docs: decide where mavwaked and mavenclient run — not on homesrv (V-463)

They appear in no compose file and run as no host process, and the task
asked whether that is a gap to close or a decision to write down. It is a
decision.

The reason is not hardware. homesrv is a Lenovo laptop and
/proc/asound/cards lists its ACP mic array with capture devices, so
passing /dev/snd into a container would work. It would also listen to an
empty room. A wake-word daemon is worth having where he is standing, and
that is not where the server is.

mavenclient is a client by name and design, mavwaked is the gate in
front of it, and the wire already reaches off-box: ipc.Dial takes
tcp://host:port?token=... through the netaddr seam, with the token
checked before internal/ipc sees the connection. So this needs a machine
and a config line, not protocol work.

The honest consequence is worse than the task suggested, and both docs
now say it: the wake word and the VAD gate are covered by unit tests and
by nothing else. QA session 1 step 2 was reworded to claim only what it
checks, which is push-to-talk through /dash. CLAUDE.md listed all nine
binaries with no column for where they run, which is how this went
unnoticed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/qa.md

@@ -105,9 +105,9 @@ turns look misaligned when they are not.
    **Passes** (02-08-2026, five turns): `я рада`, `поняла`, `помогла`,
    `проверила`, `записала`, `грустна`, `ты` throughout, no pet names.
 2. Press push-to-talk on `/dash`. Say `привет`. Confirm a spoken reply comes
-   back. This is the only check that covers mic to STT to core to TTS to
-   speaker as one path. It is also the path the eleven-day outage most likely
-   broke.
+   back. This covers browser mic to STT to core to TTS as one path. It does
+   **not** cover the wake word or the voice-activity gate, and no step here
+   does — see below.
 3. Say `тихий режим`. Expect `тихий режим включён. буду реже напоминать.` **Passes.**
 4. Say `выключи тихий режим`. Expect `тихий режим выключен.` Negation must win. **Passes.**
 5. Say `в комнате тихо`. Quiet mode must NOT flip. Confirm on `/history` that no
@@ -129,11 +129,18 @@ turns look misaligned when they are not.
    and stitch unrelated topics. Asked whether he should move flats, she opened
    with the weather. That is 287, and it is a phrasing problem, not a loop problem.
 
-**The wake path cannot be checked as deployed.** `mavwaked` and `mavenclient`
-appear in no compose file and run as no host process. Step 2 covers only
-push-to-talk, from `/dash` through mavsttd and mavttsd. Wake word and VAD
-are untested by construction. Decide whether they belong in compose or on a
-client machine, and say which in the deploy docs. Tracked as **463**.
+**The wake path cannot be checked here, and that is now the decision rather
+than a gap.** `mavwaked` and `mavenclient` appear in no compose file and run as
+no host process. They are not going to. They belong on a client machine in the
+room he is standing in, because homesrv's microphone is real and in the wrong
+room — **463**, written up in `docs/plans/17-where-the-voice-loop-runs.md`.
+
+So the wake word and the VAD gate are covered by their unit tests and by
+nothing else, and no session at this box changes that. Checking them needs a
+machine with a microphone running both binaries against a TCP-listening mavend.
+`ipc.Dial` already speaks `tcp://host:port?token=...`, so the work is a machine
+and a config line, not protocol work. Until then, **287** can only be
+half-answered, and step 2 above is push-to-talk, not the voice loop.
 
 **319's single-token bug is fixed** (01-08-2026). Single-word Russian utterances no longer come
 back as `не совсем поняла — можешь переформулировать?`. `привет` and `поужинал`