# Dependencies

CLAUDE.md says prefer writing from scratch and hide what can't be.
This is the line that decides cases.

## Hand-roll when all three hold

- **The spec is dead.** JSON, PNG, deflate, ChaCha - frozen for
  decades. Code against a dead spec is finished forever; it has no
  maintenance tail.
- **A slice suffices.** Take the part we use, never the library:
  `Json` is one enum and a parser, png writes stored deflate,
  chacha is one stream. A slice that grows features the kernel
  does not need has become a library, and libraries are what
  dependencies are for.
- **It sits on the replay contract.** rand's exact streams and
  serde_json's exact bytes were load-bearing for byte-identity;
  upstream churn there is corruption. It is real: serde_json
  1.0.151 quietly swapped ryu for zmij.

## Rent when any holds

- **The spec is alive** - TLS, HTTP, HTML/CSS, Unicode. Never
  ours.
- **It faces the platform** - windowing, GPU, audio. winit, wgpu,
  cpal stay dependencies, frozen; softbuffer holds wgpu's seat
  until the pretty face. Own the face, rent the platform.
- **It defends secrets** - security crypto is rented expertise.
  Our chacha exists for reproducibility, not secrecy.

## The garden

apps/jsx rents freely (react, react-dom, three) and does not argue
about it. Nothing there is load bearing.

## The method

Nothing is deleted until its replacement is proven byte-identical
against it: chacha differential-tested against rand 0.8, Json
against serde_json over all 46 goldens. No proof, no deletion.