fix(apply): patch every on-disk copy of a duplicated package (multi-copy silent partial P0) - #216

diff --git a/crates/socket-patch-cli/src/commands/apply.rs b/crates/socket-patch-cli/src/commands/apply.rs
--- a/crates/socket-patch-cli/src/commands/apply.rs
+++ b/crates/socket-patch-cli/src/commands/apply.rs
@@ -68,7 +68,7 @@
 async fn ensure_blobs_for_mismatches(
     args: &ApplyArgs,
     manifest: &PatchManifest,
-    all_packages: &HashMap<String, PathBuf>,
+    all_packages: &HashMap<String, Vec<PathBuf>>,
     vendored_purls: &HashSet<String>,
     staged: &mut StagedSources,
 ) {
@@ -142,13 +142,13 @@
 /// queue fetches either.
 async fn mismatch_blob_gaps(
     manifest: &PatchManifest,
-    all_packages: &HashMap<String, PathBuf>,
+    all_packages: &HashMap<String, Vec<PathBuf>>,
     vendored_purls: &HashSet<String>,
     blobs_path: &Path,
     force: bool,
 ) -> HashSet<String> {
     let mut needed: HashSet<String> = HashSet::new();
-    for (purl, pkg_path) in all_packages {
+    for (purl, pkg_paths) in all_packages {
         let variant_eco = Ecosystem::from_purl(purl).is_some_and(|e| e.supports_release_variants());
         let stripped = strip_purl_qualifiers(purl);
         let records: Vec<(&String, &PatchRecord)> = manifest
@@ -164,36 +164,41 @@
         {
             continue;
         }
-        let gated = variant_eco
-            && !force
-            && (records.len() > 1
-                || records
-                    .first()
-                    .is_some_and(|(key, _)| key.as_str() != stripped));
-        for (_, record) in records {
-            if gated {
-                if let Some((file_name, file_info)) = representative_file(&record.files) {
-                    let status = verify_file_patch(pkg_path, file_name, file_info)
-                        .await
-                        .status;
-                    if !variant_matches_installed(Some(&status)) {
+        // Check every copy: each copy's on-disk state is independent, so a
+        // nested copy can have a HashMismatch even when the root copy is
+        // Ready/AlreadyPatched. Need-blob is per copy, not per hash.
+        for pkg_path in pkg_paths {
+            let gated = variant_eco
+                && !force
+                && (records.len() > 1
+                    || records
+                        .first()
+                        .is_some_and(|(key, _)| key.as_str() != stripped));
+            for (_, record) in &records {
+                if gated {
+                    if let Some((file_name, file_info)) = representative_file(&record.files) {
+                        let status = verify_file_patch(pkg_path, file_name, file_info)
+                            .await
+                            .status;
+                        if !variant_matches_installed(Some(&status)) {
+                            continue;
+                        }
+                    }
+                }
+                for (file_name, info) in &record.files {
+                    if info.before_hash.is_empty() {
                         continue;
                     }
+                    let verify = verify_file_patch(pkg_path, file_name, info).await;
+                    if verify.status == VerifyStatus::HashMismatch
+                        && tokio::fs::metadata(blobs_path.join(&info.after_hash))
+                            .await
+                            .is_err()
+                    {
+                        needed.insert(info.after_hash.clone());
+                    }
                 }
             }
-            for (file_name, info) in &record.files {
-                if info.before_hash.is_empty() {
-                    continue;
-                }
-                let verify = verify_file_patch(pkg_path, file_name, info).await;
-                if verify.status == VerifyStatus::HashMismatch
-                    && tokio::fs::metadata(blobs_path.join(&info.after_hash))
-                        .await
-                        .is_err()
-                {
-                    needed.insert(info.after_hash.clone());
-                }
-            }
         }
     }
     needed
@@ -1083,14 +1088,6 @@
     )
     .await;
 
-    // One representative path per PURL, for the mismatch-blob gate and the
-    // pre-attempt checks that only need "is it installed / a sample copy"
-    // (the gate's fetch decision is per-hash, identical across copies).
-    let first_paths: HashMap<String, PathBuf> = all_packages
-        .iter()
-        .filter_map(|(purl, paths)| paths.first().map(|p| (purl.clone(), p.clone())))
-        .collect();
-
     if all_packages.is_empty() && partitioned.is_empty() {
         // Nothing in scope: the manifest lists no patches (or every patch was
         // filtered out by `--ecosystems`). There is genuinely no work to do,
@@ -1128,7 +1125,7 @@
     }
 
     // Apply patches
-    ensure_blobs_for_mismatches(args, &manifest, &first_paths, &vendored_purls, &mut staged).await;
+    ensure_blobs_for_mismatches(args, &manifest, &all_packages, &vendored_purls, &mut staged).await;
     let sources = staged.as_patch_sources();
     let policy = mismatch_policy(args.force, args.common.strict);
     let mut has_errors = false;
@@ -1751,7 +1748,7 @@
             files,
         );
         let mut all_packages = HashMap::new();
-        all_packages.insert("pkg:pypi/foo@1.0.0".to_string(), pkg.clone());
+        all_packages.insert("pkg:pypi/foo@1.0.0".to_string(), vec![pkg.clone()]);
 
         let needed =
             mismatch_blob_gaps(&manifest, &all_packages, &HashSet::new(), &blobs, false).await;
@@ -1821,7 +1818,7 @@
             },
         );
         let mut all_packages = HashMap::new();
-        all_packages.insert("pkg:pypi/foo@1.0.0".to_string(), pkg.clone());
+        all_packages.insert("pkg:pypi/foo@1.0.0".to_string(), vec![pkg.clone()]);
 
