Backporting from stable(-proposed-updates) to oldstable-backports

[Simon McVittie <smcv@debian.org>]

At what point in the life cycle of a stable package is it appropriate
to upload a backport of that package to oldstable-backports?

1) New version proposed in a release.debian.org bug
2) SRMs give permission to upload, package uploaded and is listed in
   https://release.debian.org/proposed-updates/stable.html
3) Package processed by SRMs and is published on mirrors in the
   stable-proposed-updates suite
4) Stable point release issued, package is published on mirrors in the
   stable suite

So far I have been assuming that the answer is state 4, but perhaps
state 3 or even state 2 is "official enough" to backport?

For backports from stable-security, I assume we can upload a backport
as soon as the stable-security version is published on
security.debian.org?

Thanks,
    smcv