Naming the real problem first is the step most site owners skip. "It feels old" can mean slow, hard to edit, dated, or quiet, and only some of those need a rebuild, so the symptom to fix table does more work than any feature checklist.

The protect list is the part I would send to clients before any quote. Listing the pages that bring in enquiries from Search Console, keeping their addresses, and testing every redirect before launch covers most of the traffic losses I have seen after a relaunch. Google's advice to change as little as possible at once is worth repeating too: new design first, new addresses later, so any drop can be traced to one change.

One addition: write the protected list into the scope as acceptance criteria. If the top twenty pages must keep their address or land on the right page in one redirect, that becomes part of done and gets checked before handover. Do you include a post launch Search Console check in the fixed scope?