@openparachute/vault 0.6.4-rc.6 → 0.6.4-rc.8

package/src/mirror-manager.ts

@@ -369,6 +369,170 @@ async function readCurrentOrigin(repoDir: string): Promise<string | null> {
   return url.length > 0 ? url : null;
 }
 
+// ---------------------------------------------------------------------------
+// Git history read surface (vault#300)
+//
+// The vault is already git-backed via the mirror — one file per note, so
+// `git log` IS a tamper-evident, time-travelable, diffable write history.
+// These helpers SURFACE that history through the admin-gated REST + CLI
+// read paths. No write-path change, no schema change, no new table — the
+// history already exists on disk; we just read it.
+//
+// Same Bun.spawn-git shape as `readCommitsUnpushed` / `readCurrentOrigin`
+// above (spawn array argv, capture stdout, parse) so REST + CLI share ONE
+// implementation and there's no drift between them.
+// ---------------------------------------------------------------------------
+
+/** A single commit in the mirror's history. */
+export interface HistoryEntry {
+  /** Full commit sha. */
+  sha: string;
+  /** ISO-8601 author date (`%aI`). */
+  date: string;
+  /** Commit subject line (`%s`). */
+  message: string;
+}
+
+/** Default cap on how many commits a history read returns. */
+export const HISTORY_DEFAULT_LIMIT = 100;
+/** Hard ceiling — even an explicit `?limit=` can't exceed this. */
+export const HISTORY_MAX_LIMIT = 1000;
+
+/**
+ * Normalize + validate a note path for use as a `git log -- <path>.md`
+ * pathspec. Returns the `<path>.md` argv token, or null when the path is
+ * unsafe / empty.
+ *
+ * The path goes into an ARRAY-spawn argv (no shell), so this isn't guarding
+ * against shell injection — it's guarding against directory traversal
+ * (`..`) and absolute paths escaping the mirror dir, plus normalizing the
+ * leading-slash + trailing-`.md` shape so the pathspec matches the file the
+ * exporter actually wrote (`<note.path>.md`, see portable-md.ts).
+ */
+export function noteHistoryPathspec(notePath: string): string | null {
+  const trimmed = notePath.trim();
+  if (trimmed.length === 0) return null;
+  // Reject absolute paths and traversal — the pathspec must stay inside the
+  // mirror working tree. A `..` segment (or a leading `/`) could otherwise
+  // point `git log` at files outside the vault's note tree.
+  if (trimmed.startsWith("/")) return null;
+  const segments = trimmed.split("/");
+  if (segments.some((s) => s === "..")) return null;
+  // The exporter writes `<note.path>.md`. Accept a path the caller already
+  // suffixed with `.md` (idempotent) or bare; emit the `.md` form either way.
+  const base = trimmed.endsWith(".md") ? trimmed.slice(0, -3) : trimmed;
+  if (base.length === 0) return null;
+  return `${base}.md`;
+}
+
+/**
+ * Read the mirror's commit history via `git log`. Optionally scoped to a
+ * single note's file (`opts.notePath` → `git log --follow -- <path>.md`).
+ *
+ * Returns an ordered (newest-first) array of `{ sha, date, message }`.
+ * Tolerant of the not-yet-a-repo / no-commits-yet cases — those return an
+ * empty array rather than throwing, so a freshly-bootstrapped (or never-
+ * bootstrapped) mirror reads as "no history yet", not a 500.
+ *
+ * `git log` field separators: we use `%H` (full sha), `%aI` (ISO author
+ * date), `%s` (subject). A literal record separator (`\x1f`) joins the
+ * three fields and a literal unit separator (`\x1e`) terminates each record
+ * so a multi-line-unfriendly subject (it isn't — `%s` is the subject line
+ * only) or a commit message containing our delimiters can't desync parsing.
