fix(tray): bound streaming UI dispatch work

[clawsweeper]

Fixes #1150.

Summary

• bound the gateway agent-event diagnostic path to 400 pending events and 32 items per low-priority dispatcher turn
• preserve lifecycle/control events by evicting or rejecting only known disposable streaming update phases
• capture the subscription generation and originating client so reconnects reject stale queued events
• reduce every native-chat event in order while coalescing render snapshot materialization and delivery to one pending UI callback
• keep queue scheduling live after a handled listener exception and preserve the unconsumed batch suffix

Validation

Current head: 2a78af1aab68b4a2575688c8f4d6f78e93aeaed4

Not verified locally / blocked on this orchestration host:

• ./build.ps1: blocked because this Linux host has no PowerShell or .NET SDK
• dotnet test ./tests/OpenClaw.Shared.Tests/OpenClaw.Shared.Tests.csproj --no-restore: blocked because dotnet is unavailable
• dotnet test ./tests/OpenClaw.Tray.Tests/OpenClaw.Tray.Tests.csproj --no-restore: blocked because dotnet is unavailable
• current-head isolated WinUI stress walkthrough: blocked because no Windows node/runner is registered with this session

Exact-head Windows CI run 31854826852 is in progress. Repository hygiene passed; test and all three E2E shards are still running. Do not mark ready until the required jobs pass.

Regression coverage added

The deterministic stress contracts cover:

• 10,000 queued diagnostic events retain a bounded 400-item tail and drain in exactly 13 turns with a 32-item maximum
• lifecycle/control events survive streaming overflow, including a control-only full queue rejecting an incoming disposable update
• assistant/reasoning/command-output and known item/tool/job progress phases are disposable; start/result/end/error and unknown phases fail closed as controls
• listener failure reschedules the queue and preserves the unconsumed batch suffix
• 10,002 ordered chat lifecycle/delta events queue one UI callback and deliver the complete 10,000-character terminal transcript
• disposal/clear cancellation and publish-during-delivery ordering

Real behavior proof

Not verified / blocked: the current session has no Windows app host, so visible responsiveness under a running isolated tray stress case could not be captured. The source-level reproduction and deterministic dispatcher harness are included, but they are not a substitute for current-head WinUI proof.

Review

Final autoreview command:

.agents/skills/autoreview/scripts/autoreview --mode local --prompt <#1150 convergence review> --stream-engine-output

Result: clean, no accepted/actionable findings, overall correctness patch is correct (0.93 confidence). Earlier findings about reconnect identity/generation races, control-event eviction, incoming disposable rejection, tool/job update classification, and exception recovery were accepted and fixed before the clean rerun.

ClawSweeper re-reviewed exact head 2a78af1a on 2026-08-15 and reported no actionable source findings. It still requires current-head Windows CI and real tray responsiveness proof before ready-for-review.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Pushed CI follow-up at 9daa319b7def6b56efd3d6aef8fa33b7ff718683.

The two failures were test-assumption issues:

• the 10k-event stress fixture emitted the same delta repeatedly, which the existing reducer correctly treats as retransmits; it now alternates payloads so the test exercises 10k distinct ordered deltas;
• the queued-send test observed SentMessages before the coalesced snapshot delivery completed; it now waits for both send dispatch and the final queue/timeline state.

git diff --check passes. This Linux host has no .NET SDK, so the focused Windows tests are delegated to the fresh exact-head CI run.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed August 24, 2026, 9:50 PM ET / August 25, 2026, 01:50 UTC.

ClawSweeper review

What this changes

The PR bounds high-rate gateway event dispatch and coalesces native-chat snapshot delivery to reduce WinUI UI-thread work during streaming.

Regression provenance

Possible regression — probable (reproduction; reviewed change). No predecessor PR is attributed.

Merge readiness

⛔ Blocked until real behavior proof is added - 5 items remain

Keep this PR open. Its bounded-dispatch approach addresses the linked streaming hang, but the branch is dirty against current main and its chat implementation predates the current ownership refactor; it also lacks required current-head Windows responsiveness proof.

Priority: P1
Reviewed head: 2a78af1aab68b4a2575688c8f4d6f78e93aeaed4

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	The approach and deterministic coverage are useful, but the branch needs a current-main port and real Windows behavior proof.
Proof confidence	🧂 unranked krab (1/6)	Needs real behavior proof before merge: The PR explicitly lacks current-head Windows tray stress proof. Attach redacted live output, diagnostics, or a recording that shows responsiveness under streaming load before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🦐 gold shrimp (3/6)	1 actionable review finding remain.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs real behavior proof before merge: The PR explicitly lacks current-head Windows tray stress proof. Attach redacted live output, diagnostics, or a recording that shows responsiveness under streaming load before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	5 items	Current chat ownership: Current main assigns chat snapshot projection to ChatSnapshotProjector and keeps OpenClawChatDataProvider as the facade, so the old provider-owned snapshot implementation cannot be carried forward unchanged. Current behavior remains unbounded: Current main still sends each gateway agent event through the ordinary UI dispatcher and posts each immutable chat snapshot individually, so the central streaming-pressure problem is not already implemented on main. PR conflicts with the refactored chat path: The PR calls a provider-local BuildCurrentSnapshot through the new delivery helper, while current main removed that monolithic provider state in favor of focused runtime owners. GitHub reports the PR as dirty.
Findings	1 actionable finding	[P1] Port snapshot coalescing to the refactored chat runtime
Security	None	None.

