Module store 

Sidecar DuckDB store for external scanner findings.

The store lives at <cache_root>/codelore/<repo_hash_8>/external-findings.duckdb-ext alongside the main .duckdb cache entries. The .duckdb-ext extension is intentional: the cache pruner in cache.rs matches files whose .extension() equals "duckdb" exactly, so .duckdb-ext is never touched by automatic eviction.

Each ExternalStore owns its own duckdb::Connection. The connection is !Send + !Sync — same constraint as FactsDb. Callers must keep the store on the thread that created it.

Read-only readers, single read-write writer

DuckDB is single-writer: a read-write connection takes an exclusive file lock, so a second opener (a concurrent check, MCP call, or analyze on the same repo) can fail to open while the first holds it. The read paths (ExternalStore::open_existing, ExternalStore::open_nonempty) therefore open with AccessMode::ReadOnly, which takes a shared lock and lets multiple readers coexist. ExternalStore::open_or_create is the sole read-write opener and the sole writer/healer: it creates the parent directory and the table schema. Readers never run DDL — a sidecar missing the external_findings table (truncated or corrupt) cannot be healed under a read-only lock, so ExternalStore::open_nonempty treats it as unusable and maps it to None (absent, empty, and unreadable are one “nothing to read” state for a reader).

Replace semantics

ExternalStore::replace_engine removes all existing rows for the given engine before inserting the new batch. Re-ingesting the same SARIF file produces an identical row count — findings are idempotent per engine.

Absolute paths

CodeQL and similar tools emit file:// URIs with absolute host paths (e.g. file:///home/runner/work/repo/src/Foo.java). After scheme stripping the path column stores the absolute form (/home/runner/work/repo/src/Foo.java). The overlap join on repo-relative hotspot paths will simply not match these rows, which is the honest outcome — no silent rewriting that could produce false matches.

Structs

ExternalStore

Sidecar DuckDB store owning its own !Send + !Sync Connection.

PathFindings

Per-path aggregation produced by ExternalStore::findings_by_path.