@m13v/s4l 1.7.5-rc.21 → 1.7.5-rc.23

package/mcp/dist/index.js

@@ -1094,6 +1094,17 @@ async function postApproved(batchId, plan) {
                     };
                     if (cc.engagement_style)
                         decPost.engagement_style = cc.engagement_style;
+                    // Two-draft cards (2026-07-15): a human draft-switch (see the generic
+                    // edit-handling above, `if (e.variant && Array.isArray(c.drafts))`)
+                    // stamps the CHOSEN draft's assigned_style/assigned_mode onto the card
+                    // (cc). Forward both into decPost so post_reddit.py's _post_iteration
+                    // validates/logs against whichever draft is ACTUALLY posting, not
+                    // whichever was recommended at plan-write time — mirrors
+                    // twitter_post_plan.py's identical per-candidate override.
+                    if (cc.assigned_style !== undefined)
+                        decPost.assigned_style = cc.assigned_style;
+                    if (cc.assigned_mode !== undefined)
+                        decPost.assigned_mode = cc.assigned_mode;
                     const miniPlan = {
                         project_name: meta.project_name || cc.matched_project,
                         batch_id: cc.reddit_batch_id || meta.batch_id || "reddit-mcp-approval",

package/mcp/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.7.5-rc.21",
-  "installedAt": "2026-07-15T17:33:38.021Z"
+  "version": "1.7.5-rc.23",
+  "installedAt": "2026-07-15T22:57:05.841Z"
 }

package/mcp/manifest.json

@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "name": "social-autoposter",
   "display_name": "S4L",
-  "version": "1.7.5-rc.21",
+  "version": "1.7.5-rc.23",
   "description": "Draft, review, approve, and autopilot X/Twitter posts.",
   "long_description": "## **⚠️ The disclaimer above is generic Claude boilerplate.** Anthropic shows the same warning on every plugin regardless of what it does; any plugin has the same level of access as any app you download from the internet.\n\nS4L is an open source product developed by Mediar.ai Incorporated, a VC-backed San Francisco-based startup.\n\nTo get started:\n\n1\\. Copy this prompt: **Set me up on S4L plugin end to end**\n\n2\\. Quit with CMD+Q, reopen Claude, paste into a new chat.\n\nWhat happens next:\n\n* About every 5 minutes S4L scans X for posts that match your topics and drafts replies in your voice.\n* Drafts show up as review cards, usually the first within a few minutes. Nothing is posted automatically; you approve each one.\n* Posting autopilot stays off until you explicitly turn it on.",
   "author": {

package/mcp/menubar/s4l_card.py

@@ -69,10 +69,12 @@ import objc
 from Foundation import (
     NSObject,
     NSMakeRect,
+    NSMakeRange,
     NSMakeSize,
     NSAttributedString,
     NSMutableAttributedString,
     NSURL,
+    NSTimer,
 )
 from AppKit import (
     NSApp,
@@ -330,6 +332,85 @@ def _truncate(s, n=320):
     return s if len(s) <= n else s[: n - 1] + "…"
 