Live Verification

Command: dotnet test .\tests\OpenClaw.Tray.Tests\OpenClaw.Tray.Tests.csproj --no-restore --filter "FullyQualifiedName~AgentEvent_StreamBurst_BoundsUiWorkAndDeliversTerminalTranscript"

Result: FAIL (failed) — execution before step 1 run: sh -lc pnpm install --ignore-scripts --frozen-lockfile failed: ! Corepack is about to download https://registry.npmjs.org/pnpm/-/pnpm-11.23.0.tgz

sh -lc pnpm install --ignore-scripts --frozen-lockfile failed: ! Corepack is about to download https://registry.npmjs.org/pnpm/-/pnpm-11.23.0.tgz

Assertions:

• FAIL expect_output: AgentEvent_StreamBurst_BoundsUiWorkAndDeliversTerminalTranscript

How this fits together

Gateway events arrive on background connections and feed both tray diagnostics and the native chat timeline. The tray dispatcher and chat snapshot publisher turn those events into WinUI render work.

flowchart LR
A[Gateway event stream] --> B[Tray gateway service]
B --> C[Bounded event queue]
C --> D[UI dispatcher]
A --> E[Chat event reducer]
E --> F[Snapshot projection]
F --> G[Snapshot delivery]
G --> H[WinUI chat render]

Loading

Before merge

• Add real behavior proof - Needs real behavior proof before merge: The PR explicitly lacks current-head Windows tray stress proof. Attach redacted live output, diagnostics, or a recording that shows responsiveness under streaming load before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Port snapshot coalescing to the refactored chat runtime (P1) - Current main makes the provider a facade and assigns snapshot projection to focused chat owners. This old-tree call depends on provider-local snapshot state that current main removed, and the PR is dirty; rebase the coalescing path onto the current projection and publish flow instead of restoring the old ownership model.
• Resolve merge risk (P1) - A naive conflict resolution could restore provider-owned mutable chat state and bypass the current ChatConversationState and ChatSnapshotProjector boundaries, risking chat correctness and UI availability.
• Resolve merge risk (P1) - No current-head Windows stress capture demonstrates that the rebased tray remains responsive under the reported streaming workload.
• Complete next step (P2) - The contributor must rebase the stale chat implementation and provide real Windows proof; this is not a safe automated repair lane.

Findings

• [P1] Port snapshot coalescing to the refactored chat runtime — src/OpenClaw.Tray.WinUI/Chat/OpenClawChatDataProvider.cs:5299

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test delta	production +418/-26, tests +313/-5, docs +17/-1	The substantial new queue and snapshot surface has regression coverage, but must be ported to the current refactored chat architecture.

Root-cause cluster

Relationship: fixed_by_candidate
Canonical: #1150
Summary: This PR is a candidate fix for the canonical live agent-streaming UI saturation report.

Members:

• canonical: [Bug] OpenClaw.Tray.WinUI v2026.7.1 UI hang/crash (AppHang + APPCRASH combase.dll) under heavy agent event streaming #1150 - The PR explicitly targets the reported high-rate streaming UI hang and crash behavior.
• adjacent_distinct: [Bug] Switching sessions can hang WinUI while projecting ~200 history messages (v2026.7.1) #1167 - That report identifies session-history projection as a distinct saturation path.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge-risk options

Maintainer options:

1. Port and prove on current main (recommended)
   Rebase the implementation onto the current chat runtime owners, preserve their ownership boundaries, and add current-head Windows responsiveness proof before merge.
2. Pause the stale branch
   If the streaming fix cannot be ported narrowly, pause this branch and retain the linked canonical bug as the tracked availability work.

Technical review

Best possible solution:

Port the bounded diagnostic queue and snapshot coalescing to current main's GatewayService and chat runtime owners, then attach redacted Windows tray stress evidence from that rebased head.

Do we have a high-confidence way to reproduce the issue?

Yes, at source level. Current main dispatches every agent event and individually posts chat snapshots, while the linked report provides the real release workload; current-head Windows execution is still needed to establish the runtime regression.

Is this the best way to solve the issue?

No. The intended backpressure strategy is plausible, but this branch must be reimplemented against current ChatConversationState and ChatSnapshotProjector ownership rather than its pre-refactor provider state.

Full review comments:

• [P1] Port snapshot coalescing to the refactored chat runtime — src/OpenClaw.Tray.WinUI/Chat/OpenClawChatDataProvider.cs:5299
  Current main makes the provider a facade and assigns snapshot projection to focused chat owners. This old-tree call depends on provider-local snapshot state that current main removed, and the PR is dirty; rebase the coalescing path onto the current projection and publish flow instead of restoring the old ownership model.
  Confidence: 0.96

Overall correctness: patch is incorrect
Overall confidence: 0.96

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against ccd64bbb7d68.

