Pathweft 1.1.64

Pathweft 1.1.64 completes the Maintenance expansion (S47) with a read-only security check and opt-in hardening, and highlights runaway memory in System analysis.

• Maintenance › Security check evaluates the pinned HardeningKitty main machine list (MIT) read-only: 418 settings, 335 evaluated (registry, services, optional features, scheduled tasks, Microsoft Defender including attack surface reduction rules, BitLocker); the other 83 use methods Pathweft does not run and are not listed; the category's explanation says how many and why. Findings are grouped High, Medium and Low not met, then Met and Not checked, with current and recommended values. The category never changes anything; where a Windows tweak covers the same setting, details link to it.
• Eight Security-goal Windows tweaks with journaled, exact Restore: Defender network protection (block), potentially unwanted app blocking, Defender sandbox, LSA protection without UEFI lock (Caution), firmware-installed software off (WPBT; Caution), PowerShell 2.0 engine off, WMIC removed and VBScript removed (Caution). Optional features and capabilities are a typed action through Windows' servicing API in the administrator session approved at launch; restoring a removed capability downloads it from Windows Update.
• System analysis (Physical RAM) derives a Memory growth event when one app gains at least 15% of installed memory over at least 8 minutes at 0.25 GB/min or more, from the heavy-app snapshots Pathweft already records. Spike markers sit at the peak and name the largest app and, for RAM, the fastest-growing one, as sampled observations rather than proof of cause. Spike and growth markers use the caution colour; selecting one investigates its peak. No new collection or notifications; the performance MCP output is unchanged.
• Previewing a .lnk or .url shortcut shows what it points to, read from the shortcut itself, instead of its bytes: target, arguments, start folder, run state, shortcut key, icon, comment and whether the target is found; Open and Show target in its folder act on it. Previewing never resolves, launches or repairs the shortcut.
• 1.1.63 was built but not published; its changes ship here.
• Specification 1.21 records this as MAINT-40..45, MONITOR-22 and PREVIEW-39.

Update from Pathweft's own updater or run the installer, which requests Windows administrator consent. Pathweft binaries and installer are unsigned; verify the published files with SHA256SUMS.txt and release-manifest.json.