A mesh package the Go seat lacks is fetched from the forge's git, not stopped by an unreachable public proxy (issue 1966)

GOPROXY joined the Go seat, the public proxy and direct with commas, so go went on only after a 404 or 410: a contracts
package the seat does not hold, and a public proxy a node cannot reach, ended the fetch before direct. It joins them
with | now, so any failure goes on to the next. go words a proxy it cannot reach as "invalid version", which the pin
path read as an unknown revision and labelled "on no pull request head"; a network failure is never that now
(network is unreachable and no route to host are network failures).

Claude-Session: https://claude.ai/code/session_01JG73KEq4zoDfM9WtYpcQgZ

modules/mesh-build-go/cmd/mesh-build-go/fetch.go

@@ -334,7 +334,10 @@ func (m *Module) goEnv() []string {
 		// The Go seat first, the public proxy second, the forge's git last (CAT-BG3, E11: direct goes in the first
 		// change after mesh-sdk's and mesh-contracts' first numbered versions are in the Go seat); no GOPRIVATE, and
 		// the checksum database off for the forge's paths, which go.sum and the builder's h1: digest guard instead.
-		env = append(env, "GOPROXY="+proxy+","+PublicGoProxy+",direct", "GONOSUMDB="+ForgeGoPaths, "GOPRIVATE=")
+		// The separator is "|", not ",": with "," go goes on only after a 404 or 410, so a seat that does not hold a
+		// package (a contracts package not published yet) and a public proxy the node cannot reach stopped the fetch
+		// before "direct" (issue 1966); with "|" any failure goes on to the next, and direct reaches the forge's git.
+		env = append(env, "GOPROXY="+proxy+"|"+PublicGoProxy+"|direct", "GONOSUMDB="+ForgeGoPaths, "GOPRIVATE=")
 	} else {
 		env = append(env, "GOPRIVATE="+ForgeGoPaths)
 	}

modules/mesh-build-go/cmd/mesh-build-go/fetch_test.go

@@ -153,7 +153,7 @@ func TestFetchAsksGitForTheSshRemoteAndDownloadsEachModule(t *testing.T) {
 	}
 	m.GoSeatFile = seat
 	env := strings.Join(m.goEnv(), " ")
-	for _, want := range []string{"GOPROXY=http://forge.mesh:3000/api/packages/novox/go,https://proxy.golang.org,direct", "GONOSUMDB=git.novox.be", "GOPRIVATE= "} {
+	for _, want := range []string{"GOPROXY=http://forge.mesh:3000/api/packages/novox/go|https://proxy.golang.org|direct", "GONOSUMDB=git.novox.be", "GOPRIVATE= "} {
 		if !strings.Contains(env+" ", want) {
 			t.Errorf("with the Go seat bound the environment lacks %q: %s", want, env)
 		}

modules/mesh-build-go/cmd/mesh-build-go/versions.go

@@ -108,7 +108,7 @@ const (
 // reset connection), not of a version or a checksum that is wrong.
 func networkFailure(s string) bool {
 	s = strings.ToLower(s)
-	for _, w := range []string{"i/o timeout", "no such host", "temporary failure in name resolution", "connection refused", "connection reset", "tls handshake timeout", "lookup "} {
+	for _, w := range []string{"i/o timeout", "no such host", "temporary failure in name resolution", "connection refused", "connection reset", "tls handshake timeout", "network is unreachable", "no route to host", "lookup "} {
 		if strings.Contains(s, w) {
 			return true
 		}
@@ -348,5 +348,10 @@ func comparePre(a, b string) int {
 // "invalid version" it wraps it in): it labels a commit the forge holds on no pull request head (placePin), and decides
 // nothing; every other failure is the network's or the forge's.
 func unknownRevision(failure string) bool {
+	// go words any failure of a proxy as "invalid version: ..." (issue 1966): a failure of the network is not go knowing
+	// no such revision, whatever else the text says.
+	if networkFailure(failure) {
+		return false
+	}
 	return strings.Contains(failure, "unknown revision") || strings.Contains(failure, "invalid version")
 }

modules/mesh-build-go/cmd/mesh-build-go/versions_test.go

@@ -49,6 +49,10 @@ func TestAnAskedVersionIsWrittenIntoTheModfileWhateverGoModNames(t *testing.T) {
 			built:  commitSHA, said: "placed from the pull request's head"},
 		{name: "a lookup that times out is no pin", asked: offHead, failing: true, failsWith: "i/o timeout",
 			answer: `{"Path":"` + sdk + `","Error":"git.novox.be/novox/mesh-sdk/go@` + offHead + `: dial tcp: lookup git.novox.be on 10.10.0.3:53: read udp 10.10.0.3:42292->10.10.0.3:53: i/o timeout"}`},
+		// Issue 1966: go words a public proxy it cannot reach as "invalid version"; that is the network's failure, not an
+		// unknown revision, so a trunk commit on no pull request head is not labelled "on no pull request head".
+		{name: "an unreachable proxy worded invalid version is no pin", asked: offHead, failing: true, failsWith: "network is unreachable",
+			answer: `{"Path":"` + sdk + `","Error":"invalid version: Get \"https://proxy.golang.org/` + sdk + `/@v/` + offHead + `.info\": dial tcp [2a00:1450::1]:443: connect: network is unreachable"}`},
 		// The forge's own listing failing is a failure that may be retaken too, with its own cause (review 3).
 		{name: "a forge that cannot be listed is retaken", asked: commitSHA, failing: true, forgeDown: true,
 			failsWith: "unable to access the forge",