Downtime you are not allowed to schedule

Windows · June 24, 2026 · 6 min read

There is a category of environment where the technical work of patching is trivial and the rollout still takes a year. Continuous process plants, where stopping a line means an eight-hour restart sequence and a batch of product in the bin. Clinical systems that are in use whenever a patient is. Trading and settlement systems with a hard daily cycle. Broadcast. Distribution networks during a peak season that lasts a quarter. In all of them the same sentence gets said in planning meetings: the patch takes ten minutes, we just need a window.

“Just need a window” is the whole project.

The window is a resource, and it is not yours

Two things about windows are consistently underestimated.

The first is that a window is not idle time that happens to exist. It is manufactured, at cost, by somebody who has to arrange for the work the system normally does to not need doing. In a plant that means coordinating with production scheduling. In a hospital it means an agreed period of downtime procedure with paper fallbacks and staff briefed on them. The window exists because a set of humans arranged their week around it, which is why moving it is so much harder than moving a deployment.

The second is that the window is shared. It belongs to the change calendar of the entire organisation, and every other project wants it too. A window that theoretically recurs weekly may be available to you monthly once contention is accounted for, and the contention is invisible in your own plan. This is why window-constrained rollouts routinely take three or four times their estimate while every individual step goes exactly as forecast.

The arithmetic that kills plans quietly

Take a rollout in batches, where each batch has to be applied and then observed before the next one starts, and all of it must happen inside the window because the people who can judge whether the batch is healthy are only present during it. The unit that must fit is the patch run plus the soak.

If that unit is longer than the window, the rollout does not run slowly. It does not run. Every day hits the same wall, and adding days changes nothing.

This failure has a nasty property: it looks like progress for a while. Batch one gets applied at the start of a window, the soak is cut short because the window is ending, the batch is declared fine, and the plan proceeds having quietly abandoned the control that justified staging. Or the soak is respected, the window ends mid-soak, the batch is left half-observed over the weekend, and nobody notices that the second batch never became eligible. Months later somebody asks why so little of the fleet has moved.

The check is a subtraction, and it should be done on the first day rather than the ninetieth. It is the reason the rollout planner reports an infeasible plan as infeasible rather than as a very large number of days.

Buy time by changing the work, not the pace

Once the window is the binding constraint, effort spent making the patch itself faster has almost no leverage. The leverage is in reducing what has to happen inside the window at all.

Pre-stage everything that can be pre-staged. Downloading, verifying, unpacking and copying content are not disruptive; only the switch is. Doing that work days in advance turns a window’s contents from “fetch, install, restart” into “restart”, which can be an order of magnitude less window time for the same change. This is the single most effective move available in most window-constrained estates and it is frequently skipped because the tooling defaults to doing everything at once.

Separate installation from activation. Many changes can be laid down while the system is running and made effective at a moment of your choosing. That moment is small enough to fit almost any window. The cost is that you now have machines carrying an installed-but-inactive change, which is a real state that has to be tracked rather than assumed away — the subject of its own essay.

Buy redundancy to convert downtime into reduced capacity. If the function is served by more than one instance and traffic can be drained from one at a time, the window requirement dissolves: the system never stops, it just runs thinner for a while. This is expensive and often architecturally impossible on the systems that need it most, but it is worth pricing honestly, because “a second unit” and “a decade of quarterly window negotiations” are comparable numbers more often than people expect.

Make the soak survivable outside the window. If the reason soak must happen in-window is that only in-window staff can judge health, then instrumenting the health check is a way of buying window time. It converts a human-attended soak into an unattended one, and the batch’s fate can be decided the following morning.

Each of those is an engineering project, and each of them competes for funding with things that look more like features. The argument for them is that they are the only interventions that change the shape of the constraint rather than nibbling at it.

Freezes are risk decisions, so record them as such

Many of these environments also impose freeze periods: no changes during the harvest, the holiday trading season, the financial year end, the election. A freeze is a rational trade — the risk of a botched change during peak exceeds the risk of an unpatched month.

What goes wrong is that freezes are administered as calendar facts rather than as decisions. Nobody writes down what was deferred, nobody accepts the accumulated exposure by name, and when the freeze lifts, the backlog is treated as ordinary work rather than as a debt that was deliberately taken on. The fix costs nothing: at the point the freeze begins, list what will not be done and who is accepting that, and schedule the catch-up before the freeze rather than after it.

Say the honest number early

The most useful thing a rollout plan can do in a window-constrained environment is to fail its feasibility check loudly and early, in units the business recognises. Not “this is challenging” but: this needs eleven months of windows at the current allocation; or it needs the window extended by ninety minutes; or it needs a second unit so the window is not required at all; or it needs somebody senior to accept the exposure for eleven months in writing.

Those are four different conversations, all of them tractable, and none of them can start until somebody does the subtraction.