Having both the rest api and the backend change build states directly in the db can lead to a race condition. This was seen in our integration tests and analyzed by @mprahl :

When a module build is cancelled or resumed, the state is changed in the database via the REST API, then it sends a message that the state changed. The backend then receives the message and runs the appropriate module handler. If the backend is already running another handler on the module, it could then transition the module to another state. The failed handler would then run with the module in the incorrect state and cause the failed handler to change the module build state in the database to failed again, which causes another message to be published, which causes the failed handler to run again.

I have no idea why it was written this way, but it'd be better if the state transitions in the database happened serially only by the backend. Feel free to file a ticket to address this.