Publish an opt-in adopters registry, and the rule that every adoption number comes from it (#475) - #531

Summary

Closes #475.

Shipgate collects nothing, deliberately. The price is that it cannot count its
own users: downloads measure CI caches, stars measure sentiment, and the repos
that quietly run the gate every day are invisible. This adds the counting
mechanism that stance requires — ADOPTERS.md,
opt-in and self-served, plus the rule that every adoption number this project
publishes comes from it.

• One row per adopter, added by the adopter — through the new
  Adopter entry issue form or a
  pull request. Six fields: who, which repository (or the single word
  private), what it gates, the tier, the date, and a link to the public act
  where they asked. That link is the consent record, and it is what the count
  rests on.
• Three tiers, defined tightly: local evaluation, advisory CI,
  blocking CI — the last one meaning the job fails on a verdict and the
  check is required on the protected branch.
• An eight-rule claims policy. No entry, no claim; every number carries its
  as-of date; external and dogfooding are never summed; an entry is a dated
  statement rather than a measurement; a tier is self-reported and never
  upgraded; a badge is not an entry; the design-partner ledger (The design-partner pilot stops at one PR: measure reviewer value and the next eligible change #521) and the
  historical corpus (Gate 2: participant validation of the frozen corpus (#456) #511) stay separate; removal is unconditional.
• One optional badge, deliberately tier-neutral, linking back to the
  registry. There is no blocking-CI variant and the file says why.
• Today's numbers, published rather than omitted: 0 external entries, 1
  maintainer dogfooding entry.

The self-entry says advisory CI

Both self-gate workflows do fail the run on blocked and unknown — but
main carries no required status check, so a red run stops no merge. Under the
file's own definitions that is advisory, and a guard fails the build if the row
is ever raised without rewriting the paragraph that explains it. It is the
smallest available demonstration of the rule the registry runs on: the tier is
what is true, not what is flattering.

Type

• Documentation only

Surface discipline. Not a new surface under
CONTRIBUTING §Surface discipline — no CLI
command, schema, report block, discovery surface or adapter, and no data
collection of any kind. ADOPTERS.md is registered in
NOT_A_DISTRIBUTION_SURFACE with its reason (it publishes self-reported
adopter claims, not an engine answer), which is what the top-level classifier
requires of any new root entry. Headline metric: attributable public adoption
claims, with dogfooding and external entries separated.

Verification

Local, all green: ruff check .; the full pytest -n auto -m "not perf" gate;
tests/test_adapter_static_only.py and tests/test_latency_budget.py -m perf
in their own runs, as CI splits them.

tests/test_adopters_registry.py (46 tests) is the "and verify" half of the
issue title. It fails on a row missing a field, a row whose cell count is wrong
(reported by name rather than as a zip() error during collection), an
undefined tier, a non-ISO or future date, an entry link that does not point
into this repository, this repository listed as an external adopter, counts
that disagree with the rows, an as-of date older than the newest entry, an
empty table that stops saying it is empty, a claims rule quietly dropped, a
second badge variant, a README that drops the privacy stance or drifts from the
registry's counts, an issue form that offers an undefined tier or stops
requiring consent — and any adopter number stated anywhere in the repository's
prose that these rows cannot source.

A 50-case perturbation sweep drove every one of those mutations against the
suite and confirmed each fails, that the legitimate edits still pass (adding a
real adopter correctly, adding a second maintainer row with its explanation,
writing the grammatically singular "1 external adopter entry"), and — via a
no-op detector — that every mutation string actually matched something. It
found two real defects while I was writing it, both fixed here:

1. The badge guard folded case before looking for a tier token, so a
   blocking%20CI badge variant slipped through. It now also requires the
   section to carry exactly one shields.io URL.
2. The claim scanner's first draft misfired on real prose in this repository —
   "5 sentences of user instructions", "27 national company registries" —
   because it accepted a preposition as filler. A number now counts as a claim
   only when it reads as one: a use verb in front of it, a use verb behind it,
   or a noun with no other meaning here. Both strings are pinned as
   must-not-fire cases.

A third came out of the sweep's own failure: the negative controls hard-coded
the number 1, which silently stopped being a control the moment a test
adopter row made 1 traceable. They now derive an unsourceable number from the
published counts.

Two review rounds followed, both with findings (commits 2 and 3):

• Round 1, on the guards: the README count assertion demanded the plural
  "entries", so the first real adopter had to write "1 external adopter
  entries" or take a red build over grammar; the self-entry agreement guard
  hard-coded a sentence opener that cannot be written naturally once there are
  two maintainer rows; dates were compared against the runner's local today,
  failing a contributor east of UTC; and the claim scanner re-parsed
  ADOPTERS.md once per scanned file (294 today).
• Round 2, on the prose: the self-entry's advisory CI claim had been
  checked against the wrong mechanism. Classic branch protection reports
  main as unprotected, but an active ruleset governs it. It requires a pull
  request and linear history and carries no required_status_checks rule — so
  the tier stands, and the file now names the command that shows it. ROADMAP.md
  was also restating the external count in prose, which is rule 2's staleness
  trap one file over; it points at the registry now instead.
• Round 3, on review feedback (three P2s, all reproduced before and after, in
  5789ef07): a neighbouring sentence about dogfooding could authorize an
  explicitly external number — the exemption is now scoped to the claim's own
  sentence, and a claim that calls itself external never takes it at all;
  duplicate rows inflated the counts, since counts were compared to
  len() — rows now carry an adopter+repository identity checked across both
  tables; and only GitHub repositories were accepted, which would have told
  a GitLab or self-hosted adopter to write private about a public repository
  — repository host and consent record are now validated independently.

Not done here

The site half of the acceptance is not in this repository. "Linked from the
README and the site" — the README is done; threemoonslab.com is built from the
private ThreeMoonsLab/web repo, so the site link needs a change there. Happy
to file that as a tracking issue in web on request; it is the one acceptance
box this PR cannot tick.

Release-readiness notes

• No user-code import added to default scan paths
• No network access added to default scan paths
• New or changed check IDs are documented in docs/checks.md — n/a, no check changes
• Report/schema changes are additive or documented in STABILITY.md — n/a, no schema changes

🤖 Generated with Claude Code