[adurham]

Problem

On M4-class machines the thermal safety floor makes manual fan control unusable (reproduced on a MacBook Pro 14" M4 Max, Mac16,6, macOS 27): hotspot-class keys legitimately read 96-113°C under sustained load while macOS itself stays nominal (fans near minimum, thermal pressure Nominal, no thermal or performance warnings ever recorded in pmset). The floor compares the peak over ALL TC/Tp/TG/Tg keys against a single 95°C threshold whenever a below-max hold is active, so every manual hold is overridden to max within seconds and re-armed forever — commanded 2600 → target reads 7826 until auto.

Fix

SafetyGovernor replaces the single-threshold peak check, shared by the daemon backstop and the app's client monitor:

• Primary trip: macOS thermal pressure — Serious/Critical immediate, Fair sustained 30s. Apple's model already accounts for hotspot readings.
• Per-class backstops with seconds-based persistence (callers pass measured elapsed time, so a cadence change can't rescale the windows): hotspot class (TC/Tp/Tg/TG minus the M4 Max: TG0B/TG0H/TG0V are battery sensors, not GPU #63 misnamed battery keys) 118°C/10s judged by the second-highest reading — a single glitchy key can neither trip nor block a clear; structure (TS0P) 95°C/30s; battery (TB0T) 50°C/60s. These are deliberately conservative backstops for older generations where hardware throttling arrives first.
• Readings outside 1-130°C are sanitized before classification; a fully-blind hold (no hotspot reading) trips after 5s; pressure is checked before sensor state so a blind hold cannot wait on the sweep.
• Trip behavior unchanged from main: the hold is pinned to max and latched until pressure is NOMINAL and every class is 10°C below its threshold for 30s. After 3 trips within 10 minutes the restore cycle stops and the fans are left with Apple (stayAuto); a deliberate re-apply starts fresh.
• #63: TG0B/TG0H/TG0V excluded from the hotspot class (battery sensors, not GPU).

Evidence

• Live before/after on the affected machine: a quiet 2400 RPM hold held while hotspots ran 95.7 → 109.7°C with zero overrides (main's floor trips at the first ≥95 reading and maxes within ~2s); clean auto restore afterwards; daemon log clean the whole time.
• 12 new unit tests (real-world M4 case, sustained trips, second-highest trip AND clear, sanitized readings, pressure ladder, blind hold, re-trip backoff); full suite: 164 tests green.
• Validated on one machine so far (M4 Max, macOS 27). Reports from M1-M3 laptops and desktops are very welcome — the per-class thresholds are plain constants, easy to tune.

Deliberately not in this PR

• Fan-stall detection and release-to-auto-on-trip — kept out to keep this reviewable; happy to propose separately.
• Display-side key labeling: untouched here. The per-generation tables proposed in M4: CPU temperature includes SoC hotspot and non-core Tp keys (cause of #35) #62 are complementary — that mapping could later feed this governor's sensor classes directly.

Related: the fan-control side of #35 and #62, plus #63. Possible rebase conflicts with #37/#25/#47 in ThermalMonitor.swift/Daemon.swift — happy to rebase as needed.