A Proposal Is Not a Submit
Pippa can propose a command. That is a family-shaped feature, and it is allowed only as a proposal. ⌘K asks Pippa's command-proposal service — not the sibling door, not the mobile gateway — and comes back with one proposal, or with an answer if you asked a question; Option+Tab comes back with up to five candidates. A proposal or a completion inserts only against a frozen snapshot of the line you were on, and never with a newline. A proposal that spans several lines can still be read and copied, but Insert stays off for it, as it does for a command the service marks risky or better delegated. An Ask answer is shown and can be copied; it is never inserted at all. Nothing silently picks a winner. You look. You pick. You press Enter, or you do not. "Pippa proposes; you execute" is structural, the same bar as drafts staying outside the PTY, applied to a single line instead of a seat's document.
A completion that auto-picks is a model-callable write by another name. A proposal inserted with a trailing newline is a submit wearing a suggestion. Both will ship if nobody names them, because they photograph as helpful. They are how a Sidekick becomes a keyboard, and a keyboard a model can press is the door this track just refused, opened from the inside.
Frozen Snapshot, Then You Choose
While candidates are on screen, the line they were computed against must not be a moving target. The snapshot freezes what Pippa saw. If the PTY prints, if you keep typing, if a sibling launch rearranges the tab, the candidates belong to a moment that has passed. Inserting them into a different line is how you complete the wrong command with the right-looking suffix. The honest UI either inserts into the snapshot (and you see the join) or discards the candidates and asks again. It does not splice a stale suffix onto a live prefix in the dark.
Option+Tab is the chord that opens a chooser of up to five candidates and makes you pick. Tab itself stays with the shell — that split was a chrome rule in Track 1, and it stays a chrome rule here. Pippa completion is a different code path. Up to five candidates, explicit choice, explanations in English next to the command because chrome is English. A single glowing suggestion that accepts on Tab is a silent pick, even if the glow is pretty.
The Service Is Pippa's, the Act Is Yours
The proposal comes from Pippa's own proposal service, and it is still not the sibling door's generic input verb. Pippa may read the visible snapshot to propose. She may not send the proposal as input. She may not complete on your behalf while you are in another room. She may not attach a newline "because obviously you meant to run it." Obviously is how submits sneak through.
This is also why a phone will not get a looser proposal later. A pocket ⌘K that auto-runs because the keyboard is annoying is the same silent pick in a smaller glass. The working iOS contract is continue-host-work: open a host session and type beside the Mac. Proposals, when they exist there, will still insert without a newline. The Mac has to get this right first, in the room where you can see the line and the candidate at the same time.