Legacy Modernization and Architecture Evolution Questions

Direct answer

Strangler fig retires a legacy system by growing a new one around it: you put a routing layer (a proxy, gateway, or facade) in front of the legacy system, move one capability at a time behind that layer to a new implementation, and let the old and new code paths coexist until every capability has moved and the legacy system can be turned off. The name comes from the strangler fig vine, which grows around a host tree until the host is no longer needed. It is popular precisely because it avoids the two failure modes of a big-bang rewrite: shipping nothing for a year, and cutting over everything at once with no way back.

Structured elaboration

The mechanics, in order:

1. Put a seam in front of the legacy system. Usually an API gateway, reverse proxy, or a facade inside the monolith itself, so callers do not know or care whether a request lands on old or new code.
2. Pick the first capability to extract, usually the one that is both low-risk and high-pain (a module that changes often but is not the most business-critical, so mistakes are cheap to learn from).
3. Build the new implementation and route a slice of traffic to it, verifying its output matches the old path before trusting it fully.
4. Repeat, capability by capability, until nothing is left behind the seam pointing at the legacy system.
5. Decommission the legacy code only once nothing routes to it and you have confirmed there are no hidden callers.

The most common ways teams get this wrong, in rough order of how often they show up:

• Never actually finishing. The easy 80% of capabilities get strangled in the first few months, and the hard 20% (the ones with the messiest coupling to legacy state) get deferred indefinitely. Two years later the org is paying to run and secure both systems forever, which is worse than either a rewrite or leaving the legacy system alone. This is the single most common failure and the reason a strangler effort needs a decommission target with a rough date attached, not just a start.
• Building a permanent adapter instead of a temporary one. The seam is meant to shrink as capabilities move; if it keeps growing new special cases instead, it has quietly become a second system to maintain, not a migration path.
• Not enforcing a hard boundary between the shared state. If the new service and the legacy system both write to the same tables without a clear ownership rule, you get silent data corruption long before anyone notices a functional bug.
• Treating the seam as free. Every hop through a translation layer costs latency and adds a new thing that can fail; teams who never measure this get surprised when the "temporary" adapter becomes the slowest part of the system.

Strangling is usually the right call when the system has to keep serving traffic throughout the change (most production systems), when you can identify genuinely separable capabilities, and when the org can tolerate running two systems for a while. A full rewrite becomes more attractive when the legacy system's capabilities are too entangled to peel apart one at a time, when the business can tolerate a real code freeze, or when the legacy code is so far from correct that incrementally wrapping it just preserves its bugs behind a nicer API.

Worked example

Say a monolith handles catalog, cart, checkout, and recommendations for an e-commerce site. A team decides to strangle it:

• They put an API gateway in front of all four capabilities.
• They pick recommendations first: it changes often, has no write path into the order/payment data, and a bug there degrades the experience rather than losing money.
• They build a new recommendations service, route 5% of traffic to it behind a flag, compare its output to the legacy path for a few weeks, then ramp to 100% and delete the legacy recommendations code.
• They repeat for catalog, then cart, and leave checkout, the most state-heavy and highest-risk capability, for last, once the team has practiced the pattern three times on lower-stakes capabilities.
• Eighteen months in, nothing routes to the legacy monolith and it is decommissioned.

The order matters: doing checkout first, before the team has proven the pattern on anything, is exactly the kind of decision that produces the abandoned-halfway failure mode above.

Trade-offs and pitfalls

Strangling trades speed for safety: you ship value continuously and can stop or reverse at almost any point, but you pay for it in the ongoing cost of running two systems and maintaining the seam between them, and in the discipline required to actually finish rather than stall. A full rewrite is the opposite bet: faster in principle if nothing goes wrong, but an all-or-nothing wager on a fixed-price estimate for a system whose exact behavior nobody has fully mapped, which is exactly the situation legacy modernization starts from. The senior mistake to watch for is choosing strangling for the safety story and then never applying the same rigor to actually retiring the legacy code, which converts a migration strategy into permanent architectural debt.

Direct answer

When a legacy service is generating enough operational pain that something has to change, but the business can't absorb a full stop on feature work, the answer is to run both in parallel deliberately: carve out a defined, protected slice of engineering capacity for modernization work while feature work continues on everything else, rather than treating it as something the team squeezes in during slack time that never actually materializes.

