n-seo 0.6.0 → 0.7.0

package/CHANGELOG.md

@@ -8,6 +8,57 @@ uses [Semantic Versioning](https://semver.org/).
 
 Nothing yet.
 
+## [0.7.0] - 2026-09-18
+
+### Added
+- **A site's indexing problems, on its own page.** `/site/<host>` said nothing
+  about indexing, so anyone looking at one site had to leave for `/indexing`
+  and find their host in a list — while the data was already keyed by host and
+  already rendered per host one page over. The site page now carries that
+  host's coverage: indexed against checked, problems grouped by coverage
+  state, never-crawled. The explanations and the Request Indexing verdict come
+  with it, because both pages now render from one component and cannot drift
+  into disagreeing about what Google said. No new pull and no new data file.
+- A host that is all clear, or that has no sitemap Search Console can fetch,
+  says which rather than rendering an empty panel. An empty panel is
+  indistinguishable from a broken one.
+- **Update checking is documented where people schedule things.**
+  `update-check` has been a step in the daily run since 0.4.1 and
+  `modules.updateCheck` is the only module enabled by default, but nothing
+  said so in `docs/SCHEDULING.md` — the one place someone would otherwise
+  conclude they need a second scheduled job for it. They do not: a weekly
+  `n-seo upgrade --check` would ask the registry the same question the daily
+  run already asks and write the answer to a log nobody opens. The Upgrades
+  section of `docs/DEPLOY.md` says the same for a deployed instance, where
+  nobody is watching a terminal and the notice waits on the dashboard.
+
+### Fixed
+- **The package no longer ships Python bytecode.** `files` lists `ops/`,
+  `ingest/` and `probes/` wholesale, and whatever ran the tests before
+  packing left `__pycache__` beside the sources — so a release built on CI
+  carried the runner's `.pyc` files. 0.6.1 shipped thirteen of them, a little
+  over a tenth of the package, compiled for a Python version no user is
+  guaranteed to have. `.gitignore` covers `__pycache__`, which is why this was
+  invisible in a checkout and only appeared in the tarball.
+
+## [0.6.1] - 2026-09-15
+
+### Fixed
+- **The daily log threw away the reason a model call failed.** The llm module
+  reported `stderr` only, but a CLI may put its failure on stdout — `claude`
+  exits 1 and writes "Failed to authenticate" there — so the log read
+  `llm: exit 1:` with nothing after the colon. Every call, cause discarded.
+  It now falls back to stdout. This is the bug that matters here: it turned a
+  one-line diagnosis into a long one, and produced a confident wrong answer
+  along the way.
+- **`doctor` reported a model command as healthy when it could not run.** The
+  check was `shutil.which`: the file exists, therefore fine. A revoked key, a
+  lapsed subscription or an unreadable credential store all leave the binary
+  exactly where it was. It now sends a trivial prompt and reports what came
+  back. Note the limitation — it reports what happens *in the environment you
+  run it in*. A stripped environment that cannot reach the system credential
+  store will fail this check while the scheduled job, which can, is fine.
+
 ## [0.6.0] - 2026-09-15
 
 ### Added
@@ -486,7 +537,8 @@ First public release.
   `n-seo upgrade` gate — without changing the reported test counts, and an
   in-place install ran those assertions against the owner's live data.
 
-[Unreleased]: https://github.com/en-dash-consulting/n-seo/compare/v0.6.0...HEAD
+[Unreleased]: https://github.com/en-dash-consulting/n-seo/compare/v0.6.1...HEAD
+[0.6.1]: https://github.com/en-dash-consulting/n-seo/compare/v0.6.0...v0.6.1
 [0.6.0]: https://github.com/en-dash-consulting/n-seo/compare/v0.5.0...v0.6.0
 [0.5.0]: https://github.com/en-dash-consulting/n-seo/compare/v0.4.1...v0.5.0
 [0.4.1]: https://github.com/en-dash-consulting/n-seo/compare/v0.4.0...v0.4.1

package/README.md

@@ -3,6 +3,7 @@
 **An SEO, self-hosted.** Website: https://n-seo.dev/ · From the makers of [n-dx](https://n-dx.dev).
 
