From 05f1b472fc8115c99f82d87e415a8412dbc083da Mon Sep 17 00:00:00 2001
From: Eric Rakestraw <eric@rakestraw.us>
Date: Sun, 1 Nov 2026 21:12:22 +0000
Subject: [PATCH] Use selected module for dependency downloads

---
 docs/internal/gotool.md        | 4 +++-
 docs/roadmap/implementation.md | 3 ++-
 internal/gotool/gotool.go      | 2 +-
 internal/gotool/gotool_test.go | 2 +-
 preparation.go                 | 6 ++++--
 5 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/docs/internal/gotool.md b/docs/internal/gotool.md
index 405dd0a..5bd0280 100644
--- a/docs/internal/gotool.md
+++ b/docs/internal/gotool.md
@@ -33,7 +33,9 @@ coexist. Disk-backed diagnostics could reduce large failure peaks, but add file
 lifecycle and cleanup work and remain a follow-up option.
 
 Dependency preparation uses a separate command environment so proxy, private
-module, checksum, and cache settings remain available. Its completed capture
+module, checksum, cache, and other effective settings remain available. Its
+`go mod download -modfile=` command overrides an alternate module file selected
+through `GOFLAGS`, preserving ordinary module discovery. Its completed capture
 uses the same ownership transfer when formatting a failure.
 
 ## Configuration discovery
diff --git a/docs/roadmap/implementation.md b/docs/roadmap/implementation.md
index 5fd2351..69918ed 100644
--- a/docs/roadmap/implementation.md
+++ b/docs/roadmap/implementation.md
@@ -208,7 +208,8 @@ composition with ordinary build identity and ambient flags.
 
 ## Stage 4: Override alternate module-file selection during downloads
 
-**Status:** pending.
+**Status:** complete. `go test ./internal/gotool` passes offline. Actual module
+graph selection evidence remains deferred to Stage 5.
 
 **Files:** `internal/gotool/gotool.go`, `internal/gotool/gotool_test.go`,
 `preparation.go` GoDoc, and `docs/internal/gotool.md`.
diff --git a/internal/gotool/gotool.go b/internal/gotool/gotool.go
index e4348cb..8d91a91 100644
--- a/internal/gotool/gotool.go
+++ b/internal/gotool/gotool.go
@@ -97,7 +97,7 @@ func New(ctx context.Context, directory string) (*Tool, error) {
 func PrepareBuildDependencies(ctx context.Context, directory string) error {
 	captured := &combinedWriter{}
 	err := process.Run(ctx, process.Invocation{
-		Args: []string{"go", "mod", "download"},
+		Args: []string{"go", "mod", "download", "-modfile="},
 		Dir:  directory,
 		Env: map[string]string{
 			"GOWORK":      "off",
diff --git a/internal/gotool/gotool_test.go b/internal/gotool/gotool_test.go
index 7abf78c..69a1fcd 100644
--- a/internal/gotool/gotool_test.go
+++ b/internal/gotool/gotool_test.go
@@ -159,7 +159,7 @@ func TestPrepareBuildDependenciesPreservesPreparationEnvironment(t *testing.T) {
 	if err := json.Unmarshal(contents, &record); err != nil {
 		t.Fatal(err)
 	}
-	if strings.Join(record.Arguments, " ") != "mod download" || record.Directory != repository {
+	if strings.Join(record.Arguments, " ") != "mod download -modfile=" || record.Directory != repository {
 		t.Fatalf("Go invocation = %#v", record)
 	}
 	if record.Workspace != "off" || record.Toolchain != "local" {
diff --git a/preparation.go b/preparation.go
index 9802004..48fbc31 100644
--- a/preparation.go
+++ b/preparation.go
@@ -50,8 +50,10 @@ type DependencyPreparationRequest struct {
 
 // PrepareBuildDependencies runs `go mod download` in the selected module with
 // workspace discovery disabled and the locally available compatible Go
-// toolchain selected. It may access module networks and updates the Go module
-// cache using the caller's Go proxy, private-module, credential, and cache
+// toolchain selected. Alternate module files selected by GOFLAGS are overridden
+// for this download; other effective Go settings remain available. It may
+// access module networks and updates the Go module cache using the caller's Go
+// proxy, private-module, credential, and cache
 // settings. If required checksums are missing, the Go command may update
 // go.sum. Cancellation and Go command failures are returned to the caller.
 func PrepareBuildDependencies(ctx context.Context, request DependencyPreparationRequest) error {