feature: user-selectable capture hotkey with recorder in Settings

Ben-reported: picker opened on every activation. AppModel.init set region = nil and never
read UserDefaults back; saving worked, every launch forgot it. init now loads via
loadPersistedRegion() (decode + isStillValid). Selftest phase 2 writes a known region,
reloads through the same path, asserts the rect, restores the user's stored value.
Coordinator ran it: PICKER-SELFTEST PASS + REGION-PERSIST PASS, 90/90 tests green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Info.plist

@@ -2,10 +2,14 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
+	<!-- Identity invariants: CFBundleIdentifier stays ai.flowmaster.shotdeck and
+	     CFBundleExecutable stays Shotdeck. Changing either one invalidates the
+	     user's existing Screen Recording grant. CFBundleName is the user-facing
+	     product name only. -->
 	<key>CFBundleIdentifier</key>
 	<string>ai.flowmaster.shotdeck</string>
 	<key>CFBundleName</key>
-	<string>Shotdeck</string>
+	<string>Redline</string>
 	<key>CFBundleExecutable</key>
 	<string>Shotdeck</string>
 	<key>CFBundlePackageType</key>

README.md

@@ -1,4 +1,4 @@
-# Shotdeck
+# Redline
 
 A macOS menu-bar app that captures a remembered screen region, builds a one-screenshot-per-page PDF, AirDrops it to an iPad for markup, then watches for the annotated file to come back.
 
@@ -18,5 +18,5 @@ The grant is bound to the bundle identifier `ai.flowmaster.shotdeck` plus the co
 ```bash
 swift build && swift test
 ./scripts/build-app.sh          # signed .app for daily use
-open .build/Shotdeck.app
+open .build/Redline.app
 ```

Sources/Shotdeck/AppModel.swift

@@ -1,5 +1,4 @@
 import AppKit
-import Carbon.HIToolbox
 import Foundation
 import Observation
 import SwiftUI
@@ -37,6 +36,9 @@ public final class AppModel {
     public private(set) var outboxURL: URL
     /// Live watch folder; WP-4c updates this alongside `ReturnWatcher.updateWatchFolder`.
     public private(set) var watchFolderURL: URL
+    /// Currently bound capture combo (the last one Carbon accepted, or the preferred load).
+    private(set) var captureHotkey: HotkeyPreference
+    var hotkeyDisplayString: String { captureHotkey.displayString }
 
     let paths: AppSupportPaths
     let spool: SpoolStore
@@ -72,7 +74,7 @@ public final class AppModel {
             captures: [],
             pdfFileName: nil
         )
-        self.region = nil
+        self.region = Self.loadPersistedRegion()
         self.screenRecordingGranted = ScreenCapturer.isScreenRecordingGranted
         // Seeded from FolderSettings.resolve() via resolvedAppSupportPaths — never .standard().
         let folders = FolderSettings.resolve()
@@ -80,6 +82,7 @@ public final class AppModel {
         self.watchFolderURL = folders.watch
         self.outboxDisplayName = folders.outbox.lastPathComponent
         self.watchFolderDisplayName = folders.watch.lastPathComponent
+        self.captureHotkey = HotkeyPreference.load()
     }
 
     // MARK: Seam mutators — the only way a WP-4b/4c extension changes state.
@@ -146,16 +149,39 @@ public final class AppModel {
             setStatus((error as? ShotdeckError)?.errorDescription ?? "Could not watch the return folder.")
         }
 
-        let registered = hotkeys.register(
+        let pref = HotkeyPreference.load()
+        captureHotkey = pref
+        if !bindCaptureHotkey(pref) {
+            setStatus("\(pref.displayString) is already used by another app — capture only works from the menu.")
+        }
+    }
+
+    /// Unregisters `capture` and binds `HotkeyPreference.load()`. If Carbon rejects the new
+    /// combo, restores the previous preference (UserDefaults + Carbon) so the old one keeps working.
+    func reRegisterHotkey() {
+        let previous = captureHotkey
+        let next = HotkeyPreference.load()
+        hotkeys.unregister(id: "capture")
+        if bindCaptureHotkey(next) {
+            captureHotkey = next
+            return
+        }
+        setStatus("That combination is taken — pick another.")
+        previous.save()
+        if bindCaptureHotkey(previous) {
+            captureHotkey = previous
+        }
+    }
+
+    @discardableResult
+    private func bindCaptureHotkey(_ pref: HotkeyPreference) -> Bool {
+        hotkeys.register(
             id: "capture",
-            keyCode: UInt32(kVK_ANSI_2),
-            modifiers: UInt32(optionKey | shiftKey)
+            keyCode: pref.keyCode,
+            modifiers: pref.modifiers
         ) { [weak self] in
             Task { await self?.captureNow() }
         }
-        if !registered {
-            setStatus("⌥⇧2 is already used by another app — capture only works from the menu.")
-        }
     }
 
     public func captureNow() async {
@@ -237,6 +263,14 @@ public final class AppModel {
         NSWorkspace.shared.open(url)
     }
 
+    static func loadPersistedRegion() -> CaptureRegion? {
+        guard let data = UserDefaults.standard.data(forKey: CaptureRegion.defaultsKey),
+              let decoded = try? JSONDecoder().decode(CaptureRegion.self, from: data),
+              decoded.isStillValid
+        else { return nil }
+        return decoded
+    }
+
     private func persistRegion(_ picked: CaptureRegion) {
         replaceRegion(picked)
         if let encoded = try? JSONEncoder().encode(picked) {

Sources/Shotdeck/HotkeyPreference.swift

@@ -0,0 +1,151 @@
+import AppKit
+import Carbon.HIToolbox
+import Foundation
+
+/// User-chosen capture hotkey. `modifiers` are Carbon bits (`cmdKey`, `optionKey`,
