What changed
OpenClaw 2026.11.2 is a signed stable release that keeps secrets, conversation content, tool errors and channel payloads out of diagnostic logs, enforces selected provider and navigation boundaries, releases MCP grants after warm CLI turns, and preserves account identity across retries and scheduled delivery.
Why it matters
The release narrows several quiet authority leaks at once: sensitive content in diagnostics, stale tool grants, provider navigation and the identity used by durable delivery. Those controls matter most when an agent survives restarts or sends work later through a different channel.
What to do
Canary 2026.11.2 with synthetic secrets, diagnostic log capture, a denied provider navigation, a warm CLI MCP grant and a scheduled delivery interrupted before retry. Verify that logs omit sensitive payloads, the grant is released, the correct account sends exactly once and restart recovery preserves the intended state.
Caveat
The signed artifact and 115 merged changes are maintainer evidence, not independent cross-platform validation. Channel, plugin and native-client behavior remains deployment-specific, and reduced diagnostic detail can make troubleshooting harder.