Security & performance review

Reviewed the diff against main with focus on the float/numeric edge cases in scale.rs, the untrusted power-limit parse, the render hot path, and the ioreport.rs refactor.

Finding addressed (MEDIUM) — non-finite power limit reached the axis

power_range anchors the Pkg Power / summary Pwr axis to the device's enforced power limit, and in remote view mode that limit comes from a scraped Prometheus value (gpu_power_limit_max_watts → metrics_parser.rs → gpu.detail["power_limit_max"]). Rust's f64::from_str accepts "inf", "infinity", and "NaN", and the existing guard was only .filter(|&w| w > 0.0) — but inf > 0.0 is true. A malformed or hostile endpoint emitting ... inf therefore produced a (0, inf) range, which scale_badge rendered as a literal 0-inf axis legend.

A second, narrower route hit the same (0, inf) via the fallback path: a pathologically large but finite power_consumption scrape (near f64::MAX) passes the finite filter in history_peak, and nice_ceil then overflowed nice * pow to infinity.

Neither route can panic (the braille renderer at src/ui/braille.rs:77 treats non-finite range bounds as a degenerate constant range), so this is display corruption from untrusted input rather than a crash/DoS — hence MEDIUM, not CRITICAL.

Fix (4b68bba, src/ui/scale.rs only):

• power_range limit filter now requires w.is_finite() && w > 0.0; a bogus limit falls back to the nice-rounded observed peak.
• nice_ceil guards its result so it can never return a non-finite ceiling.
• Added regression tests: power_range_ignores_non_finite_limit (covers inf/Inf/infinity/-inf/NaN/nan) and nice_ceil_result_is_always_finite (covers f64::MAX).

Reviewed and clear

• Temperature math — thresholds are Option<u32> → f64::from is exact and non-negative; filtered to > 30.0 with a 100°C fallback. No NaN, no inversion, no divide-by-zero.
• nice_ceil / log10 / powf — zero/negative/NaN/inf inputs are short-circuited to 1.0; subnormal-to-0.0 and overflow-to-inf cases are unreachable for real inputs (callers floor at 8/10 W) and are now defended regardless.
• history_peak — already filters non-finite samples, so NaN/inf in power_consumption/ane_utilization history never poisons the peak.
• Render hot path — per-frame cost is O(1) range math plus a single O(n≤100) history_peak pass that replaces what the old auto-range scanned internally; one small scale_badge String per row. No new allocations or super-linear scans; no regression.
• ioreport.rs — collapsing the nested if item.channel == "GPUPH" into a match guard is behavior-preserving: a non-GPUPH channel falls through to _ => {} either way.

Gate

cargo fmt --check, cargo clippy --lib (0 warnings), cargo test --lib (996 passed, 0 failed; +2 new) all pass.

Addressed pr-reviewer findings (commit 01e7a02)

• [MEDIUM] Multi-GPU aggregate power clip — power_range now takes &[GpuInfo] and anchors the ceiling to the sum of every GPU's enforced limit (package power is itself summed across GPUs). When any GPU lacks a valid limit it falls back to the nice-rounded observed peak, so an N-GPU NVIDIA node no longer pins Pkg Power flat at the top.
• [LOW] Power-limit key fallback short-circuit — extracted gpu_power_limit(); each key is now parsed + validated independently in current → max → default order, so a present-but-invalid power_limit_current no longer masks a valid power_limit_max.

Added 3 regression tests (multi-GPU sum, mixed-limit fallback, per-key fallback).

Gates: cargo fmt --check ✅ · cargo clippy --lib → 0 warnings ✅ · cargo test --lib → 999 passed, 0 failed ✅