At cruise altitude, a cabin window carries roughly 8 to 9 PSI of outward pressure differential. Spread across a pane the size of a hardback book, that's approximately 2,500 newtons pushing constantly against the seal. The window doesn't move because the system holding it was designed with layers — and on a recent Ryanair flight diverting to Thessaloniki, those layers failed one by one.
The window itself is not a single sheet of acrylic. Commercial aircraft windows are triple-pane assemblies. The outer pane bears the structural load. The middle pane is a full-rated backup, kept in reserve if the outer is compromised — it even has a small bleed hole to ensure the outer pane takes the pressure load preferentially. The inner pane is scratch protection only. For a breach to reach the cabin interior, the outer and middle retention systems both have to fail. That's not an accident. That's a sequence.
On this flight, engine failure arrived simultaneously. That compound event — depressurization and engine loss together — doesn't have a single checklist. Crews train for each emergency separately. Faced with both, the priority hierarchy is immediate: don oxygen masks, initiate emergency descent to FL100 where ambient air is breathable, declare MAYDAY. The passenger injury running in parallel means the crew is managing a pressurized aircraft emergency while someone in the cabin is partially outside it.
Which brings the redundancy stack to its final layer. A 25mm seatbelt webbing strip, rated to multiples of average body weight, threaded through a buckle mechanism designed to lock harder under load. Every engineered system above it — the outer pane, the middle pane, the seal retention — had already spent itself. The belt held.
The passenger was hospitalized. A replacement aircraft was arranged. The investigation will work backward through the sequence, looking for the first domino.