64
-}
-
-func (p UnknownControlPacket) Marshal(buf []byte) []byte {
-	return newBinWriter(buf).Byte(255).Uint64(p.TraceID).Build()
-}
diff --git a/peer/peerstates_test.go b/peer/peerstates_test.go
deleted file mode 100644
index 32dc207..0000000
--- a/peer/peerstates_test.go
+++ /dev/null
@@ -1,371 +0,0 @@
-package peer
-
-import (
-	"testing"
-	"vppn/m"
-)
-
-// ----------------------------------------------------------------------------
-
-func TestPeerState_OnPeerUpdate_nilPeer(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.PeerUpdate(nil)
-	assertType[*stateDisconnected](t, h.State)
-}
-
-func TestPeerState_OnPeerUpdate_publicLocalIsServer(t *testing.T) {
-	keys := generateKeys()
-	h := NewPeerStateTestHarness()
-
-	state := h.State.(*stateDisconnected)
-	state.localAddr = addrPort4(1, 1, 1, 2, 200)
-
-	peer := &m.Peer{
-		PeerIP:     3,
-		Port:       456,
-		PubKey:     keys.PubKey,
-		PubSignKey: keys.PubSignKey,
-	}
-
-	h.PeerUpdate(peer)
-	assertEqual(t, h.Published.Up, false)
-	assertType[*stateServer](t, h.State)
-}
-
-/*
-
-func TestPeerState_OnPeerUpdate_clientDirect(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigClientDirect(t)
-}
-
-/*
-func TestPeerState_OnPeerUpdate_clientRelayed(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigClientRelayed(t)
-}
-
-/*
-func TestStateServer_directSyn(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigServer_Relayed(t)
-
-	assertEqual(t, h.Published.Up, false)
-
-	synMsg := controlMsg[packetSyn]{
-		SrcIP:   3,
-		SrcAddr: addrPort4(1, 1, 1, 3, 300),
-		Packet: packetSyn{
-			TraceID: newTraceID(),
-			//SentAt:        time.Now().UnixMilli(),
-			//SharedKeyType: 1,
-			Direct: true,
-		},
-	}
-
-	h.State = h.State.OnMsg(synMsg)
-
-	assertEqual(t, len(h.Sent), 1)
-	ack := assertType[packetAck](t, h.Sent[0].Packet)
-	assertEqual(t, ack.TraceID, synMsg.Packet.TraceID)
-	assertEqual(t, h.Sent[0].Peer.IP, 3)
-	assertEqual(t, ack.PossibleAddrs[0].IsValid(), false)
-	assertEqual(t, h.Published.Up, true)
-}
-
-func TestStateServer_relayedSyn(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	state := h.ConfigServer_Relayed(t)
-
-	state.pubAddrs.Store(addrPort4(4, 5, 6, 7, 1234))
-
-	assertEqual(t, h.Published.Up, false)
-
-	synMsg := controlMsg[packetSyn]{
-		SrcIP:   3,
-		SrcAddr: addrPort4(1, 1, 1, 3, 300),
-		Packet: packetSyn{
-			TraceID: newTraceID(),
-			//SentAt:        time.Now().UnixMilli(),
-			//SharedKeyType: 1,
-			Direct: false,
-		},
-	}
-	synMsg.Packet.PossibleAddrs[0] = addrPort4(1, 1, 1, 3, 300)
-	synMsg.Packet.PossibleAddrs[1] = addrPort4(2, 2, 2, 3, 300)
-
-	h.State = h.State.OnMsg(synMsg)
-
-	assertEqual(t, len(h.Sent), 3)
-
-	ack := assertType[packetAck](t, h.Sent[0].Packet)
-	assertEqual(t, ack.TraceID, synMsg.Packet.TraceID)
-	assertEqual(t, h.Sent[0].Peer.IP, 3)
-	assertEqual(t, ack.PossibleAddrs[0], addrPort4(4, 5, 6, 7, 1234))
-	assertEqual(t, ack.PossibleAddrs[1].IsValid(), false)
-	assertEqual(t, h.Published.Up, true)
-
-	assertType[packetProbe](t, h.Sent[1].Packet)
-	assertType[packetProbe](t, h.Sent[2].Packet)
-	assertEqual(t, h.Sent[1].Peer.DirectAddr, addrPort4(1, 1, 1, 3, 300))
-	assertEqual(t, h.Sent[2].Peer.DirectAddr, addrPort4(2, 2, 2, 3, 300))
-}
-
-func TestStateServer_onProbe(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigServer_Relayed(t)
-	assertEqual(t, h.Published.Up, false)
-
-	probeMsg := controlMsg[packetProbe]{
-		SrcIP:   3,
-		SrcAddr: addrPort4(1, 1, 1, 3, 300),
-		Packet:  packetProbe{TraceID: newTraceID()},
-	}
-
-	h.State = h.State.OnMsg(probeMsg)
-
-	assertEqual(t, len(h.Sent), 1)
-
-	probe := assertType[packetProbe](t, h.Sent[0].Packet)
-	assertEqual(t, probe.TraceID, probeMsg.Packet.TraceID)
-	assertEqual(t, h.Sent[0].Peer.DirectAddr, addrPort4(1, 1, 1, 3, 300))
-}
-
-func TestStateServer_OnPingTimer_timeout(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigServer_Relayed(t)
-
-	synMsg := controlMsg[packetSyn]{
-		SrcIP:   3,
-		SrcAddr: addrPort4(1, 1, 1, 3, 300),
-		Packet: packetSyn{
-			TraceID: newTraceID(),
-			//SentAt:        time.Now().UnixMilli(),
-			//SharedKeyType: 1,
-			Direct: true,
-		},
-	}
-
-	h.State = h.State.OnMsg(synMsg)
-	assertEqual(t, len(h.Sent), 1)
-	assertEqual(t, h.Published.Up, true)
-
-	// Ping shouldn't timeout.
-	h.OnPingTimer()
-	assertEqual(t, h.Published.Up, true)
-
-	// Advance the time, then ping.
-	state := assertType[*stateServer](t, h.State)
-	state.lastSeen = time.Now().Add(-timeoutInterval - time.Second)
-
-	h.OnPingTimer()
-	assertEqual(t, h.Published.Up, false)
-}
-
-func TestStateClientDirect_OnAck(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigClientDirect(t)
-
-	assertEqual(t, h.Published.Up, false)
-
-	// On entering the state, a SYN should have been sent.
-	assertEqual(t, len(h.Sent), 1)
-	syn := assertType[packetSyn](t, h.Sent[0].Packet)
-
-	ack := controlMsg[packetAck]{
-		Packet: packetAck{TraceID: syn.TraceID},
-	}
-	h.State = h.State.OnMsg(ack)
-	assertEqual(t, h.Published.Up, true)
-}
-
-func TestStateClientDirect_OnAck_incorrectTraceID(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigClientDirect(t)
-
-	assertEqual(t, h.Published.Up, false)
-
-	// On entering the state, a SYN should have been sent.
-	assertEqual(t, len(h.Sent), 1)
-	syn := assertType[packetSyn](t, h.Sent[0].Packet)
-
-	ack := controlMsg[packetAck]{
-		Packet: packetAck{TraceID: syn.TraceID + 1},
-	}
-	h.State = h.State.OnMsg(ack)
-	assertEqual(t, h.Published.Up, false)
-}
-
-func TestStateClientDirect_OnPingTimer(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigClientDirect(t)
-
-	// On entering the state, a SYN should have been sent.
-	assertEqual(t, len(h.Sent), 1)
-	assertType[packetSyn](t, h.Sent[0].Packet)
-
-	h.OnPingTimer()
-
-	// On ping timer, another syn should be sent. Additionally, we should remain
-	// in the same state.
-	assertEqual(t, len(h.Sent), 2)
-	assertType[packetSyn](t, h.Sent[1].Packet)
-	assertType[*stateClientDirect](t, h.State)
-	assertEqual(t, h.Published.Up, false)
-}
-
-func TestStateClientDirect_OnPingTimer_timeout(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigClientDirect(t)
-
-	assertEqual(t, h.Published.Up, false)
-
-	// On entering the state, a SYN should have been sent.
-	assertEqual(t, len(h.Sent), 1)
-	syn := assertType[packetSyn](t, h.Sent[0].Packet)
-
-	ack := controlMsg[packetAck]{
-		Packet: packetAck{TraceID: syn.TraceID},
-	}
-	h.State = h.State.OnMsg(ack)
-	assertEqual(t, h.Published.Up, true)
-
-	state := assertType[*stateClientDirect](t, h.State)
-	state.lastSeen = time.Now().Add(-(timeoutInterval + time.Second))
-
-	h.OnPingTimer()
-
-	// On ping timer, we should timeout, causing the client to reset. Another SYN
-	// will be sent when re-entering the state, but the connection should be down.
-	assertEqual(t, len(h.Sent), 2)
-	assertType[packetSyn](t, h.Sent[1].Packet)
-	assertType[*stateClientDirect](t, h.State)
-	assertEqual(t, h.Published.Up, false)
-}
-
-func TestStateClientRelayed_OnAck(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigClientRelayed(t)
-
-	assertEqual(t, h.Published.Up, false)
-
-	// On entering the state, a SYN should have been sent.
-	assertEqual(t, len(h.Sent), 1)
-	syn := assertType[packetSyn](t, h.Sent[0].Packet)
-
-	ack := controlMsg[packetAck]{
-		Packet: packetAck{TraceID: syn.TraceID},
-	}
-	h.State = h.State.OnMsg(ack)
-	assertEqual(t, h.Published.Up, true)
-}
-
-func TestStateClientRelayed_OnPingTimer_noAddrs(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigClientRelayed(t)
-
-	assertEqual(t, h.Published.Up, false)
-
-	// On entering the state, a SYN should have been sent.
-	assertEqual(t, len(h.Sent), 1)
-
-	// If we haven't had an ack yet, we won't have addresses to probe. Therefore
-	// we'll have just one more syn packet sent.
-	h.OnPingTimer()
-	assertEqual(t, len(h.Sent), 2)
-}
-
-func TestStateClientRelayed_OnPingTimer_withAddrs(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigClientRelayed(t)
-
-	assertEqual(t, h.Published.Up, false)
-
-	// On entering the state, a SYN should have been sent.
-	assertEqual(t, len(h.Sent), 1)
-
-	syn := assertType[packetSyn](t, h.Sent[0].Packet)
-
-	ack := controlMsg[packetAck]{Packet: packetAck{TraceID: syn.TraceID}}
-	ack.Packet.PossibleAddrs[0] = addrPort4(1, 1, 1, 1, 300)
-	ack.Packet.PossibleAddrs[1] = addrPort4(1, 1, 1, 2, 300)
-
-	h.State = h.State.OnMsg(ack)
-
-	// Add a local discovery address. Note that the port will be configured port
-	// and no the one provided here.
-	h.State = h.State.OnMsg(controlMsg[packetLocalDiscovery]{
-		SrcIP:   3,
-		SrcAddr: addrPort4(2, 2, 2, 3, 300),
-	})
-
-	// We should see one SYN and three probe packets.
-	h.OnPingTimer()
-	assertEqual(t, len(h.Sent), 5)
-	assertType[packetSyn](t, h.Sent[1].Packet)
-	assertType[packetProbe](t, h.Sent[2].Packet)
-	assertType[packetProbe](t, h.Sent[3].Packet)
-	assertType[packetProbe](t, h.Sent[4].Packet)
-
-	assertEqual(t, h.Sent[2].Peer.DirectAddr, addrPort4(1, 1, 1, 1, 300))
-	assertEqual(t, h.Sent[3].Peer.DirectAddr, addrPort4(1, 1, 1, 2, 300))
-	assertEqual(t, h.Sent[4].Peer.DirectAddr, addrPort4(2, 2, 2, 3, 456))
-}
-
-func TestStateClientRelayed_OnPingTimer_timeout(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigClientRelayed(t)
-
-	// On entering the state, a SYN should have been sent.
-	assertEqual(t, len(h.Sent), 1)
-	syn := assertType[packetSyn](t, h.Sent[0].Packet)
-
-	ack := controlMsg[packetAck]{
-		Packet: packetAck{TraceID: syn.TraceID},
-	}
-	h.State = h.State.OnMsg(ack)
-	assertEqual(t, h.Published.Up, true)
-
-	state := assertType[*stateClientRelayed](t, h.State)
-	state.lastSeen = time.Now().Add(-(timeoutInterval + time.Second))
-
-	h.OnPingTimer()
-
-	// On ping timer, we should timeout, causing the client to reset. Another SYN
-	// will be sent when re-entering the state, but the connection should be down.
-	assertEqual(t, len(h.Sent), 2)
-	assertType[packetSyn](t, h.Sent[1].Packet)
-	assertType[*stateClientRelayed](t, h.State)
-	assertEqual(t, h.Published.Up, false)
-}
-
-func TestStateClientRelayed_OnProbe_unknownAddr(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigClientRelayed(t)
-
-	h.OnProbe(controlMsg[packetProbe]{
-		Packet: packetProbe{TraceID: newTraceID()},
-	})
-
-	assertType[*stateClientRelayed](t, h.State)
-}
-
-func TestStateClientRelayed_OnProbe_upgradeDirect(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigClientRelayed(t)
-
-	syn := assertType[packetSyn](t, h.Sent[0].Packet)
-
-	ack := controlMsg[packetAck]{Packet: packetAck{TraceID: syn.TraceID}}
-	ack.Packet.PossibleAddrs[0] = addrPort4(1, 1, 1, 1, 300)
-	ack.Packet.PossibleAddrs[1] = addrPort4(1, 1, 1, 2, 300)
-
-	h.State = h.State.OnMsg(ack)
-	h.OnPingTimer()
-
-	probe := assertType[packetProbe](t, h.Sent[2].Packet)
-	h.OnProbe(controlMsg[packetProbe]{Packet: probe})
-
-	assertType[*stateClientDirect](t, h.State)
-}
-*/
diff --git a/peer/remote.go b/peer/remote.go
index 4cec36c..dd63cd8 100644
--- a/peer/remote.go
+++ b/peer/remote.go
@@ -8,8 +8,6 @@ import (
 	"sync/atomic"
 	"time"
 	"vppn/m"
-
-	"git.crumpington.com/lib/go/ratelimiter"
 )
 
