composer.lock and composer install interoperability: locked versions versus fresh resolution

Goal

Determine whether a committed composer.lock continues to govern composer install after constraints in composer.json are relaxed, and when Composer 2.x disregards the lock and performs fresh resolution instead.

Constraints and uncertainty

Composer installs exact locked versions and distribution hashes when the lock file is present and consistent with composer.json. If the lock file is missing, deleted, or older than the manifest, Composer may fall back to resolving from composer.json and install different versions. The lock pins PHP package versions but not system PHP extensions, operating-system libraries, or runtime configuration, so identical locked sets can still behave differently across platforms.

• Does composer install honor an existing lock file after a composer.json constraint is loosened, or does it re-resolve immediately?
• What lock-file conditions force Composer 2.x to ignore composer.lock and perform fresh dependency resolution?
• Does locking package versions through composer.lock guarantee identical runtime behavior across environments with different PHP extensions or OS libraries?