review: error text reaches API clients on three route handlers (js/stack-trace-exposure)

[Taleef7]

What

CodeQL raises js/stack-trace-exposure (medium) at three sinks:

File	Line	Paths
backend-ts/src/routes/runs.ts	157	5
backend-ts/src/routes/measures.ts	163	1
backend-ts/src/worker.ts	194	1

Each is the module's json() helper; the flagged flow is an caught error whose message ends up in the response body.

Why this is filed as review rather than a fix

Unlike the other three items from the first scan, this one has no mechanically correct answer. It is a judgement call about how much diagnostic detail the API should return, and the two failure modes point in opposite directions:

• Returning error text leaks internals — module paths, driver messages, and on a WebChart-backed stack potentially fragments of clinical data in a serialization error. docs/PRODUCTION_READINESS_2026-07.md sets the PHI posture this has to satisfy.
• Returning nothing useful makes a 500 undiagnosable for MIE, who consume the versioned compliance API (docs/COMPLIANCE_API.md) and cannot read our logs.

The likely shape is a correlation id in the response plus the detail in run_logs / the audit trail, but that is a design decision, not a find-and-replace.

Scope

1. Enumerate the seven flows and classify each: developer-facing detail vs client-facing message.
2. Decide the contract — probably an opaque id the client can quote back.
3. Check it against the stability statement in docs/COMPLIANCE_API.md, since response-body shape is part of that contract.

Not urgent

Auth is on for these routes and the deployed stack is a demo tenant. This is worth doing properly rather than quickly.