---
id: infra/revisit-the-frozen-lockfile-rule-in-claude-md
title: "Revisit the frozen-lockfile rule in `CLAUDE.md`, now that plugins resolve at install time"
theme: infra
status: open
created: 2026-08-20
date_source: stated
order: 5
---

**Revisit the frozen-lockfile rule in `CLAUDE.md`, now that plugins resolve at install time.**
Raised by the owner 2026-08-20, to be discussed rather than decided alone.

The rule as written is absolute: `bunfig.toml` sets `frozenLockfile = true`, `bun install` resolves
from `bun.lock` and nothing else, and an unexplained lockfile change in a diff is the signal the
whole arrangement exists to produce. The reasoning is the 2026-08-04 compromise, and it is good.

`npmDependencies` does not follow it. Plugin packages are declared as RANGES and installed with a
plain `bun install` into `plugins/node_modules/`, so they resolve per machine and per install. That
was chosen deliberately — ranges are what let two plugins share one copy of `sharp` — but it means
the codebase now holds two different postures on the same risk, and only one of them is written down.

Worth settling: whether the rule should say "the platform's own dependencies" rather than reading as
universal; whether the merged `plugins/bun.lock` should be committed after all (it would pin the
tree, at the cost of a per-machine file in git); and whether `bun install --frozen-lockfile` in
`plugins/` is achievable once that lockfile exists.