A paused book is refused, not woken up
The proxied api-key path asked the platform whether the machine was running and started it if it was not, and never read the book's status — so two calls put a cancelled customer back to writing their ledger.
The wake helper never looked at the book’s status row. A paused book — an owner’s suspend, an operator’s, or a cancelled org’s books being suspended together — was restarted by the next proxied request, and the row went on saying suspended while the machine ran. This is the api-key path the plugin’s writes go through.
The status check now runs before the wake, and the refusal carries a new
book_paused code rather than folding into the 409 the route already answers.
The code is the point rather than the sentence: every other 409 on this route is
transient and clients sleep on all of them — the plugin retries six times with a
five-second sleep. A paused book never clears, so filing it under the transient
type is a caller waiting thirty seconds for something that nothing is doing.
The contract bumps because a caller that got 200 now gets 409. The client that needs a code change is the plugin, which gains its own paused error, deliberately not a subclass of the unavailable one — inheritance would put it straight back into the retry loop it was written to leave.