backend/ and frontend/ already had committed lockfiles; platform/api/ just gained one. gateway/ and provisioner/ never had one generated at all — not a deliberate policy, an inconsistency. Generated via npm install --package-lock-only and validated with a clean npm ci for both (72 and 153 packages respectively, no resolution surprises).