From: Daan De Meyer <daan.j.demeyer@gmail.com>
Date: Wed, 21 May 2025 14:37:12 +0000 (+0200)
Subject: core: Clean up includes
X-Git-Tag: v258-rc1~525
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=836e4e7ea8fa24a0a08a3579f154ed4f4987c5df;p=thirdparty%2Fsystemd.git

core: Clean up includes

Split out of #37344.
---

diff --git a/src/core/all-units.h b/src/core/all-units.h
index 9e8649d1e17..dd152d78022 100644
--- a/src/core/all-units.h
+++ b/src/core/all-units.h
@@ -1,15 +1,15 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "automount.h"
-#include "device.h"
-#include "mount.h"
-#include "path.h"
-#include "scope.h"
-#include "service.h"
-#include "slice.h"
-#include "socket.h"
-#include "swap.h"
-#include "target.h"
-#include "timer.h"
-#include "unit.h"
+#include "automount.h"  /* IWYU pragma: export */
+#include "device.h"     /* IWYU pragma: export */
+#include "mount.h"      /* IWYU pragma: export */
+#include "path.h"       /* IWYU pragma: export */
+#include "scope.h"      /* IWYU pragma: export */
+#include "service.h"    /* IWYU pragma: export */
+#include "slice.h"      /* IWYU pragma: export */
+#include "socket.h"     /* IWYU pragma: export */
+#include "swap.h"       /* IWYU pragma: export */
+#include "target.h"     /* IWYU pragma: export */
+#include "timer.h"      /* IWYU pragma: export */
+#include "unit.h"       /* IWYU pragma: export */
diff --git a/src/core/apparmor-setup.c b/src/core/apparmor-setup.c
index 2dbb63e603a..104335a75e1 100644
--- a/src/core/apparmor-setup.c
+++ b/src/core/apparmor-setup.c
@@ -1,6 +1,5 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <errno.h>
 #include <unistd.h>
 
 #include "alloc-util.h"
@@ -10,7 +9,6 @@
 #include "fd-util.h"
 #include "fileio.h"
 #include "log.h"
-#include "macro.h"
 #include "string-util.h"
 #include "strv.h"
 
diff --git a/src/core/audit-fd.c b/src/core/audit-fd.c
index 6150e7e43e5..928d67169af 100644
--- a/src/core/audit-fd.c
+++ b/src/core/audit-fd.c
@@ -1,7 +1,5 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <errno.h>
-
 #include "audit-fd.h"
 #include "capability-util.h"
 #include "libaudit-util.h"
diff --git a/src/core/audit-fd.h b/src/core/audit-fd.h
index 2fceb433a71..55bd357c81f 100644
--- a/src/core/audit-fd.h
+++ b/src/core/audit-fd.h
@@ -1,5 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include "forward.h"
+
 int get_core_audit_fd(void);
 void close_core_audit_fd(void);
diff --git a/src/core/automount.c b/src/core/automount.c
index c3f4b6b72c6..e6b3dd09dba 100644
--- a/src/core/automount.c
+++ b/src/core/automount.c
@@ -1,21 +1,19 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <errno.h>
 #include <fcntl.h>
-#include <limits.h>
 #include <linux/auto_dev-ioctl.h>
-#include <sys/epoll.h>
 #include <sys/mount.h>
 #include <sys/stat.h>
 #include <unistd.h>
 
+#include "sd-bus.h"
+
 #include "alloc-util.h"
-#include "async.h"
 #include "automount.h"
 #include "bus-error.h"
-#include "bus-util.h"
 #include "dbus-automount.h"
 #include "dbus-unit.h"
+#include "errno-util.h"
 #include "fd-util.h"
 #include "format-util.h"
 #include "fstab-util.h"
@@ -30,6 +28,7 @@
 #include "path-util.h"
 #include "process-util.h"
 #include "serialize.h"
+#include "set.h"
 #include "special.h"
 #include "stdio-util.h"
 #include "string-table.h"
diff --git a/src/core/automount.h b/src/core/automount.h
index 6f2ca7657bc..8dd70ad8b5e 100644
--- a/src/core/automount.h
+++ b/src/core/automount.h
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include "core-forward.h"
 #include "unit.h"
 
 typedef enum AutomountResult {
diff --git a/src/core/bpf-devices.c b/src/core/bpf-devices.c
index 4417ab58e94..7e6a1d15a4e 100644
--- a/src/core/bpf-devices.c
+++ b/src/core/bpf-devices.c
@@ -2,18 +2,20 @@
 
 #include <fnmatch.h>
 #include <linux/bpf_insn.h>
+#include <sys/stat.h>
 
 #include "alloc-util.h"
 #include "bpf-devices.h"
 #include "bpf-program.h"
+#include "cgroup.h"
 #include "devnum-util.h"
 #include "fd-util.h"
 #include "fileio.h"
+#include "log.h"
 #include "missing_bpf.h"
 #include "nulstr-util.h"
 #include "parse-util.h"
 #include "path-util.h"
-#include "stdio-util.h"
 #include "string-util.h"
 
 #define PASS_JUMP_OFF 4096
diff --git a/src/core/bpf-devices.h b/src/core/bpf-devices.h
index a1d261548d8..aac7dfd8db0 100644
--- a/src/core/bpf-devices.h
+++ b/src/core/bpf-devices.h
@@ -1,11 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <inttypes.h>
-
-#include "cgroup.h"
-
-typedef struct BPFProgram BPFProgram;
+#include "core-forward.h"
 
 int bpf_devices_cgroup_init(BPFProgram **ret, CGroupDevicePolicy policy, bool allow_list);
 int bpf_devices_apply_policy(
diff --git a/src/core/bpf-firewall.c b/src/core/bpf-firewall.c
index 428c0c97813..cf9d826332e 100644
--- a/src/core/bpf-firewall.c
+++ b/src/core/bpf-firewall.c
@@ -1,27 +1,23 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <arpa/inet.h>
-#include <assert.h>
-#include <errno.h>
-#include <fcntl.h>
 #include <linux/bpf_insn.h>
-#include <net/ethernet.h>
+#include <linux/if_ether.h>
 #include <net/if.h>
 #include <netinet/ip.h>
 #include <netinet/ip6.h>
-#include <stddef.h>
 #include <stdio.h>
-#include <stdlib.h>
 #include <unistd.h>
 
 #include "alloc-util.h"
 #include "bpf-firewall.h"
 #include "bpf-program.h"
+#include "errno-util.h"
 #include "fd-util.h"
 #include "in-addr-prefix-util.h"
 #include "manager.h"
 #include "memory-util.h"
-#include "missing_syscall.h"
+#include "set.h"
+#include "string-util.h"
 #include "strv.h"
 #include "unit.h"
 #include "virt.h"
diff --git a/src/core/bpf-firewall.h b/src/core/bpf-firewall.h
index 27cbdf857bc..4a47e70558b 100644
--- a/src/core/bpf-firewall.h
+++ b/src/core/bpf-firewall.h
@@ -1,10 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <inttypes.h>
-
-#include "cgroup.h"
-#include "unit.h"
+#include "core-forward.h"
 
 int bpf_firewall_compile(Unit *u);
 int bpf_firewall_install(Unit *u);
diff --git a/src/core/bpf-foreign.c b/src/core/bpf-foreign.c
index 851cc424a2d..b58cff8a0b4 100644
--- a/src/core/bpf-foreign.c
+++ b/src/core/bpf-foreign.c
@@ -1,19 +1,20 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
+#include "alloc-util.h"
 #include "bpf-foreign.h"
 #include "bpf-program.h"
 #include "cgroup.h"
-#include "memory-util.h"
+#include "hash-funcs.h"
+#include "hashmap.h"
 #include "missing_magic.h"
-#include "mountpoint-util.h"
-#include "set.h"
+#include "siphash24.h"
 #include "stat-util.h"
+#include "unit.h"
 
-typedef struct BPFForeignKey BPFForeignKey;
-struct BPFForeignKey {
+typedef struct BPFForeignKey {
         uint32_t prog_id;
         uint32_t attach_type;
-};
+} BPFForeignKey;
 
 static int bpf_foreign_key_new(uint32_t prog_id,
                 enum bpf_attach_type attach_type,
diff --git a/src/core/bpf-foreign.h b/src/core/bpf-foreign.h
index c97be7c72f4..831648cc653 100644
--- a/src/core/bpf-foreign.h
+++ b/src/core/bpf-foreign.h
@@ -2,7 +2,7 @@
 
 #pragma once
 
-#include "unit.h"
+#include "core-forward.h"
 
 /*
  * Attach cgroup-bpf programs foreign to systemd, i.e. loaded to the kernel by an entity
diff --git a/src/core/bpf-restrict-fs.c b/src/core/bpf-restrict-fs.c
index 4e163717399..33e525c911a 100644
--- a/src/core/bpf-restrict-fs.c
+++ b/src/core/bpf-restrict-fs.c
@@ -1,27 +1,17 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <errno.h>
-#include <fcntl.h>
-#include <linux/types.h>
-#include <sys/resource.h>
-#include <sys/stat.h>
-#include <sys/time.h>
-#include <sys/types.h>
-#include <unistd.h>
-
-#include "alloc-util.h"
+#include <stdlib.h>
+
 #include "bpf-restrict-fs.h"
-#include "cgroup-util.h"
 #include "fd-util.h"
-#include "fileio.h"
 #include "filesystems.h"
 #include "log.h"
 #include "lsm-util.h"
 #include "manager.h"
-#include "mkdir.h"
 #include "nulstr-util.h"
+#include "set.h"
 #include "stat-util.h"
-#include "strv.h"
+#include "unit.h"
 
 #if BPF_FRAMEWORK
 /* libbpf, clang and llc compile time dependencies are satisfied */
diff --git a/src/core/bpf-restrict-fs.h b/src/core/bpf-restrict-fs.h
index 8da12de7463..dbc017e2517 100644
--- a/src/core/bpf-restrict-fs.h
+++ b/src/core/bpf-restrict-fs.h
@@ -1,7 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "hashmap.h"
+#include "core-forward.h"
 
 typedef enum FilesystemParseFlags {
         FILESYSTEM_PARSE_INVERT     = 1 << 0,
@@ -9,11 +9,6 @@ typedef enum FilesystemParseFlags {
         FILESYSTEM_PARSE_LOG        = 1 << 2,
 } FilesystemParseFlags;
 
-typedef struct Unit Unit;
-typedef struct Manager Manager;
-
-typedef struct restrict_fs_bpf restrict_fs_bpf;
-
 bool bpf_restrict_fs_supported(bool initialize);
 int bpf_restrict_fs_setup(Manager *m);
 int bpf_restrict_fs_update(const Set *filesystems, uint64_t cgroup_id, int outer_map_fd, bool allow_list);
diff --git a/src/core/bpf-restrict-ifaces.c b/src/core/bpf-restrict-ifaces.c
index e97682a19cd..971772badef 100644
--- a/src/core/bpf-restrict-ifaces.c
+++ b/src/core/bpf-restrict-ifaces.c
@@ -1,8 +1,14 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
+#include "sd-netlink.h"
+
+#include "alloc-util.h"
 #include "bpf-restrict-ifaces.h"
+#include "cgroup.h"
 #include "fd-util.h"
+#include "fdset.h"
 #include "netlink-util.h"
+#include "set.h"
 #include "unit.h"
 
 #if BPF_FRAMEWORK
diff --git a/src/core/bpf-restrict-ifaces.h b/src/core/bpf-restrict-ifaces.h
index 80af1f3e5b8..51d9de3a33f 100644
--- a/src/core/bpf-restrict-ifaces.h
+++ b/src/core/bpf-restrict-ifaces.h
@@ -1,9 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "fdset.h"
-
-typedef struct Unit Unit;
+#include "core-forward.h"
 
 int bpf_restrict_ifaces_supported(void);
 int bpf_restrict_ifaces_install(Unit *u);
diff --git a/src/core/bpf-socket-bind.c b/src/core/bpf-socket-bind.c
index ef5ff4f65a3..6838476d048 100644
--- a/src/core/bpf-socket-bind.c
+++ b/src/core/bpf-socket-bind.c
@@ -1,11 +1,10 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#if BPF_FRAMEWORK
-#include <bpf/bpf.h>
-#endif
-
+#include "alloc-util.h"
 #include "bpf-socket-bind.h"
+#include "cgroup.h"
 #include "fd-util.h"
+#include "fdset.h"
 #include "unit.h"
 
 #if BPF_FRAMEWORK
diff --git a/src/core/bpf-socket-bind.h b/src/core/bpf-socket-bind.h
index 13a0fc15215..511772b713c 100644
--- a/src/core/bpf-socket-bind.h
+++ b/src/core/bpf-socket-bind.h
@@ -1,9 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "fdset.h"
-
-typedef struct Unit Unit;
+#include "core-forward.h"
 
 int bpf_socket_bind_supported(void);
 
diff --git a/src/core/cgroup.c b/src/core/cgroup.c
index 504a64d231f..61a034641b3 100644
--- a/src/core/cgroup.c
+++ b/src/core/cgroup.c
@@ -1,7 +1,9 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include <fcntl.h>
+#include <sys/stat.h>
 
+#include "sd-bus.h"
 #include "sd-messages.h"
 
 #include "af-list.h"
@@ -10,6 +12,7 @@
 #include "bpf-devices.h"
 #include "bpf-firewall.h"
 #include "bpf-foreign.h"
+#include "bpf-program.h"
 #include "bpf-restrict-ifaces.h"
 #include "bpf-socket-bind.h"
 #include "btrfs-util.h"
@@ -19,12 +22,14 @@
 #include "cgroup-setup.h"
 #include "cgroup-util.h"
 #include "devnum-util.h"
+#include "errno-util.h"
+#include "extract-word.h"
 #include "fd-util.h"
+#include "fdset.h"
 #include "fileio.h"
 #include "firewall-util.h"
 #include "in-addr-prefix-util.h"
 #include "inotify-util.h"
-#include "io-util.h"
 #include "ip-protocol-list.h"
 #include "limits-util.h"
 #include "manager.h"
@@ -32,18 +37,22 @@
 #include "parse-util.h"
 #include "path-util.h"
 #include "percent-util.h"
+#include "pidref.h"
 #include "process-util.h"
 #include "procfs-util.h"
 #include "serialize.h"
+#include "set.h"
 #include "special.h"
 #include "stdio-util.h"
 #include "string-table.h"
 #include "string-util.h"
+#include "strv.h"
 #include "virt.h"
 
 #if BPF_FRAMEWORK
 #include "bpf-dlopen.h"
 #include "bpf-link.h"
+#include "bpf-restrict-fs.h"
 #include "bpf/restrict_fs/restrict-fs-skel.h"
 #endif
 
@@ -52,7 +61,7 @@
 /* Returns the log level to use when cgroup attribute writes fail. When an attribute is missing or we have access
  * problems we downgrade to LOG_DEBUG. This is supposed to be nice to container managers and kernels which want to mask
  * out specific attributes from us. */
-#define LOG_LEVEL_CGROUP_WRITE(r) (IN_SET(abs(r), ENOENT, EROFS, EACCES, EPERM) ? LOG_DEBUG : LOG_WARNING)
+#define LOG_LEVEL_CGROUP_WRITE(r) (IN_SET(ABS(r), ENOENT, EROFS, EACCES, EPERM) ? LOG_DEBUG : LOG_WARNING)
 
 static void unit_remove_from_cgroup_empty_queue(Unit *u);
 
diff --git a/src/core/cgroup.h b/src/core/cgroup.h
index bdd4a2236bb..501caa971c3 100644
--- a/src/core/cgroup.h
+++ b/src/core/cgroup.h
@@ -1,18 +1,11 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <stdbool.h>
-
-#include "sd-event.h"
-
-#include "bpf-program.h"
-#include "bpf-restrict-fs.h"
 #include "cgroup-util.h"
+#include "core-forward.h"
 #include "cpu-set-util.h"
 #include "firewall-util.h"
 #include "list.h"
-#include "pidref.h"
-#include "time-util.h"
 
 typedef struct CGroupTasksMax {
         /* If scale == 0, just use value; otherwise, value / scale.
@@ -29,15 +22,6 @@ static inline bool cgroup_tasks_max_isset(const CGroupTasksMax *tasks_max) {
 
 uint64_t cgroup_tasks_max_resolve(const CGroupTasksMax *tasks_max);
 
-typedef struct CGroupContext CGroupContext;
-typedef struct CGroupDeviceAllow CGroupDeviceAllow;
-typedef struct CGroupIODeviceWeight CGroupIODeviceWeight;
-typedef struct CGroupIODeviceLimit CGroupIODeviceLimit;
-typedef struct CGroupIODeviceLatency CGroupIODeviceLatency;
-typedef struct CGroupBPFForeignProgram CGroupBPFForeignProgram;
-typedef struct CGroupSocketBindItem CGroupSocketBindItem;
-typedef struct CGroupRuntime CGroupRuntime;
-
 typedef enum CGroupDevicePolicy {
         /* When devices listed, will allow those, plus built-in ones, if none are listed will allow
          * everything. */
@@ -72,43 +56,43 @@ typedef enum CGroupDevicePermissions {
         _CGROUP_DEVICE_PERMISSIONS_INVALID = -EINVAL,
 } CGroupDevicePermissions;
 
-struct CGroupDeviceAllow {
+typedef struct CGroupDeviceAllow {
         LIST_FIELDS(CGroupDeviceAllow, device_allow);
         char *path;
         CGroupDevicePermissions permissions;
-};
+} CGroupDeviceAllow;
 
-struct CGroupIODeviceWeight {
+typedef struct CGroupIODeviceWeight {
         LIST_FIELDS(CGroupIODeviceWeight, device_weights);
         char *path;
         uint64_t weight;
-};
+} CGroupIODeviceWeight;
 
-struct CGroupIODeviceLimit {
+typedef struct CGroupIODeviceLimit {
         LIST_FIELDS(CGroupIODeviceLimit, device_limits);
         char *path;
         uint64_t limits[_CGROUP_IO_LIMIT_TYPE_MAX];
-};
+} CGroupIODeviceLimit;
 
-struct CGroupIODeviceLatency {
+typedef struct CGroupIODeviceLatency {
         LIST_FIELDS(CGroupIODeviceLatency, device_latencies);
         char *path;
         usec_t target_usec;
-};
+} CGroupIODeviceLatency;
 
