diff --git a/.env.example b/.env.example
index 07a3561..73cdb9f 100644
--- a/.env.example
+++ b/.env.example
@@ -89,12 +89,14 @@ BASE_RPC_URL=                              # [SECRET] on-chain RPC endpoint
 # ── Tuning ────────────────────────────────────────────────────────────────
 CLAUDE_TIMEOUT=7200                        # [CONFIG] max seconds per Claude invocation
 
-# ── Shared Claude config ────────────────────────────────────────────────────
-# Shared directory for OAuth lock coherence across containers (#641, #642).
-# All containers mount this directory and resolve CLAUDE_CONFIG_DIR to the
-# same location, so proper-lockfile's atomic mkdir works across them.
-CLAUDE_SHARED_DIR=/var/lib/disinto/claude-shared  # [CONFIG] shared mount path
-CLAUDE_CONFIG_DIR=${CLAUDE_SHARED_DIR}/config     # [CONFIG] config subdirectory
+# ── Claude Code shared OAuth state ─────────────────────────────────────────
+# Shared directory used by every factory container so Claude Code's internal
+# proper-lockfile-based OAuth refresh lock works across containers. Both
+# values must live outside $HOME (so docker bind mounts don't depend on UID
+# mapping) and must be the same absolute path on host and inside each
+# container. See docs/CLAUDE-AUTH-CONCURRENCY.md.
+CLAUDE_SHARED_DIR=/var/lib/disinto/claude-shared
+CLAUDE_CONFIG_DIR=${CLAUDE_SHARED_DIR}/config
 
 # ── Factory safety ────────────────────────────────────────────────────────
 # Disables Claude Code auto-updater, telemetry, error reporting, and bug