Update docs for current LiveCD flow

bible-local/architecture/runtime-flows.md

@@ -30,6 +30,26 @@ local-fs.target
 - `bee-audit.service` does not wait for `network-online.target`; audit is local and must run even if DHCP is broken.
 - `bee-audit.service` logs audit failures but does not turn partial collector problems into a boot blocker.
 
+## Console and login flow
+
+Local-console behavior:
+
+```text
+tty1
+  └── live-config autologin → bee
+        └── /home/bee/.profile
+              └── exec menu
+                    └── /usr/local/bin/bee-tui
+                          └── sudo -n /usr/local/bin/bee tui --runtime livecd
+```
+
+Rules:
+- local `tty1` lands in user `bee`, not directly in `root`
+- `menu` must work without typing `sudo`
+- TUI actions still run as `root` via `sudo -n`
+- SSH is independent from the tty1 path
+- serial console support is enabled for VM boot debugging
+
 ## ISO build sequence
 
 ```
@@ -80,6 +100,10 @@ Exit code 0 = all required checks pass. All `FAIL` lines must be zero before shi
 Key checks: NVIDIA modules loaded, `nvidia-smi` sees all GPUs, lib symlinks present,
 systemd services running, audit completed with NVIDIA enrichment, LAN reachability.
 
+Current validation state:
+- local/libvirt VM boot path is validated for `systemd`, SSH, `bee audit`, `bee-network`, and TUI startup
+- real hardware validation is still required before treating the ISO as release-ready
+
 ## Overlay mechanism
 
 `live-build` copies files from `config/includes.chroot/` into the ISO filesystem.