diff --git a/AGENTS.md b/AGENTS.md
index 16f504e..f07fb02 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -49,7 +49,10 @@ Adding a build step changes this contract. Read
 - `submitted-skills/` — other people's submitted work, reproduced verbatim
 - `skill-reviews/improved/` — generated; edit `skills-review/catalog.js` instead
 - `vote-service/` — separate deploy lifecycle; do not fold into the site build
-- `package-lock.json`, `dist/`, `node_modules/`
+- `dist/`, `node_modules/` — build output, never committed
+- `package-lock.json` — **committed, but never hand-edited.** Change it only
+  as a side effect of `npm install`. Every worktree spins up with `npm ci`,
+  which fails outright without it.
 
 ## Rules