13 files changed, 211 insertions, 242 deletions
diff --git a/cmake/config/ipcp/common.cmake b/cmake/config/ipcp/common.cmake
index 7dbc252b..79c822a3 100644
--- a/cmake/config/ipcp/common.cmake
+++ b/cmake/config/ipcp/common.cmake
@@ -49,10 +49,4 @@ if(HAVE_FUSE)
   if(IPCP_FLOW_STATS)
     message(STATUS "IPCP flow statistics enabled")
   endif()
-
-  set(IPCP_ETH_FLOW_STATS FALSE CACHE BOOL
-      "Enable ipcpd-eth flow statistics via RIB")
-  if(IPCP_ETH_FLOW_STATS)
-    message(STATUS "ipcpd-eth flow statistics enabled")
-  endif()
 endif()
diff --git a/cmake/config/ipcp/eth.cmake b/cmake/config/ipcp/eth.cmake
deleted file mode 100644
index 6a044d4b..00000000
--- a/cmake/config/ipcp/eth.cmake
+++ /dev/null
@@ -1,22 +0,0 @@
-# Ethernet IPCP configuration options for Ouroboros
-# Options for eth-llc and eth-dix IPCPs
-
-set(IPCP_ETH_LLC_TARGET ipcpd-eth-llc)
-set(IPCP_ETH_DIX_TARGET ipcpd-eth-dix)
-
-set(IPCP_ETH_RD_THR 1 CACHE STRING
-  "Number of reader threads in Ethernet IPCP")
-set(IPCP_ETH_WR_THR 1 CACHE STRING
-  "Number of writer threads in Ethernet IPCP")
-set(IPCP_ETH_QDISC_BYPASS false CACHE BOOL
-  "Bypass the Qdisc in the kernel when using raw sockets")
-set(IPCP_ETH_SNDBUF 4096 CACHE STRING
-  "Raw socket SO_SNDBUF in bytes (floored to one frame); 0 = kernel default")
-set(IPCP_ETH_RCVBUF 0 CACHE STRING
-  "Raw socket SO_RCVBUF in bytes; 0 = leave kernel default (rmem_default)")
-set(IPCP_ETH_LO_MTU 9000 CACHE STRING
-  "Restrict Ethernet MTU over loopback interfaces")
-set(IPCP_ETH_MGMT_FRAME_SIZE 9000 CACHE STRING
-  "Management frame buffer size for Ethernet IPCPs")
-set(IPCP_ETH_MPL 100 CACHE STRING
-  "Default maximum packet lifetime for the Ethernet IPCPs, in ms")
diff --git a/cmake/config/ipcp/udp.cmake b/cmake/config/ipcp/udp.cmake
deleted file mode 100644
index af84a844..00000000
--- a/cmake/config/ipcp/udp.cmake
+++ /dev/null
@@ -1,16 +0,0 @@
-# UDP IPCP configuration options for Ouroboros
-# Options for udp4 and udp6 IPCPs
-
-set(IPCP_UDP4_TARGET ipcpd-udp4)
-set(IPCP_UDP6_TARGET ipcpd-udp6)
-
-set(IPCP_UDP_RD_THR 3 CACHE STRING
-  "Number of reader threads in UDP IPCPs")
-set(IPCP_UDP_WR_THR 3 CACHE STRING
-  "Number of writer threads in UDP IPCPs")
-set(IPCP_UDP_MPL 5000 CACHE STRING
-  "Default maximum packet lifetime for the UDP IPCPs, in ms")
-set(IPCP_UDP4_MTU 1472 CACHE STRING
-  "Fallback UDP4 layer MTU when getsockopt(IP_MTU) is unavailable, in bytes")
-set(IPCP_UDP6_MTU 1452 CACHE STRING
-  "Fallback UDP6 layer MTU when getsockopt(IPV6_MTU) is unavailable, in bytes")
diff --git a/cmake/config/irmd.cmake b/cmake/config/irmd.cmake
index 79e24bae..bbb73bec 100644
--- a/cmake/config/irmd.cmake
+++ b/cmake/config/irmd.cmake
@@ -11,7 +11,7 @@ set(ENROLL_TIMEOUT 20000 CACHE STRING
 set(REG_TIMEOUT 20000 CACHE STRING
   "Timeout for registering a name (ms)")
 set(QUERY_TIMEOUT 2000 CACHE STRING
