On-device agent with relay discipline.

Bombadil runs the Istari-shaped loop locally; relay envelopes stay versioned and operator-auditable per the published contract.

Slots follow the dad-pitch ship-id convention: replace with screenshotsSHIP/<id>.png when marketing assets exist.

Operators who already chose the AiMANAC family posture: customer-owned backends, Apple-sale trust floor, no subscription rent on core workflows.