 // ----------------------------------------------------------------------------
@@ -40,7 +38,6 @@ type Remote struct {
 	Globals
 	RemotePeerIP byte // Immutable.
 
-	limiter     *ratelimiter.Limiter
 	dupCheck    *dupCheck
 	sendCounter uint64 // init to startupCount << 48. Atomic access only.
 
@@ -53,13 +50,9 @@ func newRemote(g Globals, remotePeerIP byte) *Remote {
 	r := &Remote{
 		Globals:      g,
 		RemotePeerIP: remotePeerIP,
-		limiter: ratelimiter.New(ratelimiter.Config{
-			FillPeriod:   20 * time.Millisecond,
-			MaxWaitCount: 1,
-		}),
-		dupCheck:    newDupCheck(0),
-		sendCounter: uint64(time.Now().Unix()<<30) + 1,
-		messages:    make(chan any, 8),
+		dupCheck:     newDupCheck(0),
+		sendCounter:  uint64(time.Now().Unix()<<30) + 1,
+		messages:     make(chan any, 8),
 	}
 	r.config.Store(&remoteConfig{})
 	return r
@@ -88,7 +81,7 @@ func (r *Remote) updateConf(conf remoteConfig) {
 
 func (r *Remote) sendUDP(b []byte, addr netip.AddrPort) {
 	if _, err := r.SendUDP(b, addr); err != nil {
-		r.logf("Failed to send URP packet: %v", err)
+		r.logf("Failed to send UDP packet: %v", err)
 	}
 }
 
@@ -124,15 +117,14 @@ func (r *Remote) SendDataTo(data []byte) {
 		return
 	}
 
-	if conf.Direct {
-		r.sendDataDirect(conf, data)
-	} else {
-		r.sendDataRelayed(conf, data)
-	}
-}
+	// Direct:
 
-// sendDataRelayed sends data to the remote via the relay.
-func (r *Remote) sendDataRelayed(conf remoteConfig, data []byte) {
+	if conf.Direct {
+		r.sendUDP(r.encryptData(conf, conf.Peer.PeerIP, data), conf.DirectAddr)
+		return
+	}
+
+	// Relayed:
 	relay := r.RelayHandler.Load()
 
 	if relay == nil {
@@ -143,11 +135,6 @@ func (r *Remote) sendDataRelayed(conf remoteConfig, data []byte) {
 	relay.relayData(conf.Peer.PeerIP, r.encryptData(conf, conf.Peer.PeerIP, data))
 }
 