+ *
+ * The git binary preflight is the CALLER's responsibility (REST + CLI both
+ * call `ensureGitAvailable` before this) — but a missing-repo `git log`
+ * exits non-zero, which we map to `[]`, so even an un-preflighted call
+ * degrades to "empty" rather than a crash.
+ */
+export async function readMirrorHistory(
+  repoDir: string,
+  opts: { notePath?: string; limit?: number } = {},
+): Promise<HistoryEntry[]> {
+  const limit = Math.min(
+    Math.max(1, Math.floor(opts.limit ?? HISTORY_DEFAULT_LIMIT)),
+    HISTORY_MAX_LIMIT,
+  );
+  const FIELD_SEP = "\x1f";
+  const RECORD_SEP = "\x1e";
+  const format = `%H${FIELD_SEP}%aI${FIELD_SEP}%s${RECORD_SEP}`;
+  const args = [
+    "log",
+    `--max-count=${limit}`,
+    `--pretty=format:${format}`,
+  ];
+  if (opts.notePath) {
+    const spec = noteHistoryPathspec(opts.notePath);
+    // An unsafe / empty path yields no history rather than an unscoped log.
+    if (spec === null) return [];
+    // `--follow` traces the file across renames (the vault renames note
+    // files when a note's path changes). `--` ends the option list so the
+    // pathspec is never mistaken for a flag.
+    args.push("--follow", "--", spec);
+  }
+  const proc = Bun.spawn(["git", ...args], {
+    cwd: repoDir,
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const exitCode = await proc.exited;
+  // Non-zero: not a git repo, no commits yet, or a path with no history.
+  // All map to "empty history" — never a thrown error.
+  if (exitCode !== 0) return [];
+  const out = new TextDecoder().decode(
+    await new Response(proc.stdout).arrayBuffer(),
+  );
+  const entries: HistoryEntry[] = [];
+  for (const record of out.split(RECORD_SEP)) {
+    const trimmed = record.trim();
+    if (trimmed.length === 0) continue;
+    const [sha, date, ...rest] = trimmed.split(FIELD_SEP);
+    if (!sha || !date) continue;
+    entries.push({
+      sha,
+      date,
+      // `%s` never contains FIELD_SEP, but rejoin defensively so a delimiter
+      // that somehow slipped into a subject doesn't truncate the message.
+      message: redactToken(rest.join(FIELD_SEP)),
+    });
+  }
+  return entries;
+}
+
+/**
+ * Read a single past revision of a note file: `git show <sha>:<path>.md`.
+ * Returns the file content at that commit, or null when the path is unsafe,
+ * the sha/path pair doesn't resolve, or git exits non-zero.
+ *
+ * The sha + path both go into an array-spawn argv (no shell). The sha is
+ * validated to a hex-only shape (git accepts abbreviated shas + symbolic
+ * refs, but for this read surface we only allow `[0-9a-f]` so a caller can't
+ * smuggle a `..`-style ref or option-looking token). The path runs through
+ * the same `noteHistoryPathspec` normalization as the log read.
+ */
+export async function showMirrorRevision(
+  repoDir: string,
+  sha: string,
+  notePath: string,
+): Promise<string | null> {
+  const cleanSha = sha.trim();
+  // Hex-only, bounded. Covers full + abbreviated shas; rejects refs,
+  // ranges, and anything option-looking.
+  if (!/^[0-9a-f]{4,64}$/.test(cleanSha)) return null;
+  const spec = noteHistoryPathspec(notePath);
+  if (spec === null) return null;
+  const proc = Bun.spawn(["git", "show", `${cleanSha}:${spec}`], {
+    cwd: repoDir,
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const exitCode = await proc.exited;
+  if (exitCode !== 0) return null;
+  return new TextDecoder().decode(
+    await new Response(proc.stdout).arrayBuffer(),
+  );
+}
+
 /**
  * Singleton lifecycle controller. Holds the active mirror config, the
  * resolved path, hook subscriptions (when sync_mode=events), the

