docs: the release week's record — the aleph story and the smoke's facts

The plan note gains the release-week postscript: the aleph root cause,
the pin's rise and byte-identical fall, the upstream filing, and the
smoke's real-session reshaping. AGENTS.md gains the vm smoke's loaded
facts: the -u filter that misses a manager's Started line, the
restart-wave shape that makes live-shell probes coin flips, and the
runner-safe headless console combo.

Author: Letdown2491

AGENTS.md

@@ -82,6 +82,23 @@ nostr layer is enabled) — the same road every release ships.
   closures are `Fn` — clone captured ids before the listener AND inside
   it. Goldens pin bytes; a moving golden is the review.
 
+## The vm smoke's loaded facts (44.4.0)
+
+- A `-u` unit filter misses the "Started" line: `journalctl -u` filters
+  by `_SYSTEMD_UNIT`, and a start line belongs to the manager that
+  wrote it, not the unit it names. The user manager forwards to the
+  system journal and the smoketest account reads it back; a `--user`
+  probe came back empty while the system journal carried the line.
+  The failure dump's `journalctl -b` shape is the proven reader.
+- Displayless (`virtio-vga` + `QEMU_DISPLAY: none`), niri dies on
+  early import and the GPUI shell follows — "window not found" —
+  restart-looping until the unit's start limit ends the waves. A probe
+  that needs a live shell process is a coin flip wearing a deadline:
+  the notification name and the sleep inhibitor exist only while a
+  wave is. Ask what shipped and what the journal recorded instead.
+- `egl-headless` wants a host DRM node a runner lacks. The GPU-less
+  console combo is `virtio-vga` plus `none`.
+
 ## Agent skills
 
 ### Issue tracker

notes/44.4.0-plan.md

@@ -401,3 +401,35 @@ the release carries that the plan did not know:
   PAM-opened at a real login; an autologin boot starts the daemon
   locked until the keyring is opened. The honest posture holds, the
   docs say so, and the inactivity switch's default rationale names it.
+
+## Postscript — the release week (2026-10-02)
+
+The layer shipped as 44.4.0 and the release tier did its job: the
+binaries and the ISO went out, and the image tier failed where the
+binaries could not carry it. What the release week found:
+
+- **The aleph failure was ours, and the dates were a shadow.** Fresh
+  installs of kuma's images died in `bootloader-update.service`:
+  `rpm-ostree compose image` emits no version label, bootc's install
+  wrote `"version": null` into `/sysroot/.bootc-aleph.json`, and
+  bootupd's reader requires a string. The float was blamed and the
+  compose environment pinned to a mirror of the last good float; a
+  recompose under the pinned env proved its tools byte-identical to
+  the floating one's, which moved the suspicion to kuma's own
+  Containerfile and the version label it never stamped. Stamped
+  (9a16b14), the failure vanished on every base. The pin rose and fell
+  inside a week; the mirror job went with it (8c2284a). The released
+  binaries never carried the bug; the released ISO does, and whether
+  to retag it or cut 44.4.1 stays open.
+- **Filed upstream as a contract bug, not a kuma one**: the writer
+  declares `version` optional and emits null; the reader requires a
+  string. [coreos/bootupd#1166](https://github.com/coreos/bootupd/issues/1166) —
+  any pipeline that composes label-less hits this on every boot.
+- **The smoke's real-session section learned what a displayless VM can
+  answer.** The shell survives the GPU-less VM in restart-waves until
+  the unit's start limit ends them, so every probe that needed a live
+  shell process — notification ownership, the sleep-inhibitor
+  readback, a stale noctalia pgrep — either measured the runner's
+  timing or passed vacuously. What remains asks the wiring and the
+  journal; whether the shell draws is real hardware's question. The
+  measured facts are in AGENTS.md.