Constraint: hk-8-8 deploy path builds the frontend in Docker and requires web/package-lock.json to satisfy npm ci.
Rejected: Hotfix the remote Dockerfile to bypass lockfile usage | would diverge deploy logic from repo source of truth.
Confidence: high
Scope-risk: narrow
Directive: Keep package.json and package-lock.json committed together for frontend dependency changes.
Tested: Verified lockfile presence locally; previous hk-8-8 build failure reproduced missing-lockfile requirement.
Not-tested: Fresh remote image build after this follow-up commit (next step in current rollout).