package/src/mirror-routes.ts

@@ -34,7 +34,11 @@ import {
   validateMirrorConfigShape,
   type MirrorConfig,
 } from "./mirror-config.ts";
-import type { MirrorManager } from "./mirror-manager.ts";
+import {
+  readMirrorHistory,
+  showMirrorRevision,
+  type MirrorManager,
+} from "./mirror-manager.ts";
 import { getMirrorManager } from "./mirror-registry.ts";
 import {
   applyToGitRemote,
@@ -296,6 +300,183 @@ export async function handleMirrorPushNow(
   );
 }
 
+/**
+ * `GET /vault/<name>/.parachute/mirror/history` — surface the mirror's git
+ * commit history (vault#300).
+ *
+ * The vault is already git-backed via the mirror (one file per note), so
+ * `git log` IS a tamper-evident, diffable write history. This endpoint
+ * SURFACES it through the admin gate — it's a read-only ops/forensics
+ * surface, not a content read path (hence admin, not read, scoped upstream).
+ *
+ * Query params:
+ *   - `?path=<note.path>` — scope the log to a single note's file
+ *     (`git log --follow -- <path>.md`). An unsafe path (traversal /
+ *     absolute) yields an empty list, never an unscoped log.
+ *   - `?limit=<n>` — cap the number of commits (default
+ *     HISTORY_DEFAULT_LIMIT, clamped to HISTORY_MAX_LIMIT).
+ *
+ * Response: 200 `{ history: [{ sha, date, message }], mirror_path,
+ * path?, limit }`. Degrades gracefully:
+ *   - mirror disabled / no path resolved → 200 with empty history + a
+ *     `note` explaining the mirror isn't initialized (not a 500).
+ *   - git not installed → 503 git_not_installed (consistent with the other
+ *     mirror routes).
+ *   - no commits yet / path with no history → 200 empty history.
+ */
+export async function handleMirrorHistory(
+  req: Request,
+  manager: MirrorManager,
+): Promise<Response> {
+  const url = new URL(req.url);
+  const pathParam = url.searchParams.get("path") ?? undefined;
+  const limitParam = url.searchParams.get("limit");
+  let limit: number | undefined;
+  if (limitParam !== null) {
+    const n = Number(limitParam);
+    if (!Number.isInteger(n) || n <= 0) {
+      return Response.json(
+        {
+          error: "Invalid limit",
+          field: "limit",
+          message: "limit must be a positive integer.",
+        },
+        { status: 400 },
+      );
+    }
+    limit = n;
+  }
+
+  const status = manager.getStatus();
+  // No resolved mirror path means the mirror was never enabled /
+  // bootstrapped for this vault — there's no git repo to read. Return an
+  // empty history with an explanatory note rather than a 500/404; the
+  // caller (SPA / CLI) renders "no history yet, enable backup to start".
+  if (!status.mirror_path) {
+    return Response.json(
+      {
+        history: [],
+        mirror_path: null,
+        ...(pathParam ? { path: pathParam } : {}),
+        note: "Mirror is not initialized for this vault — no git history exists yet. Enable history (backup) to start recording write history.",
+      },
+      { headers: { "Access-Control-Allow-Origin": "*" } },
+    );
+  }
+
+  // Preflight git — the helper degrades a missing repo to [], but a
+  // git-less server should get the friendly, actionable 503 (same shape as
+  // the import / PUT routes) rather than a silently-empty list.
+  try {
+    ensureGitAvailable();
+  } catch (err) {
+    if (err instanceof GitNotInstalledError) {
+      return Response.json(
+        {
+          error: "git not installed",
+          error_type: "git_not_installed",
+          message: err.message,
+        },
+        { status: 503 },
+      );
+    }
+    throw err;
+  }
+
+  const history = await readMirrorHistory(status.mirror_path, {
+    notePath: pathParam,
+    limit,
+  });
+  return Response.json(
+    {
+      history,
+      mirror_path: status.mirror_path,
+      ...(pathParam ? { path: pathParam } : {}),
+      ...(limit !== undefined ? { limit } : {}),
+    },
+    { headers: { "Access-Control-Allow-Origin": "*" } },
+  );
+}
+
+/**
+ * `GET /vault/<name>/.parachute/mirror/history/show?sha=<sha>&path=<note.path>`
+ * — read a single note file at a past revision (`git show <sha>:<path>.md`).
+ * The companion to `/history`: history lists the commits, this reads what a
+ * note looked like at one of them. Admin-gated (vault#300).
+ *
+ * Query params (both required):
+ *   - `sha` — a commit sha (hex, validated in `showMirrorRevision`).
+ *   - `path` — the note path (normalized to `<path>.md`).
+ *
+ * Response:
+ *   200 `{ sha, path, content }` — the file content at that revision.
+ *   400 — missing sha/path.
+ *   404 — the sha/path pair doesn't resolve (unknown sha, note didn't
+ *         exist at that commit, or an unsafe path).
+ *   503 — git not installed.
+ */
+export async function handleMirrorHistoryShow(
+  req: Request,
+  manager: MirrorManager,
+): Promise<Response> {
+  const url = new URL(req.url);
+  const sha = url.searchParams.get("sha")?.trim() ?? "";
+  const notePath = url.searchParams.get("path")?.trim() ?? "";
+  if (sha.length === 0 || notePath.length === 0) {
+    return Response.json(
+      {
+        error: "sha and path required",
+        message:
+          "Provide both `sha` (a commit from /history) and `path` (the note path) query params.",
+      },
+      { status: 400 },
+    );
+  }
+
+  const status = manager.getStatus();
+  if (!status.mirror_path) {
+    return Response.json(
+      {
+        error: "Mirror not initialized",
+        message:
+          "No git history exists for this vault yet — enable history (backup) first.",
+      },
+      { status: 404 },
+    );
+  }
+
+  try {
+    ensureGitAvailable();
+  } catch (err) {
+    if (err instanceof GitNotInstalledError) {
+      return Response.json(
+        {
+          error: "git not installed",
+          error_type: "git_not_installed",
+          message: err.message,
+        },
+        { status: 503 },
+      );
+    }
+    throw err;
+  }
+
+  const content = await showMirrorRevision(status.mirror_path, sha, notePath);
+  if (content === null) {
+    return Response.json(
+      {
+        error: "Revision not found",
+        message: `No content for ${notePath} at ${sha} — the sha may be unknown, the note may not have existed at that commit, or the path is invalid.`,
+      },
+      { status: 404 },
+    );
+  }
+  return Response.json(
+    { sha, path: notePath, content },
+    { headers: { "Access-Control-Allow-Origin": "*" } },
+  );
+}
+
 /**
  * Convenience for tests + future callers: build the GET response from a
  * known-good config without needing a real MirrorManager.

