michal-niedzwiedzki · Oct 6, 2026 · Oct 5, 2026 · Oct 6, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,6 +4,13 @@
 
 ### Added
 
+- **Cookieless page analytics on the project site.** The documentation pages
+  now count visits with [GoatCounter](https://www.goatcounter.com): no cookies,
+  no stored identifier, no cross-site tracking. The counter script is vendored
+  at `docs/vendor/goatcounter-count.js`, so `script-src` stays `'self'`; the
+  only new grant is the collector at `visimark.goatcounter.com`. The Playground
+  is not counted.
+
 - **A SIMULATION tab in the Playground.** Next to REASONING, KNOWLEDGE and
   INFERENCE, a flask-icon tab with a Start Simulation button runs
   `visimark simulate` on the open document. The readings fill the tab; the

diff --git a/docs/articles.html b/docs/articles.html
@@ -6,15 +6,17 @@
     <!--
       Generated by `bun run gen:articles` from docs/articles/articles.json —
       do not hand-edit. A <meta> policy, because GitHub Pages cannot send
-      headers. The page has no script of its own, so there is nothing to
-      grant beyond style, same-origin fonts and images.
+      headers. Beyond style, same-origin fonts and images, the only grants
+      are the vendored analytics script and its collector (analytics-lib.ts).
     -->
     <meta
       http-equiv="Content-Security-Policy"
       content="default-src 'none';
+               script-src 'self';
                style-src 'self';
                font-src 'self';
-               img-src 'self';
+               img-src 'self' https://visimark.goatcounter.com;
+               connect-src https://visimark.goatcounter.com;
                base-uri 'none';
                form-action 'none'"
     />
@@ -114,5 +116,6 @@ <h2><a href="articles/bakeoff/">Manda-Panda and the Sunday bakeoff</a></h2>
           </div></article>
       </main>
     </div>
+    <script data-goatcounter="https://visimark.goatcounter.com/count" async src="vendor/goatcounter-count.js"></script>
   </body>
 </html>
diff --git a/docs/articles/10-things-excel-cannot-do-but-visimark-can/index.html b/docs/articles/10-things-excel-cannot-do-but-visimark-can/index.html
@@ -6,15 +6,17 @@
     <!--
       Generated by `bun run gen:articles` from docs/articles/articles.json —
       do not hand-edit. A <meta> policy, because GitHub Pages cannot send
-      headers. The page has no script of its own, so there is nothing to
-      grant beyond style, same-origin fonts and images.
+      headers. Beyond style, same-origin fonts and images, the only grants
+      are the vendored analytics script and its collector (analytics-lib.ts).
     -->
     <meta
       http-equiv="Content-Security-Policy"
       content="default-src 'none';
+               script-src 'self';
                style-src 'self';
                font-src 'self';
-               img-src 'self';
+               img-src 'self' https://visimark.goatcounter.com;
+               connect-src https://visimark.goatcounter.com;
                base-uri 'none';
                form-action 'none'"
     />
@@ -158,5 +160,6 @@ <h3><a href="../../articles/deal-desk/">Three agents and a 5-dimensional for-loo
         </div>
       </main>
     </div>
+    <script data-goatcounter="https://visimark.goatcounter.com/count" async src="../../vendor/goatcounter-count.js"></script>
   </body>
 </html>
diff --git a/docs/articles/agent-budget/index.html b/docs/articles/agent-budget/index.html
@@ -6,15 +6,17 @@
     <!--
       Generated by `bun run gen:articles` from docs/articles/articles.json —
       do not hand-edit. A <meta> policy, because GitHub Pages cannot send
-      headers. The page has no script of its own, so there is nothing to
-      grant beyond style, same-origin fonts and images.
+      headers. Beyond style, same-origin fonts and images, the only grants
+      are the vendored analytics script and its collector (analytics-lib.ts).
     -->
     <meta
       http-equiv="Content-Security-Policy"
       content="default-src 'none';
+               script-src 'self';
                style-src 'self';
                font-src 'self';
-               img-src 'self';
+               img-src 'self' https://visimark.goatcounter.com;
+               connect-src https://visimark.goatcounter.com;
                base-uri 'none';
                form-action 'none'"
     />
@@ -128,5 +130,6 @@ <h3><a href="../../articles/kiln-bonus/">The kiln bonus</a></h3>
         </div>
       </main>
     </div>
+    <script data-goatcounter="https://visimark.goatcounter.com/count" async src="../../vendor/goatcounter-count.js"></script>
   </body>
 </html>
diff --git a/docs/articles/bakeoff/index.html b/docs/articles/bakeoff/index.html
@@ -6,15 +6,17 @@
     <!--
