---
title: "Roll out each update in stages with a stop · Agent Wranglers"
url: https://agentwranglers.se/playbook/desktop-apps/update-integrity/staged-desktop-updates
id: DSK-8
level: Recommended
updated: 2026-10-22
tokens: 936
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Roll out each update in stages with a stop switch

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Update integrity](https://agentwranglers.se/playbook/desktop-apps/update-integrity.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22.

- ID: DSK-8
- Level: Recommended
- Chapter: [Update integrity](https://agentwranglers.se/playbook/desktop-apps/update-integrity.md)
- Rule: Offer each update to at most 10% of installs first, and widen it only while the crash rate stays at the last version's level. Keep a switch on the update server that stops the rollout within 5 minutes.
- Check: The update feed has a rollout share and a stop flag. In a test, set the share to 10% for 1,000 simulated install IDs. Between 50 and 150 get the update. Set the stop flag. The next check offers the update to none.
- How: An update that breaks start-up cannot fix itself, because the broken app never checks for the next one. Pick installs by a stable random ID kept on the device, so the same installs get the update each time. Watch crash reports per version, as [upload symbols for every build](https://agentwranglers.se/playbook/mobile-apps/crashes-and-quality/crash-symbols.md) does on phones. The general method is in [release to a small share first](https://agentwranglers.se/playbook/engineering/build-test-and-deploy/staged-rollouts.md). Make the updater check run before the main window loads, so even a broken build can fetch the fix.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Python example

```python
import hashlib

def gets_update(install_id: str, release: str, share_percent: int, stopped: bool) -> bool:
    if stopped:
        return False
    bucket = int(hashlib.sha256(f"{release}:{install_id}".encode()).hexdigest(), 16) % 100
    return bucket < share_percent
```

### Go example

```go
func GetsUpdate(installID, release string, sharePercent int, stopped bool) bool {
	if stopped {
		return false
	}
	sum := sha256.Sum256([]byte(release + ":" + installID))
	return int(binary.BigEndian.Uint32(sum[:4])%100) < sharePercent
}
```

## Sources

- [Microsoft, Gradual package rollout](https://learn.microsoft.com/en-us/windows/apps/publish/gradual-package-rollout)

## Related rules

- MOB-31 [Upload symbols for every build](https://agentwranglers.se/playbook/mobile-apps/crashes-and-quality/crash-symbols.md) in Mobile apps
- ENG-10 [Release to a small share first](https://agentwranglers.se/playbook/engineering/build-test-and-deploy/staged-rollouts.md) in Engineering
- IOT-12 [Roll firmware out in stages and stop on bad numbers](https://agentwranglers.se/playbook/connected-devices/firmware-updates/staged-firmware-rollout.md) in Connected devices

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/desktop-apps/update-integrity/staged-desktop-updates">Agent Wranglers desktop apps, extensions and CLIs playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Refuse updates older than the installed version](https://agentwranglers.se/playbook/desktop-apps/update-integrity/no-downgrades.md)
- Next: [Keep the bundled browser engine current](https://agentwranglers.se/playbook/desktop-apps/update-integrity/current-app-runtime.md)
- [Update integrity](https://agentwranglers.se/playbook/desktop-apps/update-integrity.md)