InvalidValue "Failed invoking <symbol>" / IQ error during watchface UPDATE on FR265 (fw 28.05, CIQ 6.0)

Device: Forerunner 265 (part 006-B4257-00) Firmware: 28.05 Connect IQ: 6.0.0 Language: chs App type: Watchface (AMOLED), CIQ min API 3.2.0

Symptom

When a user updates the watchface from the store while it is the currently active face, the device briefly shows the Connect IQ error screen (white "IQ" + "!") with:

Error: Invalid Value
Details: 'Failed invoking <symbol>'

Sometimes it auto-recovers within a second; other times it stays on the error screen until a button press, then reloads fine. After the reload the watchface runs perfectly.

What I have verified (key point)

The crash is tied to the update action itself, not to any code change:

• Uploading the same binary with only the version number bumped still reproduces it. Identical code → still crashes on update. This rules out my application code as the cause.
• Side-loading the .prg (overwriting GARMIN/APPS) does NOT reproduce it. Only a store update of the active watchface does — i.e. the path that hot-swaps the running .prg.
• try { } catch(ex) { } around every callback (onUpdate/onPartialUpdate/onLayout/initialize) does not catch it.
• Decoding the ERA stack (matching .prg.debug.xml) yields no coherent application call stack — the top frame is native/system (pc: 0x3000220e, Native: false), application frames don't form a valid chain.

This all points to the error originating in the firmware while it tears down the running .prg during the OTA update, not in app code.

Crash report (ERA)

Error: Invalid Value
Details: 'Failed invoking <symbol>'
Time: 2026-06-20T13:38:53Z
Part-Number: 006-B4257-00
Firmware-Version: '28.05'
ConnectIQ-Version: 6.0.0
Language-Code: chs
Stack:
  - pc: 0x3000220e   Native: false
  - pc: 0x10006536
  - pc: 0x10008f99
  - pc: 0x10008e83
  - pc: 0x100097e5

Questions

1. Is this a known behavior when a store update replaces a watchface that is currently being rendered on FR265 / fw 28.05 / CIQ 6.0?
2. Is there a recommended way for an app to avoid the transient InvalidValue / Failed invoking <symbol> during the update hand-off?
3. Should onUpdate/onPartialUpdate be able to catch this, or is it raised below the VM (uncatchable, like an OOM)?

Happy to provide a minimal reproducible project if useful.