Legacy Modernization and Architecture Evolution Questions

Direct answer

Rehosting moves a system as-is onto new infrastructure and wins on speed when the goal is escaping unsupported hardware or a data center exit deadline. Replatforming makes small, targeted changes (a managed database instead of a self-hosted one) and wins when you want some operational benefit without touching application logic. Incremental refactoring decomposes and modernizes the system piece by piece and wins when the system needs to keep evolving and the team can invest in an ongoing effort. A full rewrite replaces the system outright and wins only when the existing system's structure is so far from what's needed that incremental change would cost more than starting over, and the business can tolerate the risk of an all-or-nothing delivery.

Structured elaboration

The real differentiator between these isn't just cost or time, it's what risk each one is willing to accept:

• Rehosting (lift-and-shift): lowest technical risk (nothing about the application changes), fastest to execute, but it changes nothing about the underlying problems (scaling limits, unmaintainable code, licensing costs tied to the old platform). It's a stopgap, not a fix, and it's the right first move when there's a hard deadline (end-of-life hardware, a data center closing) that leaves no time for anything deeper.
• Replatforming: moderate risk, moderate benefit. You get real operational wins (managed backups, autoscaling) without the risk of touching business logic, but you're still carrying whatever architectural debt the application has.
• Incremental refactoring: this is the strangler-fig territory, higher effort spread over a longer timeline, but continuously shippable and reversible at almost any point. It's the right choice when the system needs to keep serving traffic and evolving, and the org can sustain the discipline of an ongoing migration rather than a one-time project.
• Full rewrite: highest risk, because you're betting the whole effort on an estimate for a system whose exact current behavior nobody has fully mapped, the same problem that makes writing "characterization tests first" so important for any legacy work. It sometimes wins on relative cost and time if the existing system is small enough, or so entangled that incremental extraction genuinely doesn't have a viable seam.

Pairing the approach with a rollout strategy that matches its risk profile: rehosting and replatforming can usually go through a single cutover with a tested rollback plan, since the application behavior itself hasn't changed. Incremental refactoring needs the parallel-run and gradual-traffic-shift discipline strangler-fig migrations use. A full rewrite needs the most conservative rollout of all: extensive parallel-run validation against the old system before the new one is trusted with any real traffic, since there is no incremental fallback if a whole rewritten system turns out to be subtly wrong.

Worked example

A 15-year-old monolith running on infrastructure the vendor is discontinuing support for in six months:

• Rehost first: the deadline leaves no time for anything else, so the team moves it to modern infrastructure unchanged, buying time.
• Then decide the target: with the deadline pressure gone, they evaluate the system properly. It has clear, separable modules (billing, notifications, reporting), so incremental refactoring via strangler fig is viable, and they start extracting the highest-pain module (notifications, which changes often and causes frequent incidents) first, using canary rollout (releasing the change to a small slice of traffic first, so a problem shows up as an early warning instead of a full outage) and parallel-run validation to de-risk each extraction.
• They explicitly rule out a full rewrite: the modules are separable enough that strangling costs less in both time and risk than a rewrite would, given the amount of undocumented behavior a rewrite would have to somehow rediscover from scratch.

Trade-offs and pitfalls

The mistake that costs the most is picking based on which approach sounds most technically satisfying rather than which one matches the actual constraint (a hard deadline favors rehosting regardless of its long-term limitations; a system that genuinely cannot be decomposed favors a rewrite regardless of the risk). The second most common mistake is pairing a high-risk approach (a full rewrite) with a rollout strategy suited to a low-risk one (a single cutover), which is how a rewrite that was individually well-executed still causes an incident, because nobody validated it against real production behavior before trusting it fully.

Direct answer

When a legacy service is generating enough operational pain that something has to change, but the business can't absorb a full stop on feature work, the answer is to run both in parallel deliberately: carve out a defined, protected slice of engineering capacity for modernization work while feature work continues on everything else, rather than treating it as something the team squeezes in during slack time that never actually materializes.

