A Window Is Not a Server
The Mac app is a projector over the same engine the terminal already runs. The engine process opens no listening socket. It is a child: one workspace, one record, one stdio pipe. A local HTTP server 'so the UI can attach' would be a second product and a second attacker surface. Family work already has enough listeners. This one stays a program.
The host is native — SwiftUI and AppKit own lifecycle, permissions, and Apple integration. The renderer is a guest. The Python engine remains the sole owner of the loop, the tools, the record, and workspace mutation. No client database or reducer may become authoritative. If the window dies, the notebook is still on disk. If the engine dies, the window recovers from the notebook. Neither direction invents a second loop.
No Bundled Interpreter
The signed app launches a Conda child. It does not ship a private Python tree inside the bundle. A private tree would drift from the cleanroom interpreter the CLI already proved. Swift packaging and signing live in swift-quest. Here the rule is smaller: the projector does not become a second runtime.