+/// `shiftKey`, `controlKey`), matching `HotkeyCenter.register`.
+struct HotkeyPreference: Codable, Equatable, Sendable {
+    var keyCode: UInt32
+    var modifiers: UInt32
+
+    static let defaultsKey = "ai.flowmaster.shotdeck.hotkey"
+
+    /// ⌥⇧2 — kVK_ANSI_2 (19) with optionKey|shiftKey.
+    static let `default` = HotkeyPreference(
+        keyCode: 19,
+        modifiers: UInt32(optionKey) | UInt32(shiftKey)
+    )
+
+    static func load(defaults: UserDefaults = .standard) -> HotkeyPreference {
+        guard let data = defaults.data(forKey: defaultsKey),
+              let decoded = try? JSONDecoder().decode(HotkeyPreference.self, from: data),
+              decoded.modifiers != 0
+        else { return .default }
+        return decoded
+    }
+
+    func save(defaults: UserDefaults = .standard) {
+        guard let data = try? JSONEncoder().encode(self) else { return }
+        defaults.set(data, forKey: Self.defaultsKey)
+    }
+
+    /// ⌘⌥⇧⌃ in that order, then a name for common keycodes.
+    var displayString: String {
+        var s = ""
+        if modifiers & UInt32(cmdKey) != 0 { s += "⌘" }
+        if modifiers & UInt32(optionKey) != 0 { s += "⌥" }
+        if modifiers & UInt32(shiftKey) != 0 { s += "⇧" }
+        if modifiers & UInt32(controlKey) != 0 { s += "⌃" }
+        s += Self.keyName(for: keyCode)
+        return s
+    }
+
+    /// `nil` when the event is modifier-only or has no ⌘⌥⇧⌃ flags.
+    static func fromKeyEvent(keyCode: UInt16, modifierFlags: NSEvent.ModifierFlags) -> HotkeyPreference? {
+        switch Int(keyCode) {
+        case kVK_Shift, kVK_RightShift,
+             kVK_Command, kVK_RightCommand,
+             kVK_Option, kVK_RightOption,
+             kVK_Control, kVK_RightControl,
+             kVK_CapsLock, kVK_Function:
+            return nil
+        default:
+            break
+        }
+        var carbon: UInt32 = 0
+        if modifierFlags.contains(.command) { carbon |= UInt32(cmdKey) }
+        if modifierFlags.contains(.option) { carbon |= UInt32(optionKey) }
+        if modifierFlags.contains(.shift) { carbon |= UInt32(shiftKey) }
+        if modifierFlags.contains(.control) { carbon |= UInt32(controlKey) }
+        guard carbon != 0 else { return nil }
+        return HotkeyPreference(keyCode: UInt32(keyCode), modifiers: carbon)
+    }
+
+    private static func keyName(for keyCode: UInt32) -> String {
+        switch Int(keyCode) {
+        case kVK_ANSI_A: return "A"
+        case kVK_ANSI_B: return "B"
+        case kVK_ANSI_C: return "C"
+        case kVK_ANSI_D: return "D"
+        case kVK_ANSI_E: return "E"
+        case kVK_ANSI_F: return "F"
+        case kVK_ANSI_G: return "G"
+        case kVK_ANSI_H: return "H"
+        case kVK_ANSI_I: return "I"
+        case kVK_ANSI_J: return "J"
+        case kVK_ANSI_K: return "K"
+        case kVK_ANSI_L: return "L"
+        case kVK_ANSI_M: return "M"
+        case kVK_ANSI_N: return "N"
+        case kVK_ANSI_O: return "O"
+        case kVK_ANSI_P: return "P"
+        case kVK_ANSI_Q: return "Q"
+        case kVK_ANSI_R: return "R"
+        case kVK_ANSI_S: return "S"
+        case kVK_ANSI_T: return "T"
+        case kVK_ANSI_U: return "U"
+        case kVK_ANSI_V: return "V"
+        case kVK_ANSI_W: return "W"
+        case kVK_ANSI_X: return "X"
+        case kVK_ANSI_Y: return "Y"
+        case kVK_ANSI_Z: return "Z"
+        case kVK_ANSI_0: return "0"
+        case kVK_ANSI_1: return "1"
+        case kVK_ANSI_2: return "2"
+        case kVK_ANSI_3: return "3"
+        case kVK_ANSI_4: return "4"
+        case kVK_ANSI_5: return "5"
+        case kVK_ANSI_6: return "6"
+        case kVK_ANSI_7: return "7"
+        case kVK_ANSI_8: return "8"
+        case kVK_ANSI_9: return "9"
+        case kVK_ANSI_Equal: return "="
+        case kVK_ANSI_Minus: return "-"
+        case kVK_ANSI_RightBracket: return "]"
+        case kVK_ANSI_LeftBracket: return "["
+        case kVK_ANSI_Quote: return "'"
+        case kVK_ANSI_Semicolon: return ";"
+        case kVK_ANSI_Backslash: return "\\"
+        case kVK_ANSI_Comma: return ","
+        case kVK_ANSI_Slash: return "/"
+        case kVK_ANSI_Period: return "."
+        case kVK_ANSI_Grave: return "`"
+        case kVK_Space: return "Space"
+        case kVK_Return: return "Return"
+        case kVK_Tab: return "Tab"
+        case kVK_Delete: return "Delete"
+        case kVK_ForwardDelete: return "Fwd Delete"
+        case kVK_Escape: return "Esc"
+        case kVK_Home: return "Home"
+        case kVK_End: return "End"
+        case kVK_PageUp: return "Page Up"
+        case kVK_PageDown: return "Page Down"
+        case kVK_Help: return "Help"
+        case kVK_LeftArrow: return "←"
+        case kVK_RightArrow: return "→"
+        case kVK_DownArrow: return "↓"
+        case kVK_UpArrow: return "↑"
+        case kVK_F1: return "F1"
+        case kVK_F2: return "F2"
+        case kVK_F3: return "F3"
+        case kVK_F4: return "F4"
+        case kVK_F5: return "F5"
+        case kVK_F6: return "F6"
+        case kVK_F7: return "F7"
+        case kVK_F8: return "F8"
+        case kVK_F9: return "F9"
+        case kVK_F10: return "F10"
+        case kVK_F11: return "F11"
+        case kVK_F12: return "F12"
+        case kVK_F13: return "F13"
+        case kVK_F14: return "F14"
+        case kVK_F15: return "F15"
+        case kVK_F16: return "F16"
+        case kVK_F17: return "F17"
+        case kVK_F18: return "F18"
+        case kVK_F19: return "F19"
+        case kVK_F20: return "F20"
+        default: return "Key \(keyCode)"
+        }
+    }
+}

