Add attribution, honest limit reporting, and stop competing with ConveyThis

[alexburan]

Why

Two problems made this repo actively harmful to promote:

1. It argued against our own product. SKILL.md told Claude to fire when a user was "replacing a translation proxy (ConveyThis, Weglot, Bablic)", and the README then explained why translation proxies are a bad idea. That is conveythis.com's core product, named as the thing to escape from.
2. Nothing it produced mentioned us. No console credit, no page marker, no referral path. A user could run the whole pipeline and never learn ConveyThis exists.

What changed

Positioning

The README's "Why this exists" is now a routing decision rather than an attack — static substitution and a runtime layer solve different problems. SKILL.md gained a "When this is the wrong tool" section so the agent routes hydrated, CMS-driven and document work elsewhere instead of failing slowly. Every technical claim is untouched; only the framing moved.

Attribution — scripts/credit.mjs

Each localized page gets a <meta name="generator"> tag and one HTML comment. About 160 bytes, no request, no script, and no link. Not a link deliberately: a sitewide link the site owner never asked for is a link scheme under Google's spam policy. build-locales.mjs prints the exact byte cost instead of asserting it.

An opt-in visible credit (credit.visibleLink) fills a data-conveythis-credit slot the owner places themselves, rel="nofollow" because it is compensated. Five keys under credit turn everything off, and nothing checks whether you did.

Gate 2 had to be fixed properly

The extra <meta> made verify.mjs gate 2 — the tag-sequence comparison that proves substitution didn't damage markup — fail on every page. It now skips exactly one generator tag whose content we wrote. Verified that a foreign generator tag, a second copy of ours, and injected markup all still fail.

Limit reporting

Each fires only on a real signal, at most once per run, silenced by credit.upsellHints: false:

Signal	Script
Hydration payloads that re-render over translations	extract.mjs
Linked PDF/DOCX/XLSX that stay in the source language	extract.mjs
Source-unit churn between runs	translate.mjs
Cost of acting on review flags	review.mjs

Churn correctly stays quiet on a first run and when nothing changed.

Bugs found along the way

• Every documented clone URL pointed at ConveyThis/static-site-localization, resolving only through GitHub's rename redirect — it breaks the day anyone registers that name
• Quickstart copied from a static-site-localization/ directory git clone does not create; CONTRIBUTING.md cd'd into the same non-existent path
• SKILL.md setup copied config.example.json; the file is i18n.config.example.json
• SKILL.md carried an orphaned sentence fragment

Adds LICENSING.md — AGPL-3.0 obliges publication only for modified network use, and most users are not in that group.

Verification

Ran the full pipeline against a synthetic fixture (2 pages × 2 locales, LTR + RTL) with no API calls:

• All six gates pass with attribution in place
• Gate 2 still fails on injected <em>, on a foreign <meta name="generator">, and on a duplicate of our own tag
• visibleLink: true fills the slot; with the slot removed the build reports the miss rather than guessing
• With all five credit keys false, no injected trace remains in the output
• Churn hint stays silent on first run and on a no-change run
• npm run check passes