Structured elaboration

1. Diagnose before allocating. Understand what's actually driving the incident volume (a specific fragile subsystem, a category of bug, an operational gap like missing monitoring) before deciding what modernization work would actually reduce it, so the effort targets the real cause rather than a plausible-sounding one.
2. Balance short-term fixes and long-term work explicitly, as two named tracks. Short-term operational fixes (better alerting, a faster rollback path, patching the specific recurring bug) reduce pain quickly and buy the credibility and breathing room to invest in the longer-term structural fix. Skipping straight to the long-term fix without the short-term relief usually means the incident volume stays high long enough to erode stakeholder patience before the real fix lands.
3. Allocate a protected percentage of capacity, not "whatever's left over." A common and defensible pattern is a fixed percentage of each sprint or quarter dedicated to modernization work, protected from being silently reabsorbed into feature work when a deadline looms, because that reabsorption is exactly how "we'll get to it" becomes "we never got to it."
4. Define milestones and track metrics that show progress, not just effort spent: incident volume trending down, time-to-resolve improving, the specific fragile subsystem's change-failure rate improving. Without a visible metric, it's hard to defend the ongoing capacity allocation against pressure to redirect it entirely to features.
5. Sequence quick wins first. For a system with multiple problems, addressing the ones that reduce risk or cost the most relative to effort first builds momentum and stakeholder trust in the approach, which matters for sustaining the capacity allocation over the following months.

Worked example

A legacy service generating a high volume of production incidents that teams repeatedly patch without addressing the root cause:

• Diagnosis reveals the majority of incidents trace back to a single fragile module with no automated tests and a history of being modified under time pressure without review.
• Short-term track: the team adds targeted monitoring and a faster, safer rollback path for that specific module immediately, cutting incident resolution time even before any structural change, and buying visible relief that reduces pressure while the longer effort proceeds.
• Long-term track: 20% of each sprint's capacity is protected for incrementally adding test coverage and refactoring the fragile module, with an explicit agreement from leadership that this allocation survives normal sprint-planning pressure rather than being the first thing cut when a deadline is tight.
• Milestones: the team tracks incident count attributable to this specific module monthly, targeting a 50% reduction within two quarters, a concrete, visible number that justifies the ongoing capacity allocation to stakeholders who are not tracking the work day to day.
• Six months in, incident volume from the targeted module has dropped substantially, which the team uses as evidence to negotiate continued (or expanded) protected capacity for the next fragile area, rather than the effort quietly winding down once the initial crisis passed.

Trade-offs and pitfalls

The trade-off is slower feature delivery in the near term against a system that stops generating enough operational pain to keep eating unplanned time regardless; teams that skip this trade and try to do modernization work purely in slack time consistently find that slack time never materializes under real delivery pressure, and the work simply doesn't happen. The most common pitfall is a protected-capacity allocation that exists on paper but gets silently deprioritized the first time a real deadline conflicts with it, which is why tracking and publicizing the resulting metric improvement matters: it's the evidence that keeps leadership honoring the allocation the next time there's pressure to cut it.

Direct answer

Before you delete anything, you need proof the migration actually succeeded (not just that the new system is live), a defined retention and archival plan for whatever legal or audit obligations outlive the system itself, a rollback path in case something surfaces after decommission that the pre-cutover testing missed, and a communication plan that reaches every stakeholder who might still depend on the old system, including the ones you do not already know about.

Structured elaboration

A decommissioning plan has four parts, and skipping any of them is how "the migration is done" turns into "we deleted data we needed":

1. Verification that the migration is actually complete. Not "the new system works," but "nothing depends on the old one anymore." This means auditing traffic and access logs on the legacy system for weeks after the cutover, not just at the moment of cutover, because low-frequency dependencies (a monthly batch job, a quarterly report) will not show up in a one-week traffic sample.
2. Legal and audit retention requirements. Many systems have data that has to remain queryable for years after the system itself is gone, for regulatory or contractual reasons. That means an archival strategy decided before decommission, not scrambled together after someone asks for five-year-old records the week after you deleted the database.
3. A rollback plan for the decommission itself, distinct from the rollback plan for the original migration. If something surfaces after you have shut the legacy system down (a caller nobody knew about, a data discrepancy only visible under a rare condition), you need a defined path back, even if that path is "restore from the last verified backup and re-enable the legacy code path for a bounded window," not "we have no idea, we deleted it."
4. Third-party integrations and stakeholder communication. External partners often integrate with systems in ways your internal traffic logs cannot see (a partner polling an API you exposed to them specifically). The communication plan needs to reach them with enough lead time to migrate on their side, not just notify internal teams.