-struct CGroupBPFForeignProgram {
+typedef struct CGroupBPFForeignProgram {
         LIST_FIELDS(CGroupBPFForeignProgram, programs);
         uint32_t attach_type;
         char *bpffs_path;
-};
+} CGroupBPFForeignProgram;
 
-struct CGroupSocketBindItem {
+typedef struct CGroupSocketBindItem {
         LIST_FIELDS(CGroupSocketBindItem, socket_bind_items);
         int address_family;
         int ip_protocol;
         uint16_t nr_ports;
         uint16_t port_min;
-};
+} CGroupSocketBindItem;
 
 typedef enum CGroupPressureWatch {
         CGROUP_PRESSURE_WATCH_NO,       /* → tells the service payload explicitly not to watch for memory pressure */
@@ -122,7 +106,7 @@ typedef enum CGroupPressureWatch {
 /* The user-supplied cgroup-related configuration options. This remains mostly immutable while the service
  * manager is running (except for an occasional SetProperty() configuration change), outside of reload
  * cycles. */
-struct CGroupContext {
+typedef struct CGroupContext {
         bool io_accounting;
         bool memory_accounting;
         bool tasks_accounting;
@@ -222,7 +206,7 @@ struct CGroupContext {
         /* Forward coredumps for processes that crash within this cgroup.
          * Requires 'delegate' to also be true. */
         bool coredump_receive;
-};
+} CGroupContext;
 
 /* Used when querying IP accounting data */
 typedef enum CGroupIPAccountingMetric {
@@ -349,10 +333,6 @@ typedef struct CGroupRuntime {
         bool warned_clamping_cpu_quota_period:1;
 } CGroupRuntime;
 
-typedef struct Unit Unit;
-typedef struct Manager Manager;
-typedef enum ManagerState ManagerState;
-
 uint64_t cgroup_context_cpu_weight(CGroupContext *c, ManagerState state);
 
 usec_t cgroup_cpu_adjust_period(usec_t period, usec_t quota, usec_t resolution, usec_t max_period);
diff --git a/src/core/clock-warp.h b/src/core/clock-warp.h
index 402c7eee042..84ffdc230ad 100644
--- a/src/core/clock-warp.h
+++ b/src/core/clock-warp.h
@@ -1,7 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <stdbool.h>
+#include "forward.h"
 
 int clock_reset_timewarp(void);
 void clock_apply_epoch(bool allow_backwards);
diff --git a/src/core/core-forward.h b/src/core/core-forward.h
new file mode 100644
index 00000000000..59be62c57d6
--- /dev/null
+++ b/src/core/core-forward.h
@@ -0,0 +1,53 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+#pragma once
+
+#include "conf-parser-forward.h"        /* IWYU pragma: export */
+#include "forward.h"                    /* IWYU pragma: export */
+#include "unit-def.h"                   /* IWYU pragma: export */
+
+typedef enum CGroupDevicePermissions CGroupDevicePermissions;
+typedef enum CGroupDevicePolicy CGroupDevicePolicy;
+typedef enum CGroupMask CGroupMask;
+typedef enum ExecCleanMask ExecCleanMask;
+typedef enum ExecPreserveMode ExecPreserveMode;
+typedef enum FreezerAction FreezerAction;
+typedef enum JobResult JobResult;
+typedef enum JobState JobState;
+typedef enum JobType JobType;
+typedef enum ManagerState ManagerState;
+typedef enum TransactionAddFlags TransactionAddFlags;
+typedef enum UnitDependencyAtom UnitDependencyAtom;
+typedef enum UnitWriteFlags UnitWriteFlags;
+
+typedef struct ActivationDetails ActivationDetails;
+typedef struct BindMount BindMount;
+typedef struct CGroupBPFForeignProgram CGroupBPFForeignProgram;
+typedef struct CGroupContext CGroupContext;
+typedef struct CGroupDeviceAllow CGroupDeviceAllow;
+typedef struct CGroupIODeviceLatency CGroupIODeviceLatency;
+typedef struct CGroupIODeviceLimit CGroupIODeviceLimit;
+typedef struct CGroupIODeviceWeight CGroupIODeviceWeight;
+typedef struct CGroupRuntime CGroupRuntime;
+typedef struct CGroupSocketBindItem CGroupSocketBindItem;
+typedef struct DynamicCreds DynamicCreds;
+typedef struct DynamicUser DynamicUser;
+typedef struct ExecCommand ExecCommand;
+typedef struct ExecContext ExecContext;
+typedef struct ExecParameters ExecParameters;
+typedef struct ExecRuntime ExecRuntime;
+typedef struct ExecSharedRuntime ExecSharedRuntime;
+typedef struct Job Job;
+typedef struct JobDependency JobDependency;
+typedef struct KillContext KillContext;
+typedef struct Manager Manager;
+typedef struct MountImage MountImage;
+typedef struct PathSpec PathSpec;
+typedef struct Scope Scope;
+typedef struct Service Service;
+typedef struct Socket Socket;
+typedef struct SocketPeer SocketPeer;
+typedef struct TemporaryFileSystem TemporaryFileSystem;
+typedef struct Unit Unit;
+typedef struct UnitRef UnitRef;
+
+struct restrict_fs_bpf;
diff --git a/src/core/crash-handler.c b/src/core/crash-handler.c
index 385a6cf641f..41826a1f3e0 100644
--- a/src/core/crash-handler.c
+++ b/src/core/crash-handler.c
@@ -4,16 +4,18 @@
 
 #include "sd-messages.h"
 
+#include "constants.h"
 #include "crash-handler.h"
 #include "exit-status.h"
-#include "macro.h"
+#include "format-util.h"
+#include "log.h"
 #include "main.h"
-#include "missing_syscall.h"
 #include "process-util.h"
 #include "raw-clone.h"
 #include "rlimit-util.h"
 #include "signal-util.h"
 #include "string-table.h"
+#include "string-util.h"
 #include "terminal-util.h"
 #include "virt.h"
 
diff --git a/src/core/crash-handler.h b/src/core/crash-handler.h
index f156d23aa00..4fd185fa45e 100644
--- a/src/core/crash-handler.h
+++ b/src/core/crash-handler.h
@@ -1,9 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <errno.h>
-
-#include "macro.h"
+#include "forward.h"
 
 typedef enum CrashAction {
         CRASH_FREEZE,
diff --git a/src/core/dbus-automount.h b/src/core/dbus-automount.h
index cfceaecc043..6e46d9b2779 100644
--- a/src/core/dbus-automount.h
+++ b/src/core/dbus-automount.h
@@ -1,10 +1,9 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "sd-bus.h"
 #include "sd-bus-vtable.h"
 
-#include "unit.h"
+#include "core-forward.h"
 
 extern const sd_bus_vtable bus_automount_vtable[];
 
diff --git a/src/core/dbus-cgroup.c b/src/core/dbus-cgroup.c
index 326c440cf9f..b8ca90bb21f 100644
--- a/src/core/dbus-cgroup.c
+++ b/src/core/dbus-cgroup.c
@@ -1,32 +1,26 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <arpa/inet.h>
-
 #include "af-list.h"
 #include "alloc-util.h"
-#include "bpf-firewall.h"
-#include "bpf-foreign.h"
+#include "bpf-program.h"
 #include "bus-get-properties.h"
 #include "bus-message-util.h"
-#include "bus-util.h"
 #include "cgroup.h"
 #include "cgroup-util.h"
 #include "dbus-cgroup.h"
-#include "dbus-util.h"
-#include "errno-util.h"
 #include "escape.h"
-#include "fd-util.h"
-#include "fileio.h"
 #include "firewall-util.h"
 #include "in-addr-prefix-util.h"
-#include "ip-protocol-list.h"
 #include "limits-util.h"
 #include "manager.h"
 #include "memstream-util.h"
 #include "parse-util.h"
 #include "path-util.h"
 #include "percent-util.h"
+#include "set.h"
 #include "socket-util.h"
+#include "string-util.h"
+#include "strv.h"
 #include "varlink.h"
 
 BUS_DEFINE_PROPERTY_GET(bus_property_get_tasks_max, "t", CGroupTasksMax, cgroup_tasks_max_resolve);
diff --git a/src/core/dbus-cgroup.h b/src/core/dbus-cgroup.h
index 21f33984857..cd62979002b 100644
--- a/src/core/dbus-cgroup.h
+++ b/src/core/dbus-cgroup.h
@@ -1,11 +1,9 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "sd-bus.h"
 #include "sd-bus-vtable.h"
 
-#include "cgroup.h"
-#include "unit.h"
+#include "core-forward.h"
 
 extern const sd_bus_vtable bus_cgroup_vtable[];
 
diff --git a/src/core/dbus-device.c b/src/core/dbus-device.c
index b5e18d80a47..c39dc87a575 100644
--- a/src/core/dbus-device.c
+++ b/src/core/dbus-device.c
@@ -2,7 +2,6 @@
 
 #include "dbus-device.h"
 #include "device.h"
-#include "unit.h"
 
 const sd_bus_vtable bus_device_vtable[] = {
         SD_BUS_VTABLE_START(0),
diff --git a/src/core/dbus-execute.c b/src/core/dbus-execute.c
index d0281cc236d..c0915f501a1 100644
--- a/src/core/dbus-execute.c
+++ b/src/core/dbus-execute.c
@@ -1,48 +1,46 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
+#include <syslog.h>
 #include <sys/mount.h>
-#include <sys/prctl.h>
 
 #include "af-list.h"
 #include "alloc-util.h"
+#include "bpf-restrict-fs.h"
 #include "bus-get-properties.h"
 #include "bus-unit-util.h"
-#include "bus-util.h"
 #include "cap-list.h"
-#include "capability-util.h"
 #include "cpu-set-util.h"
 #include "creds-util.h"
 #include "dbus-execute.h"
 #include "dbus-util.h"
+#include "dissect-image.h"
 #include "env-util.h"
-#include "errno-list.h"
 #include "escape.h"
 #include "exec-credential.h"
 #include "execute.h"
 #include "fd-util.h"
-#include "fileio.h"
 #include "hexdecoct.h"
 #include "hostname-util.h"
 #include "image-policy.h"
 #include "ioprio-util.h"
 #include "iovec-util.h"
 #include "journal-file.h"
-#include "load-fragment.h"
 #include "memstream-util.h"
 #include "mountpoint-util.h"
 #include "namespace.h"
-#include "parse-util.h"
+#include "nsflags.h"
+#include "ordered-set.h"
 #include "path-util.h"
 #include "pcre2-util.h"
 #include "process-util.h"
 #include "rlimit-util.h"
 #include "seccomp-util.h"
 #include "securebits-util.h"
+#include "set.h"
 #include "specifier.h"
-#include "stat-util.h"
 #include "strv.h"
 #include "syslog-util.h"
-#include "unit-printf.h"
+#include "unit.h"
 #include "user-util.h"
 #include "utf8.h"
 
diff --git a/src/core/dbus-execute.h b/src/core/dbus-execute.h
index 4ad7dd27a9d..c3566bda561 100644
--- a/src/core/dbus-execute.h
+++ b/src/core/dbus-execute.h
@@ -1,11 +1,10 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "sd-bus.h"
 #include "sd-bus-vtable.h"
 
-#include "execute.h"
-#include "unit.h"
+#include "bus-get-properties.h"
+#include "core-forward.h"
 
 #define BUS_EXEC_STATUS_VTABLE(prefix, offset, flags)                   \
         BUS_PROPERTY_DUAL_TIMESTAMP(prefix "StartTimestamp", (offset) + offsetof(ExecStatus, start_timestamp), flags), \
diff --git a/src/core/dbus-job.c b/src/core/dbus-job.c
index 7ebaec976b4..854d329c014 100644
--- a/src/core/dbus-job.c
+++ b/src/core/dbus-job.c
@@ -4,15 +4,17 @@
 
 #include "alloc-util.h"
 #include "bus-get-properties.h"
+#include "bus-object.h"
 #include "bus-util.h"
 #include "dbus.h"
 #include "dbus-job.h"
 #include "dbus-unit.h"
 #include "dbus-util.h"
+#include "hashmap.h"
 #include "job.h"
 #include "log.h"
+#include "manager.h"
 #include "selinux-access.h"
-#include "string-util.h"
 #include "strv.h"
 
 static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_type, job_type, JobType);
diff --git a/src/core/dbus-job.h b/src/core/dbus-job.h
index 50957303de6..13ce4dca758 100644
--- a/src/core/dbus-job.h
+++ b/src/core/dbus-job.h
@@ -1,11 +1,9 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "sd-bus.h"
+#include "sd-bus-vtable.h"
 
-#include "bus-object.h"
-
-typedef struct Job Job;
+#include "core-forward.h"
 
 extern const sd_bus_vtable bus_job_vtable[];
 extern const BusObjectImplementation job_object;
diff --git a/src/core/dbus-kill.c b/src/core/dbus-kill.c
index 19e439f79ee..12dea8fb3b0 100644
--- a/src/core/dbus-kill.c
+++ b/src/core/dbus-kill.c
@@ -5,6 +5,7 @@
 #include "dbus-util.h"
 #include "kill.h"
 #include "signal-util.h"
+#include "string-util.h"
 
 static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_kill_mode, kill_mode, KillMode);
 
diff --git a/src/core/dbus-kill.h b/src/core/dbus-kill.h
index 5a9028795cc..6afe40e58b2 100644
--- a/src/core/dbus-kill.h
+++ b/src/core/dbus-kill.h
@@ -1,11 +1,9 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "sd-bus.h"
 #include "sd-bus-vtable.h"
 
-#include "kill.h"
-#include "unit.h"
+#include "core-forward.h"
 
 extern const sd_bus_vtable bus_kill_vtable[];
 
diff --git a/src/core/dbus-manager.c b/src/core/dbus-manager.c
index 6cb3777097e..c79118f98a8 100644
--- a/src/core/dbus-manager.c
+++ b/src/core/dbus-manager.c
@@ -1,8 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <errno.h>
+#include <linux/capability.h>
 #include <sys/prctl.h>
-#include <sys/statvfs.h>
 #include <unistd.h>
 
 #include "alloc-util.h"
@@ -16,9 +15,9 @@
 #include "bus-util.h"
 #include "chase.h"
 #include "confidential-virt.h"
-#include "dbus.h"
 #include "dbus-cgroup.h"
 #include "dbus-execute.h"
+#include "dbus.h"
 #include "dbus-job.h"
 #include "dbus-manager.h"
 #include "dbus-scope.h"
@@ -27,25 +26,29 @@
 #include "dbus-util.h"
 #include "dynamic-user.h"
 #include "env-util.h"
+#include "errno-util.h"
 #include "fd-util.h"
-#include "fileio.h"
 #include "format-util.h"
+#include "glyph-util.h"
+#include "hashmap.h"
 #include "initrd-util.h"
 #include "install.h"
 #include "locale-util.h"
 #include "log.h"
 #include "manager-dump.h"
+#include "manager.h"
 #include "memfd-util.h"
 #include "os-util.h"
-#include "parse-util.h"
 #include "path-util.h"
+#include "pidref.h"
 #include "process-util.h"
 #include "selinux-access.h"
-#include "stat-util.h"
+#include "set.h"
 #include "string-util.h"
 #include "strv.h"
 #include "syslog-util.h"
 #include "taint.h"
+#include "unit-name.h"
 #include "user-util.h"
 #include "version.h"
 #include "virt.h"
diff --git a/src/core/dbus-manager.h b/src/core/dbus-manager.h
index fcabca57c9c..4dd6492255e 100644
--- a/src/core/dbus-manager.h
+++ b/src/core/dbus-manager.h
@@ -3,9 +3,7 @@
 
 #include "sd-bus-vtable.h"
 
-#include "time-util.h"
-
-typedef struct Manager Manager;
+#include "core-forward.h"
 
 extern const sd_bus_vtable bus_manager_vtable[];
 extern const sd_bus_vtable bus_manager_log_control_vtable[];
diff --git a/src/core/dbus-mount.c b/src/core/dbus-mount.c
index 6b30b90f7fb..6c10e476b9c 100644
--- a/src/core/dbus-mount.c
+++ b/src/core/dbus-mount.c
@@ -10,7 +10,6 @@
 #include "mount.h"
 #include "string-util.h"
 #include "unit.h"
-#include "utf8.h"
 
 static int property_get_what(
                 sd_bus *bus,
diff --git a/src/core/dbus-mount.h b/src/core/dbus-mount.h
index 5a848d3104e..2ea4c74f624 100644
--- a/src/core/dbus-mount.h
+++ b/src/core/dbus-mount.h
@@ -1,10 +1,9 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "sd-bus.h"
 #include "sd-bus-vtable.h"
 
-#include "unit.h"
+#include "core-forward.h"
 
 extern const sd_bus_vtable bus_mount_vtable[];
 
diff --git a/src/core/dbus-path.h b/src/core/dbus-path.h
index b5018b0116d..c30466dc72a 100644
--- a/src/core/dbus-path.h
+++ b/src/core/dbus-path.h
@@ -1,10 +1,9 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "sd-bus.h"
 #include "sd-bus-vtable.h"
 
-#include "unit.h"
+#include "core-forward.h"
 
 extern const sd_bus_vtable bus_path_vtable[];
 
diff --git a/src/core/dbus-scope.c b/src/core/dbus-scope.c
index cf282462702..2d2f65a9665 100644
--- a/src/core/dbus-scope.c
+++ b/src/core/dbus-scope.c
@@ -4,15 +4,16 @@
 #include "bus-common-errors.h"
 #include "bus-get-properties.h"
 #include "bus-util.h"
-#include "dbus.h"
 #include "dbus-cgroup.h"
 #include "dbus-kill.h"
 #include "dbus-manager.h"
 #include "dbus-scope.h"
-#include "dbus-unit.h"
 #include "dbus-util.h"
+#include "manager.h"
+#include "pidref.h"
 #include "scope.h"
 #include "selinux-access.h"
+#include "string-util.h"
 #include "unit.h"
 
 int bus_scope_method_abandon(sd_bus_message *message, void *userdata, sd_bus_error *error) {
diff --git a/src/core/dbus-scope.h b/src/core/dbus-scope.h
index fb7467a0f55..017390ac5b6 100644
--- a/src/core/dbus-scope.h
+++ b/src/core/dbus-scope.h
@@ -1,12 +1,9 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "sd-bus.h"
 #include "sd-bus-vtable.h"
 
