From ed9eaf7e7a00d21bb9805bc14d3babf47905b1e5 Mon Sep 17 00:00:00 2001
From: Jake Bromberg <jake@funlandresearch.com>
Date: Tue, 12 May 2026 09:43:36 -0700
Subject: [PATCH 1/2] feat(verifier): bundle index, prev/next nav, status
 tracking, shortcuts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds a workflow on top of the per-bundle editor that surfaces what's been done and steps through what hasn't.

INDEX page at /verifier/ (no ?bundle=). Lists every bundle in data/verifier/ with its three-state status badge (incomplete / partial / complete), page_date_raw, and last-saved timestamp. Click a row to open. Header has an "Open next page that needs work" button that jumps to the first non-complete bundle.

Three-state tracking via a new top-level "status" field on corrections.json. /api/save accepts an optional "status" body parameter: complete from the client wins, but an existing on-disk complete is preserved across plain Saves (refining details on a done page doesn't downgrade it). Legacy corrections.json without status is treated as partial — they were saved, just not done.

New GET /api/bundles enumerates bundles + their state for the index page and the Prev/Next nav in the editor. Malformed bundles still appear (with null metadata) so the user can spot the breakage.

Editor header gets two buttons (Save, Mark complete), a status pill reflecting the current state, position indicator (3 / 5), Prev/Next buttons, and a "← All pages" back link. Save and Mark complete share the same POST path; they only differ in the status body field.

Keyboard shortcuts: ⌘S save, ⌘⇧S mark complete, j/k row nav (also ⌘↓/⌘↑), ⌘D toggle delete on focused row, n/p prev/next bundle, ? toggles the overlay listing them all. Single-letter shortcuts are ignored when an input has focus so typing works normally.

The bundle-input file picker is dropped — opening a bundle is now done via the index list or a direct ?bundle= URL.

10 new tests cover the status preservation rule, /api/bundles state classification (incomplete/partial/complete, legacy corrections.json, malformed bundle, verified_at surfacing, empty dir). Total 494, ruff/mypy clean.
---
 tests/unit/test_verifier_serve.py | 174 +++++++++++++++++
 verifier/README.md                |  50 +++--
 verifier/app.js                   | 307 ++++++++++++++++++++++++++++--
 verifier/index.html               |  65 ++++++-
 verifier/serve.py                 | 153 ++++++++++++++-
 verifier/styles.css               | 134 +++++++++++++
 6 files changed, 842 insertions(+), 41 deletions(-)

diff --git a/tests/unit/test_verifier_serve.py b/tests/unit/test_verifier_serve.py
index 3aa54b0..8da6299 100644
--- a/tests/unit/test_verifier_serve.py
+++ b/tests/unit/test_verifier_serve.py
@@ -319,6 +319,180 @@ async def test_save_writes_are_atomic_no_tmp_left_behind(serve_app, tmp_path: Pa
     assert tmp_files == [], f"unexpected tmp files left: {tmp_files}"
 
 
+async def test_save_writes_status_draft_by_default(serve_app, tmp_path: Path) -> None:
+    """A Save with no `status` field writes corrections.json with
+    `status: "draft"` — the default for a partial / in-progress page."""
+    async with await _client(serve_app.app) as c:
+        r = await c.post(
+            "/api/save",
+            json={
+                "stem": "draft-default",
+                "verified": _page_result_dict(),
+                "corrections": _corrections_dict(),
+            },
+        )
+    assert r.status_code == 200
+    assert r.json()["status"] == "draft"
+    on_disk = json.loads(
+        (tmp_path / "data" / "verifier" / "draft-default.corrections.json").read_text()
+    )
+    assert on_disk["status"] == "draft"
+
+
+async def test_save_writes_status_complete_when_requested(serve_app, tmp_path: Path) -> None:
+    """An explicit `status: "complete"` from the UI's Mark complete button
+    persists as `"complete"`."""
+    async with await _client(serve_app.app) as c:
+        r = await c.post(
+            "/api/save",
+            json={
+                "stem": "mark-done",
+                "status": "complete",
+                "verified": _page_result_dict(),
+                "corrections": _corrections_dict(),
+            },
+        )
+    assert r.status_code == 200
+    assert r.json()["status"] == "complete"
+
+
+async def test_save_preserves_complete_on_subsequent_draft_save(serve_app, tmp_path: Path) -> None:
+    """Once a page is `complete`, a subsequent plain Save (default
+    `draft` or omitted status) does NOT downgrade it. Refining details
+    on a completed page is a tweak-in-place, not a status change."""
+    body_draft = {
+        "stem": "preserve",
+        "verified": _page_result_dict(),
+        "corrections": _corrections_dict(),
+    }
+    body_complete = {**body_draft, "status": "complete"}
+    async with await _client(serve_app.app) as c:
+        await c.post("/api/save", json=body_complete)
+        # Now save again with no status — should stay complete.
+        r = await c.post("/api/save", json=body_draft)
+    assert r.status_code == 200
+    assert r.json()["status"] == "complete"
+    on_disk = json.loads((tmp_path / "data" / "verifier" / "preserve.corrections.json").read_text())
+    assert on_disk["status"] == "complete"
+
+
+async def test_save_rejects_invalid_status(serve_app, tmp_path: Path) -> None:
+    """Unknown status values are rejected — no silent fallback."""
+    async with await _client(serve_app.app) as c:
+        r = await c.post(
+            "/api/save",
+            json={
+                "stem": "bad-status",
+                "status": "in-progress",  # not a valid value
+                "verified": _page_result_dict(),
+                "corrections": _corrections_dict(),
+            },
+        )
+    assert r.status_code == 400
+    assert "status" in r.json()["detail"]
+
+
+# -- /api/bundles ----------------------------------------------------------
+
+
+def _write_bundle(verifier_dir: Path, stem: str, page_date_raw: str | None) -> None:
+    """Drop a minimal bundle.json under the verifier directory for the
+    /api/bundles enumeration tests."""
+    verifier_dir.mkdir(parents=True, exist_ok=True)
+    (verifier_dir / f"{stem}.bundle.json").write_text(
+        json.dumps(
+            {
+                "schema_version": 2,
+                "stem": stem,
+                "image_path": f"../tests/golden/{stem}.png",
+                "pdf_path": None,
+                "page_number": None,
+                "model_version": "test",
+                "extracted_at": "2026-05-12T00:00:00Z",
+                "page_date_raw": page_date_raw,
+                "comments_raw": None,
+                "oddities": [],
+                "quadrants": [],
+            }
+        )
+    )
+
+
+async def test_list_bundles_empty_when_no_dir(serve_app, tmp_path: Path) -> None:
+    """No data/verifier/ directory → empty bundle list, not a 500."""
+    async with await _client(serve_app.app) as c:
+        r = await c.get("/api/bundles")
+    assert r.status_code == 200
+    assert r.json() == {"bundles": []}
+
+
+async def test_list_bundles_classifies_three_states(serve_app, tmp_path: Path) -> None:
+    """Three bundles → three states: incomplete (no corrections file),
+    partial (corrections with status=draft), complete (corrections with
+    status=complete). Sorted alphabetically by stem."""
