docs(deploy): vd03 HistorianGateway gRPC :5221 opened off-box (0.0.0.0 + firewall rule)

.claude/skills/sister-project-history/historiangateway.md

@@ -84,3 +84,4 @@ for persistence evidence.
 - **2026-11-11:** OtOpcUa adopted Contracts/Client 1.0.0 with the adapter rename (`230cef4e build: adopt HistorianGateway 1.0 TLS options`, on origin/master); historiangw#131 closed. The only open historiangw issue is #78 (the DEV/QA deploy, blocked by the wonder-box hold).
 
 - **2026-11-11 deployed `ea9f21c` to wonder-app-vd03 (DEV)** (was `d8d890c`, the SQL-era build). Owner-approved WinRM deploy: SMB-staged self-contained win-x64, preflight test boot on 15220/15221 against store copies, swap 6.5 s downtime, verify 0 FAIL (gRPC probe/browse/read-raw as OtOpcUa, bogus key refused). Config unchanged (already `Transport=RemoteGrpc` → wonder-sql-vd03:32565); inert `RuntimeDb` line removed from appsettings.Production.json. Backups `Server.bak.20261111T164035`, `_databak-pre-ea9f21c-…`, `_regbak-…`. Carried-over risks: `AllowUntrustedServerCertificate=true` (#91), personal historian account.
+- **2026-11-12 vd03 gRPC opened off-box:** Grpc endpoint `127.0.0.1:5221` → `0.0.0.0:5221` (h2c) + firewall rule `HistorianGateway gRPC 5221` (Domain), via SMB config push + one WinRM script; off-box `HistorianStatus/Probe` without a key → `Unauthenticated` (auth enforced). Backup `appsettings.Production.json.bak-20261112T070347`.

deployment.md

@@ -475,6 +475,12 @@ script `E:\ApiInstall\_stage-otopcua-5fb4b4db\rollback.ps1`, ConfigDb backup
 `e4b4824a` → **Applied**; then `9adc5590` re-pointed the FOCAS `MaxRpm` tag to `MotorSpeedPct`; health 200 ×3, ServiceLevel 255. Full record: OtOpcUa
 `docs/deploy/vd03-upgrade-b8b4c18f-to-master.md` §(h). QA vq03/vq04 are unchanged from the 2026-09-10 round.
 
+**HistorianGateway gRPC opened to the network on DEV (2026-11-12):** `appsettings.Production.json` `Kestrel:Endpoints:Grpc`
+`http://127.0.0.1:5221` → `http://0.0.0.0:5221` (h2c, still plaintext; `ApiKeys:Mode=ApiKey` enforced — an off-box call
+without a key gets `Unauthenticated`), plus inbound firewall rule `HistorianGateway gRPC 5221` (TCP, Domain profile).
+Service restarted; OtOpcUa's `http://localhost:5221` link unaffected. Backup
+`Server\appsettings.Production.json.bak-20261112T070347`. Rollback: restore it, restart, remove the rule.
+
 Neither install is a scripted in-repo flow — the operational procedures live in ScadaBridge
 `docs/operations/` (`failover-procedures.md`, `maintenance-procedures.md`,
 `inbound-api-key-reissue.md`, `troubleshooting-guide.md`). Treat any service/port specifics not in