[Aaronontheweb]

Summary

This PR prepares the stable patch release 0.28.3.

• Directory.Build.props: <VersionPrefix> is 0.28.3. <VersionSuffix> stays empty. <PackageReleaseNotes> holds the 0.28.3 notes.
• RELEASE_NOTES.md: the Unreleased section is now 0.28.3 (2026-11-07). It lists each user-facing change since the 0.28.2 tag.

Main changes in the release

• The daemon redacts and frames every log record (feat(logging): redact and frame every daemon log record #2766, fix(logging): close the log redaction gaps of #2770 #2789). Request query strings stay out of the log (security: keep request query strings out of daemon logs #2745).
• Notification webhook URLs and header values move to secrets.json (fix(notifications): keep webhook URLs and auth headers in secrets.json, keyed by name #2778).
• The default output limit no longer shrinks with a prompt estimate (fix(models): cap the default output limit by window/4 instead of a per-call prompt estimate #2784).
• A scripted uninstall exists for Linux, macOS, and Windows (feat: add scripted uninstall for Linux, macOS, and Windows #2690).
• netclaw skill show and netclaw skill remove read the daemon registry (fix(skills): serve skill show and remove from the daemon registry (#2728) #2734).
• MCP OAuth finds metadata for an issuer that has a path (fix(mcp): find OAuth metadata for an issuer that has a path #2738). The CLI shows the client registration remedy (fix(mcp): show the client registration remedy in the CLI #2741).
• netclaw doctor reads the active daemon log on Windows (fix(doctor): read active daemon logs on Windows #2786).

Upgrade impact

The database format does not change. The config format stays valid. The release notes list the five behavior changes.

Excluded from the notes

These PRs change CI, tests, internal docs, or specs only: #2730, #2753, #2765, #2779, #2780, #2782, #2785, #2790.

Validation

• dotnet build Netclaw.slnx -c Release passes with 0 errors.
• dotnet slopwatch analyze reports 0 issues.
• Each .cs file has a copyright header.

After the merge

The maintainer merges this PR and pushes the 0.28.3 tag from dev. This PR does not create a tag or a GitHub release.