 [![npm](https://img.shields.io/npm/v/n-seo)](https://www.npmjs.com/package/n-seo)
+[![downloads](https://img.shields.io/npm/dw/n-seo)](https://www.npmjs.com/package/n-seo)
 [![CI](https://github.com/en-dash-consulting/n-seo/actions/workflows/ci.yml/badge.svg)](https://github.com/en-dash-consulting/n-seo/actions/workflows/ci.yml)
 [![license](https://img.shields.io/npm/l/n-seo)](LICENSE)
 

package/docs/DEPLOY.md

@@ -273,6 +273,15 @@ checks. The instance directory is never touched by an upgrade — that
 separation is the point of `docs/INSTANCE.md`. Roll back by checking out the
 previous engine commit and running `manage up`.
 
+**You will hear about a release without going to look.** The daily run's
+`update-check` step asks the registry once a day and writes
+`data/update-check.json`; the Settings page and `doctor` read it. That matters
+more on a deployed instance than on a laptop, because nobody is watching a
+terminal here — the notice is waiting on the dashboard the next time you open
+it. Do not add a separate scheduled `n-seo upgrade --check`; it would duplicate
+the step the daily run already performs. `modules.updateCheck.enabled: false`
+turns it off.
+
 ## Watching it
 
 | Where | What |

package/docs/PRD.md

@@ -6,6 +6,13 @@ deliberately does not do, and the capabilities that exist or are planned.
 Each feature lists acceptance criteria in the form a test or a reviewer can
 check. Status markers: **[shipped]**, **[planned]**, **[idea]**.
 
+Some capabilities are stated as epic-level acceptance criteria rather than as
+their own `## Feature:` section — the epic *is* the capability, and splitting
+it would add a heading without adding a claim. Those still appear as features
+in the `.rex/` tree, which needs a node to schedule work against. The two
+files agree on what exists and on its status; the tree is simply finer-grained
+in places.
+
 ## Purpose
 
 n-seo is a local-first control plane for organic growth across one or more
@@ -89,7 +96,8 @@ a fresh checkout runs.
 - Acceptance: `ops/doctor.py` reports the exact email to add in Search
   Console and GA4 and which configured properties are not yet accessible.
 
-# Epic: Ingest [shipped]
+# Epic: Ingest and site health [shipped]
+
 
 ## Feature: Search Console pulls [shipped]
 
@@ -105,7 +113,7 @@ a fresh checkout runs.
   `funnel` report only for `conversions.site`, falling back when the custom
   dimension is unregistered.
 
-## Feature: Time series, index coverage, metadata audit, trend analysis [shipped]
+## Feature: Time series, index coverage, metadata audit and trend analysis [shipped]
 
 - Acceptance: date × page series for 180 days from both sources.
 - Acceptance: URL Inspection verdict for every sitemap URL (sitemap indexes
@@ -119,7 +127,8 @@ a fresh checkout runs.
 - Acceptance: trend file with branded/generic split, rising/falling queries
   (84d vs prior 84d), monthly trajectory and AI-referral sessions by month.
 
-# Epic: Live-site probe [shipped]
+## Feature: No-auth health probe with regression alerts [shipped]
+
 
 - Acceptance: robots.txt (incl. AI-crawler disallows), sitemap.xml, llms.txt
   and llms-full.txt, homepage metadata/JSON-LD/visible-text bytes, and a real
@@ -127,7 +136,8 @@ a fresh checkout runs.
 - Acceptance: the daily diff raises an ALERT line on any regression versus
   the previous snapshot.
 
