[kevmo314]

Problem

Error group CKSyptWhubTOeA (two events about 1s apart on 0cf4831):

HTTP POST /unban returned 500: provider returned HTTP 400

This is a regression from #1752. That PR treated a 400 as a malformed request (and alerted) when Twitch's message mentioned parameter|required|malformed|valid. Twitch's own unban refusal wording mentions the "user_id query parameter", so a normal "this user isn't banned" refusal was reported as an agent bug. I reproduced it with that wording against main: the response was a 500.

The same problem showed up on other endpoints: Twitch deleteMessage/clear and every Kick action (ban, unban, timeout, deleteMessage, send) had no refusal handling. Any 4xx where the provider explained its refusal turned into a 500 alert.

Fix

Refusals are now classified in one place for all chat actions, and the provider's wording is no longer interpreted:

• clients.HTTPError.Explained records only whether the provider gave a reason (a non-blank JSON message, the field Twitch and Kick use). The text is never stored, so it can't leak into logs or responses.
• providerRejection in the shared chat wrapper turns an explained 400/404/409/422 into failed-precondition " rejected this request." The existing 429 → resource-exhausted mapping moved into it. This applies to every action and every provider. YouTube keeps its own reason-based mapping.
• The wording heuristic is removed from writeBan. Known Twitch phrasings ("already banned", "not banned", …) still get their specific messages.
• Still alerts: 5xx responses, 401/403, a 4xx with no message, an empty or non-JSON body, and transport failures.

The "agent bugs should still alert" guarantee no longer depends on guessing from provider text at runtime. It now comes from test-time contracts: TestTwitchModerationAndRaids and TestKickActions already check the query parameters and body of every request these actions send.

Tests

• New unban refusal naming its parameter row, using Twitch-style wording. It fails on main with a 500 and passes here.
• New TestProviderRejectionsAcrossEndpoints covers Twitch delete/clear and Kick ban/unban/delete across 400/404/409/422. It also checks that unexplained, non-JSON, non-string-message and 5xx responses still alert, and that provider text never reaches logs or responses.
• Removed the four Report unrecognized Twitch ban and timeout refusals as rejections #1752 rows that pinned wording-based "malformed" detection, since that behavior was the bug.

go test ./... passes except the internal/youtube live tests, which need youtube.com (blocked in the sandbox where this was developed).

Known gaps

• 401/403 still alert on purpose. For moderation that usually means the user isn't a moderator or a scope is missing, which may deserve its own user-facing mapping. That's left out of scope here.

---

Generated by Claude Code