+    verifier_dir = tmp_path / "data" / "verifier"
+    _write_bundle(verifier_dir, "a-untouched", "A")
+    _write_bundle(verifier_dir, "b-draft", "B")
+    _write_bundle(verifier_dir, "c-complete", "C")
+    (verifier_dir / "b-draft.corrections.json").write_text(json.dumps({"status": "draft"}))
+    (verifier_dir / "c-complete.corrections.json").write_text(json.dumps({"status": "complete"}))
+
+    async with await _client(serve_app.app) as c:
+        r = await c.get("/api/bundles")
+    bundles = r.json()["bundles"]
+    assert [b["stem"] for b in bundles] == ["a-untouched", "b-draft", "c-complete"]
+    assert [b["status"] for b in bundles] == ["incomplete", "partial", "complete"]
+    assert [b["page_date_raw"] for b in bundles] == ["A", "B", "C"]
+    assert bundles[0]["url"] == "/verifier/?bundle=/data/verifier/a-untouched.bundle.json"
+
+
+async def test_list_bundles_legacy_corrections_without_status_is_partial(
+    serve_app, tmp_path: Path
+) -> None:
+    """A corrections.json from before status tracking landed (no `status`
+    field) is classified as `partial` — they were saved, just not done."""
+    verifier_dir = tmp_path / "data" / "verifier"
+    _write_bundle(verifier_dir, "legacy", None)
+    (verifier_dir / "legacy.corrections.json").write_text(json.dumps({"row_corrections": []}))
+    async with await _client(serve_app.app) as c:
+        r = await c.get("/api/bundles")
+    assert r.json()["bundles"][0]["status"] == "partial"
+
+
+async def test_list_bundles_surfaces_verified_at_timestamp(serve_app, tmp_path: Path) -> None:
+    """`verified_at` reflects when the last Save / Mark-complete fired.
+    Sourced from the verified.json mtime so the same /api/save flow keeps
+    it accurate."""
+    verifier_dir = tmp_path / "data" / "verifier"
+    _write_bundle(verifier_dir, "stamped", None)
+    (verifier_dir / "stamped.corrections.json").write_text(json.dumps({"status": "draft"}))
+    (verifier_dir / "stamped.verified.json").write_text("{}")
+
+    async with await _client(serve_app.app) as c:
+        r = await c.get("/api/bundles")
+    bundle = r.json()["bundles"][0]
+    assert bundle["verified_at"] is not None
+    # ISO format with timezone.
+    assert "T" in bundle["verified_at"]
+
+
+async def test_list_bundles_malformed_bundle_doesnt_break_index(serve_app, tmp_path: Path) -> None:
+    """If one bundle.json is corrupted, the index still lists it (so the
+    user can spot the problem) but with null metadata."""
+    verifier_dir = tmp_path / "data" / "verifier"
+    verifier_dir.mkdir(parents=True)
+    (verifier_dir / "broken.bundle.json").write_text("not json {{ \\")
+    _write_bundle(verifier_dir, "good", "ok")
+    async with await _client(serve_app.app) as c:
+        r = await c.get("/api/bundles")
+    bundles = r.json()["bundles"]
+    by_stem = {b["stem"]: b for b in bundles}
+    assert "broken" in by_stem
+    assert by_stem["broken"]["page_date_raw"] is None
+    assert by_stem["broken"]["status"] == "incomplete"
+    assert by_stem["good"]["page_date_raw"] == "ok"
+
+
 async def test_save_skips_db_when_no_jobs_db_file(serve_app, tmp_path: Path) -> None:
     """If `data/jobs.db` doesn't exist (no pipeline has run), Save still
     succeeds — no DB integration is attempted."""
diff --git a/verifier/README.md b/verifier/README.md
index ef96db5..39d31e3 100644
--- a/verifier/README.md
+++ b/verifier/README.md
@@ -14,15 +14,15 @@ The verifier ships with a tiny FastAPI server that does two things:
 .venv/bin/python verifier/serve.py
 # default port is 8765; override with VERIFIER_PORT=9000 .venv/bin/python verifier/serve.py
 
-# then open in a browser:
-open "http://localhost:8765/verifier/?bundle=/data/verifier/<stem>.bundle.json"
+# then open the index:
+open "http://localhost:8765/verifier/"
 ```
 
-If you want only the static side and don't need the artist-lookup button, `python -m http.server 8765` from the repo root still works — the Check-artists button will return 404s but everything else functions.
+The index page lists every bundle in `data/verifier/` with its verification state and an **Open next page that needs work** button. Click a row to open it. The status badge on each row mirrors the same state machine as the in-edit pill: `incomplete` (no save yet), `partial` (saved as draft), `complete` (marked complete).
 
-The `?bundle=...` URL param is the recommended path: the UI fetches the bundle, then resolves the bundle's `image_path` (relative path inside the JSON) and fetches the image too.
+The `?bundle=<path>` URL is still the way to deep-link a specific page (e.g., bookmarks, share links). Edit-mode navigation also exposes Prev / Next buttons and the keyboard shortcuts (`?` to see all).
 
-You can also load a bundle via the **Load bundle** file picker, in which case a second **Load image** picker appears. This path works without a server but you must pick both files manually.
+You can also load a bundle via the **Load image** file picker if the page is served statically and the relative image path can't be fetched.
 
 ## File layout
 
@@ -104,15 +104,25 @@ tests/golden/<stem>.truth.json          # derive_truth output (optional destinat
 
 ## Saving
 
-Clicking **Save** POSTs the current edit state to the server's `/api/save` endpoint, which:
+Two buttons share the right side of the header: **Save** and **Mark complete**. Both POST to `/api/save`. The only difference is the `status` field in the body — `Save` omits it (treated as `draft`), `Mark complete` sends `"complete"`.
 
-1. Writes `data/verifier/<stem>.verified.json` — `PageResult`-shaped JSON validating against `core.schema.PageResult`. Bundle-only fields (`schema_version`, `stem`, `image_path`, `pdf_path`, `page_number`, per-entry `row_bbox`) are stripped before validation. Rows marked ✗ are excluded. Rows added via **+ add row** are included.
-2. Writes `data/verifier/<stem>.corrections.json` — the delta between the loaded bundle and the verified state (shape below).
-3. If the bundle has a non-null `pdf_path` + `page_number` (production-pipeline pages do; test fixtures don't), updates the matching `jobs.db` row via `JobStore.mark_verified` — setting `verified_at`, `verified_path`, and `corrections_path`.
+Status semantics:
 
-The status bar reports the destination files and whether `jobs.db` was updated:
+- **Incomplete** — no `<stem>.corrections.json` on disk. The bundle has never been saved.
+- **Partial** — `corrections.json` exists with `"status": "draft"`. The user is in progress.
+- **Complete** — `corrections.json` has `"status": "complete"`. The user explicitly marked the page done.
 
-> Saved data/verifier/X.verified.json + data/verifier/X.corrections.json · 4 field correction(s), 0 added, 0 deleted · jobs.db updated.
+The server runs a small preservation rule so a plain Save on an already-complete page **does not** downgrade it. The user can refine details on a complete page without re-marking it. (If we ever need a "Revert to draft" affordance, that's a separate ticket.)
+
+Save's three side effects:
+
+1. Writes `data/verifier/<stem>.verified.json` — `PageResult`-shaped JSON validating against `core.schema.PageResult`. Bundle-only fields are stripped before validation. Rows marked ✗ are excluded; rows added via **+ add row** are included.
