Ready-to-promote email
When a rule newly looks ready to promote, the owner gets one email. It links to Tuning. It does not click Promote.
When it sends
The switch is on by default. The mail goes out when there is a ready rule that was not in the last note. The same set does not send again. Rules still inside the 24-hour count window are mentioned as still watching, not as ready.
The message has three lists: ready for you to promote, on hold, and needs an allowlist. The next step in the mail is to open Tuning and click Promote only on the rules you want in block.
Ready-to-promote stays on email. It does not go to Slack or the generic webhook. Those are for attack spikes.
The mail includes the same human-click line as the other alerts, and a link to turn this note off.