gate: streaming — the model's events relayed as they come, the fringe as the last block

Bamidbar 15:39 u'reitem oto — the fringe must be seen, so a streaming
client gets it too. With "stream": true the request is opened
asynchronously (Gate.Upstream.open_stream/4, httpc stream: :self) and
Gate.Stream relays every complete SSE event to the caller unchanged
while gathering the text deltas; the terminal events (Anthropic
message_delta + message_stop; OpenAI the finish_reason chunk + [DONE])
are held until the gathered text has been examined, then released
behind the fringe sent as one more text block, with the `bikoret` object
added to the terminal event the client already parses. No X-Bikoret-*
headers on a stream (they leave before the model speaks); no rebuke on a
stream (nothing streamed can be taken back — 422). An examination that
fails after the stream began is said in the trailer ("— bikoret: not
examined (…)"), never silent. One api_calls_external gathered before the
call, as for any pass. Tamid §1.1, Construction §3.10, KOHEN. Doorpost
40e7d7d1…. Elixir 612/0 (read before this commit).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

specs/bikoret_tamid.md

@@ -458,7 +458,21 @@ Response (200): the upstream's reply, with
                    rebuked?: {first_bedikah_ref, first_verdict}, disclosure }
 
   Any non-200 from the upstream is returned as it came (X-Bikoret-Verdict: none).
-  A stream request is refused (422): a fringe needs the whole garment.
+
+Streaming ("stream": true): the model's events are relayed as they
+  arrive, bytes unchanged, while the text is gathered; when the model's
+  stream ends the text is examined and the fringe is sent as ONE MORE
+  BLOCK before the terminal events — Anthropic: content_block_start /
+  content_block_delta / content_block_stop at the next index; OpenAI: one
+  more chunk with delta.content — and the `bikoret` object rides on the
+  terminal event the client already parses (message_delta; the chunk
+  with finish_reason), where an unknown field is ignored. Headers go out
+  before the model speaks, so a streamed reply has NO X-Bikoret-* headers
+  and cannot be rebuked ("stream" with X-Bikoret-Rebuke → 422). If the
+  examination fails after the stream has begun, the trailer says
+  "— bikoret: not examined (<why>)" and the object's verdict is "none":
+  delivered, marked, never silent. Gathered text is capped at 65,536
+  bytes like any output.
 
 Rebuke once: when X-Bikoret-Rebuke is "once" and the first reply is
 lo_tov, one second request = the first + the first reply as an

specs/bikoret_vayakhel.md

@@ -547,9 +547,15 @@ Headers:
 
 **What the gate does with it** (`VavPipeline.Gate`):
 
-1. Forwards the body unchanged (the `stream` flag is refused: 422 — a
-   fringe needs the whole garment). The upstream's status and body are
-   returned verbatim on any non-200.
+1. Forwards the body unchanged. The upstream's status and body are
+   returned verbatim on any non-200. With `stream: true` the request is
+   opened asynchronously (`Gate.Upstream.open_stream/4`, OTP httpc
+   `stream: :self`) and `Gate.Stream` relays each complete SSE event to
+   the caller as it arrives, gathering the text deltas; the terminal
+   events (Anthropic `message_delta` + `message_stop`; OpenAI the
+   `finish_reason` chunk + `[DONE]`) are held until the examination has
+   run, then released behind the fringe block, the `bikoret` object
+   added to the terminal event. No rebuke on a stream.
 2. Reads the reply's text (`content[].text` / `choices[0].message.content`)
    and examines it: provenance from the upstream (`anthropic → claude`,
    `openai → gpt`); **query** = the last user message's text; **sources**