+2. Writes `data/verifier/<stem>.corrections.json` — the delta between the loaded bundle and the verified state, plus a top-level `"status"` field.
+3. If the bundle has a non-null `pdf_path` + `page_number`, updates the matching `jobs.db` row via `JobStore.mark_verified`.
+
+The status bar reports the destination files, status, and whether `jobs.db` was updated:
+
+> Saved as complete · data/verifier/X.verified.json + data/verifier/X.corrections.json · 4 field correction(s), 0 added, 0 deleted · jobs.db updated.
 
 If you'd rather have a downloadable file, open the saved JSON from `data/verifier/` directly.
 
@@ -166,6 +176,24 @@ Badge states:
 
 The lookup goes through request-o-matic's LLM-driven request parser (artist normalization, fuzzy matching) before hitting the LML library search. The badge reflects request-o-matic's `library_results` and `artwork` fields — not LML's `/api/v1/lookup` directly, since the LLM correction layer is the load-bearing piece.
 
+## Keyboard shortcuts
+
+Press `?` anywhere in the editor to see the overlay. The current set:
+
+| Key | Action |
+|---|---|
+| ⌘S / Ctrl+S | Save (draft) |
+| ⌘⇧S / Ctrl+Shift+S | Mark complete |
+| j / ⌘↓ | Focus next row's `raw_text` |
+| k / ⌘↑ | Focus previous row |
+| ⌘D / Ctrl+D | Toggle ✗ (delete) on focused row |
+| n | Next bundle |
+| p | Previous bundle |
+| ? | Toggle shortcut overlay |
+| Esc | Close overlay |
+
+The single-letter keys (`j`, `k`, `n`, `p`, `?`) are ignored when the keyboard focus is in an `<input>`, `<textarea>`, or `<select>` — so typing in a row's text field works normally.
+
 ## Known rough edges (v1)
 
 - **No autosave / localStorage.** Close the tab and unsaved edits are lost. Export before navigating away.
diff --git a/verifier/app.js b/verifier/app.js
index b251f35..14c6d86 100644
--- a/verifier/app.js
+++ b/verifier/app.js
@@ -1,22 +1,25 @@
 // Flowsheet verifier — vanilla JS, no build step.
 //
-// Loads a bundle.json (produced by scripts/make_verifier_bundle.py) plus
-// the page image it references, renders per-row canvas crops next to
-// editable text fields, and on Save POSTs two files to /api/save:
-//   1. <stem>.verified.json — PageResult-shaped corrected page
-//   2. <stem>.corrections.json — delta vs the original bundle
+// Two modes, switched on the presence of `?bundle=` in the URL:
 //
-// Two load paths are supported:
-//   1. Server-served bundle: fetch(bundle) then fetch(image) by relative
-//      URL. Used when the page is served via `python verifier/serve.py`.
-//   2. File-picker bundle: read the bundle as text, then prompt for the
-//      image file separately.
+//   1. INDEX mode (no ?bundle=): show the list of every bundle in
+//      data/verifier/ with status (incomplete / partial / complete),
+//      plus an "Open next incomplete" jump button.
+//
+//   2. EDIT mode (?bundle=<path>): the legacy per-page editor. Renders
+//      per-row canvas crops next to editable text fields. Save POSTs to
+//      /api/save which writes <stem>.verified.json + <stem>.corrections.json
+//      and updates jobs.db when a job key is present. Mark complete sends
+//      the same payload with status="complete".
 //
 // State is split:
 //   state.originalBundle  — immutable snapshot of the loaded bundle. Never
 //                           mutated; used as the diff baseline on save.
 //   state.bundle          — working copy. Mutated by edits and UI flags
 //                           (`_added`, `_deleted`).
+//   state.bundleList      — cached /api/bundles response, used by Prev/Next
+//                           and the keyboard shortcuts. Refreshed after a
+//                           successful save so the status pill reflects truth.
 
 "use strict";
 
@@ -27,6 +30,8 @@ const state = {
   originalBundle: null,    // immutable snapshot for diffing
   pageImage: null,         // HTMLImageElement
   lookupConcurrency: 4,    // parallel /api/lookup requests
+  bundleList: null,        // cached array from /api/bundles
+  focusedRowIndex: null,   // for j/k keyboard nav across rows
 };
 
 const $ = (sel, root = document) => root.querySelector(sel);
@@ -118,6 +123,7 @@ function finishInit() {
   );
   $("#app").hidden = false;
   $("#save-verified").disabled = false;
+  $("#mark-complete").disabled = false;
   $("#toggle-page-view").disabled = false;
   $("#check-artists").disabled = false;
   $("#page-view-img").src = state.pageImage.src;
@@ -126,6 +132,77 @@ function finishInit() {
   // Show the full-page reference by default; verifiers asked for this
   // because the row crops need page context to be useful.
   togglePageView();
+  // Best-effort: fetch the bundle list to enable Prev/Next and the
+  // status pill. Failures don't block editing.
+  refreshNavFromBundleList().catch(() => {});
+}
+
+// ---- nav + status pill --------------------------------------------------
+
+async function fetchBundleList() {
+  const r = await fetch("/api/bundles");
+  if (!r.ok) throw new Error(`/api/bundles ${r.status}`);
+  const data = await r.json();
+  state.bundleList = data.bundles || [];
+  return state.bundleList;
+}
+
+// Find the current bundle's position in state.bundleList. Returns -1 if
+// the current bundle isn't in the list (e.g., picked via file-picker, or
+// the bundle was removed between page loads).
+function currentBundleIndex() {
+  if (!state.bundle || !state.bundleList) return -1;
+  return state.bundleList.findIndex(b => b.stem === state.bundle.stem);
+}
+
+async function refreshNavFromBundleList() {
+  if (!state.bundle) return;
+  try {
+    await fetchBundleList();
+  } catch (err) {
+    // Non-fatal — Prev/Next stay disabled, no status pill.
+    console.warn("bundle list fetch failed:", err);
+    return;
+  }
+  const idx = currentBundleIndex();
+  const total = state.bundleList.length;
+  const posEl = $("#nav-position");
+  const prevBtn = $("#prev-page");
+  const nextBtn = $("#next-page");
+  if (idx >= 0) {
+    posEl.textContent = `${idx + 1} / ${total}`;
+    prevBtn.disabled = idx === 0;
+    nextBtn.disabled = idx === total - 1;
+  } else {
+    posEl.textContent = `? / ${total}`;
+    prevBtn.disabled = true;
+    nextBtn.disabled = true;
+  }
+  updateStatusPill(state.bundleList[idx]?.status ?? "incomplete");
+}
+
+function updateStatusPill(status) {
+  const pill = $("#status-pill");
+  pill.hidden = false;
+  pill.className = `status-pill status-${status}`;
+  pill.textContent = status;
+}
+
+function navigateTo(bundle) {
+  if (!bundle?.url) return;
+  location.href = bundle.url;
+}
+
+function navigatePrev() {
+  const idx = currentBundleIndex();
+  if (idx > 0) navigateTo(state.bundleList[idx - 1]);
+}
+
+function navigateNext() {
+  const idx = currentBundleIndex();
+  if (idx >= 0 && idx < state.bundleList.length - 1) {
+    navigateTo(state.bundleList[idx + 1]);
+  }
 }
 
 // ---- render: page meta ---------------------------------------------------
@@ -425,12 +502,17 @@ function buildCorrectionsExport() {
 
 // ---- file-download helpers -----------------------------------------------
 
-async function saveAll() {
+async function saveAll(requestedStatus = null) {
+  // requestedStatus = "complete" when user clicked Mark complete; null
+  // for a plain Save (the server applies the preservation rule — an
+  // already-complete page stays complete).
