fix: full review pass (main process, voice pipeline, Hermes client, HUD) and e2e-validated local voice (v2.1.0.1)

Electron main
- utility-process channel: sherpa output copied into V8 buffers (Electron rejects external
  buffers), audio exchanged as base64; worker restart on timeout, identity-safe exit handling,
  deterministic native unload by restart
- webhook: loopback by default without secret, UTF-8-safe body assembly, clean restart, port validation
- files IPC: realpath-based root check, openPath allow-list (reveal-only outside document folders),
  Windows reserved names; store: debounced async atomic writes with backup of corrupt files;
  logger: streaming writes with rotation; log message size cap
- HTTP stream proxy: socket released on idle timeout / renderer destroyed, id validation
- model manager: inactivity timeout, retrying rm/rename (Windows locks), engine stopped before
  replacing a model; WAV decoder handles float/24-bit; IPC payload validation
- window: opaque rounded window on Windows, navigation lock-down, visibility events;
  Ctrl+Alt+Escape instead of the Task Manager shortcut; single-instance guard; EVEFLOW_USER_DATA

Voice pipeline
- abort semantics (SendHandle.aborted), abort before the stream opens, session id prefixes per transport
- hands-free re-arm after replies without speech, start/stop race, no chime on auto re-arm,
  no silence shipped to STT (400 ms pre-roll), no transcription of empty manual stops
- TTS: bounded prefetch, cancellable segments, non-interrupting notices, volume applied at play time
- SSE CRLF split, usage in chat completions, finish_reason length, phonetic regex hoisted

HUD
- core renderer: no canvas shadows, cached colours, reusable spectrum buffer, theme read on change,
  30 fps idle, stops when the window is hidden; ping flashes on send / tool / speech
- deltas coalesced per animation frame; stable auto-scroll; narrow selectors everywhere
- bundled fonts (offline), reduce-motion fix, error toasts, ops drawer below 1180 px,
  interim transcript and first-token latency in the core caption, Ctrl+K, dialog semantics,
  switch/aria roles, compact widget cleanup, Whisper small recommended for French
- docs/ROADMAP.md: audit results, e2e results and the plan towards a real JARVIS

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017Wn5VX9HNbJ7N54hR24u9Y

electron/window.ts

@@ -1,4 +1,5 @@
 import { app, BrowserWindow, screen, shell } from 'electron';
+import { EventEmitter } from 'node:events';
 import fs from 'node:fs';
 import path from 'node:path';
 import { IPC, type WindowMode } from '../shared/ipc';
@@ -9,6 +10,9 @@ const COMPACT_SIZE = { width: 380, height: 620, minWidth: 320, minHeight: 420 };
 
 let mainWindow: BrowserWindow | null = null;
 let currentMode: WindowMode = 'hud';
+export const windowEvents = new EventEmitter();
+// Transparent frameless windows cannot be resized reliably on Windows; use an opaque, rounded window there.
+const TRANSPARENT = process.platform !== 'win32';
 let hudBounds: Electron.Rectangle | null = null;
 
 export function getMainWindow(): BrowserWindow | null {
@@ -49,8 +53,9 @@ export function createMainWindow(): BrowserWindow {
   const win = new BrowserWindow({
     ...HUD_SIZE,
     frame: false,
-    transparent: true,
-    backgroundColor: '#00000000',
+    transparent: TRANSPARENT,
+    backgroundColor: TRANSPARENT ? '#00000000' : '#03070d',
+    roundedCorners: true,
     hasShadow: true,
     show: false,
     title: 'EveFlow',
@@ -78,11 +83,18 @@ export function createMainWindow(): BrowserWindow {
     return { action: 'deny' };
   });
   win.webContents.on('will-navigate', (event, url) => {
-    if (!url.startsWith('file://') && !url.startsWith(process.env.VITE_DEV_SERVER_URL ?? 'http://127.0.0.1:5173')) {
-      event.preventDefault();
-      void shell.openExternal(url);
-    }
+    if (url === win.webContents.getURL()) return;
+    event.preventDefault();
+    if (/^https?:\/\//i.test(url)) void shell.openExternal(url);
   });
+  win.webContents.on('will-redirect', (event) => event.preventDefault());
+  const notifyVisibility = () => {
+    if (!win.isDestroyed()) win.webContents.send(IPC.windowVisibility, win.isVisible() && !win.isMinimized());
+  };
+  win.on('show', notifyVisibility);
+  win.on('hide', notifyVisibility);
+  win.on('minimize', notifyVisibility);
+  win.on('restore', notifyVisibility);
 
   win.on('closed', () => {
     mainWindow = null;
@@ -129,6 +141,7 @@ export function setWindowMode(mode: WindowMode): void {
   }
   currentMode = mode;
   win.webContents.send(IPC.windowModeChanged, mode);
+  windowEvents.emit('mode', mode);
 }
 
 export function toggleWindowVisibility(): void {