From a2e43ba49fc6e288e4208d9d923ae996e27e24ec Mon Sep 17 00:00:00 2001
From: jdl <jdl@desktop>
Date: Mon, 8 Jun 2026 17:29:45 +0200
Subject: [PATCH] WIP

---
 peer/device.go       |  4 ++++
 peer/on_hub_test.go  |  4 ++--
 peer/on_multicast.go |  2 +-
 peer/on_ping.go      |  2 +-
 peer/on_tick.go      |  2 +-
 peer/remote.go       | 29 +++++++++++------------------
 6 files changed, 20 insertions(+), 23 deletions(-)

diff --git a/peer/device.go b/peer/device.go
index e175278..7aec48e 100644
--- a/peer/device.go
+++ b/peer/device.go
@@ -39,10 +39,12 @@ func (a *App) devPeers() []wgtypes.Peer {
 
 func (a *App) devAddPeer(p *Peer) {
 	devRetry(p.VPNIP, "AddPeer", func() error { return a.dev.AddPeer(p.PubKey()) })
+	p.State = StateRelayed
 }
 
 func (a *App) devAddDirect(p *Peer, endpoint netip.AddrPort) {
 	devRetry(p.VPNIP, "AddDirect", func() error { return a.dev.AddDirect(p.PubKey(), endpoint, p.VPNIP) })
+	p.State = StateDirect
 }
 
 func (a *App) devSetRelay(p *Peer, endpoint netip.AddrPort) {
@@ -51,10 +53,12 @@ func (a *App) devSetRelay(p *Peer, endpoint netip.AddrPort) {
 
 func (a *App) devPromote(p *Peer) {
 	devRetry(p.VPNIP, "Promote", func() error { return a.dev.Promote(p.PubKey(), p.VPNIP) })
+	p.State = StateDirect
 }
 
 func (a *App) devAddProbe(p *Peer, endpoint netip.AddrPort) {
 	devRetry(p.VPNIP, "AddProbe", func() error { return a.dev.AddProbe(p.PubKey(), endpoint) })
+	p.State = StateProbing
 }
 
 func (a *App) devRemove(p *Peer) {
diff --git a/peer/on_hub_test.go b/peer/on_hub_test.go
index b02d3db..98c7c17 100644
--- a/peer/on_hub_test.go
+++ b/peer/on_hub_test.go
@@ -41,8 +41,8 @@ func TestOnAddPeer(t *testing.T) {
 				if a.peersByIP[peerVPNIP] == nil {
 					t.Fatal("not in peersByIP")
 				}
-				if p.State() != StateRelayed {
-					t.Fatalf("state = %v, want StateRelayed", p.State())
+				if p.State != StateRelayed {
+					t.Fatalf("state = %v, want StateRelayed", p.State)
 				}
 				dev.AssertAddPeer(t, 0, key)
 			},
diff --git a/peer/on_multicast.go b/peer/on_multicast.go
index 000a375..1476443 100644
--- a/peer/on_multicast.go
+++ b/peer/on_multicast.go
@@ -28,7 +28,7 @@ func (a *App) onMulticastDiscovery(e MulticastEvent) {
 		return
 	}
 
-	if peer.IsPublic || peer.State() == StateDirect {
+	if peer.IsPublic || peer.State == StateDirect {
 		return
 	}
 
diff --git a/peer/on_ping.go b/peer/on_ping.go
index 48e35e2..2be8d0a 100644
--- a/peer/on_ping.go
+++ b/peer/on_ping.go
@@ -34,7 +34,7 @@ func (a *App) onPing(e PingEvent) {
 
 	// We can only learn our own endpoint from directly-connected peers — Dst
 	// is the sender's observation of our WG handshake source.
-	if peer.State() == StateDirect {
+	if peer.State == StateDirect {
 		if dst := e.ping.Dst; dst.IsValid() {
 			if dst.Addr().Is4() {
 				a.selfV4 = dst
diff --git a/peer/on_tick.go b/peer/on_tick.go
index 3786df3..45de25e 100644
--- a/peer/on_tick.go
+++ b/peer/on_tick.go
@@ -27,7 +27,7 @@ func (a *App) onTick() {
 			a.sendPing(p, now)
 		}
 
-		switch p.State() {
+		switch p.State {
 		case StateProbing:
 			// Promote probing peers to direct once alive (direct path confirmed
 			// working).
diff --git a/peer/remote.go b/peer/remote.go
index d7fd56d..b2b28a4 100644
--- a/peer/remote.go
+++ b/peer/remote.go
@@ -19,15 +19,17 @@ const (
 )
 
 type Peer struct {
-	wgPeer     wgtypes.Peer
-	VPNIP      netip.Addr     // VPN IP address.
-	IsRelay    bool           // Peer is a relay.
-	IsPublic   bool           // Peer has a public IP.
-	Endpoint4  netip.AddrPort // Reported IPv4 endpoint.
-	Endpoint6  netip.AddrPort // Reported IPv6 endpoint.
-	RTT        time.Duration  // Round-trip time.
-	Role       control.Role   // Client initiates pings; server responds.
-	SignPubKey [32]byte       // nacl/sign public key for verifying multicast beacons.
+	wgPeer        wgtypes.Peer
+	VPNIP         netip.Addr     // VPN IP address.
+	IsRelay       bool           // Peer is a relay.
+	IsPublic      bool           // Peer has a public IP.
+	Endpoint4     netip.AddrPort // Reported IPv4 endpoint.
+	Endpoint6     netip.AddrPort // Reported IPv6 endpoint.
+	RTT           time.Duration  // Round-trip time.
+	Role          control.Role   // Client initiates pings; server responds.
+	SignPubKey    [32]byte       // nacl/sign public key for verifying multicast beacons.
+	State         PeerState      // Explicit state; set by devXxx helpers.
+	probeDeadline time.Time      // Deadline for direct-path probe; zero if not probing.
 }
 
 // PubKey is the wireguard public key.
@@ -35,15 +37,6 @@ func (p *Peer) PubKey() wgtypes.Key {
 	return p.wgPeer.PublicKey
 }
 
-func (p *Peer) State() PeerState {
-	if len(p.wgPeer.AllowedIPs) > 0 {
-		return StateDirect
-	}
-	if p.wgPeer.Endpoint == nil {
-		return StateRelayed
-	}
-	return StateProbing
-}
 
 func (p *Peer) WGEndpoint() netip.AddrPort {
 	ep := p.wgPeer.Endpoint