Structured elaboration

1. Diagnose before allocating. Understand what's actually driving the incident volume (a specific fragile subsystem, a category of bug, an operational gap like missing monitoring) before deciding what modernization work would actually reduce it, so the effort targets the real cause rather than a plausible-sounding one.
2. Balance short-term fixes and long-term work explicitly, as two named tracks. Short-term operational fixes (better alerting, a faster rollback path, patching the specific recurring bug) reduce pain quickly and buy the credibility and breathing room to invest in the longer-term structural fix. Skipping straight to the long-term fix without the short-term relief usually means the incident volume stays high long enough to erode stakeholder patience before the real fix lands.
3. Allocate a protected percentage of capacity, not "whatever's left over." A common and defensible pattern is a fixed percentage of each sprint or quarter dedicated to modernization work, protected from being silently reabsorbed into feature work when a deadline looms, because that reabsorption is exactly how "we'll get to it" becomes "we never got to it."
4. Define milestones and track metrics that show progress, not just effort spent: incident volume trending down, time-to-resolve improving, the specific fragile subsystem's change-failure rate improving. Without a visible metric, it's hard to defend the ongoing capacity allocation against pressure to redirect it entirely to features.
5. Sequence quick wins first. For a system with multiple problems, addressing the ones that reduce risk or cost the most relative to effort first builds momentum and stakeholder trust in the approach, which matters for sustaining the capacity allocation over the following months.

Worked example

A legacy service generating a high volume of production incidents that teams repeatedly patch without addressing the root cause:

• Diagnosis reveals the majority of incidents trace back to a single fragile module with no automated tests and a history of being modified under time pressure without review.
• Short-term track: the team adds targeted monitoring and a faster, safer rollback path for that specific module immediately, cutting incident resolution time even before any structural change, and buying visible relief that reduces pressure while the longer effort proceeds.
• Long-term track: 20% of each sprint's capacity is protected for incrementally adding test coverage and refactoring the fragile module, with an explicit agreement from leadership that this allocation survives normal sprint-planning pressure rather than being the first thing cut when a deadline is tight.
• Milestones: the team tracks incident count attributable to this specific module monthly, targeting a 50% reduction within two quarters, a concrete, visible number that justifies the ongoing capacity allocation to stakeholders who are not tracking the work day to day.
• Six months in, incident volume from the targeted module has dropped substantially, which the team uses as evidence to negotiate continued (or expanded) protected capacity for the next fragile area, rather than the effort quietly winding down once the initial crisis passed.

Trade-offs and pitfalls

The trade-off is slower feature delivery in the near term against a system that stops generating enough operational pain to keep eating unplanned time regardless; teams that skip this trade and try to do modernization work purely in slack time consistently find that slack time never materializes under real delivery pressure, and the work simply doesn't happen. The most common pitfall is a protected-capacity allocation that exists on paper but gets silently deprioritized the first time a real deadline conflicts with it, which is why tracking and publicizing the resulting metric improvement matters: it's the evidence that keeps leadership honoring the allocation the next time there's pressure to cut it.

Direct answer

A full rewrite wins when the legacy system's structure fights every incremental change so hard that the accumulated cost of working around it, in time, in bugs, in the parts of the team's attention it consumes, exceeds a realistic (padded) estimate for building it again from what you now know. What has to go right: the team genuinely understands the system's current behavior well enough to not silently drop requirements, the business can tolerate a real delivery gap, and there's a credible plan for the parts of the estimate that are hardest to predict, data migration and the long tail of edge cases nobody remembers exist until they break in production.

Structured elaboration

The risks a rewrite introduces that incremental work avoids:

• The estimate is a guess dressed as a plan. You cannot fully know what a legacy system does until you've read every path through it, and if you could do that cheaply, you probably wouldn't need a rewrite. Rewrites reliably underestimate the "long tail," the 20% of behavior that's undocumented, weird, and only matters for edge cases, because that's exactly the part that's hardest to discover in advance.
• All-or-nothing delivery. An incremental effort can stop, ship partial value, and reassess. A rewrite typically can't ship real value until most of it is done, which means the business is exposed to the full cost of the effort before seeing any of the benefit, and a rewrite that stalls at 80% delivers zero value for the investment made.
• Data migration risk concentrates at the end. Incremental approaches migrate data piece by piece, catching problems early on a small blast radius. A rewrite often defers data migration to a single cutover at the very end, which is exactly when the team has the least remaining slack to absorb a surprise.

The risks incremental work introduces that a rewrite avoids:

• Running two systems for longer than planned, with the ongoing cost and the risk of the migration simply never finishing.
• The seam itself becoming a source of bugs, translation errors at the boundary between old and new that a from-scratch rewrite wouldn't have to deal with.
• Slower overall delivery of the target end state, since incremental work is deliberately paced to be safe rather than fast.

Concrete mitigations for the rewrite risks: build characterization tests against the legacy system's actual behavior before writing a line of the replacement, so the estimate is grounded in observed behavior rather than assumed behavior; plan the data migration and cutover as a first-class, staged piece of the project rather than a final step; and set an internal checkpoint (not a public commitment) partway through where the team honestly reassesses whether the estimate is holding, with permission to fall back to a hybrid approach if it isn't.

