diff --git a/scripts/test-layout/layout.json b/scripts/test-layout/layout.json
index 9925e111815..4868047c94f 100644
--- a/scripts/test-layout/layout.json
+++ b/scripts/test-layout/layout.json
@@ -76,6 +76,9 @@
     "owner-registry-acl.test.ts": "config",
     "minimax-combo-image-input.test.ts": "providers",
     "web-search-forced-declaration.test.ts": "web-search",
+    "web-search-loop-iteration-usage.test.ts": "web-search",
+    "web-search-loop-error-usage.test.ts": "web-search",
+    "web-search-rotation-usage-attribution.test.ts": "web-search",
     "claude-devin-output-order.test.ts": "claude-integration",
     "codex-config-preservation.test.ts": "codex-integration",
     "codex-credits.test.ts": "codex-integration",
diff --git a/src/images/loop.ts b/src/images/loop.ts
index cc33a556bae..36ac172d9f6 100644
--- a/src/images/loop.ts
+++ b/src/images/loop.ts
@@ -325,6 +325,12 @@ export interface ImageBridgeDeps {
   waitForRequestSlot?: (signal?: AbortSignal) => Promise<ProviderRequestSlot | void>;
   /** Raw adapter usage at the terminal event, pre wire-normalization (see bridgeToResponsesSSE onUsage). */
   onUsage?: (usage: OcxUsage | undefined) => void;
+  /**
+   * After an `on429` rotation, offered the usage of the hidden iterations the left credential
+   * served. Returning true means it was billed to that credential's attempt, so `onUsage` will not
+   * report it again; the client terminal still includes it.
+   */
+  onRotatedUsage?: (usage: OcxUsage) => boolean;
   /**
    * Optional 429 failover for the routed (non-xAI) model. Return a rebuilt adapter for the
    * rotated credential, or null when the pool is exhausted. Async hooks support OAuth refresh;
@@ -383,6 +389,10 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
   let paidImageCalls = 0;
   let paidVideoCalls = 0;
   let hiddenUsage: OcxUsage | undefined;
+  // Hidden usage already billed through onRotatedUsage: still on the client terminal, not in
+  // ledgerUsage, which is what onUsage reports once a rotation has moved some.
+  let rotatedUsage: OcxUsage | undefined;
+  let ledgerUsage: OcxUsage | undefined;
   let activeProducers = 0;
 
   const addUsage = (a: OcxUsage | undefined, b: OcxUsage | undefined): OcxUsage | undefined => {
@@ -575,6 +585,7 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
       // runTurn adapters signal errors via {type:"error"} events, not HTTP status codes.
       const errorEvent = events.find(e => e.type === "error");
       if (errorEvent && errorEvent.type === "error") {
+        hiddenUsage = addUsage(hiddenUsage, errorEvent.usage);
         if (errorEvent.code === "translation_buffer_limit") {
           throw new TranslatorBudgetExceededError("retained_collectors", TRANSLATOR_MAX_TURN_BYTES);
         }
@@ -715,6 +726,10 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
         const rotated = await deps.on429(prepared.response.headers.get("retry-after"), prepared.response.headers,
           iterParsed, prepared.response);
         if (!rotated) break;
+        if (hiddenUsage && deps.onRotatedUsage?.(hiddenUsage)) {
+          rotatedUsage = addUsage(rotatedUsage, hiddenUsage);
+          hiddenUsage = undefined;
+        }
         try { void prepared.response.body?.cancel().catch(() => {}); } catch { /* already closed */ }
         adapter = rotated.adapter;
         yield { type: "heartbeat" };
@@ -778,6 +793,8 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
           signal,
           inactivityTimeoutMs: stallTimeoutMs,
           translatorBudget,
+          // A pass that fails was still billed; the error terminal below reports it with the hidden passes.
