fix: full review pass (main process, voice pipeline, Hermes client, HUD) and e2e-validated local voice (v2.1.0.1)

Electron main
- utility-process channel: sherpa output copied into V8 buffers (Electron rejects external
  buffers), audio exchanged as base64; worker restart on timeout, identity-safe exit handling,
  deterministic native unload by restart
- webhook: loopback by default without secret, UTF-8-safe body assembly, clean restart, port validation
- files IPC: realpath-based root check, openPath allow-list (reveal-only outside document folders),
  Windows reserved names; store: debounced async atomic writes with backup of corrupt files;
  logger: streaming writes with rotation; log message size cap
- HTTP stream proxy: socket released on idle timeout / renderer destroyed, id validation
- model manager: inactivity timeout, retrying rm/rename (Windows locks), engine stopped before
  replacing a model; WAV decoder handles float/24-bit; IPC payload validation
- window: opaque rounded window on Windows, navigation lock-down, visibility events;
  Ctrl+Alt+Escape instead of the Task Manager shortcut; single-instance guard; EVEFLOW_USER_DATA

Voice pipeline
- abort semantics (SendHandle.aborted), abort before the stream opens, session id prefixes per transport
- hands-free re-arm after replies without speech, start/stop race, no chime on auto re-arm,
  no silence shipped to STT (400 ms pre-roll), no transcription of empty manual stops
- TTS: bounded prefetch, cancellable segments, non-interrupting notices, volume applied at play time
- SSE CRLF split, usage in chat completions, finish_reason length, phonetic regex hoisted

HUD
- core renderer: no canvas shadows, cached colours, reusable spectrum buffer, theme read on change,
  30 fps idle, stops when the window is hidden; ping flashes on send / tool / speech
- deltas coalesced per animation frame; stable auto-scroll; narrow selectors everywhere
- bundled fonts (offline), reduce-motion fix, error toasts, ops drawer below 1180 px,
  interim transcript and first-token latency in the core caption, Ctrl+K, dialog semantics,
  switch/aria roles, compact widget cleanup, Whisper small recommended for French
- docs/ROADMAP.md: audit results, e2e results and the plan towards a real JARVIS

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017Wn5VX9HNbJ7N54hR24u9Y

electron/voice/engine.ts

@@ -19,13 +19,22 @@ let child: UtilityProcess | null = null;
 let nextId = 1;
 const pending = new Map<number, Pending>();
 
+function rejectAll(message: string): void {
+  for (const [id, p] of pending) {
+    clearTimeout(p.timer);
+    p.reject(new Error(message));
+    pending.delete(id);
+  }
+}
+
 function spawn(): UtilityProcess {
   if (child) return child;
   const script = path.join(__dirname, 'voice-worker.js');
-  child = utilityProcess.fork(script, [], { serviceName: 'eveflow-voice', stdio: 'pipe' });
-  child.stdout?.on('data', (d: Buffer) => log('DEBUG', 'voice-worker', d.toString().trim()));
-  child.stderr?.on('data', (d: Buffer) => log('WARN', 'voice-worker', d.toString().trim()));
-  child.on('message', (msg: { id: number; ok: boolean; result?: unknown; error?: string }) => {
+  const proc = utilityProcess.fork(script, [], { serviceName: 'eveflow-voice', stdio: 'pipe' });
+  child = proc;
+  proc.stdout?.on('data', (d: Buffer) => log('DEBUG', 'voice-worker', d.toString().trim()));
+  proc.stderr?.on('data', (d: Buffer) => log('WARN', 'voice-worker', d.toString().trim()));
+  proc.on('message', (msg: { id: number; ok: boolean; result?: unknown; error?: string }) => {
     const p = pending.get(msg.id);
     if (!p) return;
     pending.delete(msg.id);
@@ -33,17 +42,15 @@ function spawn(): UtilityProcess {
     if (msg.ok) p.resolve(msg.result);
     else p.reject(new Error(msg.error ?? 'erreur moteur vocal'));
   });
-  child.on('exit', (code) => {
+  proc.on('exit', (code) => {
     log(code === 0 ? 'INFO' : 'ERROR', 'voice-worker', `exited with code ${code}`);
+    // A newer worker may already have replaced this one; only clean up if we are still current.
+    if (child !== proc) return;
     child = null;
-    for (const [id, p] of pending) {
-      clearTimeout(p.timer);
-      p.reject(new Error('Le moteur vocal local s’est arrêté de façon inattendue.'));
-      pending.delete(id);
-    }
+    rejectAll('Le moteur vocal local s’est arrêté de façon inattendue.');
   });
   log('INFO', 'voice', 'voice worker started');
-  return child;
+  return proc;
 }
 
