text/event-stream with JSON frames {channel, printer_id, type, ts, data}. Without printer_id it carries every printer the caller may see plus the hub channel (hub.printers_changed) and the sheets channel (sheet.updated). An API key without admin scope gets job.state_changed and run.state_changed (live and in the snapshot) only for the jobs and tape runs it submitted. Ends with auth.expired when the session or key stops being valid. Returns 404 for an unknown printer_id, 403 when the credentials exclude it, 429 when LABELYARD_SSE_MAX_SUBSCRIBERS connections are open.