ylib-syim 0.0.21 → 0.0.22

package/bridges/main.ts

@@ -1,4 +1,4 @@
-import { setupBridgeLogger } from "./logger.ts";
+import { formatBeijingLogTimestamp, setupBridgeLogger } from "./logger.ts";
 import fs from "node:fs";
 import http from "node:http";
 import os from "node:os";
@@ -61,10 +61,14 @@ const localConfigOnly =
 const runtimeStateStorePaths = resolveRuntimeStateStorePaths(
   (process.env.IM_AGENT_HUB_HOME || "").trim() || undefined,
 );
+// runtime-state.json 是运行态的磁盘 warm snapshot。默认关闭读写，避免空配置、
+// 配置源异常或本地误配置时把历史账号状态从磁盘恢复回内存并重新展示。
+// 需要本地调试/对比实验时再显式开启：
+//   RUNTIME_STATE_WARM_RESTORE=1 RUNTIME_STATE_SNAPSHOT_PERSIST=1
 const runtimeStateWarmRestoreEnabled =
-  process.env.RUNTIME_STATE_WARM_RESTORE !== "0";
+  process.env.RUNTIME_STATE_WARM_RESTORE === "1";
 const runtimeStateSnapshotPersistEnabled =
-  process.env.RUNTIME_STATE_SNAPSHOT_PERSIST !== "0";
+  process.env.RUNTIME_STATE_SNAPSHOT_PERSIST === "1";
 const runtimeStateEventJournalEnabled =
   process.env.RUNTIME_STATE_EVENT_JOURNAL !== "0";
 const RUNTIME_STATE_EVENT_JOURNAL_MAX_BYTES_DEFAULT = 5 * 1024 * 1024;
@@ -123,6 +127,10 @@ const runtimeStatusProbeTimeoutMsWeixin = Math.max(
   runtimeStatusProbeTimeoutMs,
   Number(process.env.RUNTIME_STATUS_PROBE_TIMEOUT_MS_WEIXIN || "4000") || 4000,
 );
+const runtimeAccountControlTimeoutMs = Math.max(
+  1_000,
+  Number(process.env.RUNTIME_ACCOUNT_CONTROL_TIMEOUT_MS || "10000") || 10000,
+);
 /** 与 OpenClaw `channels.status` 的 `timeoutMs` 语义对齐：最小 1000ms，HTTP 入参硬上限。 */
 const RUNTIME_STATUS_PROBE_TIMEOUT_OPENCLAW_MIN_MS = 1_000;
 const RUNTIME_STATUS_PROBE_TIMEOUT_HTTP_MAX_MS = 120_000;
@@ -575,6 +583,7 @@ const runtimeHealthGuardRestartsByHour = new Map<string, number[]>();
 
 // bot 控制并发保护（platform+account 粒度）。
 const botControlInFlight = new Set<string>();
+let runtimeConfigApplyInFlight = false;
 // 账号归一化日志去重集合。
 const runtimeAccountNormalizationLogMemo = new Set<string>();
 
@@ -669,6 +678,8 @@ type RuntimeChannelActivityEntry = {
 const runtimeChannelActivityRegistry = new Map<string, RuntimeChannelActivityEntry>();
 /** 对标登出语义：用于快照层展示 `lastDisconnect.loggedOut`。 */
 const runtimeLogoutRegistry = new Set<string>();
+/** 手动 stop 生命周期：防止迟到 probe/event 在保护窗后把已停止账号恢复为在线。 */
+const runtimeManualStoppedKeys = new Set<string>();
 
 type RuntimeStateSnapshotFilePayload = {
   schema_version: 1;
@@ -925,6 +936,28 @@ function markRuntimeAccountLoggedOut(
   });
 }
 
+function runtimeAccountKey(
+  platform: RuntimePlatform,
+  bot_account_id: string,
+): string {
+  const normalized = normalizeRuntimeAccountId(platform, bot_account_id);
+  return keyOf(platform, normalized || bot_account_id);
+}
+
+function markRuntimeAccountManuallyStopped(
+  platform: RuntimePlatform,
+  bot_account_id: string,
+): void {
+  runtimeManualStoppedKeys.add(runtimeAccountKey(platform, bot_account_id));
+}
+
+function clearRuntimeAccountManualStop(
+  platform: RuntimePlatform,
+  bot_account_id: string,
+): void {
+  runtimeManualStoppedKeys.delete(runtimeAccountKey(platform, bot_account_id));
+}
+
 // shouldSkipAccountProbe: 按账号跳过未过期的 probe（对标按需探活）。
 function shouldSkipAccountProbe(
   key: string,
@@ -1186,6 +1219,41 @@ function applyRemoteRuntimeConfigToPluginHome(): void {
   }
 }
 
+function persistRuntimeConfigSnapshot(params: {
+  config: Record<string, unknown>;
+  targetPath: string;
+  reason: string;
+}): void {
+  const targetPath = String(params.targetPath || "").trim();
+  if (!targetPath) {
+    throw new Error("target config path is empty");
+  }
+  const dir = path.dirname(targetPath);
+  fs.mkdirSync(dir, { recursive: true });
+  const tempPath = path.join(
+    dir,
+    `.${path.basename(targetPath)}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`,
+  );
+  try {
+    fs.writeFileSync(
+      tempPath,
+      JSON.stringify(params.config, null, 2),
+      "utf-8",
+    );
+    fs.renameSync(tempPath, targetPath);
+    console.log(
+      `[bridges/main] runtime config persisted reason=${params.reason} path=${targetPath}`,
+    );
+  } catch (err) {
+    try {
+      if (fs.existsSync(tempPath)) fs.unlinkSync(tempPath);
+    } catch {
+      // ignore cleanup failure; original persist error is more useful.
+    }
+    throw err;
+  }
+}
+
 // nowIso: 生成当前 ISO 时间戳。
 function nowIso(): string {
   // 全链路统一使用 ISO 字符串时间戳。
@@ -1647,6 +1715,39 @@ function hasFreshRuntimeEventLivenessForProbeGuard(
   return ageMs <= runtimeStatusProbeDowngradeGuardEventFreshMs;
 }
 
+function isConnectedRuntimeEventLivenessName(
+  eventName: string | null | undefined,
+): boolean {
+  const normalized = String(eventName || "")
+    .trim()
+    .toLowerCase();
+  return (
+    normalized === "socket_open" ||
+    normalized === "socket_keepalive" ||
+    normalized === "websocket_open" ||
+    normalized === "websocket_keepalive" ||
+    normalized === "get_updates_ok" ||
+    normalized === "status:connected" ||
+    normalized === "status_sink:connected"
+  );
+}
+
+function hasFreshConnectedRuntimeEventLivenessForRecovery(
+  key: string,
+  nowMs = Date.now(),
+): boolean {
+  const eventLiveness = runtimeEventLivenessRegistry.get(key);
+  if (!isConnectedRuntimeEventLivenessName(eventLiveness?.last_event)) {
+    return false;
+  }
+  const eventAtMs = parseIsoTimeMs(
+    String(eventLiveness?.last_event_at || "").trim() || null,
+  );
+  if (eventAtMs == null) return false;
+  const ageMs = Math.max(0, nowMs - eventAtMs);
+  return ageMs <= runtimeStatusProbeDowngradeGuardEventFreshMs;
+}
+
 function shouldGuardProbeDowngradeByFreshEvent(params: {
   key: string;
   prev: RuntimeBotStatus;
@@ -1678,12 +1779,29 @@ function shouldGuardProbeConnectedByEventBroken(params: {
 }
 
 function shouldBypassProtectWindowForEventRecovery(params: {
+  key: string;
   prev: RuntimeBotStatus;
   next: RuntimeBotStatus;
 }): boolean {
-  const { prev, next } = params;
+  const { key, prev, next } = params;
   const prevSource = prev.status_source || "probe";
   const nextSource = next.status_source || "probe";
+  // manual/connecting 是控制面临时态：表示启动/重启请求已经提交，
+  // 不是数据面证明“仍在连接中”。当后续 event 明确回传 connected 时，
+  // 应立即收敛为在线；否则会因为 manual rank 更高，在保护窗内持续
+  // 抑制 connected，导致前端看到“已有 keepalive 成功但仍显示连接中”。
+  // probe 只能证明凭证/API 可用，不一定证明 WebSocket/long-poll 数据面
+  // 已恢复，所以 probe/connected 只有在存在新鲜 connected 事件事实时才旁路。
+  if (
+    prevSource === "manual" &&
+    prev.link_status === "connecting" &&
+    next.link_status === "connected"
+  ) {
+    if (nextSource === "event") return true;
+    if (nextSource === "probe") {
+      return hasFreshConnectedRuntimeEventLivenessForRecovery(key);
+    }
+  }
   if (prevSource !== "event" || nextSource !== "event") return false;
   const prevBroken =
     prev.link_status === "disconnected" ||
@@ -1843,6 +1961,36 @@ function upsertRuntimeStatus(entry: RuntimeBotStatus): void {
     });
   }
 
