But I do have a question: as documented, I find that when stage1's
process execs into stage2, there is a devtmpfs mounted at /dev. I don't
understand where this happens! I see where the stage 1 script mounts a
tmpfs at /run, but I don't see anything there, or in the initial s6
scandir, that mounts /dev. What am I missing?
If you created your stage 1 script with s6-linux-init-maker, and you
see nothing in your stage 1 that mounts /dev, it means that you told
s6-linux-init-maker that your kernel automounts /dev at boot time.
So, your /dev is already mounted when the kernel spawns init. The
kernel option triggering that behaviour is named CONFIG_DEVTMPFS_MOUNT.