-# Epic: Action engine [shipped]
+# Epic: Action engine and profiles [shipped]
+
 
 - Acceptance: six rules over the 90-day window (metadata findings, CTR
   gaps, striking distance, probe hygiene, engagement mismatch, traffic drop)
@@ -164,6 +174,11 @@ published once and installed many times. Full reference: `docs/PROFILES.md`.
   corrupting the sort.
 - Acceptance: a priority can never create a card. Everything in the queue
   still came from data.
+- Acceptance: `principles` carries the part of a method that is not a number —
+  a title, a body, and a kind. `hard` is a constraint an agent must not cross;
+  `guide` is judgement it should apply. They render at the top of the action
+  queue and on Settings, and `n-seo init` writes them into the instance's
+  `CLAUDE.md`, so the owner and their agent read the same rules.
 - Decided: a profile is data only and may not ship executable code. Installing
   a method should not mean running its author's code on the machine holding
   your Search Console credentials. `priorities` covers reordering and hiding
@@ -177,7 +192,8 @@ published once and installed many times. Full reference: `docs/PROFILES.md`.
   with the engine defaults documented in `src/config.ts` and mirrored in
   `ingest/seo_config.py`; tests cover an override changing a rule's output.
 
-# Epic: Dashboard [shipped]
+# Epic: Dashboard and agent access [shipped]
+
 
 - Acceptance: routes `/`, `/actions`, `/insights`, `/trends[/N]`,
   `/content`, `/drafts/:slug`, `/campaigns/:slug`, `/site/:host`,
@@ -199,12 +215,41 @@ published once and installed many times. Full reference: `docs/PROFILES.md`.
   pages and conversions, and writes the config file (creating it from the
   example on first save); invalid topic lines are rejected with a message.
 
+## Feature: Read-only MCP over stdio and authenticated HTTP [shipped]
+
+
+- Acceptance: stdio transport with no secret; HTTP transport that returns
+  503 with no token configured and compares tokens in constant time.
+- Acceptance: every tool is annotated read-only; tools cover the queue, a
+  single action, sites, per-site report, top queries, striking distance, CTR
+  gaps, metadata audit, time series, ops status, daily log, proposals,
+  conversions, campaigns, settings and engine info; docs exposed as
+  resources.
+
+## Feature: Indexing problems on the individual site page [shipped]
+
+`/site/:host` says nothing about indexing today, so someone looking at one
+site has to leave for `/indexing` and find their host in a list. The data is
+already keyed by host — `indexStatus()` carries problems, never-crawled,
+indexed and checked per site — so this is surfacing, not a new pull.
+
+- Acceptance: the site page shows that host's indexed/checked counts, its
+  problems grouped by coverage state, and its never-crawled count.
+- Acceptance: each problem keeps its coverage-state explanation and whether
+  Request Indexing helps — true only where Google has formed no judgement,
+  false where it fetched and declined.
+- Acceptance: a host that is all clear, or has no sitemap coverage, says so
+  explicitly rather than rendering an empty panel; it links through to
+  `/indexing` for the cross-site view.
+- Acceptance: renders from demo data with no server error, in both themes.
+
 ## Feature: Custom pages and rules in instance mode [idea]
 
 Allow an instance to register extra routes and rules without forking the
 engine (e.g. `instance/src/extensions.ts`).
 
-# Epic: Modules (opt-in) [shipped]
+# Epic: Optional modules [shipped]
+
 
 - Acceptance: each of indexStatus, metadataAudit, opportunityScan, llm,
   hackerNews, reddit, indexNow, staticExport, gitAutoCommit, notifications,
@@ -218,37 +263,23 @@ engine (e.g. `instance/src/extensions.ts`).
   briefings.
 - Acceptance: briefing prompts forbid generating comment text.
 
-## Feature: HTTP LLM adapter [planned]
+## Feature: HTTP LLM adapter [shipped]
 
 Optional adapter that calls an OpenAI-compatible or Anthropic HTTP endpoint
 instead of a CLI, with the key read from `.env`.
 