+  if (
+    prev &&
+    normalizedEntry.status_source !== "manual" &&
+    runtimeManualStoppedKeys.has(key)
+  ) {
+    const stoppedApplied: RuntimeBotStatus = {
+      ...prev,
+      last_heartbeat_at:
+        normalizedEntry.last_heartbeat_at || prev.last_heartbeat_at,
+      last_probe_at: normalizedEntry.last_probe_at || prev.last_probe_at,
+      reconnect_count:
+        normalizedEntry.reconnect_count ?? prev.reconnect_count,
+      restart_pending: false,
+      running: false,
+      busy: normalizedEntry.busy ?? prev.busy,
+      active_runs: normalizedEntry.active_runs ?? prev.active_runs,
+      last_run_activity_at:
+        normalizedEntry.last_run_activity_at || prev.last_run_activity_at,
+      mode: normalizedEntry.mode || prev.mode,
+    };
+    runtimeStatusRegistry.set(key, stoppedApplied);
+    syncRuntimeChannelSnapshotFromStatus(stoppedApplied);
+    mirrorHeartbeatFromStatus(stoppedApplied);
+    scheduleRuntimeStateSnapshotPersist();
+    logRuntimeStatusDebug(
+      `status preserved manual-stop key=${key} prev=${prev.status_source || "probe"}/${prev.link_status} next=${normalizedEntry.status_source || "probe"}/${normalizedEntry.link_status}`,
+    );
+    return;
+  }
+
   if (
     prev &&
     shouldGuardProbeDowngradeByFreshEvent({
@@ -1971,6 +2119,7 @@ function upsertRuntimeStatus(entry: RuntimeBotStatus): void {
     const windowMs = resolveStatusProtectWindowMs(prev);
     const bypassProtectWindowForEventRecovery =
       shouldBypassProtectWindowForEventRecovery({
+        key,
         prev,
         next: normalizedEntry,
       });
@@ -1982,6 +2131,9 @@ function upsertRuntimeStatus(entry: RuntimeBotStatus): void {
       !bypassProtectWindowForEventRecovery
     ) {
       // 低优先级回写被抑制时，仍更新部分时效字段，避免观测面停滞。
+      const preserveManualStopLifecycle =
+        (prev.status_source || "probe") === "manual" &&
+        prev.link_status === "disconnected";
       logSuppressedTransition({
         key,
         prev,
@@ -1999,12 +2151,22 @@ function upsertRuntimeStatus(entry: RuntimeBotStatus): void {
         last_probe_at: normalizedEntry.last_probe_at || prev.last_probe_at,
         reconnect_count:
           normalizedEntry.reconnect_count ?? prev.reconnect_count,
-        last_event: normalizedEntry.last_event || prev.last_event,
-        last_event_at: normalizedEntry.last_event_at || prev.last_event_at,
+        last_event: preserveManualStopLifecycle
+          ? prev.last_event
+          : normalizedEntry.last_event || prev.last_event,
+        last_event_at: preserveManualStopLifecycle
+          ? prev.last_event_at
+          : normalizedEntry.last_event_at || prev.last_event_at,
         restart_pending:
-          normalizedEntry.restart_pending ?? prev.restart_pending ?? false,
-        running:
-          normalizedEntry.running ?? prev.running,
+          preserveManualStopLifecycle
+            ? prev.restart_pending ?? false
+            : normalizedEntry.restart_pending ?? prev.restart_pending ?? false,
+        // manual/disconnected 是显式停止生命周期。迟到的 keepalive/probe
+        // 被保护窗抑制时不能顺手把 running 改回 true，否则展示层会从
+        // “已停止”漂成普通“离线”，OpenClaw 兼容快照的 lastStopAt 也会失真。
+        running: preserveManualStopLifecycle
+          ? prev.running ?? false
+          : normalizedEntry.running ?? prev.running,
         busy: normalizedEntry.busy ?? prev.busy,
         active_runs: normalizedEntry.active_runs ?? prev.active_runs,
         last_run_activity_at:
@@ -2474,6 +2636,16 @@ function restorePersistedRuntimeStateSnapshot(
     restored_filter:
       allowedKeys && allowedKeys.size > 0 ? "configured_accounts_only" : "all",
   });
+  logRuntimeConfigReconcile({
+    trigger: "startup_restore",
+    mode: "startup_restore",
+    nextAccounts: collectConfiguredAccountIdsByPlatform(config),
+    affectedAccounts: allowedKeys ? Array.from(allowedKeys).sort() : undefined,
+    restoredSnapshots,
+    restoredHeartbeats,
+    restoredEvents,
+    restoredDisconnects,
+  });
   scheduleRuntimeStateSnapshotPersist();
 }
 
@@ -2559,12 +2731,66 @@ function upsertRuntimeProbe(entry: RuntimeProbeEntry): void {
   scheduleRuntimeStateSnapshotPersist();
 }
 
+function normalizeRuntimeEventName(eventName: string | null | undefined): string {
+  return String(eventName || "")
+    .trim()
+    .toLowerCase();
+}
+
+const telemetryEventAliases: Record<string, string> = {
+  "runtime-channel-inbound": "runtime_channel_inbound",
+  "runtime.channel.inbound": "runtime_channel_inbound",
+  channel_inbound: "runtime_channel_inbound",
+  "runtime-channel-outbound": "runtime_channel_outbound",
+  "runtime.channel.outbound": "runtime_channel_outbound",
+  channel_outbound: "runtime_channel_outbound",
+  "runtime-transport-disconnect": "runtime_transport_disconnect",
+  "runtime.transport.disconnect": "runtime_transport_disconnect",
+  transport_disconnect: "runtime_transport_disconnect",
+  "runtime-account-logged-out": "runtime_account_logged_out",
+  "runtime.account.logged_out": "runtime_account_logged_out",
+  account_logged_out: "runtime_account_logged_out",
+};
+
+const telemetryEventCanonicalAliases: Record<string, string> = {
+  runtimechannelinbound: "runtime_channel_inbound",
+  runtimechanneloutbound: "runtime_channel_outbound",
+  runtimetransportdisconnect: "runtime_transport_disconnect",
+  runtimeaccountloggedout: "runtime_account_logged_out",
+  channelinbound: "runtime_channel_inbound",
+  channeloutbound: "runtime_channel_outbound",
+  transportdisconnect: "runtime_transport_disconnect",
+  accountloggedout: "runtime_account_logged_out",
+};
+
+function canonicalizeRuntimeEventName(eventName: string): string {
+  return eventName.replace(/[^a-z0-9]/g, "");
+}
+
+function normalizeRuntimeTelemetryEventName(eventName: string): string {
+  const direct = telemetryEventAliases[eventName];
+  if (direct) return direct;
+  const canonical = canonicalizeRuntimeEventName(eventName);
+  return telemetryEventCanonicalAliases[canonical] || eventName;
+}
+
+function isTelemetryLikeEventName(eventName: string | null | undefined): boolean {
+  const normalized = normalizeRuntimeEventName(eventName);
+  if (!normalized) return false;
+  const canonical = canonicalizeRuntimeEventName(normalized);
+  if (!canonical) return false;
+  return (
+    canonical.includes("channel") ||
+    canonical.includes("transport") ||
+    canonical.includes("logout") ||
+    canonical.includes("loggedout")
+  );
+}
+
 // isDiagnosticOnlyEvent: 运行时判定函数。
 function isDiagnosticOnlyEvent(eventName: string | null | undefined): boolean {
   // 诊断事件不驱动 link_status，只更新 diagnostic 维度。
-  const normalized = String(eventName || "")
-    .trim()
-    .toLowerCase();
+  const normalized = normalizeRuntimeEventName(eventName);
   return (
     normalized === "runtime_log_diagnostic" ||
     normalized === "runtime_diagnostic"
@@ -2574,9 +2800,7 @@ function isDiagnosticOnlyEvent(eventName: string | null | undefined): boolean {
 // isHeartbeatOnlyEvent: 运行时判定函数。
 function isHeartbeatOnlyEvent(eventName: string | null | undefined): boolean {
   // 心跳类事件只更新 heartbeat/activity，不写最终状态。
-  const normalized = String(eventName || "")
-    .trim()
-    .toLowerCase();
+  const normalized = normalizeRuntimeEventName(eventName);
   return (
     normalized === "runtime_heartbeat" ||
     normalized === "heartbeat" ||
@@ -2586,7 +2810,9 @@ function isHeartbeatOnlyEvent(eventName: string | null | undefined): boolean {
 
 // isTelemetryOnlyEvent: 仅更新 activity / lastDisconnect / 登出注册表，不要求 link_status。
 function isTelemetryOnlyEvent(eventName: string | null | undefined): boolean {
-  const n = String(eventName || "").trim();
+  const n = normalizeRuntimeTelemetryEventName(
+    normalizeRuntimeEventName(eventName),
+  );
   return (
     n === "runtime_channel_inbound" ||
     n === "runtime_channel_outbound" ||
@@ -3653,7 +3879,7 @@ function readRecentBridgeErrorFromLog(
   return null;
 }
 
-/** Bridge file lines from setupBridgeLogger: `[ISO] [log|info|warn|error|debug] message` */
+/** Bridge file lines from setupBridgeLogger: `[Asia/Shanghai timestamp] [log|info|warn|error|debug] message` */
 const BRIDGE_FILE_ERROR_LINE = /^\[[^\]]+\] \[error\] /;
 
