I am keen to have a conversation on what model railroad operators expect or desire in relation to recovery from a layout disaster, ether a derailment (causing a short) or "Controlled" emergency stop to avoid a collision.

Maybe not strictly digital, however the CS3 is the topical controller with functions for HALT as well as STOP and NOT STOP.

With V2.1 of the CS3, the Release notes state ...
GO function in events
In the events it is now possible to send a "Go" command. This means that a booster can be put back into operation after a short-circuit detection without having to stop the entire system operation. In connection with the HALT command, operation can be safely stopped on large systems in the event of a fault, the short circuit can be eliminated and the operation can then be continued again.
If you insert an S88 contact in the events as a trigger, you can implement buttons on the system that trigger the HALT and GO functionality.

So the first question is.
In the event of a layout short , on a layout with multiple booster powered sections.
- Do you actually want just the Booster to power off - leaving the rest of the layout running?
or
- Prefer to be safe and stop the whole layout?

A corollary to this involves whether Marklin should offer the ability to define the behavior one way or the other like other manufacturers do.

Also related..
If the programming track shorts out, should the main track power off? (currently it does not)
If the main track (of the CS3) shorts out, should the programming track power off? (currently it does)


Now for the operational messaging. Currently , when an overload condition occurs, a popup message does initially appear.
Once dismissed there is no means on the CS3 to indicate which , if any, of the boosters are off or on
Should there be some indication on the controller ? Is so what ?

Comment:Traditionally, it has been fairly easy to wire an indicator lamp to each trackfeed to show this


For the 2nd point,
How do you best envision implementing the "Soft Go" ...
- Would a dummy sensor (to a Event) on the CS3 screen be sufficient?
- Would an external, S88 connected button (to an Event) more ergonomic?
- neither - It is easier to do the old BIG STOP -> BIG NOT-STOP ?


The 3rd point about making use of the HALT command introduces some other new thoughts.
- as above, where would you implement this from - Screen or S88 button?
More specifically
- if this was a derailment , would you be more happy/safe to use the BIG STOP anyway?


Back to the GO
As indicated this may be used to re-energise a booster, after its domain has been cleared of an electrical short, without having to use the BIG STOP -> BIG NOT-STOP method
However
- would you also like to see the GO be able to resume operation from a HALT ?
- - currently it does not - all trains stay halted
- - neither is there any indication on the screen that the train HAD been halted and needs resuming
- - Even a BIG STOP -> BIG NOT-STOP is not sufficient to kick the loco to resume its speed

- would you also like to have the GO be able to resume from a BIG STOP ?
- - currently it does not

In relation to HALT
All trains are commanded to speed 0 BUT while all the throttles go red, their speed remains indicating the original speed.
- Would you expect a HALTED loco to stay halted until the GO is sent
- - Currently it does NOT - a single nudge of the throttle will start it HOWEVER the throttle bars stay red