-#include "unit.h"
-
-typedef struct Scope Scope;
+#include "core-forward.h"
 
 extern const sd_bus_vtable bus_scope_vtable[];
 
diff --git a/src/core/dbus-service.c b/src/core/dbus-service.c
index 20ed478068d..6c1866859d9 100644
--- a/src/core/dbus-service.c
+++ b/src/core/dbus-service.c
@@ -1,32 +1,35 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include <fcntl.h>
+#include <sys/stat.h>
+#include <sys/sysmacros.h>
 
 #include "alloc-util.h"
 #include "async.h"
 #include "bus-common-errors.h"
 #include "bus-get-properties.h"
+#include "constants.h"
 #include "dbus-cgroup.h"
 #include "dbus-execute.h"
 #include "dbus-kill.h"
 #include "dbus-manager.h"
 #include "dbus-service.h"
 #include "dbus-util.h"
-#include "exec-credential.h"
+#include "dissect-image.h"
 #include "execute.h"
 #include "exit-status.h"
 #include "fd-util.h"
-#include "fileio.h"
+#include "glyph-util.h"
 #include "locale-util.h"
+#include "manager.h"
 #include "missing_fcntl.h"
+#include "mount-util.h"
 #include "open-file.h"
-#include "parse-util.h"
 #include "path-util.h"
 #include "selinux-access.h"
 #include "service.h"
 #include "signal-util.h"
 #include "string-util.h"
-#include "strv.h"
 #include "unit.h"
 
 static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_type, service_type, ServiceType);
diff --git a/src/core/dbus-service.h b/src/core/dbus-service.h
index aea6cf77f30..3977a3af494 100644
--- a/src/core/dbus-service.h
+++ b/src/core/dbus-service.h
@@ -1,10 +1,9 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "sd-bus.h"
 #include "sd-bus-vtable.h"
 
-#include "unit.h"
+#include "core-forward.h"
 
 extern const sd_bus_vtable bus_service_vtable[];
 
diff --git a/src/core/dbus-slice.c b/src/core/dbus-slice.c
index d6b2b5f3b77..e504665cce7 100644
--- a/src/core/dbus-slice.c
+++ b/src/core/dbus-slice.c
@@ -5,6 +5,7 @@
 #include "dbus-slice.h"
 #include "dbus-util.h"
 #include "slice.h"
+#include "string-util.h"
 #include "unit.h"
 
 static int property_get_currently_active(
diff --git a/src/core/dbus-slice.h b/src/core/dbus-slice.h
index eb71916abda..7a11379a2c2 100644
--- a/src/core/dbus-slice.h
+++ b/src/core/dbus-slice.h
@@ -1,10 +1,9 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "sd-bus.h"
 #include "sd-bus-vtable.h"
 
-#include "unit.h"
+#include "core-forward.h"
 
 extern const sd_bus_vtable bus_slice_vtable[];
 
diff --git a/src/core/dbus-socket.c b/src/core/dbus-socket.c
index 545bef5af51..5781fb59f32 100644
--- a/src/core/dbus-socket.c
+++ b/src/core/dbus-socket.c
@@ -9,12 +9,12 @@
 #include "dbus-util.h"
 #include "fd-util.h"
 #include "ip-protocol-list.h"
-#include "parse-util.h"
 #include "path-util.h"
 #include "socket.h"
 #include "socket-netlink.h"
 #include "socket-util.h"
 #include "string-util.h"
+#include "strv.h"
 #include "unit.h"
 
 static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_result, socket_result, SocketResult);
diff --git a/src/core/dbus-socket.h b/src/core/dbus-socket.h
index f9f36a24485..e638c39cf7d 100644
--- a/src/core/dbus-socket.h
+++ b/src/core/dbus-socket.h
@@ -1,10 +1,9 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "sd-bus.h"
 #include "sd-bus-vtable.h"
 
-#include "unit.h"
+#include "core-forward.h"
 
 extern const sd_bus_vtable bus_socket_vtable[];
 
diff --git a/src/core/dbus-swap.c b/src/core/dbus-swap.c
index dbcc5a3621c..e733675f0f0 100644
--- a/src/core/dbus-swap.c
+++ b/src/core/dbus-swap.c
@@ -7,7 +7,6 @@
 #include "dbus-cgroup.h"
 #include "dbus-execute.h"
 #include "dbus-swap.h"
-#include "string-util.h"
 #include "swap.h"
 #include "unit.h"
 
diff --git a/src/core/dbus-swap.h b/src/core/dbus-swap.h
index 9d651b56542..485bf33e650 100644
--- a/src/core/dbus-swap.h
+++ b/src/core/dbus-swap.h
@@ -5,10 +5,9 @@
   Copyright © 2010 Maarten Lankhorst
 ***/
 
-#include "sd-bus.h"
 #include "sd-bus-vtable.h"
 
-#include "unit.h"
+#include "core-forward.h"
 
 extern const sd_bus_vtable bus_swap_vtable[];
 
diff --git a/src/core/dbus-target.c b/src/core/dbus-target.c
index e979fb7267e..26e7a5376ec 100644
--- a/src/core/dbus-target.c
+++ b/src/core/dbus-target.c
@@ -1,7 +1,6 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include "dbus-target.h"
-#include "unit.h"
 
 const sd_bus_vtable bus_target_vtable[] = {
         SD_BUS_VTABLE_START(0),
diff --git a/src/core/dbus-timer.c b/src/core/dbus-timer.c
index b9d0c16acd8..4c7d8cd80a2 100644
--- a/src/core/dbus-timer.c
+++ b/src/core/dbus-timer.c
@@ -2,8 +2,10 @@
 
 #include "alloc-util.h"
 #include "bus-get-properties.h"
+#include "calendarspec.h"
 #include "dbus-timer.h"
 #include "dbus-util.h"
+#include "string-util.h"
 #include "strv.h"
 #include "timer.h"
 #include "unit.h"
diff --git a/src/core/dbus-timer.h b/src/core/dbus-timer.h
index ac436f15aa8..52f2153cbc3 100644
--- a/src/core/dbus-timer.h
+++ b/src/core/dbus-timer.h
@@ -1,10 +1,9 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "sd-bus.h"
 #include "sd-bus-vtable.h"
 
-#include "unit.h"
+#include "core-forward.h"
 
 extern const sd_bus_vtable bus_timer_vtable[];
 
diff --git a/src/core/dbus-unit.c b/src/core/dbus-unit.c
index 4f45b7c34ed..8d8169df55e 100644
--- a/src/core/dbus-unit.c
+++ b/src/core/dbus-unit.c
@@ -4,10 +4,8 @@
 
 #include "alloc-util.h"
 #include "bitfield.h"
-#include "bpf-firewall.h"
 #include "bus-common-errors.h"
 #include "bus-get-properties.h"
-#include "bus-polkit.h"
 #include "bus-util.h"
 #include "cgroup-util.h"
 #include "condition.h"
@@ -17,19 +15,23 @@
 #include "dbus-unit.h"
 #include "dbus-util.h"
 #include "fd-util.h"
+#include "format-util.h"
 #include "install.h"
 #include "locale-util.h"
 #include "log.h"
+#include "manager.h"
+#include "namespace-util.h"
 #include "path-util.h"
 #include "process-util.h"
 #include "selinux-access.h"
 #include "service.h"
+#include "set.h"
 #include "signal-util.h"
 #include "special.h"
-#include "string-table.h"
 #include "string-util.h"
 #include "strv.h"
-#include "user-util.h"
+#include "transaction.h"
+#include "unit-name.h"
 #include "web-util.h"
 
 static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_collect_mode, collect_mode, CollectMode);
diff --git a/src/core/dbus-unit.h b/src/core/dbus-unit.h
index 9cf2cbf878d..9b879b11beb 100644
--- a/src/core/dbus-unit.h
+++ b/src/core/dbus-unit.h
@@ -1,9 +1,9 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "sd-bus.h"
+#include "sd-bus-vtable.h"
 
-#include "unit.h"
+#include "core-forward.h"
 
 extern const sd_bus_vtable bus_unit_vtable[];
 extern const sd_bus_vtable bus_unit_cgroup_vtable[];
diff --git a/src/core/dbus-util.c b/src/core/dbus-util.c
index b7578307134..7db4434582a 100644
--- a/src/core/dbus-util.c
+++ b/src/core/dbus-util.c
@@ -1,15 +1,14 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include "bus-polkit.h"
-#include "bus-util.h"
 #include "dbus-util.h"
+#include "dissect-image.h"
 #include "escape.h"
 #include "manager.h"
-#include "parse-util.h"
 #include "path-util.h"
 #include "reboot-util.h"
+#include "strv.h"
 #include "unit.h"
-#include "unit-printf.h"
 #include "user-util.h"
 
 int bus_property_get_triggered_unit(
@@ -120,7 +119,7 @@ int bus_set_transient_tristate(
         return 1;
 }
 
-int bus_set_transient_usec_internal(
+static int bus_set_transient_usec_internal(
                 Unit *u,
                 const char *name,
                 usec_t *p,
@@ -151,6 +150,14 @@ int bus_set_transient_usec_internal(
         return 1;
 }
 
+int bus_set_transient_usec(Unit *u, const char *name, usec_t *p, sd_bus_message *message, UnitWriteFlags flags, sd_bus_error *error) {
+        return bus_set_transient_usec_internal(u, name, p, false, message, flags, error);
+}
+
+int bus_set_transient_usec_fix_0(Unit *u, const char *name, usec_t *p, sd_bus_message *message, UnitWriteFlags flags, sd_bus_error *error) {
+        return bus_set_transient_usec_internal(u, name, p, true, message, flags, error);
+}
+
 int bus_verify_manage_units_async_impl(
                 Manager *manager,
                 const char *id,
@@ -193,6 +200,15 @@ int bus_verify_manage_units_async_impl(
                         error);
 }
 
+int bus_verify_manage_units_async_full(Unit *u, const char *verb, const char *polkit_message, sd_bus_message *call, sd_bus_error *error) {
+        assert(u);
+        return bus_verify_manage_units_async_impl(u->manager, u->id, verb, polkit_message, call, error);
+}
+
+int bus_verify_manage_units_async(Manager *manager, sd_bus_message *call, sd_bus_error *error) {
+        return bus_verify_manage_units_async_impl(manager, NULL, NULL, NULL, call, error);
+}
+
 int bus_verify_manage_unit_files_async(Manager *m, sd_bus_message *call, sd_bus_error *error) {
         assert(m);
         assert(call);
diff --git a/src/core/dbus-util.h b/src/core/dbus-util.h
index 471c64acb65..f28a1ca7256 100644
--- a/src/core/dbus-util.h
+++ b/src/core/dbus-util.h
@@ -3,7 +3,8 @@
 
 #include "sd-bus.h"
 
-#include "dissect-image.h"
+#include "core-forward.h"
+#include "string-util.h"
 #include "unit.h"
 
 int bus_property_get_triggered_unit(sd_bus *bus, const char *path, const char *interface, const char *property, sd_bus_message *reply, void *userdata, sd_bus_error *error);
@@ -243,22 +244,11 @@ int bus_set_transient_reboot_parameter(Unit *u, const char *name, char **p, sd_b
 int bus_set_transient_string(Unit *u, const char *name, char **p, sd_bus_message *message, UnitWriteFlags flags, sd_bus_error *error);
 int bus_set_transient_bool(Unit *u, const char *name, bool *p, sd_bus_message *message, UnitWriteFlags flags, sd_bus_error *error);
 int bus_set_transient_tristate(Unit *u, const char *name, int *p, sd_bus_message *message, UnitWriteFlags flags, sd_bus_error *error);
-int bus_set_transient_usec_internal(Unit *u, const char *name, usec_t *p, bool fix_0, sd_bus_message *message, UnitWriteFlags flags, sd_bus_error *error);
-static inline int bus_set_transient_usec(Unit *u, const char *name, usec_t *p, sd_bus_message *message, UnitWriteFlags flags, sd_bus_error *error) {
-        return bus_set_transient_usec_internal(u, name, p, false, message, flags, error);
-}
-static inline int bus_set_transient_usec_fix_0(Unit *u, const char *name, usec_t *p, sd_bus_message *message, UnitWriteFlags flags, sd_bus_error *error) {
-        return bus_set_transient_usec_internal(u, name, p, true, message, flags, error);
-}
-
+int bus_set_transient_usec(Unit *u, const char *name, usec_t *p, sd_bus_message *message, UnitWriteFlags flags, sd_bus_error *error);
+int bus_set_transient_usec_fix_0(Unit *u, const char *name, usec_t *p, sd_bus_message *message, UnitWriteFlags flags, sd_bus_error *error);
 int bus_verify_manage_units_async_impl(Manager *manager, const char *id, const char *verb, const char *polkit_message, sd_bus_message *call, sd_bus_error *error);
-static inline int bus_verify_manage_units_async_full(Unit *u, const char *verb, const char *polkit_message, sd_bus_message *call, sd_bus_error *error) {
-        assert(u);
-        return bus_verify_manage_units_async_impl(u->manager, u->id, verb, polkit_message, call, error);
-}
-static inline int bus_verify_manage_units_async(Manager *manager, sd_bus_message *call, sd_bus_error *error) {
-        return bus_verify_manage_units_async_impl(manager, NULL, NULL, NULL, call, error);
-}
+int bus_verify_manage_units_async_full(Unit *u, const char *verb, const char *polkit_message, sd_bus_message *call, sd_bus_error *error);
+int bus_verify_manage_units_async(Manager *manager, sd_bus_message *call, sd_bus_error *error);
 int bus_verify_manage_unit_files_async(Manager *m, sd_bus_message *call, sd_bus_error *error);
 int bus_verify_reload_daemon_async(Manager *m, sd_bus_message *call, sd_bus_error *error);
 int bus_verify_set_environment_async(Manager *m, sd_bus_message *call, sd_bus_error *error);
diff --git a/src/core/dbus.c b/src/core/dbus.c
index 0c3c124ce96..cb167fa2c18 100644
--- a/src/core/dbus.c
+++ b/src/core/dbus.c
@@ -1,7 +1,5 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <errno.h>
-#include <sys/epoll.h>
 #include <unistd.h>
 
 #include "sd-bus.h"
@@ -11,7 +9,7 @@
 #include "bus-common-errors.h"
 #include "bus-error.h"
 #include "bus-internal.h"
-#include "bus-polkit.h"
+#include "bus-object.h"
 #include "bus-util.h"
 #include "dbus.h"
 #include "dbus-automount.h"
@@ -31,19 +29,23 @@
 #include "dbus-target.h"
 #include "dbus-timer.h"
 #include "dbus-unit.h"
+#include "errno-util.h"
 #include "fd-util.h"
+#include "fdset.h"
+#include "format-util.h"
 #include "fs-util.h"
 #include "log.h"
+#include "manager.h"
+#include "path-util.h"
+#include "pidref.h"
 #include "process-util.h"
 #include "selinux-access.h"
 #include "serialize.h"
-#include "service.h"
+#include "set.h"
 #include "special.h"
 #include "string-util.h"
 #include "strv.h"
-#include "strxcpyx.h"
 #include "umask-util.h"
-#include "user-util.h"
 
 #define CONNECTIONS_MAX 4096
 
diff --git a/src/core/dbus.h b/src/core/dbus.h
index a362a652af0..03d94af36cd 100644
--- a/src/core/dbus.h
+++ b/src/core/dbus.h
@@ -1,11 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "sd-bus.h"
-
-#include "fdset.h"
-
-typedef struct Manager Manager;
+#include "core-forward.h"
 
 void bus_send_pending_reload_message(Manager *m);
 
diff --git a/src/core/device.c b/src/core/device.c
index 97124645711..8afca1236e8 100644
--- a/src/core/device.c
+++ b/src/core/device.c
@@ -1,25 +1,23 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <errno.h>
-#include <sys/epoll.h>
-
+#include "sd-bus.h"
 #include "sd-messages.h"
 
 #include "alloc-util.h"
 #include "bus-common-errors.h"
-#include "dbus-device.h"
 #include "dbus-unit.h"
 #include "device.h"
 #include "device-private.h"
 #include "device-util.h"
+#include "extract-word.h"
+#include "hashmap.h"
 #include "log.h"
 #include "manager.h"
-#include "parse-util.h"
 #include "path-util.h"
-#include "ratelimit.h"
 #include "serialize.h"
-#include "stat-util.h"
+#include "set.h"
 #include "string-util.h"
+#include "strv.h"
 #include "swap.h"
 #include "udev-util.h"
 #include "unit.h"
diff --git a/src/core/device.h b/src/core/device.h
index 6f42cfa93ab..9bcbece4296 100644
--- a/src/core/device.h
+++ b/src/core/device.h
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include "core-forward.h"
 #include "unit.h"
 
 /* A mask specifying where we have seen the device currently. This is a bitmask because the device might show up
diff --git a/src/core/dynamic-user.c b/src/core/dynamic-user.c
index d21c709de73..e69f6557a5a 100644
--- a/src/core/dynamic-user.c
+++ b/src/core/dynamic-user.c
@@ -1,25 +1,27 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
+#include <grp.h>
 #include <sys/file.h>
 #include <sys/stat.h>
-#include <sys/types.h>
 
 #include "clean-ipc.h"
 #include "dynamic-user.h"
+#include "errno-list.h"
+#include "extract-word.h"
 #include "fd-util.h"
+#include "fdset.h"
 #include "fileio.h"
 #include "format-util.h"
-#include "fs-util.h"
+#include "hashmap.h"
 #include "iovec-util.h"
 #include "lock-util.h"
 #include "manager.h"
-#include "parse-util.h"
 #include "random-util.h"
 #include "serialize.h"
+#include "siphash24.h"
 #include "socket-util.h"
 #include "stdio-util.h"
 #include "string-util.h"
-#include "strv.h"
 #include "uid-classification.h"
 #include "user-util.h"
 
diff --git a/src/core/dynamic-user.h b/src/core/dynamic-user.h
index fe190cb864e..0f923edfe91 100644
--- a/src/core/dynamic-user.h
+++ b/src/core/dynamic-user.h
@@ -1,14 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <stdbool.h>
-#include <stdio.h>
-#include <sys/types.h>
-
-#include "fdset.h"
-#include "memory-util.h"
-
-typedef struct Manager Manager;
+#include "core-forward.h"
 
