driftproof 0.10.1 → 0.11.0

package/README.md

@@ -1,12 +1,13 @@
 <!-- SPDX-License-Identifier: Apache-2.0 -->
 # Driftproof
 
-**Your skill passed. On which model? On what date?**
+**Is the gap your skill makes real, or noise? Did it hold on the last model release?**
 
-A SKILL.md teaches an AI coding agent how you like things done. When a new model
-ships, the same file can stop helping, or start hurting. Driftproof re-runs the
-skill's tests on the new model and hands you a dated, hash-verified receipt
-saying whether it still helps.
+A SKILL.md teaches an AI coding agent how you like things done. A skill's own
+tests passing is one answer. Driftproof asks two more: whether the scores with
+the skill and without it separate beyond their spread, and whether that held
+when the model changed. Each answer is a dated, hash-verified receipt, and when
+there were too few draws to tell, the receipt says so.
 
 [![driftproof](https://img.shields.io/endpoint?url=https://driftproofhq.com/badges/commit-message-conventions.json)](https://driftproofhq.com)
 &nbsp;— live badge for the bundled `commit-message-conventions` example, generated from its own receipt.
@@ -25,13 +26,13 @@ differ in what moves underneath the skill — or, in the value report, in which
 axes are measured; or, in the instrument re-measurement, in the instrument itself:
 
 - **[Report #001](https://driftproofhq.com/reports/001/)** — *release drift*: ten
-  public agent skills across a current-vs-previous Sonnet release; 9 of 10 moved
-  beyond noise. ([markdown](reports/report-001.md))
+  public agent skills across a current-vs-previous Sonnet release; 9 of 10 showed
+  a separation detected under the rule. ([markdown](reports/report-001.md))
 - **[Report #002](https://driftproofhq.com/reports/002/)** — *substrate
   durability*: the same suites across two vendors' CLIs (Claude vs Codex);
   3 durable, 4 substrate-dependent, 2 regressed, 1 no effect.
 - **[Report #003](https://driftproofhq.com/reports/003/)** — *release drift*:
-  `claude-opus-4-8` → `claude-opus-5`; 4 improved, 2 regressed, 4 within noise.
+  `claude-opus-4-8` → `claude-opus-5`; 4 improved, 2 regressed, 4 with no separation detected.
 - **[Report #004](https://driftproofhq.com/reports/004/)** — *capability gap*:
   `claude-opus-5` (flagship) vs `claude-fable-5` (frontier tier);
   3 durable, 5 tier-dependent, 0 regressions, 2 no effect — encoded expertise
@@ -68,8 +69,9 @@ axes are measured; or, in the instrument re-measurement, in the instrument itsel
 - **[Report #008](https://driftproofhq.com/reports/008/)** — *release drift*:
   two of Report #007's cells re-measured on `claude-fable-5-1` against
   `claude-fable-5`, with the skill `content_hash` and `suite_hash` asserted
-  identical before the first call. **Both cells came back within noise**: the
-  14 cases read 0 improved, 0 regressed, 14 within noise, 0 not measured. The
+  identical before the first call. **Neither cell showed a separation detected
+  under the rule**: the 14 cases read 0 improved, 0 regressed, 14 with no separation
+  detected, 0 not measured, which is not evidence that nothing changed. The
   first release pair in this project where both sides are generation-sampled
   receipts, which is what makes the delta attributable to the model rather than
   to the instrument. One case sits inside the verdict on the effect floor alone
@@ -97,8 +99,10 @@ instead of a stale one.
 The hard part isn't running an eval once — it's making the number **credible
 enough to act on**. An LLM judge is noisy, so a naive score can swing run to run
 by more than the drift you're trying to detect. Driftproof's answer is to **sample
-the judge and report confidence bands**, and to **only claim a regression when the
-bands don't overlap**. A tool that cries wolf is worse than no tool.
+and report bands**, each a descriptive spread (the mean plus or minus one sample
+standard deviation), and to **only claim a regression when the bands don't
+overlap**: a separation detected under that rule, not proof. A tool that cries wolf
+is worse than no tool.
 