 
+def _fit_thread_body(thread_tv, text, link_url, *, font_size=12, step=15, floor=10):
+    """Set the thread-quote text on `thread_tv` ('text… ↗' when link_url is
+    given), shrinking `text` -- never the trailing link -- until the arrow
+    actually lands inside the view's visible box.
+
+    thread_tv is fixed-height and not vertically resizable, with no
+    scrollview around it, so a glyph laid out below its frame is simply
+    never drawn and never clickable. The old fixed `_truncate(text, 200)`
+    assumed ~4 lines always fit 200 characters, which holds most of the
+    time but not when word/URL lengths wrap more per line -- the trailing
+    ↗ link, the card's only way to open the source thread, could then sit
+    past the visible box (2026-07-15 user report: link "sometimes appears
+    outside the visible area", "doesn't fit into the card"). Checking the
+    arrow glyph's own bounding rect (rather than comparing total laid-out
+    height to the box) is what makes this correct whether or not the text
+    container itself turns out to be height-bounded."""
+    text = (text or "").strip()
+    box_h = thread_tv.frame().size.height
+    try:
+        inset = thread_tv.textContainerInset()
+        available_h = box_h - 2 * inset.height
+    except Exception:
+        available_h = box_h
+
+    def _attributed(shown_text):
+        b = NSMutableAttributedString.alloc().initWithString_attributes_(
+            shown_text,
+            {
+                NSFontAttributeName: NSFont.systemFontOfSize_(font_size),
+                NSForegroundColorAttributeName: NSColor.labelColor(),
+            },
+        )
+        if link_url:
+            b.appendAttributedString_(
+                NSAttributedString.alloc().initWithString_attributes_(
+                    " ↗",
+                    {
+                        NSFontAttributeName: NSFont.systemFontOfSize_(font_size),
+                        # Delegate (textView:clickedOnLink:atIndex:) tracks the
+                        # click as a thread_click interaction, then opens the
+                        # URL itself via NSWorkspace.
+                        NSLinkAttributeName: NSURL.URLWithString_(link_url),
+                    },
+                )
+            )
+        return b
+
+    length = min(len(text), 200)
+    lm = thread_tv.layoutManager()
+    tc = thread_tv.textContainer()
+    # Bounded loop: each pass is a cheap native layout of at most a couple
+    # hundred characters. The common case (thread fits in ~200 chars)
+    # exits after the first pass; only pathological long-word wrapping
+    # iterates further, and it always terminates at `floor`.
+    for _ in range(20):
+        shown = text[:length].rstrip()
+        if length < len(text):
+            shown += "…"
+        attributed = _attributed(shown)
+        thread_tv.textStorage().setAttributedString_(attributed)
+        if not link_url:
+            return
+        total_len = attributed.length()
+        if total_len == 0:
+            return
+        lm.ensureLayoutForTextContainer_(tc)
+        glyph_range = lm.glyphRangeForTextContainer_(tc)
+        laid_out_all = (glyph_range.location + glyph_range.length) >= total_len
+        fits = False
+        if laid_out_all:
+            last_rect = lm.boundingRectForGlyphRange_inTextContainer_(
+                NSMakeRange(total_len - 1, 1), tc
+            )
+            fits = (last_rect.origin.y + last_rect.size.height) <= available_h
+        if fits or length <= floor:
+            return
+        length = max(floor, length - step)
+
+
 # Human names for the ISO 639-1 codes the drafting model actually emits, so the
 # card can say "posts in Japanese" instead of "posts in ja". Unknown codes fall
 # back to the bare code; never raises.
@@ -398,6 +479,12 @@ def _reply_heading_suffix(d):
     project = (d.get("project") or "").strip()
     lane = ((d.get("experiments") or {}).get("lane") or "").strip()
     bits = []
+    if (d.get("experiments") or {}).get("sandbox"):
+        # Prompt-sandbox replay (run-twitter-cycle.sh S4L_SANDBOX_CANDIDATES_FILE):
+        # visible on the heading itself, not just the details popover, since
+        # approve_() blocks posting on these and the reviewer should know why
+        # before clicking rather than after.
+        bits.append("⚠ SANDBOX — not postable")
     # Project and lane are independent concepts most of the time (project
     # "fazm" drafted under lane "personal_brand"), but the operator's own
     # PersonalBrand project IS the personal_brand lane, so project=="PersonalBrand"
@@ -523,6 +610,20 @@ def _details_lines(d):
     return lines
 
