The brief was a rota system for a domiciliary care provider. The requirement that reshaped it arrived in discovery, almost as an aside: "what happens when a third of the team can't come in".
The rota's hidden assumption
Every scheduling algorithm we looked at, including our first draft, assumed availability was the normal case and unavailability was the exception to be handled by a manual swap. That assumption breaks exactly when it matters most — sickness spikes, transport disruption, a strike — and it breaks in the way that hurts the most vulnerable clients first, because the hardest visits to reassign are the ones needing continuity of carer.
What we built instead
- A degraded mode, not an error state. When coverage drops below a threshold, the system does not fail to produce a rota; it produces the best rota it can and flags every gap explicitly, ranked by client risk.
- Continuity as a scored preference, not a hard constraint. In normal operation the same carer visits the same client. Under strain, that preference is the first thing allowed to give, and the system says so rather than silently reassigning.
- A human override that is faster than the automated path, because the manager on the ground during a real disruption needs to move people around in seconds, not navigate a form built for the calm case.
The client risk ranking was the hard part
Ranking which visits matter most when not everything can be covered is not a scheduling problem, it is a clinical judgement, and we were not qualified to make it. We built the ranking as configuration the care provider's own clinical lead owns and can change without a deployment, rather than logic we baked in.
Software that only works when everything is going well is a demo with a database attached.
Testing the bad day
We ran the rota generator against real historical data from a flu season with high absenteeism, before launch, specifically to watch the degraded mode operate against numbers that were not invented for the test. It surfaced two clients who would have gone uncovered under the first version of the ranking, which was exactly the kind of finding a clean synthetic dataset would never have produced.
What shipped
The degraded mode has run for real twice since launch, both times during weather disruption rather than a strike. The provider's own report was that the gaps were visible and explainable to families, which was the actual measure of success, not an uptime number.