package/src/routes.ts

@@ -328,7 +328,7 @@ function parseMetaBrackets(url: URL): {
         return {
           error: json(
             {
-              error: `bracket-date filter on \`${field}\` supports only \`gte\` (inclusive lower bound) and \`lt\` (exclusive upper bound). Got: \`${op}\`. The dateFilter contract uses these two ops because the equivalent flat shape (\`date_field=${field}&date_from=…&date_to=…\`) is half-open by design.`,
+              error: `bracket-date filter on \`${field}\` supports only \`gte\` (inclusive lower bound) and \`lt\` (exclusive upper bound). Got: \`${op}\`. The dateFilter contract is half-open by design.`,
               code: "INVALID_QUERY",
             },
             400,
@@ -623,20 +623,13 @@ export function parseNotesQueryOpts(url: URL): {
     lastUpdatedBy: parseQuery(url, "last_updated_by") ?? undefined,
     createdVia: parseQuery(url, "created_via") ?? undefined,
     lastUpdatedVia: parseQuery(url, "last_updated_via") ?? undefined,
-    ...(bracket.dateFilter
-      ? { dateFilter: bracket.dateFilter }
-      : parseQuery(url, "date_field")
-        ? {
-            dateFilter: {
-              field: parseQuery(url, "date_field")!,
-              from: parseQuery(url, "date_from") ?? undefined,
-              to: parseQuery(url, "date_to") ?? undefined,
-            },
-          }
-        : {
-            dateFrom: parseQuery(url, "date_from") ?? undefined,
-            dateTo: parseQuery(url, "date_to") ?? undefined,
-          }),
+    // Date-range filtering on the query string is bracket-style only:
+    // `?meta[created_at][gte]=…&meta[created_at][lt]=…` (see
+    // `parseMetaBrackets`). The flat `date_field` / `date_from` / `date_to`
+    // params were removed in 0.6.4 (vault#288, breaking) — they are now
+    // ignored. The MCP `date_from` / `date_to` shorthand is a separate,
+    // supported convenience and is unaffected.
+    ...(bracket.dateFilter ? { dateFilter: bracket.dateFilter } : {}),
     sort: (parseQuery(url, "sort") as "asc" | "desc") ?? undefined,
     orderBy: parseQuery(url, "order_by") ?? undefined,
     limit: parseInt10(parseQuery(url, "limit")) ?? 50,
@@ -907,7 +900,7 @@ async function handleNotesInner(
 
