fix: full review pass (main process, voice pipeline, Hermes client, HUD) and e2e-validated local voice (v2.1.0.1)

Electron main
- utility-process channel: sherpa output copied into V8 buffers (Electron rejects external
  buffers), audio exchanged as base64; worker restart on timeout, identity-safe exit handling,
  deterministic native unload by restart
- webhook: loopback by default without secret, UTF-8-safe body assembly, clean restart, port validation
- files IPC: realpath-based root check, openPath allow-list (reveal-only outside document folders),
  Windows reserved names; store: debounced async atomic writes with backup of corrupt files;
  logger: streaming writes with rotation; log message size cap
- HTTP stream proxy: socket released on idle timeout / renderer destroyed, id validation
- model manager: inactivity timeout, retrying rm/rename (Windows locks), engine stopped before
  replacing a model; WAV decoder handles float/24-bit; IPC payload validation
- window: opaque rounded window on Windows, navigation lock-down, visibility events;
  Ctrl+Alt+Escape instead of the Task Manager shortcut; single-instance guard; EVEFLOW_USER_DATA

Voice pipeline
- abort semantics (SendHandle.aborted), abort before the stream opens, session id prefixes per transport
- hands-free re-arm after replies without speech, start/stop race, no chime on auto re-arm,
  no silence shipped to STT (400 ms pre-roll), no transcription of empty manual stops
- TTS: bounded prefetch, cancellable segments, non-interrupting notices, volume applied at play time
- SSE CRLF split, usage in chat completions, finish_reason length, phonetic regex hoisted

HUD
- core renderer: no canvas shadows, cached colours, reusable spectrum buffer, theme read on change,
  30 fps idle, stops when the window is hidden; ping flashes on send / tool / speech
- deltas coalesced per animation frame; stable auto-scroll; narrow selectors everywhere
- bundled fonts (offline), reduce-motion fix, error toasts, ops drawer below 1180 px,
  interim transcript and first-token latency in the core caption, Ctrl+K, dialog semantics,
  switch/aria roles, compact widget cleanup, Whisper small recommended for French
- docs/ROADMAP.md: audit results, e2e results and the plan towards a real JARVIS

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017Wn5VX9HNbJ7N54hR24u9Y

electron/logger.ts

@@ -5,22 +5,46 @@ import type { LogEntry } from '../shared/ipc';
 
 const MAX_LOG_BYTES = 5 * 1024 * 1024;
 
+let stream: fs.WriteStream | null = null;
+let written = 0;
+
 export function getLogPath(): string {
   return path.join(app.getPath('userData'), 'eveflow.log');
 }
 
+function output(): fs.WriteStream {
+  if (!stream) {
+    const target = getLogPath();
+    try {
+      written = fs.statSync(target).size;
+    } catch {
+      written = 0;
+    }
+    stream = fs.createWriteStream(target, { flags: 'a' });
+    stream.on('error', (err) => console.error('[logger] write failed:', err.message));
+  }
+  return stream;
+}
+
+function rotate(): void {
+  const target = getLogPath();
+  stream?.end();
+  stream = null;
+  try {
+    fs.renameSync(target, `${target}.old`);
+  } catch {
+    /* ignore */
+  }
+  written = 0;
+}
+
 export function writeLog(entry: LogEntry): void {
   try {
-    const logPath = getLogPath();
     const data = entry.data !== undefined ? ' | ' + safeJson(entry.data) : '';
     const line = `[${entry.ts}] [${entry.level}] [${entry.tag}] ${entry.message}${data}\n`;
-    try {
-      const stat = fs.statSync(logPath);
-      if (stat.size > MAX_LOG_BYTES) fs.renameSync(logPath, logPath + '.old');
-    } catch {
-      /* first start: file does not exist yet */
-    }
-    fs.appendFileSync(logPath, line, 'utf8');
+    written += Buffer.byteLength(line);
+    if (written > MAX_LOG_BYTES) rotate();
+    output().write(line);
   } catch (err) {
     console.error('[logger] cannot write log file:', (err as Error).message);
   }