Stream the tenant audit log (SSE)

API key required (Authorization: Bearer <key>, or ?apiKey= for browsers’ EventSource, which cannot set headers). Server-sent events: each event: receipt frame’s data is one complete receipt, plus : ping heartbeats. On connect, replays the most recent replay receipts (default 20, max 50), then holds the connection open up to timeout seconds (default 10, max 12) emitting new receipts, then closes. Reconnect and resume with since (a receiptId) or the Last-Event-ID header EventSource sends automatically; the cursor guarantees at-least-once delivery with no gaps. decision filters the replay and the live hold to one decision (ALLOW, DENY, or STEP_UP, case-insensitive; anything else is a 400). One tenant’s stream never carries another tenant’s receipts. This is the feed behind ./writ stream and the dashboard’s live audit log.