diff --git a/docs/guide_app_controller.md b/docs/guide_app_controller.md
index b9de175e..a9f904cf 100644
--- a/docs/guide_app_controller.md
+++ b/docs/guide_app_controller.md
@@ -65,7 +65,7 @@ The actual `__init__` (`src/app_controller.py:778-1212`) does the following:
 1. **Startup timeline anchors** — Captures `_init_start_ts` for the `startup_timeline()` diagnostics. Other timeline anchors are filled in lazily as events occur.
 2. **Locks** — Creates **11** thread-safety locks (`_send_thread_lock`, `_disc_entries_lock`, `_pending_*_lock` for comms/tool_calls/history/gui_tasks/dialog/api_event_queue, `_rag_engine_lock`, `_rag_sync_lock`, `_project_switch_lock`) plus 5 non-lock state fields for the RAG-sync coalescing and project-switch state machine (`_rag_sync_token`/`_rag_sync_dirty`, `_project_switch_in_progress`/`_pending_path`/`_error`).
 3. **GUI health state** — `_gui_degraded_reason` and `_last_imgui_assert` (set when `immapp.run` raises `RuntimeError`; see [guide_gui_2.md](guide_gui_2.md#startup-architecture-lazy-imports-profiler-refresh-rate)).
-4. **Shared io_pool** — `make_io_pool()` creates an **8-thread** `ThreadPoolExecutor` named `controller-io-N` (per `IO_POOL_MAX_WORKERS = 8` in `src/io_pool.py:20`; the io_pool.py module docstring still says "4 worker threads" — that string is stale from a 2026-06-06 4→8 bump and should be fixed separately). This is the SOLE background pool for all async work (no `threading.Thread()` calls anywhere else in `src/`).
+4. **Shared io_pool** — `make_io_pool()` creates an **8-thread** `ThreadPoolExecutor` named `controller-io-N` (per `IO_POOL_MAX_WORKERS = 8` in `src/io_pool.py:20`; bumped 4→8 in commit `4a338486` on 2026-06-06). This is the SOLE background pool for all async work (no `threading.Thread()` calls anywhere else in `src/`). The module docstring at `src/io_pool.py:1-15` also documents the SIGINT-handler fix that replaced the original atexit approach.
 5. **Warmup manager** — `WarmupManager(self._io_pool, log_to_stderr=log_to_stderr)` with an on-complete callback to stamp `warmup_done_ts`. `defer_warmup=True` defers the actual `start_warmup()` call until the first frame is painted (the desktop GUI pattern; headless mode starts immediately). The `log_to_stderr` parameter honors `SLOP_WARMUP_DEBUG` env var.
 6. **Various flags** — `_warmup_started`, `_pending_fetch_provider`, `_defer_warmup`.