Patching that repairs failures
A patch fails and nobody notices until the audit.
A failed Windows update gets repair tries first.
What's different
The list of fixes is printed on the policy page.
Each attempt is recorded on the device.
The ticket arrives with what was tried.