-  "Timeout to query a name with an IPCP (ms); must exceed shim retry budget")
+  "Timeout to query a name with an IPCP (ms); must exceed PoA retries")
 set(CONNECT_TIMEOUT 20000 CACHE STRING
   "Timeout to connect an IPCP to another IPCP (ms)")
 set(FLOW_ALLOC_TIMEOUT 20000 CACHE STRING
diff --git a/cmake/config/lib.cmake b/cmake/config/lib.cmake
deleted file mode 100644
index 81a7d6ba..00000000
--- a/cmake/config/lib.cmake
+++ /dev/null
@@ -1,139 +0,0 @@
-# Library configuration options for Ouroboros
-# Options affecting libouroboros-common, libouroboros-dev, libouroboros-irm
-
-# Flow limits
-set(SYS_MAX_FLOWS 10240 CACHE STRING
-  "Maximum number of total flows for this system")
-set(PROC_MAX_FLOWS 4096 CACHE STRING
-  "Maximum number of flows in an application")
-set(PROC_RES_FDS 64 CACHE STRING
-  "Number of reserved flow descriptors per application")
-set(PROC_MAX_FQUEUES 32 CACHE STRING
-  "Maximum number of flow sets per application")
-
-# Threading
-if(NOT APPLE)
-  set(PTHREAD_COND_CLOCK "CLOCK_MONOTONIC" CACHE STRING
-    "Clock to use for condition variable timing")
-else()
-  set(PTHREAD_COND_CLOCK "CLOCK_REALTIME" CACHE INTERNAL
-    "Clock to use for condition variable timing")
-endif()
-
-# Timeouts
-set(SOCKET_TIMEOUT 500 CACHE STRING
-  "Default timeout for responses from IPCPs (ms)")
-
-# QoS settings
-set(QOS_DISABLE_CRC TRUE CACHE BOOL
-  "Ignores ber setting on all QoS cubes")
-
-include(utils/CPUUtils)
-detect_pclmul()
-detect_pmull()
-if(HAVE_PCLMUL)
-  message(STATUS "CRC-64/NVMe backend: PCLMUL (x86 SSE4.1+PCLMUL)")
-elseif(HAVE_PMULL)
-  message(STATUS "CRC-64/NVMe backend: PMULL (aarch64 crypto)")
-else()
-  message(STATUS "CRC-64/NVMe backend: byte table (no acceleration)")
-endif()
-
-# Delta-t protocol timers (Watson bound: 3*MPL + A + R).
-# MPL is reported per IPCP (IPCP_*_MPL); A and R are FRCT-wide.
-set(DELTA_T_ACK 1000 CACHE STRING
-  "Maximum time to acknowledge a packet (ms)")
-set(DELTA_T_RTX 30000 CACHE STRING
-  "Maximum time to retransmit a packet (ms)")
-
-# FRCT configuration
-set(FRCT_REORDER_QUEUE_SIZE 128 CACHE STRING
-  "Size of the reordering queue, must be a power of 2")
-set(FRCT_START_WINDOW 128 CACHE STRING
-  "Start window, must be a power of 2")
-set(FRCT_LINUX_RTT_ESTIMATOR TRUE CACHE BOOL
-  "Use Linux RTT estimator formula instead of the TCP RFC formula")
-set(FRCT_RTO_MDEV_MULTIPLIER 2 CACHE STRING
-  "Multiplier for deviation term in the RTO: RTO = sRTT + (mdev << X)")
-set(FRCT_RTO_INC_FACTOR 0 CACHE STRING
-  "Divisor for RTO increase after timeout: RTO += RTX >> X, 0: Karn/Partridge")
-set(FRCT_RTO_MIN 250 CACHE STRING
-  "Hard floor for Retransmission Timeout (RTO) for FRCT (us)")
-set(FRCT_TICK_TIME 5000 CACHE STRING
-  "Tick time for FRCT activity (retransmission, acknowledgments) (us)")
-set(FRCT_DEBUG_STDOUT FALSE CACHE BOOL
-  "Print FRCT final counters to stdout at flow teardown")
-
-# Retransmission (RXM) configuration
