diff --git a/CLOUDFLARE.md b/CLOUDFLARE.md
index ec2bc2c76f..c52c6ff7d0 100644
--- a/CLOUDFLARE.md
+++ b/CLOUDFLARE.md
@@ -319,5 +319,12 @@ Expected results:
 
 ## Recovery
 
+The router retains custom logs and uncaught exceptions at full sampling. Routine
+per-request invocation logs and tracing are disabled, and request URL query strings
+are redacted. This preserves failure evidence without a log for every successful
+asset request. The configuration takes effect after Worker deployment and cannot
+recover errors from periods when logging was disabled. Inspect Worker logs alongside
+HTTP response-status analytics; an explicit HTTP 5xx response need not throw an exception.
+
 For a router regression, use Cloudflare's deployment history to roll back to the
 prior Worker version, then rerun live smoke. Routine deployment does not change DNS.
diff --git a/wrangler.toml b/wrangler.toml
index a2b00fefd2..09dd3b60da 100644
--- a/wrangler.toml
+++ b/wrangler.toml
@@ -6,6 +6,18 @@ routes = [
   { pattern = "documentation.openclaw.ai/*", zone_name = "openclaw.ai" }
 ]
 
+[observability]
+redact_query_string = true
+
+[observability.logs]
+enabled = true
+head_sampling_rate = 1
+# Keep failure logs without storing an invocation record for every request.
+invocation_logs = false
+
+[observability.traces]
+enabled = false
+
 [[r2_buckets]]
 binding = "DOCS_BUCKET"
 bucket_name = "openclaw-docs"