 **A verdict without a price is half an answer.** The same receipts price the
 marginal cost of a skill firing, and Report #005 found the dominant cost driver is
@@ -139,17 +143,24 @@ effect floor, `NO_EFFECT` when it doesn't, `REGRESSED` when the skill hurts. Eac
 case is judged several times, so it carries a **band** (`mean ± stddev`) instead of
 one fragile number, and a case is only ever called regressed/improved when its two
 bands don't overlap. The **effect floor** (0.05, one judge quantization step) is the
-minimum real move required before a change counts as more than noise — band
-separation *plus* a floor-sized delta, never either alone.
-
-**What the band does not cover.** A verdict rests on **one generation draw per
-arm**: the band is the spread of the *judge* re-scoring that single response, not
-the spread of the model writing a different one. Report #006 measured the second
-directly and found it larger — draw-to-draw spread up to **sd 0.186** on the 0–1
-scale, against judge-level noise several times smaller. So treat a surprising
-single-run verdict as **provisional and worth re-running** before you act on it.
-Generation sampling lands in the next receipt spec; until it does, this is a
-limit of the instrument, stated rather than implied.
+minimum move required before a separation is called a change: band separation
+*plus* a floor-sized delta, never either alone.
+
+**What the band covers.** Since receipt spec v0.5 a run **samples the generation**
+as well as the judge: each arm is drawn at least 3 and at most 10 times
+(`GENERATION_SAMPLES_MIN` and `GENERATION_SAMPLES_MAX` in `config.js`, applied by
+`lib/sampling.js`), and each draw is judged several times. A run stops at 3 draws
+when the across-draw spread is no wider than the 0.05 effect floor; otherwise it
+keeps drawing until two successive estimates of that spread agree to within 0.01, or
+the ceiling is reached, and each case records its `stopping_reason`. So a band on a
+generation-sampled receipt is the spread of the model writing different responses,
+not only of the judge re-scoring one. Report #006 measured that spread directly and
+found it larger than judge-level noise, draw-to-draw **sd 0.186** at the most, which
+is why v0.5 samples it. A receipt from before v0.5 carries a **legacy** band, one
+generation per arm re-scored by the judge, and a comparison report labels each band
+`(legacy)` or `(generation)`. Either way a band describes the draws a run made, at
+the sample size it used, so treat a surprising verdict as **worth re-running**
+before you act on it.
 
 ### Install
 
@@ -179,6 +190,13 @@ optional and pulled in only for `CLAUDE_PROVIDER=api`. The CLI resolves its spec
 schema, and model registry from inside the package, so it runs the same from a
 global/npx install as it does in a checkout.
 
+**Platforms.** Driftproof is tested on Linux and macOS. In an outside retest of
+0.10.1 on macOS the shipped gate passed 592 of 611, with 19 failed and 1 not
+applicable, and all nineteen failures are in the publishing helper, which needs
+GNU `realpath -m`. Windows is untested: from Node's source the plugin would not
+find `npx` there, but that failure has never been observed. A CI matrix across
+Linux, macOS and Windows is planned.
+
 ### Other commands
 
 ```bash
@@ -278,7 +296,7 @@ A receipt is the unit of evidence — one JSON document conforming to
 
 ```jsonc
 {
-  "schema_version": "0.6",
+  "schema_version": "0.7",
   "skill":  { "name": "commit-message-conventions", "version": "0.2.0",
               "content_hash": "…sha256 over SKILL.md + bundled files…" },
   "suite":  { "format": "agentskills.io/evals", "suite_hash": "…", "case_count": 10 },
@@ -287,7 +305,7 @@ A receipt is the unit of evidence — one JSON document conforming to
     "model_release_date": "2025-10-01",
     "provider": "anthropic",
     "surface": "claude-cli",
-    "runner_version": "0.10.1",
+    "runner_version": "0.11.0",
     "date_utc": "2026-07-27T…Z",
     "registry": "registered",
     "transcripts": "hashes-only",
@@ -329,7 +347,7 @@ Key ideas:
 
