Function select_installed_variants 

pub async fn select_installed_variants(
    pkg_path: &Path,
    variants: &[(&str, &HashMap<String, PatchFileInfo>)],
) -> Vec<usize>

Select the single variant whose installed bytes match the on-disk distribution — i.e. the “minimally required” release for this environment.

A package@version may resolve to several patch variants (PyPI ?artifact_id=... releases, one per wheel/sdist). Only one distribution is ever installed in a given environment, so only one variant can apply. This mirrors the first-file hash check the apply pipeline uses: a variant matches when its first patched file is not in a VerifyStatus::HashMismatch state against the on-disk package. A variant with no files (nothing to verify) is treated as a match.

variants maps a variant key (typically a qualified PURL) to that variant’s patched files. Returns the indices of every variant whose first patched file is in a VerifyStatus::Ready or VerifyStatus::AlreadyPatched state — i.e. its beforeHash (or afterHash, if already applied) matches the installed bytes.

A VerifyStatus::NotFound (a missing pre-existing file) or VerifyStatus::HashMismatch does not count as a match: those signal the variant describes a distribution that is not present on disk. A variant with no files (nothing to verify) is treated as a match.

Returning all matches (not just the first) is what lets ecosystems whose variants coexist on disk work — e.g. Maven, where several classifier jars (foo-1.0.jar, foo-1.0-linux-x86_64.jar) live in one version directory and each maps to its own file. For PyPI and RubyGems exactly one distribution is installed per environment, so this naturally yields ≤1 index and their behavior is unchanged. The narrow download filter (scan/get) and the rollback dedupe share this helper so release selection stays consistent with apply.