Desktop runtime
Supervised sidecar
Running Python as a separate child process that a desktop app watches and restarts, instead of embedding an interpreter in the binary.
The reason is failure isolation. A segfault in an embedded runtime takes the whole application down, window and all; a segfault in a sidecar takes down the sidecar, and something notices.
The two sides talk over a loopback connection authenticated with a token the Python side writes at startup, because a local port is otherwise reachable by anything running as the same user.