A conservation Data Activator needs to evaluate, the instant each new gallery-temperature reading arrives, whether the average temperature over the trailing four minutes has crossed a damage-risk threshold, so the alert can fire on the very reading that pushes it over rather than waiting for a scheduled check. Which windowing function is designed to re-evaluate on every incoming event like this?

A sliding window recomputes its aggregation continuously, emitting a fresh result every time a new event enters (or an old one exits) the trailing window span, rather than only at fixed clock boundaries or fixed hop intervals. That per-event re-evaluation is precisely what allows the Data Activator to catch a damage-risk threshold crossing on the exact reading that causes it, satisfying the 'the instant each new reading arrives' requirement.

A tumbling window with a four-minute duration only produces a result once every four minutes, so a threshold crossed mid-window would go undetected until the segment closes, introducing exactly the delay the scenario wants to avoid. A hopping window with a one-minute hop improves on tumbling but still only re-evaluates once per minute at most, meaning up to a minute could pass between the actual threshold crossing and the alert firing. A snapshot window groups only events sharing an identical timestamp and has no concept of a trailing multi-minute span at all, so it cannot express a rolling four-minute average.

A caveat: because a sliding window can emit a result on every incoming event, it is the most computationally intensive of the window types, so applying it to a very high-frequency sensor stream needs capacity planning to avoid overwhelming the alerting pipeline. Operationally, validate the configuration by injecting a single reading that pushes the trailing four-minute average over the threshold and confirming the alert fires on that exact reading rather than after a delay.