-set(RXM_MIN_RESOLUTION 20 CACHE STRING
-  "Minimum retransmission delay (ns), as a power to 2")
-set(RXM_WHEEL_MULTIPLIER 4 CACHE STRING
-  "Factor for retransmission wheel levels as a power to 2")
-set(RXM_WHEEL_LEVELS 3 CACHE STRING
-  "Number of levels in the retransmission wheel")
-set(RXM_WHEEL_SLOTS_PER_LEVEL 256 CACHE STRING
-  "Number of slots per level in the retransmission wheel, must be a power of 2")
-
-# Acknowledgment wheel configuration
-set(ACK_WHEEL_SLOTS 256 CACHE STRING
-  "Number of slots in the acknowledgment wheel, must be a power of 2")
-set(ACK_WHEEL_RESOLUTION 18 CACHE STRING
-  "Minimum acknowledgment delay (ns), as a power to 2")
-
-# Thread pool manager (TPM) debugging
-set(TPM_DEBUG_REPORT_INTERVAL 0 CACHE STRING
-  "Interval at wich the TPM will report long running threads (s), 0 disables")
-set(TPM_DEBUG_ABORT_TIMEOUT 0 CACHE STRING
-  "TPM abort process after a thread reaches this timeout (s), 0 disables")
-
-# Encryption
-set(KEY_LEAF_BITS 20 CACHE STRING
-  "Packets per leaf key as a power of two (2^20 = AEAD-safe default)")
-set(KEY_NODE_BITS 6 CACHE STRING
-  "Leaf keys per node key, power of two (2^6 = 64; leak compartment)")
-set(KEY_NODE_COUNT 128 CACHE STRING
-  "Node keys per batch (N); <= 4096, the 12-bit on-wire node index")
-set(KEY_REKEY_WATERMARK 4 CACHE STRING
-  "Re-key when this many node keys remain; 0 disables the count trigger")
-set(KEY_REPLAY_WINDOW 2048 CACHE STRING
-  "RX replay window in packets; power of two, >= 128")
-set(KEY_REKEY_WM_CHECK_BITS 16 CACHE STRING
-  "Re-key watermark is consulted once per 2^n flow writes")
-if(NOT KEY_REPLAY_WINDOW MATCHES "^[0-9]+$")
-  message(FATAL_ERROR "KEY_REPLAY_WINDOW must be a positive integer")
-endif()
-math(EXPR _krw_p2 "${KEY_REPLAY_WINDOW} & (${KEY_REPLAY_WINDOW} - 1)")
-if(KEY_REPLAY_WINDOW LESS 128 OR NOT _krw_p2 EQUAL 0)
-  message(FATAL_ERROR "KEY_REPLAY_WINDOW must be a power of two >= 128")
-endif()
-
-# Re-key must finish within its lead window - KEY_REKEY_WATERMARK node keys
-# worth of packets - before the batch exhausts and TX fails closed. dev.c only
-# evaluates the watermark once per FLOW_WM_CHECK writes, so a lead below ~2x
-# that leaves a high-rate flow no room to complete the exchange. Production
-# defaults are vast; this guards under-sized (test) geometries.
-if(KEY_REKEY_WATERMARK GREATER 0)
-  math(EXPR _rk_wm_check "1 << ${KEY_REKEY_WM_CHECK_BITS}")
-  math(EXPR _rk_lead
-    "${KEY_REKEY_WATERMARK} << (${KEY_LEAF_BITS} + ${KEY_NODE_BITS})")
-  math(EXPR _rk_min "2 * ${_rk_wm_check}")
-  if(_rk_lead LESS _rk_min)
-    message(WARNING
-      "Re-key lead is ${_rk_lead} packets vs the watermark check interval "
-      "${_rk_wm_check}; a high-rate flow may exhaust its key batch before the "
-      "re-key completes (TX fails closed until it does). Raise KEY_LEAF_BITS, "
-      "KEY_NODE_BITS, or KEY_REKEY_WATERMARK.")