 
+# Twitter's hard-expire ceiling: skill/run-twitter-cycle.sh's FRESHNESS_HOURS,
+# a fixed constant with "NO env-var knobs" per the 2026-07-06 decision (6h
+# steady-state as of 2026-07-15, raised from 2h; widened to 48h while
+# first-run-boost.json exists in the state dir, mirroring the exact marker
+# run-draft-and-publish.sh reads to decide the same thing). The real Phase 0
+# gate now compares tweet_posted_at directly (basis="tweet_posted_at" passed
+# by score_twitter_candidates.py), so this constant tracks thread age exactly,
+# not a discovery-age proxy. Reddit cards never carry a `stats` dict (see
+# _reddit_plan_to_candidates), so _expiry_str never fires for them; reddit's
+# own 24h ceiling (post_reddit.py) has no card-facing clock yet.
+_TWITTER_EXPIRE_HOURS = 6
+_TWITTER_EXPIRE_HOURS_BOOST = 48
+
+
 def _age_str(iso):
     """Thread age since tweet_posted_at, minute-granular for fresh threads
     ('38m'); rolls to hours/days only when minutes would be absurd."""
@@ -546,6 +647,89 @@ def _age_str(iso):
     return f"{hours // 24}d"
 
 
+def _first_run_boost_active():
+    try:
+        from pathlib import Path
+
+        import s4l_state
+
+        return (Path(s4l_state.state_dir()) / "first-run-boost.json").exists()
+    except Exception:
+        return False
+
+
+def _expiry_secs_left(iso, platform):
+    """Seconds remaining until the Phase 0 hard-expire cutoff, shared by the
+    header's minute-granular label and the hover popover's second-granular
+    live countdown. None when there's nothing to count down: no timestamp,
+    or a platform this doesn't apply to."""
+    if not iso or (platform or "twitter").lower() != "twitter":
+        return None
+    try:
+        t = datetime.datetime.fromisoformat(str(iso).replace("Z", "+00:00"))
+        if t.tzinfo is None:
+            t = t.replace(tzinfo=datetime.timezone.utc)
+        hours = (
+            _TWITTER_EXPIRE_HOURS_BOOST
+            if _first_run_boost_active()
+            else _TWITTER_EXPIRE_HOURS
+        )
+        deadline = t + datetime.timedelta(hours=hours)
+        return int(
+            (deadline - datetime.datetime.now(datetime.timezone.utc)).total_seconds()
+        )
+    except Exception:
+        return None
+
+
+def _expiry_seconds_str(iso, platform):
+    """Second-granular countdown ('1h22m03s left', '4m09s left', '38s
+    left'), or 'expired'. The header label re-renders this every second
+    (2026-07-15 per user: it should visibly count down in the inline card
+    itself, not just on hover) via tickAgeExpiryLabel_."""
+    secs_left = _expiry_secs_left(iso, platform)
+    if secs_left is None:
+        return None
+    if secs_left <= 0:
+        return "expired"
+    h, rem = divmod(secs_left, 3600)
+    m, s = divmod(rem, 60)
+    if h:
+        return f"{h}h{m:02d}m{s:02d}s left"
+    if m:
+        return f"{m}m{s:02d}s left"
+    return f"{s}s left"
+
+
+def _age_expiry_display(iso, platform):
+    """(text, urgent) for the header's age/expiry label: 'Ns ago (Xh Ym Zs
+    left)', bold+full-strength once <=15min remain or it's already expired
+    (weight, not a new color, per this repo's severity convention -- see
+    CLAUDE.md "Dashboard colors"). Shared by _render (initial paint) and
+    tickAgeExpiryLabel_ (the per-second update) so the two never drift.
+    (None, False) when there's nothing to show (no timestamp, or a platform
+    _expiry_secs_left doesn't apply to)."""
+    age = _age_str(iso)