+- Acceptance: `modules.llm.http` takes `provider` (`anthropic` or `openai`),
+  `model`, an optional `baseUrl` and a key resolved from the environment;
+  `http` wins when configured and its key resolves, otherwise the CLI command
+  runs, and with neither the scan records candidates only.
+
 ## Feature: Bing Webmaster ingest [idea]
 
 ## Feature: Core Web Vitals via CrUX [idea]
 
-# Epic: Daily run and scheduling [shipped]
-
-- Acceptance: `ops/daily.py` waits for the network, runs the enabled steps
-  in order, retries a failed step once, tees output to `data/daily-ops.log`,
-  writes `data/last-run.json` with per-step timing, honours `--only`,
-  `--skip`, `--list`, `--no-network-wait`, and exits 1 on any failure.
-- Acceptance: hooks (`beforeRun`, `afterRun`, `afterStep`) run in the
-  instance directory and are logged like steps without aborting the run.
-- Acceptance: launchd, cron and systemd templates plus an installer script.
-
-# Epic: MCP server [shipped]
-
-- Acceptance: stdio transport with no secret; HTTP transport that returns
-  503 with no token configured and compares tokens in constant time.
-- Acceptance: every tool is annotated read-only; tools cover the queue, a
-  single action, sites, per-site report, top queries, striking distance, CTR
-  gaps, metadata audit, time series, ops status, daily log, proposals,
-  conversions, campaigns, settings and engine info; docs exposed as
-  resources.
-
 # Epic: Engine and instance [shipped]
 
+
 - Acceptance: `N_SEO_INSTANCE` relocates every instance-owned path; in-place
   mode is unchanged when it is unset.
 - Acceptance: `n-seo init|start|dev|daily|doctor|demo|mcp|check|export|
@@ -264,6 +295,17 @@ instead of a CLI, with the key read from `.env`.
 - Acceptance: `n-seo upgrade` refuses to leave the engine on a commit that
   fails `npm run check` without printing the rollback command.
 
+## Feature: Portable orchestrator with hooks and scheduler templates [shipped]
+
+
+- Acceptance: `ops/daily.py` waits for the network, runs the enabled steps
+  in order, retries a failed step once, tees output to `data/daily-ops.log`,
+  writes `data/last-run.json` with per-step timing, honours `--only`,
+  `--skip`, `--list`, `--no-network-wait`, and exits 1 on any failure.
+- Acceptance: hooks (`beforeRun`, `afterRun`, `afterStep`) run in the
+  instance directory and are logged like steps without aborting the run.
+- Acceptance: launchd, cron and systemd templates plus an installer script.
+
 ## Feature: Publish the engine to npm [shipped]
 
 - Acceptance: `npm i n-seo` installs a working engine; `npx n-seo init`
@@ -284,13 +326,30 @@ instead of a CLI, with the key read from `.env`.
   and both compare against the engine running now — so an upgrade stops the
   notice immediately rather than at the next daily run.
 
-# Epic: Quality [shipped]
+## Feature: Update checking is visible where people schedule things [shipped]
 
-- Acceptance: `npm run check` runs typecheck, TypeScript tests (sandboxed
-  copy) and Python tests; CI runs both suites, a demo-data dashboard smoke,
-  `doctor --offline`, and a grep that fails on any private name.
+The capability shipped in 0.4.1 and nobody needs a second scheduled job for
+it: `update-check` is a step in the daily run, `modules.updateCheck` is the
+only module enabled by default, and the Settings page and `doctor` read the
+file it writes. What was missing was saying so where someone goes to set
+scheduling up, which is exactly where they would otherwise invent a redundant
+weekly job.
+
+- Acceptance: `docs/SCHEDULING.md` names the `update-check` step, that
+  `modules.updateCheck` is on by default, and that the result appears on
+  Settings and in `doctor` — so a reader setting up scheduling does not add a
+  second job for it.
+- Acceptance: the Upgrades section of `docs/DEPLOY.md` says the same for a
+  deployed instance, where nobody is watching a terminal.
+- Acceptance: neither document suggests scheduling `n-seo upgrade --check`
+  separately; both say why that would duplicate the daily step.
+- Decided: no weekly scheduler template. A second job would make a duplicate
+  registry request and write the answer to a log nobody opens. The narrow case
+  it would serve — an install that never schedules the daily run — is a
+  contradiction of how n-seo is meant to work.
+
+# Epic: Onboarding, docs and quality [shipped]
 
