[Bug] Windows Companion 2026.9.3 crashes in WinUI ArrangeOverride after chat.history

This report is redacted to exclude tokens, credentials, private messages, project contents, and protected project paths.

This report is redacted to exclude tokens, credentials, private messages,
project contents, and protected project paths.

Summary

OpenClaw Windows Companion 2026.9.3.0 crashes in the native WinUI Chat
surface after receiving chat.history. The Gateway and Ollama remain healthy,
and no provider/model request or chat.send occurs before the crash.

The failure reproduces after both selected-thread correction and a clean
Companion Chat/UI-state rebuild, so it is not tied solely to one historical
session.

Environment

• Application: OpenClaw.Tray.WinUI.exe.
• Companion version: 2026.9.3.0.
• Product version: 2026.9.3+84928c4370bc52d7f19127c65a637c7a28aab46e.
• Windows build: 10.0.26200.9445.
• Architecture: x64.
• Faulting runtime module: Microsoft.UI.Xaml.dll 3.2.3.0.
• Installed package dependency metadata includes Windows App SDK / WinUI and
  Microsoft UI Reactor components.

Reproduction

1. Launch Windows Companion.
2. Connect to the existing Gateway.
3. Open the Chat surface with the validated Crestodian session selected.
4. Allow the session history to load.
5. The UI exits during history rendering. A user-visible attempt to type/send a
   normal message exposes the same failure, but the recorded crash occurs before
   chat.send is submitted.

The same crash was reproduced after:

• redirecting the selected dashboard thread to the validated Crestodian
  session; and
• rebuilding Companion-owned Chat/UI state.

The protected Gateway sessions were not modified.

Crash evidence

Latest WER-enabled reproduction:

• Timestamp: approximately 2026-09-14 17:19:34.440 local time.
• Application Error event: 1000.
• Exception: System.ArgumentException: The parameter is incorrect.
• Exception code: 0xc000027b.
• Faulting module: Microsoft.UI.Xaml.dll 3.2.3.0.
• Fault offset: 0x00000000003a9c5d.
• Stack boundary: Microsoft.UI.Xaml.FrameworkElement.ArrangeOverride.

Associated WER APPCRASH record:

• WER fault module: combase.dll.
• WER parameter: 80070057.
• WER fault offset: 0x00000000000579e4.

Earlier repeated timestamps were approximately:

• 2026-09-13 22:28:25.120;
• 2026-09-13 23:45:29.503;
• 2026-09-14 00:17:17.385;
• 2026-09-14 00:17:49.307;
• 2026-09-14 00:19:00.884.

Lifecycle correlation

Observed order:

1. Companion connects/reconnects.
2. Companion requests or receives chat.history.
3. History response is received.
4. Chat rendering enters WinUI layout.
5. FrameworkElement.ArrangeOverride raises the unhandled argument exception.
6. Companion exits.

Not observed before the crash:

• chat.send;
• agent invocation;
• provider request;
• Ollama request;
• model generation;
• Gateway process failure.

Gateway health remained ok=true with a healthy event loop. Ollama remained
running and received no request in the crash window.

Session/state checks

The validated user-facing session was selected:

agent:crestodian-coder:companion-crestodian

Its intended runtime is:

• agent: crestodian-coder;
• provider: ollama;
• model: qwen3:14b-12k;
• context: 12288;
• thinking: off.

The protected validation session
agent:crestodian-coder:ollama-clean was not modified.

The selected dashboard thread had previously contained stale thinking metadata,
but redirecting away from it did not fix the layout crash. A clean Companion
Chat/UI state rebuild also reproduced the crash. This points to a general Chat
history/rendering path rather than one malformed selected session alone.

State-reset results

• Selected-thread redirection: crash remained.
• Companion-owned Chat/UI state rebuild: crash remained.
• Gateway session deletion or modification: not performed.
• Package update/reinstall: not performed.

Dump capture

One temporary per-application WER LocalDumps registration was used with a
dedicated dump folder and full-dump mode. The single reproduction generated no
.dmp file. No usable archived WER dump was available, and no debugger or
ProcDump installation was available in the diagnostic environment.

The current report therefore gives the framework boundary but not the exact
Chat control or invalid layout value below ArrangeOverride.

Expected behavior

Chat history should render without terminating the Companion process. The
operator should be able to type and send a normal message, and the Companion
should remain connected while the Gateway handles the request.

Actual behavior

The Companion process terminates with an unhandled WinUI argument exception
during Chat/history rendering. The Gateway and Ollama continue running.

Related upstream evidence

• #1150 discusses Windows Companion UI failure under event-stream pressure.
• #1167 discusses Chat history projection/re-render instability after session switching.
• PR #1301 describes a similar Reactor visual-tree/layout crash pattern (closed).
• PR #1386 addresses snapshot-delivery races (merged), but the installed build still reproduces this crash and no exact fix attribution is claimed.

Requested maintainer investigation

Please inspect the native Chat history hydration and Reactor visual-tree update
path for a layout update that reaches WinUI with an invalid argument or with
multiple competing snapshot/layout mutations. A symbolized stack below
FrameworkElement.ArrangeOverride would identify the responsible control.

Security/privacy notes

This report intentionally excludes tokens, credentials, private message text,
project contents, and protected project paths. The validated Local AI
infrastructure, Gateway, Ollama, model configuration, approvals, and security
policy were not changed during diagnosis.