       Generated by `bun run gen:articles` from docs/articles/articles.json —
       do not hand-edit. A <meta> policy, because GitHub Pages cannot send
-      headers. The page has no script of its own, so there is nothing to
-      grant beyond style, same-origin fonts and images.
+      headers. Beyond style, same-origin fonts and images, the only grants
+      are the vendored analytics script and its collector (analytics-lib.ts).
     -->
     <meta
       http-equiv="Content-Security-Policy"
       content="default-src 'none';
+               script-src 'self';
                style-src 'self';
                font-src 'self';
-               img-src 'self';
+               img-src 'self' https://visimark.goatcounter.com;
+               connect-src https://visimark.goatcounter.com;
                base-uri 'none';
                form-action 'none'"
     />
@@ -254,5 +256,6 @@ <h3><a href="../../articles/visimark-for-obsidian/">VisiMark for Obsidian: calcu
         </div>
       </main>
     </div>
+    <script data-goatcounter="https://visimark.goatcounter.com/count" async src="../../vendor/goatcounter-count.js"></script>
   </body>
 </html>
diff --git a/docs/articles/deal-desk/index.html b/docs/articles/deal-desk/index.html
@@ -6,15 +6,17 @@
     <!--
       Generated by `bun run gen:articles` from docs/articles/articles.json —
       do not hand-edit. A <meta> policy, because GitHub Pages cannot send
-      headers. The page has no script of its own, so there is nothing to
-      grant beyond style, same-origin fonts and images.
+      headers. Beyond style, same-origin fonts and images, the only grants
+      are the vendored analytics script and its collector (analytics-lib.ts).
     -->
     <meta
       http-equiv="Content-Security-Policy"
       content="default-src 'none';
+               script-src 'self';
                style-src 'self';
                font-src 'self';
-               img-src 'self';
+               img-src 'self' https://visimark.goatcounter.com;
+               connect-src https://visimark.goatcounter.com;
                base-uri 'none';
                form-action 'none'"
     />
@@ -132,5 +134,6 @@ <h3><a href="../../articles/kiln-bonus/">The kiln bonus</a></h3>
         </div>
       </main>
     </div>
+    <script data-goatcounter="https://visimark.goatcounter.com/count" async src="../../vendor/goatcounter-count.js"></script>
   </body>
 </html>
diff --git a/docs/articles/howto-finance-npv-irr-pmt/index.html b/docs/articles/howto-finance-npv-irr-pmt/index.html
@@ -6,15 +6,17 @@
     <!--
       Generated by `bun run gen:articles` from docs/articles/articles.json —
       do not hand-edit. A <meta> policy, because GitHub Pages cannot send
-      headers. The page has no script of its own, so there is nothing to
-      grant beyond style, same-origin fonts and images.
+      headers. Beyond style, same-origin fonts and images, the only grants
+      are the vendored analytics script and its collector (analytics-lib.ts).
     -->
     <meta
       http-equiv="Content-Security-Policy"
       content="default-src 'none';
+               script-src 'self';
                style-src 'self';
                font-src 'self';
-               img-src 'self';
+               img-src 'self' https://visimark.goatcounter.com;
+               connect-src https://visimark.goatcounter.com;
                base-uri 'none';
                form-action 'none'"
     />
@@ -203,5 +205,6 @@ <h3><a href="../../articles/deal-desk/">Three agents and a 5-dimensional for-loo
         </div>
       </main>
     </div>
+    <script data-goatcounter="https://visimark.goatcounter.com/count" async src="../../vendor/goatcounter-count.js"></script>
   </body>
 </html>
diff --git a/docs/articles/kiln-bonus/index.html b/docs/articles/kiln-bonus/index.html
@@ -6,15 +6,17 @@
     <!--
       Generated by `bun run gen:articles` from docs/articles/articles.json —
       do not hand-edit. A <meta> policy, because GitHub Pages cannot send
-      headers. The page has no script of its own, so there is nothing to
-      grant beyond style, same-origin fonts and images.
+      headers. Beyond style, same-origin fonts and images, the only grants
+      are the vendored analytics script and its collector (analytics-lib.ts).
     -->
     <meta
       http-equiv="Content-Security-Policy"
       content="default-src 'none';
+               script-src 'self';
                style-src 'self';
                font-src 'self';
-               img-src 'self';
+               img-src 'self' https://visimark.goatcounter.com;
+               connect-src https://visimark.goatcounter.com;
                base-uri 'none';
                form-action 'none'"
     />
