@@ -523,6 +523,26 @@ async fn reconcile_local_go(common: &GlobalArgs, target_manifest_purls: &HashSet
     }
 }
 
+/// The consumer-sync audit ([`go_consumer_sync::audit`]) of the project at
+/// `root` as run warnings: a committed `vendor/modules.txt` or a go.mod
+/// requirement set that no longer matches the socket `replace` directives,
+/// each naming the go command that fixes it.
+///
+/// [`go_consumer_sync::audit`]: socket_patch_core::vendor::go_consumer_sync::audit
+pub(crate) async fn go_consumer_sync_warnings(
+    root: &Path,
+    pristine_go_mods: &HashMap<String, PathBuf>,
+) -> Vec<RunWarning> {
+    socket_patch_core::vendor::go_consumer_sync::audit(root, pristine_go_mods)
+        .await
+        .into_iter()
+        .map(|issue| RunWarning {
+            code: issue.code().to_string(),
+            detail: issue.to_string(),
+        })
+        .collect()
+}
+
 /// Read-only verification that the manifest's patches are in place, for CI
 /// / GitHub-App auditing. Lock-free, fetch-free, offline-safe, and it never
 /// writes. Exits 0 when in sync, 1 on drift.
@@ -608,6 +628,21 @@ async fn run_check(args: &ApplyArgs, manifest_path: &Path) -> i32 {
                     drifts.push((id, "go_redirect_drift".to_string(), d.to_string()));
                 }
             }
+            // The redirects can be intact while the project no longer
+            // builds: a committed vendor/modules.txt or the go.mod
+            // requirements out of step with them (#343, #618).
+            for issue in socket_patch_core::vendor::go_consumer_sync::audit(
+                &args.common.cwd,
+                &HashMap::new(),
+            )
+            .await
+            {
+                drifts.push((
+                    issue.module().to_string(),
+                    issue.code().to_string(),
+                    issue.to_string(),
+                ));
+            }
         }
     }
 
@@ -676,7 +711,14 @@ async fn run_check(args: &ApplyArgs, manifest_path: &Path) -> i32 {
             for (_, _, detail) in &drifts {
                 eprintln!("  {detail}");
             }
-            eprintln!("Run `socket-patch apply` to regenerate them.");
+            // A go consumer-sync drift names its own go command; apply
+            // cannot regenerate vendor/modules.txt or go.sum.
+            if drifts.iter().any(|(_, code, _)| {
+                code != socket_patch_core::vendor::go_consumer_sync::VENDOR_MODULES_TXT_CODE
+                    && code != socket_patch_core::vendor::go_consumer_sync::REQUIREMENTS_CODE
+            }) {
+                eprintln!("Run `socket-patch apply` to regenerate them.");
+            }
         }
         1
     }
@@ -2228,6 +2270,7 @@ async fn apply_patches_inner(
         });
     }
     let mut fallback_skips: Vec<FallbackHomeSkip> = Vec::new();
+    let mut go_pristine_mods: HashMap<String, PathBuf> = HashMap::new();
 
     // Multi-copy aware: npm nests genuine duplicates of one `name@version`
     // (nested dupes, diamonds, `file:` dups), so the resolver returns EVERY
@@ -2650,7 +2693,16 @@ async fn apply_patches_inner(
                     match try_local_go_apply(purl, pkg_path, patch, &sources, &args.common, policy)
                         .await
                     {
-                        Some(r) => r,
+                        Some(r) => {
+                            // The unpatched go.mod, so the consumer-sync
+                            // audit below can tell requirements the patch
+                            // added from ones upstream always had (#618).
+                            if let Some((module, _)) = parse_golang_purl(purl) {
+                                go_pristine_mods
+                                    .insert(module.into_owned(), pkg_path.join("go.mod"));
+                            }
+                            r
+                        }
                         None => {
                             apply_package_patch(
                                 purl,
@@ -2727,6 +2779,13 @@ async fn apply_patches_inner(
 
     // The human summary is printed by `run`, after the per-package list.
 