-// sendDataDirect sends data to the remote directly.
-func (r *Remote) sendDataDirect(conf remoteConfig, data []byte) {
-	r.sendUDP(r.encryptData(conf, conf.Peer.PeerIP, data), conf.DirectAddr)
-}
-
 func (r *Remote) relayData(toIP byte, enc []byte) {
 	conf := r.conf()
 	if !conf.Up || !conf.Direct {
@@ -158,11 +145,6 @@ func (r *Remote) relayData(toIP byte, enc []byte) {
 }
 
 func (r *Remote) sendControl(conf remoteConfig, data []byte) {
-	if err := r.limiter.Limit(); err != nil {
-		r.logf("Rate limiter")
-		return
-	}
-
 	// Direct:
 
 	if conf.Direct {
diff --git a/peer/remotefsm.go b/peer/remotefsm.go
index e1ff529..7a68c84 100644
--- a/peer/remotefsm.go
+++ b/peer/remotefsm.go
@@ -9,6 +9,11 @@ import (
 
 type stateFunc func(msg any) stateFunc
 
+type sentProbe struct {
+	SentAt time.Time
+	Addr   netip.AddrPort
+}
+
 type remoteFSM struct {
 	*Remote
 
@@ -196,7 +201,7 @@ func (r *remoteFSM) stateServer_onSyn(msg controlMsg[packetSyn]) {
 			break
 		}
 		r.logf("Probing %v...", addr)
-		r.sendControlToAddr(packetProbe{TraceID: newTraceID()}.Marshal(r.buf), addr)
+		r.sendControlToAddr(packetProbe{TraceID: r.NewTraceID()}.Marshal(r.buf), addr)
 	}
 }
 
@@ -264,7 +269,7 @@ func (r *remoteFSM) stateClientInit(iMsg any) stateFunc {
 
 func (r *remoteFSM) stateClientInit_sendInit() {
 	conf := r.conf()
-	r.traceID = newTraceID()
+	r.traceID = r.NewTraceID()
 	init := packetInit{
 		TraceID: r.traceID,
 		Direct:  conf.Direct,
@@ -311,7 +316,7 @@ func (r *remoteFSM) enterClient() stateFunc {
 	conf := r.conf()
 	r.probes = make(map[uint64]sentProbe, 8)
 
-	r.traceID = newTraceID()
+	r.traceID = r.NewTraceID()
 	r.stateClient_sendSyn(conf)
 
 	r.pingTimer.Reset(pingInterval)
@@ -377,7 +382,7 @@ func (r *remoteFSM) stateClient_cleanProbes() {
 }
 
 func (r *remoteFSM) stateClient_sendProbeTo(addr netip.AddrPort) {
-	probe := packetProbe{TraceID: newTraceID()}
+	probe := packetProbe{TraceID: r.NewTraceID()}
 	r.probes[probe.TraceID] = sentProbe{
 		SentAt: time.Now(),
 		Addr:   addr,
@@ -403,7 +408,7 @@ func (r *remoteFSM) stateClient_onProbe(msg controlMsg[packetProbe]) {
 	conf.DirectAddr = sent.Addr
 	r.updateConf(conf)
 
