No individual JS bundles exceed 250KB gzipped

A JavaScript bundle exceeding 250KB gzipped takes 2–5 seconds to parse and execute on a mid-range Android device, even on a fast connection — because parse time is CPU-bound, not network-bound. Google's research shows that 100KB of JavaScript takes ~1 second of CPU time on a median mobile device; a 500KB bundle costs 5 seconds before any user interaction is possible. This directly fails the Core Web Vitals Interaction to Next Paint (INP) threshold. CWE-770 (Allocation of Resources Without Limits) applies: shipping an unbounded bundle is a resource management failure that degrades every user's experience proportionally to device age.

Analyze your production bundle with @next/bundle-analyzer or vite-plugin-visualizer, identify the largest chunks, and apply code splitting or lighter alternatives. Never measure bundle size from a dev server — dev builds include extra runtime overhead.

# Install and run bundle analyzer
npm install --save-dev @next/bundle-analyzer
ANALYZE=true npm run build

// next.config.ts
import bundleAnalyzer from '@next/bundle-analyzer'
const withBundleAnalyzer = bundleAnalyzer({ enabled: process.env.ANALYZE === 'true' })
export default withBundleAnalyzer({})

// Replace static imports of heavy libraries with dynamic imports
// Before
import { BarChart } from 'recharts'

// After
const BarChart = dynamic(() => import('recharts').then(m => m.BarChart), { ssr: false })

For moment/lodash, switch to date-fns and lodash-es which are tree-shakeable, or remove entirely if usage is minimal.