   if (!state.bundle) return;
-  const btn = $("#save-verified");
+  const btn = requestedStatus === "complete" ? $("#mark-complete") : $("#save-verified");
+  const otherBtn = requestedStatus === "complete" ? $("#save-verified") : $("#mark-complete");
   btn.disabled = true;
+  otherBtn.disabled = true;
   const original = btn.textContent;
-  btn.textContent = "Saving…";
+  btn.textContent = requestedStatus === "complete" ? "Marking…" : "Saving…";
 
   const verified = buildVerifiedExport();
   const corrections = buildCorrectionsExport();
@@ -441,6 +523,7 @@ async function saveAll() {
     verified,
     corrections,
   };
+  if (requestedStatus) body.status = requestedStatus;
 
   try {
     const r = await fetch("/api/save", {
@@ -462,19 +545,26 @@ async function saveAll() {
       : (body.pdf_path && body.page_number != null
           ? "no matching job row (files only)"
           : "files only (no job key)");
+    updateStatusPill(result.status === "complete" ? "complete" : "partial");
     setStatus(
-      `Saved ${result.verified_path} + ${result.corrections_path} · ` +
+      `Saved as ${result.status} · ${result.verified_path} + ${result.corrections_path} · ` +
       `${n} field correction(s), ${corrections.added_rows.length} added, ` +
       `${corrections.deleted_rows.length} deleted · ${dbBit}.`
     );
+    // Refresh the cached bundle list so Prev/Next reflects the new status.
+    refreshNavFromBundleList().catch(() => {});
   } catch (err) {
     setStatus(`Save failed: ${err.message}`, "error");
   } finally {
     btn.disabled = false;
+    otherBtn.disabled = false;
     btn.textContent = original;
   }
 }
 
+const saveDraft = () => saveAll(null);
+const markComplete = () => saveAll("complete");
+
 // ---- artist/track lookup (request-o-matic via /api/lookup proxy) --------
 
 async function lookupOne(message) {
@@ -717,20 +807,199 @@ function togglePageView() {
   btn.textContent = open ? "Hide page" : "Show page";
 }
 
+// ---- index mode ----------------------------------------------------------
+
+async function showIndex() {
+  $("#index-header").hidden = false;
+  $("#index").hidden = false;
+  const statusEl = $("#index-status");
+  statusEl.textContent = "Loading…";
+  try {
+    await fetchBundleList();
+    renderBundleList();
+  } catch (err) {
+    statusEl.textContent = `Failed to load bundle list: ${err.message}`;
+    return;
+  }
+  const incompleteCount = state.bundleList.filter(b => b.status !== "complete").length;
+  if (incompleteCount > 0) {
+    $("#open-next-incomplete").disabled = false;
+    $("#open-next-incomplete").addEventListener("click", openNextIncomplete);
+  }
+  const counts = {
+    incomplete: state.bundleList.filter(b => b.status === "incomplete").length,
+    partial: state.bundleList.filter(b => b.status === "partial").length,
+    complete: state.bundleList.filter(b => b.status === "complete").length,
+  };
+  statusEl.textContent =
+    `${state.bundleList.length} bundle(s): ` +
+    `${counts.incomplete} incomplete · ${counts.partial} partial · ${counts.complete} complete.`;
+}
+
+function renderBundleList() {
+  const tbody = $("#bundle-list tbody");
+  tbody.innerHTML = "";
+  for (const bundle of state.bundleList) {
+    const tr = document.createElement("tr");
+    tr.dataset.stem = bundle.stem;
+    tr.classList.toggle("is-complete", bundle.status === "complete");
+
+    const statusTd = document.createElement("td");
+    const pill = document.createElement("span");
+    pill.className = `status-pill status-${bundle.status}`;
+    pill.textContent = bundle.status;
+    statusTd.appendChild(pill);
+    tr.appendChild(statusTd);
+
+    const stemTd = document.createElement("td");
+    stemTd.className = "stem";
+    stemTd.textContent = bundle.stem;
+    tr.appendChild(stemTd);
+
+    const dateTd = document.createElement("td");
+    dateTd.textContent = bundle.page_date_raw || "—";
+    tr.appendChild(dateTd);
+
+    const tsTd = document.createElement("td");
+    tsTd.className = "timestamp";
+    tsTd.textContent = bundle.verified_at
+      ? new Date(bundle.verified_at).toLocaleString()
+      : "—";
+    tr.appendChild(tsTd);
+
+    tr.addEventListener("click", () => navigateTo(bundle));
+    tbody.appendChild(tr);
+  }
+}
+
+function openNextIncomplete() {
+  if (!state.bundleList) return;
+  const next = state.bundleList.find(b => b.status !== "complete");
+  if (next) {
+    navigateTo(next);
+  } else {
+    $("#index-status").textContent = "All pages complete!";
+  }
+}
+
+// ---- keyboard shortcuts --------------------------------------------------
+
+function isEditableTarget(target) {
+  if (!target) return false;
+  const tag = target.tagName;
+  return (
+    tag === "INPUT" || tag === "TEXTAREA" || tag === "SELECT" || target.isContentEditable
+  );
+}
+
+function focusedRowEl() {
+  if (state.focusedRowIndex == null) return null;
+  const rows = $$(".row");
+  return rows[state.focusedRowIndex] || null;
+}
+
+function setFocusedRow(idx) {
+  const rows = $$(".row");
+  if (idx < 0 || idx >= rows.length) return;
+  $$(".row.is-focused").forEach(el => el.classList.remove("is-focused"));
+  state.focusedRowIndex = idx;
+  const target = rows[idx];
+  target.classList.add("is-focused");
+  target.scrollIntoView({ block: "nearest", behavior: "smooth" });
+  const input = $(".raw-text", target);
+  if (input) input.focus();
+}
+
+function focusNextRow(delta) {
+  const rows = $$(".row");
+  if (!rows.length) return;
+  let next = state.focusedRowIndex == null
+    ? (delta > 0 ? 0 : rows.length - 1)
+    : state.focusedRowIndex + delta;
+  next = Math.max(0, Math.min(rows.length - 1, next));
+  setFocusedRow(next);
+}
+
+function toggleShortcutOverlay() {
+  const o = $("#shortcut-overlay");
+  o.hidden = !o.hidden;
+}
+
+function installKeyboardShortcuts() {
+  document.addEventListener("keydown", (e) => {
+    // Esc closes overlay regardless of focus.
+    if (e.key === "Escape" && !$("#shortcut-overlay").hidden) {
+      toggleShortcutOverlay();
+      e.preventDefault();
+      return;
+    }
+    // ⌘S / Ctrl+S → save. Works even when an input has focus.
