[harryisfish]

Why

The root daemon could execute a user-replaceable helper, and interrupted hardware writes or foreground discharge could leave manual control active. Non-finite temperature inputs could also bypass the thermal guard.

What changed

• Install an atomic, protected helper copy and update the upgrade instructions.
• Roll failed fan operations back to auto, retry incomplete recovery, and reject non-finite safety inputs.
• Supervise foreground discharge in the daemon with connection ownership, a monotonic renewal deadline, target checks, and restoration retries.

Scope

Fix the four high-priority findings. Other audit findings and hardware-specific DDC changes are excluded. Old daemons must be reinstalled before the new CLI will start supervised discharge.

Blast Radius

Touches daemon installation, all manual fan write callers, thermal safety, and adapter control. Manual adapter toggles remain separate from supervised discharge. Homebrew upgrades now require sudo smctl daemon install to update the protected copy.

Verification

• Before the fix, focused fan/guard regressions produced 10 assertion failures.
• 133 related tests passed, including filesystem copy/permission/ACL checks, fan rollback/retry, non-finite inputs, lease expiry, session ownership, and a real anonymous XPC disconnect with a mock SMC backend.
• Current-head CI passed debug build, the full test suite, and release build: https://github.com/leaperone/smctl/actions/runs/39926269811. No actual helper installation or hardware write was performed.