Worked example

A retrospective example: a team decided a legacy inventory system's coupling to a proprietary rules engine made incremental extraction impractical, so they chose a rewrite. What made it work: they spent the first month purely on characterization testing against the legacy system, capturing behavior for every product category and edge case they could enumerate, before writing any new code. That testing surfaced a rounding rule for one product category that looked like a bug but turned out to be a deliberate accommodation for a regulatory requirement in one region, exactly the kind of hidden logic a rewrite risks silently dropping. Because they'd captured it in a test before starting, the new system preserved it correctly, and the team could point to a passing test suite, not just confidence, when they cut over.

An architectural decision that limited scale, brought up in the same retrospective: the original system had used a single shared table for all regions' inventory data, which made the regulatory rounding rule and a dozen similar region-specific rules invisible in the schema and discoverable only by reading application code path by path. The rewrite's replacement schema made region-specific rules an explicit, first-class concept, directly because the team had been burned by how hard the old shape made those rules to find.

Trade-offs and pitfalls

The single biggest risk-reducer for a rewrite is treating "we understand the current behavior" as a deliverable to prove, via characterization tests against real behavior, rather than an assumption to proceed on. Teams that skip this step and start writing new code based on what they believe the system does, rather than what it's actually observed to do, are the ones whose rewrites silently change behavior and discover it in production months later.

Direct answer

These are four different tools for four different situations, and interviewers who use them interchangeably are usually testing whether you actually know the difference. A strangler fig is for gradually replacing a legacy system's functionality behind a routing seam while it stays live. An anti-corruption layer is for protecting a new system's domain model when it has to talk to a legacy system it is not replacing (or not replacing yet). A facade is for simplifying and unifying how callers interact with a messy legacy system, without migrating anything or translating between two different domain models at all. A full rewrite is for when the legacy system cannot be safely peeled apart at all. The decision comes down to whether the system can be decomposed into independently extractable pieces, and whether it needs to keep running the whole time. A fourth axis matters just as much: whether you are actually trying to replace anything at all, or you just want a safer, simpler interface onto a legacy system you have no plan to migrate away from, which is what a facade alone is for.

Structured elaboration

A useful way to separate them:

• Strangler fig answers "how do I replace this system's functionality over time without a big cutover." It assumes the system can be broken into pieces that can move independently, and it is a migration strategy, not a permanent architecture. Use it when the legacy system is large but decomposable, and downtime is not acceptable.
• Anti-corruption layer answers "how do I integrate with this system without its bad decisions becoming my bad decisions." It does not assume you are replacing anything; you might be integrating with a legacy system permanently (a partner's system you do not control) or temporarily (as one piece of a larger strangler effort, where the ACL sits between the parts still on legacy and the parts already moved). Use it any time a system you do not fully trust the shape of has to feed a system whose domain model you want to keep clean.
• Facade answers "how do I make a messy legacy system safer and simpler to call, without replacing or translating anything." Unlike an anti-corruption layer, it does not have to reconcile two different domain models, it is a single unified interface placed in front of a system you are not migrating away from, at least not yet, so callers stop depending directly on the legacy system's tangled internals. Use it when the goal is purely to make what already exists safer to call, or as the seam a later strangler-fig effort will route traffic through once you do decide to replace what is behind it.
• Full rewrite answers "the incremental approach is not viable here." Use it when the legacy system's capabilities are so tightly coupled that there is no seam to strangle along, when the code is small enough that a rewrite is genuinely cheaper than untangling it, or when the business can tolerate a real code freeze while the rewrite happens. It is also sometimes the right call for build-versus-buy reasons that have nothing to do with technical coupling: if a vendor product now does what the core subsystem does, replacing rather than incrementally modernizing can be the faster and cheaper path, provided the migration and switching costs are honestly priced in.

In practice they combine rather than compete: a strangler-fig migration typically starts by placing a facade in front of the legacy system to create a single seam, then uses an anti-corruption layer at that seam to protect the already-migrated parts from the still-legacy parts as pieces move across it.

Worked example

A team replacing a core subsystem (say, pricing) weighs the options (a facade alone is ruled out early, since the goal is to actually move pricing off the legacy system, not just make it safer to call):

• Strangler: pricing logic touches a dozen call sites across the codebase, but each call site is independently identifiable, so they can move pricing behind a facade and migrate call sites one at a time. This is the default choice given decomposability.
• ACL alone (no strangler): they decide pricing itself will stay on the legacy system for now, but a new checkout service needs pricing data. Rather than have checkout speak the legacy pricing format, they add an ACL so checkout's domain model stays clean, with no plan yet to replace pricing itself.
• Full rewrite / buy: they discover pricing logic is deeply entangled with tax and discount logic in ways that resist any clean extraction, and a commercial pricing engine now covers the requirements. They rewrite (replace) rather than strangle, accepting a scoped migration project with a defined cutover instead of an open-ended incremental one.

