Package listed as installed recipe even if recipe-contrib not activated

[GromNaN]

The package should not be listed in symfony.lock when the recipe hasn't been applied. For example, when the recipe-contrib is not authorized.

Reproducer

Create blank project

symfony new reproducer
cd reproducer

Add a package with a recipe-contrib in non-interactive mode:

composer require doctrine/mongodb-odm-bundle -n

Since extra.symfony.allow-contrib is not set, the recipe for the package was not applied (expected behavior). But it's listed in symfony.lock like it was:

    "doctrine/mongodb-odm-bundle": {
        "version": "5.5",
        "recipe": {
            "repo": "github.com/symfony/recipes-contrib",
            "branch": "main",
            "version": "5.0",
            "ref": "e84b128ea886f70a430eb88de7ac8217611542cc"
        }
    },

Now, there is no way to run the recipe, except removing and re-installing the package.

I tried:

composer config extra.symfony.allow-contrib true
composer recipe:update

Output:

❯ composer recipe:update
All packages appear to be up-to-date!

This is not expected, the recipe should be applied because contrib are now allowed.

If I remove the entry in symfony.lock and run the previous commands, then the recipe is applied.

[stof]

If contrib recipes are not allowed, I would indeed expect the symfony.lock to include the package in the same way than packages than don't have any recipe.
the current behavior looks like a bug.