Was ambiguous — backend/frontend committed lockfiles, api/gateway/provisioner didn't, with no stated reason either way. Now explicit: every first-party Node service commits its package-lock.json, validated with npm ci before each commit that touches it.