+    // A redirect leaves the project building only if its committed
+    // `vendor/modules.txt` and its go.mod requirements still agree with the
+    // `replace` directives (#343, #618): name the regeneration step.
+    if !args.common.dry_run && eco_in_local_scope(&args.common, Ecosystem::Golang) {
+        run_warnings.extend(go_consumer_sync_warnings(&args.common.cwd, &go_pristine_mods).await);
+    }
+
     // Note: `apply` deliberately does NOT garbage-collect unused blobs in
     // `.socket/`. GC is the responsibility of `socket-patch repair` /
     // `gc` / `scan --prune`. Keeping apply read-only against `.socket/`
 
@@ -2660,6 +2660,19 @@ pub(crate) async fn rollback_patches_inner(
         results.push(result);
     }
 
+    // Dropping a `replace` leaves a committed vendor/modules.txt recording
+    // it, which breaks every vendored build until it is regenerated (#343).
+    if !common.dry_run
+        && results
+            .iter()
+            .any(|r| r.success && is_local_go(&r.package_key, common))
+    {
+        let none = std::collections::HashMap::new();
+        for w in crate::commands::apply::go_consumer_sync_warnings(&common.cwd, &none).await {
+            warnings.push((w.code, w.detail));
+        }
+    }
+
     superseded_left.sort();
     superseded_left.dedup();
     Ok(RollbackOutcome {
 
@@ -1575,6 +1575,26 @@ pub(crate) async fn run_redirect_selected(
     engine_warnings.extend(done.rush_warnings.iter().cloned());
     engine_warnings.extend(done.pnpm_warnings.iter().cloned());
     engine_warnings.extend(done.npm_warnings.iter().cloned());
+    // A hosted Go `replace` breaks a committed vendor/ directory until
+    // `go mod vendor` re-records it in vendor/modules.txt (#343).
+    if !common.dry_run
+        && done
+            .rewritten
+            .iter()
+            .any(|f| f == "go.mod" || f.ends_with("/go.mod"))
+    {
+        for w in crate::commands::apply::go_consumer_sync_warnings(
+            &common.cwd,
+            &std::collections::HashMap::new(),
+        )
+        .await
+        {
+            engine_warnings.push(socket_patch_core::patch::redirect::RewriteWarning {
+                code: w.code,
+                detail: w.detail,
+            });
+        }
+    }
     let mut warnings: Vec<serde_json::Value> =
         socket_patch_core::hosted::render::rewrite_warnings_json(&engine_warnings);
     warnings.extend(gem_stale.warnings.iter().cloned());
 
@@ -1236,6 +1236,7 @@ async fn run_check(args: &VendorArgs) -> i32 {
     } else {
         None
     };
+    let go_sync_issues = tokio::sync::OnceCell::new();
     for (key, entry) in entries {
         let record = entry.record.as_ref().or_else(|| manifest.patches.get(key));
         let mut failure = match record {
@@ -1268,6 +1269,26 @@ async fn run_check(args: &VendorArgs) -> i32 {
                 failure = Some(unwired_check_failure(discovery, root, key, entry).await);
             }
         }
+        // The committed copy and its `replace` can be intact while the
+        // project no longer builds: vendor/modules.txt or the go.mod
+        // requirements out of step with the `replace` (#343, #618).
+        if failure.is_none() && entry.ecosystem == "golang" {
+            if let Some((module, _)) = socket_patch_core::utils::purl::parse_golang_purl(key) {
+                let issues: Vec<String> = go_sync_issues
+                    .get_or_init(|| async {
+                        socket_patch_core::vendor::go_consumer_sync::audit(root, &HashMap::new())
+                            .await
+                    })
+                    .await
+                    .iter()
+                    .filter(|issue| issue.module() == module)
+                    .map(ToString::to_string)
+                    .collect();
+                if !issues.is_empty() {
+                    failure = Some(issues.join("; "));
+                }
+            }
+        }
         if vendor::jvm::apply::upstream_unverified(entry) {
             env.warnings.push(RunWarning {code: "vendor_jvm_upstream_unverified".into(), detail: format!("{key}: upstream metadata was accepted offline; run vendor online to verify registry checksums")});
         }
@@ -3778,6 +3799,19 @@ pub(crate) async fn vendor_records_reusing(
         }
     }
 
+    // A vendored Go module builds only if the committed vendor/modules.txt
+    // and the go.mod requirements agree with its `replace` (#343, #618).
+    if !common.dry_run && records.keys().any(|p| p.starts_with("pkg:golang/")) {
+        for w in
+            crate::commands::apply::go_consumer_sync_warnings(&common.cwd, &HashMap::new()).await
+        {
+            if !common.json && !common.silent {
+                eprintln!("Warning: {}", w.detail);
+            }
+            env.warnings.push(w);
+        }
+    }
+
     // A rolled-back eject's summary would describe a vendoring that was
     // undone: the eject prints it itself once it knows the outcome (#1005).
     match eject {