[AndreLYL]

Weixin QR login fails with dns_rejected when the system resolver returns a Fake-IP address. Add an explicit weixin_dns: google option for login and message transport, using the existing HTTPS DNS implementation while retaining public-address validation, numeric pinning and the original Weixin TLS hostname. System DNS remains the default.

Shutdown typing cleanup reuses a public endpoint already validated by the same client, preserving its independent three-second cleanup budget without restarting cancelled DNS requests. The connection guide explains when to select the option.

Validation:

• Offline tests cover QR login and authenticated polling, separation of DNS queries from credentials, rejection of mixed public/Fake-IP answers, configuration validation and shutdown after cancellation.
• Windows targeted transport/lifecycle tests and native runtime/onboarding checks passed.
• Linux Python 3.11/3.14 full engine regression and upgrade, Windows/macOS native checks and container CI all passed.
• A private Windows deployment completed QR binding, event subscription, existing-DOT message reading and interim/final replies. The owner confirmed both text replies were visible exactly once. Further live tests verified image recognition/original-image return and CSV processing/generated-file return, including the generated CSV values. The owner confirmed satisfaction with all three media test results. Voice passed via Weixin transcription and text output; direct audio understanding and generated spoken replies did not pass (the existing Fal connection returned UNAUTHORIZED). Disconnect recovery remains unverified. The capability and validation documents record these boundaries.