A detection stopped firing after a source vendor renamed a field and the parser no longer maps it. Which approach best fits?

1. Measure coverage impact and replace it with a narrower evidence-based tuning change.
2. Restore the normalized field mapping and add detection-contract regression checks.
3. Use supported grouping or deduplication with explicit entity and time scope.
4. Version the rule with rationale, test cases, and an accountable owner.