         let needed =
             mismatch_blob_gaps(&manifest, &all_packages, &HashSet::new(), &blobs, false).await;
@@ -1867,7 +1864,7 @@
         );
         let manifest = manifest_with_record("pkg:gem/foo@1.0.0", files);
         let mut all_packages = HashMap::new();
-        all_packages.insert("pkg:gem/foo@1.0.0".to_string(), pkg.clone());
+        all_packages.insert("pkg:gem/foo@1.0.0".to_string(), vec![pkg.clone()]);
 
         let needed =
             mismatch_blob_gaps(&manifest, &all_packages, &HashSet::new(), &blobs, false).await;
@@ -1907,7 +1904,7 @@
         );
         let manifest = manifest_with_record("pkg:gem/foo@1.0.0?platform=x86_64-linux", files);
         let mut all_packages = HashMap::new();
-        all_packages.insert("pkg:gem/foo@1.0.0".to_string(), pkg.clone());
+        all_packages.insert("pkg:gem/foo@1.0.0".to_string(), vec![pkg.clone()]);
 
         let needed =
             mismatch_blob_gaps(&manifest, &all_packages, &HashSet::new(), &blobs, false).await;
@@ -1954,7 +1951,7 @@
         );
         let manifest = manifest_with_record("pkg:gem/foo@1.0.0", files);
         let mut all_packages = HashMap::new();
-        all_packages.insert("pkg:gem/foo@1.0.0".to_string(), pkg.clone());
+        all_packages.insert("pkg:gem/foo@1.0.0".to_string(), vec![pkg.clone()]);
 
         let needed =
             mismatch_blob_gaps(&manifest, &all_packages, &HashSet::new(), &blobs, false).await;
@@ -2002,7 +1999,7 @@
         );
         let manifest = manifest_with_record("pkg:npm/foo@1.0.0", files);
         let mut all_packages = HashMap::new();
-        all_packages.insert("pkg:npm/foo@1.0.0".to_string(), pkg.clone());
+        all_packages.insert("pkg:npm/foo@1.0.0".to_string(), vec![pkg.clone()]);
 
         let needed =
             mismatch_blob_gaps(&manifest, &all_packages, &HashSet::new(), &blobs, false).await;

diff --git a/crates/socket-patch-cli/src/commands/rollback.rs b/crates/socket-patch-cli/src/commands/rollback.rs
--- a/crates/socket-patch-cli/src/commands/rollback.rs
+++ b/crates/socket-patch-cli/src/commands/rollback.rs
@@ -742,9 +742,9 @@
     )
     .await;
 
-    // One representative path per PURL for the "is it installed" checks and
-    // the before-blob gate (the gate's fetch decision is per-hash, identical
-    // across copies). The per-copy restore uses `all_packages_multi`.
+    // One representative path per PURL for the "is it installed" checks.
+    // The before-blob gate now checks every copy (need-blob is per on-disk
+    // state, not per hash), so it uses `rollback_targets` directly.
     let all_packages: HashMap<String, PathBuf> = all_packages_multi
         .iter()
         .filter_map(|(purl, paths)| paths.first().map(|p| (purl.clone(), p.clone())))
@@ -931,22 +931,33 @@
     // it must not abort the run or trigger a download; the rollback loop's
     // own per-file verification still reports those states honestly
     // (already_original / not_found / hash_mismatch).
+    //
+    // Check every copy: each copy's on-disk state is independent, so a
+    // nested copy can be patched while the root copy is already original.
+    // Need-blob is per copy, not per hash — the gate must probe every
+    // physical copy that will be attempted, or a later copy can be missing
+    // its blob even when an online run fetches for the first copy.
     let absent_blobs = get_missing_before_blobs(&gate_manifest, &blobs_path).await;
     let mut missing_blobs: HashSet<String> = HashSet::new();
     let mut blob_gated_purls: HashSet<String> = HashSet::new();
     if !absent_blobs.is_empty() {
         for (purl, patch) in &gate_manifest.patches {
-            let pkg_path = all_packages
-                .get(purl)
-                .expect("gate manifest holds only attempted targets, which the crawler discovered");
-            for (file, info) in &patch.files {
-                if info.before_hash.is_empty() || !absent_blobs.contains(&info.before_hash) {
+            // Probe every copy of this PURL that will be attempted. The
+            // rollback loop below restores every copy in `rollback_targets`,
+            // so the gate must verify all of them too.
+            for (target_purl, pkg_path) in &rollback_targets {
+                if *target_purl != purl {
                     continue;
                 }
-                let v = verify_file_rollback(pkg_path, file, info, &blobs_path).await;
-                if v.status == VerifyRollbackStatus::MissingBlob {
-                    missing_blobs.insert(info.before_hash.clone());
-                    blob_gated_purls.insert(purl.clone());
+                for (file, info) in &patch.files {
+                    if info.before_hash.is_empty() || !absent_blobs.contains(&info.before_hash) {
+                        continue;
+                    }
+                    let v = verify_file_rollback(pkg_path, file, info, &blobs_path).await;
+                    if v.status == VerifyRollbackStatus::MissingBlob {
+                        missing_blobs.insert(info.before_hash.clone());
+                        blob_gated_purls.insert(purl.clone());
+                    }
                 }
             }
         }