Found in mission 002. A webex function route doing JSON.parse(req.body) on `{bad` answers 500 with a body containing the located message (api.hl:31:9 ...), leaking the source path; log shows error.InvalidOperation in the event handler fiber. Server survives. Expected: a non-aborting parse (e.g. JSON.tryParse returning null or {error}) so apps can answer 400.