The 'broken pipe' error under set -euo pipefail was masking the real answer. Capture status + content-type + first-char in one curl, dump first 200 bytes of body on failure so we can see what the server actually served.