-	r.traceID = newTraceID()
+	r.traceID = r.NewTraceID()
 	r.stateClient_sendSyn(conf)
 	r.logf("Successful probe to %v.", sent.Addr)
 }
diff --git a/peer/routingtable.go b/peer/routingtable.go
deleted file mode 100644
index d29d4b0..0000000
--- a/peer/routingtable.go
+++ /dev/null
@@ -1,138 +0,0 @@
-package peer
-
-import (
-	"net/netip"
-	"sync/atomic"
-	"time"
-)
-
-// TODO: Remove
-func newRemotePeer(ip byte) *remotePeer {
-	counter := uint64(time.Now().Unix()<<30 + 1)
-	return &remotePeer{
-		IP:       ip,
-		counter:  &counter,
-		dupCheck: newDupCheck(0),
-	}
-}
-
-// ----------------------------------------------------------------------------
-
-type remotePeer struct {
-	localIP       byte
-	IP            byte           // VPN IP of peer (last byte).
-	Up            bool           // True if data can be sent on the peer.
-	Relay         bool           // True if the peer is a relay.
-	Direct        bool           // True if this is a direct connection.
-	DirectAddr    netip.AddrPort // Remote address if directly connected.
-	PubSignKey    []byte
-	ControlCipher *controlCipher
-	DataCipher    *dataCipher
-
-	counter  *uint64   // For sending to. Atomic access only.
-	dupCheck *dupCheck // For receiving from. Not safe for concurrent use.
-}
-
-func (p remotePeer) EncryptDataPacket(destIP byte, data, out []byte) []byte {
-	h := Header{
-		StreamID: dataStreamID,
-		Counter:  atomic.AddUint64(p.counter, 1),
-		SourceIP: p.localIP,
-		DestIP:   destIP,
-	}
-	return p.DataCipher.Encrypt(h, data, out)
-}
-
-// Decrypts and de-dups incoming data packets.
-func (p remotePeer) DecryptDataPacket(h Header, enc, out []byte) ([]byte, error) {
-	dec, ok := p.DataCipher.Decrypt(enc, out)
-	if !ok {
-		return nil, errDecryptionFailed
-	}
-
-	if p.dupCheck.IsDup(h.Counter) {
-		return nil, errDuplicateSeqNum
-	}
-
-	return dec, nil
-}
-
-// Peer must have a ControlCipher.
-func (p remotePeer) EncryptControlPacket(pkt marshaller, tmp, out []byte) []byte {
-	tmp = pkt.Marshal(tmp)
-	h := Header{
-		StreamID: controlStreamID,
-		Counter:  atomic.AddUint64(p.counter, 1),
-		SourceIP: p.localIP,
-		DestIP:   p.IP,
-	}
-
-	return p.ControlCipher.Encrypt(h, tmp, out)
-}
-
-// Returns a controlMsg[PacketType]. Peer must have a non-nil ControlCipher.
-//
-// This function also drops packets with duplicate sequence numbers.
-func (p remotePeer) DecryptControlPacket(fromAddr netip.AddrPort, h Header, enc, tmp []byte) (any, error) {
-	out, ok := p.ControlCipher.Decrypt(enc, tmp)
-	if !ok {
-		return nil, errDecryptionFailed
-	}
-
-	if p.dupCheck.IsDup(h.Counter) {
-		return nil, errDuplicateSeqNum
-	}
-
-	msg, err := parseControlMsg(h.SourceIP, fromAddr, out)
-	if err != nil {
-		return nil, err
-	}
-
-	return msg, nil
-}
-
-// ----------------------------------------------------------------------------
-
-type routingTable struct {
-	// The LocalIP is the configured IP address of the local peer on the VPN.
-	//
-	// This value is constant.
-	LocalIP byte
-
-	// The LocalAddr is the configured local public address of the peer on the
-	// internet. If LocalAddr.IsValid(), then the local peer has a public
-	// address.
-	//
-	// This value is constant.
-	LocalAddr netip.AddrPort
-
-	// The remote peer configurations. These are updated by
-	Peers [256]remotePeer
-
-	// The current relay's VPN IP address, or zero if no relay is available.
-	RelayIP byte
-}
-
-func newRoutingTable(localIP byte, localAddr netip.AddrPort) routingTable {
-	rt := routingTable{
-		LocalIP:   localIP,
-		LocalAddr: localAddr,
-	}
-
-	for i := range rt.Peers {
-		counter := uint64(time.Now().Unix()<<30 + 1)
-		rt.Peers[i] = remotePeer{
-			localIP:  localIP,
-			IP:       byte(i),
-			counter:  &counter,
-			dupCheck: newDupCheck(0),
-		}
-	}
-
-	return rt
-}
-
-func (rt *routingTable) GetRelay() (remotePeer, bool) {
-	relay := rt.Peers[rt.RelayIP]
-	return relay, relay.Up && relay.Direct
-}
diff --git a/peer/routingtable_test.go b/peer/routingtable_test.go
deleted file mode 100644
index 919449b..0000000
--- a/peer/routingtable_test.go
+++ /dev/null
@@ -1,169 +0,0 @@
-package peer
-
-import (
-	"bytes"
-	"reflect"
-	"testing"
-)
-
-func TestRemotePeer_DecryptDataPacket(t *testing.T) {
-	p1, p2, _ := NewPeersForTesting()
-	orig := RandPacket()
-
-	peer2 := p1.RT.Load().Peers[2]
-	peer1 := p2.RT.Load().Peers[1]
-
-	enc := peer2.EncryptDataPacket(2, orig, newBuf())
-
-	h := parseHeader(enc)
-	if h.DestIP != 2 || h.SourceIP != 1 {
-		t.Fatal(h)
-	}
-
-	dec, err := peer1.DecryptDataPacket(h, enc, newBuf())
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if !bytes.Equal(orig, dec) {
-		t.Fatal(dec)
-	}
-}
-
-func TestRemotePeer_DecryptDataPacket_packetAltered(t *testing.T) {
-	p1, p2, _ := NewPeersForTesting()
-	orig := RandPacket()
-
-	peer2 := p1.RT.Load().Peers[2]
-	peer1 := p2.RT.Load().Peers[1]
-
-	enc := peer2.EncryptDataPacket(2, orig, newBuf())
-
-	h := parseHeader(enc)
-
-	for range 2048 {
-		_, err := peer1.DecryptDataPacket(h, ModifyPacket(enc), newBuf())
-		if err == nil {
-			t.Fatal(enc)
-		}
-	}
-}
-
-func TestRemotePeer_DecryptDataPacket_duplicateSequenceNumber(t *testing.T) {
-	p1, p2, _ := NewPeersForTesting()
-	orig := RandPacket()
-
-	peer2 := p1.RT.Load().Peers[2]
-	peer1 := p2.RT.Load().Peers[1]
-
-	enc := peer2.EncryptDataPacket(2, orig, newBuf())
-	h := parseHeader(enc)
-
-	if _, err := peer1.DecryptDataPacket(h, enc, newBuf()); err != nil {
-		t.Fatal(err)
-	}
-
-	if _, err := peer1.DecryptDataPacket(h, enc, newBuf()); err == nil {
-		t.Fatal(err)
-	}
-}
-
-func TestRemotePeer_DecryptControlPacket(t *testing.T) {
-	p1, p2, _ := NewPeersForTesting()
-
-	peer2 := p1.RT.Load().Peers[2]
-	peer1 := p2.RT.Load().Peers[1]
-
-	orig := packetProbe{TraceID: newTraceID()}
-
-	enc := peer2.EncryptControlPacket(orig, newBuf(), newBuf())
-
-	h := parseHeader(enc)
-	if h.DestIP != 2 || h.SourceIP != 1 {
-		t.Fatal(h)
-	}
-
-	ctrlMsg, err := peer1.DecryptControlPacket(p1.RT.Load().LocalAddr, h, enc, newBuf())
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	dec, ok := ctrlMsg.(controlMsg[packetProbe])
-	if !ok {
-		t.Fatal(ctrlMsg)
-	}
-
-	if dec.SrcIP != 1 || dec.SrcAddr != p1.RT.Load().LocalAddr {
-		t.Fatal(dec)
-	}
-
-	if !reflect.DeepEqual(dec.Packet, orig) {
-		t.Fatal(dec)
-	}
-}
-
-func TestRemotePeer_DecryptControlPacket_packetAltered(t *testing.T) {
-	p1, p2, _ := NewPeersForTesting()
-
-	peer2 := p1.RT.Load().Peers[2]
-	peer1 := p2.RT.Load().Peers[1]
-
-	orig := packetProbe{TraceID: newTraceID()}
-
-	enc := peer2.EncryptControlPacket(orig, newBuf(), newBuf())
-
-	h := parseHeader(enc)
-	if h.DestIP != 2 || h.SourceIP != 1 {
-		t.Fatal(h)
-	}
-
-	for range 2048 {
-		ctrlMsg, err := peer1.DecryptControlPacket(p1.RT.Load().LocalAddr, h, ModifyPacket(enc), newBuf())
-		if err == nil {
-			t.Fatal(ctrlMsg)
-		}
-	}
-}
-
-func TestRemotePeer_DecryptControlPacket_duplicateSequenceNumber(t *testing.T) {
-	p1, p2, _ := NewPeersForTesting()
-
-	peer2 := p1.RT.Load().Peers[2]
-	peer1 := p2.RT.Load().Peers[1]
-
-	orig := packetProbe{TraceID: newTraceID()}
-
-	enc := peer2.EncryptControlPacket(orig, newBuf(), newBuf())
-
-	h := parseHeader(enc)
-	if h.DestIP != 2 || h.SourceIP != 1 {
-		t.Fatal(h)
-	}
-
-	if _, err := peer1.DecryptControlPacket(p1.RT.Load().LocalAddr, h, enc, newBuf()); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := peer1.DecryptControlPacket(p1.RT.Load().LocalAddr, h, enc, newBuf()); err == nil {
