tools(sentry): measure gate uptake from the population that emits the errors

[dzianisv]

The number that decides AGE-105 was coming from a population that cannot see most of our users

noise-gate-report.mjs grades the noise gate with

expected_post = baseline x (1 - gated_share x efficacy)

gated_share came from Play's version share. This app's marketed install paths are the self-hosted F-Droid repo and the direct APK (docs/marketing/*), and Play production had been serving versionCode 136 (2026-06-22) for eight weeks when the gate shipped. Play's denominator cannot contain those users; Sentry's can, because it is built from the devices that actually send events.

scripts/release-uptake.mjs reads gated share from Sentry release health. Sessions are billed against a different quota than errors, so they keep arriving while the org is over its error quota and every error is rate-limited away — precisely when this measurement is needed. It also needs no Play service account, so it runs on a laptop instead of only in CI.

First live reading — 7d to 2026-08-14

version       users   share    sessions   share   gated
0.4.10         801   78.5%      8175   75.3%   no
0.4.12         161   15.8%      2369   21.8%   no
0.4.13          30    2.9%       139    1.3%   no
0.4.14           7    0.7%        17    0.2%   yes

gated share (users):    0.7%  (7/1021)
gated share (sessions): 0.2%  (17/10855)
largest ungated cohort: v0.4.10 at 78.5% of active users

v0.4.10 has held ~78% for four weeks; v0.4.12 sat flat at ~16% for three. This install base does not auto-converge on the newest build, which is the assumption written into the Play-based path ("Play auto-updates, so its active base converges on the newest build fast"). Until that cohort moves, the ceiling on any client-side reduction is ~21.5%, whatever the gate does on-device.

What the tests pin

Every one of these fails silently in production if it regresses:

• 0.4.9 vs 0.4.10 ordering — lexical compare puts them on the wrong side of the gate.
• Unparseable release names stay in the denominator; dropping them inflates the share.
• An empty window returns share: null, never 0, so "no data" cannot grade as "nobody upgraded".
• User share and session share are both reported when they diverge (quota is consumed per event, not per user).
• The projection refuses undefendable horizons and flat series instead of extrapolating uptake that is not happening.

node --test scripts/release-uptake.test.mjs — 10 pass. Already covered by npm test (scripts/*.test.mjs).

Deliberately not wired into noise-gate-report.mjs here

That file is modified by both #175 and #174. This PR is new files only, so it cannot conflict with or re-orphan that stack. Wiring the Sentry source in as the preferred gated_share (Play as cross-check) follows once they land.

Refs AGE-105.