Sources/Shotdeck/MenuBarView.swift

@@ -49,7 +49,7 @@ struct MenuBarView: View {
 
     private var defaultStatusText: String {
         guard let region = model.region else {
-            return "No region yet — press ⌥⇧2 to pick one."
+            return "No region yet — press \(model.hotkeyDisplayString) to pick one."
         }
         let w = Int(region.rect.width)
         let h = Int(region.rect.height)
@@ -89,7 +89,7 @@ struct MenuBarView: View {
             Button {
                 Task { await model.captureNow() }
             } label: {
-                actionLabel("Capture now", trailing: "⌥⇧2")
+                actionLabel("Capture now", trailing: model.hotkeyDisplayString)
             }
             .disabled(model.isCapturing)
 
@@ -128,7 +128,7 @@ struct MenuBarView: View {
             Button {
                 NSApp.terminate(nil)
             } label: {
-                actionLabel("Quit Shotdeck")
+                actionLabel("Quit Redline")
             }
         }
         .buttonStyle(.plain)

Sources/Shotdeck/PanelSnapshot.swift

@@ -0,0 +1,295 @@
+import AppKit
+import CoreGraphics
+import Darwin
+import Foundation
+import ImageIO
+import PDFKit
+import SwiftUI
+import ShotdeckCore
+
+/// Headless offscreen renderer for `MenuBarView` / `SettingsView`.
+/// Driven by `SHOTDECK_SNAPSHOT_DIR`; never touches the real Application Support spool.
+enum PanelSnapshot {
+    private static let panelWidth: CGFloat = 340
+
+    /// Called from `main.swift` before `ShotdeckApp.main()`. Returns immediately when the
+    /// env var is unset; otherwise writes the six panel PNGs, prints each path, and `exit`s.
+    @MainActor
+    static func runIfRequested() {
+        guard let raw = ProcessInfo.processInfo.environment["SHOTDECK_SNAPSHOT_DIR"],
+              !raw.isEmpty
+        else { return }
+
+        let app = NSApplication.shared
+        app.setActivationPolicy(.prohibited)
+
+        Task { @MainActor in
+            do {
+                try await captureAll(to: URL(fileURLWithPath: raw, isDirectory: true))
+                exit(0)
+            } catch {
+                fputs("PanelSnapshot failed: \(error)\n", stderr)
+                exit(1)
+            }
+        }
+
+        app.run()
+        exit(0)
+    }
+
+    @MainActor
+    private static func captureAll(to directory: URL) async throws {
+        try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
+
+        let (model, root) = try makeIsolatedModel()
+        defer { try? FileManager.default.removeItem(at: root) }
+
+        let region = sampleRegion()
+
+        // 01 — Screen Recording missing (no public mutator; snapshot-only seam).
+        model.snapshotSetScreenRecordingGranted(false)
+        model.replaceRegion(nil)
+        try renderMenuBar(model: model, to: directory, name: "01-no-permission")
+
+        // 02 — granted, no region picked.
+        model.snapshotSetScreenRecordingGranted(true)
+        model.replaceRegion(nil)
+        try renderMenuBar(model: model, to: directory, name: "02-no-region")
+
+        // 03 — region set, empty session.
+        model.replaceRegion(region)
+        try renderMenuBar(model: model, to: directory, name: "03-empty-session")
+
+        // 04 — three real PNGs in the temp spool so SessionStrip thumbnails decode.
+        let swatches: [(CGFloat, CGFloat, CGFloat)] = [
+            (0.85, 0.22, 0.18),
+            (0.18, 0.62, 0.32),
+            (0.16, 0.38, 0.82),
+        ]
+        for (red, green, blue) in swatches {
+            let png = try makePNGData(width: 192, height: 108, red: red, green: green, blue: blue)
+            _ = try await model.spool.append(
+                pngData: png,
+                pixelWidth: 192,
+                pixelHeight: 108,
+                scale: 2.0,
+                capturedAt: Date()
+            )
+        }
+        model.replaceSession(try await model.spool.currentSession())
+        try renderMenuBar(model: model, to: directory, name: "04-captures-present")
+
+        // 05 — two inspected PDFs in the temp ledger, one marked / one not.
+        try await seedReturns(model: model)
+        try renderMenuBar(model: model, to: directory, name: "05-returns-present")
+
+        // 06 — SettingsView against the same isolated model.
+        try render(
+            SettingsView().environment(model),
+            to: directory.appendingPathComponent("panel-06-settings.png")
+        )
+    }
+
+    @MainActor
+    private static func renderMenuBar(model: AppModel, to directory: URL, name: String) throws {
+        try render(
+            MenuBarView().environment(model),
+            to: directory.appendingPathComponent("panel-\(name).png")
+        )
+    }
+
+    @MainActor
+    private static func render(_ view: some View, to url: URL) throws {
+        let wrapped = view
+            .frame(width: panelWidth, alignment: .topLeading)
+            .fixedSize(horizontal: false, vertical: true)
+            .background(Color(nsColor: .windowBackgroundColor))
+
+        let hosting = NSHostingView(rootView: wrapped)
+        hosting.wantsLayer = true
+        hosting.appearance = NSAppearance(named: .aqua)
+
+        let window = NSWindow(
+            contentRect: NSRect(x: -10_000, y: -10_000, width: panelWidth, height: 64),
+            styleMask: [.borderless],
+            backing: .buffered,
+            defer: false
+        )
+        window.isReleasedWhenClosed = false
+        window.appearance = NSAppearance(named: .aqua)
+        window.backgroundColor = .windowBackgroundColor
+        window.isOpaque = true
+        window.alphaValue = 0
+        window.contentView = hosting
+        window.orderBack(nil)
+
+        hosting.layoutSubtreeIfNeeded()
+        var size = hosting.fittingSize
+        if size.height < 1 {
+            size.height = hosting.intrinsicContentSize.height
+        }
+        if size.height < 1 { size.height = 240 }
+        size.width = panelWidth
+        size.height = ceil(size.height)
+
+        hosting.setFrameSize(size)
+        window.setContentSize(size)
+        hosting.layoutSubtreeIfNeeded()
+        RunLoop.current.run(until: Date(timeIntervalSinceNow: 0.05))
+
+        let bounds = hosting.bounds
+        guard let rep = hosting.bitmapImageRepForCachingDisplay(in: bounds) else {
+            throw SnapshotError.renderFailed(url.lastPathComponent)
+        }
+        hosting.cacheDisplay(in: bounds, to: rep)
+        guard let png = rep.representation(using: .png, properties: [:]) else {
+            throw SnapshotError.encodeFailed(url.lastPathComponent)
+        }
+        try png.write(to: url)
+        print(url.path)
+        fflush(stdout)
+
+        window.contentView = nil
+        window.close()
+    }
+
+    @MainActor
+    private static func makeIsolatedModel() throws -> (model: AppModel, root: URL) {
+        let root = FileManager.default.temporaryDirectory
+            .appendingPathComponent("shotdeck-panel-snapshot-\(UUID().uuidString)", isDirectory: true)
+        let paths = try AppSupportPaths(
+            root: root,
+            outbox: root.appendingPathComponent("outbox", isDirectory: true),
+            watchFolder: root.appendingPathComponent("watch", isDirectory: true)
+        )
+        let ledger = try ReturnLedger(paths: paths)
+        let model = AppModel(
+            paths: paths,
+            spool: try SpoolStore(paths: paths),
+            composer: PDFComposer(),
+            capturer: ScreenCapturer(),
+            hotkeys: HotkeyCenter(),
+            picker: RegionPickerController(),
+            ledger: ledger,
+            watcher: ReturnWatcher(paths: paths, ledger: ledger)
+        )
+        model.setFolderURLs(outbox: paths.outbox, watch: paths.watchFolder)
+        return (model, root)
+    }
+
+    @MainActor
+    private static func seedReturns(model: AppModel) async throws {
+        let watch = model.paths.watchFolder
+        let unmarkedURL = watch.appendingPathComponent("Shotdeck-20260901-120000.pdf")
+        let markedURL = watch.appendingPathComponent("Shotdeck-20260901-120100.pdf")
+        try writeShotdeckPDF(to: unmarkedURL, marked: false)
+        try writeShotdeckPDF(to: markedURL, marked: true)
+
+        let unmarked = try AnnotationInspector.inspect(fileURL: unmarkedURL)
+        let marked = try AnnotationInspector.inspect(fileURL: markedURL)
+        try await model.ledger.record(unmarked)
+        try await model.ledger.record(marked)
+        model.setReturns(
+            all: try await model.ledger.all(),
+            commented: try await model.ledger.commented()
+        )
+    }
+
+    private static func sampleRegion() -> CaptureRegion {
+        CaptureRegion(
+            displayID: CGMainDisplayID(),
+            rect: CGRect(x: 120, y: 80, width: 800, height: 600),
+            capturedScale: 2.0
+        )
+    }
+
+    private static func makePNGData(
+        width: Int,
+        height: Int,
+        red: CGFloat,
+        green: CGFloat,
+        blue: CGFloat
+    ) throws -> Data {
+        let colorSpace = CGColorSpaceCreateDeviceRGB()
+        guard let context = CGContext(
+            data: nil,
+            width: width,
+            height: height,
+            bitsPerComponent: 8,
+            bytesPerRow: width * 4,
+            space: colorSpace,
+            bitmapInfo: CGImageAlphaInfo.premultipliedLast.rawValue
+        ) else {
+            throw SnapshotError.pngGenerationFailed
+        }
+        context.setFillColor(red: red, green: green, blue: blue, alpha: 1)
+        context.fill(CGRect(x: 0, y: 0, width: width, height: height))
+        guard let image = context.makeImage() else {
+            throw SnapshotError.pngGenerationFailed
+        }
+        let buffer = NSMutableData()
+        guard let destination = CGImageDestinationCreateWithData(
+            buffer,
+            "public.png" as CFString,
+            1,
+            nil
+        ) else {
+            throw SnapshotError.pngGenerationFailed
+        }
+        CGImageDestinationAddImage(destination, image, nil)
+        guard CGImageDestinationFinalize(destination) else {
+            throw SnapshotError.pngGenerationFailed
+        }
+        return buffer as Data
+    }
+
+    private static func writeShotdeckPDF(to url: URL, marked: Bool) throws {
+        let document = PDFDocument()
+        let page = PDFPage()
+        page.setBounds(CGRect(x: 0, y: 0, width: 612, height: 792), for: .mediaBox)
+        document.insert(page, at: 0)
+        document.documentAttributes = [
+            PDFDocumentAttribute.creatorAttribute: "Shotdeck",
+            PDFDocumentAttribute.subjectAttribute: UUID().uuidString,
+        ]
+        if marked {
+            let annotation = PDFAnnotation(
+                bounds: CGRect(x: 72, y: 400, width: 220, height: 36),
+                forType: .highlight,
+                withProperties: nil
+            )
+            page.addAnnotation(annotation)
+        }
+        guard document.write(to: url) else {
+            throw SnapshotError.pdfWriteFailed(url.lastPathComponent)
+        }
+    }
+}
+
+extension AppModel {
+    /// `screenRecordingGranted` is `public private(set)` with no seam mutator.
+    /// Snapshot-only: the KeyPath setter exists at runtime; compile-time access is file-private.
+    func snapshotSetScreenRecordingGranted(_ granted: Bool) {
+        // private(set) types this as KeyPath; the setter still exists on the @Observable storage.
+        let writable: ReferenceWritableKeyPath<AppModel, Bool> = unsafeBitCast(
+            \AppModel.screenRecordingGranted, to: ReferenceWritableKeyPath<AppModel, Bool>.self
+        )
+        self[keyPath: writable] = granted
+    }
+}
+
+private enum SnapshotError: Error, CustomStringConvertible {
+    case renderFailed(String)
+    case encodeFailed(String)
+    case pngGenerationFailed
+    case pdfWriteFailed(String)
+
+    var description: String {
+        switch self {
+        case .renderFailed(let name): return "bitmapImageRepForCachingDisplay failed for \(name)"
+        case .encodeFailed(let name): return "PNG encode failed for \(name)"
+        case .pngGenerationFailed: return "CoreGraphics PNG generation failed"
+        case .pdfWriteFailed(let name): return "could not write \(name)"
+        }
+    }
+}

