diff --git a/src/docs/config-replication-impl-status.md b/src/docs/config-replication-impl-status.md
index 4e9eed06..30f544c5 100644
--- a/src/docs/config-replication-impl-status.md
+++ b/src/docs/config-replication-impl-status.md
@@ -1,7 +1,7 @@
 # Config Replication — Implementation Status
 
 > **Branch**: `persistent_ha`
-> **Date**: 2026-05-13
+> **Date**: 2026-05-13 (updated)
 > **Design doc**: `config-replication-design.md`
 
 ---
@@ -28,6 +28,7 @@ from the primary on every startup, eliminating manual per-node provisioning.
 | `handle_controller_join()` | ✅ Done | `8f4db30` | Registers endpoint in `standby_endpoints` under lock |
 | WAL record-count `schedule_checkpoint()` | ✅ Done | `a95476b` | Idempotent CAS; coalesced via `delaymgr` 1s delay; bounds `persist_recover` to ≤10k records |
 | `typemap.h` union arms + capnp shims | ✅ Done | `491c255` | `replconfigreplymsg`, `upgradeconfigreplymsg`, etc. wired |
+| API server rejects `lost_and_found` job submissions | ✅ Done | `bc92166` | `preCheckJobRequest()` returns "internal recovery queue" error before store lookup; 3 tests in `jobs_test.go` |
 
 ---
 
@@ -42,7 +43,7 @@ design doc).
 |---|---|---|
 | `handle_upgrade_config()` | ✅ Compiled, gated | SHA-256 transit check, Cap'n Proto decode, generation increment, disk save, restart signal. Active only when `CONF_ENABLE_UPGRADE_CONFIG=1` |
 | `push_config_to_standbys()` | ⚠ Stub (returns 0) | Wire protocol for `OP_replConfigPush` deferred — standbys catch up via pull on reconnect |
-| `create_lost_and_found()` | ⚠ Stub (no-op) | Synthetic queue/host for WAL recovery with unknown IDs; requires kvmgr integration |
+| `create_lost_and_found()` | ✅ Done | `91e66b8` | Inserts synthetic queue via `create_queue()` and host via `makeWorker()` before `persist_recover()`; gated with `#ifndef XCE_TESTING` for unit test binary |
 
 **Prerequisites before enabling** (`CONF_ENABLE_UPGRADE_CONFIG=1`):
 1. `validate_host()` implemented with real CN allowlist check (see `FUTURE_WORK.md §6`)
@@ -69,7 +70,6 @@ design doc).
 | Item | Severity | Tracked |
 |---|---|---|
 | `push_config_to_standbys()` is a no-op — standbys get new config on reconnect pull, not pushed immediately | LOW | `FUTURE_WORK.md` |
-| `create_lost_and_found()` is a no-op — WAL recovery routes unknown IDs silently without synthetic queue | LOW | `FUTURE_WORK.md` |
 | `do_one_config_fetch()` stub burns ~47s on standby startup (all 20 retry attempts hit -ENOSYS) until fully wired | MEDIUM | Fix: wire `send_repl_config_request` over the pre-Phase-2 SSL connection |
 | Heartbeat listener (`start_heartbeat_listener`) is a no-op stub — simultaneous-boot symmetry relies on priority step only | LOW | `FUTURE_WORK.md §7` |
 | Peers cross-validation hash in `OP_heartbeat` not implemented | LOW | `FUTURE_WORK.md` |
@@ -103,3 +103,6 @@ design doc).
 | `src/controller/testsuite/test_ha_role.c` | +3 election probing tests |
 | `src/controller/testsuite/test_persist_wal.c` | +3 WAL bound tests |
 | `src/controller/testsuite/controller_test.c` | New suites registered |
+| `src/frontend/apiserver/controllers/jobs.go` | +reserved-name guard in `preCheckJobRequest()` |
+| `src/frontend/apiserver/controllers/jobs_test.go` | **New** — 3 tests: lost_and_found rejected, normal queue passes, empty queue passes |
+| `src/docs/config-replication-impl-status.md` | **New** — this file |