Dependencies

CLAUDE.md says prefer writing from scratch and hide what can't be. This is the line that decides cases.

Hand-roll when all three hold

• The spec is dead. JSON, PNG, deflate, ChaCha - frozen for

decades. Code against a dead spec is finished forever; it has no maintenance tail.

• A slice suffices. Take the part we use, never the library:

Json is one enum and a parser, png writes stored deflate, chacha is one stream. A slice that grows features the kernel does not need has become a library, and libraries are what dependencies are for.

• It sits on the replay contract. rand's exact streams and

serde_json's exact bytes were load-bearing for byte-identity; upstream churn there is corruption. It is real: serde_json 1.0.151 quietly swapped ryu for zmij.

Rent when any holds

• The spec is alive - TLS, HTTP, HTML/CSS, Unicode. Never

ours.

• It faces the platform - windowing, GPU, audio. winit, wgpu,

cpal stay dependencies, frozen; softbuffer holds wgpu's seat until the pretty face. Own the face, rent the platform.

• It defends secrets - security crypto is rented expertise.

Our chacha exists for reproducibility, not secrecy.

The garden

apps/jsx rents freely (react, react-dom, three) and does not argue about it. Nothing there is load bearing.

The method

Nothing is deleted until its replacement is proven byte-identical against it: chacha differential-tested against rand 0.8, Json against serde_json over all 46 goldens. No proof, no deletion.