servicepack v1.2.18 — the update rewrites only what it delivered No Go code change. The update rewrites servicepack's import path to yours after syncing. That rewrite was a `find` over the whole working tree, and find does not honour .gitignore -- so it edited *.go and *.mod inside scratch dirs and nested clones, invisibly, because the damage was all ignored. One project saw 62,026 files visited instead of ~50, and an unrelated servicepack checkout under the repo had its imports rewritten. It is now scoped to rsync's own transfer manifest: the exact set the sync delivered, after every exclude and .servicepackupdateignore entry. The companion *.mod walk is gone -- go.mod is handled directly, by the upgrade-only dependency merge, and by `make dep`. A missing manifest now aborts rather than silently skipping, and a post-rewrite scan warns if anything the repo actually owns still references the framework path. Both scripts run from the freshly downloaded framework, so this lands on the very next `make servicepack-update` -- no intermediate release needed.