Notify, freeze, and rollout windows — the social contract of change

A freeze window prohibits change. A change window allows it. A rollout window is a recurring low-risk path. The calendar is the social contract between the cluster and the people who depend on it; the discipline is that every change is announced, every window is owned, and no change is made outside the calendar.

The three window types

A production change calendar contains three kinds of windows:

1. Freeze window. A period during which no non-emergency change is permitted. Freeze windows typically cover the end-of-quarter, the holiday season, and the days around a major product launch. The freeze is a hard constraint: the change is deferred, not “we’ll sneak it in.”
2. Change window. A period during which a specific change is approved. The change has an owner, a rollback, a validation, and a close-out. The change window is the rectangle around the maintenance described in lesson CXVI-01.
3. Rollout window. A recurring low-risk path for ordinary rollouts: a deploy at 10:00 every Tuesday, a feature-flag flip mid-week, a config push during business hours. The rollout window has a low-risk class and a fast rollback.

gantt
    title "Change calendar"
    dateFormat YYYY-MM-DD
    axisFormat %m-%d
    section Freezes
    Quarter-end freeze          :f1, 2026-09-25, 5d
    Holiday freeze              :f2, 2026-12-22, 10d
    section Change windows
    K8s upgrade 1.34.x          :c1, 2026-10-05, 1d
    etcd member replacement     :c2, 2026-10-12, 1d
    section Rollout windows
    Weekly deploy slot          :r1, 2026-09-28, 7d
    Weekly deploy slot          :r2, 2026-10-05, 7d

The three types are on the same calendar; the visual distinction is the discipline. A freeze is a solid block; a change window is a labelled rectangle; a rollout window is a recurring line.

Why freeze windows exist

A freeze window is the operator’s response to a risk the calendar judges unfair to introduce. The judgement is not about the cluster’s ability to absorb the change — the cluster runs the same regardless of the date — it is about the organisation’s ability to respond to a failure.

During a freeze, the on-call roster is reduced, the response time is slower, and the cost of an incident is higher because the customer is paying attention. The freeze decouples the cluster’s risk from the organisation’s risk by deferring the change rather than forbidding it.

A freeze that is treated as “we’ll sneak it in” is a freeze that has decided the rule does not apply. Every production incident attributed to a sneaky change during a freeze is evidence that the freeze was not enforced.

The change calendar

A change calendar is a system of record. It records:

• The window’s start and end.
• The window’s owner.
• The window’s risk class.
• The change being made.
• The rollback path.
• The validation check.
• The communication sent.
• The close-out and the post-incident review (PIR).

The calendar is the social contract. The customer can read it to learn what is happening when. The on-call can read it to know what to expect. The auditor can read it to verify the governance.

erDiagram
    WINDOW ||--o{ CHANGE : contains
    WINDOW {
      string id
      string owner
      string risk_class
      time start
      time end
    }
    CHANGE {
      string id
      string description
      string rollback
      string status
    }
    WINDOW ||--o{ COMMUNICATION : includes
    COMMUNICATION {
      string channel
      time sent_at
      string audience
    }

A change calendar that is not queryable is a calendar that has decided the audit is not important.

The no-sneak-change discipline

The worst production failure is a sneak change. A sneak change is a modification made outside the calendar, often because “it was small” or “we had a window.” The failure is not the change itself; it is the deception. The customer cannot prepare for what they cannot see.

The discipline is:

• Every change is in the calendar. If it is not in the calendar, it is not a change.
• Every change has an owner. If the owner is “the team,” there is no owner.
• Every change has a rollback. If the rollback is “we’ll figure it out,” the change is not approved.
• Every change is communicated. Not after the change; before.
• Every change is closed. A change that does not close is a change that has been forgotten.

The discipline is the same scale-free: a one-line config tweak gets the same governance as a control-plane upgrade. The difference is the risk class, not the procedure.

Production discipline

A change calendar is the cluster’s social contract. The discipline is to publish the calendar, classify the windows, respect the freezes, and never make a change outside the calendar. The cluster’s reputation is the calendar’s reputation.

• Distinguish freeze, change, and rollout windows. The three are on the same calendar; the visual distinction is the discipline.
• Close the window. A window that does not close is a window that has forgotten its purpose.

Quiz