fix(lockfile): preserve default-branch flag through lock round-trips

ArrayDumper emits `default-branch: true` into the lock for any package
that came from a default branch, and ArrayLoader reads it back to
synthesize the `9999999-dev` alias inside Locker::getLockedRepository.
Mozart was dropping the flag in two places: packagist_version_to_locked_package
ignored pv.default_branch when building the lock entry, and
locked_package_to_packagist_version hardcoded default_branch=false when
re-hydrating a lock-pinned package's metadata for partial updates. The
result was that a non-allow-listed default-branch dev package (e.g. f/f
in update-changes-url) ended up in the new lock without the marker, so
collect_stale_installed_aliases thought its `9999999-dev` alias had
been retired and emitted a spurious MarkAliasUninstalled trace.

1 files changed, 15 insertions, 1 deletions

diff --git a/crates/mozart-registry/src/lockfile.rs b/crates/mozart-registry/src/lockfile.rs
index 5a293fe..3ddc6a2 100644
--- a/crates/mozart-registry/src/lockfile.rs
+++ b/crates/mozart-registry/src/lockfile.rs
@@ -580,7 +580,11 @@ fn locked_package_to_packagist_version(pkg: &LockedPackage) -> PackagistVersion
             .get("notification-url")
             .and_then(|v| v.as_str())
             .map(String::from),
-        default_branch: false,
+        default_branch: pkg
+            .extra_fields
+            .get("default-branch")
+            .and_then(|v| v.as_bool())
+            .unwrap_or(false),
         abandoned: pkg.extra_fields.get("abandoned").cloned(),
     }
 }
@@ -742,6 +746,16 @@ fn packagist_version_to_locked_package(name: &str, pv: &PackagistVersion) -> Loc
             extra_fields.insert("abandoned".to_string(), abandoned.clone());
         }
     }
+    // Propagate `default-branch: true` so the lock surface — and the
+    // installed.json round-trip — keeps the marker that drives Composer's
+    // synthetic `9999999-dev` alias for default-branch dev packages.
+    // Without this, `Locker::getLockedRepository` (which Mozart mirrors via
+    // `collect_stale_installed_aliases` / `lock_alias_pretty_pairs`) can't
+    // tell that the package's default branch is still aliased and emits a
+    // spurious `MarkAliasUninstalled` for the missing `9999999-dev` alias.
+    if pv.default_branch {
+        extra_fields.insert("default-branch".to_string(), serde_json::Value::Bool(true));
+    }
 
     LockedPackage {
         name: name.to_string(),