-  endif()
-endif()
-
-# Flow statistics (requires FUSE)
-if(HAVE_FUSE)
-  set(PROC_FLOW_STATS TRUE CACHE BOOL
-    "Enable flow statistics tracking for application flows")
-  if(PROC_FLOW_STATS)
-    message(STATUS "Application flow statistics enabled")
-  else()
-    message(STATUS "Application flow statistics disabled")
-  endif()
-endif()
-
diff --git a/cmake/config/lib/common.cmake b/cmake/config/lib/common.cmake
new file mode 100644
index 00000000..ebdc3196
--- /dev/null
+++ b/cmake/config/lib/common.cmake
@@ -0,0 +1,58 @@
+# Library configuration options for Ouroboros Options affecting libouroboros-common,
+# libouroboros-dev and libouroboros-irm as a whole; per-subsystem options sit beside this file
+
+# Flow limits
+set(SYS_MAX_FLOWS 10240 CACHE STRING
+  "Maximum number of total flows for this system")
+set(PROC_MAX_FLOWS 4096 CACHE STRING
+  "Maximum number of flows in an application")
+set(PROC_RES_FDS 64 CACHE STRING
+  "Number of reserved flow descriptors per application")
+set(PROC_MAX_FQUEUES 32 CACHE STRING
+  "Maximum number of flow sets per application")
+
+# Threading
+if(NOT APPLE)
+  set(PTHREAD_COND_CLOCK "CLOCK_MONOTONIC" CACHE STRING
+    "Clock to use for condition variable timing")
+else()
+  set(PTHREAD_COND_CLOCK "CLOCK_REALTIME" CACHE INTERNAL
+    "Clock to use for condition variable timing")
+endif()
+
+# Timeouts
+set(SOCKET_TIMEOUT 500 CACHE STRING
+  "Default timeout for responses from IPCPs (ms)")
+
+# QoS settings
+set(QOS_DISABLE_CRC TRUE CACHE BOOL
+  "Ignores ber setting on all QoS cubes")
+
+include(utils/CPUUtils)
+detect_pclmul()
+detect_pmull()
+if(HAVE_PCLMUL)
+  message(STATUS "CRC-64/NVMe backend: PCLMUL (x86 SSE4.1+PCLMUL)")
+elseif(HAVE_PMULL)
+  message(STATUS "CRC-64/NVMe backend: PMULL (aarch64 crypto)")
+else()
+  message(STATUS "CRC-64/NVMe backend: byte table (no acceleration)")
+endif()
+
+# Thread pool manager (TPM) debugging
+set(TPM_DEBUG_REPORT_INTERVAL 0 CACHE STRING
+  "Interval at wich the TPM will report long running threads (s), 0 disables")
+set(TPM_DEBUG_ABORT_TIMEOUT 0 CACHE STRING
+  "TPM abort process after a thread reaches this timeout (s), 0 disables")
+
+# Flow statistics (requires FUSE)
+if(HAVE_FUSE)
+  set(PROC_FLOW_STATS TRUE CACHE BOOL
+    "Enable flow statistics tracking for application flows")
+  if(PROC_FLOW_STATS)
+    message(STATUS "Application flow statistics enabled")
+  else()
+    message(STATUS "Application flow statistics disabled")
+  endif()
+endif()
+
diff --git a/cmake/config/lib/crypt.cmake b/cmake/config/lib/crypt.cmake
new file mode 100644
index 00000000..45fdaaed
--- /dev/null
+++ b/cmake/config/lib/crypt.cmake
@@ -0,0 +1,41 @@
+# Encryption configuration for Ouroboros Options for the key schedule and packet protection in
+# src/lib/crypt/
+
+# Encryption
+set(KEY_LEAF_BITS 20 CACHE STRING
+  "Packets per leaf key as a power of two (2^20 = AEAD-safe default)")
+set(KEY_NODE_BITS 6 CACHE STRING
+  "Leaf keys per node key, power of two (2^6 = 64; leak compartment)")
+set(KEY_NODE_COUNT 128 CACHE STRING
