Expose structured generation errors to consumers

doc.go

@@ -23,8 +23,9 @@
 // InspectProfile return copied inspection values. Returned values and values
 // passed to extension interfaces are likewise isolated from engine state.
 // Callers own those copies and may mutate them after the call that supplied or
-// returned them. Returned structured errors are likewise caller-owned and may
-// be mutated without affecting engine state or another error.
+// returned them. [CapacityError] values are caller-owned and may be mutated
+// without affecting engine state or another error. Immutable [GenerationError]
+// values are also caller-owned and do not retain shared engine state.
 //
 // # Security and sensitive data
 //
@@ -53,9 +54,14 @@
 // Construction, inspection, handle, and error values, including [Config],
 // [Backend], [RunRequest], [ArtifactRef], [ExecutionTargetOverride], [Profile],
 // [OpenAICompatibleProfileConfig], [ProfileInspection],
-// [PromptInputDefinition], [PromptInspection], [PreparedExecution], and
-// [CapacityError], do not have stable JSON representations. Direct API keys
-// are nevertheless excluded from JSON for every public value.
+// [PromptInputDefinition], [PromptInspection], [PreparedExecution],
+// [CapacityError], and [GenerationError], do not have stable JSON
+// representations. Direct API keys are nevertheless excluded from JSON for
+// every public value.
+
+// Provider-derived [GenerationError] accessor values are untrusted and can
+// contain sensitive request or schema fragments. Applications must apply their
+// own disclosure policy before logging, displaying, or returning them.
 //
 // JSON timestamps use time.Time's RFC 3339 encoding and are omitted when zero.
 // PreparedRun and RunResult durations are encoded as integer milliseconds in