                          if (switch_root_dir)
                                  args[i++] = "--switched-root";
                          args[i++] = arg_running_as == SYSTEMD_SYSTEM ? "--system" : "--user";
+@@ -1923,6 +1924,13 @@ finish:
+                 args[i++] = NULL;
+                 assert(i <= args_size);
+ 
++                /* reenable any blocked signals, especially important
++                 * if we switch from initial ramdisk to init=... */
++                reset_all_signal_handlers();
++
++                assert_se(sigemptyset(&ss) == 0);
++                assert_se(sigprocmask(SIG_SETMASK, &ss, NULL) == 0);
++
+                 if (switch_root_init) {
+                         args[0] = switch_root_init;
+                         execv(args[0], (char* const*) args);
+diff --git a/src/core/manager.c b/src/core/manager.c
+index 224106c..7342095 100644
+--- a/src/core/manager.c
++++ b/src/core/manager.c
+@@ -422,7 +422,7 @@ int manager_new(SystemdRunningAs running_as, Manager **_m) {
+                 return -ENOMEM;
+ 
+ #ifdef ENABLE_EFI
+-        if (detect_container(NULL) <= 0)
++        if (running_as == SYSTEMD_SYSTEM && detect_container(NULL) <= 0)
+                 boot_timestamps(&m->userspace_timestamp, &m->firmware_timestamp, &m->loader_timestamp);
+ #endif
+ 
+@@ -2129,9 +2129,6 @@ int manager_serialize(Manager *m, FILE *f, FDSet *fds, bool switching_root) {
+                 if (u->id != t)
+                         continue;
+ 
+-                if (!unit_can_serialize(u))
+-                        continue;
+-
+                 /* Start marker */
+                 fputs(u->id, f);
+                 fputc('\n', f);
+diff --git a/src/core/namespace.c b/src/core/namespace.c
+index 9f15211..e41cf5b 100644
+--- a/src/core/namespace.c
++++ b/src/core/namespace.c
+@@ -42,6 +42,7 @@
+ #include "mkdir.h"
+ #include "dev-setup.h"
+ #include "def.h"
++#include "label.h"
+ 
+ typedef enum MountMode {
+         /* This is ordered by priority! */
+@@ -68,6 +69,7 @@ static int append_mounts(BindMount **p, char **strv, MountMode mode) {
+         STRV_FOREACH(i, strv) {
+ 
+                 (*p)->ignore = false;
++                (*p)->done = false;
+ 
+                 if ((mode == INACCESSIBLE || mode == READONLY || mode == READWRITE) && (*i)[0] == '-') {
+                         (*p)->ignore = true;
+@@ -217,7 +219,10 @@ static int mount_dev(BindMount *m) {
+                         goto fail;
+                 }
+ 
++                label_context_set(d, st.st_mode);
+                 r = mknod(dn, st.st_mode, st.st_rdev);
++                label_context_clear();
++
+                 if (r < 0) {
+                         r = -errno;
+                         goto fail;
+@@ -350,7 +355,7 @@ int setup_namespace(
+                 private_dev;
+ 
+         if (n > 0) {
+-                m = mounts = (BindMount *) alloca(n * sizeof(BindMount));
++                m = mounts = (BindMount *) alloca0(n * sizeof(BindMount));
+                 r = append_mounts(&m, read_write_dirs, READWRITE);
+                 if (r < 0)
+                         return r;
 diff --git a/src/core/service.c b/src/core/service.c
 index ae3695a..6b3aa45 100644
 --- a/src/core/service.c

                 log_error_unit(UNIT(s)->id, "%s is of type D-Bus but no D-Bus service name has been specified. Refusing.", UNIT(s)->id);
                 return -EINVAL;
diff --git a/src/core/socket.c b/src/core/socket.c
index 7c18a2b..eba67d5 100644
--- a/src/core/socket.c
+++ b/src/core/socket.c
@@ -663,16 +663,25 @@ static int instance_from_socket(int fd, unsigned nr, char **instance) {

                 break;
         }
 
@@ -1242,6 +1251,8 @@ static int socket_spawn(Socket *s, ExecCommand *c, pid_t *_pid) {
                        NULL,
                        s->exec_runtime,
                        &pid);
+        if (r < 0)
+                goto fail;
 
