Confused about keeping system up to date

[Ed Flecko]

Hi folks,
I'm running Production Release 8.1 on a production server.

For a variety of reasons, I've decided to keep my system up to date
via building it from source code.

1.) I want to follow the 8.1 errata branch, which (after rebuilding)
pretty much just applies any released patches, right?

2.) I want the entry in my supfile to read: tag=RELENG_8_1_0 - or
tag=RELENG_8.1_0 ?

3.) As a general rule, the only time you really NEED to update,
rebuild your system, etc., is after there's been a security patch
release, right?

4.) Is RELENG_8_1 the same thing as 8.1-RELEASE ???

5.) If I'm just trying to keep my system up to date as far as applying
security patches, should I just follow the directions in the security
patch notes to apply it, or should I update via cvsup (or csup, etc.)
and rebuild the system? I guess what I'm asking is: when, if ever (?)
should you just apply patches or should you always update, rebuild,
etc.???

Thank you,
Ed