/dev/ptmx can be a symlink ptmx -> pts/ptmx, and we add a ptmx instance inside the devpts filesystem. Each devpts filesystem is responsible for its own pool of ptys, with own numbering, etc.
This does mean that entries in /dev/pts are more than just plain device nodes, which they are now (you can cp -a a device node from /dev/pts into another filesystem and it will still "just work"), but I doubt this actually matters to anyone. If anyone cares, now I guess would be a good time to speak up.
Agreed. That is another legitimate path. And if all you care about is
isolation and not dealing with the general class of problems with the
global device number to device mapping that is sane. I know we have
several other virtual devices that we tend to care about but ptys are
the real world pain point.