Every Mesrai rule, in one place

Avoid re-checking loop-invariant conditions inside iterations; lift them out.

Deduplicate identical queries within a request; reuse previously fetched data or preload in a single query.

Avoid unnecessary AsQueryable/ToList/Where/Select chains that do nothing; keep pipelines minimal.

Avoid no-op or duplicate calls (e.g., flatten.flatten, compact followed by compact!).

Avoid `!` when nullability is already proven or a safer alternative (`??`, early return) exists.

Eliminate debug helpers (var_dump, die, print_r) and commented-out blocks before merging.

Ship only runtime artifacts (binaries, compiled assets, minimal configs). Exclude tests, sources, docs, and dev tooling.

Detect lines with trailing whitespace. Trailing spaces add unnecessary noise to version control diffs. Recommend removing them to keep the codebase clean.

Delete dead code and after-return/throw statements that never execute.

Eliminate assignments to variables that are never used or overwritten immediately to improve code efficiency and readability.

Delete dead configuration fields and env flags; keep only variables that change behavior.

Delete imports that are not referenced by the compilation unit.

Delete imports and locals that are not referenced; prefer tooling (ruff/flake8/mypy) to enforce.

Delete dead/commented code and unused params; rely on version control for history.

Delete unused locals or prefix with underscore when required by interface.

Function names must describe side effects and return values (e.g., fetchUser vs. process).

Do not use echo/var_dump for diagnostics in application code; use a PSR-3 logger or error_log with levels.

Derive paths/URLs from configuration or environment variables, not string literals in code.

Give semantic names to magic numbers/strings and freeze where appropriate.

Prefer named def functions for non-trivial logic; keep lambdas only for tiny, inline expressions.

Extract numeric literals with meaning into named constants or readonly fields.

Use the standard logging module (or your app's logger) instead of print() in committed code.

Use safe casts (as?) with null checks or require statements instead of unchecked as.

Do not expose full, unminified source maps publicly in production. If source maps are required for error tracking, serve them behind authentication or IP allowlists and set "X-Robots-Tag: noindex".