+    if ((e.metaKey || e.ctrlKey) && e.key.toLowerCase() === "s") {
+      e.preventDefault();
+      if (e.shiftKey) markComplete();
+      else saveDraft();
+      return;
+    }
+    // ⌘D / Ctrl+D → toggle delete on focused row. Also works in inputs.
+    if ((e.metaKey || e.ctrlKey) && e.key.toLowerCase() === "d") {
+      const row = focusedRowEl();
+      if (row) {
+        const btn = row.querySelector(".delete-row");
+        if (btn) {
+          btn.click();
+          e.preventDefault();
+        }
+      }
+      return;
+    }
+    // Non-modifier letter shortcuts are ignored when an input has focus,
+    // so the verifier can type normally.
+    if (isEditableTarget(e.target)) return;
+    if (e.key === "?" || (e.shiftKey && e.key === "/")) {
+      toggleShortcutOverlay();
+      e.preventDefault();
+    } else if (e.key === "j" || (e.metaKey && e.key === "ArrowDown")) {
+      focusNextRow(1);
+      e.preventDefault();
+    } else if (e.key === "k" || (e.metaKey && e.key === "ArrowUp")) {
+      focusNextRow(-1);
+      e.preventDefault();
+    } else if (e.key === "n") {
+      navigateNext();
+      e.preventDefault();
+    } else if (e.key === "p") {
+      navigatePrev();
+      e.preventDefault();
+    }
+  });
+  // Click outside the overlay card closes it.
+  $("#shortcut-overlay").addEventListener("click", (e) => {
+    if (e.target.id === "shortcut-overlay") toggleShortcutOverlay();
+  });
+}
+
 // ---- wiring --------------------------------------------------------------
 
 document.addEventListener("DOMContentLoaded", async () => {
-  $("#bundle-input").addEventListener("change", (e) => {
-    const file = e.target.files?.[0];
-    if (file) loadBundleFromFile(file);
-  });
+  installKeyboardShortcuts();
+  const params = new URLSearchParams(location.search);
+  const hasBundle = !!params.get("bundle");
+  if (!hasBundle) {
+    await showIndex();
+    return;
+  }
+  // Edit mode.
+  $("#edit-header").hidden = false;
   $("#image-input").addEventListener("change", (e) => {
     const file = e.target.files?.[0];
     if (file) loadImageFromFile(file);
   });
-  $("#save-verified").addEventListener("click", saveAll);
+  $("#save-verified").addEventListener("click", saveDraft);
+  $("#mark-complete").addEventListener("click", markComplete);
   $("#toggle-page-view").addEventListener("click", togglePageView);
   $("#check-artists").addEventListener("click", checkArtists);
+  $("#prev-page").addEventListener("click", navigatePrev);
+  $("#next-page").addEventListener("click", navigateNext);
 
   await loadBundleFromUrlParam();
 });
diff --git a/verifier/index.html b/verifier/index.html
index 22270ae..473fecb 100644
--- a/verifier/index.html
+++ b/verifier/index.html
@@ -7,21 +7,33 @@
   <link rel="stylesheet" href="styles.css">
 </head>
 <body>
-  <header>
+  <!-- Index-mode header (shown when no ?bundle= is set). -->
+  <header id="index-header" hidden>
     <h1>Flowsheet verifier</h1>
     <div class="controls">
-      <label class="file-picker">
-        <span>Load bundle</span>
-        <input type="file" id="bundle-input" accept=".json">
-      </label>
+      <button id="open-next-incomplete" disabled>Open next page that needs work</button>
+      <span id="index-status"></span>
+    </div>
+  </header>
+
+  <!-- Edit-mode header (shown when ?bundle= is set). -->
+  <header id="edit-header" hidden>
+    <h1>Flowsheet verifier</h1>
+    <div class="controls">
+      <a id="back-to-index" href="/verifier/">← All pages</a>
+      <button id="prev-page" disabled title="Previous bundle (p)">◀ Prev</button>
+      <span id="nav-position"></span>
+      <button id="next-page" disabled title="Next bundle (n)">Next ▶</button>
+      <span class="status-pill" id="status-pill" hidden></span>
       <label class="file-picker" id="image-picker" hidden>
         <span>Load image</span>
         <input type="file" id="image-input" accept="image/png,image/jpeg">
       </label>
-      <button id="toggle-page-view" disabled>Show page</button>
+      <button id="toggle-page-view" disabled title="Toggle full-page reference (?)">Show page</button>
       <button id="check-artists" disabled title="Look up each row's artist/track via the WXYC library (request-o-matic)">Check artists</button>
-      <button id="save-verified" disabled title="Persist this session: writes verified + corrections JSON to data/verifier/ and (when a job row exists) records the verification in jobs.db">Save</button>
-      <span id="status">Pick a bundle.json to begin.</span>
+      <button id="save-verified" disabled title="Save current state as draft (⌘S)">Save</button>
+      <button id="mark-complete" disabled title="Mark this page complete (⌘⇧S)">Mark complete</button>
+      <span id="status">Loading bundle…</span>
     </div>
   </header>
 
@@ -29,6 +41,24 @@ <h1>Flowsheet verifier</h1>
     <img id="page-view-img" alt="Full page">
   </aside>
 
+  <!-- Index mode body. -->
+  <main id="index" hidden>
+    <section id="bundle-list-wrapper">
+      <table id="bundle-list">
+        <thead>
+          <tr>
+            <th>Status</th>
+            <th>Stem</th>
+            <th>page_date_raw</th>
+            <th>Last saved</th>
+          </tr>
+        </thead>
+        <tbody></tbody>
+      </table>
+    </section>
+  </main>
+
+  <!-- Edit mode body. -->
   <main id="app" hidden>
     <section id="page-meta">
       <h2>Page</h2>
@@ -50,6 +80,25 @@ <h2>Page</h2>
     </section>
   </main>
 
+  <!-- Keyboard shortcut overlay (toggled by `?`). -->
+  <div id="shortcut-overlay" hidden>
+    <div class="overlay-card">
+      <h2>Keyboard shortcuts</h2>
+      <dl>
+        <dt>⌘S / Ctrl+S</dt>          <dd>Save (draft)</dd>
+        <dt>⌘⇧S / Ctrl+Shift+S</dt>   <dd>Mark complete</dd>
+        <dt>j / ⌘↓</dt>                <dd>Focus next row's raw_text</dd>
+        <dt>k / ⌘↑</dt>                <dd>Focus previous row</dd>
+        <dt>⌘D / Ctrl+D</dt>           <dd>Toggle ✗ (delete) on current row</dd>
+        <dt>n</dt>                     <dd>Next bundle</dd>
+        <dt>p</dt>                     <dd>Previous bundle</dd>
+        <dt>?</dt>                     <dd>Toggle this overlay</dd>
+        <dt>Esc</dt>                   <dd>Close overlay</dd>
+      </dl>
+      <p class="overlay-note">Shortcuts ignore key events that target inputs/textareas/selects (so you can type normally). j/k/n/p require the keyboard focus to be outside an editable field.</p>
+    </div>
+  </div>
+
   <template id="quadrant-template">
     <article class="quadrant">
       <header class="quadrant-header">
diff --git a/verifier/serve.py b/verifier/serve.py
index f58a804..efae9d1 100644
--- a/verifier/serve.py
+++ b/verifier/serve.py
@@ -10,7 +10,12 @@
                         <stem>.verified.json and <stem>.corrections.json
                         into data/verifier/, and (when the bundle carries
                         a `pdf_path`/`page_number` pair) updates
-                        `jobs.db` via `JobStore.mark_verified`.
