In-place strip pass for the per-app OTP bundle, called by MobDev.NativeBuild when MOB_SLIM=1. Was an inline ~100-line defp in native_build.ex; extracted here so it's testable and has a place for per-app override hooks to live.

What gets stripped

Six phases run in fixed order against <app_bundle>/otp:

1. apple_binaries — .so / .a and priv/bin/* (Apple-policy parity: no standalone executables in the bundle)
2. prefix_libs — every lib/<name>-* whose <name> is in the computed strip set (see compute_strip_set/1)
3. foreign_apps — lib/{toy_,test_,mob_test,scratch_}* (other projects' code that snuck into a shared OTP cache)
4. dedup_versions — when the same lib appears at multiple versions, keep only the highest
5. src_and_headers — every src/ and include/ directory
6. beam_chunks — :beam_lib.strip_release/1 drops Debug/Doc chunks from every .beam

Steps are intentionally idempotent so repeat runs are safe.

Strip set composition

The default strip set is the hardcoded baseline (hardcoded_prefixes/0) — a curated list of OTP libs mobile apps never need (megaco, snmp, diameter, …). Per-app overrides in mob.exs adjust the set:

config :mob_dev,
  slim: [
    drop_libs: ["foo_dep"],   # force-strip these too
    keep_libs: ["mnesia"]     # don't strip these even if baseline says so
  ]

drop_libs and keep_libs accept plain <name> strings — the same shape MobDev.OtpAudit's report uses, so users can copy basenames directly out of mix mob.audit_otp output.

Audit-driven expansion + the always-keep guardrail

When the caller passes :audit_input (typically via mob.exs slim: [audit: true, trace_json: "..."]), the strip set grows by:

• audit.foreign_app_names (allow-list-validated cache cruft)
• strippable_libs ∩ trace_strippable_libs (both signals agree)
• trace_strippable_libs \ strippable_libs (trace-only — libs the static graph reaches but the trace says are never called)

The last category is the powerful one and the dangerous one. A 60-second trace window can easily miss libs that ARE used but only at boot (sasl) or only in code paths the user didn't drive during the window (crypto, public_key, asn1, ssl when no TLS happens). Auto-stripping those would break apps.

The always_keep_libs/0 set is the safety guardrail: those libs are NEVER added to the strip set by audit-driven expansion, no matter what the trace says. The hardcoded baseline still strips what it strips, and :drop_libs still works as the user-explicit escape hatch — but the trace can't accidentally take down crypto or sasl.

Override patterns from mob.exs:

config :mob_dev,
  slim: [
    # Force-keep — user override beats everything else.
    # Use this if audit-driven strip is taking out a lib you
    # actually need at runtime.
    keep_libs: ["some_lib"],

    # Force-strip — user override beats the audit. Use this
    # to expand beyond what the trace alone would mark.
    drop_libs: ["my_unused_dep"]
  ]

Precedence (in order from least to most authoritative): hardcoded baseline → audit-derived expansion (minus always_keep_libs) → :drop_libs → :keep_libs. The user's :keep_libs is always the last word.