Don't override 5xx errors

apps/backend/src/route-handlers/smart-response.tsx

@@ -140,8 +140,8 @@ export async function createResponse<T extends SmartResponse>(req: NextRequest |
     headers.set("cache-control", ["no-store, max-age=0"]);
 
 
-    // If the x-stack-override-error-status header is given, override error statuses to 200
-    if (req?.headers.has("x-stack-override-error-status") && status >= 400 && status < 600) {
+    // If the x-stack-override-error-status header is given, override 4xx statuses to 200.
+    if (req?.headers.has("x-stack-override-error-status") && status >= 400 && status < 500) {
       status = 200;
       headers.set("x-stack-actual-status", [obj.statusCode.toString()]);
     }

claude/CLAUDE-KNOWLEDGE.md

@@ -374,3 +374,6 @@ A: Function parameter types are checked contravariantly, so helper signatures li
 
 Q: What breaks when bulldozer tests stop using `bindTableToExecutionContext` wrappers?
 A: Any trigger callbacks written as `(changesTable) => ...` can fail against the strict `RowChangeTriggerInput` signature once wrappers are removed. Update those callbacks to explicit two-arg form like `(_ctx, changesTable) => ...`, and make helper types (for example table facades and lifecycle instrumentation helpers) use ctx-first method signatures so all table API calls pass `executionContext` explicitly.
+
+Q: How should `x-stack-override-error-status` behave in backend smart responses?
+A: In `apps/backend/src/route-handlers/smart-response.tsx`, only override `4xx` responses to `200` with `x-stack-actual-status`. Do not override `5xx`, so infrastructure/runtime failures still surface as real server errors.

sdks/spec/src/_utilities.spec.md

@@ -25,7 +25,7 @@ x-stack-access-type: "client" | "server" | "admin"
   - "client" for StackClientApp
   - "server" for StackServerApp (also include server key header)
 x-stack-override-error-status: "true"
-  - Tells server to return errors as 200 with x-stack-actual-status header
+  - Tells server to return 4xx errors as 200 with x-stack-actual-status header
   - This works around some platforms that intercept non-200 responses
 x-stack-random-nonce: <random-string>
   - Cache buster to prevent framework caching (e.g., Next.js)