Shouldn’t we add an explicit After=startup-tags.service to lightdm.service for correctness despite it is correctly ordered already due to Before=sysinit.target? But that could change?

Hmmm. My reasoning as a counter argument:

With the previous changes we make the promise, that normal service units can rely on basic mariux64 features by default without explicit configuration. These are: startup tags available, ip address configured (not necessarily remotes already reachable), automount-path ( /project etc ) working (if local), vlans configured, maybe more. The motivation was to make service configuration simpler to avoid errors.

A normal service (with default dependencies) like lightdm doesn't need to care or enumerate whatever it needs from the set.

I think, its generally preferable, if we have the dependency in one place only (in this case at the provider and with Before=) and not redundantly mirrored on both sides. The promise is "services can use startup tags" but the fact, that there is a service "startup-tags.service" is an implementation detail. If we change the service name to mx-startup-tags.service or put everything into a single synchronous "mx-basic.service" script or reorganize everything to use a target for the combined logic (mx-basic.target), we can just do so without changing anything at the normal service units. This would not be possible, if the details were duplicated into the normal service units.