+    secs_left = _expiry_secs_left(iso, platform)
+    expiry_seconds = _expiry_seconds_str(iso, platform)
+    if not expiry_seconds:
+        return None, False
+    text = f"{age} ago ({expiry_seconds})" if age else expiry_seconds
+    urgent = secs_left is not None and secs_left <= 900
+    return text, urgent
+
+
+# Hover popover on the header's age/expiry label (2026-07-15 per user): the
+# reviewer sees the countdown but not necessarily WHY it exists, so the
+# popover pairs the live seconds-granular clock with the reasoning behind the
+# freshness gate itself.
+_EXPIRY_EDUCATION_TEXT = (
+    "What we care about is not a post that has a lot of engagement, but the "
+    "fresh ones: ideally we're the first to comment and like a post, to have "
+    "the highest share of voice and be the first-ranking comment on a thread."
+)
+
+
 # ---- contemporary styling helpers --------------------------------------------
 # Style-only layer (2026-07-07): frames, sizes, and control positions are
 # untouched; these helpers change nothing but the skin. The card reads as a
@@ -728,6 +912,8 @@ class _ReviewController(NSObject):
         self._eye_btn = None
         self._details_btn = None
         self._stats_popover = None
+        self._age_expiry_label = None
+        self._age_expiry_timer = None
         # Per-card telemetry, reset when a NEW card renders (not on the
         # card <-> reason-picker swap, which is the same card).
         self._rendered_idx = -1
@@ -1155,8 +1341,10 @@ class _ReviewController(NSObject):
         )
         right_x = W - M
         self._close_stats_popover()
+        self._stop_age_expiry_timer()
         self._eye_btn = None
         self._details_btn = None
+        self._age_expiry_label = None
         if _engagement_line(stats):
             # y is nudged 2px above the label row: the label's 12pt text draws
             # top-aligned in its 18px frame while the button centers its image,
@@ -1167,19 +1355,50 @@ class _ReviewController(NSObject):
             content.addSubview_(eye)
             self._eye_btn = eye
             right_x -= 24
-        age = _age_str(stats.get("tweet_posted_at"))
-        if age:
+        # Age + a live, second-granular countdown to the Phase 0 hard-expire
+        # cutoff, combined in one header label ("10m ago (1h49m20s left)")
+        # that ticks every second via tickAgeExpiryLabel_ (2026-07-15 per
+        # user) -- no need to hover to see it counting down. Hovering still
+        # shows the fixed "why freshness matters" explanation.
+        age_expiry, urgent = _age_expiry_display(
+            stats.get("tweet_posted_at"), d.get("platform")
+        )
+        if age_expiry:
+            # Urgent state (<=15min left, or already past the cutoff) drops
+            # the muted gray and goes bold+full-strength instead of adding a
+            # color: this repo's severity convention is weight, never a new
+            # chromatic accent (see CLAUDE.md "Dashboard colors").
             age_w = int(
                 NSAttributedString.alloc().initWithString_attributes_(
-                    age, {NSFontAttributeName: NSFont.systemFontOfSize_(11)}
+                    age_expiry, {NSFontAttributeName: _font(11, urgent)}
                 ).size().width
-            ) + 8
+            ) + 12  # +12 not +8: a little slack so a minute/hour rollover
+            # mid-tick (e.g. "59s left" -> "1m00s left") doesn't clip before
+            # the next full _render recomputes the exact width.
