diff --git a/docs/changes/CUST-WP-0073/workstation-agents-r4/SHA256SUMS b/docs/changes/CUST-WP-0073/workstation-agents-r4/SHA256SUMS
index f816a0e8..47b1afc2 100644
--- a/docs/changes/CUST-WP-0073/workstation-agents-r4/SHA256SUMS
+++ b/docs/changes/CUST-WP-0073/workstation-agents-r4/SHA256SUMS
@@ -1,5 +1,5 @@
 095a8ee5836f32f5e72405aba7c596544b3bc18886f7f80f368048866aab39b9  custodian-agents-sshd.service
-6be8e06f16067d0d5096f2a112abe0fc64290653d4e6e34e7d75fa937faee222  guest-setup.sh
+e75bc9ed831a950c89096a08d87171ccc596ab961ef26495521f40d3f9987350  guest-setup.sh
 af7dc531e2aa701c4e57652ae51dc3c25a8c18dcf6a89d2d6ccc469e49326fa5  import.ps1
 51e1d7b355d3c76e3a119bf2e6dfbe90d9c00b194aea92911c0b6f536f3d15b7  sshd_config
 dfa9d24c3a7df7d96d0bed7ca628283d71d2d8f4c74c547d43b4dab9bf3e82c4  wsl.conf
diff --git a/docs/changes/CUST-WP-0073/workstation-agents-r4/guest-setup.sh b/docs/changes/CUST-WP-0073/workstation-agents-r4/guest-setup.sh
index 5ec914f6..aca437ba 100755
--- a/docs/changes/CUST-WP-0073/workstation-agents-r4/guest-setup.sh
+++ b/docs/changes/CUST-WP-0073/workstation-agents-r4/guest-setup.sh
@@ -30,6 +30,7 @@ install -o root -g root -m 0600 "$here/sshd_config" /etc/ssh/sshd_config.d/00-cu
 sed -i -e 's/^#\?Port .*/# Port set in sshd_config.d/' /etc/ssh/sshd_config
 install -o root -g root -m 0644 "$here/custodian-agents-sshd.service" /etc/systemd/system/custodian-agents-sshd.service
 ssh-keygen -A >/dev/null
+install -d -m 0755 /run/sshd
 /usr/sbin/sshd -t
 systemctl enable custodian-agents-sshd.service
 install -d -o root -g root -m 0700 /etc/custodian-agents
diff --git a/docs/evidence/2026-10-20-custodian-agents-distro-staging.md b/docs/evidence/2026-10-20-custodian-agents-distro-staging.md
new file mode 100644
index 00000000..836abea0
--- /dev/null
+++ b/docs/evidence/2026-10-20-custodian-agents-distro-staging.md
@@ -0,0 +1,27 @@
+# custodian-agents distro staging — 2026-10-20 (attended, CUST-WP-0073 step 5)
+
+Supervisor: Bernd Worsch (present). Recipe: docs/changes/CUST-WP-0073/workstation-agents-r4/.
+
+- Import: Ubuntu 24.04.5 WSL rootfs, sha256 bb415d82…6039e (pinned, matched);
+  store `%LOCALAPPDATA%\Custodian\WSL\custodian-agents`; WSL 3.0.3.0; WSL2. No other distro touched.
+- guest-setup.sh stopped at `sshd -t` (missing /run/sshd); remaining tail steps
+  completed by hand, script fixed (`install -d /run/sshd`) for re-runs.
+- After `wsl --terminate custodian-agents` (wsl.conf applied), as default user:
+  - `custodian-agt` uid/gid 1001, groups only `custodian-agt`; `sudo -n true` → password required (account and root password locked).
+  - `/mnt/c` empty (automount off); no `/home/worsch`; no Windows exes on PATH; no SSH_AUTH_SOCK; no credential-like env.
+  - Only 9p mount: `/usr/lib/wsl/drivers` (ro, GPU drivers).
+  - `custodian-agents-sshd` active, listening 127.0.0.1:22273 only; stock ssh.socket inactive.
+- Interop probe: binfmt `WSLInterop` is registered kernel-wide (by operator distro) and
+  `/run/WSL/*_interop` is connectable by the agent. Copied `whoami.exe` and `cmd.exe`
+  into the guest and executed as custodian-agt: WSL logged `UtilAcceptVsock … accept4 failed 110`,
+  no output, and a probe file write to the Windows user's %TEMP% did **not** occur.
+  Conclusion: `[interop] enabled=false` is enforced on the Windows side for this distro.
+  Residual: shared WSL2 network namespace (operator loopback forwards reachable) — accepted under builder-mode open egress; re-arm item.
+- Not yet done: harness installs/logins, credentials, actual-account proof (steps 6–9).
+
+## Step 6 (partial) — harnesses and Codex desktop transport
+
+- Installed as custodian-agt (user-local, open egress): codex-cli 0.163.0 (npm, Node 18.19.1 from Ubuntu), Claude Code 2.1.304 (native installer). Grok Build: founder installs during login round. No logins performed.
+- Windows key `%USERPROFILE%\.ssh\custodian_agents_ed25519` (SHA256:pkK868bu…) is the only authorized key (`/etc/ssh/authorized_keys/custodian-agt`, root-owned 0644). Windows ssh config gained `Host custodian-agents` (127.0.0.1:22273, IdentitiesOnly, ForwardAgent no).
+- Guest host key ED25519 SHA256:QImiZUx1+BXRtgouldHB276LyaRyv1gaWBIVDXr8/20, matched on first connect; `ssh custodian-agents` → custodian-agt@custodian-agents OK.
+- The distro must be running for SSH (WSL stops idle distros): start with `wsl -d custodian-agents`.