Fixes applied (14 of 15 findings — see note on R5)

Concurrency crashes
  - H1 HardwareMonitorService.RebuildTree now builds the tree under _updateLock, so it can't enumerate a hardware's _active HashSet while the update loop mutates it.
  - A1 AppSettings now guards every dictionary read/write (and snapshots in Save) with a lock — safe under concurrent access from the parallel discovery threads.
  - R2 Plumbed that same lock (HardwareMonitorService.SensorReadLock) into RemoteWebServer and wrapped the Prometheus sensor.Values enumeration with it.
  - L1 Computer — refactored Add into AddCore, which performs the cancellation/enabled re-check and the _groups insertion atomically under _lock. A deferred task can
  no longer add (and leak) a group after Close() drained the list; if it loses the race it closes the group instead.
  - M1 UpdateTimer_Tick now bails before/after the await when _isShuttingDown is set in MainWindow_Closed, so an in-flight tick won't touch the disposed
  view-model/Computer.

  Broken behavior
  - T1 Tray callback now decodes NOTIFYICON_VERSION_4 correctly (message = LOWORD(lParam), icon id = HIWORD(lParam)) — right-click menu and double-click work again.
  - M2 A transient update exception no longer calls _timer.Stop(); the loop keeps running.
  - H2 Newly discovered (deferred) storage devices get the current ForceDriveWakeup setting applied in HardwareChanged.
  - V2 Sensor items carry a parent reference; toggling IsVisible recomputes the parent group's visibility, so no empty group headers. (Strengthened the existing test
  that had skipped this assertion.)
  - H3 Tree-rebuild coalescing now uses a dirty flag with a re-check, so a change arriving during a rebuild isn't lost.
  - R4 Web routing matches endpoints exactly on the query-stripped path (Url.AbsolutePath), so static assets like metrics.html aren't hijacked.
  - L8 IntelCpu.Update skips the bus/core-clock math while TimeStampCounterFrequency is still 0 (deferred-TSC window), so clocks keep their prior value instead of
  reporting 0 MHz.
  - V1 Existing plot series keep their assigned color; only an explicit user pen color updates them (no per-tick color shifting).
  - M3 Runtime errors write to a dedicated runtime.log (once), instead of overwriting the shared startup.log.
  - T2 CreateSensorIcon returns IntPtr.Zero on DIB failure instead of the shared main-icon handle (which callers DestroyIcon).

  I also set _isOpen = false in HardwareMonitorService.Dispose so the rebuild guard actually holds during shutdown (the latent after-close-rebuild issue adjacent to
  H3

LibreHardwareMonitor.Windows.WinUI/ViewModels/MainWindowViewModel.cs

@@ -116,6 +116,7 @@ public sealed class MainWindowViewModel : ViewModelBase, IDisposable
         _remoteWebServer = new RemoteWebServer(
             () => RootItems.FirstOrDefault(),
             _hardwareMonitor.Computer,
+            _hardwareMonitor.SensorReadLock,
             settings.GetValue("listenerIp", "?"),
             settings.GetValue("listenerPort", 8085),
             settings.GetValue("authenticationEnabled", false),
@@ -958,9 +959,11 @@ public sealed class MainWindowViewModel : ViewModelBase, IDisposable
                 _plotSeriesByIdentifier[identifier] = series;
                 PlotSeries.Add(series);
             }
-            else
+            else if (sensorItem.PenColor.HasValue)
             {
-                series.Color = GetPlotColor(sensorItem);
+                // Only honor an explicit user pen color for an existing series; keep the auto-assigned color stable.
+                // (Recomputing it from the live series count made existing lines shift/collide colors every tick.)
+                series.Color = sensorItem.PenColor.Value;
             }
 
             series.Points.Add(new PlotPointViewModel(now, value.Value));