-		t.Fatal(err)
-	}
-}
-
-func TestRemotePeer_DecryptControlPacket_unknownPacketType(t *testing.T) {
-	p1, p2, _ := NewPeersForTesting()
-
-	peer2 := p1.RT.Load().Peers[2]
-	peer1 := p2.RT.Load().Peers[1]
-
-	orig := UnknownControlPacket{TraceID: newTraceID()}
-
-	enc := peer2.EncryptControlPacket(orig, newBuf(), newBuf())
-
-	h := parseHeader(enc)
-	if h.DestIP != 2 || h.SourceIP != 1 {
-		t.Fatal(h)
-	}
-
-	if _, err := peer1.DecryptControlPacket(p1.RT.Load().LocalAddr, h, enc, newBuf()); err == nil {
-		t.Fatal(err)
-	}
-}
diff --git a/peer/state-client.go b/peer/state-client.go
deleted file mode 100644
index 7e9d7c9..0000000
--- a/peer/state-client.go
+++ /dev/null
@@ -1,162 +0,0 @@
-package peer
-
-import (
-	"net/netip"
-	"time"
-)
-
-type sentProbe struct {
-	SentAt time.Time
-	Addr   netip.AddrPort
-}
-
-type stateClient struct {
-	*peerData
-	lastSeen time.Time
-	syn      packetSyn
-	probes   map[uint64]sentProbe
-}
-
-func enterStateClient(data *peerData) peerState {
-	ip, ipValid := netip.AddrFromSlice(data.peer.PublicIP)
-
-	data.staged.Relay = data.peer.Relay && ipValid
-	data.staged.Direct = ipValid
-	data.staged.DirectAddr = netip.AddrPortFrom(ip, data.peer.Port)
-	data.publish(data.staged)
-
-	state := &stateClient{
-		peerData: data,
-		lastSeen: time.Now(),
-		syn: packetSyn{
-			TraceID:       newTraceID(),
-			SharedKey:     data.staged.DataCipher.Key(),
-			Direct:        data.staged.Direct,
-			PossibleAddrs: data.pubAddrs.Get(),
-		},
-		probes: map[uint64]sentProbe{},
-	}
-
-	state.Send(state.staged, state.syn)
-
-	data.pingTimer.Reset(pingInterval)
-
-	state.logf("==> Client")
-	return state
-}
-
-func (s *stateClient) logf(str string, args ...any) {
-	s.peerData.logf("CLNT | "+str, args...)
-}
-
-func (s *stateClient) OnMsg(raw any) peerState {
-	switch msg := raw.(type) {
-	case peerUpdateMsg:
-		return initPeerState(s.peerData, msg.Peer)
-	case controlMsg[packetAck]:
-		s.onAck(msg)
-	case controlMsg[packetProbe]:
-		return s.onProbe(msg)
-	case controlMsg[packetLocalDiscovery]:
-		s.onLocalDiscovery(msg)
-	case pingTimerMsg:
-		return s.onPingTimer()
-	default:
-		s.logf("Ignoring message: %v", raw)
-	}
-	return s
-}
-
-func (s *stateClient) onAck(msg controlMsg[packetAck]) {
-	if msg.Packet.TraceID != s.syn.TraceID {
-		return
-	}
-
-	s.lastSeen = time.Now()
-
-	if !s.staged.Up {
-		s.staged.Up = true
-		s.publish(s.staged)
-		s.logf("Got ACK.")
-	}
-
-	if s.staged.Direct {
-		s.pubAddrs.Store(msg.Packet.ToAddr)
-		return
-	}
-
-	// Relayed below.
-
-	s.cleanProbes()
-
-	for _, addr := range msg.Packet.PossibleAddrs {
-		if !addr.IsValid() {
-			break
-		}
-		s.sendProbeTo(addr)
-	}
-}
-
-func (s *stateClient) onPingTimer() peerState {
-	if time.Since(s.lastSeen) > timeoutInterval {
-		if s.staged.Up {
-			s.logf("Timeout.")
-		}
-		return initPeerState(s.peerData, s.peer)
-	}
-
-	s.Send(s.staged, s.syn)
-	return s
-}
-
-func (s *stateClient) onProbe(msg controlMsg[packetProbe]) peerState {
-	if s.staged.Direct {
-		return s
-	}
-
-	s.cleanProbes()
-
-	sent, ok := s.probes[msg.Packet.TraceID]
-	if !ok {
-		return s
-	}
-
-	s.staged.Direct = true
-	s.staged.DirectAddr = sent.Addr
-	s.publish(s.staged)
-
-	s.syn.TraceID = newTraceID()
-	s.syn.Direct = true
-	s.Send(s.staged, s.syn)
-	s.logf("Successful probe to %v.", sent.Addr)
-	return s
-}
-
-func (s *stateClient) onLocalDiscovery(msg controlMsg[packetLocalDiscovery]) {
-	if s.staged.Direct {
-		return
-	}
-
-	// The source port will be the multicast port, so we'll have to
-	// construct the correct address using the peer's listed port.
-	addr := netip.AddrPortFrom(msg.SrcAddr.Addr(), s.peer.Port)
-	s.sendProbeTo(addr)
-}
-
-func (s *stateClient) cleanProbes() {
-	for key, sent := range s.probes {
-		if time.Since(sent.SentAt) > pingInterval {
-			delete(s.probes, key)
-		}
-	}
-}
-
-func (s *stateClient) sendProbeTo(addr netip.AddrPort) {
-	probe := packetProbe{TraceID: newTraceID()}
-	s.probes[probe.TraceID] = sentProbe{
-		SentAt: time.Now(),
-		Addr:   addr,
-	}
-	s.logf("Probing %v...", addr)
-	s.SendTo(probe, addr)
-}
diff --git a/peer/state-client_test.go b/peer/state-client_test.go
deleted file mode 100644
index 25441e8..0000000
--- a/peer/state-client_test.go
+++ /dev/null
@@ -1,193 +0,0 @@
-package peer
-
-import (
-	"testing"
-	"time"
-)
-
-func TestStateClient_peerUpdate(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigClientDirect(t)
-	h.PeerUpdate(nil)
-	assertType[*stateDisconnected](t, h.State)
-}
-
-func TestStateClient_initialPackets(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigClientDirect(t)
-
-	assertEqual(t, len(h.Sent), 2)
-	assertType[packetInit](t, h.Sent[0].Packet)
-	assertType[packetSyn](t, h.Sent[1].Packet)
-}
-
-func TestStateClient_onAck_incorrectTraceID(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigClientDirect(t)
-	h.Sent = h.Sent[:0]
-
-	ack := controlMsg[packetAck]{
-		Packet: packetAck{TraceID: newTraceID()},
-	}
-	h.OnAck(ack)
-
-	// Nothing should have happened.
-	assertType[*stateClient](t, h.State)
-	assertEqual(t, len(h.Sent), 0)
-}
-
-func TestStateClient_onAck_direct_downToUp(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigClientDirect(t)
-
-	assertEqual(t, len(h.Sent), 2)
-	syn := assertType[packetSyn](t, h.Sent[1].Packet)
-	h.Sent = h.Sent[:0]
-
-	assertEqual(t, h.Published.Up, false)
-
-	ack := controlMsg[packetAck]{
-		Packet: packetAck{TraceID: syn.TraceID},
-	}
-
-	h.OnAck(ack)
-
-	assertEqual(t, len(h.Sent), 0)
-}
-
-func TestStateClient_onAck_relayed_sendsProbes(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigClientRelayed(t)
-
-	assertEqual(t, len(h.Sent), 2)
-	syn := assertType[packetSyn](t, h.Sent[1].Packet)
-	h.Sent = h.Sent[:0]
-
-	assertEqual(t, h.Published.Up, false)
-
-	ack := controlMsg[packetAck]{
-		Packet: packetAck{TraceID: syn.TraceID},
-	}
-	ack.Packet.PossibleAddrs[0] = addrPort4(1, 2, 3, 4, 100)
-	ack.Packet.PossibleAddrs[1] = addrPort4(2, 3, 4, 5, 200)
-
-	h.OnAck(ack)
-
-	assertEqual(t, len(h.Sent), 2)
-	assertType[packetProbe](t, h.Sent[0].Packet)
-	assertEqual(t, h.Sent[0].Peer.DirectAddr, ack.Packet.PossibleAddrs[0])
-	assertType[packetProbe](t, h.Sent[1].Packet)
-	assertEqual(t, h.Sent[1].Peer.DirectAddr, ack.Packet.PossibleAddrs[1])
-}
-
-func TestStateClient_onPing(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigClientRelayed(t)
-	h.Sent = h.Sent[:0]
-	h.OnPingTimer()
-	assertEqual(t, len(h.Sent), 1)
-	assertType[*stateClient](t, h.State)
-	assertType[packetSyn](t, h.Sent[0].Packet)
-}
-
-func TestStateClient_onPing_timeout(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigClientRelayed(t)
-	h.Sent = h.Sent[:0]
-	state := assertType[*stateClient](t, h.State)
-	state.lastSeen = time.Now().Add(-2 * timeoutInterval)
-	state.staged.Up = true
-	h.OnPingTimer()
-
-	newState := assertType[*stateClientInit](t, h.State)
-	assertEqual(t, newState.staged.Up, false)
-	assertEqual(t, len(h.Sent), 1)
-	assertType[packetInit](t, h.Sent[0].Packet)
-}
-
-func TestStateClient_onProbe_direct(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigClientDirect(t)
-
-	h.Sent = h.Sent[:0]
-	probe := controlMsg[packetProbe]{
-		Packet: packetProbe{
-			TraceID: newTraceID(),
-		},
-	}
-