             age_label = _label(
-                NSMakeRect(right_x - age_w, H - 70, age_w, 18), age, size=11, muted=True
+                NSMakeRect(right_x - age_w, H - 70, age_w, 18),
+                age_expiry,
+                size=11,
+                bold=urgent,
+                muted=not urgent,
             )
             age_label.setAlignment_(NSTextAlignmentRight)
             content.addSubview_(age_label)
             right_x -= age_w + 4
+            age_label.addTrackingArea_(
+                NSTrackingArea.alloc().initWithRect_options_owner_userInfo_(
+                    age_label.bounds(),
+                    NSTrackingMouseEnteredAndExited | NSTrackingActiveAlways,
+                    self,
+                    {"kind": "expiry"},
+                )
+            )
+            self._age_expiry_label = age_label
+            self._age_expiry_timer = (
+                NSTimer.scheduledTimerWithTimeInterval_target_selector_userInfo_repeats_(
+                    1.0, self, "tickAgeExpiryLabel:", None, True
+                )
+            )
         # Platform mark (brand identification, inline with the author row):
         # Reddit's orange "r/" vs X's glyph, so a mixed-platform review queue
         # reads at a glance which network each card posts to.
@@ -1269,32 +1488,13 @@ class _ReviewController(NSObject):
             thread_tv.setDrawsBackground_(False)
         # An NSTextView grows vertically by default; long threads inflated the
         # frame over the author row above (non-flipped superview: growth goes
-        # UP) and pushed the trailing ↗ out of the box. Pin the frame and
-        # truncate to what 4 lines actually fit so the arrow stays visible.
+        # UP). Pin the frame, then _fit_thread_body shrinks the text (never
+        # the trailing ↗ link) until the arrow actually lands inside it.
         thread_tv.setVerticallyResizable_(False)
         thread_tv.setHorizontallyResizable_(False)
-        body = NSMutableAttributedString.alloc().initWithString_attributes_(
-            _truncate(thread_en or d.get("thread_text"), 200),
-            {
-                NSFontAttributeName: NSFont.systemFontOfSize_(12),
-                NSForegroundColorAttributeName: NSColor.labelColor(),
-            },
-        )
         if thread_url:
-            body.appendAttributedString_(
-                NSAttributedString.alloc().initWithString_attributes_(
-                    " ↗",
-                    {
-                        NSFontAttributeName: NSFont.systemFontOfSize_(12),
-                        # Delegate (textView:clickedOnLink:atIndex:) tracks the
-                        # click as a thread_click interaction, then opens the
-                        # URL itself via NSWorkspace.
-                        NSLinkAttributeName: NSURL.URLWithString_(thread_url),
-                    },
-                )
-            )
             thread_tv.setDelegate_(self)
-        thread_tv.textStorage().setAttributedString_(body)
+        _fit_thread_body(thread_tv, thread_en or d.get("thread_text"), thread_url)
         content.addSubview_(thread_tv)
         # Reply heading — bold. A concise "project/lane · viral N" tag rides
         # right after it in a SEPARATE, regular-weight label (2026-07-08:
@@ -1516,6 +1716,19 @@ class _ReviewController(NSObject):
             self._panel.makeFirstResponder_(tv)
             self.performSelector_withObject_afterDelay_("focusReply:", None, 0.05)
 