 - **`content_hash` / `suite_hash`** are computed over a canonical JSON form, so the
   same skill and suite hash identically on any machine — receipts are comparable.
-- **Per-case `samples` / `mean` / `stddev`** give each case a confidence band. An
+- **Per-case `samples` / `mean` / `stddev`** give each case a band, a descriptive spread of one sample standard deviation. An
   `outcome` of **`borderline`** means the pass threshold sits *inside* the band —
   the run can't confidently call it pass or fail.
 - **`delta_uncertainty`** is the combined band on the with-skill-vs-baseline lift.
@@ -349,7 +367,8 @@ Key ideas:
 `driftproof diff A.json B.json` compares the with-skill bands per case across two
 receipts. The rule that keeps it honest: a **regression** (or improvement) is
 claimed **only when the two bands do not overlap**. Overlapping bands are reported
-as **within noise** and never counted as a regression.
+as **no separation detected** at the sample size used: never counted as a
+regression, and never evidence that nothing changed.
 
 ## Verification in CI (GitHub Action + badge)
 
@@ -365,7 +384,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: driftproofhq/driftproof@v0.10.1
+      - uses: driftproofhq/driftproof@v0.11.0
         with:
           skill-dir: skills/my-skill
           models: claude-haiku-4-5

package/bin/driftproof

@@ -13,7 +13,7 @@ const { buildDriftReport, revisionPairProblem } = require('../lib/diff');
 const { surfaceForModel, isSubscriptionSurface, resolveModel, evalUser } = require('../lib/provider');
 const { estimateRunCostUSD, BudgetTracker } = require('../lib/cost');
 const { registryStatus, assertRegistered, REGISTRY_PATH } = require('../lib/models');
-const { verdictFromReceipt, badgeEndpoint, githubOutputLines } = require('../lib/verdict');
+const { verdictFromReceipt, badgeEndpoint, githubOutputLines, drawsLine, UNDERPOWERED_LINE } = require('../lib/verdict');
 const decision = require('../lib/decision');
 const { scaffoldInit } = require('../lib/init');
 
@@ -75,7 +75,7 @@ function loadRc(skillDir) {
 
 // Flags that never take a value, so `--trusted-skill <skill-dir>` keeps the dir
 // positional instead of swallowing it as the flag's value.
-const BOOLEAN_FLAGS = new Set(['trusted-skill']);
+const BOOLEAN_FLAGS = new Set(['trusted-skill', 'svg']);
 
 // ── THE INPUT CONTRACT (spec 026 AC-9, F5) ────────────────────────────────────
 // A COPY of action/lib.sh's RE_* rules, in the shape spec 028's fixture holds
@@ -177,7 +177,7 @@ USAGE
                         [--keep-transcripts] [--out DIR] [--trusted-skill]
   ${PROJECT_NAME} diff <receiptA.json> <receiptB.json> [--out FILE] [--mode release|revision]
   ${PROJECT_NAME} validate <receipt.json>
-  ${PROJECT_NAME} badge <receipt.json|receipts-dir> [--models a,b] [--out FILE] [--github-output]
+  ${PROJECT_NAME} badge <receipt.json|receipts-dir> [--models a,b] [--out FILE] [--github-output] [--svg [--href URL]]
   ${PROJECT_NAME} decide <receipts-dir> --models a,b [--github-output] [--badge FILE]
                         [--summary FILE] [--enforce] [--fail-on-regression true|false]
   ${PROJECT_NAME} import <results.json> --from agent-skills-eval|skillgrade [--out DIR]
@@ -515,17 +515,35 @@ function cmdBadge(positional, flags) {
   if (fs.existsSync(p) && fs.statSync(p).isDirectory()) return cmdBadgeSet(p, flags);
   const receipt = JSON.parse(fs.readFileSync(p, 'utf8'));
   refuseUnverified(receipt, p, 'badge');
+  if (flags.svg) {
+    // SPEC 036. The drawn badge: state, model, date, lift and uncertainty, with the
+    // machine token in its data attributes. After the same hash check as the JSON.
+    const svg = require('../lib/badge-svg').badgeSvg(receipt, { href: typeof flags.href === 'string' ? flags.href : null });
+    if (flags.out) {
+      const out = path.resolve(flags.out);
+      fs.mkdirSync(path.dirname(out), { recursive: true });
+      fs.writeFileSync(out, svg);
+      console.log(`badge written to ${flags.out}  (${verdictFromReceipt(receipt).verdict}, svg)`);
+    } else process.stdout.write(svg);
+    return;
+  }
   if (flags['github-output']) { console.log(githubOutputLines(receipt)); return; }
   const badge = badgeEndpoint(receipt);
   const json = JSON.stringify(badge, null, 2);
+  const v = verdictFromReceipt(receipt);
+  // SPEC 035 AC-3. An UNDERPOWERED receipt says so in words and says what it would
+  // have needed. Beside JSON on stdout the two lines go to stderr, so a caller that
+  // redirects the badge still gets a file that parses.
+  const power = v.verdict === 'UNDERPOWERED' ? [`${UNDERPOWERED_LINE}.`, drawsLine(v.drawsNeeded)] : [];
   if (flags.out) {
     const out = path.resolve(flags.out);
     fs.mkdirSync(path.dirname(out), { recursive: true });
     fs.writeFileSync(out, json + '\n');
-    const v = verdictFromReceipt(receipt);
     console.log(`badge written to ${flags.out}  (${v.verdict}: ${badge.message}, ${badge.color})`);
+    for (const line of power) console.log(line);
   } else {
     console.log(json);
+    for (const line of power) console.error(line);
   }
 }
 