+                        `jobs.db` via `JobStore.mark_verified`. Honors
+                        an optional `status` field with preservation
+                        semantics — see the handler docstring.
+  GET  /api/bundles   — list every bundle in data/verifier/ with its
+                        verification state (incomplete / partial /
+                        complete) for the index page and Prev/Next nav.
 
 Run:
 
@@ -129,6 +134,37 @@ async def lookup(request: Request) -> JSONResponse:
     return JSONResponse(r.json())
 
 
+_VALID_STATUSES = frozenset({"draft", "complete"})
+
+
+def _resolve_status(incoming: str | None, corrections_path: Path) -> str:
+    """Compute the corrections.json `status` field for this save.
+
+    Rules (matching the UI's two-button design):
+      - `"complete"` from the client wins outright (user clicked
+        "Mark complete").
+      - Otherwise, if the existing corrections.json on disk has
+        `"status": "complete"`, preserve it. A plain Save on an
+        already-complete page is a "refine in place" edit, not a
+        downgrade. The user can revert by re-saving via a future
+        "Revert to draft" affordance if we add one.
+      - Otherwise (incoming is `"draft"`, None, or unknown), the page
+        is a draft.
+
+    Returns one of `"draft"` or `"complete"`.
+    """
+    if incoming == "complete":
+        return "complete"
+    if corrections_path.is_file():
+        try:
+            existing = json.loads(corrections_path.read_text())
+        except Exception:  # noqa: BLE001
+            existing = {}
+        if existing.get("status") == "complete":
+            return "complete"
+    return "draft"
+
+
 @app.post("/api/save")
 async def save(request: Request) -> JSONResponse:
     """Persist a verifier UI session to disk and (optionally) `jobs.db`.
@@ -139,13 +175,19 @@ async def save(request: Request) -> JSONResponse:
           "stem": "<page stem>",
           "pdf_path": "<rel path to PDF>" | null,
           "page_number": <int> | null,
+          "status": "draft" | "complete" | null,
           "verified": { ...PageResult... },
           "corrections": { ...corrections... }
         }
 
     Writes:
       - `data/verifier/<stem>.verified.json`  (validated as PageResult)
-      - `data/verifier/<stem>.corrections.json` (verbatim JSON)
+      - `data/verifier/<stem>.corrections.json` (verbatim JSON +
+        server-resolved `status` field)
+
+    Status resolution: `"complete"` wins; otherwise an existing
+    on-disk `"complete"` is preserved across plain Saves. See
+    `_resolve_status` for the table.
 
     If `pdf_path` and `page_number` are present, also calls
     `JobStore.mark_verified` to record the verification in `jobs.db`.
@@ -162,11 +204,20 @@ async def save(request: Request) -> JSONResponse:
     corrections = payload.get("corrections")
     pdf_path = payload.get("pdf_path")
     page_number = payload.get("page_number")
+    incoming_status = payload.get("status")
     if verified is None or corrections is None:
         raise HTTPException(
             status_code=400,
             detail="body must include `verified` and `corrections` objects",
         )
+    if incoming_status is not None and incoming_status not in _VALID_STATUSES:
+        raise HTTPException(
+            status_code=400,
+            detail=(
+                f"status must be one of {sorted(_VALID_STATUSES)} or omitted, "
+                f"got {incoming_status!r}"
+            ),
+        )
 
     # Validate verified against PageResult and keep the parsed model so
     # the on-disk JSON is the Pydantic-normalized round-trip rather than
@@ -184,8 +235,12 @@ async def save(request: Request) -> JSONResponse:
     VERIFIER_DIR.mkdir(parents=True, exist_ok=True)
     verified_path = VERIFIER_DIR / f"{stem}.verified.json"
     corrections_path = VERIFIER_DIR / f"{stem}.corrections.json"
+    # Resolve status BEFORE we overwrite the existing corrections file,
+    # so the preservation rule can see the prior on-disk value.
+    resolved_status = _resolve_status(incoming_status, corrections_path)
+    corrections_with_status = {"status": resolved_status, **(corrections or {})}
     _atomic_write_text(verified_path, validated.model_dump_json(indent=2))
-    _atomic_write_text(corrections_path, json.dumps(corrections, indent=2))
+    _atomic_write_text(corrections_path, json.dumps(corrections_with_status, indent=2))
 
     db_updated = False
     # `isinstance(x, int)` is True for `bool` in Python — explicitly reject
@@ -211,10 +266,102 @@ async def save(request: Request) -> JSONResponse:
             "verified_path": str(verified_path.relative_to(DATA_ROOT.parent)),
             "corrections_path": str(corrections_path.relative_to(DATA_ROOT.parent)),
             "db_updated": db_updated,
+            "status": resolved_status,
         }
     )
 
 
+@app.get("/api/bundles")
+async def list_bundles() -> JSONResponse:
+    """Enumerate every bundle in data/verifier/ with its verification state.
+
+    The state machine: `incomplete` (no corrections.json yet), `partial`
+    (corrections.json with `status="draft"`), `complete` (corrections.json
+    with `status="complete"`). Legacy corrections.json files without a
+    `status` field default to `partial` — they were saved before status
+    tracking landed, so they're at least in-progress.
+
+    Returns:
+        {
+          "bundles": [
+            {
+              "stem": "...",
+              "page_date_raw": "..." | null,
+              "pdf_path": "..." | null,
+              "page_number": int | null,
+              "status": "incomplete" | "partial" | "complete",
+              "verified_at": "<ISO timestamp>" | null,
+              "url": "/verifier/?bundle=/data/verifier/<stem>.bundle.json"
+            },
+            ...
+          ]
+        }
+
+    Sorted by stem so navigation is deterministic and matches alphanumeric
+    page order (which the WXYC stem format respects: `page05 < page25`).
+    """
+    if not VERIFIER_DIR.is_dir():
+        return JSONResponse({"bundles": []})
+
+    bundles_out: list[dict[str, object]] = []
+    for bundle_path in sorted(VERIFIER_DIR.glob("*.bundle.json")):
+        stem = bundle_path.name.removesuffix(".bundle.json")
+        try:
+            bundle = json.loads(bundle_path.read_text())
+        except Exception:  # noqa: BLE001
+            # A malformed bundle file shouldn't break the whole index —
+            # surface it as incomplete with null metadata so it still
+            # appears and the user can see something's off.
+            bundle = {}
+
+        corrections_path = VERIFIER_DIR / f"{stem}.corrections.json"
+        verified_path = VERIFIER_DIR / f"{stem}.verified.json"
+        status, verified_at = _bundle_state(corrections_path, verified_path)
+
+        bundles_out.append(
+            {
+                "stem": stem,
+                "page_date_raw": bundle.get("page_date_raw"),
+                "pdf_path": bundle.get("pdf_path"),
+                "page_number": bundle.get("page_number"),
+                "status": status,
+                "verified_at": verified_at,
+                "url": f"/verifier/?bundle=/data/verifier/{stem}.bundle.json",
+            }
+        )
+
+    return JSONResponse({"bundles": bundles_out})
+
+
+def _bundle_state(corrections_path: Path, verified_path: Path) -> tuple[str, str | None]:
+    """Derive (status, verified_at) for one bundle from disk.
