diff --git a/CLAUDE.md b/CLAUDE.md
index 61308131..e62d9542 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -26,12 +26,14 @@ Repos cloned as sibling directories under `~/Desktop/` — referenced for contex
 
 Other peers in the `scadaproj` family (see `scadaproj/CLAUDE.md` for details): `~/Desktop/HistorianGateway` (`historiangw`) — AVEVA Historian gRPC sidecar, OtOpcUa's sole historian backend; its historian SDK (`AVEVA.Historian.Client`) is now owned inside that repo at `HistorianGateway/histsdk/` (the separate `~/Desktop/histsdk` repo was folded in with history); and `~/Desktop/scadaproj` (`scadaproj`) itself — shared `ZB.MOM.WW.*` libs + the dev/test GLAuth on `10.100.0.35:3893`.
 
-> ⛔ **Wonder box remote access (2026-09-11): no `psbridge`, no `winrm`.** Both skills are retired/disabled —
-> the WinRM remote-exec channel set off the security software on the wonder boxes (vd03/vq03/vq04). Do not
-> run remote commands (service control, publish/swap, PowerShell) on those boxes and do not stand up a
-> replacement channel until the user clears one. Still allowed: UNC/SMB file copies and logging directly
-> into the SQL Servers. Deploy steps that need a command on the box are blocked; see the umbrella
-> [`../scadaproj/CLAUDE.md`](../scadaproj/CLAUDE.md) for the current hold.
+> ⛔ **Wonder box remote access: `winrm` is DEPLOYMENT-ONLY (2026-09-28); `psbridge` stays retired.**
+> WinRM remote exec set off the security software on the wonder boxes (vd03/vq03/vq04) and was
+> disabled 2026-09-11; the user re-enabled the `winrm` skill on 2026-09-28 for deployment activities
+> only (preflight, backup, stop/swap/start, migration, post-deploy verify, rollback of a deploy the
+> user asked for). Ad-hoc diagnostics and "which version is deployed?" checks do NOT use WinRM —
+> read the build stamp over SMB (a non-running `cli\*.dll`, or the `app.bak.<ts>` / `E:\psrem-stage`
+> listings) and probe `/health/ready` over HTTP. UNC/SMB file copies and direct SQL logins are always
+> allowed. See the skill's *Scope* section and the umbrella [`../scadaproj/CLAUDE.md`](../scadaproj/CLAUDE.md).
 
 ## Document Conventions