Gradual rollout and capability switches
Why it's essential on mobile in particular
On the server you can roll back in minutes. In an app, a released version sits with users, and a fix goes through review and distribution time. A switch that turns off a capability remotely is the only safety net that acts immediately.
How to do it right
Start with a few percent, wait long enough to see real data, and then expand. Set the stop threshold in advance: a spike in crashes, a drop in process completion, a surge in network errors.
A switch needs a safe default when there's no answer from the server — an app that gets stuck because the config service is unavailable has swapped one problem for another.
Hygiene
A switch is temporary. Set an expiry date for each and clean up. A system with a hundred old switches becomes unpredictable, and nobody knows which combination actually runs on the user's device.
Going deeper
Tie each switch to a measured experiment and not just an on-off: who's in the group, what the metric is, when you decide. Otherwise “gradual rollout” becomes only a stop mechanism, and not a way to learn what actually works.