F-27: No emergency stop; track power button turns power on when the state is unknown #30

Severity: MEDIUM · Effort: Medium · Batch: 4 · Status: Code done in #21 (1b8767b), awaiting bench verification

Found in the second full review of the firmware. Recorded with the rest of the pass (F-19…F-44) in docs/REVIEW_REMEDIATION_PLAN_2.md, which is where its status is kept.

Description

OrchestratorClient::sendEmergencyStop exists but nothing calls it, and nothing sends
WiThrottle's X. A loco with no knob assigned cannot be stopped without assigning one. The
track-power toggle turns power on when the state is unknown — the wrong default for a panic
press — and under WiThrottle it depends on the separate JSON link, so it silently does nothing
when that link is down.

Plan

1. Add emergencyStop() to the ThrottleBackend port (orchestrator: EMERGENCY_STOP;
   WiThrottle: X on every acquired throttle) and a dedicated on-screen control.
2. An unknown power state turns power off, not on.
3. Under WiThrottle, an OFF goes over PPA0 when the JSON link is down.

Files: ThrottleBackend.h, both backends, ThrottleController, MainScreen,
PowerStatusBar.cpp

Acceptance Criteria

• ThrottleBackend::emergencyStop(); ThrottleController::emergencyStop() shows the
  throttles stopped only once it was sent.
• An E-STOP button in the main screen's bottom row, in UiTheme::BUTTON_EMERGENCY —
  the one saturated button — firing on press rather than on click.
• A press on an unknown power state turns power off.
• Under WiThrottle, OFF falls back to PPA0 when the JSON link is down; ON still waits for
  it. The button shows WiThrottle's PPA state when JSON has none.
• Unit test test_controller_emergency_stop passes on the board (it compiles).
• Bench: E-STOP under each transport; check the button's placement against the carousel
  and the icon buttons (laid out without a screen to look at).
• Bench: stop JMRI's web server, press the power button; power goes off over WiThrottle.