diff --git a/.github/workflows/README.md b/.github/workflows/README.md
index d1a9b44f52..28ba9bfc78 100644
--- a/.github/workflows/README.md
+++ b/.github/workflows/README.md
@@ -181,7 +181,9 @@ The `vpn` input does the same for the WireGuard mesh on swarm rows, and on
 compose rows of a role's smallest variant: `auto` rotates it, `enforced`
 meshes every such row and `disabled` none. A meshed compose row also deploys
 `svc-net-wireguard`, whose CLI test meshes three throwaway hosts; every other
-compose row never takes the mesh. `meshes` names the WireGuard layout a meshed
+compose row never takes the mesh. Every swarm and compose title shows 🚇 when
+its row carries the mesh and 🛣️ when it does not, and a `&vpn` pin on a row
+that cannot take the mesh aborts the run. `meshes` names the WireGuard layout a meshed
 swarm row deploys, empty meaning `INFINITO_SWARM_MESHES` from `default.env`; pointing it at
 an `inventories/examples/*/wireguard.yml` with `vpn: enforced` and `mode: swarm`
 is how an example is deployed in CI.