While using HTTP status codes could work for GraphQL payloads which have only one operation in them, this approach would not work for those which have multiple[0].
> GraphQL looks like it's been implemented by someone who thought 200 and 404 were the only possible codes.
Maybe. Or maybe they decided that a 2xx status would be interpreted as "success" by a non-trivial set of libraries and/or systems. Either way, take it up with the standards committee :-).
0 - http://spec.graphql.org/October2021/#sec-Executing-Requests