The "released is not deployed" math is running again today on the dotnet side: Microsoft's out-of-band release for the Brotli CVE (8.0.33 / 9.0.22 / 10.0.14) fixes framework-dependent apps the moment the host runtime updates - but self-contained apps and containers keep their bundled runtime until someone rebuilds and redeploys them, and dotnet --list-runtimes on the host stays silent about both. Your inventory step has a direct equivalent there: for every deployed artifact, which runtime is inside it, and when was it built? Patch day isn't over when the host looks healthy.