Sources/Shotdeck/PickerSelfTest.swift

@@ -0,0 +1,215 @@
+import AppKit
+import Darwin
+import Foundation
+import ShotdeckCore
+
+/// In-process self-test for the region picker, driven by `SHOTDECK_PICKER_SELFTEST`.
+/// Posts synthetic mouse events through `NSApp.postEvent` only — never CGEventPost/taps.
+@MainActor
+enum PickerSelfTest {
+    private static let pointA = NSPoint(x: 200, y: 300)
+    private static let pointB = NSPoint(x: 600, y: 600)
+    private static let dragSteps = 6
+
+    /// Called from `main.swift` before `ShotdeckApp.main()`. Returns immediately when the
+    /// env var is unset; otherwise waits for launch, drives the production picker, and `exit`s.
+    static func runIfRequested() {
+        guard let raw = ProcessInfo.processInfo.environment["SHOTDECK_PICKER_SELFTEST"],
+              !raw.isEmpty
+        else { return }
+
+        let output = URL(fileURLWithPath: raw, isDirectory: true)
+        // Hop onto a plain main-queue turn after NSApp starts. Nested run loops
+        // from a Swift Task do not drain NSApp's event queue.
+        DispatchQueue.main.async {
+            MainActor.assumeIsolated {
+                execute(outputDirectory: output)
+            }
+        }
+    }
+
+    private static func execute(outputDirectory: URL) {
+        do {
+            try FileManager.default.createDirectory(
+                at: outputDirectory,
+                withIntermediateDirectories: true
+            )
+        } catch {
+            fail(expected: expectedLabel(), got: "could not create output dir: \(error)")
+        }
+
+        guard let screen = NSScreen.screens.first(where: { $0.frame.contains(pointA) })
+            ?? NSScreen.screens.first
+        else {
+            fail(expected: expectedLabel(), got: "no NSScreen")
+        }
+
+        let appKitRect = CGRect(
+            x: min(pointA.x, pointB.x),
+            y: min(pointA.y, pointB.y),
+            width: abs(pointB.x - pointA.x),
+            height: abs(pointB.y - pointA.y)
+        ).intersection(screen.frame)
+        let expected = CaptureRegion.fromAppKit(rect: appKitRect, on: screen)
+
+        let picker = RegionPickerController()
+        var result: CaptureRegion??
+        picker.pick { region in
+            result = .some(region)
+        }
+
+        guard let overlay = overlayWindow(containing: pointA) else {
+            fail(expected: format(expected.rect), got: "no overlay window after pick()")
+        }
+        overlay.makeKey()
+
+        var eventNumber = 1
+        func post(_ type: NSEvent.EventType, at screenPoint: NSPoint, clickCount: Int) {
+            let locationInWindow = overlay.convertPoint(fromScreen: screenPoint)
+            guard let event = NSEvent.mouseEvent(
+                with: type,
+                location: locationInWindow,
+                modifierFlags: [],
+                timestamp: ProcessInfo.processInfo.systemUptime,
+                windowNumber: overlay.windowNumber,
+                context: nil,
+                eventNumber: eventNumber,
+                clickCount: clickCount,
+                pressure: 1
+            ) else {
+                fail(expected: format(expected.rect), got: "NSEvent.mouseEvent(\(type.rawValue)) returned nil")
+            }
+            eventNumber += 1
+            NSApp.postEvent(event, atStart: false)
+            // Local monitors run during NSApp.sendEvent (production dispatch),
+            // not during nextEvent dequeue. Drive that same path here.
+            NSApp.sendEvent(event)
+        }
+
+        post(.leftMouseDown, at: pointA, clickCount: 1)
+        for step in 1...(dragSteps / 2) {
+            post(.leftMouseDragged, at: interpolate(step), clickCount: 0)
+        }
+
+        writeOverlayBitmap(overlay, to: outputDirectory.appendingPathComponent("overlay-middrag.png"))
+
+        for step in ((dragSteps / 2) + 1)...dragSteps {
+            post(.leftMouseDragged, at: interpolate(step), clickCount: 0)
+        }
+        post(.leftMouseUp, at: pointB, clickCount: 1)
+
+        guard let wrapped = result else {
+            fail(expected: format(expected.rect), got: "completion never fired")
+        }
+        guard let got = wrapped else {
+            fail(expected: format(expected.rect), got: "nil")
+        }
+
+        if got.rect != expected.rect {
+            fail(expected: format(expected.rect), got: format(got.rect))
+        }
+
+        print("PICKER-SELFTEST PASS rect=\(format(got.rect))")
+        fflush(stdout)
+
+        runRegionPersistPhase()
+        exit(0)
+    }
+
+    /// Phase 2: writes a known region under `CaptureRegion.defaultsKey`, reloads it through
+    /// `AppModel.loadPersistedRegion()` (the same path init uses), then restores whatever
+    /// value was stored before so a real picked region is untouched.
+    private static func runRegionPersistPhase() {
+        let defaults = UserDefaults.standard
+        let previous = defaults.data(forKey: CaptureRegion.defaultsKey)
+
+        let known = CaptureRegion(
+            displayID: CGMainDisplayID(),
+            rect: CGRect(x: 10, y: 10, width: 100, height: 100),
+            capturedScale: 2.0
+        )
+        var failure: String?
+        if let encoded = try? JSONEncoder().encode(known) {
+            defaults.set(encoded, forKey: CaptureRegion.defaultsKey)
+            if let loaded = AppModel.loadPersistedRegion() {
+                if loaded.rect != known.rect {
+                    failure = "expected=\(format(known.rect)) got=\(format(loaded.rect))"
+                }
+            } else {
+                failure = "loadPersistedRegion returned nil"
+            }
+        } else {
+            failure = "could not encode CaptureRegion"
+        }
+
+        if let previous {
+            defaults.set(previous, forKey: CaptureRegion.defaultsKey)
+        } else {
+            defaults.removeObject(forKey: CaptureRegion.defaultsKey)
+        }
+
+        if let failure {
+            print("REGION-PERSIST FAIL \(failure)")
+            fflush(stdout)
+            exit(1)
+        }
+        print("REGION-PERSIST PASS")
+        fflush(stdout)
+    }
+
+    private static func interpolate(_ step: Int) -> NSPoint {
+        let t = CGFloat(step) / CGFloat(dragSteps)
+        return NSPoint(
+            x: pointA.x + (pointB.x - pointA.x) * t,
+            y: pointA.y + (pointB.y - pointA.y) * t
+        )
+    }
+
+    private static func overlayWindow(containing point: NSPoint) -> RegionPickerWindow? {
+        let overlays = NSApp.windows.compactMap { $0 as? RegionPickerWindow }
+        return overlays.first(where: { $0.coveringScreen.frame.contains(point) }) ?? overlays.first
+    }
+
+    private static func writeOverlayBitmap(_ overlay: RegionPickerWindow, to url: URL) {
+        guard let view = overlay.contentView else {
+            fail(expected: expectedLabel(), got: "overlay has no contentView")
+        }
+        overlay.layoutIfNeeded()
+        view.layoutSubtreeIfNeeded()
+        view.display()
+        let bounds = view.bounds
+        guard let rep = view.bitmapImageRepForCachingDisplay(in: bounds) else {
+            fail(expected: expectedLabel(), got: "bitmapImageRepForCachingDisplay failed")
+        }
+        view.cacheDisplay(in: bounds, to: rep)
+        guard let png = rep.representation(using: .png, properties: [:]) else {
+            fail(expected: expectedLabel(), got: "PNG encode failed")
+        }
+        do {
+            try png.write(to: url)
+        } catch {
+            fail(expected: expectedLabel(), got: "could not write \(url.path): \(error)")
+        }
+        print(url.path)
+        fflush(stdout)
+    }
+
+    private static func expectedLabel() -> String {
+        format(CGRect(
+            x: min(pointA.x, pointB.x),
+            y: min(pointA.y, pointB.y),
+            width: abs(pointB.x - pointA.x),
+            height: abs(pointB.y - pointA.y)
+        ))
+    }
+
+    private static func format(_ rect: CGRect) -> String {
+        "(\(rect.origin.x), \(rect.origin.y), \(rect.width), \(rect.height))"
+    }
+
+    private static func fail(expected: String, got: String) -> Never {
+        print("PICKER-SELFTEST FAIL expected=\(expected) got=\(got)")
+        fflush(stdout)
+        exit(1)
+    }
+}

Sources/Shotdeck/RegionPickerController.swift

@@ -48,20 +48,27 @@ public final class RegionPickerController {
             matching: [.leftMouseDown, .leftMouseDragged, .leftMouseUp, .keyDown]
         ) { [weak self] event in
             guard let self else { return event }
-            // NSEvent is not Sendable; lift the two Sendable fields the handler
-            // needs. Mouse geometry is read from NSEvent.mouseLocation on the
-            // main thread inside the isolated methods, per spec.
+            // NSEvent is not Sendable; lift Sendable fields the handler needs.
+            // Prefer the event's window-local point converted to global AppKit
+            // coordinates; NSEvent.mouseLocation is only a fallback.
+            // keyCode is only valid on key events — reading it on a mouse event raises.
             let type = event.type
-            let keyCode = event.keyCode
+            let keyCode: UInt16 = (type == .keyDown) ? event.keyCode : 0
+            let locationInWindow = event.locationInWindow
+            let windowNumber = event.windowNumber
             let consume = MainActor.assumeIsolated {
-                self.handle(type: type, keyCode: keyCode)
+                let location = self.globalAppKitLocation(
+                    locationInWindow: locationInWindow,
+                    windowNumber: windowNumber
+                )
+                return self.handle(type: type, keyCode: keyCode, location: location)
             }
             return consume ? nil : event
         }
     }
 
     /// Returns `true` when the event should be swallowed.
-    private func handle(type: NSEvent.EventType, keyCode: UInt16) -> Bool {
+    private func handle(type: NSEvent.EventType, keyCode: UInt16, location: NSPoint?) -> Bool {
         switch type {
         case .keyDown:
             if keyCode == 53 { // kVK_Escape
@@ -70,21 +77,21 @@ public final class RegionPickerController {
             }
             return false
         case .leftMouseDown:
-            handleMouseDown()
+            handleMouseDown(location: location)
             return false
         case .leftMouseDragged:
-            handleMouseDragged()
+            handleMouseDragged(location: location)
             return false
         case .leftMouseUp:
-            handleMouseUp()
+            handleMouseUp(location: location)
             return false
         default:
             return false
         }
     }
 
-    private func handleMouseDown() {
-        let point = NSEvent.mouseLocation
+    private func handleMouseDown(location: NSPoint?) {
+        let point = location ?? NSEvent.mouseLocation
         dragStart = point
         startScreen = NSScreen.screens.first(where: { $0.frame.contains(point) })
             ?? NSScreen.screens.first
@@ -99,17 +106,17 @@ public final class RegionPickerController {
         }
     }
 
-    private func handleMouseDragged() {
+    private func handleMouseDragged(location: NSPoint?) {
         guard dragStart != nil, startScreen != nil else { return }
-        applyLiveSelection()
+        applyLiveSelection(current: location)
     }
 