         strv_free(argv);
         if (r < 0)
@@ -1497,6 +1508,12 @@ static void socket_enter_running(Socket *s, int cfd) {
                         }
 
                 if (!pending) {
+                        if (!UNIT_ISSET(s->service)) {
+                                log_error_unit(UNIT(s)->id, "%s: service to activate vanished, refusing activation.", UNIT(s)->id);
+                                r = -ENOENT;
+                                goto fail;
+                        }
+
                         r = manager_add_job(UNIT(s)->manager, JOB_START, UNIT_DEREF(s->service), JOB_REPLACE, true, &error, NULL);
                         if (r < 0)
                                 goto fail;
diff --git a/src/core/timer.c b/src/core/timer.c
index 6c85304..720b8af 100644
--- a/src/core/timer.c
+++ b/src/core/timer.c
@@ -111,6 +111,23 @@ static int timer_add_default_dependencies(Timer *t) {
         return unit_add_two_dependencies_by_name(UNIT(t), UNIT_BEFORE, UNIT_CONFLICTS, SPECIAL_SHUTDOWN_TARGET, NULL, true);
 }
 
+static void update_stampfile(Timer *t, usec_t timestamp) {
+        _cleanup_close_ int fd = -1;
+
+        mkdir_parents_label(t->stamp_path, 0755);
+
+        /* Update the file atime + mtime, if we can */
+        fd = open(t->stamp_path, O_WRONLY|O_CREAT|O_TRUNC|O_CLOEXEC, 0644);
+        if (fd >= 0) {
+                struct timespec ts[2];
+
+                timespec_store(&ts[0], timestamp);
+                ts[1] = ts[0];
+
+                futimens(fd, ts);
+        }
+}
+
 static int timer_setup_persistent(Timer *t) {
         int r;
 
@@ -131,7 +148,7 @@ static int timer_setup_persistent(Timer *t) {
 
                 e = getenv("XDG_DATA_HOME");
                 if (e)
-                        t->stamp_path = strjoin(e, "/systemd/timers/", UNIT(t)->id, NULL);
+                        t->stamp_path = strjoin(e, "/systemd/timers/stamp-", UNIT(t)->id, NULL);
                 else {
 
                         _cleanup_free_ char *h = NULL;
@@ -496,22 +513,8 @@ static void timer_enter_running(Timer *t) {
 
         dual_timestamp_get(&t->last_trigger);
 
-        if (t->stamp_path) {
-                _cleanup_close_ int fd = -1;
-
-                mkdir_parents_label(t->stamp_path, 0755);
-
-                /* Update the file atime + mtime, if we can */
-                fd = open(t->stamp_path, O_WRONLY|O_CREAT|O_TRUNC|O_CLOEXEC, 0644);
-                if (fd >= 0) {
-                        struct timespec ts[2];
-
-                        timespec_store(&ts[0], t->last_trigger.realtime);
-                        ts[1] = ts[0];
-
-                        futimens(fd, ts);
-                }
-        }
+        if (t->stamp_path)
+                update_stampfile(t, t->last_trigger.realtime);
 
         timer_set_state(t, TIMER_RUNNING);
         return;
@@ -539,6 +542,11 @@ static int timer_start(Unit *u) {
 
                 if (stat(t->stamp_path, &st) >= 0)
                         t->last_trigger.realtime = timespec_load(&st.st_atim);
+                else if (errno == ENOENT)
+                        /* The timer has never run before,
+                         * make sure a stamp file exists.
+                         */
+                        update_stampfile(t, now(CLOCK_REALTIME));
         }
 
         t->result = TIMER_SUCCESS;
diff --git a/src/core/transaction.c b/src/core/transaction.c
index d00f427..2befc32 100644
--- a/src/core/transaction.c
+++ b/src/core/transaction.c
@@ -378,7 +378,7 @@ static int transaction_verify_order_one(Transaction *tr, Job *j, Job *from, unsi
                                       "Found dependency on %s/%s",
                                       k->unit->id, job_type_to_string(k->type));
 
-                        if (!delete &&
+                        if (!delete && hashmap_get(tr->jobs, k->unit) &&
                             !unit_matters_to_anchor(k->unit, k)) {
                                 /* Ok, we can drop this one, so let's
                                  * do so. */
diff --git a/src/core/umount.c b/src/core/umount.c
index d1258f0..0311812 100644
--- a/src/core/umount.c