 // getBridgeLoggerFilePath: 运行时辅助函数。
@@ -3711,7 +3937,7 @@ function buildRuntimeLogDownloadFileName(logFilePath: string | null): string {
     const baseName = path.basename(candidate).trim();
     if (baseName) return baseName;
   }
-  return `im-agent-hub-runtime-${new Date().toISOString().replace(/[:.]/g, "-")}.log`;
+  return `im-agent-hub-runtime-${formatBeijingLogTimestamp().replace(/[:.]/g, "-")}.log`;
 }
 
 // parseRuntimeLogDownloadMaxBytes: 解析输入并返回规范化结果。
@@ -3877,10 +4103,34 @@ function clearPlatformStatuses(
       runtimeLogoutRegistry.delete(key);
     }
   }
+  for (const key of Array.from(runtimeManualStoppedKeys)) {
+    if (key.startsWith(`${platform}:`)) {
+      runtimeManualStoppedKeys.delete(key);
+    }
+  }
   recomputeRuntimeHeartbeatLastReceivedAt();
   scheduleRuntimeStateSnapshotPersist();
 }
 
+function clearAllRuntimeStateRegistries(): void {
+  runtimeStatusRegistry.clear();
+  runtimeChannelSnapshotRegistry.clear();
+  runtimeHeartbeatRegistry.clear();
+  runtimeEventLivenessRegistry.clear();
+  runtimeHeartbeatLastReceivedAt = null;
+  runtimeDiagnosticRegistry.clear();
+  runtimeProbeRegistry.clear();
+  runtimeAuditRegistry.clear();
+  runtimeLastDisconnectRegistry.clear();
+  runtimeHealthReasonMemo.clear();
+  runtimeHealthGuardRecoveringKeys.clear();
+  runtimeHealthGuardLastRestartAtMs.clear();
+  runtimeHealthGuardRestartsByHour.clear();
+  runtimeChannelActivityRegistry.clear();
+  runtimeLogoutRegistry.clear();
+  runtimeManualStoppedKeys.clear();
+}
+
 // prunePlatformStatusesByAccounts: 运行时辅助函数。
 function prunePlatformStatusesByAccounts(
   platform: "dingtalk" | "feishu" | "weixin",
@@ -3949,6 +4199,13 @@ function prunePlatformStatusesByAccounts(
       runtimeLogoutRegistry.delete(key);
     }
   }
+  for (const key of Array.from(runtimeManualStoppedKeys)) {
+    if (!key.startsWith(`${platform}:`)) continue;
+    const accountKey = key.slice(platform.length + 1);
+    if (!normalizedAccountSet.has(accountKey)) {
+      runtimeManualStoppedKeys.delete(key);
+    }
+  }
 
   recomputeRuntimeHeartbeatLastReceivedAt();
   scheduleRuntimeStateSnapshotPersist();
@@ -4005,6 +4262,232 @@ function readConfiguredAccountIds(
   return hasLegacyRootCredential() ? ["__default__"] : [];
 }
 
+function collectConfiguredAccountIdsByPlatform(
+  config: Record<string, unknown> | null,
+): Record<RuntimePlatform, string[]> {
+  const empty: Record<RuntimePlatform, string[]> = {
+    dingtalk: [],
+    feishu: [],
+    weixin: [],
+  };
+  if (!config || typeof config !== "object" || Array.isArray(config)) {
+    return empty;
+  }
+  const pairs: Array<
+    [RuntimePlatform, "dingtalk-connector" | "feishu" | "openclaw-weixin"]
+  > = [
+    ["dingtalk", "dingtalk-connector"],
+    ["feishu", "feishu"],
+    ["weixin", "openclaw-weixin"],
+  ];
+  for (const [platform, channelKey] of pairs) {
+    const normalizedIds = Array.from(
+      new Set(
+        readConfiguredAccountIds(config, channelKey)
+          .map((accountId) => normalizeRuntimeAccountId(platform, accountId, config))
+          .map((accountId) => String(accountId || "").trim())
+          .filter((accountId) => accountId.length > 0),
+      ),
+    );
+    empty[platform] = normalizedIds;
+  }
+  return empty;
+}
+
+function markRuntimeAccountsConnecting(
+  platform: RuntimePlatform,
+  accountIds: string[],
+  lastEvent = "config_loaded",
+): string[] {
+  const normalizedIds = Array.from(
+    new Set(
+      accountIds
+        .map((accountId) => String(accountId || "").trim())
+        .filter((accountId) => accountId.length > 0),
+    ),
+  );
+  if (normalizedIds.length === 0) return [];
+  const startedAt = nowIso();
+  for (const accountId of normalizedIds) {
+    clearRuntimeAccountManualStop(platform, accountId);
+    upsertRuntimeStatus({
+      platform,
+      bot_account_id: accountId,
+      link_status: "connecting",
+      started_at: startedAt,
+      last_heartbeat_at: startedAt,
+      last_error: null,
+      reconnect_count: 0,
+      restart_pending: false,
+      busy: false,
+      active_runs: 0,
+      last_run_activity_at: startedAt,
+      mode: null,
+      last_event: lastEvent,
+      status_source: "manual",
+      last_probe_at: null,
+    });
+  }
+  return normalizedIds;
+}
+
+function logRuntimeConfigReconcile(params: {
+  trigger: string;
+  mode: "full_reset" | "incremental" | "startup_restore";
+  previousAccounts?: Record<RuntimePlatform, string[]>;
+  nextAccounts?: Record<RuntimePlatform, string[]>;
+  addedAccounts?: Record<RuntimePlatform, string[]>;
+  removedAccounts?: Record<RuntimePlatform, string[]>;
+  removedStopResults?: Record<RuntimePlatform, Array<Record<string, unknown>>>;
+  affectedAccounts?: string[];
+  markConnecting?: boolean;
+  restoredSnapshots?: number;
+  restoredHeartbeats?: number;
+  restoredEvents?: number;
+  restoredDisconnects?: number;
+}): void {
+  console.log(
+    `[bridges/main][config-reconcile] ${JSON.stringify({
+      trigger: params.trigger,
+      mode: params.mode,
+      mark_connecting:
+        typeof params.markConnecting === "boolean" ? params.markConnecting : null,
+      previous_accounts: params.previousAccounts || null,
+      next_accounts: params.nextAccounts || null,
+      added_accounts: params.addedAccounts || null,
+      removed_accounts: params.removedAccounts || null,
+      removed_stop_results: params.removedStopResults || null,
+      affected_accounts: params.affectedAccounts || null,
+      restored_snapshots:
+        typeof params.restoredSnapshots === "number"
+          ? params.restoredSnapshots
+          : null,
+      restored_heartbeats:
+        typeof params.restoredHeartbeats === "number"
+          ? params.restoredHeartbeats
+          : null,
+      restored_events:
+        typeof params.restoredEvents === "number" ? params.restoredEvents : null,
+      restored_disconnects:
+        typeof params.restoredDisconnects === "number"
+          ? params.restoredDisconnects
+          : null,
+    })}`,
+  );
+}
+
+async function stopRemovedRuntimeAccounts(
+  platform: RuntimePlatform,
+  accountIds: string[],
+): Promise<Array<Record<string, unknown>>> {
+  const normalizedIds = Array.from(
+    new Set(
+      accountIds
+        .map((accountId) => String(accountId || "").trim())
+        .filter((accountId) => accountId.length > 0),
+    ),
+  );
+  if (normalizedIds.length === 0) return [];
+
+  const control = resolveRuntimeBridgeControl(platform);
+  const results: Array<Record<string, unknown>> = [];
+  for (const accountId of normalizedIds) {
+    const result: Record<string, unknown> = {
+      platform,
+      bot_account_id: accountId,
+      attempted: false,
+      ok: false,
+    };
+    if (typeof control?.stopAccount !== "function") {
+      result.reason = "stopAccount_not_available";
+      results.push(result);
+      continue;
+    }
+    result.attempted = true;
+    try {
+      await withRuntimeControlTimeout(
+        control.stopAccount(accountId),
+        `stop removed account timeout platform=${platform} account=${accountId}`,
+      );
+      result.ok = true;
+      result.reason = "stopped_removed_account";
+    } catch (err) {
+      result.error = err instanceof Error ? err.message : String(err);
+      console.warn(
+        `[bridges/main][config-reconcile] stop removed account failed platform=${platform} account=${accountId} err=${String(result.error || "unknown")}`,
+      );
+    }
+    results.push(result);
+  }
+  return results;
+}
+
+async function reconcileRuntimeStateForConfigDelta(params: {
+  previousConfig: Record<string, unknown> | null;
+  nextConfig: Record<string, unknown>;
+  trigger: string;
+}): Promise<void> {
+  const previousAccounts = collectConfiguredAccountIdsByPlatform(
+    params.previousConfig,
+  );
+  const nextAccounts = collectConfiguredAccountIdsByPlatform(params.nextConfig);
+  const addedAccounts: Record<RuntimePlatform, string[]> = {
+    dingtalk: [],
+    feishu: [],
+    weixin: [],
+  };
+  const removedAccounts: Record<RuntimePlatform, string[]> = {
+    dingtalk: [],
+    feishu: [],
+    weixin: [],
+  };
+  const removedStopResults: Record<RuntimePlatform, Array<Record<string, unknown>>> = {
+    dingtalk: [],
+    feishu: [],
+    weixin: [],
+  };
+  const affectedAccounts = new Set<string>();
+
+  const platforms: RuntimePlatform[] = ["dingtalk", "feishu", "weixin"];
+  for (const platform of platforms) {
+    const prevIds = previousAccounts[platform];
+    const nextIds = nextAccounts[platform];
+    const prevSet = new Set(prevIds);
+    const nextSet = new Set(nextIds);
+    const added = nextIds.filter((accountId) => !prevSet.has(accountId));
+    const removed = prevIds.filter((accountId) => !nextSet.has(accountId));
+    addedAccounts[platform] = added;
+    removedAccounts[platform] = removed;
+    removedStopResults[platform] = await stopRemovedRuntimeAccounts(platform, removed);
+
+    if (nextIds.length === 0) {
+      clearPlatformStatuses(platform);
+    } else {
+      prunePlatformStatusesByAccounts(platform, nextIds, params.nextConfig);
+      markRuntimeAccountsConnecting(platform, added);
+    }
+
+    for (const accountId of added) {
+      affectedAccounts.add(keyOf(platform, accountId));
+    }
+    for (const accountId of removed) {
+      affectedAccounts.add(keyOf(platform, accountId));
+    }
+  }
+
+  logRuntimeConfigReconcile({
+    trigger: params.trigger,
+    mode: "incremental",
+    previousAccounts,
+    nextAccounts,
+    addedAccounts,
+    removedAccounts,
+    removedStopResults,
+    affectedAccounts: Array.from(affectedAccounts).sort(),
+    markConnecting: false,
+  });
+}
+
 // isConfiguredRuntimeAccount: 运行时判定函数。
 function isConfiguredRuntimeAccount(
   platform: "dingtalk" | "feishu" | "weixin",
@@ -4044,65 +4527,64 @@ function exposeRuntimeConfigToBridges(
 }
 
