From 147934e55c0f2ca4e68f18f2719db46572c8c0be Mon Sep 17 00:00:00 2001
From: riccardom <riccardomanfrin@gmail.com>
Date: Tue, 20 Oct 2026 12:41:34 +0200
Subject: [PATCH] [client] Extract the peer phases of a sync pass into
 applyPeerPhases

---
 client/internal/engine.go | 48 +++++++++++++++++++++++----------------
 1 file changed, 28 insertions(+), 20 deletions(-)

diff --git a/client/internal/engine.go b/client/internal/engine.go
index d7a8de4d9..1ecb80d51 100644
--- a/client/internal/engine.go
+++ b/client/internal/engine.go
@@ -1730,30 +1730,11 @@ func (e *Engine) updateNetworkMap(networkMap *mgmProto.NetworkMap, maxBatch int,
 	// peer was deleted), remotePeers is already empty, so the bounded diff below removes
 	// every peer in batches — same path as a normal update, no unbounded removeAllPeers
 	// held under syncMsgMux in one shot.
-	doneRemoved := e.phase("removed_peers")
-	removeMore, err := e.removePeers(remotePeers, maxBatch)
-	doneRemoved()
+	needMore, err := e.applyPeerPhases(remotePeers, maxBatch)
 	if err != nil {
 		return false, err
 	}
 
-	doneModified := e.phase("modified_peers")
-	modifyMore, err := e.modifyPeers(remotePeers, maxBatch)
-	doneModified()
-	if err != nil {
-		return false, err
-	}
-
-	doneAdded := e.phase("added_peers")
-	addMore, err := e.addNewPeers(remotePeers, maxBatch)
-	doneAdded()
-	if err != nil {
-		return false, err
-	}
-
-	// needMore signals the caller to re-run when a peer phase hit its per-pass cap.
-	needMore := removeMore || modifyMore || addMore
-
 	e.statusRecorder.FinishPeerListModifications()
 
 	// The SSH and lazy-exclude steps walk the whole map and need every target peer
@@ -1781,6 +1762,33 @@ func (e *Engine) updateNetworkMap(networkMap *mgmProto.NetworkMap, maxBatch int,
 	return needMore, nil
 }
 
+// applyPeerPhases removes, modifies and adds up to maxBatch peers each, and
+// reports whether any phase hit the cap.
+func (e *Engine) applyPeerPhases(remotePeers []*mgmProto.RemotePeerConfig, maxBatch int) (bool, error) {
+	doneRemoved := e.phase("removed_peers")
+	removeMore, err := e.removePeers(remotePeers, maxBatch)
+	doneRemoved()
+	if err != nil {
+		return false, err
+	}
+
+	doneModified := e.phase("modified_peers")
+	modifyMore, err := e.modifyPeers(remotePeers, maxBatch)
+	doneModified()
+	if err != nil {
+		return false, err
+	}
+
+	doneAdded := e.phase("added_peers")
+	addMore, err := e.addNewPeers(remotePeers, maxBatch)
+	doneAdded()
+	if err != nil {
+		return false, err
+	}
+
+	return removeMore || modifyMore || addMore, nil
+}
+
 // applyWholesale applies the cheap, local, idempotent map sections (lazy feature
 // flag, firewall/legacy management, DNS, routes, ACL filtering, DNS forwarder) that
 // must be in place before peers come up. It runs once per target, on the first pass.