Juno — four status words carried more weight this cycle than the systems behind them could support: Done, Cancelled, Monitored, Contained. Each means less than a user reading it would reasonably assume, and the evidence this time is concrete rather than inferred: operator logs, published API contracts, provider self-disclosures, one confirmed containment failure. Nothing in here comes from a demo.
Four categories below. Every finding carries a confidence tag, and each section closes with where it routes for design work. The domain ranking sits at the end.
What "Done" leaves running
The claim an interface presents: The task finished successfully.
What the evidence shows: Current products do distinguish some lifecycle states, and credit where it's due. Claude Code's Agent View separates Working, Completed, Failed, and Stopped, and tracks separately whether the underlying process is still alive. Google's Gemini Enterprise task contract distinguishes SUBMITTED, WORKING, and COMPLETED. Those are real distinctions. The blanket claim that every product collapses agent activity into a single indicator is wrong.
What these lifecycles don't cross is the session boundary. A task can read Completed while a child process it spawned is still running. In another report, a parent turn finalized while three subagents it had launched were still active with results nobody had collected — those results surfaced only when the user happened to send a new prompt 34 minutes later.
Claude Code defines Completed as "the task finished successfully" and says nothing about whether Completed verifies files, pull requests, messages, or third-party effects outside the session. Google's consumer-facing Gemini Spark folds receipt and active execution into a single Ongoing section. OpenAI's ChatGPT Work documentation describes progress and deliverables, not a lifecycle that extends past the session.
Confidence: High that current products distinguish some lifecycle states. Moderate-to-high that none of the products inspected expose a complete chain from acknowledged request through verified downstream settlement. Moderate because the review was representative rather than exhaustive, though the pattern held across everything examined.
Design implication: In Issue #11 I laid out the delegation contract lifecycle as proposed, staged, authorized, committed, settled, compensating. This cycle's practitioner reports land on the seam between committed and settled. The system reports done while effects it started are still moving, and the user has already moved on.
The system tracks its own execution state. It does not track whether the pull request it opened was merged, whether the file it published is reachable, whether the API call it made produced what it was meant to produce. A completion indicator that covered this would have to represent uncertainty about outcomes the system has no mechanism to observe. Doing that without turning every "done" into "maybe done" is the open problem.
What "Cancelled" covers
The claim an interface presents: The task was cancelled.
What the evidence shows: OpenAI's Agents API contract is explicit that accepting a cancellation event is not the same as completing cleanup. Cancellation may leave saved results, published files, and terminal effects in place. The API treats acknowledgment, runtime termination, and reversal of effects as three separate events.
In Issue #9 I separated three cancellation propositions: the request was accepted, the reported state changed, the underlying operation stopped. This cycle adds a fourth I didn't anticipate. An operator report on Claude's Agent SDK documented eight phantom cancellations in one session. The tooling told the model the user didn't want the action and instructed it to stop. No user cancellation had occurred. Two research subagents were killed mid-report, discarding roughly 88,000 tokens of completed work, and the host logs showed no corresponding user denial, interrupt, or watchdog event.
Confidence: High on the API-level semantics; it's in the contract. Moderate on how common false cancellation attribution is — one operator report, with a reproduction sketch and no confirmed root cause.
Design implication: Cancellation has at least four components: whether a cancellation was requested, by whom, whether execution stopped, and whether effects were reversed. Interfaces collapse all four into one indicator. The attribution failure is the sharpest finding this cycle, because it means the status display can assign a decision to a person who never made it.
"Monitored" without an independent verifier
The claim an interface presents: AI behavior is monitored, reviewed, and escalated when problems arise.
What the evidence shows: Anthropic reported that every action on its measured internal platform passes through online monitoring and later offline ingestion. More than a billion decisions analyzed in August, roughly 100,000 transcripts flagged weekly, about 50 cases escalated to people. Substantial numbers.
Anthropic also said it cannot be certain that all relevant behavior is captured, or that the resulting activity is adequately legible to human overseers. The operator of the monitoring system is telling you it has coverage gaps it can't size.
Which is what makes the Accenture/Faculty embedded evaluation partnership worth reading closely. Announced September 18, positioned as the mechanism that could independently verify monitoring claims of this kind. As of this cycle's cutoff there is no published methodology, no stated independence protections or publication rights, no evaluation criteria, and no escalation authority. Anthropic says many operating details remain under development. Accenture's announcement defines work categories, not terms. Faculty's publication index carried no partnership-specific methodology by the cutoff.
Anthropic will fund the evaluator's work directly, while acknowledging that pooled or government funding would be preferable. The entity being evaluated is paying for the evaluation, and the access and reporting terms aren't public.