+          onErrorUsage: usage => { hiddenUsage = addUsage(hiddenUsage, usage); },
         })) {
           if (event.type === "heartbeat") yield event;
           else {
@@ -871,11 +888,12 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
           // Codex. forceFinal also finalizes.
           const shouldLoop = split.calls.length > 0 && !split.hasRealToolCall && !forceFinal;
           if (!shouldLoop) {
-            if (hiddenUsage) {
+            if (hiddenUsage || rotatedUsage) {
               for (let i = split.passthrough.length - 1; i >= 0; i--) {
                 const e = split.passthrough[i];
                 if (e?.type === "done" || e?.type === "incomplete") {
-                  split.passthrough[i] = { ...e, usage: addUsage(hiddenUsage, e.usage) };
+                  ledgerUsage = addUsage(hiddenUsage, e.usage);
+                  split.passthrough[i] = { ...e, usage: addUsage(rotatedUsage, ledgerUsage) };
                   break;
                 }
               }
@@ -1062,6 +1080,8 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
             });
           }
         } catch (e) {
+          ledgerUsage = hiddenUsage;
+          const usage = addUsage(rotatedUsage, hiddenUsage);
           if (isTranslatorBudgetExceededError(e)) {
             yield {
               type: "error",
@@ -1069,14 +1089,14 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
               errorType: "upstream_error",
               code: e.code,
               message: "upstream translation buffer exceeded the safe limit",
-              ...(hiddenUsage ? { usage: hiddenUsage } : {}),
+              ...(usage ? { usage } : {}),
             };
           } else {
             yield {
               type: "error",
               message: e instanceof LoopError ? e.message : (e instanceof Error ? e.message : String(e)),
               ...(e instanceof LoopError ? { status: e.status } : {}),
-              ...(hiddenUsage ? { usage: hiddenUsage } : {}),
+              ...(usage ? { usage } : {}),
             };
           }
           return;
@@ -1104,7 +1124,7 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
       ...(deps.onUsage ? {
         // Terminal done/incomplete already includes hiddenUsage (merged above). Do not
         // add it again here or request logs double-count multi-iteration image turns.
-        onUsage: (usage: OcxUsage | undefined) => deps.onUsage?.(usage),
+        onUsage: (usage: OcxUsage | undefined) => deps.onUsage?.(rotatedUsage ? ledgerUsage : usage),
       } : {}),
       ...(deps.onCompletedResponse ? { onCompletedResponse: deps.onCompletedResponse } : {}),
     },
diff --git a/src/server/responses/sidecar-execution.ts b/src/server/responses/sidecar-execution.ts
index 01973827e21..36962a53b6d 100644
--- a/src/server/responses/sidecar-execution.ts
+++ b/src/server/responses/sidecar-execution.ts
@@ -21,7 +21,7 @@ import {
   clampImageMaxRounds,
 } from "../../images";
 import type { ProviderAdapter } from "../../adapters/base";
-import type { OcxParsedRequest } from "../../types";
+import type { OcxParsedRequest, OcxUsage } from "../../types";
 import { rotateProviderTransportOn429, rateLimitRetryPolicyFor } from "../../providers/key-failover";
 import {
   isGenericOAuthFailoverEnabled,
@@ -50,6 +50,7 @@ import { providerFetch } from "./fetch-helpers";
 import type { AttemptRecoveryKind } from "../../usage/log";
 import { recordAdapterReasoning, recordAdapterTier } from "../request-log";
 import { normalizeLogConversationId } from "../request-log-conversation";
+import { attemptAccountChanged } from "../request-log-account-rotation";
 import { rememberResponseState } from "../../responses/state";
 import { trackStreamLifetime } from "../lifecycle";
 import { isAntigravityRawValidationRefusal } from "./antigravity-validation-refusal";
@@ -452,6 +453,15 @@ export async function executeResponsesSidecars(
     });
     return { adapter: rotatedAdapter, recoveryKind };
   };
+  // A loop's hidden rounds before a rotation were spent by the account it left. Bill them to that
+  // account's attempt while it is still open; the next send seals it. Declined when that send
+  // keeps the account (no new attempt), so the loop's final total still carries them.
