Bake Time
The deliberate wait between rollout steps, sized by how long the fault you are watching for takes to appear.
Between regions, or between rings, the rollout pauses. The length of that pause is not arbitrary: it should be at least as long as the slowest failure mode you expect the step to reveal.
That reframing is what makes it possible to argue about. A memory leak surfaces in hours, not minutes. A daily batch interaction surfaces once a day. A month-end code path surfaces monthly, which no bake time will catch and which therefore needs a different control. A fifteen-minute bake catches crashes and error-rate spikes and nothing else — which is a legitimate scope as long as it is a chosen one.
The cost side is real too. Long bakes mean a change is partially deployed for longer, which means more time with two versions live and more exposure to the compatibility constraints that implies. And a bake period with no automated analysis attached is just a delay: it only converts into safety if something is watching and empowered to stop the rollout.