 /* Note that this object always allocates a pair of user and group under the same name, even if one of them isn't
  * used. This means, if you want to allocate a group and user pair, and they might have two different names, then you
diff --git a/src/core/efi-random.c b/src/core/efi-random.c
index 775f678e1c4..c10071782e2 100644
--- a/src/core/efi-random.c
+++ b/src/core/efi-random.c
@@ -1,17 +1,13 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include <fcntl.h>
-#include <unistd.h>
+#include <sys/stat.h>
 
-#include "alloc-util.h"
 #include "chattr-util.h"
 #include "efi-random.h"
 #include "efivars.h"
 #include "fd-util.h"
-#include "fs-util.h"
 #include "log.h"
-#include "random-util.h"
-#include "strv.h"
 
 void lock_down_efi_variables(void) {
         _cleanup_close_ int fd = -EBADF;
diff --git a/src/core/emergency-action.c b/src/core/emergency-action.c
index 6752926bd96..cb460d0f03d 100644
--- a/src/core/emergency-action.c
+++ b/src/core/emergency-action.c
@@ -3,15 +3,13 @@
 #include <sys/reboot.h>
 
 #include "ansi-color.h"
-#include "bus-error.h"
-#include "bus-util.h"
 #include "emergency-action.h"
 #include "manager.h"
 #include "raw-reboot.h"
 #include "reboot-util.h"
 #include "special.h"
 #include "string-table.h"
-#include "terminal-util.h"
+#include "string-util.h"
 #include "virt.h"
 
 static const char* const emergency_action_table[_EMERGENCY_ACTION_MAX] = {
diff --git a/src/core/emergency-action.h b/src/core/emergency-action.h
index d0f1898a60d..f993a5f06e5 100644
--- a/src/core/emergency-action.h
+++ b/src/core/emergency-action.h
@@ -1,12 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <errno.h>
-
-#include "macro.h"
-#include "runtime-scope.h"
-
-typedef struct Manager Manager;
+#include "core-forward.h"
 
 typedef enum EmergencyAction {
         EMERGENCY_ACTION_NONE,
diff --git a/src/core/exec-credential.c b/src/core/exec-credential.c
index 1608e4c9b07..9bc7540e5ea 100644
--- a/src/core/exec-credential.c
+++ b/src/core/exec-credential.c
@@ -4,9 +4,11 @@
 
 #include "acl-util.h"
 #include "creds-util.h"
+#include "errno-util.h"
 #include "exec-credential.h"
 #include "execute.h"
 #include "fileio.h"
+#include "fs-util.h"
 #include "glob-util.h"
 #include "io-util.h"
 #include "iovec-util.h"
@@ -15,10 +17,16 @@
 #include "mkdir-label.h"
 #include "mount-util.h"
 #include "mountpoint-util.h"
+#include "ordered-set.h"
+#include "path-lookup.h"
+#include "path-util.h"
 #include "process-util.h"
 #include "random-util.h"
 #include "recurse-dir.h"
 #include "rm-rf.h"
+#include "siphash24.h"
+#include "stat-util.h"
+#include "strv.h"
 #include "tmpfile-util.h"
 #include "user-util.h"
 
diff --git a/src/core/exec-credential.h b/src/core/exec-credential.h
index 65c9a83b359..c082d6d6f7e 100644
--- a/src/core/exec-credential.h
+++ b/src/core/exec-credential.h
@@ -1,14 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <stdbool.h>
-#include <stdint.h>
-#include <unistd.h>
-
-#include "hash-funcs.h"
-
-typedef struct ExecContext ExecContext;
-typedef struct ExecParameters ExecParameters;
+#include "core-forward.h"
 
 /* A credential configured with LoadCredential= */
 typedef struct ExecLoadCredential {
diff --git a/src/core/exec-invoke.c b/src/core/exec-invoke.c
index 8de8660b325..b27358d8dc9 100644
--- a/src/core/exec-invoke.c
+++ b/src/core/exec-invoke.c
@@ -1,8 +1,11 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
+#include <grp.h>
+#include <linux/ioprio.h>
 #include <linux/prctl.h>
 #include <linux/sched.h>
 #include <linux/securebits.h>
+#include <poll.h>
 #include <sys/eventfd.h>
 #include <sys/ioctl.h>
 #include <sys/mount.h>
@@ -10,7 +13,6 @@
 
 #if HAVE_PAM
 #include <security/pam_appl.h>
-#include <security/pam_misc.h>
 #endif
 
 #include "sd-messages.h"
@@ -24,12 +26,14 @@
 #include "bpf-restrict-fs.h"
 #include "btrfs-util.h"
 #include "capability-util.h"
-#include "cgroup.h"
 #include "cgroup-setup.h"
+#include "cgroup.h"
 #include "chase.h"
-#include "chattr-util.h"
 #include "chown-recursive.h"
+#include "constants.h"
 #include "copy.h"
+#include "coredump-util.h"
+#include "dissect-image.h"
 #include "dynamic-user.h"
 #include "env-util.h"
 #include "escape.h"
@@ -38,11 +42,11 @@
 #include "execute.h"
 #include "exit-status.h"
 #include "fd-util.h"
+#include "fs-util.h"
 #include "hexdecoct.h"
 #include "hostname-setup.h"
 #include "image-policy.h"
 #include "io-util.h"
-#include "ioprio-util.h"
 #include "iovec-util.h"
 #include "journal-send.h"
 #include "manager.h"
@@ -51,16 +55,23 @@
 #include "missing_syscall.h"
 #include "mkdir-label.h"
 #include "mount-util.h"
+#include "namespace-util.h"
+#include "nsflags.h"
+#include "open-file.h"
 #include "osc-context.h"
+#include "path-util.h"
+#include "pidref.h"
 #include "proc-cmdline.h"
 #include "process-util.h"
 #include "psi-util.h"
 #include "rlimit-util.h"
 #include "seccomp-util.h"
 #include "selinux-util.h"
+#include "set.h"
 #include "signal-util.h"
 #include "smack-util.h"
 #include "socket-util.h"
+#include "stat-util.h"
 #include "string-table.h"
 #include "strv.h"
 #include "terminal-util.h"
diff --git a/src/core/exec-invoke.h b/src/core/exec-invoke.h
index a8a3ac6e56e..d8a2320ef40 100644
--- a/src/core/exec-invoke.h
+++ b/src/core/exec-invoke.h
@@ -1,11 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-typedef struct ExecCommand ExecCommand;
-typedef struct ExecContext ExecContext;
-typedef struct ExecParameters ExecParameters;
-typedef struct ExecRuntime ExecRuntime;
-typedef struct CGroupContext CGroupContext;
+#include "core-forward.h"
 
 int exec_invoke(
                 const ExecCommand *command,
diff --git a/src/core/execute-serialize.c b/src/core/execute-serialize.c
index 2a91a6fadb1..4c10a81a04d 100644
--- a/src/core/execute-serialize.c
+++ b/src/core/execute-serialize.c
@@ -3,23 +3,31 @@
 #include "af-list.h"
 #include "capability-util.h"
 #include "cgroup.h"
-#include "cgroup-setup.h"
+#include "dissect-image.h"
 #include "dynamic-user.h"
 #include "escape.h"
 #include "exec-credential.h"
+#include "execute.h"
 #include "execute-serialize.h"
+#include "extract-word.h"
 #include "fd-util.h"
-#include "fileio.h"
 #include "hexdecoct.h"
+#include "image-policy.h"
 #include "in-addr-prefix-util.h"
+#include "log.h"
+#include "nsflags.h"
+#include "open-file.h"
+#include "ordered-set.h"
 #include "parse-helpers.h"
 #include "parse-util.h"
-#include "percent-util.h"
+#include "path-util.h"
 #include "process-util.h"
 #include "rlimit-util.h"
 #include "serialize.h"
+#include "set.h"
 #include "string-util.h"
 #include "strv.h"
+#include "time-util.h"
 
 static int exec_cgroup_context_serialize(const CGroupContext *c, FILE *f) {
         _cleanup_free_ char *disable_controllers_str = NULL, *delegate_controllers_str = NULL,
diff --git a/src/core/execute-serialize.h b/src/core/execute-serialize.h
index 89c8e09edbd..17b0159d1ef 100644
--- a/src/core/execute-serialize.h
+++ b/src/core/execute-serialize.h
@@ -1,7 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "execute.h"
+#include "core-forward.h"
 
 /* These functions serialize/deserialize for invocation purposes (i.e.: serialized object is passed to a
  * child process) rather than to save state across reload/reexec. */
diff --git a/src/core/execute.c b/src/core/execute.c
index d6fbde04e4c..8d961094730 100644
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -1,20 +1,14 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <errno.h>
 #include <fcntl.h>
 #include <linux/prctl.h>
 #include <poll.h>
-#include <sys/file.h>
 #include <sys/mman.h>
-#include <sys/personality.h>
+#include <sys/mount.h>
 #include <sys/prctl.h>
-#include <sys/shm.h>
-#include <sys/types.h>
-#include <sys/un.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
 #include <unistd.h>
-#include <utmpx.h>
-
-#include "sd-messages.h"
 
 #include "af-list.h"
 #include "alloc-util.h"
@@ -23,55 +17,51 @@
 #include "cap-list.h"
 #include "capability-util.h"
 #include "cgroup-setup.h"
-#include "constants.h"
+#include "coredump-util.h"
 #include "cpu-set-util.h"
+#include "dissect-image.h"
 #include "dynamic-user.h"
 #include "env-file.h"
 #include "env-util.h"
-#include "errno-list.h"
 #include "escape.h"
-#include "exec-credential.h"
 #include "execute.h"
 #include "execute-serialize.h"
-#include "exit-status.h"
 #include "fd-util.h"
+#include "fdset.h"
 #include "fileio.h"
 #include "format-util.h"
+#include "fs-util.h"
 #include "glob-util.h"
 #include "hexdecoct.h"
+#include "image-policy.h"
 #include "io-util.h"
 #include "ioprio-util.h"
-#include "lock-util.h"
 #include "log.h"
-#include "macro.h"
 #include "manager.h"
-#include "manager-dump.h"
-#include "memory-util.h"
-#include "missing_fs.h"
-#include "mkdir-label.h"
+#include "mkdir.h"
+#include "namespace-util.h"
 #include "namespace.h"
+#include "nsflags.h"
+#include "open-file.h"
+#include "ordered-set.h"
 #include "osc-context.h"
 #include "parse-util.h"
 #include "path-util.h"
+#include "pidref.h"
 #include "process-util.h"
 #include "rlimit-util.h"
 #include "rm-rf.h"
 #include "seccomp-util.h"
 #include "securebits-util.h"
-#include "selinux-util.h"
 #include "serialize.h"
+#include "set.h"
 #include "sort-util.h"
-#include "special.h"
-#include "stat-util.h"
 #include "string-table.h"
 #include "string-util.h"
 #include "strv.h"
 #include "syslog-util.h"
 #include "terminal-util.h"
 #include "tmpfile-util.h"
-#include "umask-util.h"
-#include "unit-serialize.h"
-#include "user-util.h"
 #include "utmp-wtmp.h"
 #include "vpick.h"
 
@@ -386,6 +376,16 @@ const char* exec_get_private_notify_socket_path(const ExecContext *context, cons
         return "/run/host/notify";
 }
 
+int exec_log_level_max(const ExecContext *context, const ExecParameters *params) {
+        assert(context);
+        assert(params);
+
+        if (params->debug_invocation)
+                return LOG_DEBUG;
+
+        return context->log_level_max < 0 ? log_get_max_level() : context->log_level_max;
+}
+
 bool exec_directory_is_private(const ExecContext *context, ExecDirectoryType type) {
         assert(context);
 
@@ -1995,6 +1995,27 @@ char** exec_context_get_restrict_filesystems(const ExecContext *c) {
 #endif
 }
 
+bool exec_context_restrict_namespaces_set(const ExecContext *c) {
+        assert(c);
+
+        return (c->restrict_namespaces & NAMESPACE_FLAGS_ALL) != NAMESPACE_FLAGS_ALL;
+}
+
+bool exec_context_restrict_filesystems_set(const ExecContext *c) {
+        assert(c);
+
+        return c->restrict_filesystems_allow_list ||
+          !set_isempty(c->restrict_filesystems);
+}
+
+bool exec_context_with_rootfs(const ExecContext *c) {
+        assert(c);
+
+        /* Checks if RootDirectory= or RootImage= are used */
+
+        return !empty_or_root(c->root_directory) || c->root_image;
+}
+
 int exec_context_has_vpicked_extensions(const ExecContext *context) {
         int r;
 
diff --git a/src/core/execute.h b/src/core/execute.h
index 1bbaac3840c..5700e7febe5 100644
--- a/src/core/execute.h
+++ b/src/core/execute.h
@@ -1,44 +1,21 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <sched.h>
-#include <stdbool.h>
-#include <stdio.h>
-#include <sys/capability.h>
-#include <sys/socket.h>
+#include "sd-id128.h"
 
 #include "bus-unit-util.h"
 #include "cgroup-util.h"
-#include "coredump-util.h"
+#include "core-forward.h"
 #include "cpu-set-util.h"
 #include "exec-util.h"
-#include "fdset.h"
 #include "list.h"
-#include "log.h"
 #include "log-context.h"
 #include "namespace.h"
-#include "nsflags.h"
 #include "numa-util.h"
-#include "open-file.h"
-#include "ordered-set.h"
-#include "path-util.h"
 #include "ratelimit.h"
 #include "rlimit-util.h"
-#include "runtime-scope.h"
-#include "set.h"
 #include "time-util.h"
 
-typedef struct CGroupContext CGroupContext;
-typedef struct ExecStatus ExecStatus;
-typedef struct ExecCommand ExecCommand;
-typedef struct ExecContext ExecContext;
-typedef struct ExecSharedRuntime ExecSharedRuntime;
-typedef struct DynamicCreds DynamicCreds;
-typedef struct ExecRuntime ExecRuntime;
-typedef struct ExecParameters ExecParameters;
-typedef struct Manager Manager;
-typedef struct Unit Unit;
-
 #define EXEC_STDIN_DATA_MAX (64U*1024U*1024U)
 
 typedef enum ExecUtmpMode {
@@ -96,29 +73,29 @@ typedef enum ExecKeyringMode {
 } ExecKeyringMode;
 
 /* Contains start and exit information about an executed command.  */
-struct ExecStatus {
+typedef struct ExecStatus {
         dual_timestamp start_timestamp;
         dual_timestamp exit_timestamp;
         dual_timestamp handoff_timestamp;
         pid_t pid;
         int code;     /* as in siginfo_t::si_code */
         int status;   /* as in siginfo_t::si_status */
-};
+} ExecStatus;
 
 /* Stores information about commands we execute. Covers both configuration settings as well as runtime data. */
-struct ExecCommand {
+typedef struct ExecCommand {
         char *path;
         char **argv;
         ExecStatus exec_status; /* Note that this is not serialized to sd-executor */
         ExecCommandFlags flags;
         LIST_FIELDS(ExecCommand, command); /* useful for chaining commands */
-};
+} ExecCommand;
 
 /* Encapsulates certain aspects of the runtime environment that is to be shared between multiple otherwise separate
  * invocations of commands. Specifically, this allows sharing of /tmp and /var/tmp data as well as network namespaces
  * between invocations of commands. This is a reference counted object, with one reference taken by each currently
  * active command invocation that wants to share this runtime. */
-struct ExecSharedRuntime {
+typedef struct ExecSharedRuntime {
         unsigned n_ref;
 
         Manager *manager;
@@ -134,9 +111,9 @@ struct ExecSharedRuntime {
 
         /* Like netns_storage_socket, but the file descriptor is referring to the IPC namespace. */
         int ipcns_storage_socket[2];
-};
+} ExecSharedRuntime;
 
-struct ExecRuntime {
+typedef struct ExecRuntime {
         ExecSharedRuntime *shared;
         DynamicCreds *dynamic_creds;
 
@@ -147,7 +124,7 @@ struct ExecRuntime {
          * the root directory or root image. The lock prevents tmpfiles from removing the ephemeral snapshot
          * until we're done using it. */
         int ephemeral_storage_socket[2];
-};
+} ExecRuntime;
 
 typedef enum ExecDirectoryType {
         EXEC_DIRECTORY_RUNTIME,
@@ -195,7 +172,7 @@ typedef enum ExecCleanMask {
 /* Encodes configuration parameters applied to invoked commands. Does not carry runtime data, but only configuration
  * changes sourced from unit files and suchlike. ExecContext objects are usually embedded into Unit objects, and do not
  * change after being loaded. */
-struct ExecContext {
+typedef struct ExecContext {
         char **environment;
         char **environment_files;
         char **pass_environment;
@@ -386,28 +363,7 @@ struct ExecContext {
         OrderedSet *import_credentials; /* ExecImportCredential */
 
         ImagePolicy *root_image_policy, *mount_image_policy, *extension_image_policy;
-};
-
-static inline bool exec_context_restrict_namespaces_set(const ExecContext *c) {
-        assert(c);
-
-        return (c->restrict_namespaces & NAMESPACE_FLAGS_ALL) != NAMESPACE_FLAGS_ALL;
-}
-
-static inline bool exec_context_restrict_filesystems_set(const ExecContext *c) {
-        assert(c);
-
-        return c->restrict_filesystems_allow_list ||
-          !set_isempty(c->restrict_filesystems);
-}
-
-static inline bool exec_context_with_rootfs(const ExecContext *c) {
-        assert(c);
-
-        /* Checks if RootDirectory= or RootImage= are used */
-
-        return !empty_or_root(c->root_directory) || c->root_image;
-}
+} ExecContext;
 
 typedef enum ExecFlags {
         EXEC_APPLY_SANDBOXING        = 1 << 0,
@@ -431,7 +387,7 @@ typedef enum ExecFlags {
 
