Review (posted as a comment because GitHub refuses a formal review on a PR under the same account).

The design and the door are solid: constant-time token check, every write scoped by the source's own base, unknown keys refused at the door, deterministic re-serialisation, no migration, and ADR 0054 reads true for decisions 1, 2 and 4 to 7. One thing breaks decision 3 and the PR's own example, so please fix it before merging.

Blocking: a pushed statement's when / ended is never recorded. locate_time (crates/utopia-server/src/extraction_open.rs:76) starts with let (q, span) = quote?;, and the door requires s[i][0] to be null ("the item is its own evidence", sources_routes.rs:679), so for every pushed statement the lookup returns None before it searches the chunk and run_open takes the TIME_NOT_IN_QUOTE branch (extraction_open.rs:685): the fact lands with only the document's doc_time, a drop signal is written per statement and time_mentions::record is never called. Pushing the ADR's example ("when": "08:14:03") yields a fact with no time mention and one drop. The DB test passes because it asserts phrase, entities and evidence but never counts time_mentions. Suggest: in the pushed branch, search the chunk itself when the quote is null, and add an assertion that one time mention lands in a_pushed_statement_reaches_the_open_graph_without_a_model.

Two smaller asks

• A subject (or an n entity) that is not listed in e passes the door's shape check, answers 200 created, then is dropped silently as UNKNOWN_REF in extraction, which is exactly what decision 5 says the door should not do. Resolve s[i][1] and n[i][0] against e at the door (same folding as name_key) and answer 422.
• Tests: none for deleted: true (tombstone, missing_since, revival), the missing Authorization header, the 64 KiB / 200-item limits, or a non-null n[i][2] quote. The auth, unknown-key, api-source 404 and versioning paths are genuinely covered.

Pre-existing and not blocking: the body is buffered before the token check (axum's default 2 MiB), same as the existing push; a DefaultBodyLimit on the route would close it cheaply.

CI green, DCO fine, i18n in both packs. Happy to merge once the time path is fixed.

Updated in a0b3875, all three points.

Time words (blocking). On the pushed path the words are now located in the chunk directly (the chunk is the payload), instead of going through locate_time, which returns at quote? before it searches. a_pushed_statement_reaches_the_open_graph_without_a_model now asserts that one time mention (08:14:03, role when) lands on the fact; I ran it with the fix stashed and it fails there, so it does guard the path.

Unlisted subject / n entity. The door resolves s[i][1] and n[i][0] against e with the same folding as name_key (whitespace and case only) and answers 422 naming the slot. An object not in e still lands as a literal value, as it does for a model's reply; the record and the guide say both.

Tests. Added: tombstone marks and a new push revives (missing_since set, then cleared, document never deleted); a tombstone for an identity never pushed is a no-op that still answers marked_missing; the missing Authorization header; the 64 KiB limit over HTTP (still 422 with the message, not a 413); the 200-item limit; an n entity not in e; a non-null n quote; and a subject that differs only by case and whitespace, which must pass.

The route also carries DefaultBodyLimit of four payloads now, so the 2 MiB default is no longer buffered ahead of the token check.

Local: clippy clean, the five statements tests and the extraction_open unit tests pass on a fresh database.

Re-reviewed a0b3875. All three points are addressed: the pushed branch locates time words in the chunk itself (extraction_open.rs:680) instead of through locate_time, and the DB test now asserts the 08:14:03 mention lands; the door resolves s[i][1] and n[i][0] against e with the same name_key folding and answers 422 naming the slot; the new tests cover tombstone and revival, an unknown-identity tombstone, the missing Authorization header, the 64 KiB limit over HTTP, the 200-item limit, an n entity not in e, a non-null n quote and a folded subject that must pass, and the route carries a DefaultBodyLimit. Approved on my side once CI is green; merging waits for Wayland's explicit go, as asked.

Ran the branch end to end against a real server (fresh database, port 8319, job worker on, no chat model): register → workspace → base → create a Statements source → read its token → push the record's example over HTTP → wait for the worker → read the graph back. All 26 checks pass at ecf32fb: door refusals (401 wrong or missing key, 422 unknown key, 422 unlisted subject), created/unchanged/updated/marked_missing, one JSON document with two versions, the open statement on the entity as an unbound relation, the when time mention, an evidence row with no quote, only known_as on the typed layer, the earlier statement listed under review's unconfirmed queue after the update rather than invalidated.

It found one gap, fixed in ecf32fb: GET /token and POST /rotate-token still gated on kind == "api", so a Statements source's token could be seen once at creation and never again. Both now accept either push kind, with a test that reads the token back, rotates it, and checks the old one is refused.

The resolve_time and align_types jobs log a warning without a chat model, as they do for any document; extraction itself reaches done.