diff --git a/electron/package.json b/electron/package.json
index 00871f0a..2295bf45 100644
--- a/electron/package.json
+++ b/electron/package.json
@@ -1,6 +1,6 @@
 {
   "name": "openswarm",
-  "version": "1.1.57",
+  "version": "1.1.58",
   "description": "OpenSwarm — AI Agent Orchestrator",
   "author": "openswarm-ai",
   "main": "main.js",
diff --git a/frontend/src/app/components/Onboarding/OnboardingRoot.tsx b/frontend/src/app/components/Onboarding/OnboardingRoot.tsx
index c528757e..916cf1c8 100644
--- a/frontend/src/app/components/Onboarding/OnboardingRoot.tsx
+++ b/frontend/src/app/components/Onboarding/OnboardingRoot.tsx
@@ -24,6 +24,10 @@ import { report } from './telemetry';
 const PERSIST_DEBOUNCE_MS = 200;
 
 const OnboardingRoot: React.FC = () => {
+  // Windows nuclear ablation v1.1.58: the AgenticCursor motion.div gate in 1.1.57 was not sufficient — OnboardingPanel / OnboardingDirector / popups have additional Framer Motion + portal subtrees that segfault on commit. Return null on Windows so the entire onboarding UI is suppressed; user can still use the app normally without the guided tour. Mac unchanged.
+  if (typeof navigator !== 'undefined' && navigator.userAgent.includes('Windows')) {
+    return null;
+  }
   const acRef = useRef<AgenticCursorHandle | null>(null);
   const dispatch = useAppDispatch();
   const store = useStore<RootState>() as Store<RootState>;
diff --git a/frontend/src/app/pages/AgentChat/ChatInput/toolbar/ToolbarActions.tsx b/frontend/src/app/pages/AgentChat/ChatInput/toolbar/ToolbarActions.tsx
index 5fb8fc8e..80bee944 100644
--- a/frontend/src/app/pages/AgentChat/ChatInput/toolbar/ToolbarActions.tsx
+++ b/frontend/src/app/pages/AgentChat/ChatInput/toolbar/ToolbarActions.tsx
@@ -3,9 +3,8 @@ import Box from '@mui/material/Box';
 import IconButton from '@mui/material/IconButton';
 import Tooltip from '@mui/material/Tooltip';
 
-// File input was ablated in v1.1.54 as a suspected crasher, but the actual crasher turned out to be contentEditable's TSF init (now replaced with textarea in EditorSurface). Restored on both platforms in v1.1.57. Keeping IS_WIN reference removal would require touching call sites; harmless left here as a constant.
+// Windows ablation re-instated in v1.1.58: the file input AND the contentEditable were BOTH crashers. v1.1.57's restore of <input type="file"> brought back the AgentChat-children commit segfault (crash fires right after AgentChat:before-jsx without any child render logs). Drag-and-drop attach still works via AttachmentChips drop zone on Windows. Future: replace this button with an Electron native showOpenDialog IPC so the button is functional on Windows again without touching <input type="file">.
 const IS_WIN = typeof navigator !== 'undefined' && navigator.userAgent.includes('Windows');
-void IS_WIN;
 import MicNoneOutlinedIcon from '@mui/icons-material/MicNoneOutlined';
 import ArrowUpwardIcon from '@mui/icons-material/ArrowUpward';
 import StopIcon from '@mui/icons-material/Stop';
@@ -93,7 +92,7 @@ export const ToolbarActions: React.FC<Props> = ({
       })()}
 
       {/* Windows-only ablation: hidden <input type="file"> + attach button skipped on Windows to test whether IFileDialog COM init is the trigger for the Chromium 144 commit-phase segfault. Mac still renders both (drag/paste/click attach all work). On Windows, drag-and-drop attach still works via AttachmentChips drop zone. */}
-      {true && (
+      {!IS_WIN && (
         <input
           ref={generalFileInputRef}
           type="file"
@@ -110,7 +109,7 @@ export const ToolbarActions: React.FC<Props> = ({
           }}
         />
       )}
-      {true && (
+      {!IS_WIN && (
         <Tooltip title="Attach file">
           <IconButton
             size="small"
diff --git a/frontend/src/app/pages/Dashboard/cards/BrowserCard.tsx b/frontend/src/app/pages/Dashboard/cards/BrowserCard.tsx
index 0e34b157..435d4052 100644
--- a/frontend/src/app/pages/Dashboard/cards/BrowserCard.tsx
+++ b/frontend/src/app/pages/Dashboard/cards/BrowserCard.tsx
@@ -1119,9 +1119,18 @@ const BrowserCard: React.FC<Props> = ({
           <Box sx={{ width: '100%', height: '100%', position: 'relative' }}>
             <iframe
               src={activeUrl}
-              sandbox="allow-scripts allow-same-origin allow-forms allow-popups"
+              // No sandbox: a restrictive sandbox blocks some sites from rendering, and our renderer is already isolated by Electron's contextIsolation + sub_frame XFO/CSP frame-ancestors strip in main.js. onLoad/onError add definitive instrumentation so we can tell whether the iframe loaded successfully (with empty body from anti-iframe JS) or genuinely failed (network error, CSP block, etc.).
               style={{ width: '100%', height: '100%', border: 'none' }}
               title="Browser"
+              referrerPolicy="no-referrer-when-downgrade"
+              onLoad={() => {
+                // eslint-disable-next-line no-console
+                console.log('[diag][iframe:onLoad]', activeUrl);
+              }}
+              onError={(e) => {
+                // eslint-disable-next-line no-console
+                console.error('[diag][iframe:onError]', activeUrl, (e as any)?.message || e);
+              }}
             />
             <Box
               sx={{