 // markConfiguredBotsAsConnecting: 标记运行态以驱动后续状态收敛。
-function markConfiguredBotsAsConnecting(config: Record<string, unknown>): void {
+function markConfiguredBotsAsConnecting(
+  config: Record<string, unknown>,
+  trigger = "config_reset",
+): void {
   // 应用全量配置时重置运行态基线，后续由 probe/event 收敛到真实状态。
-  runtimeStatusRegistry.clear();
-  runtimeChannelSnapshotRegistry.clear();
-  runtimeHeartbeatRegistry.clear();
-  runtimeEventLivenessRegistry.clear();
-  runtimeHeartbeatLastReceivedAt = null;
-  runtimeDiagnosticRegistry.clear();
-  runtimeProbeRegistry.clear();
-  runtimeAuditRegistry.clear();
-  runtimeLastDisconnectRegistry.clear();
-  runtimeHealthReasonMemo.clear();
-  runtimeHealthGuardRecoveringKeys.clear();
-  runtimeHealthGuardLastRestartAtMs.clear();
-  runtimeHealthGuardRestartsByHour.clear();
-  runtimeChannelActivityRegistry.clear();
-  runtimeLogoutRegistry.clear();
-
-  const applyPlatformConnecting = (
-    platform: "dingtalk" | "feishu" | "weixin",
-    channelKey: "dingtalk-connector" | "feishu" | "openclaw-weixin",
-  ): void => {
-    const accountIds = readConfiguredAccountIds(config, channelKey);
-    if (accountIds.length === 0) return;
-    const startedAt = nowIso();
-    for (const accountId of accountIds) {
-      const normalizedAccountId = String(accountId || "").trim();
-      if (!normalizedAccountId) continue;
-      upsertRuntimeStatus({
-        platform,
-        bot_account_id: normalizedAccountId,
-        link_status: "connecting",
-        started_at: startedAt,
-        last_heartbeat_at: startedAt,
-        last_error: null,
-        reconnect_count: 0,
-        restart_pending: false,
-        busy: false,
-        active_runs: 0,
-        last_run_activity_at: startedAt,
-        mode: null,
-        last_event: "config_loaded",
-        status_source: "manual",
-        last_probe_at: null,
-      });
-    }
+  clearAllRuntimeStateRegistries();
+  const nextAccounts = collectConfiguredAccountIdsByPlatform(config);
+  const addedAccounts: Record<RuntimePlatform, string[]> = {
+    dingtalk: markRuntimeAccountsConnecting("dingtalk", nextAccounts.dingtalk),
+    feishu: markRuntimeAccountsConnecting("feishu", nextAccounts.feishu),
+    weixin: markRuntimeAccountsConnecting("weixin", nextAccounts.weixin),
   };
-
-  applyPlatformConnecting("dingtalk", "dingtalk-connector");
-  applyPlatformConnecting("feishu", "feishu");
-  applyPlatformConnecting("weixin", "openclaw-weixin");
+  const affectedAccounts = [
+    ...addedAccounts.dingtalk.map((accountId) => keyOf("dingtalk", accountId)),
+    ...addedAccounts.feishu.map((accountId) => keyOf("feishu", accountId)),
+    ...addedAccounts.weixin.map((accountId) => keyOf("weixin", accountId)),
+  ].sort();
+  logRuntimeConfigReconcile({
+    trigger,
+    mode: "full_reset",
+    nextAccounts,
+    addedAccounts,
+    removedAccounts: {
+      dingtalk: [],
+      feishu: [],
+      weixin: [],
+    },
+    affectedAccounts,
+    markConnecting: true,
+  });
   scheduleRuntimeStateSnapshotPersist();
 }
 
 // markPlatformStarted: 标记运行态以驱动后续状态收敛。
-function markPlatformStarted(platform: "dingtalk" | "feishu" | "weixin"): void {
-  // bridge 进程拉起后，先把该平台已配置账号标记为 connecting。
+function markPlatformStarted(
+  platform: "dingtalk" | "feishu" | "weixin",
+  accountIds?: string[],
+): void {
+  // bridge 进程拉起后的状态标记分两种语义：
+  // - accountIds 为空：冷启动/全平台启动，沿用历史语义，标记该平台全部账号；
+  // - accountIds 非空：单账号 lazy start（bot control / health guard / weixin invoke），
+  //   只能标记目标账号，避免同平台其它已在线账号被误写成 manual/connecting。
+  // 这里不影响真实 bridge 启动范围，只限制运行态标记的受影响账号集合。
+  const targetAccounts = accountIds
+    ? new Set(
+        accountIds
+          // 复用运行态账号归一化，确保 __default__ 单账号别名与 registry key 对齐。
+          .map((accountId) => normalizeRuntimeAccountId(platform, accountId))
+          .map((accountId) => String(accountId || "").trim())
+          .filter((accountId) => accountId.length > 0),
+      )
+    : null;
   for (const value of listRuntimeBotStatuses()) {
     if (value.platform !== platform) continue;
+    // 单账号 lazy start 场景必须跳过非目标账号，防止“新增/启动一个账号”
+    // 把同平台所有账号都短暂打回 connecting。
+    if (targetAccounts && !targetAccounts.has(value.bot_account_id)) continue;
+    clearRuntimeAccountManualStop(platform, value.bot_account_id);
     upsertRuntimeStatus({
       ...value,
       link_status: "connecting",
@@ -4252,8 +4734,12 @@ async function ensureBridgesStartedByConfig(): Promise<void> {
 }
 
 // ensureWeixinBridgeReadyForGatewayInvoke: 确保目标运行资源已就绪。
-async function ensureWeixinBridgeReadyForGatewayInvoke(): Promise<void> {
+async function ensureWeixinBridgeReadyForGatewayInvoke(
+  accountIds?: string[],
+): Promise<void> {
   // weixin 网关调用允许懒启动，避免“首次调用时 bridge 尚未拉起”直接失败。
+  // accountIds 仅用于 lazy start 成功后的状态标记收敛范围；bridge 进程仍是
+  // 平台级进程，不能理解为只启动某个账号。
   if (weixinBridgeStarted) {
     return;
   }
@@ -4275,7 +4761,7 @@ async function ensureWeixinBridgeReadyForGatewayInvoke(): Promise<void> {
   try {
     await import("./weixin-stdio-bridge.ts");
     weixinBridgeStarted = true;
-    markPlatformStarted("weixin");
+    markPlatformStarted("weixin", accountIds);
     console.log("[bridges/main] weixin bridge lazy started");
   } catch (err) {
     console.error(
@@ -4301,8 +4787,11 @@ async function waitBridgeStartingFlag(
 // ensureBridgeReadyForBotControl: 确保目标运行资源已就绪。
 async function ensureBridgeReadyForBotControl(
   platform: RuntimePlatform,
+  accountId?: string,
 ): Promise<void> {
   // bot/start|restart 的兜底懒启动，按平台定向拉起，不走全量启动逻辑。
+  // accountId 用来限制 platform_process_started 的 manual/connecting 写入范围：
+  // 单机器人控制只应影响当前 bot，不能污染同平台其它 bot 的展示态。
   const allowByMode =
     platform === "dingtalk"
       ? startupOnlyMode === "all" || startupOnlyMode === "dingtalk"
@@ -4327,7 +4816,7 @@ async function ensureBridgeReadyForBotControl(
     try {
       await import("./dingtalk-stdio-bridge.ts");
       dingtalkBridgeStarted = true;
-      markPlatformStarted("dingtalk");
+      markPlatformStarted("dingtalk", accountId ? [accountId] : undefined);
       console.log(
         "[bridges/main] dingtalk bridge lazy started for bot control",
       );
@@ -4352,7 +4841,7 @@ async function ensureBridgeReadyForBotControl(
     try {
       await import("./lark-stdio-bridge.ts");
       larkBridgeStarted = true;
-      markPlatformStarted("feishu");
+      markPlatformStarted("feishu", accountId ? [accountId] : undefined);
       console.log("[bridges/main] lark bridge lazy started for bot control");
     } catch (err) {
       console.error(
@@ -4364,7 +4853,9 @@ async function ensureBridgeReadyForBotControl(
     return;
   }
 
