01Does it build from source on a clean machine today?
Not on the build server that has been running for six years. On a laptop with nothing installed, from the repository, following written steps.
What it tells you. If it does not, you do not have a codebase you control - you have a running instance. Nothing else on this list can be assessed reliably until that is fixed, and fixing it is usually days rather than months.
02Is there any automated test suite at all?
Any coverage counts. The question is whether something will tell you when behaviour changes.
What it tells you. With no tests, a rewrite is a bet that you can re-specify behaviour nobody has written down. Characterisation tests written against the current system are almost always the cheapest first move, whatever you decide afterwards.
03Is the framework or runtime still receiving security patches?
Check the version you actually run, against the vendor's own support policy, not the project's latest release.
What it tells you. This changes urgency more than any other single answer. An unsupported runtime on an internet-facing system is a risk decision; the same runtime on an isolated internal system is a maintenance decision.
04Where does the business logic actually live?
Application code, or stored procedures, triggers, scheduled jobs and constraints the app enforces that the schema does not?
What it tells you. Logic scattered outside the application is the most common reason rewrites silently drop rules. The more that sits in the database and in cron, the more a rewrite is a discovery project wearing an engineering estimate.
05Is there a living, still-employed person who understands the domain rules?
Not the code - the rules. Why the discount is calculated that way, why that customer type is exempt.
What it tells you. If yes, almost any path is viable and you should move while that is still true. If no, preservation work comes before any change, because the system is currently the only remaining specification.
06Is there a licence or hardware dependency pinning the deployment?
A per-CPU licence, a dongle, a specific OS version, an integration with a device that speaks one protocol.
What it tells you. These constraints usually decide the answer on their own, and they are the ones most often discovered late. Establish them before anyone estimates anything.
07Is the database shared with systems nobody controls?
Reporting tools, another department's application, an integration writing directly into tables.
What it tells you. A shared schema means the database is a public interface whether or not anyone intended it. That usually rules out a clean rewrite and points toward gradual replacement behind a stable interface.
08How often does it deploy?
Weekly, quarterly, or only when something breaks?
What it tells you. Deployment frequency is a proxy for how frightening the system is to change. A system nobody dares deploy will not survive a gradual migration, because that approach requires frequent small releases.
09What regulation constrains the data it holds?
Retention obligations, residency requirements, audit trails you must be able to produce.
What it tells you. Regulation constrains where the system can run and what can be discarded, which narrows the options before technical preference gets a say.