[Bug] v2026.9.3: OpenClaw.Tray.WinUI crashes (0xc000027b in Microsoft.UI.Xaml.dll) ~12 s after connect when opening a chat session with history; v2026.7.1-4 fine

Summary

Windows Companion v2026.9.3 (OpenClaw.Tray.WinUI.exe 2026.9.3+84928c43) crashes ~10–15 s after connecting to a remote gateway, every time the chat view is opened on a session that has history. Reproduced on two Windows 11 machines (build 26200) on the same day the auto-update to 2026.9.3 landed. v2026.7.1-4 on the same machines/gateway did not crash.

Environment

• Companion: v2026.9.3 (auto-updated from v2026.7.1-4 at ~03:41 UTC 2026-09-12)
• OS: Windows 11 Enterprise 10.0.26200
• Gateway: OpenClaw 2026.9.2 (remote, wss:// over Tailscale Serve, device-token auth, protocol 4)
• Chat sessions: the agent's main session with a few dozen messages; sessions carry labels; sessions.visibility=all (12 agents)

Repro

1. Start the Companion; it connects (gateway.self event logged, presenceCount populated) and shows Connected.
2. Open Chat, select a session with history (e.g. the agent's main session).
3. 10–15 s later the process crashes. Reopening reproduces it every time. Deleting last-chat-state.json did not help.

Crash signature (Windows Application log / WER)

Faulting application name: OpenClaw.Tray.WinUI.exe, version: 2026.9.3.0
Faulting module name: Microsoft.UI.Xaml.dll, version: 3.2.3.0
Exception code: 0xc000027b   (once: CoreMessagingXP.dll, 0xc000027b)
WER: APPCRASH P4: combase.dll 10.0.26100.9444, P7: 80070057

Four dumps within three minutes (12:16–12:18 local) on machine A; same signature later on machine B.

Companion diagnostics (diagnostics.jsonl, tail)

{"event":"app.start","metadata":{"nodeMode":false,"useSshTunnel":false}}
{"event":"gateway.self","metadata":{"version":"2026.9.2","protocol":4,"authMode":null,"stateVersionPresence":13,"stateVersionHealth":138,"presenceCount":4}}
{"event":"gateway.health.channels","metadata":{"channelCount":2,"healthyCount":1,"errorCount":0}}
... crash ~12 s later, nothing further logged

Notes

• Transport is fine: the reconnect to the gateway completes within ~1 s of app.start each time (device token reused, no pairing prompt).
• Looks related to #1167 (session switch hang while projecting history) and #1270 (XAML crash loop under event throughput), but this is a hard crash on a modest session, not a hang.
• Workaround in use: roll back to v2026.7.1-4. Is there a supported way to pin/disable auto-update so a rollback sticks?

Start with OpenClaw.Tray.WinUI.exe v2026.9.3 and reproduce the crash by opening a chat session with history, then inspect diagnostics.jsonl and the Windows WER crash signature. Compare the behavior with v2026.7.1-4 and review related issues #1167 and #1270; done means the history view no longer crashes after connection and the reproduction is verified on the affected setup.