+  "Node keys per batch (N); <= 4096, the 12-bit on-wire node index")
+set(KEY_REKEY_WATERMARK 4 CACHE STRING
+  "Re-key when this many node keys remain; 0 disables the count trigger")
+set(KEY_REPLAY_WINDOW 2048 CACHE STRING
+  "RX replay window in packets; power of two, >= 128")
+set(KEY_REKEY_WM_CHECK_BITS 16 CACHE STRING
+  "Re-key watermark is consulted once per 2^n flow writes")
+if(NOT KEY_REPLAY_WINDOW MATCHES "^[0-9]+$")
+  message(FATAL_ERROR "KEY_REPLAY_WINDOW must be a positive integer")
+endif()
+math(EXPR _krw_p2 "${KEY_REPLAY_WINDOW} & (${KEY_REPLAY_WINDOW} - 1)")
+if(KEY_REPLAY_WINDOW LESS 128 OR NOT _krw_p2 EQUAL 0)
+  message(FATAL_ERROR "KEY_REPLAY_WINDOW must be a power of two >= 128")
+endif()
+
+# Re-key must finish within its lead window - KEY_REKEY_WATERMARK node keys worth of packets -
+# before the batch exhausts and TX fails closed. dev.c only evaluates the watermark once per
+# FLOW_WM_CHECK writes, so a lead below ~2x that leaves a high-rate flow no room to complete the
+# exchange. Production defaults are vast; this guards under-sized (test) geometries.
+if(KEY_REKEY_WATERMARK GREATER 0)
+  math(EXPR _rk_wm_check "1 << ${KEY_REKEY_WM_CHECK_BITS}")
+  math(EXPR _rk_lead
+    "${KEY_REKEY_WATERMARK} << (${KEY_LEAF_BITS} + ${KEY_NODE_BITS})")
+  math(EXPR _rk_min "2 * ${_rk_wm_check}")
+  if(_rk_lead LESS _rk_min)
+    message(WARNING
+      "Re-key lead is ${_rk_lead} packets vs the watermark check interval "
+      "${_rk_wm_check}; a high-rate flow may exhaust its key batch before the "
+      "re-key completes (TX fails closed until it does). Raise KEY_LEAF_BITS, "
+      "KEY_NODE_BITS, or KEY_REKEY_WATERMARK.")
+  endif()
+endif()
diff --git a/cmake/config/lib/frct.cmake b/cmake/config/lib/frct.cmake
new file mode 100644
index 00000000..1bd60aa0
--- /dev/null
+++ b/cmake/config/lib/frct.cmake
@@ -0,0 +1,43 @@
+# FRCT configuration for Ouroboros Options for the flow and retransmission control protocol in
+# src/lib/frct.c
+
+# Delta-t protocol timers (Watson bound: 3*MPL + A + R).
+# MPL is reported per IPCP (IPCP_*_MPL); A and R are FRCT-wide.
+set(DELTA_T_ACK 1000 CACHE STRING
+  "Maximum time to acknowledge a packet (ms)")
+set(DELTA_T_RTX 32000 CACHE STRING
+  "Maximum time to retransmit a packet (ms)")
+
+# FRCT configuration
+set(FRCT_REORDER_QUEUE_SIZE 128 CACHE STRING
+  "Size of the reordering queue, must be a power of 2")
+set(FRCT_START_WINDOW 128 CACHE STRING
+  "Start window, must be a power of 2")
+set(FRCT_LINUX_RTT_ESTIMATOR TRUE CACHE BOOL
+  "Use Linux RTT estimator formula instead of the TCP RFC formula")
+set(FRCT_RTO_MDEV_MULTIPLIER 2 CACHE STRING
+  "Multiplier for deviation term in the RTO: RTO = sRTT + (mdev << X)")
+set(FRCT_RTO_INC_FACTOR 0 CACHE STRING
+  "Divisor for RTO increase after timeout: RTO += RTX >> X, 0: Karn/Partridge")
+set(FRCT_RTO_MIN 250 CACHE STRING
+  "Hard floor for Retransmission Timeout (RTO) for FRCT (us)")
+set(FRCT_TICK_TIME 5000 CACHE STRING
+  "Tick time for FRCT activity (retransmission, acknowledgments) (us)")
+set(FRCT_DEBUG_STDOUT FALSE CACHE BOOL