-	h.OnProbe(probe)
-	assertType[*stateClient](t, h.State)
-	assertEqual(t, len(h.Sent), 0)
-}
-
-func TestStateClient_onProbe_noMatch(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigClientRelayed(t)
-
-	h.Sent = h.Sent[:0]
-	probe := controlMsg[packetProbe]{
-		Packet: packetProbe{
-			TraceID: newTraceID(),
-		},
-	}
-
-	h.OnProbe(probe)
-	assertType[*stateClient](t, h.State)
-	assertEqual(t, len(h.Sent), 0)
-}
-
-func TestStateClient_onProbe_directUpgrade(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigClientRelayed(t)
-
-	state := assertType[*stateClient](t, h.State)
-	traceID := newTraceID()
-	state.probes[traceID] = sentProbe{
-		SentAt: time.Now(),
-		Addr:   addrPort4(1, 2, 3, 4, 500),
-	}
-
-	probe := controlMsg[packetProbe]{
-		Packet: packetProbe{TraceID: traceID},
-	}
-
-	assertEqual(t, h.Published.Direct, false)
-	h.Sent = h.Sent[:0]
-	h.OnProbe(probe)
-	assertEqual(t, h.Published.Direct, true)
-
-	assertEqual(t, len(h.Sent), 1)
-	assertType[packetSyn](t, h.Sent[0].Packet)
-}
-
-func TestStateClient_onLocalDiscovery_direct(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigClientDirect(t)
-
-	h.Sent = h.Sent[:0]
-	pkt := controlMsg[packetLocalDiscovery]{
-		Packet: packetLocalDiscovery{},
-	}
-
-	h.OnLocalDiscovery(pkt)
-	assertType[*stateClient](t, h.State)
-	assertEqual(t, len(h.Sent), 0)
-}
-
-func TestStateClient_onLocalDiscovery_relayed(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigClientRelayed(t)
-
-	h.Sent = h.Sent[:0]
-	pkt := controlMsg[packetLocalDiscovery]{
-		SrcAddr: addrPort4(1, 2, 3, 4, 500),
-		Packet:  packetLocalDiscovery{},
-	}
-
-	h.OnLocalDiscovery(pkt)
-	assertType[*stateClient](t, h.State)
-	assertEqual(t, len(h.Sent), 1)
-	assertType[packetProbe](t, h.Sent[0].Packet)
-	assertEqual(t, h.Sent[0].Peer.DirectAddr, addrPort4(1, 2, 3, 4, 456))
-}
diff --git a/peer/state-clientinit.go b/peer/state-clientinit.go
deleted file mode 100644
index 8ced222..0000000
--- a/peer/state-clientinit.go
+++ /dev/null
@@ -1,104 +0,0 @@
-package peer
-
-import (
-	"net/netip"
-	"time"
-)
-
-type stateClientInit struct {
-	*peerData
-	startedAt time.Time
-	traceID   uint64
-}
-
-func enterStateClientInit(data *peerData) peerState {
-	ip, ipValid := netip.AddrFromSlice(data.peer.PublicIP)
-
-	data.staged.Up = false
-	data.staged.Relay = false
-	data.staged.Direct = ipValid
-	data.staged.DirectAddr = netip.AddrPortFrom(ip, data.peer.Port)
-	data.staged.PubSignKey = data.peer.PubSignKey
-	data.staged.ControlCipher = newControlCipher(data.privKey, data.peer.PubKey)
-	data.staged.DataCipher = newDataCipher()
-
-	data.publish(data.staged)
-
-	state := &stateClientInit{
-		peerData:  data,
-		startedAt: time.Now(),
-		traceID:   newTraceID(),
-	}
-	state.sendInit()
-
-	data.pingTimer.Reset(pingInterval)
-
-	state.logf("==> ClientInit")
-	return state
-}
-
-func (s *stateClientInit) logf(str string, args ...any) {
-	s.peerData.logf("INIT | "+str, args...)
-}
-
-func (s *stateClientInit) OnMsg(raw any) peerState {
-	switch msg := raw.(type) {
-	case peerUpdateMsg:
-		return initPeerState(s.peerData, msg.Peer)
-	case controlMsg[packetInit]:
-		return s.onInit(msg)
-	case controlMsg[packetSyn]:
-		s.logf("Unexpected SYN")
-		return s
-	case controlMsg[packetAck]:
-		s.logf("Unexpected ACK")
-		return s
-	case controlMsg[packetProbe]:
-		return s
-	case controlMsg[packetLocalDiscovery]:
-		return s
-	case pingTimerMsg:
-		return s.onPing()
-	default:
-		s.logf("Ignoring message: %#v", raw)
-		return s
-	}
-}
-
-func (s *stateClientInit) onInit(msg controlMsg[packetInit]) peerState {
-	if msg.Packet.TraceID != s.traceID {
-		s.logf("Invalid trace ID on INIT.")
-		return s
-	}
-	s.logf("Got INIT version %d.", msg.Packet.Version)
-	return enterStateClient(s.peerData)
-}
-
-func (s *stateClientInit) onPing() peerState {
-	if time.Since(s.startedAt) < timeoutInterval {
-		s.sendInit()
-		return s
-	}
-
-	if s.staged.Direct {
-		s.staged.Direct = false
-		s.publish(s.staged)
-		s.startedAt = time.Now()
-		s.sendInit()
-		s.logf("Direct connection failed. Attempting indirect connection.")
-		return s
-	}
-
-	s.logf("Timeout.")
-	return initPeerState(s.peerData, s.peer)
-}
-
-func (s *stateClientInit) sendInit() {
-	s.traceID = newTraceID()
-	init := packetInit{
-		TraceID: s.traceID,
-		Direct:  s.staged.Direct,
-		Version: version,
-	}
-	s.Send(s.staged, init)
-}
diff --git a/peer/state-clientinit_test.go b/peer/state-clientinit_test.go
deleted file mode 100644
index fc910a5..0000000
--- a/peer/state-clientinit_test.go
+++ /dev/null
@@ -1,92 +0,0 @@
-package peer
-
-import (
-	"testing"
-	"time"
-)
-
-func TestPeerState_ClientInit_initWithIncorrectTraceID(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigClientInit(t)
-
-	// Should have sent the first init packet.
-	assertEqual(t, len(h.Sent), 1)
-	init := assertType[packetInit](t, h.Sent[0].Packet)
-
-	init.TraceID = newTraceID()
-	h.OnInit(controlMsg[packetInit]{Packet: init})
-
-	assertType[*stateClientInit](t, h.State)
-}
-
-func TestPeerState_ClientInit_init(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigClientInit(t)
-
-	// Should have sent the first init packet.
-	assertEqual(t, len(h.Sent), 1)
-	init := assertType[packetInit](t, h.Sent[0].Packet)
-	h.OnInit(controlMsg[packetInit]{Packet: init})
-
-	assertType[*stateClient](t, h.State)
-}
-
-func TestPeerState_ClientInit_onPing(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigClientInit(t)
-
-	// Should have sent the first init packet.
-	assertEqual(t, len(h.Sent), 1)
-	h.Sent = h.Sent[:0]
-
-	for range 3 {
-		h.OnPingTimer()
-	}
-
-	assertEqual(t, len(h.Sent), 3)
-
-	for i := range h.Sent {
-		assertType[packetInit](t, h.Sent[i].Packet)
-	}
-}
-
-func TestPeerState_ClientInit_onPingTimeout(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigClientInit(t)
-
-	state := assertType[*stateClientInit](t, h.State)
-	state.startedAt = time.Now().Add(-2 * timeoutInterval)
-	assertEqual(t, state.staged.Direct, true)
-
-	h.OnPingTimer()
-
-	// Should now try indirect connection.
-	state = assertType[*stateClientInit](t, h.State)
-	assertEqual(t, state.staged.Direct, false)
-
-	// Should re-initialize the peer after another timeout, so should be direct
-	// again.
-	state.startedAt = time.Now().Add(-2 * timeoutInterval)
-	h.OnPingTimer()
-
-	assertEqual(t, state.staged.Direct, true)
-}
-
-func TestPeerState_ClientInit_onPeerUpdate(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigClientInit(t)
-
-	h.PeerUpdate(nil)
-
-	// Should have moved into the client state due to timeout.
-	assertType[*stateDisconnected](t, h.State)
-}
-
-func TestPeerState_ClientInit_ignoreMessage(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigClientInit(t)
-	h.OnProbe(controlMsg[packetProbe]{})
-
-	// Shouldn't do anything.
-	assertType[*stateClientInit](t, h.State)
-}
diff --git a/peer/state-disconnected.go b/peer/state-disconnected.go
deleted file mode 100644
index ea503dc..0000000
--- a/peer/state-disconnected.go
+++ /dev/null
@@ -1,50 +0,0 @@
-package peer
-
-import "net/netip"
-
-type stateDisconnected struct {
-	*peerData
-}
-
-func enterStateDisconnected(data *peerData) peerState {
-	data.staged.Up = false
-	data.staged.Relay = false
-	data.staged.Direct = false
-	data.staged.DirectAddr = netip.AddrPort{}
-	data.staged.PubSignKey = nil
-	data.staged.ControlCipher = nil
