The escalation boundary — where money, law, and anger stay human — step 8 of 8

Checkpoint: the incident drill, end to end.

The return-window macro is eval-passed. Its shipped logic escalates when days > 35 — but the actual policy window is 30 days. Nobody noticed, because both golden cases (day 10, day 45) land on the same side of both numbers — it got promoted on a thin two-case set. The lesson-2 ladder catches an empty golden set, not a thin one; nobody enforced the five-case entry ticket, and this drill is exactly why it exists. Today it told a day-31 customer they were still inside the window. A human caught it in review of an adjacent ticket.

Write run_drill(macro, fn, incident) that runs the response, printing four lines:

1. Pull the macro: set its status to "pulled" and print kill switch: NAME pulled
2. Print correction: sent by a named human — the customer gets a person, not a corrected template.
3. Bank the incident: append it to the macro's golden set and print golden set: BEFORE -> AFTER cases
4. Re-run the evals over the grown set (a case passes when fn(ticket) == want). Set status to "eval-passed" only if every case passes, else "review-required", and print re-eval: PASSED/TOTAL — STATUS

The buggy fn will now fail its own incident case — that's the ratchet working. Expected output:

kill switch: return-window pulled
correction: sent by a named human
golden set: 2 -> 3 cases
re-eval: 2/3 — review-required