-    private func handleMouseUp() {
+    private func handleMouseUp(location: NSPoint?) {
         guard let startScreen else {
             dragStart = nil
             return
         }
-        guard let rect = currentClampedRect(), rect.width >= 8, rect.height >= 8 else {
+        guard let rect = currentClampedRect(current: location), rect.width >= 8, rect.height >= 8 else {
             // Mis-click: reset drag state, leave every window open and fully dimmed.
             dragStart = nil
             self.startScreen = nil
@@ -122,8 +129,8 @@ public final class RegionPickerController {
         finish(region: region)
     }
 
-    private func applyLiveSelection() {
-        guard let startScreen, let rect = currentClampedRect() else { return }
+    private func applyLiveSelection(current: NSPoint?) {
+        guard let startScreen, let rect = currentClampedRect(current: current) else { return }
         let local = Self.localRect(from: rect, on: startScreen)
         let text = "\(Int(rect.width)) x \(Int(rect.height))"
         window(for: startScreen)?.updateSelection(localRect: local, sizeText: text)
@@ -134,9 +141,9 @@ public final class RegionPickerController {
 
     /// Normalize the drag (so bottom-right → up-left is not misjudged) then clamp
     /// to the screen the gesture started on — never selects across displays.
-    private func currentClampedRect() -> CGRect? {
+    private func currentClampedRect(current: NSPoint?) -> CGRect? {
         guard let dragStart, let startScreen else { return nil }
-        let current = NSEvent.mouseLocation
+        let current = current ?? NSEvent.mouseLocation
         let normalized = CGRect(
             x: min(dragStart.x, current.x),
             y: min(dragStart.y, current.y),
@@ -146,6 +153,21 @@ public final class RegionPickerController {
         return normalized.intersection(startScreen.frame)
     }
 
+    /// Convert a monitored event's `locationInWindow` into global AppKit coordinates
+    /// (bottom-left origin, matching `NSEvent.mouseLocation` / `NSScreen.frame`).
+    private func globalAppKitLocation(locationInWindow: NSPoint, windowNumber: Int) -> NSPoint? {
+        if let window = windows.first(where: { $0.windowNumber == windowNumber }) {
+            return window.convertPoint(toScreen: locationInWindow)
+        }
+        if windowNumber != 0, let window = NSApp.window(withWindowNumber: windowNumber) {
+            return window.convertPoint(toScreen: locationInWindow)
+        }
+        if windowNumber == 0 {
+            return locationInWindow
+        }
+        return nil
+    }
+
     private func window(for screen: NSScreen) -> RegionPickerWindow? {
         windows.first { $0.coveringScreen === screen }
     }

Sources/Shotdeck/RegionPickerWindow.swift

@@ -29,6 +29,7 @@ final class RegionPickerWindow: NSPanel {
         becomesKeyOnlyIfNeeded = false
         animationBehavior = .none
         collectionBehavior = [.canJoinAllSpaces, .fullScreenAuxiliary, .stationary]
+        acceptsMouseMovedEvents = true
         contentView = pickerView
     }
 
@@ -53,6 +54,8 @@ private final class RegionPickerView: NSView {
 
     override var isOpaque: Bool { false }
     override var acceptsFirstResponder: Bool { true }
+    // Accessory-app trap: first click on an inactive overlay is first-mouse and is dropped unless accepted.
+    override func acceptsFirstMouse(for event: NSEvent?) -> Bool { true }
 
     override func draw(_ dirtyRect: NSRect) {
         super.draw(dirtyRect)

Sources/Shotdeck/ReturnsList.swift

@@ -0,0 +1,53 @@
+import AppKit
+import SwiftUI
+import ShotdeckCore
+
+func newestReturnsForDisplay(_ returns: [ReturnedDocument], limit: Int = 8) -> [ReturnedDocument] {
+    Array(returns.sorted { $0.detectedAt > $1.detectedAt }.prefix(limit))
+}
+
+func returnMarkLabel(_ document: ReturnedDocument) -> String {
+    guard document.isCommented else { return "not marked" }
+    let count = document.annotatedPages.count
+    return "\(count) page\(count == 1 ? "" : "s") marked"
+}
+
+struct ReturnsList: View {
+    let returns: [ReturnedDocument]
+
+    var body: some View {
+        let visible = newestReturnsForDisplay(returns)
+        if visible.isEmpty {
+            EmptyView()
+        } else {
+            VStack(alignment: .leading, spacing: 4) {
+                Text("Came back from your device")
+                    .font(.caption)
+                    .foregroundStyle(.secondary)
+                ForEach(visible) { document in
+                    Button {
+                        NSWorkspace.shared.activateFileViewerSelecting([document.fileURL])
+                    } label: {
+                        HStack(spacing: 8) {
+                            Text(document.fileURL.lastPathComponent)
+                                .lineLimit(1)
+                            Spacer(minLength: 8)
+                            Text(returnMarkLabel(document))
+                                .font(.caption)
+                                .foregroundStyle(document.isCommented ? .primary : .secondary)
+                        }
+                    }
+                    .buttonStyle(.plain)
+                    .help(DubaiTime.stamp(document.detectedAt))
+                }
+            }
+        }
+    }
+}
+
+extension AppModel: ReturnsSectionProviding {
+    public func returnsSection() -> AnyView {
+        guard !allReturns.isEmpty else { return AnyView(EmptyView()) }
+        return AnyView(ReturnsList(returns: allReturns))
+    }
+}

Sources/Shotdeck/SendController.swift

@@ -0,0 +1,71 @@
+import AppKit
+import Darwin
+import Foundation
+import ShotdeckCore
+
+extension AppModel: SendCapable {
+    public func send(anchor: NSView?) async {
+        guard !session.isEmpty, !isSending else { return }
+        setSending(true)
+        defer { setSending(false) }
+
+        let workingSession = session
+        let composer = self.composer
+        // Live outbox (FolderSettings), not `paths.outbox` — Settings changes take effect.
+        let outboxDir = outboxURL
+        let sourceDir = paths.sessionDirectory(workingSession.id)
+        let fileName = PDFComposer.fileName(for: workingSession)
+        let finalURL = outboxDir.appendingPathComponent(fileName)
+        // Same directory as the final target so the rename below is same-volume (atomic).
+        let tempURL = outboxDir.appendingPathComponent(".shotdeck-\(UUID().uuidString).pdf")
+        let title = "Redline – \(DubaiTime.stamp(workingSession.createdAt))"
+
+        do {
+            // D-13: build off the main actor. Only Sendable values cross into the
+            // detached task — never `anchor` (NSView is not Sendable).
+            try await Task.detached(priority: .userInitiated) {
+                _ = try composer.compose(
+                    session: workingSession,
+                    imageURL: { capture in sourceDir.appendingPathComponent(capture.fileName) },
+                    title: title,
+                    to: tempURL
+                )
+                // POSIX rename onto `finalURL` replaces any same-name file in one
+                // directory operation; there is never a window where the PDF is gone.
+                if Darwin.rename(tempURL.path, finalURL.path) != 0 {
+                    throw ShotdeckError.pdfCompositionFailed(
+                        reason: "could not publish the PDF: \(String(cString: strerror(errno)))"
+                    )
+                }
+                try AtomicFile.fsyncDirectory(at: outboxDir)
+            }.value
+
+            // File exists on disk now — archive only after that (D-13). A later AirDrop
+            // failure never deletes this file.
+            guard FileManager.default.fileExists(atPath: finalURL.path) else {
+                throw ShotdeckError.pdfCompositionFailed(reason: "the PDF was not written to disk")
+            }
+            _ = try await spool.archiveCurrent(pdfFileName: fileName)
+            replaceSession(try await spool.currentSession())
+
+            let pageWord = workingSession.captures.count == 1 ? "page" : "pages"
+            setStatus("Sent — \(workingSession.captures.count) \(pageWord).")
+
+            guard let anchor else {
+                setStatus("PDF saved to \(outboxDisplayName). Open the panel to AirDrop it.")
+                return
+            }
+            do {
+                try Sharing.airDrop(fileURL: finalURL, from: anchor)
+            } catch {
+                setStatus(
+                    "AirDrop is not available right now — the PDF is on your \(outboxDisplayName)."
+                )
+            }
+        } catch {
+            // Never unlink the published PDF, and never unlink `tempURL` either:
+            // a rename failure would leave the complete document at the temp name.
+            setStatus((error as? ShotdeckError)?.errorDescription ?? "The PDF could not be built.")
+        }
+    }
+}

