Phased / staged rollout
Shipping an update to a small percentage of users first and widening over days, so a broken build hits 1 percent instead of everyone.
See it
What it is
Instead of handing a new build to your whole install base at once, you release it to a slice and widen. Apple's Phased Release runs a fixed seven-day ramp (1, 2, 5, 10, 20, 50, then 100 percent). Google Play's staged rollout lets you pick the percentage yourself and bump it whenever you like. Both give you a pause button, which is the entire point: you watch crash-free rate and reviews for a day, and if something is on fire only a fraction of users are holding the match.
Use it for anything with real risk: a framework upgrade, a migration that touches local data, a rewritten checkout. Skip it when you are shipping the fix for a rollout you just halted, because you want that one everywhere immediately.
The misconception that costs people a night: pausing is not rolling back. Users who already installed the bad build keep it, and the only way to reach them is a new, higher version. Also, Apple's phasing only governs automatic updates. Anyone who opens the App Store and taps Update gets the new build on day one regardless, and so does every new installer, so 'only 1 percent has it' is never quite true.
Ask AI for it
Release this version as a staged rollout instead of a full release. My setup: crash telemetry in [crash provider, e.g. Sentry or Firebase Crashlytics], review data from [source, e.g. the Play Developer Reporting API], CI on [CI platform], baseline version [previous version number], and credentials available only as [named CI secrets]. Use the Google Play Developer Publishing API to publish to the production track at 5 percent, then give me one command to bump to 20, 50, and 100 percent and one to halt the rollout. On iOS, enable Phased Release for automatic updates when submitting. Before each bump, query crash-free sessions and new one-star review counts against the baseline version, using this exact metric query: [paste query or say 'propose one and let me confirm']. Stop automatically if crash-free sessions drop more than 0.5 percent. Deliver this first as a dry-run script that prints every API call it would make without executing it; do not wire it into a deployed workflow, and never read a credential from anywhere but the named secrets. Document that pausing does not revert installed users and that a fix needs a new version number.