Composer dependency overlay can attest a mount without replacing runtime code

[chubes4]

Problem

A composer-package dependency overlay can report the requested Git reference and source digest as mounted while PHP still executes the consumer plugin's pre-existing package implementation.

This makes the overlay receipt look authoritative even though the runtime dependency was not replaced.

Reproduction

1. Use a WordPress plugin that vendors an older Composer package revision.
2. Declare the plugin in inputs.extra_plugins.
3. Declare a clean newer package checkout in inputs.dependency_overlays with kind: composer-package.
4. Run a WP-CLI workload that exercises behavior which differs between the two package revisions.

Observed in a Static Site Importer fixture-matrix dependency-discovery recipe:

• The prepared mount records the newer package commit as reference.
• The mount records a content SHA-256 for the newer source.
• Direct host execution through the newer checkout succeeds.
• The same exact staged input inside WP Codebox fails with the diagnostic produced by the consumer's older vendored package.
• The mounted target is the expected consumer path: vendor/automattic/blocks-engine-php-transformer.

The mismatch remains after committing the source checkout and rerunning with a new artifact directory, so it is not dirty-worktree provenance or caller output reuse.

Expected contract

1. A successful dependency-overlay mount makes the declared package implementation authoritative for Composer autoloading in the runtime.
2. The prepared overlay receipt proves the actual executable package tree, not only the requested mount input.
3. Integration coverage vendors revision A in a consumer, overlays behaviorally distinct revision B, and asserts PHP executes revision B through the consumer's normal autoloader.
4. If replacement cannot be guaranteed, recipe setup fails before workloads run.

AI assistance

OpenAI GPT-5.6-Sol via OpenCode helped compare host and sandbox behavior, inspect mount attestations and Composer autoload paths, isolate the overlay boundary, and draft this report. Chris Huber remains responsible for the issue.