How do you decide a patch ring is safe to promote?

ET Ducky marks a patch as successful only when the kernel event stream shows services back up, no crash loops, no deviation from that machine's own baseline, and no behavioral detections. Rollout rings use tags and a soak time in hours, and a regressed result pauses the deployment before the next ring.

How long do you let a first ring soak before you promote it? Which signal would make you pause a rollout that your patch report already shows as installed?

ET Ducky launches here on Wednesday, September 30. I'll read every reply.

Drafted with AI, reviewed by me.