Sources/Shotdeck/SettingsView.swift

@@ -0,0 +1,204 @@
+import AppKit
+import SwiftUI
+import ShotdeckCore
+
+struct SettingsView: View {
+    @Environment(AppModel.self) private var model
+    @State private var isRecordingHotkey = false
+    @State private var recorder = HotkeyRecorderBox()
+
+    private let labelWidth: CGFloat = 104
+
+    var body: some View {
+        Grid(alignment: .leading, horizontalSpacing: 12, verticalSpacing: 10) {
+            GridRow {
+                Text("Hotkey")
+                    .font(.headline)
+                    .frame(maxWidth: .infinity, alignment: .leading)
+                    .gridCellColumns(2)
+            }
+
+            GridRow(alignment: .center) {
+                fieldLabel("Capture")
+                HStack(spacing: 8) {
+                    Button {
+                        armHotkeyRecorder()
+                    } label: {
+                        Text(isRecordingHotkey ? "Press keys…" : model.hotkeyDisplayString)
+                            .foregroundStyle(isRecordingHotkey ? .secondary : .primary)
+                            .lineLimit(1)
+                    }
+                    Spacer(minLength: 0)
+                }
+                .frame(minHeight: 22)
+            }
+
+            GridRow {
+                Text("Folders")
+                    .font(.headline)
+                    .frame(maxWidth: .infinity, alignment: .leading)
+                    .gridCellColumns(2)
+                    .padding(.top, 6)
+            }
+
+            GridRow(alignment: .center) {
+                fieldLabel("Watch folder")
+                folderValue(path: model.watchFolderURL.path) {
+                    model.chooseWatchFolder()
+                }
+            }
+
+            GridRow(alignment: .center) {
+                fieldLabel("Output folder")
+                folderValue(path: model.outboxURL.path) {
+                    model.chooseOutboxFolder()
+                }
+            }
+
+            GridRow {
+                Button("Reveal spool folder") { model.openSpoolFolder() }
+                    .gridCellColumns(2)
+                    .frame(maxWidth: .infinity, alignment: .leading)
+                    .padding(.top, 4)
+            }
+        }
+        .padding(16)
+        .frame(minWidth: 320, idealWidth: 360, maxWidth: 360, alignment: .leading)
+        .controlSize(.small)
+        .onDisappear { disarmHotkeyRecorder() }
+    }
+
+    private func armHotkeyRecorder() {
+        guard !isRecordingHotkey else { return }
+        isRecordingHotkey = true
+        recorder.onKey = { keyCode, flags in
+            handleRecorderKey(keyCode: keyCode, flags: flags)
+        }
+        recorder.arm()
+    }
+
+    private func handleRecorderKey(keyCode: UInt16, flags: NSEvent.ModifierFlags) {
+        if keyCode == 53 { // kVK_Escape
+            disarmHotkeyRecorder()
+            return
+        }
+        guard let pref = HotkeyPreference.fromKeyEvent(keyCode: keyCode, modifierFlags: flags) else {
+            return
+        }
+        pref.save()
+        model.reRegisterHotkey()
+        disarmHotkeyRecorder()
+    }
+
+    private func disarmHotkeyRecorder() {
+        recorder.disarm()
+        recorder.onKey = nil
+        isRecordingHotkey = false
+    }
+
+    private func fieldLabel(_ title: String) -> some View {
+        Text(title)
+            .lineLimit(1)
+            .frame(width: labelWidth, alignment: .trailing)
+            .gridColumnAlignment(.trailing)
+            .frame(minHeight: 22, alignment: .trailing)
+    }
+
+    private func folderValue(path: String, choose: @escaping () -> Void) -> some View {
+        HStack(spacing: 8) {
+            Text(path)
+                .lineLimit(1)
+                .truncationMode(.middle)
+                .foregroundStyle(.secondary)
+                .frame(maxWidth: .infinity, alignment: .leading)
+            Button("Choose…") { choose() }
+        }
+        .frame(minHeight: 22)
+    }
+}
+
+/// Local keyDown monitor for the Settings capture-hotkey recorder. Callbacks hop onto the
+/// main actor the same way `RegionPickerController` does — local monitors fire on the
+/// main run loop during `NSApp.sendEvent`.
+@MainActor
+private final class HotkeyRecorderBox {
+    var onKey: ((UInt16, NSEvent.ModifierFlags) -> Void)?
+    private var monitor: Any?
+
+    func arm() {
+        disarm()
+        monitor = NSEvent.addLocalMonitorForEvents(matching: .keyDown) { [weak self] event in
+            guard let self else { return event }
+            let keyCode = event.keyCode
+            let rawFlags = event.modifierFlags.rawValue
+            MainActor.assumeIsolated {
+                self.onKey?(keyCode, NSEvent.ModifierFlags(rawValue: rawFlags))
+            }
+            return nil
+        }
+    }
+
+    func disarm() {
+        if let monitor {
+            NSEvent.removeMonitor(monitor)
+        }
+        monitor = nil
+    }
+}
+
+extension AppModel: SettingsWindowPresenting {
+    private static var settingsWindowController: NSWindowController?
+
+    public func presentSettingsWindow() {
+        if let existing = Self.settingsWindowController {
+            existing.window?.makeKeyAndOrderFront(nil)
+            NSApp.activate()
+            return
+        }
+        let hosting = NSHostingController(rootView: SettingsView().environment(self))
+        let window = NSWindow(contentViewController: hosting)
+        window.title = "Redline Settings"
+        window.styleMask = [.titled, .closable]
+        window.isReleasedWhenClosed = false
+        window.center()
+        let controller = NSWindowController(window: window)
+        Self.settingsWindowController = controller
+        controller.showWindow(nil)
+        NSApp.activate()
+    }
+
+    func chooseOutboxFolder() {
+        guard let url = chooseDirectory(startingAt: outboxURL) else { return }
+        FolderSettings.setOutbox(url)
+        setFolderURLs(outbox: url, watch: watchFolderURL)
+        setStatus("Output folder set to \(url.lastPathComponent).")
+    }
+
+    func chooseWatchFolder() {
+        guard let url = chooseDirectory(startingAt: watchFolderURL) else { return }
+        FolderSettings.setWatchFolder(url)
+        setFolderURLs(outbox: outboxURL, watch: url)
+        Task {
+            do {
+                try await watcher.updateWatchFolder(url)
+                setStatus("Watch folder set to \(url.lastPathComponent).")
+            } catch {
+                setStatus(
+                    (error as? ShotdeckError)?.errorDescription ?? "Could not switch the watch folder."
+                )
+            }
+        }
+    }
+
+    private func chooseDirectory(startingAt directory: URL) -> URL? {
+        let panel = NSOpenPanel()
+        panel.canChooseDirectories = true
+        panel.canChooseFiles = false
+        panel.allowsMultipleSelection = false
+        panel.canCreateDirectories = true
+        panel.prompt = "Choose"
+        panel.directoryURL = directory
+        guard panel.runModal() == .OK else { return nil }
+        return panel.url
+    }
+}

Sources/Shotdeck/Sharing.swift

@@ -0,0 +1,83 @@
+import AppKit
+import ShotdeckCore
+
+@MainActor
+enum Sharing {
+    /// Presents the AirDrop picker for `fileURL`, anchored to `view`.
+    /// Throws `ShotdeckError.airDropUnavailable` when the service cannot be created,
+    /// `canPerform` is false, or `view` is not in a visible window (a detached view
+    /// never produces an on-screen sheet).
+    static func airDrop(fileURL: URL, from view: NSView) throws {
+        guard let service = NSSharingService(named: .sendViaAirDrop),
+              service.canPerform(withItems: [fileURL]) else {
+            throw ShotdeckError.airDropUnavailable
+        }
+        // Presenting from a detached NSView (no window) yields a sheet that never appears.
+        guard let window = view.window, window.isVisible else {
+            throw ShotdeckError.airDropUnavailable
+        }
+
+        NSApp.activate()
+        window.makeKeyAndOrderFront(nil)
+
+        service.subject = fileURL.lastPathComponent
+        let session = AirDropSession(service: service, window: window, view: view)
+        AirDropSession.keepAlive(session)
+        service.delegate = session
+        service.perform(withItems: [fileURL])
+    }
+}
+
+/// Retains the sharing service for the life of the picker and supplies the real
+/// on-screen window as the sheet parent. `NSSharingService.delegate` is weak.
+@MainActor
+private final class AirDropSession: NSObject, NSSharingServiceDelegate {
+    static var live: [AirDropSession] = []
+
+    let service: NSSharingService
+    let window: NSWindow
+    let view: NSView
+
+    init(service: NSSharingService, window: NSWindow, view: NSView) {
+        self.service = service
+        self.window = window
+        self.view = view
+    }
+
+    static func keepAlive(_ session: AirDropSession) {
+        live.append(session)
+    }
+
+    private func drop() {
+        Self.live.removeAll { $0 === self }
+    }
+
+    func sharingService(
+        _ sharingService: NSSharingService,
+        sourceWindowForShareItems items: [Any],
+        sharingContentScope: UnsafeMutablePointer<NSSharingService.SharingContentScope>
+    ) -> NSWindow? {
+        sharingContentScope.pointee = .item
+        return window
+    }
+
+    func sharingService(
+        _ sharingService: NSSharingService,
+        sourceFrameOnScreenForShareItem item: Any
+    ) -> NSRect {
+        let inWindow = view.convert(view.bounds, to: nil)
+        return window.convertToScreen(inWindow)
+    }
+
+    func sharingService(_ sharingService: NSSharingService, didShareItems items: [Any]) {
+        drop()
+    }
+
+    func sharingService(
+        _ sharingService: NSSharingService,
+        didFailToShareItems items: [Any],
+        error: any Error
+    ) {
+        drop()
+    }
+}

