[revelation]

I'm pretty sure the fail safe for a furnace should not be on and blasting. In a well insulated house (well, not CA either) you could easily get the temperature into dangerous areas with a constantly on furnace, and you don't want that happening when asleep.

[tomkinstinch]

The risk is the boiler remaining off when you are not around; that's the condition where massive property damage would occur (pipes freezing). If you're present, presumably you would notice a failed-safe boiler running often and address the issue. The boiler controller would preserve the safety of the system itself even if the thermostat calls for heat constantly.

In the event the house is too hot, you could open windows, leave, or if it is above freezing outside simply turn off the boiler directly. If it gets too hot while you're asleep, it's not "dangerous": you would wake up sweating. Granted, infants or the infirm may have issues, but in general they face a multitude of dangers that need special consideration or supervision.

What Nest should have really done is include an old-school analog control mechanism as the fail safe (reed switch, magnet, and a bimetallic strip?) that would maintain a safe baseline (say, 50ºF) if the "smart" controller fails.