diff --git a/NEXT.md b/NEXT.md
index 2caec13..efa8d73 100644
--- a/NEXT.md
+++ b/NEXT.md
@@ -714,6 +714,21 @@ Sixty mutations, nineteen left the whole suite green. The severe cluster is clos
 
 ## Sharp edges
 
+- **Two formatted numbers cannot be held at once.** `flan_i64_to_bytes`, `flan_f64_to_bytes` and `flan_u64_to_bytes`
+  all write into one `static char scratch[64]` — "rendered text lives here until the next call", flan_rt.c:184 — and
+  `(string b)` does not copy. So
+
+  ```
+  (let [a (string (i64->bytes 11))
+        b (string (i64->bytes 22))]
+    (print a) (print " ") (println b))     ; => 22 22
+  ```
+
+  `a` is 11 and prints 22. No crash and no diagnostic. This is not new — the `[u8]` already aliased — but a `string`
+  reads as more value-like and invites exactly this. Format, draw, measure, then format the next one; `digits.flan`
+  sequences itself strictly for this reason. `rl/draw-text` is safe because the shim's `flan_shim_cstr` copies out of
+  ptr+len before the call.
+
 - **Writing through a string literal is undefined, and the two build modes
   disagree about how.** `(let [s (bytes "Hi")] (set (at s 0) \h))` stores into
   a `private unnamed_addr constant`. At `-O0` that is a store to read-only