Module warm 

Warm per-file state + watcher (spec §8.1): verdicts memoized by (path, content-hash), invalidated by keyed path events, cleared wholesale on manifest change. The memo NEVER re-decides — a hit returns the stored envelope, a miss runs the same check_write the cold path runs, so warm and cold are identical by construction.

Structs

WarmState

Memoized check state shared between the accept loop and the watcher.

WatchGuard

Keeps the filesystem watcher alive; dropping it stops watching.