@@ -1591,10 +1591,11 @@ pub async fn run(args: RollbackArgs) -> i32 {
             global: args.common.global,
             global_prefix: args.common.global_prefix.clone(),
         };
-        let discovered = find_all_packages_for_rollback(
+        let discovered = crate::ecosystem_dispatch::find_package_paths_for_path_scope(
             &partitioned,
             &crawler_options,
             args.common.silent || args.common.json,
+            None,
         )
         .await;
         // One single-pattern scope per raw pattern, compiled once (not per
 
@@ -33,8 +33,7 @@ use std::path::{Path, PathBuf};
 use crate::args::{apply_env_toggles, GlobalArgs};
 use crate::commands::vex::{generate_vex_from_manifest_path, VexEmbedArgs};
 use crate::ecosystem_dispatch::{
-    crawl_ecosystems, crawl_ecosystems_with_npm, find_all_packages_for_rollback_reusing,
-    partition_purls,
+    crawl_ecosystems, crawl_ecosystems_with_npm, find_package_paths_for_path_scope, partition_purls,
 };
 use crate::json_envelope::{
     usage_error, Command as JsonCommand, Envelope, EnvelopeError, PatchAction, PatchEvent,
@@ -2181,7 +2180,7 @@ async fn run_scan(
         unresolved.dedup();
         if !unresolved.is_empty() {
             let partitioned = partition_purls(&unresolved, args.common.ecosystems.as_deref());
-            let copies = find_all_packages_for_rollback_reusing(
+            let copies = find_package_paths_for_path_scope(
                 &partitioned,
                 &crawler_options,
                 true,
 
