1. Canary event?
     Canary not arriving at all       -> Type 1 (phantom). Check: handler subscription, event bus registration.
     Canary arrives, output is wrong  -> Type 3 (counterfeit). Check: handler logic, defaults.

2. Freshness monitoring flagged a stale output?
     Handler has never produced output -> Type 2 (empty). Check: handler body, output destination.
     Output exists but is all defaults -> Type 3 (counterfeit). Check: handler logic, defaults.
     Output was fine and just stopped  -> Something changed. Check: recent deploys, config.

3. Mutation testing left a survivor?
   (This branch tells you what to build, not where to look.)
     Subscription removal survived  -> Type 1 (phantom) risk. Write an integration test.
     Body replacement survived      -> Type 2 (empty) risk. Add output verification.
     Payload corruption survived    -> Type 3 (counterfeit) risk. Add semantic assertions.
     Conditional inversion survived -> Type 4 (monoculture) risk. Add diversity checks.

None of the above, or you cannot tell the source -> Unclassified. Investigate before assuming noise.
