Why a foot.

Keep a human body on the control.

Stopping should be the default state of an agent, not a button you have to find. If something runs only while a person is physically holding it, then attention is its power supply. When the attention goes, so does the power, and nobody has to remember to do anything.

None of this is new. Machines that can hurt you have long been built to stop when you let go, and the idea is old enough to have a few well-worn forms.

Trams and trains

A dead man's pedal or handle must be held for the vehicle to move or to keep moving. Streetcars such as the PCC had one under the driver's foot, and many tram and train cabs carry some form of it today. Rail operators also add vigilance devices that ask for a periodic acknowledgement, because a pedal alone can be held down by a weight or a slumped driver.¹

Lawn mowers

In the United States a walk-behind power mower must have an operator-presence control, and the blade must stop within three seconds of the operator releasing it. That is the federal safety standard at 16 CFR 1205, in force since 1982.² The rule does not ask the operator to be careful. It makes letting go the safe thing.

Industrial robots

A robot teach pendant carries a three-position enabling switch. Released, the robot stops. Held in the middle, it may move. Squeezed through in panic, it stops again. Both letting go and clenching are treated as the body saying no.³

Position 1

Released

Motion stops.

Position 2

Held

Motion permitted.

Position 3

Squeezed

Motion stops.

Agents are fast, and approval usually arrives after the fact. You read what they did once it is done. The stop control, where there is one, is a button you look for when it is already too late.

A pedal turns that around. Nothing happens unless you are there for it, and the moment you are not, it ends. It is a small, rude kind of consent that has to be renewed every second.

People defeat hold-down controls.

Yes, and the rail industry knows it. Weights, wedges, tape and a driver who has fallen asleep all keep a pedal down. The T-1 as drawn does not prevent this, and the manual says so in its first warning: do not put a brick on the pedal. What the design does about it is limited and honest. The run lamp is lit by the loop current, so the pedal cannot report running while it is not. A defeat is visible: a brick is not subtle. And a serious version would borrow the rail answer, a vigilance check that needs a fresh release and press every so often, so that a held-down pedal alone is not enough. This pedal does not have one. It would need one.

My foot will get tired.

Good. That is a budget. The length of a run is the length of your own attention, in the one currency that cannot be faked.

It does not scale.

No. One person, one foot, one stream of attention. That is the point of it.

Why not a stop button?

Because a stop button asks you to act in order to be safe. The pedal asks you to act in order to be dangerous. The default matters more than the control.

What if I cannot use a foot?

Use any part of you that can hold a switch down. A hand switch, a knee switch or a sip-and-puff device all work. The idea is a body, not a foot.

Half. The pedal is a joke: no such pedal exists, it has a manual that warns about bricks, and nobody should buy it.

The principle is not. Agents are being given more autonomy faster than anyone has worked out how to take it back. Autonomy is granted once and then kept by default, and revoking it is the exception. I would build it the other way round: stop by default, short leases that lapse unless renewed, and a person physically present as the precondition for anything that cannot be undone. The pedal is the loudest way I could find to say that.