@@ -634,33 +634,49 @@ pub async fn find_all_packages_for_rollback(
 }
 
 /// [`find_all_packages_for_rollback`], taking the npm `node_modules` roots
-/// from `prior` as [`find_packages_for_rollback_reusing`] does. Used by
-/// `scan`'s path scoping, which must see the same copies `rollback`'s path
-/// targets do.
-///
-/// An npm package's copies here also include each link in a `node_modules`
-/// root that resolves to one of them ([`add_npm_links_to_copies`]): path
-/// scoping asks which install paths reach a package, and pnpm's isolated
-/// linker or npm's `install-strategy=linked` reach a workspace member's
-/// ALIAS dependency only through such a link (#1266).
+/// from `prior` as [`find_packages_for_rollback_reusing`] does.
 pub async fn find_all_packages_for_rollback_reusing(
     partitioned: &HashMap<Ecosystem, Vec<String>>,
     options: &CrawlerOptions,
     silent: bool,
     prior: Option<&NpmCrawlSnapshot>,
 ) -> HashMap<String, Vec<PathBuf>> {
-    let prior_roots = prior
+    let npm_roots = prior
         .filter(|p| p.taken_with(options))
-        .map(|p| p.roots.clone());
-    let npm_roots = match prior_roots {
-        Some(roots) => Some(roots),
-        None if partitioned
-            .get(&Ecosystem::Npm)
-            .is_some_and(|p| !p.is_empty()) =>
-        {
-            NpmCrawler.get_node_modules_paths(options).await.ok()
-        }
-        None => None,
+        .map(|p| p.roots.as_slice());
+    dispatch_find(partitioned, options, silent, merge_qualified, npm_roots).await
+}
+
+/// The install paths that reach each purl, for `scan`'s and `rollback`'s
+/// path targets: [`find_all_packages_for_rollback_reusing`]'s physical
+/// copies, plus each npm package link directly in a `node_modules` root
+/// (scoped ones one level down) that resolves to one of them or to one
+/// of their store peer variants.
+///
+/// The crawler records a plain-name link at its own path
+/// (`packages/a/node_modules/ms`), but never an alias link
+/// (`packages/a/node_modules/lp -> …/.pnpm/left-pad@1.3.0/node_modules/left-pad`):
+/// links are not physical copies, and apply and VEX must see each copy
+/// once (#856). Path scoping asks which paths install the package
+/// instead, and pnpm's isolated linker or npm's `install-strategy=linked`
+/// reach a workspace member's ALIAS dependency only through such a link
+/// (#1266). The member's link can resolve to a peer variant the crawl
+/// skipped once it found the root's copy, so the variants count too.
+/// The result is for path matching only: it can name one physical copy
+/// more than once.
+pub async fn find_package_paths_for_path_scope(
+    partitioned: &HashMap<Ecosystem, Vec<String>>,
+    options: &CrawlerOptions,
+    silent: bool,
+    prior: Option<&NpmCrawlSnapshot>,
+) -> HashMap<String, Vec<PathBuf>> {
+    let has_npm = partitioned
+        .get(&Ecosystem::Npm)
+        .is_some_and(|purls| !purls.is_empty());
+    let npm_roots = match prior.and_then(|p| p.roots_for(options)) {
+        Some(roots) if has_npm => Some(roots.to_vec()),
+        None if has_npm => NpmCrawler.get_node_modules_paths(options).await.ok(),
+        _ => None,
     };
     let mut found = dispatch_find(
         partitioned,
@@ -670,40 +686,43 @@ pub async fn find_all_packages_for_rollback_reusing(
         npm_roots.as_deref(),
     )
     .await;
-    if let Some(roots) = npm_roots {
-        found = tokio::task::spawn_blocking(move || {
-            add_npm_links_to_copies(&mut found, &roots);
-            found
-        })
-        .await
-        .expect("npm link enumeration does not panic");
-    }
-    found
-}
-
-/// Add to each npm purl's `copies` every package link directly in one of
-/// `roots` (scoped ones one level down) that resolves to one of its
-/// copies. The crawler records a plain-name link at its own path
-/// (`packages/a/node_modules/ms`), but never an alias link
-/// (`packages/a/node_modules/lp -> …/.pnpm/left-pad@1.3.0/node_modules/left-pad`):
-/// links are not physical copies, and apply and VEX must see each physical
-/// copy once. Path scoping instead needs every path that installs the
-/// package, so the alias link is added here (#1266).
-fn add_npm_links_to_copies(copies: &mut HashMap<String, Vec<PathBuf>>, roots: &[PathBuf]) {
+    let Some(roots) = npm_roots else {
+        return found;
+    };
     let mut by_target: HashMap<PathBuf, Vec<String>> = HashMap::new();
-    for (purl, paths) in copies.iter() {
-        if !purl.starts_with("pkg:npm/") {
+    for (purl, paths) in &found {
+        if Ecosystem::from_purl(purl) != Some(Ecosystem::Npm) {
             continue;
         }
-        for path in paths {
-            if let Ok(target) = std::fs::canonicalize(path) {
+        for path in with_store_peer_variant_copies(paths.clone()).await {
+            if let Ok(target) = tokio::fs::canonicalize(&path).await {
                 by_target.entry(target).or_default().push(purl.clone());
             }
         }
     }
     if by_target.is_empty() {
-        return;
+        return found;
     }
+    // A failed enumeration only loses the extra links; the copies stand.
+    let links = tokio::task::spawn_blocking(move || npm_links_to(&by_target, &roots))
+        .await
+        .unwrap_or_default();
+    for (purl, link) in links {
+        let paths = found.entry(purl).or_default();
+        if !paths.contains(&link) {
+            paths.push(link);
+        }
+    }
+    found
+}
+
+/// Every package link directly in one of `roots` (scoped ones one level
+/// down) that resolves to a key of `by_target`, paired with each purl
+/// that key belongs to.
+fn npm_links_to(
+    by_target: &HashMap<PathBuf, Vec<String>>,
+    roots: &[PathBuf],
+) -> Vec<(String, PathBuf)> {
     let entries = |dir: &Path| -> Vec<(String, PathBuf, std::fs::FileType)> {
         let Ok(read) = std::fs::read_dir(dir) else {
             return Vec::new();
@@ -716,6 +735,7 @@ fn add_npm_links_to_copies(copies: &mut HashMap<String, Vec<PathBuf>>, roots: &[
             })
             .collect()
     };
+    let mut out = Vec::new();
     for root in roots {
         let mut links = Vec::new();
         for (name, path, file_type) in entries(root) {
@@ -735,13 +755,11 @@ fn add_npm_links_to_copies(copies: &mut HashMap<String, Vec<PathBuf>>, roots: &[
                 continue;
             };
             for purl in by_target.get(&target).into_iter().flatten() {
-                let paths = copies.get_mut(purl).expect("keyed from copies");
-                if !paths.contains(&link) {
-                    paths.push(link.clone());
-                }
+                out.push((purl.clone(), link.clone()));
             }
         }
     }
+    out
 }
 