-# Epic: Onboarding and docs [shipped]
 
 - Acceptance: `npm run demo` populates every page with synthetic data before
   any Google setup.
@@ -298,6 +357,13 @@ instead of a CLI, with the key read from `.env`.
   INSTANCE, MCP, OPERATING-RULES, PLAYBOOK, FAQ, CONTRIBUTING, SECURITY,
   CHANGELOG exist and match the CLI contracts.
 
+## Feature: Tests and CI [shipped]
+
+
+- Acceptance: `npm run check` runs typecheck, TypeScript tests (sandboxed
+  copy) and Python tests; CI runs both suites, a demo-data dashboard smoke,
+  `doctor --offline`, and a grep that fails on any private name.
+
 ## Feature: Interactive setup wizard [idea]
 
 `n-seo init --guided`: asks for hosts, property ids and the key path, then

package/docs/SCHEDULING.md

@@ -135,6 +135,28 @@ the dashboard shows as the run status chip), and appends a dated entry to
 `docs/daily-log.md`. Re-running on the same day replaces that day's entry
 rather than stacking a second one.
 
+## Checking for a newer n-seo
+
+You do not need a second scheduled job for this. `update-check` is a step in
+the daily run, and `modules.updateCheck` is the only module enabled by
+default: once a day it asks the registry whether a newer engine has been
+published and writes `data/update-check.json`. The Settings page and
+`n-seo doctor` both read that file, so the notice reaches you without either
+of them making a network request.
+
+Scheduling `n-seo upgrade --check` weekly on top of that would ask the
+registry the same question a second time and write the answer to a log nobody
+opens. Run it by hand when you want to look:
+
+```sh
+n-seo upgrade --check    # reports what is available, changes nothing
+n-seo upgrade            # performs it, prints the changelog and the rollback
+```
+
+Switch the daily check off with `modules.updateCheck.enabled: false`; nothing
+about your instance is sent either way — it is the same public metadata
+request `npm view n-seo version` makes from any machine.
+
 ## Logs, in one place
 
 | File | What |

package/ops/doctor.py

@@ -79,6 +79,36 @@ def check_profile(cfg):
     report("OK", f"from {d}")
 
 
+def probe_llm(cmd):
+    """Actually call the model and see whether it answers.
+
+    `shutil.which` only proves a file exists. An expired OAuth session, a
+    revoked key or a missing subscription all leave the binary exactly where
+    it was, so the old check reported OK while every call in the daily run
+    failed — eleven of them, silently, because the llm module degrades rather
+    than failing the run. A green tick for something that cannot work is
+    worse than no check at all.
+
+    Returns (ok, detail). Never raises.
+    """
+    try:
+        p = subprocess.run(cmd, input="Reply with the single word: ok",
+                           capture_output=True, text=True, timeout=90, encoding="utf-8")
+    except subprocess.TimeoutExpired:
+        return False, "timed out after 90s"
+    except OSError as exc:
+        return False, str(exc)[:120]
+    if p.returncode != 0:
+        detail = (p.stderr or p.stdout or "").strip().splitlines()
+        return False, (detail[0][:160] if detail else f"exit {p.returncode}, no output")
+    out = (p.stdout or "").strip()
+    if not out:
+        # Some CLIs report an auth failure on stdout and still exit 0.
+        err = (p.stderr or "").strip().splitlines()
+        return False, (err[0][:160] if err else "exited 0 but said nothing")
+    return True, out.splitlines()[0][:60]
+
+
 def check_config():
     print("config")
     if seo_config.using_example():
@@ -301,8 +331,15 @@ def check_modules(cfg):
                 elif key == "command" and not http and not llm.get("http"):
                     report("FAIL", "llm has neither http nor command configured")
                 continue
-            report("OK" if shutil.which(cmd[0]) else "FAIL", f"llm.{key}: {cmd[0]}",
-                   "" if shutil.which(cmd[0]) else "not on PATH")
+            if not shutil.which(cmd[0]):
+                report("FAIL", f"llm.{key}: {cmd[0]}", "not on PATH")
+                continue
+            if OFFLINE:
+                report("OK", f"llm.{key}: {cmd[0]}", "on PATH — not called (offline)")
+                continue
+            ok, detail = probe_llm(cmd)
+            report("OK" if ok else "FAIL", f"llm.{key}: {raw[:48]}",
+                   detail if not ok else f"answered: {detail}")
     hn = cfg["modules"].get("hackerNews", {})
     if hn.get("enabled"):
         user = (hn.get("user") or "").strip()