Sources/Shotdeck/main.swift

@@ -4,6 +4,12 @@ import ShotdeckCore
 
 // SwiftPM treats a file named main.swift as top-level code, which forbids `@main`.
 // App.main() is the equivalent entry point.
+if ProcessInfo.processInfo.environment["SHOTDECK_SNAPSHOT_DIR"] != nil {
+    MainActor.assumeIsolated { PanelSnapshot.runIfRequested() }
+}
+if ProcessInfo.processInfo.environment["SHOTDECK_PICKER_SELFTEST"] != nil {
+    MainActor.assumeIsolated { PickerSelfTest.runIfRequested() }
+}
 ShotdeckApp.main()
 
 struct ShotdeckApp: App {
@@ -21,7 +27,7 @@ struct ShotdeckApp: App {
                     Text(count).font(.system(size: 11, weight: .semibold))
                 }
             }
-            .accessibilityLabel("Shotdeck")
+            .accessibilityLabel("Redline")
         }
         .menuBarExtraStyle(.window)
     }
@@ -54,7 +60,7 @@ final class AppDelegate: NSObject, NSApplicationDelegate {
             // Safe: temp-dir creation for a path this process controls cannot legitimately fail.
             let fallback = try! AppSupportPaths(root: fallbackRoot, outbox: tmp, watchFolder: tmp)
             let model = try! makeModel(paths: fallback)
-            model.setStatus("Shotdeck could not access its storage folder. Captures will not persist.")
+            model.setStatus("Redline could not access its storage folder. Captures will not persist.")
             return model
         }
     }

Sources/ShotdeckCore/Model/ShotdeckError.swift

@@ -16,7 +16,7 @@ public enum ShotdeckError: Error, LocalizedError, Sendable {
         case .screenRecordingNotGranted:
             return "Screen Recording is turned off. Grant it in System Settings to capture."
         case .noRegionRemembered:
-            return "No capture region is set. Choose 'Re-select area' from the Shotdeck menu."
+            return "No capture region is set. Choose 'Re-select area' from the Redline menu."
         case .displayNoLongerConnected:
             return "The display used for capture is no longer connected."
         case .captureFailed(let underlying):

Sources/ShotdeckCore/PDF/PDFComposer.swift

@@ -71,7 +71,7 @@ public struct PDFComposer: Sendable {
     }
 
     public static func fileName(for session: CaptureSession) -> String {
-        "Shotdeck-\(DubaiTime.fileStamp(session.createdAt)).pdf"
+        "Redline-\(DubaiTime.fileStamp(session.createdAt)).pdf"
     }
 
     private static func writePDF(
@@ -86,7 +86,7 @@ public struct PDFComposer: Sendable {
         }
 
         let auxiliaryInfo: [String: Any] = [
-            kCGPDFContextCreator as String: "Shotdeck",
+            kCGPDFContextCreator as String: "Redline",
             kCGPDFContextTitle as String: title,
             kCGPDFContextSubject as String: sessionID.uuidString.lowercased(),
         ]

Sources/ShotdeckCore/Returns/AnnotationInspector.swift

@@ -93,16 +93,19 @@ public enum AnnotationInspector {
         )
     }
 
-    /// True when this PDF was produced by Shotdeck. Creator attribute is authoritative;
+    /// True when this PDF was produced by this app. Creator attribute is authoritative;
     /// the filename fallback applies ONLY when the creator attribute is absent.
+    /// Accepts both the current product name ("Redline") and the legacy name ("Shotdeck")
+    /// so PDFs already on the iPad or in Downloads are still detected.
     public static func isShotdeckDocument(_ document: PDFDocument) -> Bool {
         if let creator = document.documentAttributes?[PDFDocumentAttribute.creatorAttribute] as? String {
-            return creator == "Shotdeck"          // present creator is authoritative, full stop
+            // Present creator is authoritative, full stop.
+            return creator == "Redline" || creator == "Shotdeck"
         }
         // Creator ABSENT (some apps rewrite metadata on save) -> filename fallback only here.
         guard let name = document.documentURL?.lastPathComponent else { return false }
         // .lastPathComponent on a file URL is already percent-decoded; do not use .absoluteString.
-        return name.wholeMatch(of: /^Shotdeck-\d{8}-\d{6}( \d+)?\.pdf$/) != nil
+        return name.wholeMatch(of: /^(Redline|Shotdeck)-\d{8}-\d{6}( \d+)?\.pdf$/) != nil
         // Case-sensitive by construction (Swift Regex literals are case-sensitive by default).
         // The optional "( \d+)?" is macOS's duplicate-name suffix AirDrop adds when a file of
         // the same name already exists in the watch folder — the normal case for a return.

Sources/ShotdeckCore/Returns/ReturnWatcher.swift

@@ -60,7 +60,7 @@ public actor ReturnWatcher {
     }
 
     /// Scans the watch folder once, immediately, without waiting for an event. Every
-    /// recognized, stable, openable Shotdeck PDF present is (re-)inspected and (re-)recorded
+    /// recognized, stable, openable Redline/Shotdeck PDF present is (re-)inspected and (re-)recorded
     /// into the ledger; returns exactly the documents processed in this call.
     @discardableResult
     public func scanNow() async throws -> [ReturnedDocument] {

Tests/ShotdeckCoreTests/AnnotationInspectorTests.swift

@@ -371,6 +371,72 @@ func i19b_presentNonShotdeckCreatorBeatsMatchingFilename() throws {
     #expect(AnnotationInspector.isShotdeckDocument(reopened) == false)
 }
 
+@Test("I-19c Present Redline creator is recognized")
+func i19c_presentRedlineCreatorIsRecognized() throws {
+    let (paths, cleanup) = try makeCasePaths()
+    defer { try? FileManager.default.removeItem(at: cleanup) }
+
+    let pdfURL = paths.watchFolder.appendingPathComponent("Redline-20260830-134219.pdf")
+    try makePDF(at: pdfURL, pageCount: 1, creator: "Redline")
+    let reopened = try #require(PDFDocument(url: pdfURL))
+    #expect(AnnotationInspector.isShotdeckDocument(reopened) == true)
+}
+
+@Test("I-19d Present legacy Shotdeck creator is still recognized")
+func i19d_presentLegacyShotdeckCreatorIsStillRecognized() throws {
+    let (paths, cleanup) = try makeCasePaths()
+    defer { try? FileManager.default.removeItem(at: cleanup) }
+
+    let pdfURL = paths.watchFolder.appendingPathComponent("Shotdeck-20260830-134220.pdf")
+    try makePDF(at: pdfURL, pageCount: 1, creator: "Shotdeck")
+    let reopened = try #require(PDFDocument(url: pdfURL))
+    #expect(AnnotationInspector.isShotdeckDocument(reopened) == true)
+}
+
+@Test("I-19e Absent creator falls back to Redline filename")
+func i19e_absentCreatorFallsBackToRedlineFilename() throws {
+    let (paths, cleanup) = try makeCasePaths()
+    defer { try? FileManager.default.removeItem(at: cleanup) }
+
+    let pdfURL = paths.watchFolder.appendingPathComponent("Redline-20260830-134221.pdf")
+    try makePDF(at: pdfURL, pageCount: 1, creator: nil)
+    let reopened = try #require(PDFDocument(url: pdfURL))
+    #expect(AnnotationInspector.isShotdeckDocument(reopened) == true)
+}
+
+@Test("I-19f Absent creator falls back to legacy Shotdeck filename")
+func i19f_absentCreatorFallsBackToLegacyShotdeckFilename() throws {
+    let (paths, cleanup) = try makeCasePaths()
+    defer { try? FileManager.default.removeItem(at: cleanup) }
+
+    let pdfURL = paths.watchFolder.appendingPathComponent("Shotdeck-20260830-134222.pdf")
+    try makePDF(at: pdfURL, pageCount: 1, creator: nil)
+    let reopened = try #require(PDFDocument(url: pdfURL))
+    #expect(AnnotationInspector.isShotdeckDocument(reopened) == true)
+}
+
+@Test("I-19g Absent creator falls back to Redline duplicate-name suffix")
+func i19g_absentCreatorFallsBackToRedlineDuplicateNameSuffix() throws {
+    let (paths, cleanup) = try makeCasePaths()
+    defer { try? FileManager.default.removeItem(at: cleanup) }
+
+    let pdfURL = paths.watchFolder.appendingPathComponent("Redline-20260830-134223 2.pdf")
+    try makePDF(at: pdfURL, pageCount: 1, creator: nil)
+    let reopened = try #require(PDFDocument(url: pdfURL))
+    #expect(AnnotationInspector.isShotdeckDocument(reopened) == true)
+}
+
+@Test("I-19h Present non-product creator beats a matching Redline filename")
+func i19h_presentNonProductCreatorBeatsMatchingRedlineFilename() throws {
+    let (paths, cleanup) = try makeCasePaths()
+    defer { try? FileManager.default.removeItem(at: cleanup) }
+
+    let pdfURL = paths.watchFolder.appendingPathComponent("Redline-20260830-134224.pdf")
+    try makePDF(at: pdfURL, pageCount: 1, creator: "Preview")
+    let reopened = try #require(PDFDocument(url: pdfURL))
+    #expect(AnnotationInspector.isShotdeckDocument(reopened) == false)
+}
+
 private func expectSinglePageMark(
     _ subtype: PDFAnnotationSubtype,
     bounds: CGRect,

