diff --git a/docs/KNOWN_BUGS.md b/docs/KNOWN_BUGS.md
index 32b2445e..ba6b6896 100644
--- a/docs/KNOWN_BUGS.md
+++ b/docs/KNOWN_BUGS.md
@@ -35,15 +35,15 @@ refactor work in that doc — these are defects.
   changed (emit-on-change at the list-loaded sources + collapse the refresh
   triggers into the Coordinator).
 
-### 3. Direct-pool-access lint misses bare `pool.sub(` / `pool.list(`
+### 3. Direct-pool-access lint still misses MULTI-LINE access
 - **Severity:** low (tooling gap — weakens the L1 chokepoint guarantee).
-- **Where:** `scripts/check-direct-pool-access.mjs` — regex only matches member
-  access `.pool.sub(`. Bare local-variable calls slip through, e.g.
-  `js/nostr/viewEvents.js` and `js/nostr/relayBatchFetcher.js` use `pool.sub(` /
-  `pool.list(` and are NOT currently flagged or allowlisted.
-- **Fix:** broaden the regex to also catch `\bpool\.(sub|list)\(`, then
-  re-baseline the allowlist (add the now-detected files). Do this alongside P4
-  so the allowlist still only shrinks.
+- **Status:** partially fixed — the regex now catches bare `pool.sub(` /
+  `pool.list(` (re-baselined to 22 files). Still MISSES access split across
+  lines, e.g. `js/services/profileMetadataService.js` writes `nostr.pool`
+  newline `.list(` — so profiles is an unflagged fetch source.
+- **Fix:** normalize whitespace before matching (collapse `\.pool\s*\n\s*\.list`)
+  or move to an AST/`grep -A1` check. Add profileMetadataService (and any other
+  multi-line offenders) to the allowlist once detected.
 
 ### 4. Interim relay cap is static, not liveness-ranked
 - **Severity:** low (acceptable interim).
diff --git a/docs/architecture-refactor.md b/docs/architecture-refactor.md
index e7e1a23d..7f91f713 100644
--- a/docs/architecture-refactor.md
+++ b/docs/architecture-refactor.md
@@ -262,6 +262,11 @@ The mock harness lied because it used **one perfect relay**. New fixtures:
       sub over the active id set; trusted-mute subs already batched-by-author)
 - [x] P3 view counts batched + re-enabled — viewCounter shares ONE kind-30079
       sub + backfill bucketed by `#a`; watch page opts into exact NIP-45 COUNT
-- [ ] P4 lists via stores (follows/hashtags/blocks/watch-history/profiles)
+- [~] P4 lists via stores (follows/hashtags/blocks/watch-history/profiles)
+      — IN PROGRESS: direct-pool-access lint hardened + re-baselined (22 files);
+      watch-history fetch routed through L1. Remaining: profiles
+      (profileMetadataService — note multi-line lint gap, KNOWN_BUGS #3),
+      follows/hashtags (swap relaySubscriptionService → L1 for reconnect
+      registry), blocks (userBlocks fetch).
 - [ ] P5 AppState + Coordinator + unidirectional flow
 - [ ] P6 cleanup + config relay-set trim + final docs