-  await ensureWeixinBridgeReadyForGatewayInvoke();
+  await ensureWeixinBridgeReadyForGatewayInvoke(
+    accountId ? [accountId] : undefined,
+  );
 }
 
 // markAllBotsStopped: 标记运行态以驱动后续状态收敛。
@@ -4610,7 +5101,9 @@ async function invokeGatewayMethodByChannel(args: {
     | undefined;
 
   if (args.channel === "weixin" && typeof invoker !== "function") {
-    await ensureWeixinBridgeReadyForGatewayInvoke();
+    await ensureWeixinBridgeReadyForGatewayInvoke(
+      args.accountId ? [args.accountId] : undefined,
+    );
   }
 
   const ensuredInvoker = (globalThis as Record<string, unknown>)[invokerKey] as
@@ -4715,6 +5208,25 @@ async function withProbeTimeout<T>(
   }
 }
 
+async function withRuntimeControlTimeout<T>(
+  work: Promise<T>,
+  timeoutMessage: string,
+  timeoutMs = runtimeAccountControlTimeoutMs,
+): Promise<T> {
+  if (timeoutMs <= 0) return await work;
+  let timer: ReturnType<typeof setTimeout> | null = null;
+  try {
+    return await Promise.race([
+      work,
+      new Promise<T>((_, reject) => {
+        timer = setTimeout(() => reject(new Error(timeoutMessage)), timeoutMs);
+      }),
+    ]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+
 // runWithConcurrency: 执行核心运行流程。
 async function runWithConcurrency<T>(
   items: T[],
@@ -5182,18 +5694,8 @@ async function runFullProbeAndRefreshStatuses(params: {
                       readRecentBridgeErrorFromLog(accountId, "feishu"),
                     )
                   : probeError;
-                const preserveEventStatus =
-                  previous?.status_source === "event" &&
-                  (previous.link_status === "error" ||
-                    previous.link_status === "disconnected" ||
-                    previous.link_status === "degraded");
-
                 const nextStatus: RuntimeBotStatus["link_status"] =
-                  preserveEventStatus
-                    ? previous?.link_status || "connecting"
-                    : ok
-                      ? "connected"
-                      : "error";
+                  ok ? "connected" : "error";
                 const nextError =
                   nextStatus === "connected"
                     ? null
@@ -5241,7 +5743,7 @@ async function runFullProbeAndRefreshStatuses(params: {
                   last_run_activity_at:
                     runtimeHints.last_run_activity_at || probeAt,
                   mode: runtimeHints.mode || previous?.mode || null,
-                  status_source: preserveEventStatus ? "event" : "probe",
+                  status_source: "probe",
                   last_probe_at: probeAt,
                 });
               } catch (err) {
@@ -5560,7 +6062,11 @@ function startProbeLoop(): void {
 }
 
 // pullRuntimeConfigFromPython: 运行时辅助函数。
-async function pullRuntimeConfigFromPython(forceFull = false): Promise<{
+async function pullRuntimeConfigFromPython(
+  forceFull = false,
+  reconcileRuntimeState = true,
+  options: { probeAfterPull?: boolean } = {},
+): Promise<{
   ok: boolean;
   pulled: boolean;
   not_modified?: boolean;
@@ -5569,6 +6075,7 @@ async function pullRuntimeConfigFromPython(forceFull = false): Promise<{
   dropped_fields?: Array<{ channel: string; accountId: string; field: string }>;
 }> {
   // 配置真源是 Python：拉取后先落本地文件，再通知插件读取，最后触发 probe 收敛状态。
+  const probeAfterPull = options.probeAfterPull !== false;
   applyRemoteRuntimeConfigToPluginHome();
   if (!runtimeConfigPullUrl) {
     return {
@@ -5659,7 +6166,30 @@ async function pullRuntimeConfigFromPython(forceFull = false): Promise<{
       };
     }
 
+    let persistedConfigPath: string | null = null;
+    if (runtimeConfigPullPersist) {
+      const targetPath =
+        loadedConfigPathForRuntime || path.join(process.cwd(), "syim.json");
+      // pull 成功但写盘失败时不能先切内存：否则调用方看到失败，
+      // 当前进程却已经按新配置运行，形成“失败响应 + 已变更运行态”。
+      persistRuntimeConfigSnapshot({
+        config: normalizedResult.normalized,
+        targetPath,
+        reason: "config_pull",
+      });
+      persistedConfigPath = targetPath;
+    }
+
+    const previousConfig =
+      loadedConfigForRuntime &&
+      typeof loadedConfigForRuntime === "object" &&
+      !Array.isArray(loadedConfigForRuntime)
+        ? (loadedConfigForRuntime as Record<string, unknown>)
+        : null;
     loadedConfigForRuntime = normalizedResult.normalized;
+    if (persistedConfigPath) {
+      loadedConfigPathForRuntime = persistedConfigPath;
+    }
     exposeRuntimeConfigToBridges(
       loadedConfigForRuntime,
       loadedConfigPathForRuntime,
@@ -5669,20 +6199,15 @@ async function pullRuntimeConfigFromPython(forceFull = false): Promise<{
       String(data?.version || "").trim() || undefined,
     );
     applyRemoteRuntimeConfigToPluginHome();
-    markConfiguredBotsAsConnecting(normalizedResult.normalized);
-    await probeAndRefreshStatuses({ force: true, reason: "config_pull" });
-
-    if (runtimeConfigPullPersist) {
-      const targetPath =
-        loadedConfigPathForRuntime || path.join(process.cwd(), "syim.json");
-      fs.mkdirSync(path.dirname(targetPath), { recursive: true });
-      fs.writeFileSync(
-        targetPath,
-        JSON.stringify(normalizedResult.normalized, null, 2),
-        "utf-8",
-      );
-      loadedConfigPathForRuntime = targetPath;
-      console.log(`[bridges/main] pull config persisted path=${targetPath}`);
+    if (reconcileRuntimeState) {
+      await reconcileRuntimeStateForConfigDelta({
+        previousConfig,
+        nextConfig: normalizedResult.normalized,
+        trigger: "config_pull",
+      });
+    }
+    if (probeAfterPull) {
+      await probeAndRefreshStatuses({ force: true, reason: "config_pull" });
     }
 
     return {
@@ -5790,7 +6315,7 @@ async function recoverRuntimeAccountByHealthGuard(params: {
   try {
     let control = resolveRuntimeBridgeControl(item.platform);
     if (!control) {
-      await ensureBridgeReadyForBotControl(item.platform);
+      await ensureBridgeReadyForBotControl(item.platform, item.bot_account_id);
       control = resolveRuntimeBridgeControl(item.platform);
     }
     if (!control) {
@@ -5827,10 +6352,19 @@ async function recoverRuntimeAccountByHealthGuard(params: {
     });
 
     if (typeof control.restartAccount === "function") {
-      await control.restartAccount(item.bot_account_id);
+      await withRuntimeControlTimeout(
+        control.restartAccount(item.bot_account_id),
+        `health guard restart timeout platform=${item.platform} account=${item.bot_account_id}`,
+      );
     } else {
-      await control.stopAccount!(item.bot_account_id);
-      await control.startAccount!(item.bot_account_id);
+      await withRuntimeControlTimeout(
+        control.stopAccount!(item.bot_account_id),
+        `health guard stop timeout platform=${item.platform} account=${item.bot_account_id}`,
+      );
+      await withRuntimeControlTimeout(
+        control.startAccount!(item.bot_account_id),
+        `health guard start timeout platform=${item.platform} account=${item.bot_account_id}`,
+      );
     }
 
     logRuntimeStatusDebug(
@@ -5922,6 +6456,9 @@ async function runRuntimeHealthGuardCycle(): Promise<void> {
       if (!triggerReason) continue;
 
