+* ConditionHost= for filtering services for clusters
+
+* journald: add symlinks and device names to kernel messages
+
+* maybe make systemd-detect-virt suid? or use fscaps?
+
+* consider using __secure_getenv() instead of getenv() in libs
+
+* journald: automatic rekeying with no log messages doesn't appear to work
+
+* man: document in ExecStart= explicitly that we don't take shell command lines, only executable names with arguments
+
+* shutdown: don't read-only mount anything when running in container
+
+* nspawn: --read-only is not applied recursively to submounts
+
+* MountFlags=shared acts as MountFlags=slave right now.
+
+* ReadOnlyDirectories= is not applied recursively to submounts
+
+* drop PID 1 reloading, only do reexecing (difficult: Reload()
+ currently is properly synchronous, Reexec() is weird, because we
+ can't delay the response properly until we are back, so instead of
+ being properly synchronous we just keep open the fd and close it
+ when done. That means clients don't get a succesful method reply,
+ but much rather a disconnect on success.
+
+* document that service reload may be implemented as service reexec
+
+* add option to reconfigure success exit codes/signals for services
+
+* remember which condition failed for services, not just the fact that something failed
+
+* use opterr = 0 for all getopt tools
+