Index: docs/paid-posts-design.md
===================================================================
--- docs/paid-posts-design.md	(revision 4a08bfc845c79a2a45147da7178576bc27d03c64)
+++ docs/paid-posts-design.md	(revision 61e3daf1227ad67cd38c4a5e9e79cfeb1ea92121)
@@ -70,4 +70,17 @@
 
 `PAID_SECRET` (32 random bytes) lives in env, like the other secrets.
+
+## Concurrency (a property of the cookie-less model)
+
+Because there is no session and no "current user", the model is inherently
+multi-user. Two people unlock side by side with no shared state to collide:
+each request carries its own assertion, verified against that credential's own
+public key, and the content goes back in that one response. `paid_entitlements`
+is keyed per credential, so N passkeys are N independent rows. The challenge is
+stateless (the signed blob), so there is no single "pending challenge" slot a
+second visitor could overwrite. Unlike a cookie session, "two people in the same
+browser" cannot clobber each other. The only caveat is a shared browser profile:
+the passkey picker would then list both passkeys (a small visibility hint, not
+access).
 
 ## Data model (additive)
Index: docs/privacy-betaalde-posts.md
===================================================================
--- docs/privacy-betaalde-posts.md	(revision 4a08bfc845c79a2a45147da7178576bc27d03c64)
+++ docs/privacy-betaalde-posts.md	(revision 61e3daf1227ad67cd38c4a5e9e79cfeb1ea92121)
@@ -59,4 +59,13 @@
 geen gemis.
 
+## Meerdere mensen tegelijk
+
+Omdat er geen sessie en geen "ingelogde gebruiker" bestaat, kunnen meerdere
+mensen tegelijk en los van elkaar posts ontgrendelen: elke bevestiging staat op
+zichzelf. Er is geen gedeelde toestand die van elkaar afhangt. Deel je hetzelfde
+apparaat en profiel met iemand, dan kan de passkey-kiezer wel tonen dat de ander
+een passkey heeft (geen toegang, alleen zichtbaar); gebruik dan aparte apparaten
+of profielen.
+
 ## Bewaartermijn en verlopen