diff --git a/.dockerignore b/.dockerignore
index d84b0ac..fb6997b 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -13,7 +13,6 @@ certs
 /mavpoll
 /mavcaldav
 /mavenclient
-/mavwaked
 
 # heavy deps we don't need in context. We keep only the prebuilt runtime libs
 # (deps/lib, deps/piper) and the headers the CGO build needs.
diff --git a/Dockerfile b/Dockerfile
index b55d0ef..0e4ab58 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -44,15 +44,14 @@ RUN go build -o /out/mavend    ./cmd/mavend    && \
     go build -o /out/mavttsd   ./cmd/mavttsd   && \
     go build -o /out/mavweb    ./cmd/mavweb    && \
     go build -o /out/mavpoll   ./cmd/mavpoll   && \
-    go build -o /out/mavcaldav ./cmd/mavcaldav && \
-    go build -o /out/mavwaked  ./cmd/mavwaked
+    go build -o /out/mavcaldav ./cmd/mavcaldav
 
 FROM debian:trixie-slim AS runtime
 # tzdata so the TZ env (set in compose) resolves — otherwise Go can't load the
 # zone and time.Now() stays UTC, and mavend answers clock/date queries and
 # evaluates quiet-hours in UTC.
 RUN apt-get update && apt-get install -y --no-install-recommends \
-      ca-certificates libvulkan1 mesa-vulkan-drivers libgomp1 tzdata alsa-utils && \
+      ca-certificates libvulkan1 mesa-vulkan-drivers libgomp1 tzdata && \
     rm -rf /var/lib/apt/lists/*
 
 # runtime native libs: whisper/ggml (incl. vulkan) are real files in deps/lib.
diff --git a/PROGRESS.md b/PROGRESS.md
index ab50767..8487e4b 100644
--- a/PROGRESS.md
+++ b/PROGRESS.md
@@ -88,10 +88,9 @@ tests, `-race` in `make test`.
   on the **desk PC** (hypridle-gated systemd timer), posts over wg to mavweb.
 - **Kuma `service_down`** — needs an API key created in Kuma → Settings → API Keys,
   passed to `mavpoll -kuma-key`.
-- **`mavwaked`** (always-on listening) — needs a docker-compose service entry
-  with audio device passthrough (`/dev/snd` + `group_add: audio` on the container,
-  or run as a systemd unit on the host for lower ALSA latency). Deferred until
-  the USB mic is on the homesrv and tested.
+- **`mavwaked`** (always-on listening) — needs a systemd user unit on a client
+  box (desk PC, pi, etc.) where the mic is attached. Connects to mavend over wg
+  or local net via `-addr`. Deferred until a client box is wired with a mic.
 
 Caveats / gotchas:
 - **desk_active is a workstation deploy, not code** — 0 facts ever written; presence
@@ -123,7 +122,8 @@ Since then (**2026-07-06, second session**):
   (L0 — no destructive acts). Reply plays through aplay(1). No wake word yet
   (pure VAD trigger); the 30ms frame shape matches silero-vad ONNX input 1:1,
   so swapping energy-threshold for ONNX inference is a local change in vad.go.
-  `Makefile` `build-waked` target; Docker image includes `alsa-utils` + binary.
+  `Makefile` `build-waked` target. Runs on client boxes (not docker/homesrv)
+  via systemd user unit; connects to mavend over wg or local net.
 
 - **Calendar querying (task 3)** — "что у меня завтра?" now answers from the
   CalDAV facts the poller already writes. Added `store.CalendarEvents(from,to)`,
@@ -257,9 +257,9 @@ first — these define the category:
    (L0). Gap narrowed: no wake word yet (pure voice-activity trigger; every
    utterance fires). The 30ms frame shape and 16kHz PCM match silero-vad's
    ONNX input exactly, so a wake-word model swap is a local change in vad.go.
-   Hardware: needs a mic on the always-on box (USB mic on homesrv or the desk
-   PC). Builds and tests; deploy action pending (docker-compose service + audio
-   device passthrough).
+   Hardware: the mic lives on a client box (desk PC, pi, etc.) — never the
+   homesrv. Deploy action: systemd user unit on whichever box has the mic,
+   connects to mavend over wg or local net.
 2. **Conversation is thin, not absent.** The router still classifies one
    utterance → one reply and there's no anaphora resolution or LLM-driven
    dialogue. But `internal/dialogue` is now **wired** (jul6 task 6 + follow-up):