Maybe my answer doesn’t cover all your questions, but here’s what I’ve found.

The go list command shows which packages will be built( build list). When you run go list -m all, it shows the modules really loaded during the execution —check the official reference for details on how it works.

Finally, go download fetches every dependency declared in your go.mod and it applies to all dependencies of the main module; see the Go documentation for more information.