+  const billRotatedUsage = (usage: OcxUsage): boolean => {
+    const attempt = logCtx.activeAttempt;
+    if (!attempt || !attemptAccountChanged(attempt.accountLogLabel, logCtx.accountLogLabel, attempt.provider, logCtx.provider)) return false;
+    transportState.bindKeyUsageFromBridge(usage);
+    return true;
+  };
   if ((imgPlan || vidPlan) && wsPlan) {
     // Web search takes priority when both are active — the media bridge cannot run
     // alongside runWithWebSearch. Surface a runtime signal so the user knows their
@@ -551,6 +561,7 @@ export async function executeResponsesSidecars(
         transportState.bindKeyUsageFromBridge(usage);
       },
       on429: rotateSidecarProviderOn429,
+      onRotatedUsage: billRotatedUsage,
       retryOn429Policy: route.providerName === "kiro" && isGenericOAuthFailoverEnabled(config, "kiro")
         ? null : rateLimitRetryPolicyFor(route.provider),
       onFirstOutput: noteSidecarOutput,
@@ -654,6 +665,7 @@ export async function executeResponsesSidecars(
       stallTimeoutSec: wsPlan.stallTimeoutSec,
       streamRoutedModelOutput: wsPlan.streamRoutedModelOutput,
       on429: rotateSidecarProviderOn429,
+      onRotatedUsage: billRotatedUsage,
       ...(!options.comboInitialSend && route.providerName === "google-antigravity" ? { onIterationEnd: () => {
         // The next Antigravity adapter dispatch claims this permit. If request construction,
         // admission or cancellation stopped it first, return the unused send allowance.
diff --git a/src/web-search/loop.ts b/src/web-search/loop.ts
index 79d6c291f7c..e5988852a99 100644
--- a/src/web-search/loop.ts
+++ b/src/web-search/loop.ts
@@ -7,6 +7,7 @@ import type { AttemptRecoveryKind } from "../usage/log";
 import { isTruncatedStopReason } from "../responses/truncated-stop-reason";
 import { bridgeToResponsesSSE } from "../bridge";
 import { guardEmptyToolCatalogStream, type ClientToolCatalogRestriction } from "../lib/empty-tool-catalog";
+import { mergeUsage } from "../server/responses/empty-completion-guard";
 import { runWebSearch, type SidecarOutcome, type SidecarOutcomeRecorder, type SidecarSettings } from "./executor";
 import { runAnthropicWebSearch } from "./anthropic-executor";
 import { runXaiWebSearch, type XaiSearchOptions } from "./xai-executor";
@@ -144,6 +145,18 @@ async function* replay(events: AdapterEvent[]): AsyncGenerator<AdapterEvent> {
   for (const e of events) yield e;
 }
 
+function terminalUsage(events: AdapterEvent[]): OcxUsage | undefined {
+  for (const e of events) if (e.type === "done" || e.type === "incomplete") return e.usage;
+  return undefined;
+}
+
+/** Hidden iterations add counters only: their checkpoint and raw wire usage are not the final terminal's. */
+function countersOnly(usage: OcxUsage | undefined): OcxUsage | undefined {
+  if (!usage) return undefined;
+  const { contextTotalTokens: _context, rawUsage: _raw, ...counters } = usage;
+  return counters;
+}
+
 /**
  * Collect the thinking block that preceded a web_search call in this iteration's events, so the
  * replayed assistant turn can carry it. Anthropic extended thinking REQUIRES the assistant
@@ -326,6 +339,12 @@ export interface WebSearchLoopDeps {
   onFirstOutput?: () => void;
   /** Raw adapter usage at the terminal event, pre wire-normalization (see bridgeToResponsesSSE onUsage). */
   onUsage?: (usage: OcxUsage | undefined) => void;
+  /**
+   * After an `on429` rotation, offered the usage of the hidden iterations the left credential
+   * served. Returning true means it was billed to that credential's attempt, so `onUsage` will not
+   * report it again.
+   */
+  onRotatedUsage?: (usage: OcxUsage) => boolean;
   /** Observe the exact adapter request selected for each routed-model iteration. */
   onRequestBuilt?: (request: AdapterRequest) => void;
   /** Request-scoped executor retains the core's selection binding across loop retries. */
@@ -413,6 +432,12 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
   // One iteration beyond the forced answer is reserved for its empty-answer recovery below.
   const HARD_CAP = maxSearches + 3;
   let emptyAnswerRetries = 0;
+  // Every iteration re-sends the full context, but only the last one's terminal reaches the bridge.
