• feat(desktop): add recovery action help button (#4828)
• fix(cli): Servy.CLI.dll flagged by ESET Server Security (#5024)
• fix(core): AffinityHelper.cs - hex affinity masks skip the processor-bounds check the range/list forms enforce; invalid masks pass validation and silently fail at runtime (#4788)
• fix(core): AffinityHelper.cs - both 'start < 0' and 'core < 0' guards are provably unreachable: the '-' split consumes every minus sign before parsing (#4789)
• fix(core): HandleHelper.cs - 'match.Success' is always true for matches enumerated from Regex.Matches; the term is provably constant (#4792)
• fix(core): ProcessHelper.cs - GetProcessTree's TryGetValue-miss continue is provably unreachable: both enqueue sites record the start time first (#4794)
• fix(core): ProcessKiller.cs - CriticalSystemProcesses protects the Hyper-V management services but not the per-VM worker processes (vmwp, vmmem) (#4799)
• fix(restarter): Servy.Restarter Program.cs - logs 'Successfully restarted service' and exits 0 when the service does not exist in the SCM (void RestartService hides its vanished-service clean returns) (#4893)
• fix(desktop,manager): app.manifest (Servy + Manager) - no DPI-awareness declaration; both WPF apps blur on mixed-DPI monitor setups (#4842)
• fix(manager): DependenciesView.xaml - five DataTriggers bind 'IsCycle' but the model property is 'IsCyclic', so all cycle visuals are dead (#4816)
• fix(manager): LogTailer.cs - flush-torn handling still leaks a truncated line through the threshold flush and replays published lines on exception-reopen (residual of #4084/#3302) (#4867)
• fix(setup/servy.iss): SetupAppRunningError says '%n%Please', so the dialog renders a literal '%' and loses the blank line (#4778)
• fix(setup/servy.iss): task XMLs declare UTF-8 but are saved with ANSI SaveStringsToFile; a non-ASCII install path corrupts them (#4780)
• fix(license): handle64.exe / handle64a.exe - Sysinternals binaries committed and redistributed in four projects with no attribution, version record, or redistribution license (#4756)
• ci(security.yml): .gitleaks.toml - allowlist-only config without [extend] replaces the default ruleset, so the CI secret scan runs with zero rules (#4749)
• fix: various code quality, robustness and inconsistency issues
• docs: fix various issues in the documentation (wiki)