@@ -132,5 +134,6 @@ <h3><a href="../../articles/deal-desk/">Three agents and a 5-dimensional for-loo
         </div>
       </main>
     </div>
+    <script data-goatcounter="https://visimark.goatcounter.com/count" async src="../../vendor/goatcounter-count.js"></script>
   </body>
 </html>
diff --git a/docs/articles/md-wins-better-in-spreadsheeting-than-a-spreadsheet/index.html b/docs/articles/md-wins-better-in-spreadsheeting-than-a-spreadsheet/index.html
@@ -6,15 +6,17 @@
     <!--
       Generated by `bun run gen:articles` from docs/articles/articles.json —
       do not hand-edit. A <meta> policy, because GitHub Pages cannot send
-      headers. The page has no script of its own, so there is nothing to
-      grant beyond style, same-origin fonts and images.
+      headers. Beyond style, same-origin fonts and images, the only grants
+      are the vendored analytics script and its collector (analytics-lib.ts).
     -->
     <meta
       http-equiv="Content-Security-Policy"
       content="default-src 'none';
+               script-src 'self';
                style-src 'self';
                font-src 'self';
-               img-src 'self';
+               img-src 'self' https://visimark.goatcounter.com;
+               connect-src https://visimark.goatcounter.com;
                base-uri 'none';
                form-action 'none'"
     />
@@ -153,5 +155,6 @@ <h3><a href="../../articles/md-woes-looks-good-is-wrong/">Markdown woes: Looks r
         </div>
       </main>
     </div>
+    <script data-goatcounter="https://visimark.goatcounter.com/count" async src="../../vendor/goatcounter-count.js"></script>
   </body>
 </html>
diff --git a/docs/articles/md-woes-looks-good-is-wrong/index.html b/docs/articles/md-woes-looks-good-is-wrong/index.html
@@ -6,15 +6,17 @@
     <!--
       Generated by `bun run gen:articles` from docs/articles/articles.json —
       do not hand-edit. A <meta> policy, because GitHub Pages cannot send
-      headers. The page has no script of its own, so there is nothing to
-      grant beyond style, same-origin fonts and images.
+      headers. Beyond style, same-origin fonts and images, the only grants
+      are the vendored analytics script and its collector (analytics-lib.ts).
     -->
     <meta
       http-equiv="Content-Security-Policy"
       content="default-src 'none';
+               script-src 'self';
                style-src 'self';
                font-src 'self';
-               img-src 'self';
+               img-src 'self' https://visimark.goatcounter.com;
+               connect-src https://visimark.goatcounter.com;
                base-uri 'none';
                form-action 'none'"
     />
@@ -179,5 +181,6 @@ <h3><a href="../../articles/deal-desk/">Three agents and a 5-dimensional for-loo
         </div>
       </main>
     </div>
+    <script data-goatcounter="https://visimark.goatcounter.com/count" async src="../../vendor/goatcounter-count.js"></script>
   </body>
 </html>
diff --git a/docs/articles/visimark-for-obsidian/index.html b/docs/articles/visimark-for-obsidian/index.html
@@ -6,15 +6,17 @@
     <!--
       Generated by `bun run gen:articles` from docs/articles/articles.json —
       do not hand-edit. A <meta> policy, because GitHub Pages cannot send
-      headers. The page has no script of its own, so there is nothing to
-      grant beyond style, same-origin fonts and images.
+      headers. Beyond style, same-origin fonts and images, the only grants
+      are the vendored analytics script and its collector (analytics-lib.ts).
     -->
     <meta
       http-equiv="Content-Security-Policy"
       content="default-src 'none';
+               script-src 'self';
                style-src 'self';
                font-src 'self';
-               img-src 'self';
+               img-src 'self' https://visimark.goatcounter.com;
+               connect-src https://visimark.goatcounter.com;
                base-uri 'none';
                form-action 'none'"
     />
@@ -143,5 +145,6 @@ <h3><a href="../../articles/10-things-excel-cannot-do-but-visimark-can/">10 thin
         </div>
       </main>
     </div>
+    <script data-goatcounter="https://visimark.goatcounter.com/count" async src="../../vendor/goatcounter-count.js"></script>
   </body>
 </html>
diff --git a/docs/ci.html b/docs/ci.html
@@ -28,7 +28,8 @@
       content="default-src 'none';
                script-src 'self';
                style-src 'self';
-               img-src 'self';
+               img-src 'self' https://visimark.goatcounter.com;
+               connect-src https://visimark.goatcounter.com;
                base-uri 'none';
                form-action 'none'"
     />
@@ -1866,5 +1867,6 @@ <h3 id="where-to-go-next">Where to go next</h3>
     </main>
 