-	data.staged.DataCipher = nil
-
-	data.publish(data.staged)
-
-	data.pingTimer.Stop()
-
-	return &stateDisconnected{data}
-}
-
-func (s *stateDisconnected) OnMsg(raw any) peerState {
-	switch msg := raw.(type) {
-	case peerUpdateMsg:
-		return initPeerState(s.peerData, msg.Peer)
-	case controlMsg[packetInit]:
-		s.logf("Unexpected INIT")
-		return s
-	case controlMsg[packetSyn]:
-		s.logf("Unexpected SYN")
-		return s
-	case controlMsg[packetAck]:
-		s.logf("Unexpected ACK")
-		return s
-	case controlMsg[packetProbe]:
-		s.logf("Unexpected probe")
-		return s
-	case controlMsg[packetLocalDiscovery]:
-		return s
-	case pingTimerMsg:
-		s.logf("Unexpected ping")
-		return s
-	default:
-		s.logf("Ignoring message: %#v", raw)
-		return s
-	}
-}
diff --git a/peer/state-server.go b/peer/state-server.go
deleted file mode 100644
index c9c76db..0000000
--- a/peer/state-server.go
+++ /dev/null
@@ -1,136 +0,0 @@
-package peer
-
-import (
-	"net/netip"
-	"time"
-)
-
-type stateServer struct {
-	*peerData
-	lastSeen   time.Time
-	synTraceID uint64 // Last syn trace ID.
-}
-
-func enterStateServer(data *peerData) peerState {
-	data.staged.Up = false
-	data.staged.Relay = false
-	data.staged.Direct = false
-	data.staged.DirectAddr = netip.AddrPort{}
-	data.staged.PubSignKey = data.peer.PubSignKey
-	data.staged.ControlCipher = newControlCipher(data.privKey, data.peer.PubKey)
-	data.staged.DataCipher = nil
-
-	data.publish(data.staged)
-
-	data.pingTimer.Reset(pingInterval)
-
-	state := &stateServer{
-		peerData: data,
-		lastSeen: time.Now(),
-	}
-	state.logf("==> Server")
-	return state
-}
-
-func (s *stateServer) logf(str string, args ...any) {
-	s.peerData.logf("SRVR | "+str, args...)
-}
-
-func (s *stateServer) OnMsg(raw any) peerState {
-	switch msg := raw.(type) {
-	case peerUpdateMsg:
-		return initPeerState(s.peerData, msg.Peer)
-	case controlMsg[packetInit]:
-		return s.onInit(msg)
-	case controlMsg[packetSyn]:
-		return s.onSyn(msg)
-	case controlMsg[packetAck]:
-		s.logf("Unexpected ACK")
-		return s
-	case controlMsg[packetProbe]:
-		return s.onProbe(msg)
-	case controlMsg[packetLocalDiscovery]:
-		return s
-	case pingTimerMsg:
-		return s.onPingTimer()
-	default:
-		s.logf("Unexpected message: %#v", raw)
-		return s
-	}
-}
-
-func (s *stateServer) onInit(msg controlMsg[packetInit]) peerState {
-	s.staged.Up = false
-	s.staged.Direct = msg.Packet.Direct
-	s.staged.DirectAddr = msg.SrcAddr
-	s.publish(s.staged)
-
-	init := packetInit{
-		TraceID: msg.Packet.TraceID,
-		Direct:  s.staged.Direct,
-		Version: version,
-	}
-
-	s.Send(s.staged, init)
-
-	return s
-}
-
-func (s *stateServer) onSyn(msg controlMsg[packetSyn]) peerState {
-	s.lastSeen = time.Now()
-	p := msg.Packet
-
-	// Before we can respond to this packet, we need to make sure the
-	// route is setup properly.
-	//
-	// The client will update the syn's TraceID whenever there's a change.
-	// The server will follow the client's request.
-	if p.TraceID != s.synTraceID || !s.staged.Up {
-		s.synTraceID = p.TraceID
-		s.staged.Up = true
-		s.staged.Direct = p.Direct
-		s.staged.DataCipher = newDataCipherFromKey(p.SharedKey)
-		s.staged.DirectAddr = msg.SrcAddr
-		s.publish(s.staged)
-		s.logf("Got SYN.")
-	}
-
-	// Always respond.
-	s.Send(s.staged, packetAck{
-		TraceID:       p.TraceID,
-		ToAddr:        s.staged.DirectAddr,
-		PossibleAddrs: s.pubAddrs.Get(),
-	})
-
-	if p.Direct {
-		return s
-	}
-
-	// Send probes if not a direct connection.
-	for _, addr := range msg.Packet.PossibleAddrs {
-		if !addr.IsValid() {
-			break
-		}
-		s.logf("Probing %v...", addr)
-		s.SendTo(packetProbe{TraceID: newTraceID()}, addr)
-	}
-
-	return s
-}
-
-func (s *stateServer) onProbe(msg controlMsg[packetProbe]) peerState {
-	if msg.SrcAddr.IsValid() {
-		s.logf("Probe response %v...", msg.SrcAddr)
-		s.SendTo(packetProbe{TraceID: msg.Packet.TraceID}, msg.SrcAddr)
-	}
-	return s
-}
-
-func (s *stateServer) onPingTimer() peerState {
-	if time.Since(s.lastSeen) > timeoutInterval && s.staged.Up {
-		s.staged.Up = false
-		s.publish(s.staged)
-		s.logf("Timeout.")
-	}
-	return s
-}
diff --git a/peer/state-server_test.go b/peer/state-server_test.go
deleted file mode 100644
index b367786..0000000
--- a/peer/state-server_test.go
+++ /dev/null
@@ -1,164 +0,0 @@
-package peer
-
-import (
-	"testing"
-	"time"
-)
-
-func TestStateServer_peerUpdate(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigServer_Public(t)
-	h.PeerUpdate(nil)
-	assertType[*stateDisconnected](t, h.State)
-}
-
-func TestStateServer_onInit(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigServer_Public(t)
-
-	msg := controlMsg[packetInit]{
-		SrcIP:   3,
-		SrcAddr: addrPort4(1, 2, 3, 4, 1000),
-		Packet: packetInit{
-			TraceID: newTraceID(),
-			Direct:  true,
-			Version: 4,
-		},
-	}
-
-	h.OnInit(msg)
-	assertEqual(t, len(h.Sent), 1)
-	assertEqual(t, h.Sent[0].Peer.DirectAddr, msg.SrcAddr)
-	resp := assertType[packetInit](t, h.Sent[0].Packet)
-	assertEqual(t, msg.Packet.TraceID, resp.TraceID)
-	assertEqual(t, resp.Version, version)
-}
-
-func TestStateServer_onSynDirect(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigServer_Public(t)
-
-	msg := controlMsg[packetSyn]{
-		SrcIP:   3,
-		SrcAddr: addrPort4(1, 2, 3, 4, 1000),
-		Packet: packetSyn{
-			TraceID: newTraceID(),
-			Direct:  true,
-		},
-	}
-
-	msg.Packet.PossibleAddrs[0] = addrPort4(1, 1, 1, 1, 1000)
-	msg.Packet.PossibleAddrs[1] = addrPort4(1, 1, 1, 2, 2000)
-
-	h.OnSyn(msg)
-	assertEqual(t, len(h.Sent), 1)
-	assertEqual(t, h.Sent[0].Peer.DirectAddr, msg.SrcAddr)
-	resp := assertType[packetAck](t, h.Sent[0].Packet)
-	assertEqual(t, msg.Packet.TraceID, resp.TraceID)
-}
-
-func TestStateServer_onSynRelayed(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigServer_Relayed(t)
-
-	msg := controlMsg[packetSyn]{
-		SrcIP:   3,
-		SrcAddr: addrPort4(1, 2, 3, 4, 1000),
-		Packet: packetSyn{
-			TraceID: newTraceID(),
-		},
-	}
-
-	msg.Packet.PossibleAddrs[0] = addrPort4(1, 1, 1, 1, 1000)
-	msg.Packet.PossibleAddrs[1] = addrPort4(1, 1, 1, 2, 2000)
-
-	h.OnSyn(msg)
-	assertEqual(t, len(h.Sent), 3)
-	assertEqual(t, h.Sent[0].Peer.DirectAddr, msg.SrcAddr)
-	resp := assertType[packetAck](t, h.Sent[0].Packet)
-	assertEqual(t, msg.Packet.TraceID, resp.TraceID)
-
-	for i, pkt := range h.Sent[1:] {
-		assertEqual(t, pkt.Peer.DirectAddr, msg.Packet.PossibleAddrs[i])
-		assertType[packetProbe](t, pkt.Packet)
-	}
-}
-
-func TestStateServer_onProbe(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigServer_Relayed(t)
-
-	msg := controlMsg[packetProbe]{
-		SrcIP: 3,
-		Packet: packetProbe{
-			TraceID: newTraceID(),
-		},
-	}
-	h.Sent = h.Sent[:0]
-
-	h.OnProbe(msg)
-	assertEqual(t, len(h.Sent), 0)
-}
-
-func TestStateServer_onProbe_valid(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigServer_Relayed(t)
-
-	msg := controlMsg[packetProbe]{
-		SrcIP:   3,
-		SrcAddr: addrPort4(1, 2, 3, 4, 100),
-		Packet: packetProbe{
-			TraceID: newTraceID(),
-		},
-	}
-	h.Sent = h.Sent[:0]
-
-	h.OnProbe(msg)
-	assertEqual(t, len(h.Sent), 1)
-	assertType[packetProbe](t, h.Sent[0].Packet)
-	assertEqual(t, h.Sent[0].Peer.DirectAddr, msg.SrcAddr)
-}
-
-func TestStateServer_onPing(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigServer_Relayed(t)
-	h.Sent = h.Sent[:0]
-	h.OnPingTimer()
-	assertEqual(t, len(h.Sent), 0)