Worked example

A team decommissioning a legacy order-management system after a successful migration:

• They keep the legacy system read-only (not deleted) for 90 days post-cutover, monitoring access logs the whole time. In week six, they find a quarterly compliance report job still reading directly from the legacy database, which nobody had flagged as a dependency because it only runs four times a year.
• They export the full historical dataset to a queryable archive with a retention period matching the company's seven-year audit requirement, and verify a sample of archived records against the live system before the live system goes away, since an archive nobody has tested is not actually a safety net.
• They notify the three external partners who integrate with the legacy system's API directly, giving them 60 days' notice and a migration guide, rather than assuming internal migration alone covers everyone with a dependency.
• Only after all of this, and after a final confirmed zero-traffic week on the legacy system, do they actually shut it down, with the archived data and a documented restore procedure kept in case something surfaces later.

Trade-offs and pitfalls

The tempting shortcut is to declare victory the moment the new system handles 100% of live traffic and decommission immediately, but "no traffic this week" is not the same as "no dependencies," and the cost of being wrong (deleted data you needed, a partner integration silently broken) is far higher than the cost of a monitored grace period before deletion. The other common mistake is treating archival as a technical afterthought rather than a compliance requirement with its own sign-off, which is how companies end up unable to produce records a regulator or auditor asks for.

Direct answer

A full rewrite wins when the legacy system's structure fights every incremental change so hard that the accumulated cost of working around it, in time, in bugs, in the parts of the team's attention it consumes, exceeds a realistic (padded) estimate for building it again from what you now know. What has to go right: the team genuinely understands the system's current behavior well enough to not silently drop requirements, the business can tolerate a real delivery gap, and there's a credible plan for the parts of the estimate that are hardest to predict, data migration and the long tail of edge cases nobody remembers exist until they break in production.

Structured elaboration

The risks a rewrite introduces that incremental work avoids:

• The estimate is a guess dressed as a plan. You cannot fully know what a legacy system does until you've read every path through it, and if you could do that cheaply, you probably wouldn't need a rewrite. Rewrites reliably underestimate the "long tail," the 20% of behavior that's undocumented, weird, and only matters for edge cases, because that's exactly the part that's hardest to discover in advance.
• All-or-nothing delivery. An incremental effort can stop, ship partial value, and reassess. A rewrite typically can't ship real value until most of it is done, which means the business is exposed to the full cost of the effort before seeing any of the benefit, and a rewrite that stalls at 80% delivers zero value for the investment made.
• Data migration risk concentrates at the end. Incremental approaches migrate data piece by piece, catching problems early on a small blast radius. A rewrite often defers data migration to a single cutover at the very end, which is exactly when the team has the least remaining slack to absorb a surprise.

The risks incremental work introduces that a rewrite avoids:

• Running two systems for longer than planned, with the ongoing cost and the risk of the migration simply never finishing.
• The seam itself becoming a source of bugs, translation errors at the boundary between old and new that a from-scratch rewrite wouldn't have to deal with.
• Slower overall delivery of the target end state, since incremental work is deliberately paced to be safe rather than fast.

Concrete mitigations for the rewrite risks: build characterization tests against the legacy system's actual behavior before writing a line of the replacement, so the estimate is grounded in observed behavior rather than assumed behavior; plan the data migration and cutover as a first-class, staged piece of the project rather than a final step; and set an internal checkpoint (not a public commitment) partway through where the team honestly reassesses whether the estimate is holding, with permission to fall back to a hybrid approach if it isn't.

Worked example

A retrospective example: a team decided a legacy inventory system's coupling to a proprietary rules engine made incremental extraction impractical, so they chose a rewrite. What made it work: they spent the first month purely on characterization testing against the legacy system, capturing behavior for every product category and edge case they could enumerate, before writing any new code. That testing surfaced a rounding rule for one product category that looked like a bug but turned out to be a deliberate accommodation for a regulatory requirement in one region, exactly the kind of hidden logic a rewrite risks silently dropping. Because they'd captured it in a test before starting, the new system preserved it correctly, and the team could point to a passing test suite, not just confidence, when they cut over.

An architectural decision that limited scale, brought up in the same retrospective: the original system had used a single shared table for all regions' inventory data, which made the regulatory rounding rule and a dozen similar region-specific rules invisible in the schema and discoverable only by reading application code path by path. The rewrite's replacement schema made region-specific rules an explicit, first-class concept, directly because the team had been burned by how hard the old shape made those rules to find.

