Every line is debt — the best mechanism is the one you don't write. Before building any guard, validator, convergence protocol, or cleanup path, two checks gate it:

Measure the change, and treat a bad size-to-behaviour ratio as a shape defect. Before accepting a change, count what it actually cost — production code apart from tests and docs, and comments apart from logic, because a diff dominated by explanation is not the same as one dominated by machinery:

git diff --numstat <base> -- ':!specs' ':!*.test.*' ':!**/test-harness'

Then read the added lines, not just the total. A small behavioural change that costs a large number of lines is a red flag — it is the most reliable signal that the fix is fighting the existing shape rather than fitting it: a special case layered where the general case belongs, a second owner introduced beside the real one, or a wrapper bridging two things that should have been merged. The correct response is to rework it from the shape the code would want, not to commit it with a paragraph explaining why it had to be big; that explanation is the smell, not the mitigation.

Two honesty rules, or the number means nothing: formatter churn in files the change did not otherwise touch is not part of the change and must stay out of the commit; and a net count near zero can still hide real weight — a new cron, table column, index, endpoint, dependency, or config flag is a surface someone now owns and maintains, so name those separately from the count.

Do not over-weigh the sunk cost of the existing architecture. "It already exists and works" is not an argument for keeping a shape — coding agents make large architecture switches cheap, so size a refactor by the quality of the end state, not by the volume of code it replaces. When behavior must survive, pin it with tests at the consumer surface and swap the architecture underneath — though most of the time even the old seams shouldn't survive verbatim: a big refactor is the chance to redraw them into the shape the codebase would want today, not to faithfully rebuild the old interfaces on a new foundation.

Prefer one shared primitive over N adapters. An adapter is acceptable only at an external boundary or as a short-lived migration seam.

Split a module that owns too many concepts — decomposition is refactoring too. The dual of merging duplicates: when one file or function has accreted unrelated responsibilities, divide it along ownership seams so each piece owns a coherent slice a reader can name and the original thins to composition. Past ~1000 lines a file is a smell, not a verdict — some modules earn their size (a cohesive state machine, a generated table, one algorithm with tight internal coupling), but a god-file that registers dozens of routes or handles many domains inline is accreted responsibility, not cohesion. The split is right only when each new module owns a nameable responsibility and import pressure drops because dependencies moved with it; it's wrong when it's line-count relief that scatters one concept across files a reader must reassemble.

Know what already exists before you build something new. Before writing a new mechanism — a shape, computation, asset, state machine, data contract — search the codebase for one that already does this, or something close enough to share. Only once you know what's there can you make the real decision: reuse it, consolidate two near-duplicates, or extract the shared core into an independent module both call — and that decision belongs before you start, not bolted on after. Reuse is not automatically the answer; the existing thing may be wrong, or genuinely different, and then you build new deliberately. The failure this prevents is building in ignorance of what's already there: two implementations that must agree then silently drift, each re-deriving details the other already settled (orientation, units, edge cases, ordering).

Do not preserve dev-only compatibility by default. Unshipped scaffolding should move to the clean contract immediately.

Zero lineage signaling: name things for what they are, never for where they came from. A name that encodes history — a slice file prefixed with the mega-file it was split from, //, a module named after the experiment that produced it, a wrapper named after the API it replaced — carries no information to a reader who wasn't there, and actively misleads the one who was once the old thing is gone. The test: would someone who joined today, knowing nothing of the history, choose this name? If the name only makes sense with the backstory, rename it; history lives in git, not in identifiers. The same rule kills lineage comments ("previously this was...", "moved from X") — they describe the diff, not the code, and rot the moment the referent disappears.

Prefer the idempotent contract over the refusal. When an operation can be asked for twice — a retry after a lost response, a user clicking the same button again, a replayed webhook — reaching the requested end state should succeed, not error. "Install X" where X is already installed at the place it belongs is a success: return the thing. Refusal is correct only when the second request means something genuinely different from the first — a DIFFERENT thing already occupies the name, so honoring the request would destroy or shadow it. The tell that you have it backwards: a caller has to special-case your error code to recover normal behavior, or a retry path needs a pre-flight "does it already exist?" read that races. Applies beyond writes: deletes of absent things, unsubscribes, and "mark complete" toggles are all idempotent by nature, and making them 404 or 409 pushes bookkeeping onto every caller.

Constrain the model to what production actually writes. A schema that permits more than any writer produces — a list where every flow stores one element, a state nothing reaches — taxes every consumer with the general case. The tell: a consumer asking "but which one?" when the data can only contain one. Enforce the constraint at the write path; widen when a real use arrives.

Make ownership visible in stats, tests, or debug output when divergence was the bug class.

A check that RE-DERIVES a value the code already computes will drift from it. A test or second consumer that recomputes geometry, state, or a derived quantity independently can disagree with the code over a difference invisible on paper — an operation-order or rounding subtlety — and fire false verdicts. Export the owner's computed value and have the check consume that, so it enforces exactly what the code produced: one owner for the computation, not two that happen to mostly agree.

A symmetric or featureless placeholder can hide an orientation or coordinate bug in the thing it stands in for. A symmetric stand-in renders the same whether or not the coordinate frame is flipped, so the defect stays invisible until a real asymmetric asset exposes it. When you swap a placeholder for the real asset, re-verify orientation and framing, not just that it renders.

Update the spec or handoff with the new invariant, not the mechanical file list.

If the refactor starts widening into unrelated behavior, slice it: land the shared contract first, then port consumers in reviewable passes.