package/config.js

@@ -9,7 +9,7 @@ const PROJECT_NAME = 'driftproof';
 // Bumped whenever the runner's behaviour or receipt-generation semantics change
 // in a way that could affect results. Recorded into every receipt as
 // run.runner_version so a receipt is reproducible against a known engine.
-const RUNNER_VERSION = '0.10.1';
+const RUNNER_VERSION = '0.11.0';
 
 // The eval format we CONSUME (we deliberately do not invent our own).
 const SUITE_FORMAT = 'agentskills.io/evals';
@@ -38,7 +38,7 @@ const SUITE_FORMAT = 'agentskills.io/evals';
 //        results.aggregates.band_rule, and bands that are null where the formula
 //        cannot form. NOT additive for the validator: a v0.5 receipt restamped 0.6
 //        is refused. v0.5 is frozen as receipt.v0.5.schema.json.
-const RECEIPT_SCHEMA_VERSION = '0.6';
+const RECEIPT_SCHEMA_VERSION = '0.7';
 
 // Input bounds on the skill loader and the post-checks (spec 026 AC-13, audit
 // A3/A7). lib/skill.js loaded every bundled file with no count, depth, byte,
@@ -99,11 +99,18 @@ const DEFAULT_JUDGE_SAMPLES = 5;
 // to a coarse ~0.05–0.1 grid, so a confident grade often has stddev 0 (a "point
 // band"). Two point bands that differ by a single quantum (e.g. 0.60 vs 0.64)
 // are technically non-overlapping yet represent no meaningful behaviour change.
-// The floor turns such statistically-separated-but-trivial moves into
-// "within noise (below effect floor)". 0.05 = one judge quantum. Documented in
+// The floor keeps such separated but trivial moves from being called a verdict
+// ("below effect floor" in the per-case table). 0.05 = one judge quantum. Documented in
 // spec/RECEIPT.md § "Drift verdict rule" and the report methodology.
 const EFFECT_FLOOR = 0.05;
 
+// How many standard errors of the difference between two means a case's resolution
+// adds to its two spreads (spec 035 R-2). A case the band rule does not separate is
+// UNDERPOWERED when its spreads plus this many standard errors reach the floor: at
+// those spreads and draws, a true shift of the floor's size could have gone unseparated.
+// Named, so a later decision moves it by one line and one amendment.
+const POWER_Z = 2;
+
 // ── generation sampling (receipt spec v0.5) ─────────────────────────────────
 //
 // Report #006 measured across-draw spread at sd 0.186 and 0.183 while the
@@ -131,7 +138,7 @@ const REPORT_002_GPT_MODEL = 'gpt-5.6-sol';
 const REPORT_002_JUDGE_MODEL = 'claude-haiku-4-5';
 