       // Structured query
       //
-      // Two filter syntaxes coexist on this endpoint:
+      // Date-range filtering on the query string uses one syntax:
       //
       //   - **Bracket-style** (canonical, vault#285 friction point 1.3):
       //     `?meta[field][op]=value` / `?meta[created_at][gte]=…`. Exposes
@@ -915,21 +908,18 @@ async function handleNotesInner(
       //     not_in/exists) and the dateFilter bridge through one consistent
       //     shape. See `parseMetaBrackets` for the grammar.
       //
-      //   - **Flat date params** (DEPRECATED): `?date_field=created_at&
-      //     date_from=…&date_to=…` and the legacy `?date_from=…&date_to=…`.
-      //     Still functional through 0.5.x; planned removal in a later 0.x
-      //     (vault#288). New consumers should use bracket-style.
-      //
-      // Precedence on overlap: bracket-style wins. If a caller passes both
-      // `meta[created_at][gte]=X` and `date_field=created_at&date_from=Y`,
-      // the bracket form is the dateFilter the engine sees; the flat
-      // params are silently dropped. We don't error — the bracket form is
-      // documented as canonical, and rejecting the overlap would block a
-      // realistic migration path where a caller half-converted their code.
+      // The flat date params (`?date_field=created_at&date_from=…&date_to=…`
+      // and the legacy bare `?date_from=…&date_to=…`) were REMOVED in 0.6.4
+      // (vault#288, breaking change). They are now silently ignored — a
+      // request that passes only flat date params comes back unfiltered.
+      // Bracket-style is functionally complete (full operator set), so no
+      // capability was lost. Migrate `date_field=created_at&date_from=X` to
+      // `meta[created_at][gte]=X` (and `date_to=Y` to `meta[created_at][lt]=Y`).
       //
       // Surface asymmetry: REST flattens to a query string; MCP takes a
-      // nested `date_filter: { field, from, to }` object directly. Both
-      // lower to the same store-level `dateFilter` shape.
+      // nested `date_filter: { field, from, to }` object directly (plus a
+      // top-level `date_from` / `date_to` shorthand, which is unaffected by
+      // this removal). Both lower to the same store-level `dateFilter` shape.
       // Structured-query parsing is shared with the live `/subscribe` route
       // (see `parseNotesQueryOpts`) so both endpoints lower an identical query
       // string to the same `QueryOpts` — predicate parity by construction.

package/src/routing.test.ts

@@ -2266,6 +2266,79 @@ describe("/vault/<name>/.parachute/mirror/run-now — auth + dispatch", () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// /vault/<name>/.parachute/mirror/history — surface the git write history
+// (vault#300). Admin-gated (ops/forensics surface). Tests pin the auth gate
+// matches the sibling mirror routes; helper + handler shape lives in
+// mirror-history.test.ts.
+// ---------------------------------------------------------------------------
+
+describe("/vault/<name>/.parachute/mirror/history — auth + dispatch", () => {
+  test("unauthenticated → 401", async () => {
+    createVault("journal");
+    const p = "/vault/journal/.parachute/mirror/history";
+    const res = await route(new Request(`http://localhost:1940${p}`), p);
+    expect(res.status).toBe(401);
+  });
+
+  test("vault:read token → 403 insufficient_scope (admin required)", async () => {
+    createVault("journal");
+    const fullToken = await mintJwt({ vaultName: "journal", scopes: ["vault:journal:read"] });
+    const p = "/vault/journal/.parachute/mirror/history";
+    const res = await route(
+      new Request(`http://localhost:1940${p}`, {
+        headers: { authorization: `Bearer ${fullToken}` },
+      }),
+      p,
+    );
+    expect(res.status).toBe(403);
+    const body = (await res.json()) as { error_type?: string; required_scope?: string };
+    expect(body.error_type).toBe("insufficient_scope");
+    expect(body.required_scope).toBe("vault:admin");
+  });
+
+  test("admin token reaches the handler (200 when wired, 503 when not)", async () => {
+    createVault("journal");
+    const token = await createAdminToken("journal");
+    const p = "/vault/journal/.parachute/mirror/history";
+    const res = await route(
+      new Request(`http://localhost:1940${p}`, {
+        headers: { authorization: `Bearer ${token}` },
+      }),
+      p,
+    );
+    // Either way the auth gate passed — that's what this routing-level test pins.
+    expect([200, 503]).toContain(res.status);
+  });
+
+  test("/history/show admin gate matches /history", async () => {
+    createVault("journal");
+    const fullToken = await mintJwt({ vaultName: "journal", scopes: ["vault:journal:read"] });
+    const p = "/vault/journal/.parachute/mirror/history/show";
+    const res = await route(
+      new Request(`http://localhost:1940${p}?sha=abc123&path=Notes/a`, {
+        headers: { authorization: `Bearer ${fullToken}` },
+      }),
+      p,
+    );
+    expect(res.status).toBe(403);
+  });
+
+  test("non-GET method → 405 (or 503 when manager not wired)", async () => {
+    createVault("journal");
+    const token = await createAdminToken("journal");
+    const p = "/vault/journal/.parachute/mirror/history";
+    const res = await route(
+      new Request(`http://localhost:1940${p}`, {
+        method: "POST",
+        headers: { authorization: `Bearer ${token}` },
+      }),
+      p,
+    );
+    expect([405, 503]).toContain(res.status);
+  });
+});
+
 // ---------------------------------------------------------------------------
 // /vault/<name>/.parachute/usage — per-vault data-footprint endpoint.
 //

package/src/routing.ts

@@ -94,6 +94,8 @@ import {
   handleAuthGithubSelectRepo,
   handleAuthPat,
   handleMirrorGet,
+  handleMirrorHistory,
+  handleMirrorHistoryShow,
   handleMirrorImport,
   handleMirrorPushNow,
   handleMirrorPut,
@@ -671,6 +673,50 @@ export async function route(
     return Response.json({ error: "Method not allowed" }, { status: 405 });
   }
 
