Nobody Left Who Could Map It, And Four Systems Writing The Same Rows

The company ran on a system a previous developer had built and nobody currently there could explain. Thousands of source files, no framework, no current documentation, and a database of several hundred tables carrying every purchase order, formula, batch, shipment and invoice the business had ever produced. It worked. That is the part people underestimate. It had been working for years, which is exactly why nobody had been forced to understand it.

The specifics are the kind you do not invent. One file of more than four thousand lines handled shipping, a four way inventory deduction, invoice creation and carrier calls all at once, with a near duplicate sitting beside it whose differences nobody could state. The bill of materials propagated through seventeen separate button clicks across four layers, and if you stopped after nine, nothing warned you. A block of inventory deduction code sat commented out with no note saying why, which meant nobody could say whether the inventory totals were correct. And somewhere on the plant floor a handheld scanner was writing millions of location change rows directly into all four inventory ledgers. There was no source code for it anywhere, no known owner and no credentials on file.

We did not propose a rewrite. The first deliverable was a map: a six phase teardown of the database, the code, the integrations and the security model, committed into the client's own repository so it belongs to them and not to us.

The map on its own is a document. What makes it a decision is the three things built on top. A per table write ownership register, naming which system is authoritative for every feature area, because by then two applications could both create, approve and ship the same order with no coordination between them, and that was risk number one. A ranked risk register of eight items, each with an owner. And a deliberately small hardening list, which opens by saying what it is not: this is not a rewrite plan. Idempotent permission seeds, row locking on the writes that matter, failing closed on privileged permission checks, and timezone parity between the two applications so a customer's delivery date cannot drift depending on which one wrote it.

Then the part most engagements skip. We wrote an executive brief for the leadership team, in their language, with a phased roadmap, a list of what we are explicitly not doing, and three decisions only they could make: who owns the order cutover, which part of the back office goes next, and who has the authority to retire something.

We also did work that was small and mattered. A curated copy of the system that boots in a container, so it could be exercised without touching production. And a mechanical sweep that escaped the search term in 165 autocomplete endpoints in one pass, plus parameter sanitisation across the form and action handlers, which is one whole vulnerability class closed by method rather than by review.

One thing we insisted on. Four independent read-only passes validated the architecture claims at the code level, with file and line confirmations, and they produced three corrections to our own earlier documents. We published the corrections. A map that has never been wrong about anything has not been checked.