 // Report #003 is a RELEASE DRIFT report (Report #001's type): one provider, two
-// model versions, verdicts REGRESSED/IMPROVED/MIXED/WITHIN NOISE per skill under
+// model versions, a per-skill verdict label (regressed, improved, mixed, or none separated) under
 // the per-case band-separation rule + effect floor. New vs its family predecessor.
 const REPORT_003_NEW_MODEL = 'claude-opus-5';
 const REPORT_003_OLD_MODEL = 'claude-opus-4-8';
@@ -157,7 +164,7 @@ const REPORT_005_JUDGE_MODEL = 'claude-haiku-4-5';
 module.exports = {
   PROJECT_NAME, RUNNER_VERSION, SUITE_FORMAT, RECEIPT_SCHEMA_VERSION, DEFAULT_JUDGE_SAMPLES,
   SKILL_MAX_FILES, SKILL_MAX_BYTES, SKILL_MAX_DEPTH, SUITE_MAX_CASES, CASE_MAX_CHARS, CHECK_MAX_PATTERN,
-  EFFECT_FLOOR, DEV_MAX_USD, DEV_MAX_CALLS, REPORT_MAX_USD, TRIGGER_MAX_USD,
+  EFFECT_FLOOR, POWER_Z, DEV_MAX_USD, DEV_MAX_CALLS, REPORT_MAX_USD, TRIGGER_MAX_USD,
   GENERATION_SAMPLES_MIN, GENERATION_SAMPLES_MAX, GENERATION_SD_THRESHOLD, GENERATION_STABILITY_EPS,
   REPORT_002_CLAUDE_MODEL, REPORT_002_GPT_MODEL, REPORT_002_JUDGE_MODEL,
   REPORT_003_NEW_MODEL, REPORT_003_OLD_MODEL, REPORT_003_JUDGE_MODEL,

