subtracting a whole native stack from the graph

Dependency risk rarely announces itself. It arrives as a default: a client library with its optional features left on, dragging in a platform-native cryptography library and a second encrypted-transport stack through bindings that need system packages to compile. Nothing fails. The graph simply grows a component that must be patched for as long as it exists, and that behaves differently depending on the machine that built it.

The change removed it by choosing features explicitly instead of accepting the defaults, and by pointing the mail and request paths at the same embedded trust bundle, so a container image carries its own certificate roots and stops depending on whatever the host happens to provide. An unused test-only dependency was deleted, and it turned out to be the last remaining path to a native probe that had been arriving through the side door.

The proof was mechanical rather than rhetorical: search the resolved graph for the removed family and get nothing — not the library, not the binding, not the shim. The lock file lost well over a hundred entries. Build, lints as errors, format check and the full test suite had to be green before the change counted.

One native path survived, and the record names it instead of hiding it: a desktop development server's socket, which is not part of what reaches users.

What it proves: the team can shrink attack surface by subtraction and then demonstrate the absence, which is a harder claim to support than demonstrating a feature.