       const key = keyOf(item.platform, item.bot_account_id);
+      if (runtimeManualStoppedKeys.has(key)) {
+        continue;
+      }
       if (botControlInFlight.has(key) || runtimeHealthGuardRecoveringKeys.has(key)) {
         continue;
       }
@@ -6399,14 +6936,20 @@ async function buildRuntimeBotsStatusPayload(params: {
   reason: string;
 }): Promise<Record<string, unknown>> {
   const onlyKeyResolved = params.onlyAccountKey?.trim() || null;
+  const bypassHttpProbeTtl = runtimeStatusHttpBypassGlobalProbeTtl || params.forceProbe;
+  const forceSingleAccountProbe = Boolean(onlyKeyResolved);
+  const forceStatusProbe = bypassHttpProbeTtl || forceSingleAccountProbe;
+  const respectGlobalProbeTtl = runtimeStatusHttpBypassGlobalProbeTtl
+    ? false
+    : !params.forceProbe;
   await probeAndRefreshStatuses({
     force: params.forceProbe,
     reason: params.reason,
     timeoutMs: params.probeTimeoutMs ?? undefined,
     onlyKey: onlyKeyResolved,
-    respectGlobalProbeTtl: !params.forceProbe,
-    forceSweepAccounts: params.forceProbe,
-    forceProviderProbe: params.forceProbe,
+    respectGlobalProbeTtl,
+    forceSweepAccounts: forceStatusProbe,
+    forceProviderProbe: forceStatusProbe,
   });
   const botsAll = listRuntimeBotStatuses();
   const onlyKey = onlyKeyResolved;
@@ -6457,9 +7000,10 @@ async function buildRuntimeBotsStatusPayload(params: {
       timeout_total: runtimeStatusProbeTimeoutTotal,
       partial_probe_key: onlyKeyResolved,
       http_bypass_global_probe_ttl: runtimeStatusHttpBypassGlobalProbeTtl,
-      probe_respect_global_ttl: !runtimeStatusHttpBypassGlobalProbeTtl,
-      status_reads_force_account_sweep: true,
-      status_reads_force_provider_probe: true,
+      probe_respect_global_ttl: respectGlobalProbeTtl,
+      status_reads_force_account_sweep: forceStatusProbe,
+      status_reads_force_provider_probe: forceStatusProbe,
+      single_account_force_probe: forceSingleAccountProbe,
     },
     health_guard_meta: buildRuntimeHealthGuardMeta(),
     runtime_health_ready: runtimeReadiness.ready,
@@ -6827,6 +7371,17 @@ async function startInternalApiServer(): Promise<void> {
         );
         return;
       }
+      if (runtimeConfigApplyInFlight) {
+        res.writeHead(409, { "Content-Type": "application/json" });
+        res.end(
+          JSON.stringify({
+            ok: false,
+            error:
+              "runtime config apply is in progress, bot control is temporarily unavailable",
+          }),
+        );
+        return;
+      }
 
       const channelKey = platformToChannelKey(platform);
       if (!isChannelEnabled(channelKey)) {
@@ -6874,7 +7429,7 @@ async function startInternalApiServer(): Promise<void> {
           `[bridges/main] bot/${botControlAction} control missing, try lazy start platform=${platform} account=${botAccountId}`,
         );
         try {
-          await ensureBridgeReadyForBotControl(platform);
+          await ensureBridgeReadyForBotControl(platform, botAccountId);
         } catch (err) {
           console.error(
             `[bridges/main] bot/${botControlAction} lazy start failed platform=${platform} err=${err instanceof Error ? err.message : String(err)}`,
@@ -6916,6 +7471,7 @@ async function startInternalApiServer(): Promise<void> {
             );
             return;
           }
+          clearRuntimeAccountManualStop(platform, botAccountId);
           upsertRuntimeStatus({
             platform,
             bot_account_id: botAccountId,
@@ -6933,7 +7489,10 @@ async function startInternalApiServer(): Promise<void> {
             status_source: "manual",
             last_probe_at: previous?.last_probe_at || null,
           });
-          await control.startAccount(botAccountId);
+          await withRuntimeControlTimeout(
+            control.startAccount(botAccountId),
+            `bot start timeout platform=${platform} account=${botAccountId}`,
+          );
           runtimeLogoutRegistry.delete(key);
           scheduleRuntimeStateSnapshotPersist();
         } else if (botControlAction === "stop") {
@@ -6947,10 +7506,14 @@ async function startInternalApiServer(): Promise<void> {
             );
             return;
           }
-          await control.stopAccount(botAccountId);
+          await withRuntimeControlTimeout(
+            control.stopAccount(botAccountId),
+            `bot stop timeout platform=${platform} account=${botAccountId}`,
+          );
           if (wantLogout) {
             markRuntimeAccountLoggedOut(platform, botAccountId);
           }
+          markRuntimeAccountManuallyStopped(platform, botAccountId);
           upsertRuntimeStatus({
             platform,
             bot_account_id: botAccountId,
@@ -6979,6 +7542,7 @@ async function startInternalApiServer(): Promise<void> {
             );
             return;
           }
+          clearRuntimeAccountManualStop(platform, botAccountId);
           upsertRuntimeStatus({
             platform,
             bot_account_id: botAccountId,
@@ -6996,7 +7560,10 @@ async function startInternalApiServer(): Promise<void> {
             status_source: "manual",
             last_probe_at: previous?.last_probe_at || null,
           });
-          await control.restartAccount(botAccountId);
+          await withRuntimeControlTimeout(
+            control.restartAccount(botAccountId),
+            `bot restart timeout platform=${platform} account=${botAccountId}`,
+          );
         }
 
         const bot = getRuntimeBotStatusByKey(key) || null;
@@ -7062,90 +7629,143 @@ async function startInternalApiServer(): Promise<void> {
       reqUrl.pathname === "/internal/runtime/config/apply"
     ) {
       // config/apply 只负责“配置入站 + 可选标记 connecting + probe”，不做平台自动拉起。
-      const body = await readRequestJson(req);
-      const config = body.config as Record<string, unknown> | undefined;
-      const persist = parseBoolFlag(body.persist, true);
-      const markConnectingRaw =
-        body.mark_connecting === undefined
-          ? body.markConnecting
-          : body.mark_connecting;
-      const markConnecting = parseBoolFlag(markConnectingRaw, true);
-      const requestedVersion = String(body.version || "").trim();
-      if (!config || typeof config !== "object") {
-        res.writeHead(400, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ ok: false, error: "config is required" }));
+      if (runtimeState === "restarting") {
+        res.writeHead(409, { "Content-Type": "application/json" });
+        res.end(
+          JSON.stringify({
+            ok: false,
+            status: "busy",
+            error: "runtime is restarting, config apply is temporarily unavailable",
+            runtime_instance_id: runtimeInstanceId,
+          }),
+        );
         return;
       }
-
-      const normalizedResult = normalizeRuntimeConfigByWhitelist(config);
-      if (normalizedResult.droppedFields.length > 0) {
-        console.log(
-          `[bridges/main] config/apply rejected by whitelist: ${normalizedResult.droppedFields
-            .map((item) => `${item.channel}/${item.accountId}:${item.field}`)
-            .join(", ")}`,
-        );
-        res.writeHead(400, { "Content-Type": "application/json" });
+      if (botControlInFlight.size > 0 || runtimeConfigApplyInFlight) {
+        res.writeHead(409, { "Content-Type": "application/json" });
         res.end(
           JSON.stringify({
             ok: false,
-            error: "config contains non-whitelisted fields",
-            dropped_fields: normalizedResult.droppedFields,
+            status: "busy",
+            error: runtimeConfigApplyInFlight
+              ? "runtime config apply is already in progress"
+              : "bot control operations are in progress",
+            in_flight_count: botControlInFlight.size,
+            runtime_instance_id: runtimeInstanceId,
           }),
         );
         return;
       }
 
-      loadedConfigForRuntime = normalizedResult.normalized;
-      exposeRuntimeConfigToBridges(
-        loadedConfigForRuntime,
-        loadedConfigPathForRuntime,
-      );
-      updateConfigVersion(
-        normalizedResult.normalized,
-        requestedVersion || undefined,
-      );
-      applyRemoteRuntimeConfigToPluginHome();
-      if (markConnecting) {
-        markConfiguredBotsAsConnecting(normalizedResult.normalized);
-      }
-      await probeAndRefreshStatuses({ force: true, reason: "config_apply" });
+      runtimeConfigApplyInFlight = true;
+      try {
+        const body = await readRequestJson(req);
+        const config = body.config as Record<string, unknown> | undefined;
+        const persist = parseBoolFlag(body.persist, true);
+        const markConnectingRaw =
+          body.mark_connecting === undefined
+            ? body.markConnecting
+            : body.mark_connecting;
+        const markConnecting = parseBoolFlag(markConnectingRaw, true);
+        const requestedVersion = String(body.version || "").trim();
+        if (!config || typeof config !== "object") {
+          res.writeHead(400, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: "config is required" }));
+          return;
+        }
 