+    @objc.python_method
+    def _stop_age_expiry_timer(self):
+        """Stop the header label's per-second tick (tickAgeExpiryLabel_).
+        Called at the top of every _render (the label it targets is about to
+        be replaced) and from _finish (the whole panel is going away), so a
+        repeating NSTimer can never outlive the label it updates."""
+        if self._age_expiry_timer is not None:
+            try:
+                self._age_expiry_timer.invalidate()
+            except Exception:
+                pass
+            self._age_expiry_timer = None
+
     @objc.python_method
     def _close_stats_popover(self):
         try:
@@ -1600,6 +1813,38 @@ class _ReviewController(NSObject):
         lines = _details_lines(self._drafts[self._idx])
         self._show_popover(lines, self._details_btn, "details")
 
+    @objc.python_method
+    def _show_expiry_popover(self):
+        """Hover popover for the header's age/expiry label: just the fixed
+        explanation of why freshness matters (2026-07-15 per user). The
+        countdown itself doesn't need a popover-only live view anymore -- the
+        header label ticks in place every second (see tickAgeExpiryLabel_),
+        visible whether or not the pointer is over it."""
+        self._show_popover(_EXPIRY_EDUCATION_TEXT, self._age_expiry_label, "expiry")
+
+    def tickAgeExpiryLabel_(self, timer):
+        """NSTimer target (2026-07-15): re-renders the header's age/expiry
+        label every second so its countdown visibly counts down without
+        needing hover. Not a python_method -- NSTimer invokes this through
+        the ObjC runtime."""
+        if self._age_expiry_label is None:
+            return
+        try:
+            d = self._drafts[self._idx]
+            stats = d.get("stats") or {}
+            text, urgent = _age_expiry_display(
+                stats.get("tweet_posted_at"), d.get("platform")
+            )
+            if not text:
+                return
+            self._age_expiry_label.setStringValue_(text)
+            self._age_expiry_label.setFont_(_font(11, urgent))
+            self._age_expiry_label.setTextColor_(
+                NSColor.labelColor() if urgent else NSColor.secondaryLabelColor()
+            )
+        except Exception:
+            pass
+
     # Click on an eye SHOWS its popover, never toggles it closed: a click is
     # physically preceded by hover (mouseEntered already opened it), so a
     # toggle would close what the hover just opened and the user sees nothing.
@@ -1618,8 +1863,9 @@ class _ReviewController(NSObject):
     def _hover_info(self, event):
         """(kind, slot) a tracking-area event belongs to, from the userInfo
         stamped at creation: ('stats'|'details', None) for the eye icons,
-        ('draft', 0|1) for the two draft boxes. Defaults to ('stats', None),
-        the original single-eye behavior, if the area carries no info."""
+        ('expiry', None) for the age/expiry label, ('draft', 0|1) for the two
+        draft boxes. Defaults to ('stats', None), the original single-eye
+        behavior, if the area carries no info."""
         try:
             info = event.trackingArea().userInfo()
             if info:
@@ -1628,22 +1874,26 @@ class _ReviewController(NSObject):
                     return "draft", int(info.get("slot"))
                 if kind == "details":
                     return "details", None
+                if kind == "expiry":
+                    return "expiry", None
         except Exception:
             pass
         return "stats", None
 
-    # NSTrackingArea owner callbacks (hover over either eye icon or, on
-    # two-draft cards, either draft box). Draft hovers only bank dwell time
-    # (no popover, no logging: the boxes are big and enter/exit fires on
-    # every pass of the pointer).
+    # NSTrackingArea owner callbacks (hover over either eye icon, the
+    # age/expiry label, or, on two-draft cards, either draft box). Draft
+    # hovers only bank dwell time (no popover, no logging: the boxes are big
+    # and enter/exit fires on every pass of the pointer).
     def mouseEntered_(self, event):
         kind, slot = self._hover_info(event)
         if kind == "draft":
             self._draft_hover_open[slot] = time.time()
             return
-        _log(f"{kind} eye hover enter")
+        _log(f"{kind} eye hover enter" if kind != "expiry" else "expiry label hover enter")
         if kind == "details":
             self._show_details_popover()
+        elif kind == "expiry":
+            self._show_expiry_popover()
         else:
             self._show_stats_popover()
 
@@ -1994,6 +2244,20 @@ class _ReviewController(NSObject):
         # level. Commits and advances immediately; level 2+ is the loved
         # signal, with the exact strength riding along as an approve_level_N
         # interaction.
+        d = self._drafts[self._idx]
+        if (d.get("experiments") or {}).get("sandbox"):
+            # Sandbox replay of a historical thread (run-twitter-cycle.sh's
+            # S4L_SANDBOX_CANDIDATES_FILE short-circuit): approving this would
+            # feed a real reply to twitter_post_plan.py against a months-old
+            # thread. Block it here, the single choke point _record(True, ...)
+            # always routes through, rather than downstream — Reject is still
+            # the only way to clear a sandbox card.
+            _log("blocked approve on sandbox draft (not postable)")
+            try:
+                self._panel.setTitle_("s4l · SANDBOX draft — not postable, use Reject")
+            except Exception:
+                pass
+            return
         try:
             level = int(sender.tag())
         except Exception:
@@ -2147,6 +2411,7 @@ class _ReviewController(NSObject):
     def _finish(self):
         global _active
         self._close_stats_popover()
+        self._stop_age_expiry_timer()
         try:
             if self._panel is not None:
                 self._panel.setDelegate_(None)

package/mcp/menubar/s4l_menubar.py

@@ -1087,6 +1087,7 @@ class S4LMenuBar(rumps.App):
         (1800, "Every 30 minutes"),
         (3600, "Every hour"),
         (14400, "Every 4 hours"),
+        (-1, "Never (menu bar count only)"),
     )
 
