diff --git a/docs/design/2026_10_17_proposed_ttl_inline_cross_leader_legacy_rows.md b/docs/design/2026_10_17_partial_ttl_inline_cross_leader_legacy_rows.md
similarity index 98%
rename from docs/design/2026_10_17_proposed_ttl_inline_cross_leader_legacy_rows.md
rename to docs/design/2026_10_17_partial_ttl_inline_cross_leader_legacy_rows.md
index 08b245c91..9c705bccc 100644
--- a/docs/design/2026_10_17_proposed_ttl_inline_cross_leader_legacy_rows.md
+++ b/docs/design/2026_10_17_partial_ttl_inline_cross_leader_legacy_rows.md
@@ -1,6 +1,6 @@
 # TTL-inline migration of legacy-route rows across leaders
 
-Status: Proposed
+Status: Partial
 Author: bootjp
 Date: 2026-10-17
 
@@ -322,12 +322,12 @@ For A, A′, B and C, the 16 is ⌈512 / 32⌉, where n_P is the number of a pag
 
 ## Implementation progress
 
-This proposal's design review is not implementation acceptance. The runtime changes below are being consolidated in this PR; no complete milestone or operational migration is claimed yet.
+This proposal's design review is not implementation acceptance. The components below are on main, merged by bootjp/elastickv#1280; that is why this document is `partial`. No milestone is complete and no operational migration is claimed yet: none of the new protocol is enabled, and both read fallbacks stay on.
 
 | Component | Current implementation evidence | Remaining acceptance |
 |---|---|---|
 | M1 physical-page reporting | `ShardStore.ScanGroupOwnedPageAt` returns served rows, four legacy base-metadata dispositions, catalog version and the physical resume key without remote owner probes. Delta and migration plans now share one timeout-aware rotation; the regression exhausts every slot's tick and still reaches every migration family. | Production reporting integration, valid completed snapshots, status and one-shot audit. |
-| M1b atomic absence | Store apply-lock checks include old committed versions and tombstones on memory/Pebble and entry-scoped batches. Protobuf, coordinator and 1PC preserve the condition, including duplicate-key mutation reduction. Store/KV race suites and scoped lint passed. | Durable replicated capability/activation is not implemented yet, so guarded requests remain refused by default. Retention state, downgrade fencing, drain, read-admission and compaction requirements above remain mandatory. |
+| M1b atomic absence | Store apply-lock checks include old committed versions and tombstones on memory/Pebble and entry-scoped batches. Protobuf, coordinator and 1PC preserve the condition, including duplicate-key mutation reduction. `TransactionManager.Commit` refuses any request carrying `require_absent` before proposing it, so the field cannot reach the log while a pre-capability replica would apply the `Put` it ignores; the apply-time refusal stays for entries already in a log. Store/KV race suites and scoped lint passed. | Durable replicated capability/activation is not implemented yet, so guarded requests remain refused before proposal and at apply. M1b's all-member capability fence replaces the unconditional proposal refusal. Retention state, downgrade fencing, drain, read-admission and compaction requirements above remain mandatory. |
 | M1b durable generation pins | Implemented deterministic admission, extension, retirement and expected-deadline expiry transitions, including retirement before initial admission and protection of active lower generations. The durable journal saves state with its Raft index, reloads on an already-applied disk index, and does not publish a failed write. Its control-group allocator saves a monotonic counter before returning an identity, rejects unallocated reservations, and never guesses an old lost allocation response. Memory/Pebble snapshot, reopen, ordering, encrypted-state and race tests cover these primitives. No wall clock or user HLC allocation is used. | Activation, allocator fan-out, token format, all renewal/compensation callers, drain proof, snapshot recovery barriers and read-floor/compaction integration remain mandatory. A test-only seeded epoch is not activation evidence. |
 | M1b typed FSM integration | Added a strict versioned `0x16` command decoder (moved from `0x0f`, which main assigned to the migration target-readiness opcode), typed allocation responses, durable pin apply, and journal reload at startup/snapshot restore. The highest admitted pin timestamp persists after release/expiry, fences delayed writes after restart, and invalidates timestamp caches without adding a volatile backup pin. Legacy commands reject once an activated epoch exists. New-epoch state cannot use legacy compaction while its quorum/floor protocol is unavailable. | No production producer or activation path emits this format. Both capability and a persisted activated epoch are required. Capability certificates, downgrade fencing, drain/activation, backup APIs and the full per-pass ReadIndex/prepare/drain/raise protocol are not implemented yet; reclamation for such an epoch remains closed rather than approximating them. |
 | M2-M4 | Not implemented. | Peer relocation, bounded checkpointing, reserved purge, completed-snapshot gate and seeded Jepsen acceptance. Both read fallbacks stay enabled. |