Every program ran in harrier's own cgroup. Now each runs in app-dev.jcollie.harrier-<pid>.scope, a transient scope the user's systemd creates. That scope accounts for the program and everything it starts, can limit them, and is what systemd-oomd kills under memory pressure, apart from harrier and from the other terminals. The forked child waits on a pipe before it execs. Meanwhile harrier calls StartTransientUnit on the session bus, waits until /proc/<pid>/cgroup shows the move, then lets the child go. The program starts in the scope instead of being moved there while running. cgroup.memory_high and cgroup.tasks_max set MemoryHigh and TasksMax. Every scope gets ManagedOOMMemoryPressure=kill and CollectMode= inactive-or-failed. Without systemd, a program runs in harrier's own cgroup with one warning, unless cgroup.required is set. cgroup.enabled = false turns scopes off. The first window's scope costs about 10 ms. The sway VM test checks that a program starts in its scope with the configured limits, that harrier stays outside it, and that the scope goes away with the program. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KaBaVYY8vv3qA6sgbQBuZT