A Proposal Is Not a Submit
Pippa can propose a command. That is a family-shaped feature, and it is allowed only as a proposal. ⌘K asks a loopback endpoint on the same Mac — Pippa's, not the sibling door, not the mobile gateway — and comes back with candidates. The candidates insert against a frozen snapshot of the line you were on. They never carry a newline. They never silently pick a winner. You look. You pick. You press Enter, or you do not. "Pippa proposes; you execute" is structural, the same bar as drafts staying outside the PTY, applied to a single line instead of a seat's document.
A completion that auto-picks is a model-callable write by another name. A proposal that includes a trailing newline is a submit wearing a suggestion. Both will ship if nobody names them, because they photograph as helpful. They are how a Sidekick becomes a keyboard, and a keyboard a model can press is the door this track just refused, opened from the inside.
Frozen Snapshot, Then You Choose
While candidates are on screen, the line they were computed against must not be a moving target. The snapshot freezes what Pippa saw. If the PTY prints, if you keep typing, if a sibling launch rearranges the tab, the candidates belong to a moment that has passed. Inserting them into a different line is how you complete the wrong command with the right-looking suffix. The honest UI either inserts into the snapshot (and you see the join) or discards the candidates and asks again. It does not splice a stale suffix onto a live prefix in the dark.
Option+Tab is the chord that shows more than one candidate and makes you pick. Tab itself stays with the shell — that split was a chrome rule in Track 1, and it stays a chrome rule here. Pippa completion is a different code path. Multiple candidates, explicit choice, explanations in English next to the command because chrome is English. A single glowing suggestion that accepts on Tab is a silent pick, even if the glow is pretty.
The Endpoint Is Loopback, the Act Is Yours
The proposal comes from Pippa over loopback, authenticated like any other family call, and it is still not the sibling door's generic input verb. Pippa may read the visible snapshot to propose. She may not send the proposal as input. She may not complete on your behalf while you are in another room. She may not attach a newline "because obviously you meant to run it." Obviously is how submits sneak through.
This is also why a phone will not get a looser proposal later. A pocket ⌘K that auto-runs because the keyboard is annoying is the same silent pick in a smaller glass. The working iOS contract is continue-host-work: observe, take control, then type. Proposals, when they exist there, will still insert without a newline. The Mac has to get this right first, in the room where you can see the line and the candidate at the same time.