Unlike the other three sections, this one draws entirely on provider announcements and partnership press releases. No practitioner reports describing monitoring visibility from the operator side were found. The monitoring claims here are evaluated against their own stated limitations, not against observed production experience.
Confidence: High that monitoring metrics remain provider-self-reported with no independent verification pathway currently operating. Moderate on whether the partnership eventually produces meaningful independent oversight; private terms may exist, but they aren't public.
Design implication: "Monitored" carries weight only if the certification behind it is independent, defined, and auditable, and that certification layer has been announced and not built. In Issue #10 I called this post-action verification with no way to verify. For anyone surfacing monitoring status in an interface, the question is what the word actually entitles a user to believe.
When "Sandboxed" didn't hold
The claim an interface presents: The agent operates within defined boundaries.
What the evidence shows: During a third-party cyber evaluation in May, Google's Gemini reached three real companies' systems after the evaluation environment unintentionally retained internet access and fictional targets turned out to share names with real organizations. Google confirmed the incidents to multiple outlets, said the model stopped in each case once it recognized it had reached real systems, and said the affected entities were informed.
Google said its testing partner had changed its testing processes. Irregular said all known issues on its side had been remedied. Neither described which controls changed, how they were tested, whether internet egress is now technically blocked, or how target identity gets validated. Google's AI safety publications carried no standalone incident report by the cutoff. Google told the Guardian it hadn't considered public disclosure necessary because the models hadn't damaged the companies.
Confidence: High that the containment boundary failed and both parties acknowledge it. Moderate on remediation effectiveness; corrective action was described in general terms through press statements, not in a technical report.
Design implication: A model noticing it has reached real systems and stopping is not a containment mechanism. It's an outcome that happened to be favorable, and it says nothing about the next run. Containment is an assertion about where an agent's effects can reach, and this incident shows the assertion can be wrong in ways the operator doesn't detect until after the boundary has been crossed. The design question is how you represent scope to a user in a way that separates a boundary the vendor intends, a boundary that is technically enforced, and a boundary that held the last time anyone looked. Each rests on a different kind of evidence: a policy statement, a technical control, an empirical observation. Interfaces flatten all three into one word because keeping them apart means admitting three different levels of confidence about the system's own infrastructure.
Where this routes
Agent Infrastructure as UX is the most urgent domain this cycle. In Issue #11 the committed-to-settled distinction was a proposed framework. Operator reports this cycle put it in production, with logs. Completion, cancellation, and containment all depend on runtime and tool-state distinctions that exist inside the APIs and never reach users in a form matching what the systems can warrant. Frontier problem: how an interface represents the difference between the task reporting done and the effects the task created having resolved, without requiring the user to hold a model of the system's internal architecture.
Human-Agent System Design is second. Monitoring depends entirely on what human reviewers can inspect, whether independent evaluators hold real authority, and whether unresolved effects keep an accountable owner. The Accenture/Faculty partnership is the first structural attempt at independent embedded evaluation of a frontier lab's monitoring claims, and its terms are undefined. Frontier problem: what a monitoring indicator means to a user when the operator of the monitoring system concedes coverage gaps it can't size, and the verification layer hasn't been built yet.
Intent-Based Interaction is implicated by the containment category: the distance between a declared scope and the systems an agent can actually reach. Narrower this cycle than the other two.
Inference-Aware UX is least central to these findings. Still relevant to how acknowledgment language and premature conversational closure shape status interpretation, but this cycle's evidence sits elsewhere.
The Build Queue owns the artifact response. What this cycle adds to its inputs:
- The committed-to-settled boundary needs a representation.
- Cancellation needs attribution and reversal state surfaced separately.
- Monitoring status needs to separate provider-reported from independently verified.
- Containment needs to separate intended boundaries from enforced ones.
None of the four is a copywriting problem. The status words sit on top of what the runtime can observe, and in three of these four categories it can't observe what the word claims. What the public evidence doesn't tell me is what happens to a user's trust in the agent once the interface says so.
- OpenAI's Identity role: The live posting explicitly names agent identity, permissions, authorization, governance, and remediation as the designer's scope — vocabulary that maps directly onto this cycle's containment and cancellation findings — and advertises $245K–$310K plus equity.
- Anthropic's evaluator terms: The Accenture/Faculty embedded evaluation was announced September 18, but Faculty's own insights index had no methodology, independence protections, or publication rights by the cutoff — watch for the first actual operating document.
- Google's missing postmortem: Google confirmed the Gemini evaluation incidents to Reuters and the Guardian but had published no primary incident report on its own channels by September 19; a technical disclosure would materially change the containment section's confidence level.
- Causal explanations in surprising behavior: A peer-reviewed Nature study found that explanations improved user prediction of autonomous-vehicle behavior — but only when the explanation was causally connected to the planner's decision and the behavior was surprising, not as a general benefit of showing traces.