-	assertType[*stateServer](t, h.State)
-}
-
-func TestStateServer_onPing_timeout(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigServer_Relayed(t)
-
-	h.Sent = h.Sent[:0]
-	state := assertType[*stateServer](t, h.State)
-	state.staged.Up = true
-	state.lastSeen = time.Now().Add(-2 * timeoutInterval)
-
-	h.OnPingTimer()
-	state = assertType[*stateServer](t, h.State)
-	assertEqual(t, len(h.Sent), 0)
-	assertEqual(t, state.staged.Up, false)
-}
-
-func TestStateServer_onLocalDiscovery(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigServer_Relayed(t)
-
-	msg := controlMsg[packetLocalDiscovery]{
-		SrcIP:   3,
-		SrcAddr: addrPort4(1, 2, 3, 4, 100),
-	}
-	h.OnLocalDiscovery(msg)
-	assertType[*stateServer](t, h.State)
-}
-
-func TestStateServer_onAck(t *testing.T) {
-	h := NewPeerStateTestHarness()
-	h.ConfigServer_Relayed(t)
-	msg := controlMsg[packetAck]{}
-	h.OnAck(msg)
-	assertType[*stateServer](t, h.State)
-}
diff --git a/peer/state-util_test.go b/peer/state-util_test.go
deleted file mode 100644
index 465a8c3..0000000
--- a/peer/state-util_test.go
+++ /dev/null
@@ -1,151 +0,0 @@
-package peer
-
-import (
-	"net/netip"
-	"testing"
-	"time"
-	"vppn/m"
-
-	"git.crumpington.com/lib/go/ratelimiter"
-)
-
-type PeerStateControlMsg struct {
-	Peer   remotePeer
-	Packet any
-}
-
-type PeerStateTestHarness struct {
-	data      *peerData
-	State     peerState
-	Published remotePeer
-	Sent      []PeerStateControlMsg
-}
-
-func NewPeerStateTestHarness() *PeerStateTestHarness {
-	h := &PeerStateTestHarness{}
-
-	keys := generateKeys()
-
-	state := &peerData{
-		publish: func(rp remotePeer) {
-			h.Published = rp
-		},
-		sendControlPacket: func(rp remotePeer, pkt marshaller) {
-			h.Sent = append(h.Sent, PeerStateControlMsg{rp, pkt})
-		},
-		pingTimer: time.NewTicker(pingInterval),
-		localIP:   2,
-		remoteIP:  3,
-		privKey:   keys.PrivKey,
-		pubAddrs:  newPubAddrStore(netip.AddrPort{}),
-		limiter: ratelimiter.New(ratelimiter.Config{
-			FillPeriod:   20 * time.Millisecond,
-			MaxWaitCount: 1,
-		}),
-	}
-	h.data = state
-
-	h.State = enterStateDisconnected(state)
-	return h
-}
-
-func (h *PeerStateTestHarness) PeerUpdate(p *m.Peer) {
-	h.State = h.State.OnMsg(peerUpdateMsg{p})
-}
-
-func (h *PeerStateTestHarness) OnInit(msg controlMsg[packetInit]) {
-	h.State = h.State.OnMsg(msg)
-}
-
-func (h *PeerStateTestHarness) OnSyn(msg controlMsg[packetSyn]) {
-	h.State = h.State.OnMsg(msg)
-}
-
-func (h *PeerStateTestHarness) OnAck(msg controlMsg[packetAck]) {
-	h.State = h.State.OnMsg(msg)
-}
-
-func (h *PeerStateTestHarness) OnProbe(msg controlMsg[packetProbe]) {
-	h.State = h.State.OnMsg(msg)
-}
-
-func (h *PeerStateTestHarness) OnLocalDiscovery(msg controlMsg[packetLocalDiscovery]) {
-	h.State = h.State.OnMsg(msg)
-}
-
-func (h *PeerStateTestHarness) OnPingTimer() {
-	h.State = h.State.OnMsg(pingTimerMsg{})
-}
-
-func (h *PeerStateTestHarness) ConfigServer_Public(t *testing.T) *stateServer {
-	keys := generateKeys()
-
-	state := h.State.(*stateDisconnected)
-	state.localAddr = addrPort4(1, 1, 1, 2, 200)
-
-	peer := &m.Peer{
-		PeerIP:     3,
-		PublicIP:   []byte{1, 1, 1, 3},
-		Port:       456,
-		PubKey:     keys.PubKey,
-		PubSignKey: keys.PubSignKey,
-	}
-
-	h.PeerUpdate(peer)
-	assertEqual(t, h.Published.Up, false)
-	return assertType[*stateServer](t, h.State)
-}
-
-func (h *PeerStateTestHarness) ConfigServer_Relayed(t *testing.T) *stateServer {
-	keys := generateKeys()
-	peer := &m.Peer{
-		PeerIP:     3,
-		Port:       456,
-		PubKey:     keys.PubKey,
-		PubSignKey: keys.PubSignKey,
-	}
-
-	h.PeerUpdate(peer)
-	assertEqual(t, h.Published.Up, false)
-	return assertType[*stateServer](t, h.State)
-}
-
-func (h *PeerStateTestHarness) ConfigClientInit(t *testing.T) *stateClientInit {
-	// Remote IP should be less than local IP.
-	h.data.localIP = 4
-	keys := generateKeys()
-	peer := &m.Peer{
-		PeerIP:     3,
-		PublicIP:   []byte{1, 2, 3, 4},
-		Port:       456,
-		PubKey:     keys.PubKey,
-		PubSignKey: keys.PubSignKey,
-	}
-
-	h.PeerUpdate(peer)
-	assertEqual(t, h.Published.Up, false)
-	return assertType[*stateClientInit](t, h.State)
-}
-
-func (h *PeerStateTestHarness) ConfigClientDirect(t *testing.T) *stateClient {
-	h.ConfigClientInit(t)
-	init := assertType[packetInit](t, h.Sent[0].Packet)
-	h.OnInit(controlMsg[packetInit]{
-		Packet: init,
-	})
-
-	return assertType[*stateClient](t, h.State)
-}
-
-func (h *PeerStateTestHarness) ConfigClientRelayed(t *testing.T) *stateClient {
-	h.ConfigClientInit(t)
-	state := assertType[*stateClientInit](t, h.State)
-	state.peer.PublicIP = nil // Force relay.
-
-	init := assertType[packetInit](t, h.Sent[0].Packet)
-	h.OnInit(controlMsg[packetInit]{
-		Packet: init,
-	})
-
-	return assertType[*stateClient](t, h.State)
-}
diff --git a/peer/statedata.go b/peer/statedata.go
deleted file mode 100644
index 5aee302..0000000
--- a/peer/statedata.go
+++ /dev/null
@@ -1,109 +0,0 @@
-package peer
-
-import (
-	"fmt"
-	"log"
-	"net/netip"
-	"strings"
-	"time"
-	"vppn/m"
-
-	"git.crumpington.com/lib/go/ratelimiter"
-)
-
-type peerState interface {
-	OnMsg(raw any) peerState
-}
-
-// ----------------------------------------------------------------------------
-
-type peerData struct {
-	// Output.
-	publish           func(remotePeer)
-	sendControlPacket func(remotePeer, marshaller)
-	pingTimer         *time.Ticker
-
-	// Immutable data.
-	localIP   byte
-	remoteIP  byte
-	privKey   []byte
-	localAddr netip.AddrPort // If valid, then local peer is publicly accessible.
-
-	pubAddrs *pubAddrStore
-
-	// The purpose of this state machine is to manage the RemotePeer object,
-	// publishing it as necessary.
-	staged remotePeer // Local copy of shared data. See publish().
-
-	// Mutable peer data.
-	peer *m.Peer
-
-	// We rate limit per remote endpoint because if we don't we tend to lose
-	// packets.
-	limiter *ratelimiter.Limiter
-}
-
-func (s *peerData) logf(format string, args ...any) {
-	b := strings.Builder{}
-	name := ""
-	if s.peer != nil {
-		name = s.peer.Name
-	}
-	b.WriteString(fmt.Sprintf("%03d", s.remoteIP))
-
-	b.WriteString(fmt.Sprintf("%30s: ", name))
-
-	if s.staged.Direct {
-		b.WriteString("DIRECT  | ")
-	} else {
-		b.WriteString("RELAYED | ")
-	}
-
-	if s.staged.Up {
-		b.WriteString("UP   | ")
-	} else {
-		b.WriteString("DOWN | ")
-	}
-
-	log.Printf(b.String()+format, args...)
-}
-
-// ----------------------------------------------------------------------------
-
-func (s *peerData) SendTo(pkt marshaller, addr netip.AddrPort) {
-	if !addr.IsValid() {
-		return
-	}
-	route := s.staged
-	route.Direct = true
-	route.DirectAddr = addr
-	s.Send(route, pkt)
-}
-
-func (s *peerData) Send(peer remotePeer, pkt marshaller) {
-	if err := s.limiter.Limit(); err != nil {
-		s.logf("Rate limited.")
-		return
-	}
-	s.sendControlPacket(peer, pkt)
-}
-
-func initPeerState(data *peerData, peer *m.Peer) peerState {
-	data.peer = peer
-
-	if peer == nil {
-		return enterStateDisconnected(data)
-	}
-
-	if _, isValid := netip.AddrFromSlice(peer.PublicIP); isValid {
-		if data.localAddr.IsValid() && data.localIP < data.remoteIP {
-			return enterStateServer(data)
-		}
-		return enterStateClientInit(data)
-	}
-
-	if data.localAddr.IsValid() || data.localIP < data.remoteIP {
-		return enterStateServer(data)
-	}
-	return enterStateClientInit(data)
-}