+  // /.parachute/mirror/history — surface the mirror's git commit history
+  // (vault#300). The vault is already git-backed (one file per note), so
+  // `git log` IS a tamper-evident write history; this read path exposes it.
+  // Admin-gated (it's an ops/forensics surface, not a content read) — same
+  // gate + manager check as the sibling mirror routes. GET-only.
+  //   /history       — full mirror history (?path=<note> scopes to one note,
+  //                    ?limit=<n> caps the count)
+  //   /history/show  — `git show <sha>:<path>.md` to read a past revision
+  if (
+    subpath === "/.parachute/mirror/history" ||
+    subpath === "/.parachute/mirror/history/show"
+  ) {
+    if (!hasScopeForVault(auth.scopes, vaultName, "admin")) {
+      return Response.json(
+        {
+          error: "Forbidden",
+          error_type: "insufficient_scope",
+          message: `This endpoint requires the '${SCOPE_ADMIN}' scope (or '${SCOPE_ADMIN.replace("vault:", `vault:${vaultName}:`)}').`,
+          required_scope: SCOPE_ADMIN,
+          granted_scopes: auth.scopes,
+        },
+        { status: 403 },
+      );
+    }
+    const manager = getMirrorManager(vaultName);
+    if (!manager) {
+      return Response.json(
+        {
+          error: "Mirror manager not initialized",
+          message:
+            "The vault server hasn't wired the mirror manager registry yet (boot hasn't finished, or it failed). Check logs for [mirror] entries.",
+        },
+        { status: 503 },
+      );
+    }
+    if (req.method !== "GET") {
+      return Response.json({ error: "Method not allowed" }, { status: 405 });
+    }
+    if (subpath === "/.parachute/mirror/history/show") {
+      return handleMirrorHistoryShow(req, manager);
+    }
+    return handleMirrorHistory(req, manager);
+  }
+
   // /.parachute/mirror/import — clone a vault export from git + import.
   // Admin-gated. POST-only. Synchronous (imports finish in <30s for
   // typical vaults). See mirror-routes.ts:handleMirrorImport for the

package/src/subscribe.test.ts

@@ -416,9 +416,12 @@ describe("handleSubscribe — rejected query shapes", () => {
     expect(body.error).toContain("has_links");
   });
 
-  it("date filter → 400 (M1) — legacy date_from", async () => {
+  it("date filter → 400 (M1) — bracket date_filter on created_at", async () => {
+    // The flat `date_from` param was removed in 0.6.4 (vault#288) and is now
+    // ignored, so it no longer reaches the M1 date guard. Bracket-style is the
+    // only query-string date filter; assert it's still rejected for live subs.
     const res = await handleSubscribe(
-      subscribeReq("date_from=2026-01-01"),
+      subscribeReq("meta%5Bcreated_at%5D%5Bgte%5D=2026-01-01"),
       store,
       VAULT,
       unscopedScope(),
@@ -430,6 +433,24 @@ describe("handleSubscribe — rejected query shapes", () => {
     expect(body.error).toContain("date");
   });
 
+  it("flat date_from is ignored → subscription created (vault#288 removal)", async () => {
+    // Documents the breaking change: the removed flat param no longer reaches
+    // the date guard, so a sub that ONLY carries it is now a valid (unfiltered)
+    // subscription rather than a 400.
+    const res = await handleSubscribe(
+      subscribeReq("date_from=2026-01-01"),
+      store,
+      VAULT,
+      unscopedScope(),
+      manager,
+    );
+    expect(res.status).toBe(200);
+    expect(res.headers.get("Content-Type")).toBe("text/event-stream");
+    const r = sseReader(res);
+    await r.pump();
+    await r.close();
+  });
+
   it("date filter → 400 (M1) — bracket date_filter on updated_at", async () => {
     const res = await handleSubscribe(
       subscribeReq("meta%5Bupdated_at%5D%5Bgte%5D=2026-01-01"),