Trade-offs and pitfalls

The single biggest risk-reducer for a rewrite is treating "we understand the current behavior" as a deliverable to prove, via characterization tests against real behavior, rather than an assumption to proceed on. Teams that skip this step and start writing new code based on what they believe the system does, rather than what it's actually observed to do, are the ones whose rewrites silently change behavior and discover it in production months later.

Direct answer

These are four different tools for four different situations, and interviewers who use them interchangeably are usually testing whether you actually know the difference. A strangler fig is for gradually replacing a legacy system's functionality behind a routing seam while it stays live. An anti-corruption layer is for protecting a new system's domain model when it has to talk to a legacy system it is not replacing (or not replacing yet). A facade is for simplifying and unifying how callers interact with a messy legacy system, without migrating anything or translating between two different domain models at all. A full rewrite is for when the legacy system cannot be safely peeled apart at all. The decision comes down to whether the system can be decomposed into independently extractable pieces, and whether it needs to keep running the whole time. A fourth axis matters just as much: whether you are actually trying to replace anything at all, or you just want a safer, simpler interface onto a legacy system you have no plan to migrate away from, which is what a facade alone is for.

Structured elaboration

A useful way to separate them:

• Strangler fig answers "how do I replace this system's functionality over time without a big cutover." It assumes the system can be broken into pieces that can move independently, and it is a migration strategy, not a permanent architecture. Use it when the legacy system is large but decomposable, and downtime is not acceptable.
• Anti-corruption layer answers "how do I integrate with this system without its bad decisions becoming my bad decisions." It does not assume you are replacing anything; you might be integrating with a legacy system permanently (a partner's system you do not control) or temporarily (as one piece of a larger strangler effort, where the ACL sits between the parts still on legacy and the parts already moved). Use it any time a system you do not fully trust the shape of has to feed a system whose domain model you want to keep clean.
• Facade answers "how do I make a messy legacy system safer and simpler to call, without replacing or translating anything." Unlike an anti-corruption layer, it does not have to reconcile two different domain models, it is a single unified interface placed in front of a system you are not migrating away from, at least not yet, so callers stop depending directly on the legacy system's tangled internals. Use it when the goal is purely to make what already exists safer to call, or as the seam a later strangler-fig effort will route traffic through once you do decide to replace what is behind it.
• Full rewrite answers "the incremental approach is not viable here." Use it when the legacy system's capabilities are so tightly coupled that there is no seam to strangle along, when the code is small enough that a rewrite is genuinely cheaper than untangling it, or when the business can tolerate a real code freeze while the rewrite happens. It is also sometimes the right call for build-versus-buy reasons that have nothing to do with technical coupling: if a vendor product now does what the core subsystem does, replacing rather than incrementally modernizing can be the faster and cheaper path, provided the migration and switching costs are honestly priced in.

In practice they combine rather than compete: a strangler-fig migration typically starts by placing a facade in front of the legacy system to create a single seam, then uses an anti-corruption layer at that seam to protect the already-migrated parts from the still-legacy parts as pieces move across it.

Worked example

A team replacing a core subsystem (say, pricing) weighs the options (a facade alone is ruled out early, since the goal is to actually move pricing off the legacy system, not just make it safer to call):

• Strangler: pricing logic touches a dozen call sites across the codebase, but each call site is independently identifiable, so they can move pricing behind a facade and migrate call sites one at a time. This is the default choice given decomposability.
• ACL alone (no strangler): they decide pricing itself will stay on the legacy system for now, but a new checkout service needs pricing data. Rather than have checkout speak the legacy pricing format, they add an ACL so checkout's domain model stays clean, with no plan yet to replace pricing itself.
• Full rewrite / buy: they discover pricing logic is deeply entangled with tax and discount logic in ways that resist any clean extraction, and a commercial pricing engine now covers the requirements. They rewrite (replace) rather than strangle, accepting a scoped migration project with a defined cutover instead of an open-ended incremental one.

What would make the team abort a strangler approach midway and fall back to one of the other two: discovering that the "independent" call sites actually share hidden mutable state that makes partial migration unsafe, or finding the timeline slipping so far that the cost of running two systems is exceeding the cost a rewrite would have been from the start.

Trade-offs and pitfalls

The trap is picking strangler fig by default because it feels lower-risk, without checking that the system is actually decomposable; forcing a strangler approach onto tightly coupled logic produces years of a half-migrated system with all the maintenance cost of two systems and none of the safety benefit, because the seam itself becomes unreliable. The opposite trap is reaching for a full rewrite out of frustration with legacy code, when a narrower ACL would have solved the actual integration problem at a fraction of the cost and risk.