package/lib/badge-svg.js

@@ -0,0 +1,130 @@
+// SPDX-License-Identifier: Apache-2.0
+'use strict';
+
+// The badge, drawn (spec 036).
+//
+// The shields endpoint JSON (lib/verdict.js badgeEndpoint) carries a label, a message
+// and a colour, which is all a shields badge can hold. This draws the badge itself, so
+// it can show what a reader needs at a glance: the state, the model, the date, the lift
+// and its uncertainty. Four segments, left to right:
+//
+//   driftproof | <state label> | <model> · <date> | lift <+0.000> <± 0.000 | no ±>
+//
+// The fourth segment carries the lift ONLY for a state that measured one. UNDERPOWERED and
+// NOT_MEASURED carry the draws taken against the draws needed instead (A-036-2):
+//
+//   driftproof | not enough draws | <model> · <date> | 3 draws of 87 needed
+//
+// THE WORDS ARE HUMAN; THE TOKENS ARE DATA. What a reader sees is a label (passing, not
+// enough draws); the machine token the Action and the differ publish sits on the root
+// element as data-verdict, with the receipt hash beside it, and never in the text.
+//
+// UNDERPOWERED IS DRAWN AS THE HONEST STATE, not as a failure: a calm indigo no other
+// state uses, an open hatch over it, a dashed edge around it, and the words "not enough
+// draws". Every state's text is white on a fill it clears 4.5:1 against, hatch included.
+//
+// Text widths are fixed with textLength, so a text's rendered box is the width this file
+// allots it whatever font the viewer has, and it cannot spill out of its segment.
+
+const { receiptVerdict, shortModel, receiptDrawsTaken } = require('./verdict');
+
+const INK = '#ffffff';
+const BRAND = '#24292f';
+const DETAIL = '#4b5563';
+const EFFECT = '#374151';
+const STATE = {
+  PASSED: { fill: '#1a7f37' },
+  REGRESSED: { fill: '#b42318' },
+  UNDERPOWERED: { fill: '#3538cd', hatch: '#444ce7', edge: '#a4bcfd' },
+  NO_EFFECT: { fill: '#57606a' },
+  NOT_MEASURED: { fill: '#656d76' },
+};
+const LABELS = {
+  PASSED: 'passing',
+  REGRESSED: 'regressed',
+  UNDERPOWERED: 'not enough draws',
+  NO_EFFECT: 'no separation detected',
+  NOT_MEASURED: 'not measured',
+};
+
+const H = 20;
+const PAD = 7;
+const CHAR = 6.6;
+const esc = (s) => String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+const textW = (s) => Math.round(String(s).length * CHAR * 10) / 10;
+
+// A LIFT FIGURE IS A MEASUREMENT, so only a state that measured one may print it
+// (spec 036 A-036-2). UNDERPOWERED says the receipt's draws cannot resolve a shift of the
+// effect floor, and NOT_MEASURED says the receipt carries no verdict at all. A lift beside
+// either is the badge answering, in its most legible segment, a question the state has just
+// said it cannot answer -- and a reader who takes one figure from a badge takes that one.
+// Those two states print what the reader can act on instead: the draws taken against the
+// draws that would have been needed.
+function effectText(receipt, v) {
+  const c = receipt.comparison || {};
+  if (v.verdict === 'UNDERPOWERED' || v.verdict === 'NOT_MEASURED') return drawsText(receipt, v);
+  const lift = typeof c.delta === 'number' ? `lift ${c.delta >= 0 ? '+' : '-'}${Math.abs(c.delta).toFixed(3)}` : 'no lift';
+  const unc = typeof c.delta_uncertainty === 'number' ? `± ${c.delta_uncertainty.toFixed(3)}`
+    : c.delta_uncertainty_unavailable === 'single_case' ? 'no ± (1 case)' : 'no ±';
+  return `${lift} ${unc}`;
+}
+
+// Draws taken against draws needed, in the badge's words. The needed count is
+// receiptDrawsNeeded's, the same figure drawsLine prints in a sentence, so the badge and
+// the page cannot say two different numbers. Where no count exists the badge says which
+// of the two reasons it is, rather than printing a bare figure or nothing at all.
+//
+// BOTH NUMBERS ARE ONE CASE'S (A-036-7). Where a case sets the draws needed, the draws taken
+// are that case's own, which receiptDrawsNeeded carries as `taken`. This read the smallest
+// over every readable case, so a receipt whose binding case drew 4 and whose other case drew
+// 2 badged "2 draws of 5 needed": a 2 from a case the 5 does not belong to. Where no case sets
+// the draws needed (NOT_MEASURED carries no verdict to compute one from) there is no binding
+// case, and the smallest over every readable case is the figure.
+function drawsText(receipt, v) {
+  const d = v.drawsNeeded;
+  const taken = d ? d.taken : receiptDrawsTaken(receipt);
+  if (taken === null || taken === undefined) return 'no draws recorded';
+  const draws = `${taken} ${taken === 1 ? 'draw' : 'draws'}`;
+  if (!d) return `${draws}, needed not computed`;
+  if (typeof d.value === 'number') return `${draws} of ${d.value} needed`;
+  return `${draws}, no count at these spreads`;
+}
+
+function badgeSvg(receipt, { href = null } = {}) {
+  const v = receiptVerdict(receipt);
+  const state = STATE[v.verdict];
+  const label = LABELS[v.verdict];
+  const model = shortModel((receipt.run || {}).model_id);
+  const date = String((receipt.run || {}).date_utc || '').slice(0, 10);
+  const segs = [
+    { seg: 'brand', text: 'driftproof', fill: BRAND },
+    { seg: 'state', text: label, fill: state.fill },
+    { seg: 'detail', text: `${model} · ${date}`, fill: DETAIL },
+    { seg: 'effect', text: effectText(receipt, v), fill: EFFECT },
+  ];
+  let x = 0;
+  for (const s of segs) { s.w = Math.round(textW(s.text) + 2 * PAD); s.x = x; x += s.w; }
+  const width = x;
+  const title = `driftproof: ${label} on ${model}, ${date}, ${effectText(receipt, v)}`;
+  const L = [];
+  L.push(`<svg xmlns="http://www.w3.org/2000/svg" width="${width}" height="${H}" viewBox="0 0 ${width} ${H}" role="img" aria-label="${esc(title)}" data-verdict="${v.verdict}" data-receipt-hash="${esc(receipt.receipt_hash || '')}">`);
+  L.push(`<title>${esc(title)}</title>`);
+  if (state.hatch) {
+    L.push(`<defs><pattern id="hatch" width="6" height="6" patternUnits="userSpaceOnUse" patternTransform="rotate(45)"><line x1="0" y1="0" x2="0" y2="6" stroke="${state.hatch}" stroke-width="3"/></pattern></defs>`);
+  }
+  if (href) L.push(`<a href="${esc(href)}">`);
+  for (const s of segs) {
+    const isState = s.seg === 'state';
+    const edge = isState && state.edge ? ` stroke="${state.edge}" stroke-width="1" stroke-dasharray="3 2"` : '';
+    L.push(`<rect data-seg="${s.seg}" x="${s.x}" y="0" width="${s.w}" height="${H}" fill="${s.fill}"${edge}/>`);
+    if (isState && state.hatch) L.push(`<rect data-seg="state-hatch" x="${s.x}" y="0" width="${s.w}" height="${H}" fill="url(#hatch)" opacity="0.35"/>`);
+  }
+  for (const s of segs) {
+    L.push(`<text data-seg="${s.seg}" x="${s.x + PAD}" y="14" fill="${INK}" font-family="Verdana,DejaVu Sans,sans-serif" font-size="11" textLength="${textW(s.text)}" lengthAdjust="spacingAndGlyphs">${esc(s.text)}</text>`);
+  }
+  if (href) L.push('</a>');
+  L.push('</svg>');
+  return L.join('\n') + '\n';
+}
+
+module.exports = { badgeSvg, LABELS, STATE };

