Thanks again to this
@ASentientBot method:
Replacing BigSur Beta Assets bundle in macOS Install Data
I understood more how OTA updates and any full stage 2 installer (that are almost identical), are handled by apple:
when the "macOS Install Data" is ready prepared, in nvram it sets bootable that temporary volume with label "macOS Installer", booting from there the ramdisk used is at this path:
/macOS Install Data/BaseSystem.chunklist
/macOS Install Data/BaseSystem.dmg
/macOS Install Data/Locked Files/BootKernelExtensions.kc
/macOS Install Data/Locked Files/Boot Files/boot.efi
Moreover there is also com.apple.Boot.plist:
https://github.com/jacklukem/BigSurfixes/blob/master/legacyusb installer fix/com.apple.Boot.plist
Note I edited it as generic
BigSurDataUUID
that is your APFS Data Volume UUID different for any machine.
diskutil info diskXs1 | grep UUID
or
ls /S*/V*/P*
from BigSur.
Booting from "macOS Installer" the System Volume becomes unsealed and mountable rw (because apple during the stage 2 installer unseal and disable snapshot booting), overwritten (using a delta update) or erased (using a full installer but the Data volume content are kept), all the "Assets Bundle" /macOS Install Data/UpdateBundle/ payload packages are extracted to the System Volume, then follows a stage 3 installer where system is sealed or not, and a stock apple snapshot booting is created with a kernelcollection UUID and Preboot target.
About non-APFS or Legacy USB Mac,
@hvds previously tested a kind of legacy usb installer where replaced the BaseSystem.dmg (prelinkedkernel patched with
BaseSystem legacy usb fix) and BootKernelExtensions.kc with my prelinkedkernel fix renamed to BKE to cheat the apple installer and this allowed to continue the installer until a certain point, I guess till the stage3 where this other ram disk is loaded:
https://github.com/jacklukem/BigSurfixes/blob/master/legacyusb installer fix/com.apple.Boot2.plist
Skipping this "x86_64SURamDisk.dmg" (I called it the stage3 installer) should not make or tag any snapshot and let use
mount -uw /
from single user mode, and from normal booting too, selecting "BigSur Data Volume" at apple startup manager.
Moreover I noticed that UpdateOptions.plist (DoNotSeal) is present either in /macOS Install Data/Locked Files/ and "Locked Files" folder should be unlocked with read and write permissions to everyone.
edit:
@ASentientBot seems beta 9 kernel (compiled by apple on September 25 ) can boot Penryn Core2Duo, so it's no more required a downgrading to beta 6.