diff --git a/README-ZH.md b/README-ZH.md
index ab2e6e34..5a428aca 100644
--- a/README-ZH.md
+++ b/README-ZH.md
@@ -298,6 +298,8 @@ LOCAL_ZEP_RERANK_TOP_K=50
 
 ### Tailscale 访问
 
+发布说明：Tailscale 支持主要面向源码/开发部署，即后端和 Vite 代理运行在同一台主机上。它不会自动公开本地 LLM、embedding 或 reranker 端点；除非你明确需要暴露，否则建议这些模型端点继续绑定在 `127.0.0.1`。
+
 前端现在默认走同源 `/api`，不再默认写死 `http://localhost:5001`。因此你从另一台 Tailscale 设备访问 Vite 开发服务器时，前端请求会继续命中宿主机后端，而不会错误地访问调用方自己的 localhost。
 
 建议在项目根目录 `.env` 中加入：
@@ -320,6 +322,8 @@ FLASK_PORT=5001
 
 ### 二、Docker 部署
 
+发布限制：Docker 部署属于旧路径，目前未针对本地 Zep 替代、外部 vLLM/llama.cpp 端点、以及拆分的 Python 3.11 OASIS 运行时做完整验证。需要本地优先工作流时，请使用源码部署。
+
 ```bash
 # 1. 配置环境变量（同源码部署）
 cp .env.example .env
diff --git a/README.md b/README.md
index b0878f0a..00feb9f0 100644
--- a/README.md
+++ b/README.md
@@ -298,6 +298,8 @@ Parameter rules:
 
 ### Tailscale Access
 
+Release note: Tailscale support is intended for source-code/dev deployments where the backend and Vite proxy run on the same host. It does not make the local LLM, embedding, or reranker endpoints public by itself; keep those endpoints bound to `127.0.0.1` unless you intentionally expose them.
+
 The frontend now defaults to same-origin `/api` instead of `http://localhost:5001`, so opening the Vite dev server from another device over Tailscale will still reach the backend running on the host machine.
 
 Recommended root `.env` settings:
@@ -320,6 +322,8 @@ If you expose the backend through `tailscale serve` or `tailscale funnel`, set `
 
 ### Option 2: Docker Deployment
 
+Release constraint: Docker deployment is legacy/not validated for the local Zep replacement, external vLLM/llama.cpp endpoints, and split Python 3.11 OASIS runtime. Use source deployment for the tested local-first workflow.
+
 ```bash
 # 1. Configure environment variables (same as source deployment)
 cp .env.example .env