package/lib/decision.js

@@ -20,7 +20,7 @@
 const fs = require('fs');
 const path = require('path');
 const { EFFECT_FLOOR } = require('../config');
-const { shortModel, githubOutputEntry } = require('./verdict');
+const { shortModel, githubOutputEntry, receiptVerdict, drawsLine, UNDERPOWERED_LINE } = require('./verdict');
 
 // The six decision states (spec 030 AC-4).
 //
@@ -29,7 +29,12 @@ const { shortModel, githubOutputEntry } = require('./verdict');
 // that says so. `no detected effect` is false about such a model - the effect
 // was detected and it cleared the floor - and widening it to mean "not a
 // regression" would put a measured lift and a measured nothing in one cell.
-const STATES = ['regression', 'refused', 'inconclusive', 'not measured', 'no detected effect', 'helped'];
+//
+// `underpowered` is the seventh (spec 035): the receipt measured, and its own spreads
+// and draws could not resolve a shift of the effect floor. It sits after `not
+// measured`, which measured nothing, and before `no detected effect`, which measured
+// with a resolution below the floor.
+const STATES = ['regression', 'refused', 'inconclusive', 'not measured', 'underpowered', 'no detected effect', 'helped'];
 
 // WORST FIRST. This is the single definition of the ordering; AC-1's
 // enforcement and AC-3's badge both read it, so they cannot disagree about
@@ -38,7 +43,7 @@ const STATE_ORDER = STATES.slice();
 
 // States that must never render as success on any surface the action writes -
 // the badge, the summary row, or the check title (AC-4).
-const NEVER_SUCCESS = ['inconclusive', 'not measured'];
+const NEVER_SUCCESS = ['inconclusive', 'not measured', 'underpowered'];
 
 // States that fail the job. `refused` fails CLOSED (AC-2): a model that
 // produced no receipt is not a model that passed. `regression` fails subject to
@@ -86,11 +91,15 @@ function decisionState(receipt) {
   if (level !== 'TESTED' || kind !== 'model') return 'not measured';
   const cmp = receipt.comparison || {};
   if ((receipt.run && receipt.run.status === 'incomplete') || typeof cmp.delta !== 'number') return 'inconclusive';
-  if (cmp.delta <= -EFFECT_FLOOR) return 'regression';
-  if (cmp.delta >= EFFECT_FLOOR) return 'helped';
-  return 'no detected effect';
+  // Spec 035: the measured states are the receipt verdict's, read per case by the
+  // band rule (lib/verdict.js receiptVerdict), not the aggregate delta against the floor.
+  // receiptVerdict refuses on the same four conditions the two clauses above split
+  // between `not measured` and `inconclusive`, so it cannot answer NOT_MEASURED here.
+  return MEASURED_STATE[receiptVerdict(receipt).verdict];
 }
 
