IMO, the three options are:

* Always (attempt) to repair automatically
* Just tell the user that things have failed
* Have a runtime configuration that switches between the two behaviors above