A staged (canary) rollout ships a schema change to a small random sample of the fleet first, watches the real outcome, then widens the blast radius only if that sample looks healthy — exactly how mobile release systems (Play Store staged rollouts, Firebase Remote Config gradual rollout, feature-flag canary analysis) gate a risky change. This simulator runs three cumulative stages over a randomly-ordered rollout queue built once per fleet:
Canary → first 5% of the queue
Gradual → next 25% of the queue (cumulative 30%)
Full → remaining 70% of the queue (cumulative 100%)
Inside a stage, devices are attempted in fixed-size batches. Each device in a batch migrates independently with success probability (1 − p), where p is the per-device failure slider — a real Bernoulli trial per device, not a scripted animation:
f = failures_in_batch / batch_size (observed batch failure rate)
E[f] = p, Var[f] = p·(1 − p) / batch_size (Binomial proportion)
if f > rollback_threshold:
revert every device this batch just migrated back to the old schema
halt the rollout at this batch (retry with Start/resume, or shrink the
batch / lower p first — the same batch is retried, not skipped)
else:
keep going — next batch, next stage once the stage's target is reached
The variance term is why batch size is itself a real lever: a small canary batch is cheap to run and limits how many devices a bad release can touch, but its observed failure rate is noisy — a batch of 4 can read 25% failed off a single unlucky device even at a healthy p. Real canary-analysis systems size the sample to balance that statistical noise against blast radius, which is exactly what the batch-size and threshold sliders let you explore here.
- Fleet size — total devices simulated, laid out as a grid.
- Batch size — how many devices are attempted together each rollout step.
- Rollout speed — seconds between batch attempts.
- Per-device failure — p above; higher values model riskier migrations (destructive column drops, large rewrites on low-end storage).
- Rollback threshold — the observed batch failure rate that triggers an automatic rollback of that batch.
Watch the chart at the bottom of the stage: green bars are batches that passed their stage gate, red bars crossed the threshold and were rolled back. A rollout that keeps rolling back in canary before it ever reaches gradual is telling you the release itself is unsafe at the current failure rate — not that the threshold needs loosening.