Labels

Label justifications:

• P1: This PR targets the reported tray hang and crash path during active agent streaming.
• merge-risk: 🚨 availability: It changes dispatcher scheduling and chat delivery behavior that directly determine WinUI responsiveness.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR explicitly lacks current-head Windows tray stress proof. Attach redacted live output, diagnostics, or a recording that shows responsiveness under streaming load before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

What I checked:

• Current chat ownership: Current main assigns chat snapshot projection to ChatSnapshotProjector and keeps OpenClawChatDataProvider as the facade, so the old provider-owned snapshot implementation cannot be carried forward unchanged. (docs/ARCHITECTURE.md:102, ccd64bbb7d68)
• Current behavior remains unbounded: Current main still sends each gateway agent event through the ordinary UI dispatcher and posts each immutable chat snapshot individually, so the central streaming-pressure problem is not already implemented on main. (src/OpenClaw.Tray.WinUI/Services/GatewayService.cs:406, ccd64bbb7d68)
• PR conflicts with the refactored chat path: The PR calls a provider-local BuildCurrentSnapshot through the new delivery helper, while current main removed that monolithic provider state in favor of focused runtime owners. GitHub reports the PR as dirty. (src/OpenClaw.Tray.WinUI/Chat/OpenClawChatDataProvider.cs:5299, 2a78af1aab68)
• Feature-history provenance: The current chat ownership refactor was introduced by Barbara Kudiess in the merged runtime-owner extraction, after this PR head. (src/OpenClaw.Tray.WinUI/Chat/OpenClawChatDataProvider.cs:1, f8a8825ccbb4)
• Proof status: The PR body explicitly says that current-head Windows tray responsiveness proof was not captured; green CI and deterministic tests are supplemental evidence only. (2a78af1aab68)

Likely related people:

• karkarl: Authored the merged extraction that established the current chat runtime ownership boundaries. (role: current chat-runtime refactor author; confidence: high; commits: f8a8825ccbb4; files: src/OpenClaw.Tray.WinUI/Chat/OpenClawChatDataProvider.cs, docs/ARCHITECTURE.md)
• ranjeshj: Introduced the GatewayService event-subscription surface that the bounded agent-event queue changes. (role: GatewayService introducer; confidence: medium; commits: cff1033b3bb3; files: src/OpenClaw.Tray.WinUI/Services/GatewayService.cs)
• calebeden: Recently modified the current-main native-chat provider after the ownership refactor. (role: recent chat-area contributor; confidence: medium; commits: a76c85218c7d; files: src/OpenClaw.Tray.WinUI/Chat/OpenClawChatDataProvider.cs)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Rebase the snapshot work onto ChatConversationState and ChatSnapshotProjector without restoring provider-owned runtime state.
• Attach redacted current-head Windows tray stress evidence showing the UI remains responsive.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (4 earlier review cycles)

• reviewed 2026-08-13T20:28:20.813Z sha 9daa319 :: needs real behavior proof before merge. :: none
• reviewed 2026-08-13T23:06:37.048Z sha 26475c2 :: needs real behavior proof before merge. :: none
• reviewed 2026-08-15T00:54:21.589Z sha 2a78af1 :: needs real behavior proof before merge. :: none
• reviewed 2026-08-15T01:01:50.959Z sha 2a78af1 :: needs real behavior proof before merge. :: none

[clawsweeper]

Final CI follow-up pushed at 26475c2e.

The prior exact-head Windows artifact had one remaining failure: AgentEvent_StreamBurst_BoundsUiWorkAndDeliversTerminalTranscript ended with IsStreaming=true. Root cause was a late eagerly captured async snapshot replacing the newer lifecycle.end factory. Publish now materializes the provider's authoritative current state when the pending UI callback runs.

Validation:

• git diff --check passed
• local .NET tests remain unavailable on this Linux host
• fresh exact-head Windows CI is required before this draft can be considered ready

[clawsweeper]

@clawsweeper re-review

Review/CI follow-up at current head 2a78af1a:

• The previous exact-head Windows artifact had one failure: AgentEvent_StreamBurst_BoundsUiWorkAndDeliversTerminalTranscript expected IsStreaming=false after lifecycle.end.
• That assertion contradicted the reducer's established late-final contract: a delta-only tail remains marked reconcilable so a delayed final frame can replace it in place, while TurnActive=false and ActiveAssistantId=null are the terminal guarantees.
• Commit 2a78af1a corrects only that assertion and documents the invariant. git diff --check passed; final autoreview was clean with no actionable findings (patch is correct, confidence 0.97).
• Fresh exact-head Windows CI is running.

Visible native WinUI stress proof is still not verified. The 2026-08-15 Crabbox AWS Windows desktop lease cbx_129687b80dc6 synced source but lacked .NET 10, Node, Windows SDK 26100, WebView2, and winget, so repository setup could not proceed. Keep this PR draft until current-head CI is green and a real Windows responsiveness capture is attached.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/31855064731
• Updated: 2026-08-15T00:55:59.025Z