 /* Parameters for a specific invocation of a command. This structure is put together right before a command is
  * executed. */
-struct ExecParameters {
+typedef struct ExecParameters {
         RuntimeScope runtime_scope;
 
         char **environment;
@@ -486,7 +442,7 @@ struct ExecParameters {
         char invocation_id_string[SD_ID128_STRING_MAX];
 
         bool debug_invocation;
-};
+} ExecParameters;
 
 #define EXEC_PARAMETERS_INIT(_flags)              \
         (ExecParameters) {                        \
@@ -566,6 +522,9 @@ char** exec_context_get_syscall_archs(const ExecContext *c);
 char** exec_context_get_syscall_log(const ExecContext *c);
 char** exec_context_get_address_families(const ExecContext *c);
 char** exec_context_get_restrict_filesystems(const ExecContext *c);
+bool exec_context_restrict_namespaces_set(const ExecContext *c);
+bool exec_context_restrict_filesystems_set(const ExecContext *c);
+bool exec_context_with_rootfs(const ExecContext *c);
 
 int exec_context_has_vpicked_extensions(const ExecContext *context);
 
@@ -645,15 +604,7 @@ bool exec_is_cgroup_mount_read_only(const ExecContext *context);
 
 const char* exec_get_private_notify_socket_path(const ExecContext *context, const ExecParameters *params, bool needs_sandboxing);
 
-static inline int exec_log_level_max(const ExecContext *context, const ExecParameters *params) {
-        assert(context);
-        assert(params);
-
-        if (params->debug_invocation)
-                return LOG_DEBUG;
-
-        return context->log_level_max < 0 ? log_get_max_level() : context->log_level_max;
-}
+int exec_log_level_max(const ExecContext *context, const ExecParameters *params);
 
 /* These logging macros do the same logging as those in unit.h, but using ExecContext and ExecParameters
  * instead of the unit object, so that it can be used in the sd-executor context (where the unit object is
diff --git a/src/core/executor.c b/src/core/executor.c
index 3f1cf3fe43d..68695986a31 100644
--- a/src/core/executor.c
+++ b/src/core/executor.c
@@ -1,7 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include <getopt.h>
-#include <unistd.h>
+#include <stdlib.h>
 
 #include "sd-messages.h"
 
@@ -20,6 +20,7 @@
 #include "fileio.h"
 #include "getopt-defs.h"
 #include "label-util.h"
+#include "log.h"
 #include "parse-util.h"
 #include "pretty-print.h"
 #include "selinux-util.h"
diff --git a/src/core/fuzz-execute-serialize.c b/src/core/fuzz-execute-serialize.c
index 48ddea10d7d..a0875dc35ab 100644
--- a/src/core/fuzz-execute-serialize.c
+++ b/src/core/fuzz-execute-serialize.c
@@ -18,13 +18,15 @@
  */
 
 #include <stdio.h>
+#include <stdlib.h>
 
-#include "alloc-util.h"
+#include "cgroup.h"
 #include "dynamic-user.h"
 #include "execute-serialize.h"
+#include "execute.h"
 #include "fd-util.h"
+#include "fdset.h"
 #include "fuzz.h"
-#include "service.h"
 
 static void exec_fuzz_one(FILE *f, FDSet *fdset) {
         _cleanup_(exec_params_deep_clear) ExecParameters params = EXEC_PARAMETERS_INIT(/* flags= */ 0);
diff --git a/src/core/fuzz-manager-serialize.c b/src/core/fuzz-manager-serialize.c
index ca155fd15a4..dc3d3588b56 100644
--- a/src/core/fuzz-manager-serialize.c
+++ b/src/core/fuzz-manager-serialize.c
@@ -2,12 +2,11 @@
 
 #include <stdio.h>
 
-#include "alloc-util.h"
 #include "fd-util.h"
+#include "fdset.h"
 #include "fuzz.h"
 #include "manager.h"
 #include "manager-serialize.h"
-#include "service.h"
 
 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
         _cleanup_(manager_freep) Manager *m = NULL;
diff --git a/src/core/fuzz-unit-file.c b/src/core/fuzz-unit-file.c
index d8987c9648d..3e7941f8b49 100644
--- a/src/core/fuzz-unit-file.c
+++ b/src/core/fuzz-unit-file.c
@@ -3,7 +3,6 @@
 #include "conf-parser.h"
 #include "fd-util.h"
 #include "fuzz.h"
-#include "install.h"
 #include "load-fragment.h"
 #include "manager.h"
 #include "manager-dump.h"
diff --git a/src/core/generator-setup.c b/src/core/generator-setup.c
index 7510fc3c610..d63a393d985 100644
--- a/src/core/generator-setup.c
+++ b/src/core/generator-setup.c
@@ -4,8 +4,8 @@
 
 #include "errno-util.h"
 #include "generator-setup.h"
-#include "macro.h"
 #include "mkdir-label.h"
+#include "path-lookup.h"
 #include "rm-rf.h"
 
 int lookup_paths_mkdir_generator(LookupPaths *p) {
diff --git a/src/core/generator-setup.h b/src/core/generator-setup.h
index 1cc816b3f53..57468231535 100644
--- a/src/core/generator-setup.h
+++ b/src/core/generator-setup.h
@@ -1,7 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "path-lookup.h"
+#include "forward.h"
 
 int lookup_paths_mkdir_generator(LookupPaths *p);
 void lookup_paths_trim_generator(LookupPaths *p);
diff --git a/src/core/ima-setup.c b/src/core/ima-setup.c
index 37916bb474a..bdd37a650ca 100644
--- a/src/core/ima-setup.c
+++ b/src/core/ima-setup.c
@@ -4,10 +4,7 @@
                                    TORSEC group — http://security.polito.it
 ***/
 
-#include <errno.h>
 #include <fcntl.h>
-#include <sys/stat.h>
-#include <sys/types.h>
 #include <unistd.h>
 
 #include "alloc-util.h"
diff --git a/src/core/import-creds.c b/src/core/import-creds.c
index 2603eab1d97..e146faab91e 100644
--- a/src/core/import-creds.c
+++ b/src/core/import-creds.c
@@ -1,10 +1,12 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
+#include <stdlib.h>
 #include <sys/mount.h>
 
 #include "confidential-virt.h"
 #include "copy.h"
 #include "creds-util.h"
+#include "errno-util.h"
 #include "escape.h"
 #include "fileio.h"
 #include "format-util.h"
@@ -13,6 +15,7 @@
 #include "import-creds.h"
 #include "initrd-util.h"
 #include "io-util.h"
+#include "log.h"
 #include "mkdir-label.h"
 #include "mount-util.h"
 #include "mountpoint-util.h"
@@ -21,6 +24,8 @@
 #include "proc-cmdline.h"
 #include "recurse-dir.h"
 #include "smbios11.h"
+#include "stat-util.h"
+#include "string-util.h"
 #include "strv.h"
 #include "virt.h"
 
diff --git a/src/core/ipe-setup.c b/src/core/ipe-setup.c
index 7bf4f52d047..b266a9274eb 100644
--- a/src/core/ipe-setup.c
+++ b/src/core/ipe-setup.c
@@ -10,7 +10,6 @@
 #include "fileio.h"
 #include "ipe-setup.h"
 #include "log.h"
-#include "nulstr-util.h"
 #include "path-util.h"
 #include "string-util.h"
 #include "strv.h"
diff --git a/src/core/job.c b/src/core/job.c
index c335bb1cf78..a60025cffc3 100644
--- a/src/core/job.c
+++ b/src/core/job.c
@@ -1,32 +1,28 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <errno.h>
-
-#include "sd-id128.h"
+#include "sd-bus.h"
 #include "sd-messages.h"
 
 #include "alloc-util.h"
 #include "ansi-color.h"
 #include "async.h"
 #include "cgroup.h"
+#include "condition.h"
 #include "dbus.h"
 #include "dbus-job.h"
 #include "escape.h"
-#include "fileio.h"
 #include "job.h"
 #include "log.h"
-#include "macro.h"
 #include "manager.h"
 #include "parse-util.h"
+#include "prioq.h"
 #include "serialize.h"
 #include "set.h"
 #include "sort-util.h"
 #include "special.h"
-#include "stdio-util.h"
 #include "string-table.h"
 #include "string-util.h"
 #include "strv.h"
-#include "terminal-util.h"
 #include "unit.h"
 #include "virt.h"
 
diff --git a/src/core/job.h b/src/core/job.h
index 3c1e861bbc1..d8be0b652eb 100644
--- a/src/core/job.h
+++ b/src/core/job.h
@@ -1,24 +1,8 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <stdbool.h>
-
-#include "sd-bus.h"
-#include "sd-event.h"
-
+#include "core-forward.h"
 #include "list.h"
-#include "memory-util.h"
-#include "time-util.h"
-#include "unit-dependency-atom.h"
-
-typedef struct ActivationDetails ActivationDetails;
-typedef struct Job Job;
-typedef struct JobDependency JobDependency;
-typedef enum JobType JobType;
-typedef enum JobState JobState;
-typedef enum JobResult JobResult;
-typedef struct Manager Manager;
-typedef struct Unit Unit;
 
 /* Be careful when changing the job types! Adjust job_merging_table[] accordingly! */
 enum JobType {
@@ -65,14 +49,14 @@ enum JobType {
         _JOB_TYPE_INVALID = -EINVAL,
 };
 
-enum JobState {
+typedef enum JobState {
         JOB_WAITING,
         JOB_RUNNING,
         _JOB_STATE_MAX,
         _JOB_STATE_INVALID = -EINVAL,
-};
+} JobState;
 
-enum JobResult {
+typedef enum JobResult {
         JOB_DONE,                /* Job completed successfully (or skipped due to an unmet ConditionXYZ=) */
         JOB_CANCELED,            /* Job canceled by a conflicting job installation or by explicit cancel request */
         JOB_TIMEOUT,             /* Job timeout elapsed */
@@ -88,9 +72,9 @@ enum JobResult {
         JOB_CONCURRENCY,         /* Slice the unit is in has its hard concurrency limit reached */
         _JOB_RESULT_MAX,
         _JOB_RESULT_INVALID = -EINVAL,
-};
+} JobResult;
 
-struct JobDependency {
+typedef struct JobDependency {
         /* Encodes that the 'subject' job needs the 'object' job in
          * some way. This structure is used only while building a transaction. */
         Job *subject;
@@ -101,9 +85,9 @@ struct JobDependency {
 
         bool matters:1;
         bool conflicts:1;
-};
+} JobDependency;
 
-struct Job {
+typedef struct Job {
         Manager *manager;
         Unit *unit;
 
@@ -158,7 +142,7 @@ struct Job {
         bool ref_by_private_bus:1;
 
         bool in_gc_queue:1;
-};
+} Job;
 
 Job* job_new(Unit *unit, JobType type);
 Job* job_new_raw(Unit *unit);
diff --git a/src/core/kill.c b/src/core/kill.c
index 74b1b13a8d8..07f6ecc97e9 100644
--- a/src/core/kill.c
+++ b/src/core/kill.c
@@ -1,5 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
+#include <stdio.h>
+
 #include "kill.h"
 #include "signal-util.h"
 #include "string-table.h"
diff --git a/src/core/kill.h b/src/core/kill.h
index ffa2280e609..fff6e2c2ebe 100644
--- a/src/core/kill.h
+++ b/src/core/kill.h
@@ -1,11 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <errno.h>
-#include <stdbool.h>
-#include <stdio.h>
-
-#include "macro.h"
+#include "forward.h"
 
 typedef enum KillMode {
         /* The kill mode is a property of a unit. */
diff --git a/src/core/kmod-setup.c b/src/core/kmod-setup.c
index a9a969337d8..12ce5a86e4a 100644
--- a/src/core/kmod-setup.c
+++ b/src/core/kmod-setup.c
@@ -3,13 +3,11 @@
 #include <unistd.h>
 
 #include "alloc-util.h"
-#include "bus-util.h"
 #include "capability-util.h"
 #include "efi-api.h"
 #include "fileio.h"
 #include "kmod-setup.h"
 #include "log.h"
-#include "macro.h"
 #include "module-util.h"
 #include "recurse-dir.h"
 #include "string-util.h"
diff --git a/src/core/load-dropin.c b/src/core/load-dropin.c
index a84ecb9910b..a295d7f343b 100644
--- a/src/core/load-dropin.c
+++ b/src/core/load-dropin.c
@@ -8,7 +8,6 @@
 #include "log.h"
 #include "manager.h"
 #include "stat-util.h"
-#include "string-util.h"
 #include "strv.h"
 #include "unit.h"
 #include "unit-name.h"
diff --git a/src/core/load-dropin.h b/src/core/load-dropin.h
index 864ea4f0837..308683b472f 100644
--- a/src/core/load-dropin.h
+++ b/src/core/load-dropin.h
@@ -1,9 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <stdbool.h>
-
-typedef struct Unit Unit;
+#include "core-forward.h"
 
 /* Read service data supplementary drop-in directories */
 
diff --git a/src/core/load-fragment-gperf.gperf.in b/src/core/load-fragment-gperf.gperf.in
index aeccf07d55b..1bd7c950fca 100644
--- a/src/core/load-fragment-gperf.gperf.in
+++ b/src/core/load-fragment-gperf.gperf.in
@@ -275,6 +275,7 @@ _Pragma("GCC diagnostic ignored \"-Wzero-as-null-pointer-constant\"")
 #endif
 #include <stddef.h>
 #include "all-units.h"
+#include "condition.h"
 #include "conf-parser.h"
 #include "image-policy.h"
 #include "in-addr-prefix-util.h"
diff --git a/src/core/load-fragment.c b/src/core/load-fragment.c
index 79eb1757d0e..aae9cb1d2ab 100644
--- a/src/core/load-fragment.c
+++ b/src/core/load-fragment.c
@@ -3,40 +3,37 @@
   Copyright © 2012 Holger Hans Peter Freyther
 ***/
 
-#include <errno.h>
 #include <fcntl.h>
-#include <linux/oom.h>
 #include <sched.h>
-#include <sys/resource.h>
 
+#include "sd-bus.h"
 #include "sd-messages.h"
 
 #include "af-list.h"
 #include "all-units.h"
 #include "alloc-util.h"
-#include "bpf-firewall.h"
 #include "bpf-program.h"
 #include "bpf-restrict-fs.h"
-#include "bpf-socket-bind.h"
 #include "bus-error.h"
-#include "bus-internal.h"
-#include "bus-util.h"
+#include "calendarspec.h"
 #include "cap-list.h"
 #include "capability-util.h"
 #include "cgroup-setup.h"
+#include "condition.h"
 #include "conf-parser.h"
+#include "coredump-util.h"
 #include "cpu-set-util.h"
 #include "creds-util.h"
+#include "dissect-image.h"
 #include "env-util.h"
-#include "errno-list.h"
 #include "escape.h"
 #include "exec-credential.h"
 #include "execute.h"
+#include "extract-word.h"
 #include "fd-util.h"
-#include "fileio.h"
 #include "firewall-util.h"
-#include "fs-util.h"
 #include "fstab-util.h"
+#include "hashmap.h"
 #include "hexdecoct.h"
 #include "hostname-util.h"
 #include "ioprio-util.h"
@@ -46,10 +43,12 @@
 #include "limits-util.h"
 #include "load-fragment.h"
 #include "log.h"
-#include "missing_fs.h"
+#include "manager.h"
 #include "mountpoint-util.h"
+#include "nsflags.h"
 #include "nulstr-util.h"
 #include "open-file.h"
+#include "ordered-set.h"
 #include "parse-helpers.h"
 #include "parse-util.h"
 #include "path-util.h"
@@ -60,6 +59,8 @@
 #include "seccomp-util.h"
 #include "securebits-util.h"
 #include "selinux-util.h"
+#include "set.h"
+#include "show-status.h"
 #include "signal-util.h"
 #include "socket-netlink.h"
 #include "specifier.h"
@@ -71,8 +72,6 @@
 #include "unit-name.h"
 #include "unit-printf.h"
 #include "user-util.h"
-#include "utf8.h"
-#include "varlink.h"
 #include "web-util.h"
 
 static int parse_socket_protocol(const char *s) {
diff --git a/src/core/load-fragment.h b/src/core/load-fragment.h
index 6aa8f479f5d..1d595a043bc 100644
--- a/src/core/load-fragment.h
+++ b/src/core/load-fragment.h
@@ -1,9 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "conf-parser.h"
-
-typedef struct Unit Unit;
+#include "core-forward.h"
 
 /* These functions are declared in the header to make them accessible to unit tests. */
 bool contains_instance_specifier_superset(const char *s);
diff --git a/src/core/main.c b/src/core/main.c
index cb846367c2f..640e26925ea 100644
--- a/src/core/main.c
+++ b/src/core/main.c
@@ -1,13 +1,14 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <errno.h>
 #include <fcntl.h>
 #include <getopt.h>
 #include <linux/oom.h>
+#include <stdlib.h>
 #include <sys/mount.h>
 #include <sys/prctl.h>
 #include <sys/utsname.h>
 #include <unistd.h>
+
 #if HAVE_VALGRIND_VALGRIND_H
 #  include <valgrind/valgrind.h>
 #endif
@@ -22,10 +23,8 @@
 #include "argv-util.h"
 #include "build.h"
 #include "bus-error.h"
-#include "bus-util.h"
 #include "capability-util.h"
 #include "cgroup-setup.h"
-#include "cgroup-util.h"
 #include "chase.h"
 #include "clock-util.h"
 #include "clock-warp.h"
@@ -33,25 +32,24 @@
 #include "confidential-virt.h"
 #include "constants.h"
 #include "copy.h"
+#include "coredump-util.h"
 #include "cpu-set-util.h"
 #include "crash-handler.h"
 #include "dbus.h"
 #include "dbus-manager.h"
 #include "dev-setup.h"
 #include "efi-random.h"
-#include "efivars.h"
 #include "emergency-action.h"
 #include "env-util.h"
 #include "escape.h"
-#include "exit-status.h"
 #include "fd-util.h"
 #include "fdset.h"
 #include "fileio.h"
 #include "format-util.h"
-#include "fs-util.h"
 #include "getopt-defs.h"
 #include "hexdecoct.h"
 #include "hostname-setup.h"
+#include "id128-util.h"
 #include "ima-setup.h"
 #include "import-creds.h"
 #include "initrd-util.h"
@@ -80,7 +78,6 @@
 #include "pretty-print.h"
 #include "proc-cmdline.h"
 #include "process-util.h"
-#include "psi-util.h"
 #include "random-util.h"
 #include "rlimit-util.h"
 #include "rm-rf.h"
@@ -88,6 +85,7 @@
 #include "selinux-setup.h"
 #include "selinux-util.h"
 #include "serialize.h"
+#include "set.h"
 #include "signal-util.h"
 #include "smack-setup.h"
 #include "special.h"
@@ -99,6 +97,7 @@
 #include "terminal-util.h"
 #include "time-util.h"
 #include "umask-util.h"
+#include "unit-name.h"
 #include "user-util.h"
 #include "version.h"
 #include "virt.h"
diff --git a/src/core/main.h b/src/core/main.h
index f637cbad7aa..a871d573fd2 100644
--- a/src/core/main.h
+++ b/src/core/main.h
@@ -1,8 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <stdbool.h>
-
+#include "forward.h"
 #include "crash-handler.h"
 
 extern bool arg_dump_core;
diff --git a/src/core/manager-dump.c b/src/core/manager-dump.c
index e781d191298..02275bb7ec5 100644
--- a/src/core/manager-dump.c
+++ b/src/core/manager-dump.c
@@ -1,14 +1,17 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include <fnmatch.h>
+#include <stdio.h>
+
+#include "sd-bus.h"
 
