M6: Global hotkey ⌃⌥⌘J

- Add `tauri-plugin-global-shortcut` 2.3.1 (Cargo only — FE registers via the backend) with the matching `global-shortcut:default` capability on the main window.
- New `downloads::global_shortcut`: typed `RegistrationError` (`Conflict`/`InvalidBinding`/`PluginError`) + `RegistrationStatus` state machine on top of a `Registrar` trait so the unit tests use an in-memory fake. The plugin's English error strings get mapped to typed errors at one chokepoint inside the production registrar.
- `set_global_reveal_shortcut(enabled, binding)` IPC so the Settings UI can flip the live registration; backend startup + main-window focus events re-evaluate the FDA gate via `refresh_global_reveal_shortcut`.
- Backend `binding_to_accelerator` adapter mirrors the FE one (`'⌃⌥⌘J'` → `'Control+Alt+Meta+J'`).
- FE bridge in `lib/downloads/global-shortcut-bridge.svelte.ts`: one `global-shortcut-fired` listener, calls `revealLatestDownload`, and on the first un-acknowledged trigger flips `acknowledged = true` BEFORE opening the persistent warn toast (so back-to-back presses don't queue duplicates).
- `GlobalShortcutWarnToastContent.svelte`: "Keep it on" / "Turn it off"; the latter flips `enabled = false` AND calls `setGlobalRevealShortcut(false, binding)` so the OS combo releases immediately.
- Settings registry gains the three `behavior.fileSystemWatching.globalRevealShortcut.{enabled,binding,acknowledged}` entries; `setGlobalRevealBinding` resets `acknowledged` to `false` so each fresh combo gets its own first-trigger warning.
- Stub row in `DriveIndexingSection.svelte` exposing the on/off toggle, the binding text input, and the inline status string (Registered / Couldn't register: in use by another app / Cmdr needs Full Disk Access). M7 will polish + rename the section.
- Both `CLAUDE.md` files (FE + BE) gain a "Global reveal hotkey" subsection.

Author: vdavid

Cargo.lock

@@ -39,6 +39,11 @@ tauri-plugin-mcp-bridge = "0.11"
 tauri-plugin-store = "2"
 tauri-plugin-dialog = "2.6"
 tauri-plugin-notification = "2.3.3"
+# Global system-wide keyboard shortcut (default ⌃⌥⌘J for "reveal latest download"). On
+# macOS, the plugin uses Carbon's `RegisterEventHotKey` so it needs no extra TCC grant
+# (Accessibility/Input Monitoring not required). Pinned at 2.3.1 (published 2025-10-27,
+# ~7 months old; the 2.3.2 release from 2026-05-28 is still within the 14-day age policy).
+tauri-plugin-global-shortcut = "=2.3.1"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 notify = "8"

apps/desktop/src-tauri/Cargo.toml

@@ -36,6 +36,7 @@
         "updater:default",
         "process:allow-restart",
         "dialog:allow-ask",
-        "notification:default"
+        "notification:default",
+        "global-shortcut:default"
     ]
 }

apps/desktop/src-tauri/capabilities/default.json

@@ -19,7 +19,11 @@ a partial-suffix file to a final-name file). FDA-gated.
 - `runtime.rs` — `Mutex<Option<DownloadsWatcher>>`. `refresh_runtime(&app)` aligns the handle
   with `desired_running(fda_pending)`. Idempotent.
 - `commands.rs` — IPC surface: `reveal_latest_download`, `downloads_watcher_status`,
-  `recheck_downloads_watcher_gate`.
+  `recheck_downloads_watcher_gate`, `set_global_reveal_shortcut`.
+- `global_shortcut.rs` — Wrapper around `tauri-plugin-global-shortcut`. Typed `RegistrationError`
+  (`Conflict | InvalidBinding | PluginError`) + `RegistrationStatus` (`Registered | NotRegistered |
+  Conflict`). The state machine sits in `GlobalShortcutManager<R: Registrar>`; production uses
+  `TauriRegistrar` (owned `AppHandle`), tests use an in-memory `FakeRegistrar`.
 
 ## FDA gating contract
 
@@ -57,6 +61,29 @@ the ignore set. Cmdr never writes `.crdownload` files; always register the final
 The bulk variant `note_pending_writes(paths, ttl)` exists for transfer-driver paths that know
 their destination set up front.
 
+## Global reveal hotkey (M6)
+
+The default global combo is `⌃⌥⌘J`. `apps/desktop/src-tauri/src/lib.rs` calls
+`downloads::refresh_global_reveal_shortcut(app)` at:
+
+1. **Startup**, after `set_fda_pending(...)`, alongside the watcher refresh.
+2. **Every main-window `Focused(true)` event** — covers the FDA flip path.
+3. **Settings UI flip** via the `set_global_reveal_shortcut(enabled, binding)` IPC command,
+   which the FE calls from the Settings row's change handlers.
+
+The trigger handler (`global_shortcut::plugin_builder`) emits a `global-shortcut-fired` Tauri
+event on every key-down. The FE bridge in `lib/downloads/global-shortcut-bridge.svelte.ts`
+subscribes and routes through `revealLatestDownload`. The first-trigger warn toast logic
+lives FE-side, keyed on the `acknowledged` settings flag.
+
+The plugin uses Carbon's `RegisterEventHotKey` on macOS, so no Accessibility / Input
+Monitoring TCC grant is needed; the user sees no extra prompt for the hotkey.
+
+The `register/unregister` state machine in `GlobalShortcutManager` is idempotent: re-registering
+the same binding is a no-op, swapping to a new binding unregisters the previous one first, and
+a `Conflict` error stays remembered until the next successful register so the Settings row can
+surface "Couldn't register: in use by another app." without re-attempting.
+
 ## Browser-style rename target
 
 v1 scopes to browser-style downloads: a direct create of a final-name file, or a rename from a

apps/desktop/src-tauri/src/downloads/CLAUDE.md

@@ -131,6 +131,34 @@ pub async fn recheck_downloads_watcher_gate(app: AppHandle) -> Result<(), String
     super::runtime::refresh_runtime(&app).map_err(|e| e.to_string())
 }
 
+/// Result of [`set_global_reveal_shortcut`]: the new status the Settings row
+/// should display. The FE caches this until the next register/unregister, so
+/// the row's "Registered" / "Couldn't register" indicator stays in sync
+/// without an extra round trip.
+#[derive(Debug, Clone, Serialize, Deserialize, specta::Type)]
+#[serde(rename_all = "camelCase")]
+pub struct GlobalRevealShortcutState {
+    pub status: super::global_shortcut::RegistrationStatus,
+    pub binding: String,
+    pub enabled: bool,
+}
+
+/// Apply a Settings change (toggle + binding) to the live global-shortcut
+/// registration. Idempotent; safe to call repeatedly with the same args.
+///
+/// Returns the resulting status so the FE row can render the indicator
+/// without another round trip. Errors are wrapped in the typed
+/// [`super::global_shortcut::RegistrationError`] enum.
+#[tauri::command]
+#[specta::specta]
+pub async fn set_global_reveal_shortcut(
+    app: AppHandle,
+    enabled: bool,
+    binding: String,
+) -> Result<GlobalRevealShortcutState, super::global_shortcut::RegistrationError> {
+    super::runtime::apply_global_reveal_shortcut(&app, enabled, &binding)
+}
+
 #[cfg(test)]
 mod tests {
     //! Tests for the `reveal_latest_download` branches. The process-global