Keep secrets out, and group the repeats

The temptation during an incident is to log the whole request body. That body often carries tokens, addresses or card fragments, and once written it outlives the incident. Log the shape of the payload, not its contents.

Repeated failures are the second problem. An alert rule that fires per failure floods the channel the moment one dependency stalls, and a muted channel hides the real fault.

openclaw alert-rule add   --name "Correlate Repeated Failures"   --group-by "correlation_id,metric"   --window "15m"   --action "Send one alert carrying the id and the count instead of one alert per failure."

Group by the correlation id and the metric so one logical run's repeats collapse into a single message with a count. The signal stays readable, and nobody has to mute the channel to work.