 #include "build.h"
-#include "fd-util.h"
-#include "fileio.h"
 #include "hashmap.h"
 #include "manager.h"
 #include "manager-dump.h"
 #include "memstream-util.h"
+#include "string-util.h"
+#include "strv.h"
 #include "unit-serialize.h"
 #include "version.h"
 
diff --git a/src/core/manager-dump.h b/src/core/manager-dump.h
index a02c29ad686..a6dca29711f 100644
--- a/src/core/manager-dump.h
+++ b/src/core/manager-dump.h
@@ -1,9 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <stdio.h>
-
-typedef struct Manager Manager;
+#include "core-forward.h"
 
 void manager_dump_jobs(Manager *s, FILE *f, char **patterns, const char *prefix);
 int manager_get_dump_jobs_string(Manager *m, char **patterns, const char *prefix, char **ret);
diff --git a/src/core/manager-serialize.c b/src/core/manager-serialize.c
index e0199a3727d..057ca9ad49e 100644
--- a/src/core/manager-serialize.c
+++ b/src/core/manager-serialize.c
@@ -1,19 +1,21 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include "sd-varlink.h"
-
-#include "clean-ipc.h"
+#include "alloc-util.h"
 #include "dbus.h"
 #include "dynamic-user.h"
 #include "fd-util.h"
+#include "fdset.h"
 #include "fileio.h"
 #include "format-util.h"
+#include "glyph-util.h"
+#include "hashmap.h"
 #include "initrd-util.h"
-#include "macro.h"
 #include "manager.h"
 #include "manager-serialize.h"
 #include "parse-util.h"
 #include "serialize.h"
+#include "string-util.h"
+#include "strv.h"
 #include "syslog-util.h"
 #include "unit-serialize.h"
 #include "user-util.h"
diff --git a/src/core/manager-serialize.h b/src/core/manager-serialize.h
index 7d4e8effb28..e335c6ec331 100644
--- a/src/core/manager-serialize.h
+++ b/src/core/manager-serialize.h
@@ -1,12 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <stdbool.h>
-#include <stdio.h>
-
-#include "fdset.h"
-
-typedef struct Manager Manager;
+#include "core-forward.h"
 
 #define DESTROY_IPC_FLAG (UINT32_C(1) << 31)
 
diff --git a/src/core/manager-varlink.c b/src/core/manager-varlink.c
index c38c4b1947d..8986ef8dbe2 100644
--- a/src/core/manager-varlink.c
+++ b/src/core/manager-varlink.c
@@ -2,11 +2,17 @@
 
 #include <sys/prctl.h>
 
+#include "sd-varlink.h"
+
+#include "alloc-util.h"
+#include "architecture.h"
 #include "build.h"
 #include "confidential-virt.h"
 #include "json-util.h"
 #include "manager-varlink.h"
 #include "manager.h"
+#include "set.h"
+#include "strv.h"
 #include "syslog-util.h"
 #include "taint.h"
 #include "version.h"
diff --git a/src/core/manager-varlink.h b/src/core/manager-varlink.h
index 52be44502b4..f7396e12644 100644
--- a/src/core/manager-varlink.h
+++ b/src/core/manager-varlink.h
@@ -1,7 +1,6 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "sd-json.h"
-#include "sd-varlink.h"
+#include "forward.h"
 
 int vl_method_describe_manager(sd_varlink *link, sd_json_variant *parameters, sd_varlink_method_flags_t flags, void *userdata);
diff --git a/src/core/manager.c b/src/core/manager.c
index 5b3d41596bb..893ef7677be 100644
--- a/src/core/manager.c
+++ b/src/core/manager.c
@@ -1,14 +1,11 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <errno.h>
 #include <fcntl.h>
 #include <linux/kd.h>
-#include <sys/epoll.h>
 #include <sys/inotify.h>
 #include <sys/ioctl.h>
 #include <sys/mount.h>
 #include <sys/reboot.h>
-#include <sys/timerfd.h>
 #include <sys/wait.h>
 #include <unistd.h>
 
@@ -18,24 +15,23 @@
 
 #include "all-units.h"
 #include "alloc-util.h"
+#include "architecture.h"
 #include "audit-fd.h"
 #include "boot-timestamps.h"
+#include "bpf-restrict-fs.h"
 #include "build-path.h"
 #include "bus-common-errors.h"
 #include "bus-error.h"
-#include "bus-kernel.h"
-#include "bus-util.h"
 #include "clean-ipc.h"
-#include "clock-util.h"
 #include "common-signal.h"
 #include "confidential-virt.h"
 #include "constants.h"
 #include "creds-util.h"
 #include "daemon-util.h"
-#include "dbus.h"
 #include "dbus-job.h"
 #include "dbus-manager.h"
 #include "dbus-unit.h"
+#include "dbus.h"
 #include "dirent-util.h"
 #include "dynamic-user.h"
 #include "env-util.h"
@@ -45,7 +41,9 @@
 #include "execute.h"
 #include "exit-status.h"
 #include "fd-util.h"
-#include "fileio.h"
+#include "fdset.h"
+#include "format-util.h"
+#include "fs-util.h"
 #include "generator-setup.h"
 #include "hashmap.h"
 #include "initrd-util.h"
@@ -58,20 +56,18 @@
 #include "load-fragment.h"
 #include "locale-setup.h"
 #include "log.h"
-#include "macro.h"
-#include "manager.h"
 #include "manager-dump.h"
 #include "manager-serialize.h"
-#include "memory-util.h"
+#include "manager.h"
 #include "mkdir-label.h"
 #include "mount-util.h"
 #include "notify-recv.h"
-#include "os-util.h"
 #include "parse-util.h"
 #include "path-lookup.h"
 #include "path-util.h"
 #include "plymouth-util.h"
 #include "pretty-print.h"
+#include "prioq.h"
 #include "process-util.h"
 #include "psi-util.h"
 #include "ratelimit.h"
@@ -79,6 +75,7 @@
 #include "rm-rf.h"
 #include "selinux-util.h"
 #include "serialize.h"
+#include "set.h"
 #include "signal-util.h"
 #include "socket-util.h"
 #include "special.h"
@@ -93,7 +90,6 @@
 #include "terminal-util.h"
 #include "time-util.h"
 #include "transaction.h"
-#include "uid-range.h"
 #include "umask-util.h"
 #include "unit-name.h"
 #include "user-util.h"
@@ -866,6 +862,10 @@ static int compare_job_priority(const void *a, const void *b) {
         return unit_compare_priority(x->unit, y->unit);
 }
 
+usec_t manager_default_timeout(RuntimeScope scope) {
+        return scope == RUNTIME_SCOPE_SYSTEM ? DEFAULT_TIMEOUT_USEC : DEFAULT_USER_TIMEOUT_USEC;
+}
+
 int manager_new(RuntimeScope runtime_scope, ManagerTestRunFlags test_run_flags, Manager **ret) {
         _cleanup_(manager_freep) Manager *m = NULL;
         int r;
@@ -2154,6 +2154,17 @@ int manager_add_job_full(
         return 0;
 }
 
+int manager_add_job(
+        Manager *m,
+        JobType type,
+        Unit *unit,
+        JobMode mode,
+        sd_bus_error *error,
+        Job **ret) {
+
+        return manager_add_job_full(m, type, unit, mode, 0, NULL, error, ret);
+}
+
 int manager_add_job_by_name(Manager *m, JobType type, const char *name, JobMode mode, Set *affected_jobs, sd_bus_error *e, Job **ret) {
         Unit *unit = NULL;  /* just to appease gcc, initialization is not really necessary */
         int r;
diff --git a/src/core/manager.h b/src/core/manager.h
index 31b4b59c0bc..ebb50af5a12 100644
--- a/src/core/manager.h
+++ b/src/core/manager.h
@@ -1,30 +1,15 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <stdbool.h>
-#include <stdio.h>
-
-#include "sd-bus.h"
-#include "sd-device.h"
 #include "sd-event.h"
-#include "sd-varlink.h"
 
 #include "cgroup.h"
-#include "cgroup-util.h"
 #include "common-signal.h"
-#include "emergency-action.h"
 #include "execute.h"
-#include "fdset.h"
-#include "hashmap.h"
-#include "job.h"
-#include "list.h"
-#include "path-lookup.h"
-#include "prioq.h"
-#include "ratelimit.h"
+#include "forward.h"
+#include "log.h"
 #include "show-status.h"
-#include "transaction.h"
 #include "unit.h"
-#include "unit-name.h"
 
 struct libmnt_monitor;
 
@@ -39,8 +24,6 @@ enum {
 
 assert_cc((int) _MANAGER_SIGNAL_COMMAND_MAX <= (int) _COMMON_SIGNAL_COMMAND_PRIVATE_END);
 
-typedef struct Manager Manager;
-
 /* An externally visible state. We don't actually maintain this as state variable, but derive it from various fields
  * when requested */
 typedef enum ManagerState {
@@ -169,7 +152,7 @@ typedef struct UnitDefaults {
         struct rlimit *rlimit[_RLIMIT_MAX];
 } UnitDefaults;
 
-struct Manager {
+typedef struct Manager {
         /* Note that the set of units we know of is allowed to be
          * inconsistent. However the subset of it that is loaded may
          * not, and the list of jobs may neither. */
@@ -495,7 +478,7 @@ struct Manager {
 
         /* Original ambient capabilities when we were initialized */
         uint64_t saved_ambient_set;
-};
+} Manager;
 
 static inline usec_t manager_default_timeout_abort_usec(Manager *m) {
         assert(m);
@@ -516,9 +499,7 @@ static inline usec_t manager_default_timeout_abort_usec(Manager *m) {
 
 #define MANAGER_IS_TEST_RUN(m) ((m)->test_run_flags != 0)
 
-static inline usec_t manager_default_timeout(RuntimeScope scope) {
-        return scope == RUNTIME_SCOPE_SYSTEM ? DEFAULT_TIMEOUT_USEC : DEFAULT_USER_TIMEOUT_USEC;
-}
+usec_t manager_default_timeout(RuntimeScope scope);
 
 int manager_new(RuntimeScope scope, ManagerTestRunFlags test_run_flags, Manager **m);
 Manager* manager_free(Manager *m);
@@ -546,15 +527,14 @@ int manager_add_job_full(
                 Set *affected_jobs,
                 sd_bus_error *error,
                 Job **ret);
-static inline int manager_add_job(
+int manager_add_job(
                 Manager *m,
                 JobType type,
                 Unit *unit,
                 JobMode mode,
                 sd_bus_error *error,
-                Job **ret) {
-        return manager_add_job_full(m, type, unit, mode, 0, NULL, error, ret);
-}
+                Job **ret);
+
 int manager_add_job_by_name(Manager *m, JobType type, const char *name, JobMode mode, Set *affected_jobs, sd_bus_error *e, Job **ret);
 int manager_add_job_by_name_and_warn(Manager *m, JobType type, const char *name, JobMode mode, Set *affected_jobs, Job **ret);
 int manager_propagate_reload(Manager *m, Unit *unit, JobMode mode, sd_bus_error *e);
diff --git a/src/core/mount.c b/src/core/mount.c
index d7211de0249..8797dcce180 100644
--- a/src/core/mount.c
+++ b/src/core/mount.c
@@ -1,9 +1,9 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <errno.h>
 #include <signal.h>
 #include <stdio.h>
-#include <sys/epoll.h>
+#include <stdlib.h>
+#include <sys/socket.h>
 
 #include "sd-messages.h"
 
@@ -12,17 +12,19 @@
 #include "dbus-mount.h"
 #include "dbus-unit.h"
 #include "device.h"
+#include "errno-util.h"
 #include "exec-credential.h"
 #include "exit-status.h"
 #include "fd-util.h"
 #include "format-util.h"
-#include "fs-util.h"
 #include "fstab-util.h"
+#include "glyph-util.h"
 #include "initrd-util.h"
 #include "libmount-util.h"
 #include "log.h"
 #include "manager.h"
 #include "mkdir-label.h"
+#include "mount-util.h"
 #include "mount.h"
 #include "mount-setup.h"
 #include "mountpoint-util.h"
@@ -30,6 +32,7 @@
 #include "path-util.h"
 #include "process-util.h"
 #include "serialize.h"
+#include "set.h"
 #include "special.h"
 #include "stat-util.h"
 #include "string-table.h"
diff --git a/src/core/mount.h b/src/core/mount.h
index c754ae7933a..9aaef8dd391 100644
--- a/src/core/mount.h
+++ b/src/core/mount.h
@@ -1,6 +1,9 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include "cgroup.h"
+#include "core-forward.h"
+#include "execute.h"
 #include "kill.h"
 #include "pidref.h"
 #include "unit.h"
diff --git a/src/core/namespace.c b/src/core/namespace.c
index b21a8d25e13..8ced4ead2e8 100644
--- a/src/core/namespace.c
+++ b/src/core/namespace.c
@@ -1,9 +1,9 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <errno.h>
 #include <linux/loop.h>
 #include <sched.h>
 #include <stdio.h>
+#include <stdlib.h>
 #include <sys/file.h>
 #include <sys/mount.h>
 #include <unistd.h>
@@ -13,11 +13,13 @@
 #include "chase.h"
 #include "dev-setup.h"
 #include "devnum-util.h"
-#include "env-util.h"
+#include "dissect-image.h"
+#include "errno-util.h"
 #include "escape.h"
 #include "extension-util.h"
 #include "fd-util.h"
 #include "format-util.h"
+#include "fs-util.h"
 #include "glyph-util.h"
 #include "label-util.h"
 #include "list.h"
@@ -26,7 +28,6 @@
 #include "loop-util.h"
 #include "loopback-setup.h"
 #include "missing_magic.h"
-#include "missing_syscall.h"
 #include "mkdir-label.h"
 #include "mount-util.h"
 #include "mountpoint-util.h"
@@ -3180,6 +3181,13 @@ static int setup_one_tmp_dir(const char *id, const char *prefix, char **path, ch
         return 0;
 }
 
+char* namespace_cleanup_tmpdir(char *p) {
+        PROTECT_ERRNO;
+        if (!streq_ptr(p, RUN_SYSTEMD_EMPTY))
+                (void) rmdir(p);
+        return mfree(p);
+}
+
 int setup_tmp_dirs(const char *id, char **tmp_dir, char **var_tmp_dir) {
         _cleanup_(namespace_cleanup_tmpdirp) char *a = NULL;
         _cleanup_(rmdir_and_freep) char *a_tmp = NULL;
diff --git a/src/core/namespace.h b/src/core/namespace.h
index ced0a87e145..eadd991ed2a 100644
--- a/src/core/namespace.h
+++ b/src/core/namespace.h
@@ -5,20 +5,9 @@
   Copyright © 2016 Djalal Harouni
 ***/
 
-typedef struct NamespaceParameters NamespaceParameters;
-typedef struct BindMount BindMount;
-typedef struct TemporaryFileSystem TemporaryFileSystem;
-typedef struct MountImage MountImage;
-
-#include <stdbool.h>
-
-#include "dissect-image.h"
-#include "fs-util.h"
-#include "macro.h"
-#include "namespace-util.h"
-#include "pidref.h"
+#include "forward.h"
+#include "list.h"
 #include "runtime-scope.h"
-#include "string-util.h"
 
 typedef enum ProtectHome {
         PROTECT_HOME_NO,
@@ -95,7 +84,7 @@ typedef enum PrivatePIDs {
         _PRIVATE_PIDS_INVALID = -EINVAL,
 } PrivatePIDs;
 
-struct BindMount {
+typedef struct BindMount {
         char *source;
         char *destination;
         bool read_only;
@@ -107,12 +96,12 @@ struct BindMount {
         bool idmapped;
         uid_t uid;
         gid_t gid;
-};
+} BindMount;
 
-struct TemporaryFileSystem {
+typedef struct TemporaryFileSystem {
         char *path;
         char *options;
-};
+} TemporaryFileSystem;
 
 typedef enum MountImageType {
         MOUNT_IMAGE_DISCRETE,
@@ -121,15 +110,15 @@ typedef enum MountImageType {
         _MOUNT_IMAGE_TYPE_INVALID = -EINVAL,
 } MountImageType;
 
-struct MountImage {
+typedef struct MountImage {
         char *source;
         char *destination; /* Unused if MountImageType == MOUNT_IMAGE_EXTENSION */
         LIST_HEAD(MountOptions, mount_options);
         bool ignore_enoent;
         MountImageType type;
-};
+} MountImage;
 
-struct NamespaceParameters {
+typedef struct NamespaceParameters {
         RuntimeScope runtime_scope;
 
         const char *root_directory;
@@ -202,18 +191,13 @@ struct NamespaceParameters {
         PrivateTmp private_tmp;
         PrivateTmp private_var_tmp;
         PrivatePIDs private_pids;
-};
+} NamespaceParameters;
 
 int setup_namespace(const NamespaceParameters *p, char **reterr_path);
 
 #define RUN_SYSTEMD_EMPTY "/run/systemd/empty"
 
