Define the decision boundary
Choose observable signals such as failed health checks or a sustained increase in critical errors. Assign a decision owner and a time limit for diagnosis so uncertainty does not prolong customer impact.
Confirm that the previous application version can use the current database schema and data. An incompatible migration may require a forward fix or a separate recovery procedure instead of a simple code rollback.
Practice the recovery path
Keep the previous build and its configuration available with appropriate access controls and clear steps. Rehearse in a representative environment and measure how long release or routing changes take.
After rollback, verify user journeys, background processing, and monitoring. Record the cause and follow-up work, then revise the plan when deployment, schema, or hosting architecture changes.