package/ops/llm.py

@@ -155,7 +155,12 @@ def infer(prompt: str, fast: bool = False) -> str | None:
         print(f"  llm: {exc}", file=sys.stderr)
         return None
     if p.returncode != 0:
-        print(f"  llm: exit {p.returncode}: {p.stderr.strip()[:200]}", file=sys.stderr)
+        # Not every CLI reports its failure on stderr. `claude` exits 1 and
+        # writes "Failed to authenticate: OAuth session expired" to stdout,
+        # so logging stderr alone produced "llm: exit 1:" with nothing after
+        # it — eleven times in one run, with the reason thrown away each time.
+        detail = (p.stderr.strip() or p.stdout.strip() or "no output")
+        print(f"  llm: exit {p.returncode}: {detail[:200]}", file=sys.stderr)
         return None
     out = p.stdout.strip()
     return out or None

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "n-seo",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Agentic, local-first SEO / AEO / GEO control plane: pulls Search Console + GA4, probes your sites, and ranks the next moves. Your LLM writes the proposals; your coding agent works the queue over MCP.",
   "license": "MIT",
   "author": "En Dash Consulting (https://endash.us)",
@@ -56,10 +56,12 @@
     ".claude/skills/n-seo-review/",
     ".claude/skills/n-seo-deploy/",
     "!.claude/skills/README.md",
+    "!ops/install-git-filters.sh",
     "docs/",
     "README.md",
     "CHANGELOG.md",
-    "LICENSE"
+    "LICENSE",
+    "!**/__pycache__"
   ],
   "engines": {
     "node": ">=20"

package/src/views.tsx

@@ -658,6 +658,42 @@ export const SiteDetail: FC<{ site: SiteCfg; days?: number }> = ({ site, days =
           </table></div>
         </>
       )}
+      <SiteIndexing site={site} />
+    </>
+  );
+};
+
+/** This site's index coverage, on the page someone is already looking at.
+ *  /indexing is the cross-site view; needing to leave a site page and find
+ *  your host in a list is the thing this removes. Same snapshot, same
+ *  component, no second pull. */
+const SiteIndexing: FC<{ site: SiteCfg }> = ({ site }) => {
+  const status = data.indexStatus();
+  const s = status?.sites[site.host];
+  return (
+    <>
+      {!status ? (
+        <>
+          <h2>Indexing</h2>
+          <p class="empty">
+            No index snapshot yet — enable the <b>Index coverage sweep</b> module and run{" "}
+            <code>n-seo daily --only index-status</code>
+          </p>
+        </>
+      ) : !s ? (
+        <>
+          <h2>Indexing</h2>
+          <p class="empty">
+            Nothing for {site.host} in the latest snapshot — the sweep reads sitemap URLs, so a
+            site with no sitemap Search Console can fetch will not appear here.
+          </p>
+        </>
+      ) : (
+        <HostIndexing host={site.host} s={s} title="Indexing" />
+      )}
+      <p class="sub">
+        <a href="/indexing">Every site's coverage →</a>
+      </p>
     </>
   );
 };
@@ -794,6 +830,104 @@ const SitemapLine: FC<{ sitemap?: data.IndexStatus["sites"][string]["sitemap"] }
   );
 };
 