-static inline char* namespace_cleanup_tmpdir(char *p) {
-        PROTECT_ERRNO;
-        if (!streq_ptr(p, RUN_SYSTEMD_EMPTY))
-                (void) rmdir(p);
-        return mfree(p);
-}
+char* namespace_cleanup_tmpdir(char *p);
 DEFINE_TRIVIAL_CLEANUP_FUNC(char*, namespace_cleanup_tmpdir);
 
 int setup_tmp_dirs(
diff --git a/src/core/path.c b/src/core/path.c
index d62a83cc949..315e395ee6f 100644
--- a/src/core/path.c
+++ b/src/core/path.c
@@ -1,21 +1,19 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <errno.h>
-#include <sys/epoll.h>
 #include <sys/inotify.h>
 #include <unistd.h>
 
+#include "sd-bus.h"
+
 #include "async.h"
 #include "bus-error.h"
-#include "bus-util.h"
 #include "dbus-path.h"
 #include "dbus-unit.h"
+#include "errno-util.h"
 #include "escape.h"
 #include "event-util.h"
-#include "fd-util.h"
 #include "glob-util.h"
 #include "inotify-util.h"
-#include "macro.h"
 #include "manager.h"
 #include "mkdir-label.h"
 #include "path.h"
@@ -25,8 +23,8 @@
 #include "stat-util.h"
 #include "string-table.h"
 #include "string-util.h"
+#include "strv.h"
 #include "unit.h"
-#include "unit-name.h"
 
 static const UnitActiveState state_translation_table[_PATH_STATE_MAX] = {
         [PATH_DEAD]    = UNIT_INACTIVE,
diff --git a/src/core/path.h b/src/core/path.h
index 8a3b8b35924..b99e1826a54 100644
--- a/src/core/path.h
+++ b/src/core/path.h
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include "core-forward.h"
 #include "unit.h"
 
 typedef enum PathType {
diff --git a/src/core/scope.c b/src/core/scope.c
index 174a95c6496..cf70de573c7 100644
--- a/src/core/scope.c
+++ b/src/core/scope.c
@@ -1,27 +1,26 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <errno.h>
 #include <unistd.h>
 
-#include "alloc-util.h"
+#include "sd-bus.h"
+
 #include "cgroup-setup.h"
 #include "dbus-scope.h"
 #include "dbus-unit.h"
 #include "exit-status.h"
-#include "load-dropin.h"
 #include "log.h"
 #include "manager.h"
 #include "parse-util.h"
-#include "process-util.h"
+#include "pidref.h"
 #include "random-util.h"
 #include "scope.h"
 #include "serialize.h"
+#include "set.h"
 #include "special.h"
 #include "string-table.h"
 #include "string-util.h"
 #include "strv.h"
 #include "unit.h"
-#include "unit-name.h"
 #include "user-util.h"
 
 static const UnitActiveState state_translation_table[_SCOPE_STATE_MAX] = {
diff --git a/src/core/scope.h b/src/core/scope.h
index 27f2c83b232..06541970949 100644
--- a/src/core/scope.h
+++ b/src/core/scope.h
@@ -2,6 +2,7 @@
 #pragma once
 
 #include "cgroup.h"
+#include "core-forward.h"
 #include "kill.h"
 #include "unit.h"
 
diff --git a/src/core/selinux-access.c b/src/core/selinux-access.c
index 189bded2800..9798569cf09 100644
--- a/src/core/selinux-access.c
+++ b/src/core/selinux-access.c
@@ -4,7 +4,6 @@
 
 #if HAVE_SELINUX
 
-#include <errno.h>
 #include <selinux/avc.h>
 #include <selinux/selinux.h>
 
@@ -12,15 +11,15 @@
 
 #include "alloc-util.h"
 #include "audit-fd.h"
-#include "bus-util.h"
 #include "errno-util.h"
 #include "format-util.h"
 #include "libaudit-util.h"
 #include "log.h"
-#include "path-util.h"
 #include "selinux-util.h"
 #include "stdio-util.h"
+#include "string-util.h"
 #include "strv.h"
+#include "unit.h"
 
 static bool initialized = false;
 
@@ -172,8 +171,7 @@ static int access_init(sd_bus_error *error) {
 */
 int mac_selinux_access_check_internal(
                 sd_bus_message *message,
-                const char *unit_path,
-                const char *unit_context,
+                const Unit *unit,
                 const char *permission,
                 const char *function,
                 sd_bus_error *error) {
@@ -217,9 +215,9 @@ int mac_selinux_access_check_internal(
         if (r < 0)
                 return r;
 
-        if (unit_context) {
+        if (unit && unit->access_selinux_context) {
                 /* Nice! The unit comes with a SELinux context read from the unit file */
-                acon = unit_context;
+                acon = unit->access_selinux_context;
                 tclass = "service";
         } else {
                 /* If no unit context is known, use our own */
@@ -248,7 +246,7 @@ int mac_selinux_access_check_internal(
 
         struct audit_info audit_info = {
                 .creds = creds,
-                .path = unit_path,
+                .path = unit ? unit->fragment_path : NULL,
                 .cmdline = cl,
                 .function = function,
         };
@@ -263,7 +261,7 @@ int mac_selinux_access_check_internal(
 
         log_full_errno_zerook(LOG_DEBUG, r,
                               "SELinux access check scon=%s tcon=%s tclass=%s perm=%s state=%s function=%s path=%s cmdline=%s: %m",
-                              scon, acon, tclass, permission, enforce ? "enforcing" : "permissive", function, strna(unit_path), empty_to_na(cl));
+                              scon, acon, tclass, permission, enforce ? "enforcing" : "permissive", function, strna(unit ? unit->fragment_path : NULL), empty_to_na(cl));
         return enforce ? r : 0;
 }
 
@@ -271,8 +269,7 @@ int mac_selinux_access_check_internal(
 
 int mac_selinux_access_check_internal(
                 sd_bus_message *message,
-                const char *unit_path,
-                const char *unit_label,
+                const Unit *unit,
                 const char *permission,
                 const char *function,
                 sd_bus_error *error) {
diff --git a/src/core/selinux-access.h b/src/core/selinux-access.h
index dc8da9e97bd..9c319f20ac6 100644
--- a/src/core/selinux-access.h
+++ b/src/core/selinux-access.h
@@ -1,14 +1,12 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "sd-bus.h"
+#include "core-forward.h"
 
-#include "manager.h"
-
-int mac_selinux_access_check_internal(sd_bus_message *message, const char *unit_path, const char *unit_label, const char *permission, const char *function, sd_bus_error *error);
+int mac_selinux_access_check_internal(sd_bus_message *message, const Unit *unit, const char *permission, const char *function, sd_bus_error *error);
 
 #define mac_selinux_access_check(message, permission, error) \
-        mac_selinux_access_check_internal((message), NULL, NULL, (permission), __func__, (error))
+        mac_selinux_access_check_internal((message), NULL, (permission), __func__, (error))
 
 #define mac_selinux_unit_access_check(unit, message, permission, error) \
-        mac_selinux_access_check_internal((message), (unit)->fragment_path, (unit)->access_selinux_context, (permission), __func__, (error))
+        mac_selinux_access_check_internal((message), (unit), (permission), __func__, (error))
diff --git a/src/core/selinux-setup.c b/src/core/selinux-setup.c
index 6a08782ae8c..a24af6d1c28 100644
--- a/src/core/selinux-setup.c
+++ b/src/core/selinux-setup.c
@@ -1,7 +1,5 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <errno.h>
-#include <stdio.h>
 #include <unistd.h>
 
 #if HAVE_SELINUX
@@ -13,7 +11,6 @@
 #include "errno-util.h"
 #include "initrd-util.h"
 #include "log.h"
-#include "macro.h"
 #include "selinux-setup.h"
 #include "selinux-util.h"
 #include "string-util.h"
diff --git a/src/core/selinux-setup.h b/src/core/selinux-setup.h
index cdff51d747b..99c05650d06 100644
--- a/src/core/selinux-setup.h
+++ b/src/core/selinux-setup.h
@@ -1,6 +1,6 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <stdbool.h>
+#include "forward.h"
 
 int mac_selinux_setup(bool *loaded_policy);
diff --git a/src/core/service.c b/src/core/service.c
index cab27384abe..d5874ce3938 100644
--- a/src/core/service.c
+++ b/src/core/service.c
@@ -1,35 +1,34 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <errno.h>
 #include <math.h>
 #include <sys/stat.h>
-#include <sys/types.h>
 #include <unistd.h>
 
+#include "sd-bus.h"
 #include "sd-messages.h"
 
 #include "alloc-util.h"
 #include "async.h"
 #include "bus-common-errors.h"
 #include "bus-error.h"
-#include "bus-kernel.h"
 #include "bus-util.h"
 #include "chase.h"
-#include "constants.h"
 #include "dbus-service.h"
 #include "dbus-unit.h"
 #include "devnum-util.h"
 #include "env-util.h"
+#include "errno-util.h"
 #include "escape.h"
 #include "execute.h"
 #include "exec-credential.h"
 #include "exit-status.h"
+#include "extract-word.h"
 #include "fd-util.h"
+#include "fdset.h"
 #include "fileio.h"
 #include "format-util.h"
-#include "io-util.h"
-#include "load-dropin.h"
-#include "load-fragment.h"
+#include "glyph-util.h"
+#include "image-policy.h"
 #include "log.h"
 #include "manager.h"
 #include "missing_audit.h"
@@ -38,16 +37,17 @@
 #include "open-file.h"
 #include "parse-util.h"
 #include "path-util.h"
+#include "path.h"
 #include "pidfd-util.h"
 #include "process-util.h"
 #include "random-util.h"
-#include "runtime-scope.h"
 #include "selinux-util.h"
 #include "serialize.h"
 #include "service.h"
 #include "signal-util.h"
+#include "socket.h"
 #include "special.h"
-#include "stdio-util.h"
+#include "stat-util.h"
 #include "string-table.h"
 #include "string-util.h"
 #include "strv.h"
diff --git a/src/core/service.h b/src/core/service.h
index a542c0fb111..c81b5b7637f 100644
--- a/src/core/service.h
+++ b/src/core/service.h
@@ -1,18 +1,13 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include "cgroup.h"
+#include "core-forward.h"
 #include "exit-status.h"
 #include "kill.h"
-#include "manager.h"
-#include "open-file.h"
-#include "path.h"
 #include "pidref.h"
-#include "ratelimit.h"
-#include "socket.h"
 #include "unit.h"
 
-typedef struct Service Service;
-
 typedef enum ServiceRestart {
         SERVICE_RESTART_NO,
         SERVICE_RESTART_ON_SUCCESS,
@@ -116,7 +111,7 @@ typedef struct ServiceExtraFD {
         char *fdname;
 } ServiceExtraFD;
 
-struct Service {
+typedef struct Service {
         Unit meta;
 
         ServiceType type;
@@ -245,7 +240,7 @@ struct Service {
 
         /* The D-Bus request, we will reply once the operation is finished, so that callers can block */
         sd_bus_message *mount_request;
-};
+} Service;
 
 static inline usec_t service_timeout_abort_usec(Service *s) {
         assert(s);
diff --git a/src/core/show-status.c b/src/core/show-status.c
index 9519fb1b84e..8ba1ae11d3f 100644
--- a/src/core/show-status.c
+++ b/src/core/show-status.c
@@ -1,8 +1,6 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include <fcntl.h>
-#include <sys/stat.h>
-#include <sys/types.h>
 
 #include "alloc-util.h"
 #include "fd-util.h"
diff --git a/src/core/show-status.h b/src/core/show-status.h
index 1986985c210..38c23e6a24d 100644
--- a/src/core/show-status.h
+++ b/src/core/show-status.h
@@ -1,11 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <errno.h>
-#include <stdarg.h>
-#include <stdbool.h>
-
-#include "macro.h"
+#include "forward.h"
 
 /* Manager status */
 
diff --git a/src/core/slice.c b/src/core/slice.c
index 361ef84a38b..0ace5577b68 100644
--- a/src/core/slice.c
+++ b/src/core/slice.c
@@ -1,11 +1,10 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <errno.h>
+#include <stdio.h>
 
 #include "alloc-util.h"
 #include "dbus-slice.h"
 #include "dbus-unit.h"
-#include "fd-util.h"
 #include "log.h"
 #include "manager.h"
 #include "serialize.h"
diff --git a/src/core/slice.h b/src/core/slice.h
index 46faecc0307..2f83973b885 100644
--- a/src/core/slice.h
+++ b/src/core/slice.h
@@ -1,6 +1,8 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include "cgroup.h"
+#include "core-forward.h"
 #include "unit.h"
 
 typedef struct Slice {
diff --git a/src/core/smack-setup.c b/src/core/smack-setup.c
index 6d8acc0984f..72927eb941c 100644
--- a/src/core/smack-setup.c
+++ b/src/core/smack-setup.c
@@ -5,10 +5,8 @@
         Nathaniel Chen <nathaniel.chen@intel.com>
 ***/
 
-#include <errno.h>
 #include <fcntl.h>
 #include <stdio.h>
-#include <stdlib.h>
 #include <unistd.h>
 
 #include "sd-messages.h"
@@ -18,7 +16,6 @@
 #include "fd-util.h"
 #include "fileio.h"
 #include "log.h"
-#include "macro.h"
 #include "smack-setup.h"
 #include "string-util.h"
 
diff --git a/src/core/smack-setup.h b/src/core/smack-setup.h
index 6758f07cef9..4b7da569ca6 100644
--- a/src/core/smack-setup.h
+++ b/src/core/smack-setup.h
@@ -7,6 +7,6 @@
         Nathaniel Chen <nathaniel.chen@intel.com>
 ***/
 
-#include <stdbool.h>
+#include "forward.h"
 
 int mac_smack_setup(bool *loaded_policy);
diff --git a/src/core/socket.c b/src/core/socket.c
index 1ce6bc1ba60..f848e46d84a 100644
--- a/src/core/socket.c
+++ b/src/core/socket.c
@@ -1,35 +1,37 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include <arpa/inet.h>
-#include <errno.h>
 #include <fcntl.h>
 #include <linux/sctp.h>
 #include <mqueue.h>
 #include <netinet/tcp.h>
-#include <sys/epoll.h>
 #include <sys/stat.h>
 #include <unistd.h>
 
+#include "sd-bus.h"
+
 #include "alloc-util.h"
-#include "bpf-firewall.h"
+#include "bpf-program.h"
 #include "bus-error.h"
-#include "bus-util.h"
-#include "chase.h"
-#include "constants.h"
 #include "copy.h"
 #include "dbus-socket.h"
 #include "dbus-unit.h"
 #include "errno-list.h"
+#include "errno-util.h"
 #include "exit-status.h"
+#include "extract-word.h"
 #include "fd-util.h"
+#include "fdset.h"
 #include "format-util.h"
+#include "fs-util.h"
+#include "glyph-util.h"
 #include "in-addr-util.h"
 #include "io-util.h"
 #include "ip-protocol-list.h"
-#include "label-util.h"
 #include "log.h"
 #include "manager.h"
 #include "mkdir-label.h"
+#include "namespace-util.h"
 #include "parse-util.h"
 #include "path-util.h"
 #include "pidfd-util.h"
@@ -38,7 +40,8 @@
 #include "selinux-util.h"
 #include "serialize.h"
 #include "service.h"
-#include "signal-util.h"
+#include "set.h"
+#include "siphash24.h"
 #include "smack-util.h"
 #include "socket.h"
 #include "socket-netlink.h"
@@ -50,14 +53,14 @@
 #include "unit-name.h"
 #include "user-util.h"
 
-struct SocketPeer {
+typedef struct SocketPeer {
         unsigned n_ref;
 
         Socket *socket;
         union sockaddr_union peer;
         socklen_t peer_salen;
         struct ucred peer_cred;
-};
+} SocketPeer;
 
 static const UnitActiveState state_translation_table[_SOCKET_STATE_MAX] = {
         [SOCKET_DEAD]             = UNIT_INACTIVE,
diff --git a/src/core/socket.h b/src/core/socket.h
index 240a9ac9658..696e0490c13 100644
--- a/src/core/socket.h
+++ b/src/core/socket.h
@@ -1,13 +1,14 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include "cgroup.h"
+#include "core-forward.h"
+#include "execute.h"
+#include "list.h"
 #include "pidref.h"
 #include "socket-util.h"
 #include "unit.h"
 
-typedef struct Socket Socket;
-typedef struct SocketPeer SocketPeer;
-
 typedef enum SocketExecCommand {
         SOCKET_EXEC_START_PRE,
         SOCKET_EXEC_START_CHOWN,
@@ -65,7 +66,7 @@ typedef enum SocketTimestamping {
         _SOCKET_TIMESTAMPING_INVALID = -EINVAL,
 } SocketTimestamping;
 
-struct Socket {
+typedef struct Socket {
         Unit meta;
 
         LIST_HEAD(SocketPort, ports);
@@ -161,7 +162,7 @@ struct Socket {
 
         RateLimit trigger_limit;
         RateLimit poll_limit;
-};
+} Socket;
 
 SocketPeer *socket_peer_ref(SocketPeer *p);
 SocketPeer *socket_peer_unref(SocketPeer *p);
diff --git a/src/core/swap.c b/src/core/swap.c
index 668e1bcf6cb..27ac10e36d4 100644
--- a/src/core/swap.c
+++ b/src/core/swap.c
@@ -1,7 +1,6 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <errno.h>
-#include <sys/epoll.h>
+#include <sys/socket.h>
 #include <sys/stat.h>
 #include <unistd.h>
 
@@ -12,19 +11,22 @@
 #include "dbus-unit.h"
 #include "device.h"
 #include "device-util.h"
+#include "errno-util.h"
 #include "escape.h"
 #include "exit-status.h"
 #include "fd-util.h"
 #include "format-util.h"
 #include "fstab-util.h"
+#include "glyph-util.h"
 #include "manager.h"
-#include "parse-util.h"
 #include "path-util.h"
 #include "process-util.h"
 #include "serialize.h"
+#include "set.h"
 #include "special.h"
 #include "string-table.h"
 #include "string-util.h"
+#include "strv.h"
 #include "swap.h"
 #include "unit.h"
 #include "unit-name.h"
diff --git a/src/core/swap.h b/src/core/swap.h
index fce7ea5e56a..946a2ac55fb 100644
--- a/src/core/swap.h
+++ b/src/core/swap.h
@@ -5,8 +5,9 @@
   Copyright © 2010 Maarten Lankhorst
 ***/
 