     # Posting volume (2026-07-13): server-side per-install throttle for the
@@ -1116,10 +1117,14 @@ class S4LMenuBar(rumps.App):
     def _on_cadence_preset(self, secs, _sender=None):
         """Menu callback shim: rumps passes the clicked MenuItem last."""
         written = st.write_reveal_cadence(secs)
-        self._notify(
-            "S4L draft cards",
-            f"New draft cards will show: {self._cadence_label(written).lower()}",
-        )
+        if written < 0:
+            msg = (
+                "Cards won’t pop up anymore — check the pending count in "
+                "the menu bar, or click “Review N pending drafts” to see them."
+            )
+        else:
+            msg = f"New draft cards will show: {self._cadence_label(written).lower()}"
+        self._notify("S4L draft cards", msg)
         self._sig = None
         try:
             self._tick(None)
@@ -2479,9 +2484,17 @@ class S4LMenuBar(rumps.App):
         # Drop the stale "drafting" spinner while we need attention so the ⚠ shows.
         self._stalled = attention
 
+        # Pending draft-card count, for the bulk-discard menu item (visibility +
+        # label) AND the concise inline count on the menu bar title itself
+        # (2026-07-15, so a glance at the bar shows the backlog without opening
+        # the dropdown — most useful with the reveal cadence set to "Never").
+        # Cheap local JSON reads, same source _maybe_start_review uses.
+        _, pending_drafts = self._pending_review()
+        pending_count = len(pending_drafts)
+
         # Spinner owns the title while busy; _spin already keeps the ⬆ visible there.
         if not busy:
-            self._render_title(setup_complete, ob, blocker, attention)
+            self._render_title(setup_complete, ob, blocker, attention, pending_count)
 
         # Blocker notification only on transition into a new blocker.
         if blocker and blocker_code != self._last_blocker_code:
@@ -2595,10 +2608,7 @@ class S4LMenuBar(rumps.App):
             if ob
             else 0
         )
-        # Pending draft-card count, for the bulk-discard menu item (visibility +
-        # label). Cheap local JSON reads, same source _maybe_start_review uses.
-        _, pending_drafts = self._pending_review()
-        pending_count = len(pending_drafts)
+        # pending_count was already computed above (before _render_title).
 
         # _update_available / _latest_version are in the signature so a freshly
         # detected update rebuilds the menu (adding "Update now & restart Claude Desktop") even mid-run.
@@ -2756,15 +2766,18 @@ class S4LMenuBar(rumps.App):
 
     def _reveal_hold_until(self, pending_count):
         """Epoch until which the reveal cadence is actually holding fresh cards
-        back (0.0 = no hold). A hold only exists while there is something to
-        hold: pending drafts, no review in flight, and not snoozed (the snooze
-        label and gate take precedence)."""
+        back (0.0 = no hold, -1.0 = held indefinitely — the "Never" preset, cards
+        only reveal via an explicit "Review N pending drafts" click). A hold only
+        exists while there is something to hold: pending drafts, no review in
+        flight, and not snoozed (the snooze label and gate take precedence)."""
         if pending_count <= 0 or self._review_active:
             return 0.0
         now = time.time()
         if now < self._review_snooze_until:
             return 0.0
         cadence = st.read_reveal_cadence()
+        if cadence < 0:
+            return -1.0
         until = self._last_presented_at + cadence
         return until if (cadence > 0 and now < until) else 0.0
 
