How do you decide whether to rollback or roll forward after a failed deployment?

In production the release plan records rollback compatibility before deployment. I compare current user impact with the time and risk of each mitigation, preserve evidence, choose one controlled action, and define the metric expected to recover. Database migrations, queued messages, caches, external side effects, and mixed application versions can all make an old binary unsafe. Feature disablement or traffic isolation may buy time without changing data again. After the action I verify critical business completion, error rate, latency, saturation, and reconciliation needs. The incident timeline captures artifact, configuration, schema state, decision owner, and follow-up work so recovery remains explainable.