Various pre-packaged services are "sysinit" services, started as a result of being wanted by the "sysinit" target (either directly or indirectly via a targets such as "local-fs").
The machine-id service in the sysinit services collection is an example of a sysinit service.
Its run, stop, and restart programs are all fairly straightforward and self-explanatory.
And its remain flag file causes the service to be considered a "run on empty" service by the service manager, as a target is.
This is because the meat of the service is in its start program, run when the service is brought up from being down, as happens at boot time because the service (when enabled) is wanted by the "sysinit" target.
The start program runs the setup-machine-id utility.
This utility performs boot-time actions that set up the /etc/machine-id and /run/machine-id files.
Most "sysinit" services do their work in their start programs.
Only a few, such as the the plug and play manager service and its log service, have long-lived daemon processes.
The supervise directories for most "sysinit" services live under /run, because they must be writable before the filesystem containing /etc is remounted read-write.
The service manager is told to load them, and thus needs to create their control/status API files, first thing in the bootstrap procedure.
Some "sysinit" services live in /etc/service-bundles/services.
These are the "sysinit" services that are part of, or that precede, bringing up local filesystems; loaded in parallel with (or even before) mounting /usr and /var.
Apart from the plug and play manager service, the "etc" sysinit services all use one single sysinit-log logging service. The plug and play manager service has its own logging service.
The logging services have to come up after the filesystem containint /var/log is available and writable.
Log data from the logged services sits in its input pipe until then.
The consequence of this is that too much log output from "etc" sysinit services has the potential to deadlock the system.
(Too much output from the plug and play manager service simply halts it until its log service comes up.
The plug and play manager usually isn't in the critical path for mounting /var/log read-write.)
So it is very important to minimize the amount of output generated by "etc" sysinit services.