Keep wake-word detection at the edge

So no, the wake word does not need to leave the room, and if a vendor's setup wizard insists on streaming raw audio to "improve accuracy," what it is improving is their server bill, not yours. A cheap board with a wake-word model onboard can decide whether anything downstream needs to know a person spoke at all. That decision is the whole point. Everything else, the SBC or microcontroller you picked, the storage, the cooling, the OS image, the radio, is just the appliance built around that one decision. Getting a model to print "detected" from a shell prompt once is not a feature. It is a demo you will forget to maintain.

Test the room, not the model card

Write down the event, the input, the output, and the deadline before you buy anything. "Add a wake word to the kitchen speaker" is not a job description; "when someone says the phrase near the counter mic, wake local transcription and light the indicator" is. Once you have that sentence, run it against the actual kitchen for a few days: the television left on, a toddler's approximation of the phrase, the neighbor's dog, the fridge compressor kicking in. Edge boards amplify that kind of noise more than any model swap will, and the failure I keep seeing is someone tuning the threshold on their own voice in a silent room, shipping it, and fielding a false wake every time the evening news comes on. Keep a running note of board, OS, and power supply next to cold-start latency and memory use, and what the device does when it misses a wake or fires one it shouldn't, because that log tells you whether the thing is ready, not the accuracy number from the training run.

Let the dumb layer keep the keys

None of this earns the model a say over anything that can hurt someone or something. Locks, heaters, valves, the alarm, stay behind deterministic code with real timeouts and permission checks, and every transcript, MQTT payload, or camera caption gets treated as data, never as an instruction. Local inference does not finish the privacy job alone; the recording, the log, the thumbnail cached for debugging, can still sit on a disk long after the microphone stopped listening, the same blind spot a fully local pipeline like local-rag-fully-offline has to answer for text. Run the board until the enclosure reaches operating temperature before you trust any of it, watch it at the wall, and if it throttles or corrupts an SD card under normal use, it is not done, no matter how good the demo clip looked. The rule that has held up for me: let false wakes cost nothing, let missed wakes degrade the automation instead of killing it outright, and treat the model as a narrow layer that can disappear without the house stopping.

What I still have not settled is how you debug a false trigger without keeping the very audio you promised nobody would keep, and every fix I have tried so far means breaking that promise a little to make the next one smaller.