$ledger
$ledger : \Drupal\strata\Health\HealthLedgerInterface
Runs the repair a finding's rung names, unattended or for one code on request.
Until 1.0.3 the ladder had no runner. health.auto_repair shipped on by default, a checkbox on
the retention form wrote it, the schema declared it, the README said the four rungs at or below
rebuild run on cron - and nothing read the setting. CircuitBreaker had a full unit suite and
no caller. So a site that recorded a finding recorded it forever: nothing ran a pass, and nothing
called HealthLedgerInterface::resolve() anywhere in the module, so the dashboard only ever grew.
Findings are resolved before a pass runs, not after, and put back when it raises. A pass that
succeeds proves the work was done, never that the symptom is gone, and only some passes re-check:
Verifier::verify() sweeps the tripwires again and re-records whatever is still true, while
Reindexer::reindex() does not. Clearing afterwards would therefore delete a symptom the pass had
just re-confirmed. Clearing first and restoring on failure keeps both ends honest: the ledger
shows the newest sweep rather than a running total, and a pass that could not run leaves the store
looking exactly as broken as it is.
A rung's pass runs once however many codes name it. Four codes sitting at reindex are one
reindex, not four.
Failure escalates, and escalation is how cron hands the problem over. A code whose pass raises
climbs one rung; climbing past rebuild reaches quarantine, which RepairLadder::isAutomatic()
refuses, so the code stops being retried and waits for a person. The breaker is the shorter leash
inside a single run: three failures on a code and it is left alone.
$ledger : \Drupal\strata\Health\HealthLedgerInterface
$breaker : \Drupal\strata\Health\CircuitBreaker