diff --git a/docs/LIGHTBURN.md b/docs/LIGHTBURN.md
index e8183a1..5c44b6b 100644
--- a/docs/LIGHTBURN.md
+++ b/docs/LIGHTBURN.md
@@ -113,6 +113,14 @@ restart the controller with the head re-parked.)
   queue + deceleration); Resume continues exactly. **The big button does
   the same**: one press while a job runs pauses it (LightBurn shows Hold),
   the next press resumes it — the factory's pause/resume, on the machine.
+  Two things to know before you pause a cut. **Resume where it stopped:**
+  there is no backtrack in GRBL mode, so the beam restarts from where the
+  deceleration ended and accelerates away from a standstill — at constant
+  power (`M3`) that leaves a deeper spot you can see, while `M4` scales power
+  with speed and mostly hides it. **Don't leave it paused:** the armed window
+  has an idle grace (`laser_disarm_s`, default 60 s) that counts down through
+  a hold, so a job left paused disarms itself and the resume asks for the
+  button again before it can fire.
 - **Opening the lid (or a Pro's interlock loop) during a job cancels it**,
   as the factory firmware does: the head parks with a controlled
   deceleration (the hardware cut the beam the instant the lid moved), the
@@ -128,9 +136,11 @@ restart the controller with the head re-parked.)
   material never leaves LightBurn waiting.
 - **Stop** = soft reset: motion aborts with a controlled deceleration
   and grblHAL raises an alarm with **position declared lost** (the
-  stream queue means up to ~40 mm of in-flight difference). Recovery:
-  unlock (`$X` in Console or LightBurn's prompt), jog the head clear,
-  and carry on in Current Position mode. Restart the controller with
+  stream queue means up to ~40 mm of in-flight difference). It leaves the
+  head where it stopped — the return to the job start belongs to the lid
+  and interlock policy alone, so Stop never moves the machine on its own.
+  Recovery: unlock (`$X` in Console or LightBurn's prompt), jog the head
+  clear, and carry on in Current Position mode. Restart the controller with
   the head re-parked if you want a clean absolute frame.
 - **Move tab**: jogging (set a sane speed, e.g. 6000 mm/min), Get
   Position, distance buttons.
diff --git a/docs/SAFETY.md b/docs/SAFETY.md
index 199fbe9..f4cba10 100644
--- a/docs/SAFETY.md
+++ b/docs/SAFETY.md
@@ -151,7 +151,14 @@ would not allow.
 - **Charge pump only while running.** The 200 ms retrigger starts with the
   run and the callback returns without rearming as soon as the state leaves
   `running` (stop, halt, fault, underrun). Stop/disable/unload pin sets force
-  CHG_PUMP low.
+  CHG_PUMP low. A paused job is one of those states, so the chain de-energizes
+  itself behind a pause without anyone asking it to: measured at the pads,
+  motion stops 317 ms after the pause command and HV_ENABLE drops with the
+  watchdog 550 ms after it (the feed ends with the run, then t_w expires) — a
+  pause shorter than about half a second never drops HV at all. On the resume
+  the pump primes with the run and HV_ENABLE is back within ~3 ms, while motion
+  only restarts at ~219 ms: the chain re-arms about 216 ms **before** the first
+  step, so a resumed cut is never waiting on it.
 - **FIRE backstop.** At end-of-data and on underrun the SDMA script drops FIRE
   and the step lines within one tick; the FIRE line is parked Hi-Z at every
   run end and only a latch unlock plus a new run restores it.
@@ -191,7 +198,10 @@ would not allow.
   streaming FIRE bits into a blocked gate.
 - **Disarm.** After `laser_disarm_s` (default 60 s) of no laser use, or on
   program end/abort, the controller relocks the latch, turns the button LED
-  off and stands the cooling profile down. The relock waits for the kernel to
+  off and stands the cooling profile down. A job paused on the button is no
+  laser use: the grace counts down through the hold and closes the window
+  under a job left standing, so a long pause ends with the machine disarmed
+  and the next emission needs a fresh press. The relock waits for the kernel to
   finish the queue tail so a controlled stop can never leave FIRE driven.
 - **Coolant fire gates.** The armed window requires a fresh `fire_ok` verdict
   from the cooling engine (flow verification, over-temperature, lid-IR
@@ -219,7 +229,13 @@ would not allow.
 - **Button.** Outside the arm wait the button is the job pause/resume toggle
   in both controller modes (feed hold / cycle start in GRBL mode; the
   factory's stop-backtrack-hold and lead-in resume in cloud mode); a held
-  button has no further meaning during a job.
+  button has no further meaning during a job. A pause is deliberately **not** a
+  cancel: the latch stays unlocked and the armed window open, which is what
+  lets the next press resume the job. Emission still ends with the pause — the
+  stream stops driving FIRE and the chain drops HV_ENABLE by itself (§3.1) —
+  and the window closes on its own if the pause outlives the disarm grace. A
+  lid or interlock open while paused takes the cancel path, so nothing resumes
+  past an enclosure opening.
 - **Head/motion witnesses.** Position counters are not proof of motion (the
   step-stream drives are open loop); the head accelerometer is the motion
   witness, and `beam_detect_analog` on the head is the live emission witness.