Neglect, not age
An application maintained continuously for ten years can be entirely pleasant to work on. One left untouched for three can be almost impossible, because every dependency is several major versions behind and nothing can be updated in isolation.
The difference is routine maintenance, which is cheap when continuous and expensive when deferred.
What routine maintenance means
- Security updates applied within days
- Dependency updates monthly, with tests
- PHP version kept on a supported release
- Automated vulnerability auditing on every build
- Tests kept passing, not disabled when inconvenient
A disabled test is worse than a missing one, because it creates the impression of coverage. Fix it or delete it.
Technical debt is a decision
Some shortcuts are correct decisions under time pressure. The problem is not taking them; it is not recording them, so they are never revisited.
- Record the shortcut and why it was taken
- Note what it would take to do properly
- Revisit when touching that area anyway
- Fix it before it blocks something important
Improve what you touch
Rather than a separate refactoring project, improve the code you are already changing. Over time the frequently-changed parts become clean and the untouched parts remain as they are, which is the correct allocation of effort.
Refactoring code nobody touches is spending effort where it produces no return.
Budget for it
| Application | Annual maintenance |
|---|---|
| Simple, stable | 10–15% of build cost |
| Active business application | 15–25% |
| Many integrations | 20–30% |
Unbudgeted maintenance means no maintenance, which means an application that becomes progressively more expensive to change.