diff --git a/CLAUDE.md b/CLAUDE.md
index 0bb658e..d11f679 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -190,6 +190,12 @@ publish; registry `BaseUrl` host rule) and the QA topology note: [`ZB.MOM.WW.Ove
 > is orthogonal to the deployment tier. No production box has been identified. Full host/port
 > inventory for both tiers: [`deployment.md`](deployment.md) §2.1 + §7.1.
 >
+> ⛔ **Remote command execution on the wonder boxes is DISABLED (2026-09-11).** The `winrm` skill
+> (WinRM exec/ps, service control) set off the security software and has been moved to
+> `~/.claude/skills-disabled/winrm`; do not use it or stand up a replacement channel until the user
+> clears one. **Still allowed:** UNC/SMB file copies to the boxes and logging directly into the SQL
+> Servers. Any deploy step that needs a command run on a box is blocked until a new channel is found.
+>
 > **Deployed state (2026-09-10):** DEV and both QA nodes run every repo tip — ScadaBridge `2b9a7c3c`,
 > OtOpcUa `b8b4c18f`, mxaccessgw `4f931e4` (Server + x86 Worker), HistorianGateway `d8d890c`, Overview
 > `846b77f`/`818775b3` (code-identical). All driven from the Mac by the `winrm` skill (WinRM 5985 + SMB 445,