Mail goes in, nothing comes out verifiedimportant
Seven readings in order, from the broker inwards — the sequence that found both real cases on the stand.
In detail
The order is deliberate: it goes from the cheapest reading to the most specific, and each step eliminates a whole class of cause. The two that actually happened during this work were an accidental cluster pause — created by a malformed API call that answered 200 — and a throttle limiting a destination to one connection, which looked like slowness rather than a stop. The trap in all of this is that a paused node looks healthy: the service is active, the log is quiet, the queue simply grows. Nothing raises an alarm, which is why the first reading is the broker rather than the engine.