### Fixes

- ACP: treat rejected timeout config options as best-effort hints so ACP turns continue with adapters that do not support `session/set_config_option` timeout keys. Fixes #81250. (#81603) Thanks @qkal.

- Cron/Codex: default exact-command scheduled agent turns to lightweight bootstrap context so automation runs the command before loading workspace identity or memory context.

- Codex plugin/Gateway: strip unpaired UTF-16 surrogates from Codex app-server JSON-RPC payloads and let stale reply-work recovery abort stalled reply runs, preventing malformed media turns from wedging gateway lanes.

- Codex app server: force OAuth refresh requests to perform a real token refresh instead of reusing unchanged inherited auth-profile tokens after refresh failures. (#80738) Thanks @simplyclever914.

| `plugin-sdk/acp-runtime` | ACP runtime/session and reply-dispatch helpers |

| `plugin-sdk/acp-runtime-backend` | Lightweight ACP backend registration and reply-dispatch helpers for startup-loaded plugins |

| `plugin-sdk/acp-binding-resolve-runtime` | Read-only ACP binding resolution without lifecycle startup imports |

| `plugin-sdk/codex-mcp-projection` | Reserved bundled Codex helper for projecting user MCP server config into Codex app-server thread config; not for third-party plugins |

| `plugin-sdk/codex-native-task-runtime` | Reserved bundled Codex helper for mirroring native Codex tasks into OpenClaw task registry; not for third-party plugins |

| `plugin-sdk/agent-config-primitives` | Narrow agent runtime config-schema primitives |

| `plugin-sdk/boolean-param` | Loose boolean param reader |

| `plugin-sdk/dangerous-name-runtime` | Dangerous-name matching resolution helpers |