+
+    `verified_at` is the mtime of `<stem>.verified.json` if it exists;
+    None otherwise. Reflects when the last Save / Mark-complete happened.
+    """
+    if not corrections_path.is_file():
+        return ("incomplete", None)
+    try:
+        corrections = json.loads(corrections_path.read_text())
+    except Exception:  # noqa: BLE001
+        corrections = {}
+    raw_status = corrections.get("status")
+    if raw_status == "complete":
+        status = "complete"
+    else:
+        # Anything else (`draft`, missing, malformed) is `partial`. Legacy
+        # corrections.json files written before status tracking landed end
+        # up here, which is the right semantic — they're saved, not done.
+        status = "partial"
+
+    verified_at: str | None = None
+    if verified_path.is_file():
+        from datetime import UTC, datetime
+
+        verified_at = datetime.fromtimestamp(verified_path.stat().st_mtime, tz=UTC).isoformat()
+    return (status, verified_at)
+
+
 # Static mounts. Each top-level dir we need to serve gets its own mount so
 # the URL structure mirrors the repo layout — `image_path` in bundles is
 # relative (`../pages/.../page-NN.png`), and the UI fetches relative to
diff --git a/verifier/styles.css b/verifier/styles.css
index 203c937..125c308 100644
--- a/verifier/styles.css
+++ b/verifier/styles.css
@@ -34,6 +34,140 @@ body > header h1 {
   font-weight: 600;
 }
 
+#back-to-index {
+  color: var(--accent);
+  text-decoration: none;
+  font-size: 13px;
+}
+
+#back-to-index:hover { text-decoration: underline; }
+
+#nav-position {
+  color: var(--muted);
+  font-size: 12px;
+  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
+}
+
+/* Status pill in the edit header. */
+.status-pill {
+  font-size: 11px;
+  font-weight: 600;
+  padding: 3px 10px;
+  border-radius: 12px;
+  text-transform: uppercase;
+  letter-spacing: 0.05em;
+}
+.status-pill.status-incomplete { background: #f0f0e8; color: var(--muted); border: 1px solid var(--border); }
+.status-pill.status-partial    { background: #fff5e0; color: #8a5a00; border: 1px solid #ecd9a8; }
+.status-pill.status-complete   { background: #e6f5e6; color: #1f6f1f; border: 1px solid #b8e0b8; }
+
+/* Index-mode table. */
+#bundle-list {
+  width: 100%;
+  border-collapse: collapse;
+  background: white;
+  border: 1px solid var(--border);
+  border-radius: 6px;
+  overflow: hidden;
+}
+
+#bundle-list th,
+#bundle-list td {
+  text-align: left;
+  padding: 8px 12px;
+  border-bottom: 1px solid var(--border);
+  font-size: 14px;
+}
+
+#bundle-list th {
+  background: #f0f0e8;
+  font-weight: 600;
+  font-size: 12px;
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+  color: var(--muted);
+}
+
+#bundle-list tbody tr {
+  cursor: pointer;
+}
+
+#bundle-list tbody tr:hover {
+  background: #fafafa;
+}
+
+#bundle-list tbody tr.is-complete td:not(:first-child) {
+  color: var(--muted);
+}
+
+#bundle-list td.stem {
+  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
+  font-size: 13px;
+}
+
+#bundle-list td.timestamp {
+  color: var(--muted);
+  font-size: 12px;
+  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
+}
+
+/* Keyboard-shortcut overlay. */
+#shortcut-overlay {
+  position: fixed;
+  inset: 0;
+  background: rgba(0, 0, 0, 0.4);
+  z-index: 200;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+}
+
+#shortcut-overlay .overlay-card {
+  background: white;
+  padding: 24px 32px;
+  border-radius: 8px;
+  max-width: 520px;
+  box-shadow: 0 6px 24px rgba(0, 0, 0, 0.2);
+}
+
+#shortcut-overlay h2 {
+  margin: 0 0 16px 0;
+  font-size: 16px;
+}
+
+#shortcut-overlay dl {
+  display: grid;
+  grid-template-columns: max-content 1fr;
+  column-gap: 16px;
+  row-gap: 6px;
+  margin: 0;
+  font-size: 13px;
+}
+
+#shortcut-overlay dt {
+  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
+  color: var(--accent);
+  font-weight: 600;
+}
+
+#shortcut-overlay dd {
+  margin: 0;
+  color: var(--fg);
+}
+
+#shortcut-overlay .overlay-note {
+  font-size: 11px;
+  color: var(--muted);
+  margin: 16px 0 0 0;
+  font-style: italic;
+}
+
+/* Row focus highlight (for j/k keyboard nav). */
+.row.is-focused .raw-text {
+  outline: 2px solid var(--accent);
+  outline-offset: -1px;
+}
+
 .controls {
   display: flex;
   gap: 12px;

From 555279470f6c9449e1b73f398f76873490977270 Mon Sep 17 00:00:00 2001
From: Jake Bromberg <jake@funlandresearch.com>
Date: Tue, 12 May 2026 10:00:08 -0700
Subject: [PATCH 2/2] review: address PR #55 feedback
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

MEDIUM findings from the review fixed:

- verifier/serve.py: hoisted the function-local `from datetime import UTC, datetime` out of _bundle_state to the module-level imports, matching the convention everywhere else in the module.

- verifier/app.js: moved the `open-next-incomplete` click handler attachment from showIndex (which is the rendering path) to the one-time DOMContentLoaded wiring. showIndex now just toggles the disabled state on the button. Prevents duplicate listeners if showIndex is ever re-invoked in a future refresh-without-reload flow.

LOW polish:

- verifier/README.md: added a "local-dev tool" warning up front. /api/save and /api/bundles have no auth or CSRF protection, server binds to 127.0.0.1 only — explicit so nobody forwards it to a shared host accidentally.

- verifier/app.js: simplified `e.key === "?" || (e.shiftKey && e.key === "/")` to just `e.key === "?"`. Modern browsers emit `?` for Shift+/ consistently; the OR fallback was defensive but unnecessary.

- verifier/app.js: trust the immediate /api/save response for the status pill. refreshNavFromBundleList now takes a `pillFromList` option (default true for initial load, false on the post-save refresh path) so the pill isn't overwritten from a potentially-stale cached list.

Test coverage:

- New test_save_then_bundles_reflects_status_round_trip exercises the save → list round trip in one test: a draft save and a complete save flip the right entries in /api/bundles, the third bundle stays incomplete. Closes the integration gap between the write path (corrections.json) and the read path (state classification).

495 tests pass, ruff/mypy clean.
---
 tests/unit/test_verifier_serve.py | 43 +++++++++++++++++++++++++++++++
 verifier/README.md                |  2 ++
 verifier/app.js                   | 27 ++++++++++++-------
 verifier/serve.py                 |  3 +--
 4 files changed, 64 insertions(+), 11 deletions(-)

diff --git a/tests/unit/test_verifier_serve.py b/tests/unit/test_verifier_serve.py
index 8da6299..c5a9662 100644
--- a/tests/unit/test_verifier_serve.py
+++ b/tests/unit/test_verifier_serve.py
@@ -476,6 +476,49 @@ async def test_list_bundles_surfaces_verified_at_timestamp(serve_app, tmp_path:
     assert "T" in bundle["verified_at"]
 
 
+async def test_save_then_bundles_reflects_status_round_trip(serve_app, tmp_path: Path) -> None:
+    """End-to-end: save with status=complete, then /api/bundles classifies
+    that bundle as complete; save another with default status, listed as
+    partial; un-saved bundle stays incomplete. Closes the integration gap
+    between the save path and the listing path (they read/write the same
+    corrections.json from different code paths)."""