+  "Print FRCT final counters to stdout at flow teardown")
+
+# Retransmission (RXM) configuration
+set(RXM_MIN_RESOLUTION 20 CACHE STRING
+  "Minimum retransmission delay (ns), as a power to 2")
+set(RXM_WHEEL_MULTIPLIER 4 CACHE STRING
+  "Factor for retransmission wheel levels as a power to 2")
+set(RXM_WHEEL_LEVELS 3 CACHE STRING
+  "Number of levels in the retransmission wheel")
+set(RXM_WHEEL_SLOTS_PER_LEVEL 256 CACHE STRING
+  "Number of slots per level in the retransmission wheel, must be a power of 2")
+
+# Acknowledgment wheel configuration
+set(ACK_WHEEL_SLOTS 256 CACHE STRING
+  "Number of slots in the acknowledgment wheel, must be a power of 2")
+set(ACK_WHEEL_RESOLUTION 18 CACHE STRING
+  "Minimum acknowledgment delay (ns), as a power to 2")
diff --git a/cmake/config/lib/poa.cmake b/cmake/config/lib/poa.cmake
new file mode 100644
index 00000000..c1ca10a8
--- /dev/null
+++ b/cmake/config/lib/poa.cmake
@@ -0,0 +1,37 @@
+# Flow Point of attachment (poa) configuration for Ouroboros
+
+set(POA_MGMT_FRAME_SIZE 16384 CACHE STRING
+  "Maximum size of a flow endpoint management frame, in bytes")
+
+# Management frames are retried or repeated, so a send never waits long.
+set(POA_MGMT_SND_TIMEO 100 CACHE STRING
+  "Deadline for sending a management frame, in ms")
+
+# Flows on one PoA share its transmit queue, so congestion avoidance keys its link estimator on the
+# PoA and needs a bound on their number.
+set(POA_MAX_POAS 16 CACHE STRING
+  "Maximum number of points of attachment per IPCP")
+
+# UDP endpoints
+set(POA_UDP_MPL 5000 CACHE STRING
+  "Default maximum packet lifetime for UDP flow endpoints, in ms")
+set(POA_UDP4_MTU 1472 CACHE STRING
+  "Fallback UDP4 endpoint MTU when getsockopt(IP_MTU) is unavailable")
+set(POA_UDP6_MTU 1452 CACHE STRING
+  "Fallback UDP6 endpoint MTU when getsockopt(IPV6_MTU) is unavailable")
+set(POA_UDP_RD_BUF 65535 CACHE STRING
+  "UDP endpoint receive buffer in bytes. Bounds the advertised MTU")
+
+# Ethernet endpoints
+set(POA_ETH_MPL 100 CACHE STRING
+  "Default maximum packet lifetime for Ethernet flow endpoints, in ms")
+set(POA_ETH_QDISC_BYPASS false CACHE BOOL
+  "Bypass the Qdisc in the kernel when using raw sockets")
+set(POA_ETH_SNDBUF 0 CACHE STRING
+  "Raw socket SO_SNDBUF in bytes (floored to one frame). 0 = kernel default")
+set(POA_ETH_RCVBUF 0 CACHE STRING
+  "Raw socket SO_RCVBUF in bytes. 0 = kernel default")
+set(POA_ETH_LO_MTU 9000 CACHE STRING
+  "Restrict Ethernet flow endpoint MTU over loopback interfaces")
+set(POA_ETH_RD_BUF 16384 CACHE STRING
+  "Cap on the Ethernet endpoint receive buffer and MTU, in bytes")
diff --git a/cmake/config/ssm.cmake b/cmake/config/lib/ssm.cmake
index 589171ea..a9ac35c9 100644
--- a/cmake/config/ssm.cmake
+++ b/cmake/config/lib/ssm.cmake
@@ -1,6 +1,5 @@
-# Secure Shared Memory (SSM) pool configuration for Ouroboros
-# This file defines the allocation parameters for the secure shared memory
-# pool allocator
+# Secure Shared Memory (SSM) pool configuration for Ouroboros This file defines the allocation
+# parameters for the secure shared memory pool allocator
 
