diff --git a/Cluster-Plan-Inventory-Reference.md b/Cluster-Plan-Inventory-Reference.md
index 0fdb0ee..ba2ea3d 100644
--- a/Cluster-Plan-Inventory-Reference.md
+++ b/Cluster-Plan-Inventory-Reference.md
@@ -80,8 +80,8 @@ hosts:
 | `filer` | `filer_servers:` | Metadata store via `--filer-backend` |
 | `s3` | `s3_servers:` | S3 gateway; auto-wired to first filer |
 | `sftp` | `sftp_servers:` | SFTP gateway; auto-wired to first filer |
-| `admin` | `admin_servers:` | Admin UI; password starts as `CHANGE_ME` |
-| `worker` | `worker_servers:` | Maintenance worker; auto-wired to first admin |
+| `admin` | `admin_servers:` | Admin UI; **at most one host** may carry this role (single-instance component); password starts as `CHANGE_ME` |
+| `worker` | `worker_servers:` | Maintenance worker; auto-wired to first admin; runs with `-jobType=all` by default (override via `worker_servers[].jobType`) |
 | `envoy` | `envoy_servers:` | Edge proxy |
 | `external` | nothing emitted | Documented-but-unmanaged hosts (e.g. an external Postgres). Used with `tag:` for `--filer-backend` substitution; never SSH-probed |
 
@@ -171,5 +171,6 @@ Tag substitution only runs on the URL authority's host segment, so a literal `ta
 - Two rows share an `ip:ssh-port` target but disagree on SSH user/identity.
 - A `disk.device_globs` or `disk.exclude` entry contains anything fancier than an optional trailing `*`.
 - Two hosts carry the same `tag:` (would make tag substitution ambiguous).
+- More than one host carries `roles: [admin]` (the admin UI is single-instance). Hand-written `cluster.yaml` files that skip plan are caught by the same rule at deploy time.
 
 Anything else is fine; the planner errs on the side of accepting weird-but-unambiguous inventory shapes and warning at run time.