This will be used to protect a circuit if a higher-voltage supply is connected (DC), so hysteresis isn't required (I think). It's going to have an XT60 input plug, and accept input from 4S battery packs (16.8V max). Since battery packs with much higher voltage have XT60 connectors, I don't want the wrong battery pack to kill the circuit if connected. So I'm not expecting the circuit to "clip" an AC input (although that will be an interesting thing to implement for other circuits...), just reject a DC input over a certain voltage.
Ah, cool. So the threat model is a one-time sort of thing: either it's connected to the wrong voltage, or it's fine, or disconnected completely.
Note that mechanical connections are very fast: nanoseconds. In practice, your circuit will be limited by bypass capacitance (load end) times stray inductance (battery cable length). This can be mere microseconds.
When you say better Vgs(off), you mean to completely shut down the mosfet by (in the case of an n-channel) drop the gate voltage to near 0?
Yes. Suppose it's a hot day, the device was just being used, heavily -- so the transistor is hot too -- and the battery pack is hot swapped to the wrong one. Now Vgs(th) is depressed (because hot), it doesn't shut off fully, and the transistor cooks at some intermediate current -- maybe 0.1 to 10A, at whatever voltage drop it gets.
0V is much better, and tossing in a couple little BJTs, to ensure quick switching and correct gate levels, is a cheap performance boost!
FYI, MOSFETs are always slower than BJTs -- 2N7000 is sort of like the MOS equivalent of a TIP29, in TO-92 format. It's good for way more voltage and current than a jellybean needs to be. Even the smallest MOSFETs you can find are more like 2N4401s than 2N3904s, and they're way more ESD sensitive (even with built in gate protection zeners). You can't find new production small signal RF MOSFETs (3 terminal) anymore (and there are very few dual-gate RF MOSFETs left). But small BJTs abound (MPSH10/81 are cheap, fast and useful, in case you need something faster than 2N3904/6). So, BJTs are where it's at, even if it's the general purpose kind (like 2N3904/6).
Would some input capacitance (~10uF) be able to block some (or most) transients, or should I be looking to add a TVS diode to catch those?
Yes, but only to the extent that you're willing to add enough filtering to guarantee that delay.
Suppose you want to extend it to a 10us delay. This is more than enough time for the TL431 to wake up and respond, and enough time for a BJT level shift + driver to turn off the MOSFET. To get a 10us delay, you need a cutoff frequency in the 30kHz range. Assuming this is a low impedance load (a few ohms), this requires, say, 2uH and 22uF. Which, really, that's probably not bad at all. You can guess the battery wires will have some 0.2uH or so, more if long, and you can loop some extra wire inside your box to add more. (Note: avoid cored inductors for this purpose: the inrush surge will be near a hundred amperes, or more. You need that inductance available under pulsed conditions, which means air core action.)
Any resistance you can afford, also helps, particularly in reducing the peak inrush surge current. Said inductor doesn't need to be high quality; if it has a Q of 1 under this pulsed condition, it's fine (not that that really means anything, but for the sake of argument, let's say at the peak, it's dropping half and half through inductance and DCR, thus -- informally -- giving a Q of ~1).
Now, using huge resistors to drive gates, you're looking at 10~100us, which is an eternity, and also enough to toast the FET (if it's not toasted already from inrush -- again, mind where you put capacitors, and how much of 'em, after this poor transistor!). Insert some drive in there, and you'll have a much better start, at least!
Tim