inspector: cut first paint by 30% and delete the unused half of packages/ui

[Mark-Life]

Problem:

The inspector fetched its entire JavaScript bundle before painting a pixel — 332.6 KiB gzip, including a charting library only the memory route renders, a date picker only a popover opens, and a MessagePack codec the transport never uses. Nothing was code-split, so dist/ and the first paint were the same number.

manualChunks in vite.config.ts ended with a catch-all return "vendor" for anything under node_modules. A named chunk is reachable from the entry, so that line pinned every dependency to the first paint, and would have silently undone any lazy() boundary added above it: the component splits, its dependencies do not.

Separately, packages/ui carried 56 shadcn components, 28 of which no file in the repo imports. They cost nothing in JS, but globals.css scans packages/ui/src/** for class names, so each contributed utilities to both apps' stylesheets.

Solution:

Name only the trees the first paint pulls in whole (effect, react-dom, lucide-react) and leave the rest to Rolldown, which keeps a lazy-only module in the async chunk that needs it. Four boundaries then carry weight: the three non-default routes, SessionDetail inside the sessions route, the Calendar behind the date facet, and the Toaster. sessions stays eager because an empty hash resolves to it. Each boundary has a sized Suspense fallback, so no pane collapses while its chunk arrives.

@effect/rpc serves NDJSON and MessagePack from one module and imports msgpackr statically; src/stubs/msgpackr.ts is aliased in its place and throws if MessagePack is ever constructed. The CLI's server keeps the real package.

Deleting the 28 unimported components takes the inspector's CSS from 162.8 KiB to 115.0 and the web app's from 162.0 to 113.8, and drops eight dependencies only reachable through them. shadcn add <name> brings any of them back. Two dead @source globs went too — they pointed at packages/apps and packages/components, neither of which exists.

Full numbers and method in docs/bundle-size.md.

---

Security Impact:

None. The msgpackr alias is browser-build-only and narrows an unused deserializer to a throwing constructor.

---

Testing:

bun run typecheck, bunx --bun ultracite check, and bun test:

Tasks:    9 successful, 9 total     (typecheck)
Checked 255 files in 2s. No fixes applied.
208 pass, 2 fail                    (bun test)

The two failures are in packages/core/test/agents.test.ts and reproduce unchanged on main.

No browser exists in this environment, so the lazy boundaries were exercised under happy-dom: the shell, all three lazy routes, the Toaster (fired a toast to force it to paint) and the Calendar inside its Radix portal all mounted. That harness needs a global DOM registration that breaks the 28 non-DOM tests sharing the process, so it was not kept. peektrace serve was also run against the new dist/; all 20 assets return 200.

Before, first paint was 1159.5 KiB raw / 332.6 KiB gzip and equalled the whole directory. After, it is 801.4 / 233.4, with 291 KiB deferred and 66.8 KiB genuinely deleted.