Use selected module for dependency downloads

docs/internal/gotool.md

@@ -33,7 +33,9 @@ coexist. Disk-backed diagnostics could reduce large failure peaks, but add file
 lifecycle and cleanup work and remain a follow-up option.
 
 Dependency preparation uses a separate command environment so proxy, private
-module, checksum, and cache settings remain available. Its completed capture
+module, checksum, cache, and other effective settings remain available. Its
+`go mod download -modfile=` command overrides an alternate module file selected
+through `GOFLAGS`, preserving ordinary module discovery. Its completed capture
 uses the same ownership transfer when formatting a failure.
 
 ## Configuration discovery

docs/roadmap/implementation.md

@@ -208,7 +208,8 @@ composition with ordinary build identity and ambient flags.
 
 ## Stage 4: Override alternate module-file selection during downloads
 
-**Status:** pending.
+**Status:** complete. `go test ./internal/gotool` passes offline. Actual module
+graph selection evidence remains deferred to Stage 5.
 
 **Files:** `internal/gotool/gotool.go`, `internal/gotool/gotool_test.go`,
 `preparation.go` GoDoc, and `docs/internal/gotool.md`.

internal/gotool/gotool.go

@@ -97,7 +97,7 @@ func New(ctx context.Context, directory string) (*Tool, error) {
 func PrepareBuildDependencies(ctx context.Context, directory string) error {
 	captured := &combinedWriter{}
 	err := process.Run(ctx, process.Invocation{
-		Args: []string{"go", "mod", "download"},
+		Args: []string{"go", "mod", "download", "-modfile="},
 		Dir:  directory,
 		Env: map[string]string{
 			"GOWORK":      "off",

internal/gotool/gotool_test.go

@@ -159,7 +159,7 @@ func TestPrepareBuildDependenciesPreservesPreparationEnvironment(t *testing.T) {
 	if err := json.Unmarshal(contents, &record); err != nil {
 		t.Fatal(err)
 	}
-	if strings.Join(record.Arguments, " ") != "mod download" || record.Directory != repository {
+	if strings.Join(record.Arguments, " ") != "mod download -modfile=" || record.Directory != repository {
 		t.Fatalf("Go invocation = %#v", record)
 	}
 	if record.Workspace != "off" || record.Toolchain != "local" {

preparation.go

@@ -50,8 +50,10 @@ type DependencyPreparationRequest struct {
 
 // PrepareBuildDependencies runs `go mod download` in the selected module with
 // workspace discovery disabled and the locally available compatible Go
-// toolchain selected. It may access module networks and updates the Go module
-// cache using the caller's Go proxy, private-module, credential, and cache
+// toolchain selected. Alternate module files selected by GOFLAGS are overridden
+// for this download; other effective Go settings remain available. It may
+// access module networks and updates the Go module cache using the caller's Go
+// proxy, private-module, credential, and cache
 // settings. If required checksums are missing, the Go command may update
 // go.sum. Cancellation and Go command failures are returned to the caller.
 func PrepareBuildDependencies(ctx context.Context, request DependencyPreparationRequest) error {