+/** One host's index coverage. Rendered per host on /indexing, and for a
+ *  single host on its own site page — same verdicts, same explanations, so
+ *  the two pages cannot drift into disagreeing about what Google said. */
+export const HostIndexing: FC<{
+  host: string;
+  s: data.IndexStatus["sites"][string];
+  /** Heading text when the host name would be redundant (a site page). */
+  title?: string;
+}> = ({ host, s, title }) => {
+      if (s.problems.length === 0) {
+        return (
+          <section class="idx-host">
+            <h2>
+              {title ?? host} <small>{s.indexed}/{s.checked} indexed — all clear</small>
+            </h2>
+          </section>
+        );
+      }
+      const groups = [...s.problems].sort(
+        (a, b) =>
+          (COVERAGE_ORDER.indexOf(a.coverage) + 1 || 99) -
+            (COVERAGE_ORDER.indexOf(b.coverage) + 1 || 99) ||
+          a.url.localeCompare(b.url),
+      );
+      let lastCoverage = "";
+      return (
+        <section class="idx-host">
+          <h2>
+            {title ?? host}{" "}
+            <small>
+              {s.indexed}/{s.checked} indexed · {s.neverCrawled} never crawled
+            </small>
+          </h2>
+          <SitemapLine sitemap={s.sitemap} />
+          <div class="tbl-wrap">
+            <table>
+              <thead>
+                <tr><th>URL</th><th>Last crawled</th></tr>
+              </thead>
+              <tbody>
+                {groups.map((p) => {
+                  const header = p.coverage !== lastCoverage ? p.coverage : null;
+                  lastCoverage = p.coverage;
+                  return (
+                    <>
+                      {header && (
+                        <tr class="idx-group">
+                          <td colspan={2}>
+                            <strong>{header}</strong>{" "}
+                            <span class="idx-help">{COVERAGE_HELP[header]?.means ?? p.detail ?? ""}</span>
+                            {COVERAGE_HELP[header] && (
+                              <div class="idx-fix">
+                                <span
+                                  class={`idx-ri ${REQUEST_INDEXING_HELPS.has(header) ? "yes" : "no"}`}
+                                  title={
+                                    REQUEST_INDEXING_HELPS.has(header)
+                                      ? "Google has not judged this content yet — a request moves it"
+                                      : "Google already fetched and judged this page; re-requesting repeats the same verdict and spends quota"
+                                  }
+                                >
+                                  {REQUEST_INDEXING_HELPS.has(header)
+                                    ? "Request Indexing helps"
+                                    : "Request Indexing will not fix this"}
+                                </span>{" "}
+                                {COVERAGE_HELP[header].fix}
+                              </div>
+                            )}
+                          </td>
+                        </tr>
+                      )}
+                      <tr>
+                        <td class="mono trunc">
+                          <a href={p.url} target="_blank" rel="noopener noreferrer">
+                            {p.url.replace(/^https?:\/\/[^/]+/, "") || "/"}
+                          </a>
+                          {p.canonicalMismatch && (
+                            <span class="chip"> canonical → {p.googleCanonical}</span>
+                          )}
+                        </td>
+                        <td class="mono">
+                          {p.lastCrawl ? p.lastCrawl.slice(0, 10) : "never"}
+                          {staleVerdict(p.lastCrawl) && (
+                            <span class="idx-stale" title="Google has not looked since this verdict — recheck before treating it as a live bug">
+                              {" "}stale
+                            </span>
+                          )}
+                        </td>
+                      </tr>
+                    </>
+                  );
+                })}
+              </tbody>
+            </table>
+          </div>
+        </section>
+      );
+};
+
 export const IndexingPage: FC = () => {
   const status = data.indexStatus();
   if (!status) {
