Making the laser "fail safer" on exit

I have a 7i76e-based machine with both a spindle and laser.  The 7i76e has the 7i76e_7i76x1pD config, with PWM on TB3.  The laser takes an active LOW enable (i.e. if the mesa board has no power, the laser is ON, except that the laser is powered from the same rail as the mesa board) (i.e.2. so it's connected to pin 3).  custom.hal has:

net aout-00 <= motion.analog-out-00
net aout-00 => hm2_7i76e.0.pwmgen.00.value
net dout-01 <= motion.digital-out-01
net dout-01 => hm2_7i76e.0.pwmgen.00.enable

This configuration works just fine with lightburn, using M67/M62 (but no M63? This might be the first time I'd exited linuxcnc with the laser still powered).  However, today, at the end of the day, after running a successful laser job, I did File->Exit from linuxcnc and the laser came on at full power!  I slammed the main power switch and rubbed the yellow spots out of my eyes, but the laser had already burned a hole in the paper coating of some gypsum we were using as a heat shield, despite being 5-6 inches away.  It made me think a bit about safety...

So, any tips on changes to HAL or my 7i76e setup  that will force an output pin to stay in a known state when linuxcnc exits?  Or do I need some external stuff to, say, cut power when the laser shouldn't be running?  Assuming *those* devices are connected to pins that can be trusted...

Normally I'd just try things to see what works, but in this case I'd rather not
 

Use a relay, powered from the same source as the mesa card.

Ideally, you have a separate external ESTOP circuit that needs explicit enabling via physical button that is also in the loop (and is disabled when linuxcnc powers down).

Yes, as rmu said, you should have an independent ESTOP controlled safety device for a laser.

That said, if you are using a step/dir pin for the PWM output, you should choose
the output polarity that disables the laser at power on and watchdog bites.
(it should go off if you disconnect the Ethernet cable while running)

This likely means you will need to invert the PWM output and or PWM enable output
in the hal file

Ah, this was the trick I was hoping for. Thanks!
(my electronics are still spread across a table, so no official estop yet other than the power strip switch

After some testing, I found out (much to my dismay) that the PWM output pins on the 7i76e are set one way for "watchdog timeout" and the other way for "pwm disabled" - i.e. a watchdog timeout effectively sets the pwm to 100%! This is independent of the pwm value. Is this a bug, or a way to intentionally force people to honor a separate on/off signal?

If you want active high PWM you can do it this way:

Chose the inverting outputs (Like STEP- = low at power up or watchdog bite)
and invert the PWM output:

setp hm2_7i76e.0.pwmgen.00.out0.invert_output true

That did the trick, the laser seems to be off all the time except when I expect it to be on. Thanks!

(and yes, I added a manual switch on the laser power so I could "safe" it manually, too)