-      if (persist) {
-        const targetPath =
-          String(body.target_path || "").trim() ||
-          loadedConfigPathForRuntime ||
-          path.join(process.cwd(), "syim.json");
-        try {
-          fs.mkdirSync(path.dirname(targetPath), { recursive: true });
-          fs.writeFileSync(
-            targetPath,
-            JSON.stringify(normalizedResult.normalized, null, 2),
-            "utf-8",
+        const normalizedResult = normalizeRuntimeConfigByWhitelist(config);
+        if (normalizedResult.droppedFields.length > 0) {
+          console.log(
+            `[bridges/main] config/apply rejected by whitelist: ${normalizedResult.droppedFields
+              .map((item) => `${item.channel}/${item.accountId}:${item.field}`)
+              .join(", ")}`,
           );
-          loadedConfigPathForRuntime = targetPath;
-        } catch (err) {
-          res.writeHead(500, { "Content-Type": "application/json" });
+          res.writeHead(400, { "Content-Type": "application/json" });
           res.end(
             JSON.stringify({
               ok: false,
-              error: `persist failed: ${(err as Error).message}`,
+              error: "config contains non-whitelisted fields",
+              dropped_fields: normalizedResult.droppedFields,
             }),
           );
           return;
         }
-      }
 
-      res.writeHead(200, { "Content-Type": "application/json" });
-      res.end(
-        JSON.stringify({
-          ok: true,
-          status: "applied",
-          persisted: persist,
-          mark_connecting: markConnecting,
-          configPath: loadedConfigPathForRuntime,
-          version: configVersionHash || "unknown",
-        }),
-      );
+        let persistedConfigPath: string | null = null;
+        if (persist) {
+          const targetPath =
+            String(body.target_path || "").trim() ||
+            loadedConfigPathForRuntime ||
+            path.join(process.cwd(), "syim.json");
+          try {
+            // config/apply 对外返回失败时，运行中配置也必须保持不变。
+            // 因此 persist=true 先写盘，写盘成功后才切换内存、版本与 probe。
+            persistRuntimeConfigSnapshot({
+              config: normalizedResult.normalized,
+              targetPath,
+              reason: "config_apply",
+            });
+            persistedConfigPath = targetPath;
+          } catch (err) {
+            res.writeHead(500, { "Content-Type": "application/json" });
+            res.end(
+              JSON.stringify({
+                ok: false,
+                error: `persist failed: ${(err as Error).message}`,
+              }),
+            );
+            return;
+          }
+        }
+
+        const previousConfig =
+          loadedConfigForRuntime &&
+          typeof loadedConfigForRuntime === "object" &&
+          !Array.isArray(loadedConfigForRuntime)
+            ? (loadedConfigForRuntime as Record<string, unknown>)
+            : null;
+        loadedConfigForRuntime = normalizedResult.normalized;
+        if (persistedConfigPath) {
+          loadedConfigPathForRuntime = persistedConfigPath;
+        }
+        exposeRuntimeConfigToBridges(
+          loadedConfigForRuntime,
+          loadedConfigPathForRuntime,
+        );
+        updateConfigVersion(
+          normalizedResult.normalized,
+          requestedVersion || undefined,
+        );
+        applyRemoteRuntimeConfigToPluginHome();
+        if (markConnecting) {
+          markConfiguredBotsAsConnecting(
+            normalizedResult.normalized,
+            "config_apply_mark_connecting",
+          );
+        } else {
+          await reconcileRuntimeStateForConfigDelta({
+            previousConfig,
+            nextConfig: normalizedResult.normalized,
+            trigger: "config_apply",
+          });
+        }
+        await probeAndRefreshStatuses({ force: true, reason: "config_apply" });
+
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(
+          JSON.stringify({
+            ok: true,
+            status: "applied",
+            persisted: persist,
+            mark_connecting: markConnecting,
+            configPath: loadedConfigPathForRuntime,
+            version: configVersionHash || "unknown",
+          }),
+        );
+      } finally {
+        runtimeConfigApplyInFlight = false;
+      }
       return;
     }
     if (
@@ -7178,6 +7798,18 @@ async function startInternalApiServer(): Promise<void> {
         );
         return;
       }
+      if (runtimeConfigApplyInFlight) {
+        res.writeHead(409, { "Content-Type": "application/json" });
+        res.end(
+          JSON.stringify({
+            ok: false,
+            status: "busy",
+            error: "runtime config apply is in progress",
+            runtime_instance_id: runtimeInstanceId,
+          }),
+        );
+        return;
+      }
       const body = await readRequestJson(req);
       const restartModeRaw = String(body.mode || "")
         .trim()
@@ -7191,17 +7823,11 @@ async function startInternalApiServer(): Promise<void> {
       );
       runtimeState = "restarting";
       try {
-        console.log("[bridges/main] restart-all step=mark_all_stopped begin");
-        markAllBotsStopped("restart_all");
-        console.log(
-          `[bridges/main] restart-all step=mark_all_stopped done total=${summarizeBots().total}`,
-        );
-
         if (runtimeConfigPullUrl) {
           console.log(
             `[bridges/main] restart-all step=pull_config begin url=${runtimeConfigPullUrl}`,
           );
-          const pullResult = await pullRuntimeConfigFromPython(true);
+          const pullResult = await pullRuntimeConfigFromPython(true, false);
           if (!pullResult.ok) {
             console.error(
               `[bridges/main] restart-all step=pull_config failed err=${pullResult.error || "unknown"}`,
@@ -7274,9 +7900,14 @@ async function startInternalApiServer(): Promise<void> {
             "[bridges/main] restart-all step=config_source skip (no pull url and no local config file)",
           );
         }
+        console.log("[bridges/main] restart-all step=mark_all_stopped begin");
+        markAllBotsStopped("restart_all");
+        console.log(
+          `[bridges/main] restart-all step=mark_all_stopped done total=${summarizeBots().total}`,
+        );
         if (loadedConfigForRuntime) {
           console.log("[bridges/main] restart-all step=mark_connecting begin");
-          markConfiguredBotsAsConnecting(loadedConfigForRuntime);
+          markConfiguredBotsAsConnecting(loadedConfigForRuntime, "restart_all");
           console.log(
             `[bridges/main] restart-all step=mark_connecting done total=${summarizeBots().total}`,
           );
@@ -7325,7 +7956,10 @@ async function startInternalApiServer(): Promise<void> {
           console.log("[bridges/main] restart-all step=soft_restart dingtalk");
           bridgeSoftRestart.dingtalk.attempted = true;
           try {
-            await dingtalkControl.restart();
+            await withRuntimeControlTimeout(
+              dingtalkControl.restart(),
+              "restart-all dingtalk restart timeout",
+            );
             bridgeSoftRestart.dingtalk.ok = true;
             bridgeSoftRestart.dingtalk.reason = "restarted";
           } catch (err) {
@@ -7340,7 +7974,10 @@ async function startInternalApiServer(): Promise<void> {
             );
             bridgeSoftRestart.dingtalk.attempted = true;
             try {
-              await dingtalkControl.stop();
+              await withRuntimeControlTimeout(
+                dingtalkControl.stop(),
+                "restart-all dingtalk stop timeout",
+              );
               bridgeSoftRestart.dingtalk.ok = true;
               bridgeSoftRestart.dingtalk.reason = "stopped_no_accounts";
             } catch (err) {
@@ -7362,7 +7999,10 @@ async function startInternalApiServer(): Promise<void> {
           console.log("[bridges/main] restart-all step=soft_restart lark");
           bridgeSoftRestart.lark.attempted = true;
           try {
-            await larkControl.restart();
+            await withRuntimeControlTimeout(
+              larkControl.restart(),
+              "restart-all lark restart timeout",
+            );
             bridgeSoftRestart.lark.ok = true;
             bridgeSoftRestart.lark.reason = "restarted";
           } catch (err) {
@@ -7377,7 +8017,10 @@ async function startInternalApiServer(): Promise<void> {
             );
             bridgeSoftRestart.lark.attempted = true;
             try {
-              await larkControl.stop();
+              await withRuntimeControlTimeout(
+                larkControl.stop(),
+                "restart-all lark stop timeout",
+              );
               bridgeSoftRestart.lark.ok = true;
               bridgeSoftRestart.lark.reason = "stopped_no_accounts";
             } catch (err) {
@@ -7399,7 +8042,10 @@ async function startInternalApiServer(): Promise<void> {
           console.log("[bridges/main] restart-all step=soft_restart weixin");
           bridgeSoftRestart.weixin.attempted = true;
           try {
-            await weixinControl.restart();
+            await withRuntimeControlTimeout(
+              weixinControl.restart(),
+              "restart-all weixin restart timeout",
+            );
             bridgeSoftRestart.weixin.ok = true;
             bridgeSoftRestart.weixin.reason = "restarted";
           } catch (err) {
@@ -7414,7 +8060,10 @@ async function startInternalApiServer(): Promise<void> {
             );
             bridgeSoftRestart.weixin.attempted = true;
             try {
-              await weixinControl.stop();
+              await withRuntimeControlTimeout(
+                weixinControl.stop(),
+                "restart-all weixin stop timeout",
+              );
               bridgeSoftRestart.weixin.ok = true;
               bridgeSoftRestart.weixin.reason = "stopped_no_accounts";
             } catch (err) {
@@ -7519,10 +8168,32 @@ async function startInternalApiServer(): Promise<void> {
       const platform = String(body.platform || "").trim();
       const botAccountId = String(body.bot_account_id || "").trim();
       const linkStatus = String(body.link_status || "").trim();
-      const eventName = String(body.event_name || "").trim() || null;
+      const eventNameRaw = String(body.event_name || "").trim();
+      const eventName = normalizeRuntimeTelemetryEventName(
+        normalizeRuntimeEventName(eventNameRaw),
+      ) || null;
       const isTelemetryEvent = isTelemetryOnlyEvent(eventName);
+      const isTelemetryLikeEvent = isTelemetryLikeEventName(eventNameRaw);
       const isHeartbeatEvent = isHeartbeatOnlyEvent(eventName);
       const isDiagnosticEvent = isDiagnosticOnlyEvent(eventName);
+      // 重要：该软忽略分支是跨版本兼容防线，不能删除。
+      // 当发送端事件名发生命名漂移时（snake/dash/dot/camel 混用），
+      // 若直接返回 400 会触发上游重试风暴并污染状态链路。
+      // 必须保持 ok+ignored 语义，并通过可观测日志逐步补齐 alias 映射。
+      if (isTelemetryLikeEvent && !isTelemetryEvent && !linkStatus) {
+        logRuntimeStatusDebug(
+          `event report ignored unknown telemetry event=${eventNameRaw} normalized=${eventName || ""}`,
+        );
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(
+          JSON.stringify({
+            ok: true,
+            ignored: true,
+            reason: "unknown_telemetry_event",
+          }),
+        );
+        return;
+      }
       if (
         (platform !== "dingtalk" &&
           platform !== "feishu" &&
@@ -7611,6 +8282,7 @@ async function startInternalApiServer(): Promise<void> {
         body.last_event_at ?? body.last_heartbeat_at,
         heartbeatAt,
       );
+      const incomingLastError = String(body.last_error || "").trim() || null;
       const eventNameForLiveness =
         eventName ||
         (isHeartbeatEvent
@@ -7647,7 +8319,7 @@ async function startInternalApiServer(): Promise<void> {
           platform: p,
           bot_account_id: normalizedBotAccountId,
           last_event: eventName || "runtime_diagnostic",
-          last_error: String(body.last_error || "").trim() || null,
+          last_error: incomingLastError,
           last_reported_at: heartbeatAt || nowIso(),
         });
       }
@@ -7666,8 +8338,10 @@ async function startInternalApiServer(): Promise<void> {
             bot_account_id: normalizedBotAccountId,
             started_at: String(body.started_at || prev.started_at || nowIso()),
             last_heartbeat_at: heartbeatAt,
-            last_error:
-              String(body.last_error || "").trim() || prev.last_error || null,
+            // 诊断事件只写 diagnostic 区，避免污染 status.last_error 语义。
+            last_error: isDiagnosticEvent
+              ? prev.last_error || null
+              : incomingLastError || prev.last_error || null,
             reconnect_count:
               runtimeHintsFromEvent.reconnect_count ?? prev.reconnect_count ?? 0,
             restart_pending: nextRestartPending,
@@ -7721,8 +8395,7 @@ async function startInternalApiServer(): Promise<void> {
         link_status: normalizedStatus,
         started_at: String(body.started_at || prev?.started_at || nowIso()),
         last_heartbeat_at: heartbeatAt,
-        last_error:
-          String(body.last_error || "").trim() || prev?.last_error || null,
+        last_error: incomingLastError || prev?.last_error || null,
         reconnect_count: reconnectCount,
         restart_pending: nextRestartPending,
         busy: runtimeHintsFromEvent.busy ?? false,
@@ -7892,8 +8565,29 @@ async function main(): Promise<void> {
   registerRuntimeStateExitHooks();
 