 # Shared memory pool naming configuration
 set(SSM_PREFIX "ouroboros" CACHE STRING
@@ -21,6 +20,8 @@ set(SSM_PK_BUFF_TAILSPACE 32 CACHE STRING
     "Bytes of tailspace to reserve for future tails")
 set(SSM_RBUFF_SIZE 1024 CACHE STRING
     "Number of slots in a flow's rbuff ring; must be a power of 2")
+set(SSM_RBUFF_TXQ_DELAY 10 CACHE STRING
+    "Queueing delay a flow's tx ring may hold (ms); 0 is unlimited")
 set(SSM_RBUFF_PREFIX "/${SHM_PREFIX}.rbuff." CACHE INTERNAL
     "Prefix for rbuff POSIX shared memory filenames")
 set(SSM_FLOW_SET_PREFIX "/${SHM_PREFIX}.set." CACHE INTERNAL
@@ -32,8 +33,8 @@ set(SSM_POOL_SHARDS 4 CACHE STRING
 set(SSM_POOL_RECLAIM_AGE_S 60 CACHE STRING
     "Minimum age in seconds before a block is presumed stale and reclaimed")
 
-# Global Shared Packet Pool (GSPP) - for privileged processes
-# Shared by all processes in 'ouroboros' group (~60 MB total)
+# Global Shared Packet Pool (GSPP) - for privileged processes Shared by all processes in 'ouroboros'
+# group (~60 MB total)
 set(SSM_GSPP_256_BLOCKS 1024 CACHE STRING
     "GSPP: Number of 256B blocks")
 set(SSM_GSPP_512_BLOCKS 2048 CACHE STRING
@@ -53,8 +54,8 @@ set(SSM_GSPP_256K_BLOCKS 32 CACHE STRING
 set(SSM_GSPP_1M_BLOCKS 16 CACHE STRING
     "GSPP: Number of 1MB blocks")
 
-# Per-User Pool (PUP) - for unprivileged applications
-# Each unprivileged app gets its own smaller pool (~7.5 MB total)
+# Per-User Pool (PUP) - for unprivileged applications Each unprivileged app gets its own smaller
+# pool (~7.5 MB total)
 set(SSM_PUP_256_BLOCKS 512 CACHE STRING
     "PUP: Number of 256B blocks")
 set(SSM_PUP_512_BLOCKS 512 CACHE STRING
@@ -147,10 +148,9 @@ message(STATUS "    Blocks: ${SSM_PUP_256_BLOCKS}, ${SSM_PUP_512_BLOCKS}, "
     "${SSM_PUP_16K_BLOCKS}, ${SSM_PUP_64K_BLOCKS}, ${SSM_PUP_256K_BLOCKS}, "
     "${SSM_PUP_1M_BLOCKS}")
 
-# FRCT reorder queue must fit in every enabled size class. If RQ_SIZE
-# >= any backing pool, the receiver advertises a window the pool
-# cannot back; np1_flow_write fails under load and a single dropped
-# fragment wedges the flow. Auto-zeroed classes are skipped.
+# FRCT reorder queue must fit in every enabled size class. If RQ_SIZE >= any backing pool, the
+# receiver advertises a window the pool cannot back; np1_flow_write fails under load and a single
+# dropped fragment wedges the flow. Auto-zeroed classes are skipped.
 foreach(_class 256 512 1K 2K)
     if(SSM_PUP_${_class}_BLOCKS GREATER 0
        AND NOT FRCT_REORDER_QUEUE_SIZE LESS SSM_PUP_${_class}_BLOCKS)
diff --git a/cmake/dependencies.cmake b/cmake/dependencies.cmake
index ff44ad68..93c9c0de 100644
--- a/cmake/dependencies.cmake
+++ b/cmake/dependencies.cmake
@@ -17,19 +17,19 @@ include(dependencies/crypt/libgcrypt)
 # IRMd
 include(dependencies/irmd/libtoml)
 
-# Ethernet IPCP backends
+# Ethernet PoA backends. netmap is last: it overrides the others.
 include(dependencies/eth/rawsockets)
 include(dependencies/eth/bpf)
 include(dependencies/eth/netmap)
+
+# The Ethernet PoA needs a backend to send and receive frames.
