# Humanish 0.88.2: sequential studies honor model-spend thresholds

Sequential shared-world studies now enforce the `execution.caps.maxUsd` and
`maxTotalUsd` thresholds they previously accepted without applying. This covers
computer-use participants sharing a clone or local-tree subject with
`subject.topology: shared-world` and `execution.concurrency: 1`.

Each participant's reported usage feeds the per-participant threshold and the
shared study estimate. Final usage, including a closing report, is reconciled
before the next participant starts. A participant interrupted by a threshold
has `budget_reached` / `incomplete`; its reason distinguishes prior activity
from no material progress. Later participants blocked by the shared threshold
make no model requests and add no executed turn to the checkpoint timeline.
A closing report that crosses the threshold preserves the already recorded
completion condition while blocking subsequent participants.
The bundle retains all declared participants and an explicit blocked suffix.
Verification checks the suffix against its preceding interruption, participant
records and unchanged executed timeline; absent participants cannot masquerade
as budget-blocked seats.

These checks happen after a model response and before its actions or another
participant turn. The current request can overshoot a threshold. They estimate
model spend; they do not reserve future requests or cap provider invoices,
desktop compute, or target-app charges. A zero threshold can still allow the
first model request. Use an explicit dry-run for a path without provider calls.

An unpriced model with a declared threshold is refused before allocation. For
an otherwise completed response, missing or partial usage ends capped sequential
execution with `harness_error` and `usage_unreported` (“provider usage unavailable”).
The CUA loop sends no further participant request, retry or closing request.
An explicitly incomplete provider response retains its original interruption
cause first; its missing usage remains unknown. For these strict capped sessions,
the default OpenAI adapter makes one dispatch per requested turn, including
HTTP errors and policy negotiation. The loop cancels the request signal when
its timeout wins, so an outstanding transport cannot retry after the loop ends.
Injected providers must honor that signal and control their own dispatches;
cancellation cannot undo an already billed request. Known partial costs stay
in the trace, and an unknown shared budget blocks later participants.

Sequential traces now retain dated model estimates. The run total explicitly
marks desktop compute as unmeasured, so the model subtotal is a lower bound.
Observer labels a partial estimate as known cost with the total unknown.
A custom session returning a different model identity fails orchestration and
blocks later participants while preserving its original outcome and the
estimate for its returned model. This does not retrospectively enforce an
arbitrary custom runner that ignored its cap options.

Existing bundles are not rewritten. Uncapped sessions and other execution
routes retain their existing behavior. The stricter unknown-usage rule applies
to sequential capped studies; the sequential route still has no running
Observer usage stream.

Verification covers the actual participant loop with captured provider usage,
individual and shared thresholds, unstarted seats, zero and missing usage,
closing requests, model mismatches, checkpoint evidence and cleanup. These
contract checks establish the tested behavior; they do not establish persona
effectiveness, independent adoption, or exact provider billing.