Which method verifies restored vendor tree matches original after Composer backup?

Restoring a Composer environment from backup

The goal is to recover a PHP project after a system failure, restoring the exact dependency set recorded in composer.lock while ensuring the vendor directory contains the same files as before. The main constraint is that the backup may contain only the lock file and not the vendor tree, so composer install will re‑fetch packages from Packagist, potentially pulling newer patch releases. Another uncertainty is that composer validate only checks JSON syntax and lock consistency; it does not verify that the vendor files actually exist or match the original code. The unresolved decision is how to detect and prevent drift when the lock file is present but the vendor tree is incomplete.

Can composer validate be extended to report missing vendor files? Does running composer install --no-dev guarantee the same vendor tree when the lock file is unchanged? Which external diff or checksum tool is recommended to compare a restored vendor directory against a known‑good backup?