What would make the team abort a strangler approach midway and fall back to one of the other two: discovering that the "independent" call sites actually share hidden mutable state that makes partial migration unsafe, or finding the timeline slipping so far that the cost of running two systems is exceeding the cost a rewrite would have been from the start.

Trade-offs and pitfalls

The trap is picking strangler fig by default because it feels lower-risk, without checking that the system is actually decomposable; forcing a strangler approach onto tightly coupled logic produces years of a half-migrated system with all the maintenance cost of two systems and none of the safety benefit, because the seam itself becomes unreliable. The opposite trap is reaching for a full rewrite out of frustration with legacy code, when a narrower ACL would have solved the actual integration problem at a fraction of the cost and risk.

Direct answer

Put a dedicated adapter service (not a shared library scattered across callers) between the legacy protocol and your new consumers, responsible for protocol translation, authentication bridging, and error-shape normalization, and treat it as a temporary, shrinking piece of infrastructure with an explicit plan to retire it, not a permanent integration point. The design decisions that matter most are where it lives (sidecar versus a shared gateway), how it handles the legacy system's throughput and latency ceiling, and how you keep it from quietly becoming a second system nobody wants to touch.

Structured elaboration

The core responsibilities of the adapter:

1. Protocol translation: converting between the legacy wire format (SOAP, a proprietary queue protocol, fixed-width records) and whatever your new services speak (REST, gRPC, JSON).
2. Schema and semantic mapping: legacy field names, units, and enums translated to the new domain model, the same discipline as an anti-corruption layer, because this adapter usually needs to be one.
3. Authentication bridging: legacy systems often use older auth mechanisms (SAML, an older XML-based single sign-on standard; mutual certificates; static API keys); the adapter is where that gets exchanged for whatever your new services use, most commonly OAuth 2.0 tokens, with mTLS (mutual TLS) reserved for machine-to-machine cases rather than being an equally likely default.
4. Backpressure and resilience: legacy systems frequently cannot handle the request volume a modern service mesh can generate. The adapter needs connection pooling, request batching, and its own rate limiting so it does not accidentally take down the legacy system it is protecting new consumers from.

On placement: a sidecar (deployed alongside each consuming service) minimizes added network hops and keeps the blast radius of a failure small, at the cost of deploying and versioning the adapter logic N times. A shared gateway centralizes the translation logic in one place, which is easier to evolve and monitor, at the cost of being a single point of failure and a potential throughput bottleneck if the legacy system's guaranteed-once processing requirements mean requests cannot simply be load balanced across replicas without care. For a small number of consumers with strict latency budgets, a sidecar is usually right; for many heterogeneous consumers, a shared gateway with careful capacity planning is usually right.

To avoid the adapter becoming permanent: track what fraction of the legacy system's capabilities still route through it, treat new special cases added to the adapter as a signal that a capability just got more entangled rather than less, and set an actual target date to revisit whether the adapter can start shrinking.

Worked example

A legacy mainframe payments system exposes a proprietary message-queue protocol with strict guaranteed-once processing semantics: the mainframe cannot handle duplicate submissions, and it cannot tell a modern REST client "I got that, don't worry." The adapter needs to:

• Accept REST requests from new services and assign each one an idempotency key before submitting to the mainframe queue, so a retried REST call does not become a duplicate mainframe transaction.
• Maintain a connection pool to the mainframe queue sized to its actual capacity, not the capacity of whatever load-balanced modern service is calling it, and queue or reject excess requests with a clear error rather than letting them silently pile up.
• Translate the mainframe's fixed-format response codes into REST status codes and structured error bodies the new services can actually branch on.
• Emit metrics on translation errors and latency added, since "how much is this adapter costing us" is exactly the number that later justifies (or delays) retiring it.

For the case where a third-party vendor keeps owning part of the flow (say, payment processing) for a bounded transition period, the same adapter pattern applies but with an explicit compatibility window: the adapter needs graceful-degradation fallback flows if the vendor's system is slow or down, SLA monitoring against the vendor's contracted latency, and a version-compatibility check so a vendor-side change does not silently break translation.

Trade-offs and pitfalls

The biggest pitfall is under-provisioning the adapter for the legacy system's real limits: a modern service tier can generate far more concurrent load than a mainframe queue was ever designed for, and the adapter's job is partly to be a deliberate throttle, not just a translator. The second is scope creep: once an adapter exists, it is tempting to route every new integration through it "since it's already there," which is exactly how a temporary migration aid becomes a permanent, poorly-owned piece of critical infrastructure that outlives the legacy system it was built to retire.