diff --git a/crates/tinymemory-api/src/safety/README.md b/crates/tinymemory-api/src/safety/README.md
index a486f5e3..1005b6d4 100644
--- a/crates/tinymemory-api/src/safety/README.md
+++ b/crates/tinymemory-api/src/safety/README.md
@@ -17,3 +17,14 @@ consumers own diagnostics and must consider the sensitivity of derived categorie
 
 Risk vocabulary is available by default. Enable `local-safety` for regex-based
 classification and redaction; the default engine contract stays regex-free.
+
+
+Known inherited limitations remain unchanged by this ownership move: grouped
+IBANs can be missed ([260](https://github.com/tinyhumansai/tinymemory/issues/260)),
+overlapping phone rules can count one number twice
+([261](https://github.com/tinyhumansai/tinymemory/issues/261)), and card boundaries
+or an adjacent CVV can produce incomplete matching
+([262](https://github.com/tinyhumansai/tinymemory/issues/262)). The international
+phone repetition counts separators rather than normalized digits, so seven-digit
+numbers can be missed and longer or separator-heavy strings accepted
+([263](https://github.com/tinyhumansai/tinymemory/issues/263)).
diff --git a/crates/tinymemory-api/src/safety/rules.rs b/crates/tinymemory-api/src/safety/rules.rs
index ac39a63b..6cad3122 100644
--- a/crates/tinymemory-api/src/safety/rules.rs
+++ b/crates/tinymemory-api/src/safety/rules.rs
@@ -141,7 +141,8 @@ fn build_rules() -> Vec<Rule> {
             r"\b(?:\+?1[-.\s]?)?\(?\d{3}\)?[-.\s]\d{3}[-.\s]\d{4}\b",
             None,
         ),
-        // International E.164-ish phone number (leading + and 7–15 digits).
+        // Legacy international phone-like pattern. Its repetition counts
+        // separators too; normalized digit bounds remain follow-up #263.
         pattern_rule(PiiCategory::PhoneNumber, r"\+\d(?:[\d\s\-]{6,16}\d)", None),
         // IPv4 address (octet-validated).
         pattern_rule(