diff --git a/AGENTS.md b/AGENTS.md
index 6d89068..670359f 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -57,11 +57,35 @@ repo is in PLAN.md's "Backend layout" section.
 Phases 1–3 done 2026-08-24 (see PLAN.md's phase list for what each
 verified): the skeleton pipe, the full Claude driver (streaming, tools,
 permission + AskUserQuestion cards, steering, interrupt, `--resume`
-crash recovery, images both ways), and the usage screen. Phase 4
-(pi/llama.cpp) is deferred — not testable in this VM. Next: phase 5
-(SSH; needs a decision on how to test — no keys in `~/.ssh` here) and
+crash recovery, images both ways), and the usage screen.
+
+**Phase 5 (SSH) is written and now exercised** (2026-08-28). A session
+names a host, `session::transport` turns that into an `ssh host …`
+invocation, and the driver never learns which it got. Phase 4 (llama.cpp)
+is being built now, no longer deferred. What is left is
 real-phone/WireGuard bring-up, which is operational rather than code.
 
+**How to test SSH here, since there is no second machine:** ssh this VM to
+itself. Generate a throwaway key, append the public half to
+`~/.ssh/authorized_keys`, and configure a host of `bob@127.0.0.1` with
+`identityFile` pointing at it plus
+`options: ["StrictHostKeyChecking=no", "UserKnownHostsFile=…"]` so it
+touches nothing real. Point a provider's `command` at something harmless
+like `/bin/echo` rather than at `claude`: the transport is what is under
+test, the process exiting immediately is the signal, and it costs no
+tokens. A session spawned on that host logs `running /bin/echo on loopback
+(bob@127.0.0.1)` and lands `status: exited` in its transcript, which is
+the whole path — connection, remote exec, process death reported. **Take
+the key back out afterwards**; this VM's `authorized_keys` is not scratch
+space.
+
+Note the remote login shell here is **fish**, not a POSIX shell. The
+remote script (`cd '…' && exec '…'`) happens to be valid in both, and the
+POSIX single-quote escaping `ssh.rs` does happens to mean the same thing
+in fish — but that is luck rather than design, and a shell that isn't
+either would be the thing to suspect first if a remote spawn ever
+mangles an argument.
+
 ## Checking your work
 
 - Server: from `server/`, `./run-tests.sh` (or `cargo test`) +