     <script src="vendor/visimark-site-ci.js"></script>
+    <script data-goatcounter="https://visimark.goatcounter.com/count" async src="vendor/goatcounter-count.js"></script>
   </body>
 </html>
diff --git a/docs/distribution.md b/docs/distribution.md
@@ -23,14 +23,14 @@ under `docs/WIP/` are not (several are gitignored and session-local).
 | Where | Status | Notes |
 |---|---|---|
 | [npmjs.com/package/remark-lint-visimark](https://www.npmjs.com/package/remark-lint-visimark) | **Live**, automatic | Same release leg as above. |
-| unifiedjs/remark plugin list | Not researched | No submission prepared yet. |
+| [remarkjs/remark plugin list](https://github.com/remarkjs/remark/blob/main/doc/plugins.md) | **PR open**, 2026-10-05 | [PR #1504](https://github.com/remarkjs/remark/pull/1504), awaiting merge. One-line addition to `doc/plugins.md` after `remark-lint`. Requirements: `remark-` name, default export, `remark-plugin` keyword (all already met) and a `remark-plugin` GitHub topic (added for this submission). Deliberately not sent to remark-lint's "external rules" list: that is for `unified-lint-rule` packages, and ours is a plain unified plugin. |
 
 ## `markdownlint-rule-visimark` (npm)
 
 | Where | Status | Notes |
 |---|---|---|
 | [npmjs.com/package/markdownlint-rule-visimark](https://www.npmjs.com/package/markdownlint-rule-visimark) | **Live**, automatic | Same release leg as above. |
-| DavidAnson/markdownlint custom-rules list | Not researched | No submission prepared yet. |
+| markdownlint community rules (npm keyword) | **Live**, automatic, confirmed 2026-10-05 | markdownlint has no list or PR process; its custom-rules doc says community rules are discovered via the npm keyword [`markdownlint-rule`](https://www.npmjs.com/search?q=keywords:markdownlint-rule), which the package carries. Confirmed it appears in that search (634 downloads at the time). |
 
 ## `visimark-mcp` (npm + MCP directories)
 

diff --git a/docs/examples.html b/docs/examples.html
@@ -6,16 +6,17 @@
     <!--
       Generated by `bun run gen:examples` from docs/examples/examples.json —
       do not hand-edit. A <meta> policy, because GitHub Pages cannot send
-      headers. The page has no script of its own, so there is nothing to
-      grant beyond style, same-origin fonts and images.
+      headers. Beyond style, same-origin fonts and images, the only grants
+      are the vendored analytics script and its collector (analytics-lib.ts).
     -->
     <meta
       http-equiv="Content-Security-Policy"
       content="default-src 'none';
                script-src 'self';
                style-src 'self';
                font-src 'self';
-               img-src 'self';
+               img-src 'self' https://visimark.goatcounter.com;
+               connect-src https://visimark.goatcounter.com;
                base-uri 'none';
                form-action 'none'"
     />
@@ -171,5 +172,6 @@ <h2><a href="examples/bakeoff/">Bakeoff stall: how many batches, at what price</
       </main>
     </div>
     <script src="examples-filter.js"></script>
+    <script data-goatcounter="https://visimark.goatcounter.com/count" async src="vendor/goatcounter-count.js"></script>
   </body>
 </html>
diff --git a/docs/examples/agent-budget/index.html b/docs/examples/agent-budget/index.html
@@ -30,7 +30,8 @@
       content="default-src 'none';
                script-src 'self';
                style-src 'self';
-               img-src 'self';
+               img-src 'self' https://visimark.goatcounter.com;
+               connect-src https://visimark.goatcounter.com;
                base-uri 'none';
                form-action 'none'"
     />
@@ -338,5 +339,6 @@
     </main>
 
     <script src="../../vendor/visimark-site-tutorial.js"></script>
+    <script data-goatcounter="https://visimark.goatcounter.com/count" async src="../../vendor/goatcounter-count.js"></script>
   </body>
 </html>
diff --git a/docs/examples/bakeoff/index.html b/docs/examples/bakeoff/index.html
@@ -30,7 +30,8 @@
       content="default-src 'none';
                script-src 'self';
                style-src 'self';
-               img-src 'self';
+               img-src 'self' https://visimark.goatcounter.com;
+               connect-src https://visimark.goatcounter.com;
                base-uri 'none';
                form-action 'none'"
     />
@@ -231,5 +232,6 @@
     </main>
 
     <script src="../../vendor/visimark-site-tutorial.js"></script>
+    <script data-goatcounter="https://visimark.goatcounter.com/count" async src="../../vendor/goatcounter-count.js"></script>
   </body>
 </html>