 if(HAVE_RAW_SOCKETS OR HAVE_BPF OR HAVE_NETMAP)
-  set(HAVE_ETH TRUE CACHE INTERNAL "Ethernet IPCP support available")
+  set(HAVE_ETH TRUE)
 else()
-  unset(HAVE_ETH CACHE)
+  message(STATUS "No Ethernet backend, Ethernet PoAs disabled")
+  unset(HAVE_ETH)
 endif()
 
-# UDP IPCP
-include(dependencies/udp/ddns)
-
 # Coverage tools
 include(dependencies/coverage/gcov)
 include(dependencies/coverage/lcov)
diff --git a/cmake/dependencies/eth/netmap.cmake b/cmake/dependencies/eth/netmap.cmake
index 94ecd634..b31c4d03 100644
--- a/cmake/dependencies/eth/netmap.cmake
+++ b/cmake/dependencies/eth/netmap.cmake
@@ -1,18 +1,22 @@
-# netmap support (optional acceleration)
+# netmap support (kernel bypass). Explicit opt-in.
 find_path(NETMAP_C_INCLUDE_DIR
   net/netmap_user.h
   HINTS /usr/include /usr/local/include)
 
 mark_as_advanced(NETMAP_C_INCLUDE_DIR)
 
-if(NOT HAVE_RAW_SOCKETS AND NOT HAVE_BPF AND NETMAP_C_INCLUDE_DIR)
-  set(DISABLE_NETMAP FALSE CACHE BOOL
-    "Disable netmap support for ETH IPCPs")
-  if(NOT DISABLE_NETMAP)
-    message(STATUS "Netmap support for Ethernet IPCPs enabled")
-    set(HAVE_NETMAP TRUE)
-  else()
-    message(STATUS "Netmap support for Ethernet IPCPs disabled by user")
-    unset(HAVE_NETMAP)
+set(ENABLE_NETMAP FALSE CACHE BOOL
+  "Use netmap for Ethernet PoAs, overriding raw sockets or BPF")
+
+if(ENABLE_NETMAP)
+  if(NOT NETMAP_C_INCLUDE_DIR)
+    message(FATAL_ERROR "ENABLE_NETMAP is set, but netmap was not found.")
   endif()
+
+  message(STATUS "Netmap support for Ethernet PoAs enabled")
+
+  set(HAVE_NETMAP TRUE)
+
+  unset(HAVE_RAW_SOCKETS)
+  unset(HAVE_BPF)
 endif()
diff --git a/cmake/dependencies/udp/ddns.cmake b/cmake/dependencies/udp/ddns.cmake
deleted file mode 100644
index e8208e47..00000000
--- a/cmake/dependencies/udp/ddns.cmake
+++ /dev/null
@@ -1,31 +0,0 @@
-# DDNS (Dynamic DNS) support detection
-# Requires nsupdate and nslookup tools
-
-find_program(NSUPDATE_EXECUTABLE
-  NAMES nsupdate
-  DOC "The nsupdate tool that enables DDNS")
-
-find_program(NSLOOKUP_EXECUTABLE
-  NAMES nslookup
-  DOC "The nslookup tool that resolves DNS names")
-
-mark_as_advanced(NSLOOKUP_EXECUTABLE NSUPDATE_EXECUTABLE)
-
-if(NSLOOKUP_EXECUTABLE AND NSUPDATE_EXECUTABLE)
-  set(DISABLE_DDNS FALSE CACHE BOOL "Disable DDNS support")
-  if(NOT DISABLE_DDNS)
-    message(STATUS "DDNS support enabled")
-    set(HAVE_DDNS TRUE CACHE INTERNAL "Dynamic DNS support available")
-  else()
-    message(STATUS "DDNS support disabled by user")
-    unset(HAVE_DDNS CACHE)
-  endif()
-else()
-  if(NSLOOKUP_EXECUTABLE)
-    message(STATUS "Install nsupdate to enable DDNS support")
-  elseif(NSUPDATE_EXECUTABLE)
-    message(STATUS "Install nslookup to enable DDNS support")
-  else()
-    message(STATUS "Install nslookup and nsupdate to enable DDNS support")
-  endif()
-endif()