A change window is a decision about when
Changes to a live surface go into a named window. The reason is not caution for its own sake — it is that a reader who arrives halfway through a surface being replaced has no way of telling a half-finished page from a broken one, and will treat it as broken.
A change outside a window needs a written note naming what breaks if it waits until the next one; that note is kept with the change notes rather than in a message thread.
A window is a decision about when, and nothing here is a promise about how often, how quickly or how reliably anything happens. Those would be claims, and this company was incorporated on the 30th of August 2026 — it has no measured period to make them from.
The two windows
First Tuesday of the month, 07:00 to 09:00 UK time. The main window; everything planned goes here.
Third Tuesday, the same hours. For whatever slipped out of the first, and for nothing that was never written down.
What a change note carries
- Surfaces touchedby name
- As they appear on the wall, so the note and the wall can be read against each other.
- before
- Field-list changeseach one
- Field added, field removed, shape changed — one line each, not a summary.
- before
- Slug-register changeseach one
- With the redirect each one leaves behind, because that redirect is the only thing holding an old address up.
- before
- Rollback stepinstructions
- Written as instructions somebody else could follow without asking a question.
- before
- Accessibility passeswhich, and against what
- Which of the four were rerun, and against which version of the surface.
- during
- Two signaturesnot one
- The person who made the change, and the person who read the note.
- after
The rollback step is written before the change, never during. A rollback invented while something is broken is a rollback nobody has read, and the first thing it meets is the field-list change that has already been applied.
The backup set, and what is deliberately not in it
Five things kept, and the rest regenerated
- Inthe directory table, the category tree, the slug register, the append-only record, the account roles.
- Outthe search index, every rendered page, and every file that can be regenerated from the five above.
The index is out because it is a derivative. Restoring a stale index over a current directory recreates the exact disagreement a restore is meant to end; rebuilding it from the restored directory cannot.
The register is the irreplaceable one. Every address ever published is in it, and an address with no register row is a dead link with nothing to point it anywhere.
The restore drill, and the record it writes
A drill is booked into the second window of each quarter. The backup set is restored into an empty environment and the index is rebuilt from the restored directory rather than restored.
The pass test is reconciliation, not a successful import. The category tree, the slug register and the record are compared row for row against the source, and the drill passes only when all three reconcile.
The restore record is signed and filed with the change notes. It names the backup used, the date that backup was taken, who ran the drill, how long the window stayed open, and every row that did not reconcile.