diff --git a/stacks/gitea-runner/README.md b/stacks/gitea-runner/README.md
index 16e4f84..75eb57f 100644
--- a/stacks/gitea-runner/README.md
+++ b/stacks/gitea-runner/README.md
@@ -129,6 +129,18 @@ A workflow that runs on the central runner needs three things:
 
 1. **`runs-on:`** matching a runner label — `pfi-fleet` (cross-fleet)
    or `ana-docker` (pin to that host).
+
+   ⚠ **A label LIST is AND, not fallback.** `runs-on: [vastblue, pfi-fleet]`
+   requires a runner carrying *both* labels — it does not try the first and
+   fall back to the second. A list naming a label no runner has matches
+   nothing and the job queues forever rather than failing, which is the worst
+   of the three outcomes because the board looks busy rather than broken.
+   Use **one** label, and when a workflow should move to a new runner, edit
+   the label deliberately at that moment. (Caught by eitri-smithy-dev on
+   2026-09-02 against vastblue's U1 contract, after infra-ops wrote "one-line
+   fallback to `pfi-fleet`" meaning a manual edit and was read as scheduler
+   behaviour. Standard Actions semantics, not a gitea quirk — the ambiguity
+   was in the prose, not the product.)
 2. **An SSH key** to reach the deploy target. Stored as a repo or
    org-level Actions secret named e.g. `DEPLOY_SSH_KEY`. The
    corresponding public key must be in `~lkraven/.ssh/authorized_keys`