Ledger
The failure ledger across services: each service keeps its own ledger, atomic with its checkpoints, and publishes its changes to the ops context, which aggregates them; an operator's action goes back to the owning service.
Publishing: a service sends each change of an entry as a command to the aggregate PARKED of the ops context (OPS_CONTEXT by default), through that context's command topic: RECORD_PARKED with the LedgerEntry as its member ENTRY while the entry is parked, RECORD_RESOLVED with the LedgerResolution as its member RESOLUTION once it is not. The aggregate's id is parkedId: one per service, subscription and parked aggregate.
Acting: the ops context sends the system commands RETRY, SKIP, MARK_RECOVERABLE and APPLY_RETRY_SPEC (RetryParked, SkipParked, MarkParkedRecoverable, ApplyParkedRetrySpec) to the command topic of the context that holds the entry (LedgerEntry.context), addressed to targetOf that context and the entry's ops id. The owning service authorizes each as the system command of that name on the parked aggregate, as it does the same action on its own operator routes, and runs it.
Their names sit in the system namespace NAMESPACE, as the lifecycle commands' do.
Properties
The member of RECORD_PARKED's body that holds its LedgerEntry.
The context a service publishes its ledger to unless it is configured otherwise.
The simple names of the commands a service sends to PARKED: their full names are <ops>.parked.<name>.
The member of RECORD_RESOLVED's body that holds its LedgerResolution.
Functions
The id of the ops aggregate recording the entry of ref that subscription, of context, parked in service: <service>:<context>:<subscription>:<aggregate context>.<aggregate>:<tenant>:<id>, so one service's entry of one aggregate is one ops aggregate, whichever node publishes it, and two contexts' subscriptions of one name keep entries of their own. Each field has its % and : percent-escaped (%25, %3A, Escapes), and the aggregate type's context its . too (Escapes.typeText), so two entries never share an id however their names join: tenant a:b with id c and tenant a with id b:c stay apart, as do context a.b's aggregate c and context a's b.c.
Where a system command of the ledger on the entry parkedId names (Ledger.parkedId) is sent: the command topic of context, the context that holds the entry, keyed by the entry rather than by the parked aggregate, so a command on an entry of the context's own intake is not held behind the very aggregate it parked, and the commands of one entry keep their order.