The most expensive default in the API verifiedcritical

Both interception endpoints — pauses and forced errors — are built so that the target narrows an action that otherwise applies to all traffic. That is defensible as a design and dangerous as a default, because every way of getting the body wrong lands on the widest possible outcome: a misspelled field name, a form-encoded body, a JSON parse failure, an empty object. Measured, not reasoned: a body of x=1 sent to the pause endpoint returned 200 with {"cluster": true}, and the node stopped sending. A message published afterwards stayed in outbox with no line in the send log until the pause was deleted, after which it was processed within seconds. The same body shape at the errors endpoint installed a forced error for all mail. The rule for anything we build: never call these endpoints without an explicit target, validate the target before sending rather than after, and read the response — "cluster": true in a reply to a request that named a domain means the field name was wrong and the action is now global.