Function scoped_targets 

pub fn scoped_targets<PT: ProtocolTypes, R: Rand>(
    trace: &Trace<PT>,
    to_mutate_path: &TracePath,
    representative: &Term<PT>,
    config: &MutationConfig,
    rand: &mut R,
) -> Vec<TracePath> 

Draw a MutationScope and return all the occurrences to replace, see apply_scoped_mutation. The search is unbounded (finds every structurally-equal occurrence); runaway is prevented at application time by the result-size caps in apply_to_targets, not by cutting the search short.

Exposed separately from apply_to_targets so a caller can inspect how many occurrences would be replaced before committing: ReplaceReuseMutator needs it to bound the payloads it adds.