When Otto speaks

This is the part that makes everything else tolerable. Otto can see a great deal; the question is what earns a notification.

Priority

Two values. urgent sends immediately. normal may be held.

Use normal for anything you did not ask for by name: digests, observations, nudges, FYIs. Keep urgent for replies to you, reminders you set, one-time codes and security alerts, and anything time-critical enough to be useless late. Answering something you just said always sends immediately regardless.

The three holds

In order of authority: snooze (you asked for silence until a time), busy (the calendar says you are in something), quiet (the configured quiet-hours window).

A held message is not dropped. It goes to queue.json and is flushed when the hold lifts, coalesced so that four held triggers arrive as one message rather than a burst of four. Held messages carrying buttons or files are delivered on their own, because coalescing would strip the thing that makes them actionable.

Quiet hours deliberately do not hold conversation. If you are awake and texting at 01:00 the window is wrong about you, and answering is obviously right.

snooze sets the first hold from chat. Nothing is lost by honouring it, which is why "leave me alone for an hour" is always safe.

Topic suppression

Every proactive send carries a topic key, either explicit (bill:enel-august) or falling back to the trigger that produced it. A second send under a key used recently is dropped unless the content materially changed.

This exists because the parts of Otto that speak cannot see each other. The morning brief, the hourly scan, the loops sweep and a bill trigger can each independently notice the same unpaid invoice and each decide it is worth mentioning. No single send is wrong; the set is.

Two windows do the work. Anything within two minutes at 50% similarity is treated as the restart burst, which is what happens when a session starts after downtime and every overdue trigger fires at once. Up to six hours, a send needs to be less than 82% similar to count as new information.

"Materially changed" is measured over tokens with the digits left in, so a bill whose amount moved from 84.30 to 112.00 is news and the same bill reworded is not.

The check runs before the hold, not after, so duplicates never reach the queue where coalescing would hand you one digest containing the same news five times. Urgent sends skip the check entirely.

The pre-send lint

Deterministic checks in the send path, no model call. Two severities.

Blocked, meaning the message does not go out and the session is told exactly what to fix: filler openers and closers, and machinery leaking into your view. "My trigger fired", "the email scan picked this up", "I spun up an agent". Both categories are always rewritable in one pass, which is what makes blocking safe.

Warned, meaning it sends with a note attached: links, code, lists or excessive length on a voice note; an unprompted message more than three times your own median length; any phrasing that claims mail went out, since that is only true after you approved a draft.

Only self-referential forms block. "That will trigger a rebuild" and "your CT scan is booked Tuesday" are ordinary English and survive, with a bare mention surfaced as a warning instead. Nothing here inspects meaning, so nothing here can be talked out of firing by the content of an email.

The loop escalation curve

A due-dated open loop gets two interruptions, ever:

The cap is structural rather than advisory: exhausted has no successor stage, so no future sweep can talk itself into one more nudge. The curve only moves forward, so a loop that has had its morning nudge never falls back to a digest mention.

Loops with no due date never escalate. You never gave them a deadline, and Otto inventing urgency for them would be inventing information.

Did any of it land

proactivity_report answers "am I bothering you" with evidence. It reads history.jsonl, groups outbound messages by the trigger or scan that caused them, and reports per source: how many were sent, how many drew a reply, and how long the current silent streak is.

A source that has sent three or more messages and never once drawn a reply is named explicitly. The report is evidence, not a verdict: retiring a trigger stays a conversation with you, and Otto will not disable one on its own.

Not built yet

These do not exist. The substrate each one reads is live, so every item below is a self-contained piece of work rather than a rewrite. The button copies a prompt that builds it in your own checkout.