[BUG] install-strategy=linked: hidden lockfile (node_modules/.package-lock.json) records the hoisted layout, not the linked layout #9612

Part of #9608.

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

This is not just a request to bump a dependency for a CVE

• This is not solely a request to bump a dependency for a CVE

Current Behavior

After an install with install-strategy=linked, the hidden lockfile node_modules/.package-lock.json lists packages at their hoisted logical paths (node_modules/balanced-match, node_modules/brace-expansion, …) with no references to the actual on-disk .store/ layout. The real node_modules directory contains only the root-declared symlink(s) plus .store/. The hidden lockfile is meant to represent the on-disk state so npm can cheaply validate the actual tree, so it does not match what is on disk under the linked strategy.

Expected Behavior

The hidden lockfile should reflect the actual on-disk layout produced by the linked strategy (the .store/ entries and the symlinks), so that the cached "actual" state matches the filesystem.

Steps To Reproduce

cd "$(mktemp -d)"
echo 'install-strategy=linked' > .npmrc
cat > package.json <<'EOF'
{ "name": "hl", "version": "1.0.0", "dependencies": { "minimatch": "3.0.4" } }
EOF
npm install >/dev/null

grep -c '\.store' node_modules/.package-lock.json   # -> 0 (no references to the real layout)
node -e 'console.log(Object.keys(require(process.cwd()+"/node_modules/.package-lock.json").packages))'
#   [ '', 'node_modules/balanced-match', 'node_modules/brace-expansion',
#     'node_modules/concat-map', 'node_modules/minimatch' ]   <-- hoisted layout
ls node_modules | grep -v '^\.'                     # actual on-disk: only `minimatch` (a symlink)

Environment

• npm: 12.0.0-pre.1 (latest)
• Node.js: v24.17.0
• OS Name: macOS (Darwin 25.5.0)
• System Model Name: MacBook (arm64)
• npm config:

install-strategy=linked