Tests/ShotdeckCoreTests/PDFComposerTests.swift

@@ -499,7 +499,7 @@ func documentAttributesRoundTrip() throws {
     )
     let document = try openDocument(output)
     let attributes = try #require(document.documentAttributes)
-    #expect(attributes[PDFDocumentAttribute.creatorAttribute] as? String == "Shotdeck")
+    #expect(attributes[PDFDocumentAttribute.creatorAttribute] as? String == "Redline")
     #expect(attributes[PDFDocumentAttribute.titleAttribute] as? String == "Ben review — 2026-08-30")
     #expect(attributes[PDFDocumentAttribute.subjectAttribute] as? String == "deadbeef-dead-4eef-8ead-deadbeef0001")
     #expect(document.pageCount == 1)

Tests/ShotdeckCoreTests/ReturnWatcherTests.swift

@@ -109,6 +109,65 @@ func w25_duplicateNameSuffixIsRecognizedByScanNow() async throws {
     #expect(commented[0].fileURL.resolvingSymlinksInPath().path == pdfURL.resolvingSymlinksInPath().path)
 }
 
+@Test("W-25b Redline duplicate-name suffix is the normal AirDrop return (scanNow)")
+func w25b_redlineDuplicateNameSuffixIsRecognizedByScanNow() async throws {
+    let (paths, cleanup) = try makeCasePaths()
+    defer { try? FileManager.default.removeItem(at: cleanup) }
+
+    let ledger = try ReturnLedger(paths: paths)
+    let watcher = ReturnWatcher(paths: paths, ledger: ledger)
+    let pdfURL = paths.watchFolder.appendingPathComponent("Redline-20260830-134205 2.pdf")
+
+    try makePDF(
+        at: pdfURL,
+        pageCount: 1,
+        creator: nil,
+        subject: "44444444-4444-4444-4444-444444444444",
+        annotations: [(page: 0, annotation: makeAnnotation(
+            .ink, bounds: CGRect(x: 100, y: 100, width: 120, height: 50)
+        ))]
+    )
+
+    let found = try await watcher.scanNow()
+    #expect(found.count == 1)
+    let doc = try #require(found.first)
+    #expect(doc.fileURL.lastPathComponent == "Redline-20260830-134205 2.pdf")
+    #expect(doc.fileURL.resolvingSymlinksInPath().path == pdfURL.resolvingSymlinksInPath().path)
+    #expect(doc.pageCount == 1)
+    #expect(doc.annotatedPages == [1])
+    #expect(doc.isCommented == true)
+
+    let commented = try await ledger.commented()
+    #expect(commented.count == 1)
+    #expect(commented[0].fileURL.lastPathComponent == pdfURL.lastPathComponent)
+    #expect(commented[0].fileURL.resolvingSymlinksInPath().path == pdfURL.resolvingSymlinksInPath().path)
+}
+
+@Test("W-25c Redline creator is recognized by scanNow")
+func w25c_redlineCreatorIsRecognizedByScanNow() async throws {
+    let (paths, cleanup) = try makeCasePaths()
+    defer { try? FileManager.default.removeItem(at: cleanup) }
+
+    let ledger = try ReturnLedger(paths: paths)
+    let watcher = ReturnWatcher(paths: paths, ledger: ledger)
+    let pdfURL = paths.watchFolder.appendingPathComponent("Redline-20260830-134230.pdf")
+
+    try makePDF(
+        at: pdfURL,
+        pageCount: 1,
+        creator: "Redline",
+        annotations: [(page: 0, annotation: makeAnnotation(
+            .ink, bounds: CGRect(x: 100, y: 100, width: 120, height: 50)
+        ))]
+    )
+
+    let found = try await watcher.scanNow()
+    #expect(found.count == 1)
+    let doc = try #require(found.first)
+    #expect(doc.fileURL.lastPathComponent == "Redline-20260830-134230.pdf")
+    #expect(doc.isCommented == true)
+}
+
 @Test("W-26 Creator provenance negative at the scan level")
 func w26_presentNonShotdeckCreatorIsIgnoredByScanNow() async throws {
     let (paths, cleanup) = try makeCasePaths()

scripts/build-app.sh

@@ -11,7 +11,7 @@ cd "$ROOT"
 
 IDENTITY="Apple Development: ben@flow-master.ai (QH2H9G2LK5)"
 BUNDLE_ID="ai.flowmaster.shotdeck"
-APP_BUNDLE="${ROOT}/.build/Shotdeck.app"
+APP_BUNDLE="${ROOT}/.build/Redline.app"
 
 SKIP_SIGN=0
 for arg in "$@"; do
@@ -27,7 +27,7 @@ for arg in "$@"; do
     esac
 done
 
-echo "==> Building Shotdeck (release)"
+echo "==> Building Redline (release)"
 swift build -c release --product Shotdeck
 
 BIN_PATH="$(swift build -c release --product Shotdeck --show-bin-path)/Shotdeck"

scripts/make-dmg.sh

@@ -0,0 +1,95 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+APP_BUNDLE="${ROOT}/.build/Redline.app"
+STAGING="${ROOT}/.build/dmg-staging"
+DMG="${ROOT}/.build/Redline.dmg"
+MOUNT_POINT="${ROOT}/.build/dmg-mnt"
+
+SKIP_SIGN=0
+for arg in "$@"; do
+    case "${arg}" in
+        --skip-sign)
+            SKIP_SIGN=1
+            ;;
+        *)
+            echo "Unknown argument: ${arg}" >&2
+            echo "Usage: $0 [--skip-sign]" >&2
+            exit 1
+            ;;
+    esac
+done
+
+echo "==> Building Redline.app"
+if [[ "${SKIP_SIGN}" -eq 1 ]]; then
+    ./scripts/build-app.sh --skip-sign
+else
+    ./scripts/build-app.sh
+fi
+
+if [[ ! -d "${APP_BUNDLE}" ]]; then
+    echo "App bundle not found at ${APP_BUNDLE}" >&2
+    exit 1
+fi
+
+echo "==> Staging DMG contents"
+rm -rf "${STAGING}"
+mkdir -p "${STAGING}"
+ditto "${APP_BUNDLE}" "${STAGING}/Redline.app"
+ln -s /Applications "${STAGING}/Applications"
+
+echo "==> Creating ${DMG}"
+mkdir -p "$(dirname "${DMG}")"
+hdiutil create -volname "Redline" -srcfolder "${STAGING}" -ov -format UDZO "${DMG}"
+
+MOUNTED=0
+detach_dmg() {
+    if [[ "${MOUNTED}" -eq 1 ]]; then
+        hdiutil detach "${MOUNT_POINT}" || hdiutil detach "${MOUNT_POINT}" -force || true
+        MOUNTED=0
+    fi
+}
+trap detach_dmg EXIT
+
+if [[ -d "${MOUNT_POINT}" ]] && /sbin/mount | grep -F -q "${MOUNT_POINT}"; then
+    hdiutil detach "${MOUNT_POINT}" || hdiutil detach "${MOUNT_POINT}" -force
+fi
+rm -rf "${MOUNT_POINT}"
+mkdir -p "${MOUNT_POINT}"
+
+echo "==> Verifying ${DMG}"
+hdiutil attach "${DMG}" -nobrowse -readonly -mountpoint "${MOUNT_POINT}"
+MOUNTED=1
+
+echo "==> Mount contents"
+ls -la "${MOUNT_POINT}"
+
+if [[ ! -d "${MOUNT_POINT}/Redline.app" ]]; then
+    echo "Verification failed: Redline.app missing from mounted DMG" >&2
+    exit 1
+fi
+if [[ ! -L "${MOUNT_POINT}/Applications" ]]; then
+    echo "Verification failed: Applications symlink missing from mounted DMG" >&2
+    exit 1
+fi
+if [[ "$(readlink "${MOUNT_POINT}/Applications")" != "/Applications" ]]; then
+    echo "Verification failed: Applications does not point at /Applications" >&2
+    exit 1
+fi
+
+echo "==> codesign --verify --deep"
+codesign --verify --deep --verbose=2 "${MOUNT_POINT}/Redline.app"
+
+echo "==> Detaching ${MOUNT_POINT}"
+hdiutil detach "${MOUNT_POINT}"
+MOUNTED=0
+trap - EXIT
+
+SHA256="$(shasum -a 256 "${DMG}" | awk '{print $1}')"
+
+echo
+echo "DMG path: ${DMG}"
+echo "SHA256: ${SHA256}"