 /// Qualified-aware PURL resolution for rollback, vendor, repair and
 
@@ -982,14 +982,15 @@ async fn assert_member_alias_link_in_scope(store: &str, lp_entry: &str, lp_dir:
             "scan {pattern} must not select member b's is-number; body: {}",
             bodies[0]
         );
+        if pattern == "packages/a" {
+            assert!(
+                bodies[0].contains("pkg:npm/ms@2.1.2"),
+                "scan packages/a must still select the plain-name link; body: {}",
+                bodies[0]
+            );
+            assert_eq!(v["scannedPackages"], 2, "scan packages/a: {v}");
+        }
     }
-    let (bodies, v) = scoped_agent_scan(root, "packages/a").await;
-    assert!(
-        bodies[0].contains("pkg:npm/ms@2.1.2"),
-        "scan packages/a must still select the plain-name link; body: {}",
-        bodies[0]
-    );
-    assert_eq!(v["scannedPackages"], 2, "scan packages/a: {v}");
 }
 
 /// #1266, pnpm's default isolated linker.
@@ -1007,3 +1008,61 @@ async fn paths_scope_selects_npm_linked_member_alias_link() {
     assert_member_alias_link_in_scope(".store", "left-pad@1.3.0-0a1b2c3d", "left-pad").await;
     assert_member_alias_link_in_scope(".store", "lp@1.3.0-0a1b2c3d", "lp").await;
 }
+
+/// #1266: the root's own `left-pad` link resolves to one pnpm peer
+/// variant, member a's alias `lp` to another. The crawl stops at the
+/// root's copy and never lists member a's variant, yet member a loads it,
+/// so scoping to member a must still select left-pad.
+#[cfg(unix)]
+#[tokio::test]
+async fn paths_scope_selects_member_alias_link_to_a_peer_variant() {
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path();
+    std::fs::write(
+        root.join("package.json"),
+        r#"{ "name": "root", "version": "1.0.0", "private": true, "dependencies": { "left-pad": "1.3.0" } }"#,
+    )
+    .unwrap();
+    std::fs::write(
+        root.join("pnpm-workspace.yaml"),
+        "packages: ['packages/*']\n",
+    )
+    .unwrap();
+    for variant in ["left-pad@1.3.0_react@17.0.2", "left-pad@1.3.0_react@18.2.0"] {
+        write_npm_package_at(
+            root,
+            &format!("node_modules/.pnpm/{variant}"),
+            "left-pad",
+            "1.3.0",
+        );
+    }
+    std::os::unix::fs::symlink(
+        ".pnpm/left-pad@1.3.0_react@17.0.2/node_modules/left-pad",
+        root.join("node_modules/left-pad"),
+    )
+    .unwrap();
+    let member_dir = root.join("packages/a");
+    std::fs::create_dir_all(member_dir.join("node_modules")).unwrap();
+    std::fs::write(
+        member_dir.join("package.json"),
+        r#"{ "name": "a", "version": "1.0.0", "dependencies": { "lp": "npm:left-pad@1.3.0" } }"#,
+    )
+    .unwrap();
+    std::os::unix::fs::symlink(
+        "../../../node_modules/.pnpm/left-pad@1.3.0_react@18.2.0/node_modules/left-pad",
+        member_dir.join("node_modules/lp"),
+    )
+    .unwrap();
+
+    let (bodies, v) = scoped_agent_scan(root, "packages/a").await;
+    assert_eq!(
+        bodies.len(),
+        1,
+        "scan packages/a must query the batch API once; envelope {v}"
+    );
+    assert!(
+        bodies[0].contains("pkg:npm/left-pad@1.3.0"),
+        "scan packages/a must select the peer variant member a's alias loads; body: {}",
+        bodies[0]
+    );
+}