fix: guard tray icon liveness before applying queued update

A tray update marshalled off the UI thread can run after shutdown has
disposed the tray icon. Clearing the coordinator reference alone does not
stop an already-queued delegate, so the coordinator now checks a liveness
callback before touching the icon, restoring the no-op behaviour the
inlined code had via its null check.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: AlexAlves87

src/OpenClaw.Tray.WinUI/App.xaml.cs

@@ -737,7 +737,8 @@ private void InitializeTrayIcon()
             _trayIcon,
             hasThreadAccess: () => _dispatcherQueue == null || _dispatcherQueue.HasThreadAccess,
             marshal: OnUiThread,
-            captureSnapshot: CaptureTraySnapshot);
+            captureSnapshot: CaptureTraySnapshot,
+            isAlive: () => _trayIcon != null);
         _trayIcon.IsVisible = true;
         _trayIconCoordinator.ApplyTrayTooltip(BuildTrayTooltip());
         _trayIcon.Selected += OnTrayIconSelected;

src/OpenClaw.Tray.WinUI/Services/TrayIconCoordinator.cs

@@ -10,17 +10,20 @@ internal sealed class TrayIconCoordinator
     private readonly Func<bool> _hasThreadAccess;
     private readonly Action<DispatcherQueueHandler> _marshal;
     private readonly Func<TrayStateSnapshot> _captureSnapshot;
+    private readonly Func<bool> _isAlive;
 
     internal TrayIconCoordinator(
         TrayIcon trayIcon,
         Func<bool> hasThreadAccess,
         Action<DispatcherQueueHandler> marshal,
-        Func<TrayStateSnapshot> captureSnapshot)
+        Func<TrayStateSnapshot> captureSnapshot,
+        Func<bool> isAlive)
     {
         _trayIcon = trayIcon;
         _hasThreadAccess = hasThreadAccess;
         _marshal = marshal;
         _captureSnapshot = captureSnapshot;
+        _isAlive = isAlive;
     }
 
     internal void UpdateTrayIcon()
@@ -31,6 +34,11 @@ internal void UpdateTrayIcon()
             return;
         }
 
+        // A queued update may run after shutdown has disposed the tray icon.
+        // Bail out so we never touch a disposed instance.
+        if (!_isAlive())
+            return;
+
         var iconPath = System.IO.Path.Combine(AppContext.BaseDirectory, "Assets", "openclaw.ico");
         var tooltip = BuildTrayTooltip();
 

tests/OpenClaw.Tray.Tests/AppRefactorContractTests.cs

@@ -294,6 +294,29 @@ public void TrayIcon_UpdateDelegatesToCoordinator()
         Assert.DoesNotContain("private void ApplyTrayTooltip", source);
     }
 
+    [Fact]
+    public void TrayCoordinator_UpdateGuardsLivenessBeforeTouchingIcon()
+    {
+        var source = ReadCoordinatorSource();
+        var method = ExtractMethod(source, "UpdateTrayIcon");
+
+        // A queued update can run after shutdown disposes the tray icon, so the
+        // coordinator must bail on the liveness check before it ever calls SetIcon.
+        var guardIndex = method.IndexOf("_isAlive()", StringComparison.Ordinal);
+        var setIconIndex = method.IndexOf("SetIcon(", StringComparison.Ordinal);
+
+        Assert.True(guardIndex >= 0, "UpdateTrayIcon must check the liveness guard");
+        Assert.True(setIconIndex >= 0, "UpdateTrayIcon must still set the icon");
+        Assert.True(guardIndex < setIconIndex, "Liveness guard must run before SetIcon");
+    }
+
+    private static string ReadCoordinatorSource()
+    {
+        var root = TestRepositoryPaths.GetRepositoryRoot();
+        return File.ReadAllText(Path.Combine(
+            root, "src", "OpenClaw.Tray.WinUI", "Services", "TrayIconCoordinator.cs"));
+    }
+
     private static string ReadAppSources()
     {
         var root = TestRepositoryPaths.GetRepositoryRoot();