nx_resmon_gate.nx

nx_resmon_gate.nx -- referee for nx_resmon's two policy predicates (debt seq1005). It gates the SAME functions the organ runs (nx_resmon_lib.nx), not a reimplementation, and it needs no /proc and no fixtures on disk -- every input is synthetic, so the result is deterministic. T2 AND T4 ARE THE TEETH THAT MATTER: T2 is the NON-VACUITY control: with thresholds set unreachably high, measurements that trip RED under real thresholds must return GREEN. If T2 ever fails, T1 is passing for free. T4 pins the EXACT false positive this instrument made on its first live run: a process with a huge RESERVED VmData but almost nothing committed reported a worst case of 40.6 GiB on a 36.9 GB box. A leaker is judged on rss+swap, never on reserved address space. That regression cannot return silently now. license_tier: ORIGINAL expect_exit: 0