   startupOnlyMode = parseOnlyArg();
-  const loaded = loadOpenClawConfig();
-  if (!loaded) {
+  const remoteConfigAuthoritative = Boolean(runtimeConfigPullUrl && !localConfigOnly);
+  const loaded = remoteConfigAuthoritative ? null : loadOpenClawConfig();
+  let shouldRestoreRuntimeStateSnapshot = true;
+  if (remoteConfigAuthoritative) {
+    // 远端配置权威模式：只要配置了 RUNTIME_CONFIG_PULL_URL，就不能在
+    // 初始 pull 失败时回退使用本地旧 syim.json 启动 bridge。否则 Python
+    // DB 真源不可用时，Node 可能用过期本地文件启动旧账号/旧凭证。
+    const fallbackPath = path.join(os.homedir(), ".syim", "syim.json");
+    console.log(
+      `[bridges/main] runtime pull url configured, skip local config bootstrap and wait for remote source: ${runtimeConfigPullUrl}`,
+    );
+    loadedConfigForRuntime = { channels: {}, bindings: [] };
+    loadedConfigPathForRuntime = fallbackPath;
+    exposeRuntimeConfigToBridges(
+      loadedConfigForRuntime,
+      loadedConfigPathForRuntime,
+    );
+    updateConfigVersion(loadedConfigForRuntime);
+    markConfiguredBotsAsConnecting(
+      loadedConfigForRuntime,
+      "startup_remote_config_authoritative",
+    );
+  } else if (!loaded) {
     if (!runtimeConfigPullUrl) {
       if (allowLocalRuntimeConfig) {
         printConfigBootstrapGuide();
@@ -7911,7 +8605,10 @@ async function main(): Promise<void> {
         loadedConfigPathForRuntime,
       );
       updateConfigVersion(loadedConfigForRuntime);
-      markConfiguredBotsAsConnecting(loadedConfigForRuntime);
+      markConfiguredBotsAsConnecting(
+        loadedConfigForRuntime,
+        "startup_bootstrap_empty",
+      );
     } else {
       const fallbackPath = path.join(os.homedir(), ".syim", "syim.json");
       console.log(
@@ -7924,7 +8621,10 @@ async function main(): Promise<void> {
         loadedConfigPathForRuntime,
       );
       updateConfigVersion(loadedConfigForRuntime);
-      markConfiguredBotsAsConnecting(loadedConfigForRuntime);
+      markConfiguredBotsAsConnecting(
+        loadedConfigForRuntime,
+        "startup_bootstrap_pull",
+      );
     }
   } else {
     console.log("[bridges/main] config loaded:", loaded.configPath);
@@ -7935,23 +8635,30 @@ async function main(): Promise<void> {
       loadedConfigPathForRuntime,
     );
     updateConfigVersion(loaded.config);
-    markConfiguredBotsAsConnecting(loaded.config);
+    markConfiguredBotsAsConnecting(loaded.config, "startup_local_config");
   }
 
-  restorePersistedRuntimeStateSnapshot(
-    loadedConfigForRuntime as Record<string, unknown> | null,
-  );
-
   if (runtimeConfigPullUrl && !localConfigOnly) {
     // 启动前先尝试拉最新配置，保证 bridge 进程首启读到的是最新配置快照。
-    // 启动前必须先拉到配置，确保插件启动时读到的是最新本地文件。
-    const pullResult = await pullRuntimeConfigFromPython(false);
+    // 启动前必须先拉到配置，确保插件启动时读到的是 Python DB 真源；
+    // 若失败，只启动控制面和恢复轮询，不允许旧本地配置启动 bridge。
+    const pullResult = await pullRuntimeConfigFromPython(false, true, {
+      probeAfterPull: false,
+    });
     if (!pullResult.ok) {
       console.error(
         `[bridges/main] initial config pull failed: ${pullResult.error || "unknown"}`,
       );
       console.log(
-        "[bridges/main] keep alive, wait next poll for config recovery",
+        "[bridges/main] keep alive with empty runtime config, wait next poll for config recovery",
+      );
+      shouldRestoreRuntimeStateSnapshot = false;
+      markConfiguredBotsAsConnecting(
+        (loadedConfigForRuntime as Record<string, unknown>) || {
+          channels: {},
+          bindings: [],
+        },
+        "startup_remote_pull_failed_empty",
       );
       startRuntimeConfigPollLoop();
     } else {
@@ -7964,6 +8671,31 @@ async function main(): Promise<void> {
     }
   }
 
+  if (shouldRestoreRuntimeStateSnapshot && remoteConfigAuthoritative) {
+    const configuredAccounts = collectConfiguredAccountIdsByPlatform(
+      (loadedConfigForRuntime as Record<string, unknown>) || null,
+    );
+    const hasConfiguredAccounts =
+      configuredAccounts.dingtalk.length > 0 ||
+      configuredAccounts.feishu.length > 0 ||
+      configuredAccounts.weixin.length > 0;
+    // 远端权威模式下，空配置不能恢复旧快照；否则 Python 返回空配置或
+    // pull 失败时，历史 snapshot 会重新暴露已删除/过期账号。
+    shouldRestoreRuntimeStateSnapshot = hasConfiguredAccounts;
+  }
+
+  if (shouldRestoreRuntimeStateSnapshot) {
+    restorePersistedRuntimeStateSnapshot(
+      loadedConfigForRuntime as Record<string, unknown> | null,
+    );
+  }
+
+  if (runtimeConfigPullUrl && !localConfigOnly && shouldRestoreRuntimeStateSnapshot) {
+    // 初始远端 pull 已完成后再恢复快照，因此必须补一次 probe，
+    // 避免旧 snapshot 覆盖刚拉取配置后的真实探测结果。
+    await probeAndRefreshStatuses({ force: true, reason: "startup_after_restore" });
+  }
+
   if (enableInternalApi) {
     // 控制面 API 与探测循环独立于 bridge 进程生命周期。
     await startInternalApiServer();