 function request<T>(message: Record<string, unknown>, timeoutMs = 120_000): Promise<T> {
@@ -53,9 +60,20 @@ function request<T>(message: Record<string, unknown>, timeoutMs = 120_000): Prom
     const timer = setTimeout(() => {
       pending.delete(id);
       reject(new Error('Délai dépassé pour le moteur vocal local.'));
+      // The worker handles requests synchronously: a stuck request wedges everything behind it.
+      if (child === proc) {
+        log('WARN', 'voice', 'worker unresponsive, restarting');
+        stopEngine();
+      }
     }, timeoutMs);
     pending.set(id, { resolve: (v) => resolve(v as T), reject, timer });
-    proc.postMessage({ id, ...message });
+    try {
+      proc.postMessage({ id, ...message });
+    } catch (err) {
+      pending.delete(id);
+      clearTimeout(timer);
+      reject(err as Error);
+    }
   });
 }
 
@@ -76,21 +94,31 @@ export async function engineStatus(): Promise<VoiceEngineStatus> {
 }
 
 export function transcribe(req: TranscribeRequest): Promise<TranscribeResult> {
-  return request<TranscribeResult>({ type: 'transcribe', model: modelRef(req.modelId), wav: req.wav, language: req.language }, 180_000);
+  // Binary payloads are base64-encoded for the worker: the utility process channel rejects external buffers.
+  const wav = Buffer.from(req.wav.buffer, req.wav.byteOffset, req.wav.byteLength).toString('base64');
+  return request<TranscribeResult>({ type: 'transcribe', model: modelRef(req.modelId), wav, language: req.language }, 180_000);
 }
 
-export function synthesize(req: SynthesizeRequest): Promise<SynthesizeResult> {
-  return request<SynthesizeResult>({ type: 'synthesize', model: modelRef(req.modelId), text: req.text, speaker: req.speaker, speed: req.speed }, 180_000);
+export async function synthesize(req: SynthesizeRequest): Promise<SynthesizeResult> {
+  const result = await request<Omit<SynthesizeResult, 'wav'> & { wav: string }>(
+    { type: 'synthesize', model: modelRef(req.modelId), text: req.text, speaker: req.speaker, speed: req.speed },
+    180_000
+  );
+  const buffer = Buffer.from(result.wav, 'base64');
+  return { ...result, wav: new Uint8Array(buffer.buffer, buffer.byteOffset, buffer.byteLength) };
 }
 
-export function unload(modelId?: string): Promise<unknown> {
-  if (!child) return Promise.resolve({ ok: true });
-  return request({ type: 'unload', modelId }, 20_000);
+/** Native model memory is only released deterministically by restarting the worker. */
+export function unload(_modelId?: string): Promise<unknown> {
+  stopEngine();
+  return Promise.resolve({ ok: true });
 }
 
 export function stopEngine(): void {
-  if (child) {
-    child.kill();
-    child = null;
+  const proc = child;
+  child = null;
+  if (proc) {
+    rejectAll('Moteur vocal redémarré.');
+    proc.kill();
   }
 }