SAFETY, LIGHTBURN: what the pause and the cancel mean, now that the button drives them

SAFETY: the chain de-energizes itself behind a pause without being asked -
the charge-pump feed ends with the run, so HV_ENABLE drops with the watchdog
about half a second in, and on the resume it is back ~216 ms before the first
step (pad measurements). A pause is deliberately not a cancel: the latch stays
unlocked and the window open, which is what lets the next press resume the
job, while emission still ends because the stream stops driving FIRE. The
disarm grace counts down through a hold, so a job left paused disarms itself,
and a lid or interlock open while paused takes the cancel path - nothing
resumes past an enclosure opening.

LIGHTBURN: the two things an operator needs before pausing a cut - the resume
restarts from where the deceleration ended and accelerates from a standstill,
which M3 shows as a deeper spot and M4 mostly hides, and a job left paused
disarms itself and asks for the button again. Stop leaves the head where it
stopped; returning to the job start belongs to the lid and interlock policy
alone.

docs/LIGHTBURN.md

@@ -113,6 +113,14 @@ restart the controller with the head re-parked.)
   queue + deceleration); Resume continues exactly. **The big button does
   the same**: one press while a job runs pauses it (LightBurn shows Hold),
   the next press resumes it — the factory's pause/resume, on the machine.
+  Two things to know before you pause a cut. **Resume where it stopped:**
+  there is no backtrack in GRBL mode, so the beam restarts from where the
+  deceleration ended and accelerates away from a standstill — at constant
+  power (`M3`) that leaves a deeper spot you can see, while `M4` scales power
+  with speed and mostly hides it. **Don't leave it paused:** the armed window
+  has an idle grace (`laser_disarm_s`, default 60 s) that counts down through
+  a hold, so a job left paused disarms itself and the resume asks for the
+  button again before it can fire.
 - **Opening the lid (or a Pro's interlock loop) during a job cancels it**,
   as the factory firmware does: the head parks with a controlled
   deceleration (the hardware cut the beam the instant the lid moved), the
@@ -128,9 +136,11 @@ restart the controller with the head re-parked.)
   material never leaves LightBurn waiting.
 - **Stop** = soft reset: motion aborts with a controlled deceleration
   and grblHAL raises an alarm with **position declared lost** (the
-  stream queue means up to ~40 mm of in-flight difference). Recovery:
-  unlock (`$X` in Console or LightBurn's prompt), jog the head clear,
-  and carry on in Current Position mode. Restart the controller with
+  stream queue means up to ~40 mm of in-flight difference). It leaves the
+  head where it stopped — the return to the job start belongs to the lid
+  and interlock policy alone, so Stop never moves the machine on its own.
+  Recovery: unlock (`$X` in Console or LightBurn's prompt), jog the head
+  clear, and carry on in Current Position mode. Restart the controller with
   the head re-parked if you want a clean absolute frame.
 - **Move tab**: jogging (set a sane speed, e.g. 6000 mm/min), Get
   Position, distance buttons.

docs/SAFETY.md

@@ -151,7 +151,14 @@ would not allow.
 - **Charge pump only while running.** The 200 ms retrigger starts with the
   run and the callback returns without rearming as soon as the state leaves
   `running` (stop, halt, fault, underrun). Stop/disable/unload pin sets force
-  CHG_PUMP low.
+  CHG_PUMP low. A paused job is one of those states, so the chain de-energizes
+  itself behind a pause without anyone asking it to: measured at the pads,
+  motion stops 317 ms after the pause command and HV_ENABLE drops with the
+  watchdog 550 ms after it (the feed ends with the run, then t_w expires) — a
+  pause shorter than about half a second never drops HV at all. On the resume
+  the pump primes with the run and HV_ENABLE is back within ~3 ms, while motion
+  only restarts at ~219 ms: the chain re-arms about 216 ms **before** the first
+  step, so a resumed cut is never waiting on it.
 - **FIRE backstop.** At end-of-data and on underrun the SDMA script drops FIRE
   and the step lines within one tick; the FIRE line is parked Hi-Z at every
   run end and only a latch unlock plus a new run restores it.
@@ -191,7 +198,10 @@ would not allow.
   streaming FIRE bits into a blocked gate.
 - **Disarm.** After `laser_disarm_s` (default 60 s) of no laser use, or on
   program end/abort, the controller relocks the latch, turns the button LED
-  off and stands the cooling profile down. The relock waits for the kernel to
+  off and stands the cooling profile down. A job paused on the button is no
+  laser use: the grace counts down through the hold and closes the window
+  under a job left standing, so a long pause ends with the machine disarmed
+  and the next emission needs a fresh press. The relock waits for the kernel to
   finish the queue tail so a controlled stop can never leave FIRE driven.
 - **Coolant fire gates.** The armed window requires a fresh `fire_ok` verdict
   from the cooling engine (flow verification, over-temperature, lid-IR
@@ -219,7 +229,13 @@ would not allow.
 - **Button.** Outside the arm wait the button is the job pause/resume toggle
   in both controller modes (feed hold / cycle start in GRBL mode; the
   factory's stop-backtrack-hold and lead-in resume in cloud mode); a held
-  button has no further meaning during a job.
+  button has no further meaning during a job. A pause is deliberately **not** a
+  cancel: the latch stays unlocked and the armed window open, which is what
+  lets the next press resume the job. Emission still ends with the pause — the
+  stream stops driving FIRE and the chain drops HV_ENABLE by itself (§3.1) —
+  and the window closes on its own if the pause outlives the disarm grace. A
+  lid or interlock open while paused takes the cancel path, so nothing resumes
+  past an enclosure opening.
 - **Head/motion witnesses.** Position counters are not proof of motion (the
   step-stream drives are open loop); the head accelerometer is the motion
   witness, and `beam_detect_analog` on the head is the live emission witness.