incidentally, this makes all IP set-referring rules specific to one protocol family

skip expansion in the variable fragment to avoid clearing variable declarations

deterministic processing order within modules
global classmap for dynamic module discovery

drop awall prefix when accessing submodules from the main module
remove module-level function/module shortcuts when used only once

private class for reading current configuration

verification requires root privileges

context objects converted to explicit Config objects