The end-of-flow rule is the one I would underline. A webhook that returns 200 while skipping the work looks healthy to every other check, and I've only caught that kind of failure by watching for the completed event instead of the arrival. I also like the test-by-breaking step, because an alert I've never seen fire is just a hope. The habit that saved me most was writing the first action into the alert itself, so a quiet night doesn't turn into a confused search for which dashboard matters.