+    verifier_dir = tmp_path / "data" / "verifier"
+    _write_bundle(verifier_dir, "a-incomplete", "A")
+    _write_bundle(verifier_dir, "b-partial", "B")
+    _write_bundle(verifier_dir, "c-complete", "C")
+
+    async with await _client(serve_app.app) as c:
+        # Save as draft.
+        r = await c.post(
+            "/api/save",
+            json={
+                "stem": "b-partial",
+                "verified": _page_result_dict(),
+                "corrections": _corrections_dict(),
+            },
+        )
+        assert r.json()["status"] == "draft"
+        # Save as complete.
+        r = await c.post(
+            "/api/save",
+            json={
+                "stem": "c-complete",
+                "status": "complete",
+                "verified": _page_result_dict(),
+                "corrections": _corrections_dict(),
+            },
+        )
+        assert r.json()["status"] == "complete"
+        # Now ask /api/bundles to classify all three.
+        r = await c.get("/api/bundles")
+    by_stem = {b["stem"]: b["status"] for b in r.json()["bundles"]}
+    assert by_stem == {
+        "a-incomplete": "incomplete",
+        "b-partial": "partial",
+        "c-complete": "complete",
+    }
+
+
 async def test_list_bundles_malformed_bundle_doesnt_break_index(serve_app, tmp_path: Path) -> None:
     """If one bundle.json is corrupted, the index still lists it (so the
     user can spot the problem) but with null metadata."""
diff --git a/verifier/README.md b/verifier/README.md
index 39d31e3..9cdf724 100644
--- a/verifier/README.md
+++ b/verifier/README.md
@@ -2,6 +2,8 @@
 
 A static, dependency-free single-page app for manually verifying flowsheet extraction output. Each row's cropped image strip is shown next to the model-detected text in an editable field. Hand-correct typos, mark hallucinated rows, add missed rows, then export a `verified.json` that flows back into the pipeline as ground truth.
 
+> **Local-dev tool.** `verifier/serve.py` binds to `127.0.0.1` and has no authentication or CSRF protection on `/api/save` or `/api/bundles`. Do not expose it on a non-loopback interface; in particular, do not run it from a tmux/ssh session forwarded to a shared host without adding auth in front. The bundle-stem path-traversal guard is the only sanitization on writes.
+
 ## Run
 
 The verifier ships with a tiny FastAPI server that does two things:
diff --git a/verifier/app.js b/verifier/app.js
index 14c6d86..5f1fd05 100644
--- a/verifier/app.js
+++ b/verifier/app.js
@@ -155,7 +155,7 @@ function currentBundleIndex() {
   return state.bundleList.findIndex(b => b.stem === state.bundle.stem);
 }
 
-async function refreshNavFromBundleList() {
+async function refreshNavFromBundleList({ pillFromList = true } = {}) {
   if (!state.bundle) return;
   try {
     await fetchBundleList();
@@ -178,7 +178,12 @@ async function refreshNavFromBundleList() {
     prevBtn.disabled = true;
     nextBtn.disabled = true;
   }
-  updateStatusPill(state.bundleList[idx]?.status ?? "incomplete");
+  // After a save the pill is already authoritative from /api/save's
+  // response — skip overwriting it from the (potentially-cached) list.
+  // On the initial load there's no fresher source, so we use the list.
+  if (pillFromList) {
+    updateStatusPill(state.bundleList[idx]?.status ?? "incomplete");
+  }
 }
 
 function updateStatusPill(status) {
@@ -545,14 +550,17 @@ async function saveAll(requestedStatus = null) {
       : (body.pdf_path && body.page_number != null
           ? "no matching job row (files only)"
           : "files only (no job key)");
+    // Trust the immediate response for the pill — it's authoritative for
+    // this save. The follow-up list refresh is silent and updates the
+    // Prev/Next state only (the pill is set just above and not touched
+    // by the refresh path).
     updateStatusPill(result.status === "complete" ? "complete" : "partial");
     setStatus(
       `Saved as ${result.status} · ${result.verified_path} + ${result.corrections_path} · ` +
       `${n} field correction(s), ${corrections.added_rows.length} added, ` +
       `${corrections.deleted_rows.length} deleted · ${dbBit}.`
     );
-    // Refresh the cached bundle list so Prev/Next reflects the new status.
-    refreshNavFromBundleList().catch(() => {});
+    refreshNavFromBundleList({ pillFromList: false }).catch(() => {});
   } catch (err) {
     setStatus(`Save failed: ${err.message}`, "error");
   } finally {
@@ -822,10 +830,7 @@ async function showIndex() {
     return;
   }
   const incompleteCount = state.bundleList.filter(b => b.status !== "complete").length;
-  if (incompleteCount > 0) {
-    $("#open-next-incomplete").disabled = false;
-    $("#open-next-incomplete").addEventListener("click", openNextIncomplete);
-  }
+  $("#open-next-incomplete").disabled = incompleteCount === 0;
   const counts = {
     incomplete: state.bundleList.filter(b => b.status === "incomplete").length,
     partial: state.bundleList.filter(b => b.status === "partial").length,
@@ -955,7 +960,7 @@ function installKeyboardShortcuts() {
     // Non-modifier letter shortcuts are ignored when an input has focus,
     // so the verifier can type normally.
     if (isEditableTarget(e.target)) return;
-    if (e.key === "?" || (e.shiftKey && e.key === "/")) {
+    if (e.key === "?") {
       toggleShortcutOverlay();
       e.preventDefault();
     } else if (e.key === "j" || (e.metaKey && e.key === "ArrowDown")) {
@@ -985,6 +990,10 @@ document.addEventListener("DOMContentLoaded", async () => {
   const params = new URLSearchParams(location.search);
   const hasBundle = !!params.get("bundle");
   if (!hasBundle) {
+    // Wire index-mode controls once, then render. `showIndex` populates
+    // state and toggles the disabled state on this button — the listener
+    // itself stays attached for the lifetime of the page.
+    $("#open-next-incomplete").addEventListener("click", openNextIncomplete);
     await showIndex();
     return;
   }
diff --git a/verifier/serve.py b/verifier/serve.py
index efae9d1..ab3ad2e 100644
--- a/verifier/serve.py
+++ b/verifier/serve.py
@@ -28,6 +28,7 @@
 
 import json
 import os
+from datetime import UTC, datetime
 from pathlib import Path
 
 import httpx
@@ -356,8 +357,6 @@ def _bundle_state(corrections_path: Path, verified_path: Path) -> tuple[str, str
 
     verified_at: str | None = None
     if verified_path.is_file():
-        from datetime import UTC, datetime
-
         verified_at = datetime.fromtimestamp(verified_path.stat().st_mtime, tz=UTC).isoformat()
     return (status, verified_at)