@@ -2858,6 +2871,10 @@ class S4LMenuBar(rumps.App):
         # stamped on a hold, so the same set still presents fresh when due.
         if not focus:
             cadence = st.read_reveal_cadence()
+            if cadence < 0:
+                # "Never" preset: cards never auto-pop, only an explicit
+                # "Review N pending drafts" click (focus=True) reveals them.
+                return
             if cadence > 0 and time.time() - self._last_presented_at < cadence:
                 return
         with self._review_lock:
@@ -3312,16 +3329,21 @@ class S4LMenuBar(rumps.App):
                         self._reset_posting_progress_locked()
                 self._post_q.task_done()
 
-    def _render_title(self, setup_complete, ob, blocker, attention=False):
+    def _render_title(self, setup_complete, ob, blocker, attention=False, pending_count=0):
         if blocker or attention:
-            self.title = "S4L ⚠"  # warning (setup blocked OR autopilot needs attention)
+            base = "S4L ⚠"  # warning (setup blocked OR autopilot needs attention)
         elif not setup_complete and ob and not ob.get("complete"):
             done = sum(1 for m in ob["milestones"] if m.get("status") == "complete")
-            self.title = f"S4L {done}/{len(ob['milestones'])}"
+            base = f"S4L {done}/{len(ob['milestones'])}"
         elif self._update_available:
-            self.title = "S4L ⬆"  # update available — open the menu to update
+            base = "S4L ⬆"  # update available — open the menu to update
         else:
-            self.title = "S4L"
+            base = "S4L"
+        # Concise inline backlog count, right on the bar (not just the dropdown's
+        # "Review N pending drafts") — per user request 2026-07-15, most useful
+        # when the reveal cadence is "Never" and this count is the only signal
+        # that drafts are waiting.
+        self.title = f"{base} · {pending_count}" if pending_count > 0 else base
 
     # ---- menu construction ------------------------------------------------
     def _build_menu(self, runtime_ready, setup_complete, ob, blocker, snap, attention=False, schedule_state="ok", pending_count=0):
@@ -3658,10 +3680,13 @@ class S4LMenuBar(rumps.App):
             )
         else:
             # Reveal-cadence hold: the backlog exists but the pop-up is being
-            # paced. Same courtesy line as the snooze; "Review N pending
-            # drafts" above shows them right now regardless.
+            # paced, or suppressed entirely ("Never"). Same courtesy line as
+            # the snooze; "Review N pending drafts" above shows them right
+            # now regardless.
             hold_until = self._reveal_hold_until(pending_count)
-            if hold_until:
+            if hold_until < 0:
+                items.append(self._label("Cards hidden — see count in the menu bar"))
+            elif hold_until:
                 items.append(
                     self._label(
                         "Next cards around "

package/mcp/menubar/s4l_state.py

@@ -1229,22 +1229,25 @@ REVEAL_CADENCE_DEFAULT = 3600.0
 
 
 def read_reveal_cadence():
-    """Seconds between draft-card reveals (0 = immediately, default 1 hour)."""
+    """Seconds between draft-card reveals (0 = immediately, default 1 hour,
+    -1 = "Never" — manual-only reveal via the menu's "Review N pending
+    drafts", the pending count shows in the menu bar title instead)."""
     d = read_json(MODE_FILE)
     try:
         secs = float(d.get("reveal_cadence_secs"))
     except (TypeError, ValueError, AttributeError):
         return REVEAL_CADENCE_DEFAULT
-    return max(0.0, secs)
+    return secs if secs < 0 else max(0.0, secs)
 
 
 def write_reveal_cadence(secs):
     """Persist the reveal cadence, preserving every other mode.json key.
     Returns the written value. Never raises (a menu click must not crash)."""
     try:
-        secs = max(0.0, float(secs))
+        secs = float(secs)
     except (TypeError, ValueError):
         return read_reveal_cadence()
+    secs = -1.0 if secs < 0 else max(0.0, secs)
     try:
         payload = read_json(MODE_FILE)
         if not isinstance(payload, dict):