Glossary

Definitions as this site uses them. Several of these words are used to mean materially different things by different tools and different teams, and a surprising amount of rollout confusion is two people using one word for two concepts. Where that happens the entry says so rather than quietly picking a side.

Abort criterion

A condition, agreed before a rollout starts, whose observation stops it. Useful criteria are things that can be seen inside the soak period you actually chose; “no user impact” is not one unless you have also said how you would notice.

Activation

Making an installed change take effect. On some systems this is automatic on install, on others it requires a restart, a switch of a symbolic link, a reboot into a different partition, or a licence reload. Separating activation from installation is the main lever available in window-constrained environments.

Backout plan

The written procedure for undoing a change. Worth distinguishing from a rollback capability: a backout plan that has never been executed on a machine in the state it would be needed for is a document, not a capability.

Batch

The set of hosts patched together as one unit of a staged rollout. Also called a wave or a ring depending on the tooling, and the three are not quite synonyms — see Ring.

Blast radius

The population affected if a change goes wrong. In a staged rollout the blast radius of any single step is the batch size, which is the main reason to keep early batches small. Note that the term is used loosely elsewhere to mean the scope of an incident generally; here it means the scope of this step.

Canary

A very small first batch whose purpose is to fail fast and visibly. Used inconsistently: sometimes it means a single host, sometimes an entire pilot group of hundreds, and sometimes a permanently-early cohort that receives every change first. Ask which is meant.

Change freeze

A period during which no changes are permitted, usually covering a seasonal peak or a financial deadline. A freeze is a deliberate decision to accumulate exposure, and it is worth recording as one, with a named accepter and a scheduled catch-up.

Change window

The slot in an organisation’s change calendar during which a given change is permitted. Frequently confused with a maintenance window: the maintenance window is when the system may be taken out of service, the change window is when the organisation’s process permits the change. They often differ, and the binding one is whichever is smaller.

Compensating control

Something done to reduce exposure when the fix cannot be applied — restricting access, disabling a feature, adding monitoring. It reduces risk; it does not close the finding, and reporting it as a closure is how a backlog becomes fiction.

Cumulative update

A package containing all previous fixes as well as the current one. Simplifies tracking and complicates rollback, because reversing it reverses everything it subsumed.

Deferred restart

An applied change that is waiting on a restart to take effect. The system is neither patched nor unpatched in any useful sense, which is why it deserves its own state rather than being reported as one or the other.

Delta patch

An update expressed as the difference from a specific prior version rather than as a complete image. Smaller to distribute, but it only applies to the version it was computed against, which turns a fleet with mixed versions into a sequencing problem.

Drain

Removing a host from service — stopping new work being sent to it — so that it can be patched without interrupting work in progress. The mechanism that lets a redundant system be patched without a maintenance window at all.

Dual-bank update

A firmware design with two storage banks: the update is written to the inactive bank and the device switches on the next boot, with the previous image still present. It is the difference between a device that can be reversed and one that cannot, and it is the single most consequential design decision in embedded updating.

Exception

A recorded decision not to remediate a finding within the normal timescale. To be meaningful it needs a named individual accepting the exposure, an expiry date after which the item returns to the queue automatically, and a statement of what is being done instead. Without those three it is a way of hiding an item.

Live patching

Applying a fix to running code without restarting it. Best established for kernels, where it handles fixes expressible as a redirection of a function but not fixes that change the shape of data structures already in memory. It defers the restart rather than removing the need for one.

Maintenance window

An agreed period during which a system may be disrupted. Treated in planning as though it were idle time that happens to exist; in reality it is manufactured at cost by people arranging for the system’s normal work not to need doing, and it is contended by every other project in the organisation.

Mitigation

An action that reduces the effect or likelihood of a problem without removing its cause. Used interchangeably with remediation by many tools, which is unfortunate, because the distinction — did the cause go away, or did we make it less reachable — is exactly what a risk decision turns on.

Orphaned asset

A system that is known, monitored and running, but has no person or team whose responsibilities include it. Not a discovery problem: the machine is in every report. What is missing is the decision right, not the record.

Patch

Used for at least three different things: the file that carries a fix, the act of applying it, and the state of having applied it. Most of the time context disambiguates; in a rollout plan it frequently does not, and “the patch takes ten minutes” can mean the install, the install plus restart, or the whole batch.

Pre-staging

Distributing and preparing update content in advance so that the disruptive window contains only the switch. The highest-leverage change available when the window is the constraint, and commonly skipped because tooling defaults to doing everything in one pass.

Reboot debt

The accumulated set of applied-but-not-yet-effective changes on a host that has not restarted, together with the untested start-up path that results. Grows in two dimensions at once: residual exposure, and the risk that the eventual restart does not succeed.

Remediation

Closing a finding at its cause, normally by applying a fix. See Mitigation for the distinction that many tools erase.

Ring

A named cohort of the estate that receives changes at a fixed position in the sequence — an early ring, a broad ring, a conservative ring. Distinct from a batch in that ring membership is a durable property of the host, while batches may be recomputed for each rollout. Some tooling uses the words interchangeably, which matters as soon as you ask whether the same hosts are always first.

Rollback

Returning to the previous version. Used for two different operations that are not equivalent: reversing the package (which restores files but not migrated configuration, schemas or peer components), and restoring the previous system state wholesale from an image or snapshot. Only the second is reliably a rollback in the sense people mean.

Rolling restart

Restarting members of a redundant pool one or a few at a time, so the service stays available throughout. The mechanism that converts a restart requirement into a temporary capacity reduction.

Roll-forward

Escaping a bad change by moving to a newer version rather than back to an older one. Often the only available reverse gear, and a legitimate strategy — provided the newer version exists, is tested, and can be distributed faster than the problem spreads.

Soak

The interval between finishing one batch and beginning the next, during which the effect of the change is observed. Its correct length is set by the latency of the slowest failure mode you intend to catch. A soak during which nothing is being watched is not a test; it is a delay.

Superseded patch

An update replaced by a later one that includes it. Superseded items should disappear from a backlog when their replacement is applied, and estates where they do not are counting the same finding repeatedly.

Supported version

The version a vendor will assist with. A frequent hard blocker: the fix exists, but applying it moves the system to a configuration the supplier will not support, so the risk of patching and the risk of not patching sit in different columns of the same organisation’s accounts.