A failed provider call's body cut off at its 16 KiB size bound can end inside an echoed key, and the error then quotes a prefix of the key: internal/adapter/openaiapi/client.go reads a non-200 body through io.LimitReader(maxErrorBodyBytes), and providerSaid trims whitespace before bounding the echo to 200 bytes, so a 401 body of whitespace padding followed by the key yields the key's first bytes in the refusal, which the scrub (whole key forms only) does not match. Reproduced at the streaming lane's tip by TestAnErrorBodyCutOffIsNotQuoted/cut_by_the_size; the same read on main has the same cut.

A failed provider call's body cut off at its 16 KiB size bound can end inside an echoed key, and the error then quotes a prefix of the key: internal/adapter/openaiapi/client.go reads a non-200 body through io.LimitReader(maxErrorBodyBytes), and providerSaid trims whitespace before bounding the echo to 200 bytes, so a 401 body of whitespace padding followed by the key yields the key's first bytes in the refusal, which the scrub (whole key forms only) does not match. Reproduced at the streaming lane's tip by TestAnErrorBodyCutOffIsNotQuoted/cut_by_the_size; the same read on main has the same cut.

Grounds

• pursued: no refusal of a failed call carries any prefix of the key however its body is cut, as TestAnErrorBodyCutOffIsNotQuoted proves for the wait and the size cut; a provider error body that arrives whole but is still unscrubbable, or a cut path other than these three, would show it wrong.