+const MEASURED_STATE = { REGRESSED: 'regression', PASSED: 'helped', UNDERPOWERED: 'underpowered', NO_EFFECT: 'no detected effect' };
+
 // The worst state in a set, by STATE_ORDER. An empty set has no decision, and
 // says so with null rather than defaulting to something benign.
 function worstState(states) {
@@ -182,6 +191,8 @@ function decideSet(dir, requestedCsv, { failOnRegression = true } = {}) {
       delta: receipt && receipt.comparison && typeof receipt.comparison.delta === 'number'
         ? receipt.comparison.delta : null,
       file: hit ? path.basename(hit.file) : (unreadable ? path.basename(unreadable.file) : null),
+      // Spec 035 AC-3: what an underpowered row would have needed, from the same reading.
+      drawsNeeded: state === 'underpowered' ? receiptVerdict(receipt).drawsNeeded : null,
       // The distinction is carried on the ROW, not left in a sentence, because
       // the enforcement message has to say which of the two happened (AC-2's
       // mutation class, absence-vs-unreadable).
@@ -246,6 +257,7 @@ const RENDER = {
   refused: { word: 'refused', color: 'red', marker: '\u274c' },
   inconclusive: { word: 'inconclusive', color: 'yellow', marker: '\u26a0\ufe0f' },
   'not measured': { word: 'not measured', color: 'lightgrey', marker: '\u26a0\ufe0f' },
+  underpowered: { word: 'not enough draws', color: 'blue', marker: '\u26a0\ufe0f' },
   'no detected effect': { word: 'no effect', color: 'lightgrey', marker: '\u2014' },
   helped: { word: 'passing', color: 'brightgreen', marker: '\u2705' },
 };
@@ -283,7 +295,7 @@ function badgeEndpointForSet(d, { label = 'driftproof' } = {}) {
 // `worst`, `regressed` and `missing` are new and carry what it could not say.
 const VERDICT_WORD = {
   regression: 'REGRESSED', refused: 'REFUSED', inconclusive: 'INCONCLUSIVE',
-  'not measured': 'NOT_MEASURED', 'no detected effect': 'NO_EFFECT', helped: 'PASSED',
+  'not measured': 'NOT_MEASURED', underpowered: 'UNDERPOWERED', 'no detected effect': 'NO_EFFECT', helped: 'PASSED',
 };
 
 function githubOutputLines(d) {
@@ -299,6 +311,10 @@ function githubOutputLines(d) {
     ['regressed_models', d.regressed.join(',')],
     ['missing_models', d.missing.join(',')],
     ['receipt_count', d.receiptCount],
+    // Spec 035 AC-3: the draws the worst row would have needed, when that row is
+    // underpowered; `none` when no draw count reaches the floor at its spreads, and
+    // empty otherwise.
+    ['draws_needed', worstRow && worstRow.drawsNeeded ? (worstRow.drawsNeeded.value === null ? 'none' : worstRow.drawsNeeded.value) : ''],
   ].map(([k, v]) => githubOutputEntry(k, v)).join('\n');
 }
 
@@ -324,7 +340,8 @@ function summaryMarkdown(d) {
     const r = RENDER[row.state];
     const delta = row.delta === null ? 'n/a' : (row.delta >= 0 ? '+' : '') + row.delta.toFixed(3);
     const note = row.reason ? ` <br><sub>${cell(row.reason)}</sub>` : '';
-    L.push(`| \`${cell(row.model)}\` | ${r.marker} ${row.state} | ${delta} | ${cell(row.file) || '\u2014'}${note} |`);
+    const power = row.state === 'underpowered' ? ` <br><sub>${cell(UNDERPOWERED_LINE)}. ${cell(drawsLine(row.drawsNeeded))}</sub>` : '';
+    L.push(`| \`${cell(row.model)}\` | ${r.marker} ${row.state}${power} | ${delta} | ${cell(row.file) || '\u2014'}${note} |`);
   }
   L.push('');
   L.push(`Decided over ${d.receiptCount} receipt(s) for ${d.requestedCount} requested model(s). `