-#include "sd-device.h"
-
+#include "cgroup.h"
+#include "core-forward.h"
+#include "execute.h"
 #include "pidref.h"
 #include "unit.h"
 
diff --git a/src/core/taint.c b/src/core/taint.c
index a6b220455c6..8872a224b25 100644
--- a/src/core/taint.c
+++ b/src/core/taint.c
@@ -3,8 +3,8 @@
 #include <sys/utsname.h>
 
 #include "alloc-util.h"
-#include "cgroup-util.h"
 #include "clock-util.h"
+#include "constants.h"
 #include "errno-util.h"
 #include "fileio.h"
 #include "fs-util.h"
diff --git a/src/core/target.c b/src/core/target.c
index f095aa19924..880f8584819 100644
--- a/src/core/target.c
+++ b/src/core/target.c
@@ -1,14 +1,13 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include "dbus-target.h"
+#include <stdio.h>
+
 #include "dbus-unit.h"
-#include "log.h"
 #include "serialize.h"
 #include "special.h"
 #include "string-util.h"
 #include "target.h"
 #include "unit.h"
-#include "unit-name.h"
 
 static const UnitActiveState state_translation_table[_TARGET_STATE_MAX] = {
         [TARGET_DEAD]   = UNIT_INACTIVE,
diff --git a/src/core/target.h b/src/core/target.h
index 9e7c77c027e..a6ed994faf4 100644
--- a/src/core/target.h
+++ b/src/core/target.h
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include "core-forward.h"
 #include "unit.h"
 
 typedef struct Target {
diff --git a/src/core/timer.c b/src/core/timer.c
index e4d831fd9be..5410cd76157 100644
--- a/src/core/timer.c
+++ b/src/core/timer.c
@@ -1,26 +1,27 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <errno.h>
+#include <stdlib.h>
 #include <sys/stat.h>
-#include <sys/types.h>
 #include <unistd.h>
 
+#include "sd-bus.h"
+
 #include "alloc-util.h"
 #include "bus-error.h"
-#include "bus-util.h"
+#include "calendarspec.h"
 #include "dbus-timer.h"
 #include "dbus-unit.h"
 #include "fs-util.h"
 #include "manager.h"
-#include "parse-util.h"
 #include "random-util.h"
 #include "serialize.h"
+#include "siphash24.h"
 #include "special.h"
 #include "string-table.h"
 #include "string-util.h"
+#include "strv.h"
 #include "timer.h"
 #include "unit.h"
-#include "unit-name.h"
 #include "user-util.h"
 #include "virt.h"
 
diff --git a/src/core/timer.h b/src/core/timer.h
index 90f19a7cf4e..759e924f3a7 100644
--- a/src/core/timer.h
+++ b/src/core/timer.h
@@ -1,7 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "calendarspec.h"
+#include "core-forward.h"
 #include "unit.h"
 
 typedef enum TimerBase {
diff --git a/src/core/transaction.c b/src/core/transaction.c
index 6d0d7e73bef..b451c906da3 100644
--- a/src/core/transaction.c
+++ b/src/core/transaction.c
@@ -1,7 +1,6 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <fcntl.h>
-#include <unistd.h>
+#include "sd-bus.h"
 
 #include "alloc-util.h"
 #include "ansi-color.h"
@@ -9,9 +8,10 @@
 #include "bus-error.h"
 #include "dbus-unit.h"
 #include "manager.h"
+#include "set.h"
 #include "slice.h"
+#include "string-util.h"
 #include "strv.h"
-#include "terminal-util.h"
 #include "transaction.h"
 
 static void transaction_unlink_job(Transaction *tr, Job *j, bool delete_dependencies);
diff --git a/src/core/transaction.h b/src/core/transaction.h
index 1f58fcebccf..4f5430d6d4a 100644
--- a/src/core/transaction.h
+++ b/src/core/transaction.h
@@ -1,8 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "hashmap.h"
-#include "job.h"
+#include "core-forward.h"
 
 typedef struct Transaction {
         /* Jobs to be added */
diff --git a/src/core/unit-dependency-atom.c b/src/core/unit-dependency-atom.c
index 06def183b97..a421fbc1de5 100644
--- a/src/core/unit-dependency-atom.c
+++ b/src/core/unit-dependency-atom.c
@@ -1,6 +1,6 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include "assert-util.h"
+#include "unit-def.h"
 #include "unit-dependency-atom.h"
 
 static const UnitDependencyAtom atom_map[_UNIT_DEPENDENCY_MAX] = {
diff --git a/src/core/unit-dependency-atom.h b/src/core/unit-dependency-atom.h
index 89a3eae1bf0..36ea729f5c6 100644
--- a/src/core/unit-dependency-atom.h
+++ b/src/core/unit-dependency-atom.h
@@ -1,9 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <errno.h>
-
-#include "unit-def.h"
+#include "forward.h"
 
 /* Flags that identify the various "atomic" behaviours a specific dependency type implies. Each dependency is
  * a combination of one or more of these flags that define what they actually entail. */
diff --git a/src/core/unit-printf.c b/src/core/unit-printf.c
index 5bce46b6257..2b35a1b2a92 100644
--- a/src/core/unit-printf.c
+++ b/src/core/unit-printf.c
@@ -3,17 +3,16 @@
 #include "sd-path.h"
 
 #include "alloc-util.h"
-#include "cgroup-util.h"
-#include "format-util.h"
-#include "macro.h"
+#include "creds-util.h"
+#include "env-util.h"
+#include "fd-util.h"
+#include "fileio.h"
 #include "manager.h"
 #include "specifier.h"
 #include "string-util.h"
-#include "strv.h"
 #include "unit.h"
 #include "unit-name.h"
 #include "unit-printf.h"
-#include "user-util.h"
 
 static int specifier_prefix_and_instance(char specifier, const void *data, const char *root, const void *userdata, char **ret) {
         const Unit *u = ASSERT_PTR(userdata);
@@ -254,3 +253,23 @@ int unit_full_printf_full(const Unit *u, const char *format, size_t max_length,
 
         return specifier_printf(format, max_length, table, NULL, u, ret);
 }
+
+int unit_full_printf(const Unit *u, const char *text, char **ret) {
+        return unit_full_printf_full(u, text, LONG_LINE_MAX, ret);
+}
+
+int unit_path_printf(const Unit *u, const char *text, char **ret) {
+        return unit_full_printf_full(u, text, PATH_MAX-1, ret);
+}
+
+int unit_fd_printf(const Unit *u, const char *text, char **ret) {
+        return unit_full_printf_full(u, text, FDNAME_MAX, ret);
+}
+
+int unit_cred_printf(const Unit *u, const char *text, char **ret) {
+        return unit_full_printf_full(u, text, CREDENTIAL_NAME_MAX, ret);
+}
+
+int unit_env_printf(const Unit *u, const char *text, char **ret) {
+        return unit_full_printf_full(u, text, sc_arg_max(), ret);
+}
diff --git a/src/core/unit-printf.h b/src/core/unit-printf.h
index 2df07db26d3..aa9ba004945 100644
--- a/src/core/unit-printf.h
+++ b/src/core/unit-printf.h
@@ -1,26 +1,12 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include "creds-util.h"
-#include "env-util.h"
-#include "fd-util.h"
-#include "fileio.h"
-#include "unit.h"
+#include "core-forward.h"
 
 int unit_name_printf(const Unit *u, const char* text, char **ret);
 int unit_full_printf_full(const Unit *u, const char *text, size_t max_length, char **ret);
-static inline int unit_full_printf(const Unit *u, const char *text, char **ret) {
-        return unit_full_printf_full(u, text, LONG_LINE_MAX, ret);
-}
-static inline int unit_path_printf(const Unit *u, const char *text, char **ret) {
-        return unit_full_printf_full(u, text, PATH_MAX-1, ret);
-}
-static inline int unit_fd_printf(const Unit *u, const char *text, char **ret) {
-        return unit_full_printf_full(u, text, FDNAME_MAX, ret);
-}
-static inline int unit_cred_printf(const Unit *u, const char *text, char **ret) {
-        return unit_full_printf_full(u, text, CREDENTIAL_NAME_MAX, ret);
-}
-static inline int unit_env_printf(const Unit *u, const char *text, char **ret) {
-        return unit_full_printf_full(u, text, sc_arg_max(), ret);
-}
+int unit_full_printf(const Unit *u, const char *text, char **ret);
+int unit_path_printf(const Unit *u, const char *text, char **ret);
+int unit_fd_printf(const Unit *u, const char *text, char **ret);
+int unit_cred_printf(const Unit *u, const char *text, char **ret);
+int unit_env_printf(const Unit *u, const char *text, char **ret);
diff --git a/src/core/unit-serialize.c b/src/core/unit-serialize.c
index a38b38590a8..76363e30239 100644
--- a/src/core/unit-serialize.c
+++ b/src/core/unit-serialize.c
@@ -1,15 +1,21 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
+#include "sd-bus.h"
+
+#include "alloc-util.h"
 #include "bitfield.h"
-#include "bpf-restrict-ifaces.h"
-#include "bpf-socket-bind.h"
-#include "bus-util.h"
+#include "cgroup.h"
+#include "condition.h"
 #include "dbus.h"
+#include "extract-word.h"
 #include "fileio.h"
 #include "format-util.h"
+#include "glyph-util.h"
 #include "parse-util.h"
 #include "serialize.h"
-#include "string-table.h"
+#include "set.h"
+#include "string-util.h"
+#include "strv.h"
 #include "unit.h"
 #include "unit-serialize.h"
 #include "user-util.h"
@@ -677,7 +683,7 @@ void unit_dump(Unit *u, FILE *f, const char *prefix) {
                         "%s\tMerged into: %s\n",
                         prefix, u->merged_into->id);
         else if (u->load_state == UNIT_ERROR) {
-                errno = abs(u->load_error);
+                errno = ABS(u->load_error);
                 fprintf(f, "%s\tLoad Error Code: %m\n", prefix);
         }
 
diff --git a/src/core/unit-serialize.h b/src/core/unit-serialize.h
index a7ac03cf823..8f12c8c991b 100644
--- a/src/core/unit-serialize.h
+++ b/src/core/unit-serialize.h
@@ -1,12 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <stdbool.h>
-#include <stdio.h>
-
-#include "fdset.h"
-
-typedef struct Unit Unit;
+#include "core-forward.h"
 
 /* These functions serialize state for our own usage, i.e.: across a reload/reexec, rather than for being
  * passed to a child process. */
diff --git a/src/core/unit.c b/src/core/unit.c
index 3845d7c39fa..bb30d704cf2 100644
--- a/src/core/unit.c
+++ b/src/core/unit.c
@@ -1,11 +1,10 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include <errno.h>
 #include <fnmatch.h>
-#include <stdlib.h>
-#include <sys/prctl.h>
+#include <linux/capability.h>
 #include <unistd.h>
 
+#include "sd-bus.h"
 #include "sd-id128.h"
 #include "sd-messages.h"
 
@@ -13,15 +12,14 @@
 #include "alloc-util.h"
 #include "ansi-color.h"
 #include "bpf-firewall.h"
-#include "bpf-foreign.h"
-#include "bpf-socket-bind.h"
+#include "bpf-restrict-fs.h"
 #include "bus-common-errors.h"
 #include "bus-internal.h"
 #include "bus-util.h"
 #include "cgroup-setup.h"
 #include "cgroup-util.h"
 #include "chase.h"
-#include "dbus.h"
+#include "condition.h"
 #include "dbus-unit.h"
 #include "dropin.h"
 #include "dynamic-user.h"
@@ -32,6 +30,7 @@
 #include "fd-util.h"
 #include "fileio.h"
 #include "format-util.h"
+#include "fs-util.h"
 #include "id128-util.h"
 #include "install.h"
 #include "iovec-util.h"
@@ -40,8 +39,9 @@
 #include "load-fragment.h"
 #include "log.h"
 #include "logarithm.h"
-#include "macro.h"
 #include "mkdir-label.h"
+#include "manager.h"
+#include "mount-util.h"
 #include "mountpoint-util.h"
 #include "path-util.h"
 #include "process-util.h"
@@ -49,25 +49,20 @@
 #include "serialize.h"
 #include "set.h"
 #include "signal-util.h"
+#include "siphash24.h"
 #include "sparse-endian.h"
 #include "special.h"
 #include "specifier.h"
 #include "stat-util.h"
-#include "stdio-util.h"
 #include "string-table.h"
 #include "string-util.h"
 #include "strv.h"
-#include "terminal-util.h"
 #include "tmpfile-util.h"
 #include "umask-util.h"
 #include "unit.h"
 #include "unit-name.h"
 #include "user-util.h"
 #include "varlink.h"
-#include "virt.h"
-#if BPF_FRAMEWORK
-#include "bpf-link.h"
-#endif
 
 /* Thresholds for logging at INFO level about resource consumption */
 #define MENTIONWORTHY_CPU_NSEC     (1 * NSEC_PER_SEC)
@@ -6068,6 +6063,24 @@ int unit_pid_attachable(Unit *u, PidRef *pid, sd_bus_error *error) {
         return 0;
 }
 
+int unit_get_log_level_max(const Unit *u) {
+        if (u) {
+                if (u->debug_invocation)
+                        return LOG_DEBUG;
+
+                ExecContext *ec = unit_get_exec_context(u);
+                if (ec && ec->log_level_max >= 0)
+                        return ec->log_level_max;
+        }
+
+        return log_get_max_level();
+}
+
+bool unit_log_level_test(const Unit *u, int level) {
+        assert(u);
+        return LOG_PRI(level) <= unit_get_log_level_max(u);
+}
+
 void unit_log_success(Unit *u) {
         assert(u);
 
diff --git a/src/core/unit.h b/src/core/unit.h
index cb6f6e070c1..f3a44fd1a11 100644
--- a/src/core/unit.h
+++ b/src/core/unit.h
@@ -1,29 +1,24 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-#include <errno.h>
-#include <stdbool.h>
-#include <stdlib.h>
-#include <sys/socket.h>
-#include <unistd.h>
-
 #include "sd-id128.h"
 
-#include "cgroup.h"
-#include "condition.h"
+#include "core-forward.h"
 #include "emergency-action.h"
 #include "execute.h"
+#include "hashmap.h"
 #include "install.h"
+#include "iterator.h"
 #include "job.h"
 #include "list.h"
+#include "log.h"
 #include "log-context.h"
-#include "mount-util.h"
-#include "pidref.h"
 #include "ratelimit.h"
+#include "time-util.h"
+#include "unit-def.h"
+#include "unit-dependency-atom.h"
 #include "unit-file.h"
 
-typedef struct UnitRef UnitRef;
-
 typedef enum UnitMountDependencyType {
         UNIT_MOUNT_WANTS,
         UNIT_MOUNT_REQUIRES,
@@ -217,14 +212,14 @@ static inline void* UNIT_DEPENDENCY_TO_PTR(UnitDependency d) {
         return INT_TO_PTR(d);
 }
 
-struct UnitRef {
+typedef struct UnitRef {
         /* Keeps tracks of references to a unit. This is useful so
          * that we can merge two units if necessary and correct all
          * references to them */
 
         Unit *source, *target;
         LIST_FIELDS(UnitRef, refs_by_target);
-};
+} UnitRef;
 
 /* The generic, dynamic definition of the unit */
 typedef struct Unit {
@@ -1018,23 +1013,9 @@ static inline bool unit_has_job_type(Unit *u, JobType type) {
         return u && u->job && u->job->type == type;
 }
 
-static inline int unit_get_log_level_max(const Unit *u) {
-        if (u) {
-                if (u->debug_invocation)
-                        return LOG_DEBUG;
-
-                ExecContext *ec = unit_get_exec_context(u);
-                if (ec && ec->log_level_max >= 0)
-                        return ec->log_level_max;
-        }
+int unit_get_log_level_max(const Unit *u);
 
-        return log_get_max_level();
-}
-
-static inline bool unit_log_level_test(const Unit *u, int level) {
-        assert(u);
-        return LOG_PRI(level) <= unit_get_log_level_max(u);
-}
+bool unit_log_level_test(const Unit *u, int level);
 
 /* unit_log_skip is for cases like ExecCondition= where a unit is considered "done"
  * after some execution, rather than succeeded or failed. */
diff --git a/src/core/varlink-common.h b/src/core/varlink-common.h
index 94a8682a218..5456bfced6b 100644
--- a/src/core/varlink-common.h
+++ b/src/core/varlink-common.h
@@ -2,7 +2,6 @@
 #pragma once
 
 #include "sd-json.h"
-#include "sd-varlink.h"
 
 int rlimit_build_json(sd_json_variant **ret, const char *name, void *userdata);
 int rlimit_table_build_json(sd_json_variant **ret, const char *name, void *userdata);
diff --git a/src/core/varlink.c b/src/core/varlink.c
index 40b988aec51..2e9be69c5e9 100644
--- a/src/core/varlink.c
+++ b/src/core/varlink.c
@@ -2,17 +2,19 @@
 
 #include "sd-varlink.h"
 
+#include "constants.h"
 #include "dynamic-user.h"
-#include "format-util.h"
+#include "errno-util.h"
 #include "json-util.h"
 #include "manager.h"
 #include "manager-varlink.h"
-#include "mkdir-label.h"
+#include "path-util.h"
+#include "pidref.h"
+#include "string-util.h"
 #include "strv.h"
 #include "unit.h"
 #include "user-util.h"
 #include "varlink.h"
-#include "varlink-internal.h"
 #include "varlink-io.systemd.Manager.h"
 #include "varlink-io.systemd.ManagedOOM.h"
 #include "varlink-io.systemd.UserDatabase.h"
diff --git a/src/core/varlink.h b/src/core/varlink.h
index e4996f01ada..72e6a2b130d 100644
--- a/src/core/varlink.h
+++ b/src/core/varlink.h
@@ -1,8 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
-typedef struct Manager Manager;
-typedef struct Unit Unit;
+#include "core-forward.h"
 
 int manager_setup_varlink_server(Manager *m);