same shape as the oauthError fix: http_api.xrpcError wrote the error body and returned success, so every guard written as `return http_api.xrpcError(...)` inside a helper called with `try` — requireRepoScope, requireBlobScope, requireRepoMatches, requireActiveAccount, requirePublicRepoAvailable, requireSpaceScope, validatePlcOperation, verifyCreateAccountServiceAuth, verifyImportedRepoCar, and the rest of the audit — let the handler continue and overwrite the error with a 200. for createRecord that meant an OAuth token without the collection's scope, or a body naming someone else's repo, still wrote the record. xrpcError now returns error.HandledResponse after writing; the server loop already treats that as "answered". every existing non-terminal call site was followed by `return error.HandledResponse`, so nothing skips cleanup, and parseJsonBody's bad-JSON path becomes the 400 it meant to be instead of a 500. tools/smoke.sh asserts createRecord for another repo is 400 InvalidRepo and writes nothing, and getRecord on a missing repo stays 404; both fail on the previous code. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>