fix(install): honour branch-alias when checking lock requirements

Mirror Composer's `Locker::getLockedRepository` flow when validating that
every root require is satisfied by the lock and when emitting trace
operations: a `dev-*` package's `extra.branch-alias` entry surfaces an
AliasPackage at the alias version, so requirement matching considers
that version too and `MarkAliasInstalled` fires for the branch-alias
when the lock has no matching `aliases[]` entry. Dedupe by
`alias_normalized` so packages aliased through both sources don't get
two trace lines.

1 files changed, 24 insertions, 0 deletions

diff --git a/crates/mozart/src/commands/install.rs b/crates/mozart/src/commands/install.rs
index b41e91a..5c56fbc 100644
--- a/crates/mozart/src/commands/install.rs
+++ b/crates/mozart/src/commands/install.rs
@@ -891,6 +891,16 @@ pub async fn install_from_lock(
             // match. Mirrors Composer's `Transaction::calculateOperations` DFS
             // which pushes alias targets first and emits MarkAliasInstalled
             // when the alias itself is processed.
+            //
+            // Two sources of alias entries: the `aliases[]` block in
+            // `composer.lock` (which the resolver populates with both root
+            // aliases and branch-aliases) and the package's own
+            // `extra.branch-alias` (recovered through
+            // `Locker::getLockedRepository`'s ArrayLoader expansion when the
+            // lock was hand-written without a matching `aliases[]` entry).
+            // The two sources can name the same alias version, so dedupe by
+            // `alias_normalized` to avoid emitting the trace line twice.
+            let mut emitted_alias_versions: Vec<String> = Vec::new();
             for alias in &lock.aliases {
                 if alias.package.eq_ignore_ascii_case(&pkg.name) && alias.version == pkg.version {
                     executor
@@ -899,8 +909,22 @@ pub async fn install_from_lock(
                             &exec_ctx,
                         )
                         .await?;
+                    emitted_alias_versions.push(alias.alias_normalized.clone());
                 }
             }
+            let branch_aliases = lockfile::locked_package_branch_aliases(pkg);
+            for alias in &branch_aliases {
+                if emitted_alias_versions.contains(&alias.alias_normalized) {
+                    continue;
+                }
+                executor
+                    .install_package(
+                        PackageOperation::MarkAliasInstalled { alias, target: pkg },
+                        &exec_ctx,
+                    )
+                    .await?;
+                emitted_alias_versions.push(alias.alias_normalized.clone());
+            }
         }
 
         // Step 8: Write updated vendor/composer/installed.json (unless download_only)