@@ -816,95 +950,9 @@ export const IndexingPage: FC = () => {
         Search Console's verdict on every sitemap URL · {totalProblems} not indexed,{" "}
         {totalNever} never crawled · snapshot {status.generated.slice(0, 16).replace("T", " ")}
       </p>
-      {hosts.map(([host, s]) => {
-        if (s.problems.length === 0) {
-          return (
-            <section class="idx-host">
-              <h2>
-                {host} <small>{s.indexed}/{s.checked} indexed — all clear</small>
-              </h2>
-            </section>
-          );
-        }
-        const groups = [...s.problems].sort(
-          (a, b) =>
-            (COVERAGE_ORDER.indexOf(a.coverage) + 1 || 99) -
-              (COVERAGE_ORDER.indexOf(b.coverage) + 1 || 99) ||
-            a.url.localeCompare(b.url),
-        );
-        let lastCoverage = "";
-        return (
-          <section class="idx-host">
-            <h2>
-              {host}{" "}
-              <small>
-                {s.indexed}/{s.checked} indexed · {s.neverCrawled} never crawled
-              </small>
-            </h2>
-            <SitemapLine sitemap={s.sitemap} />
-            <div class="tbl-wrap">
-              <table>
-                <thead>
-                  <tr><th>URL</th><th>Last crawled</th></tr>
-                </thead>
-                <tbody>
-                  {groups.map((p) => {
-                    const header = p.coverage !== lastCoverage ? p.coverage : null;
-                    lastCoverage = p.coverage;
-                    return (
-                      <>
-                        {header && (
-                          <tr class="idx-group">
-                            <td colspan={2}>
-                              <strong>{header}</strong>{" "}
-                              <span class="idx-help">{COVERAGE_HELP[header]?.means ?? p.detail ?? ""}</span>
-                              {COVERAGE_HELP[header] && (
-                                <div class="idx-fix">
-                                  <span
-                                    class={`idx-ri ${REQUEST_INDEXING_HELPS.has(header) ? "yes" : "no"}`}
-                                    title={
-                                      REQUEST_INDEXING_HELPS.has(header)
-                                        ? "Google has not judged this content yet — a request moves it"
-                                        : "Google already fetched and judged this page; re-requesting repeats the same verdict and spends quota"
-                                    }
-                                  >
-                                    {REQUEST_INDEXING_HELPS.has(header)
-                                      ? "Request Indexing helps"
-                                      : "Request Indexing will not fix this"}
-                                  </span>{" "}
-                                  {COVERAGE_HELP[header].fix}
-                                </div>
-                              )}
-                            </td>
-                          </tr>
-                        )}
-                        <tr>
-                          <td class="mono trunc">
-                            <a href={p.url} target="_blank" rel="noopener noreferrer">
-                              {p.url.replace(/^https?:\/\/[^/]+/, "") || "/"}
-                            </a>
-                            {p.canonicalMismatch && (
-                              <span class="chip"> canonical → {p.googleCanonical}</span>
-                            )}
-                          </td>
-                          <td class="mono">
-                            {p.lastCrawl ? p.lastCrawl.slice(0, 10) : "never"}
-                            {staleVerdict(p.lastCrawl) && (
-                              <span class="idx-stale" title="Google has not looked since this verdict — recheck before treating it as a live bug">
-                                {" "}stale
-                              </span>
-                            )}
-                          </td>
-                        </tr>
-                      </>
-                    );
-                  })}
-                </tbody>
-              </table>
-            </div>
-          </section>
-        );
-      })}
+      {hosts.map(([host, s]) => (
+        <HostIndexing key={host} host={host} s={s} />
+      ))}
     </>
   );
 };