Function safety_ceiling 

pub fn safety_ceiling(ctx: &Context) -> f32

The hard ceiling on the budget multiplier for the current context.

The PID loop regulates the multiplier smoothly toward the frame-time target, but emergencies (Critical thermal/battery, near-budget memory pressure) demand an immediate cap that does not wait for the loop to converge. This is the feedforward / safety half of the controller: it can only ever lower the multiplier, never raise it.