+  // Search-calling passes and the discarded empty forced answer are summed here and added to what
+  // onUsage reports, so the request log meters what was actually sent. The client-facing terminal
+  // keeps the last iteration's usage: Codex and Claude Code size the context window from it, and
+  // a sum would read as a context several times larger and trigger early auto-compaction.
+  let hiddenUsage: OcxUsage | undefined;
   let accountRefusalOutputStarted = false;
   const connectTimeoutMs = deps.connectTimeoutMs ?? 200_000;
   const routedModelStallTimeoutMs = deps.routedModelStallTimeoutMs ?? 200_000;
@@ -592,6 +617,7 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
         const rotated = await deps.on429(prepared.response.headers.get("retry-after"), prepared.response.headers,
           iterParsed, prepared.response);
         if (!rotated) break;
+        if (hiddenUsage && deps.onRotatedUsage?.(hiddenUsage)) hiddenUsage = undefined;
         const retainRefusal = prepared.response.status === 403
           && deps.incomingMeta?.providerName === "google-antigravity" && rotated.recoveryKind === "oauth-account-403";
         // Keep the bounded refusal readable until the sibling actually returns headers.
@@ -687,6 +713,8 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
         signal,
         inactivityTimeoutMs: routedModelStallTimeoutMs,
         translatorBudget,
+        // A pass that fails was still billed; the error path reports it with the hidden passes.
+        onErrorUsage: usage => { hiddenUsage = mergeUsage(hiddenUsage, usage); },
       })) {
         if (event.type === "heartbeat") yield event;
         // Kiro's explicit-completion protocol marks ordinary assistant text as commentary while
@@ -950,6 +978,7 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
                   stopReason: terminalEvent.stopReason,
                   eventTypes: [...new Set(split.passthrough.map(event => event.type))],
                 }));
+                hiddenUsage = mergeUsage(hiddenUsage, terminalEvent.usage);
                 if (!split.hasMalformedToolCall && !split.hasRealToolCall && emptyAnswerRetries === 0) {
                   emptyAnswerRetries++;
                   console.warn("[web-search-loop] empty forced answer — retrying once without tools");
@@ -972,6 +1001,7 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
             yield* replay(split.passthrough.slice(split.streamedPassthroughCount));
             return;
           }
+          hiddenUsage = mergeUsage(hiddenUsage, terminalUsage(split.passthrough));
           // The thinking that led to the search belongs to the FIRST call's assistant replay turn.
           for (const event of split.passthrough.slice(split.streamedPassthroughCount)) {
             if (event.type === "text_delta" && event.anthropicThinkingSignature) yield event;
@@ -982,6 +1012,8 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
             yield* runSearchCall(call, callIndex === 0 ? iterationThinking : []);
           }
         } catch (e) {
+          // The bridge reports no usage for either error; the iterations already sent still count.
+          if (hiddenUsage) deps.onUsage?.(hiddenUsage);
           if (isTranslatorBudgetExceededError(e)) {
             yield {
               type: "error",
@@ -996,6 +1028,7 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
           return;
         }
       }
+      if (hiddenUsage) deps.onUsage?.(hiddenUsage);
       yield { type: "error", message: "web-search loop exceeded its iteration cap" };
     } finally {
       if (abortSignal) abortSignal.removeEventListener("abort", linkAbort);
@@ -1019,7 +1052,7 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
       hideRawReasoning: parsed.options.hideRawReasoning,
       ...(deps.stallTimeoutSec !== undefined ? { stallTimeoutSec: deps.stallTimeoutSec } : {}),
       ...(deps.onFirstOutput ? { onFirstOutput: deps.onFirstOutput } : {}),
-      ...(deps.onUsage ? { onUsage: deps.onUsage } : {}),
+      ...(deps.onUsage ? { onUsage: (usage: OcxUsage | undefined) => deps.onUsage?.(mergeUsage(countersOnly(hiddenUsage), usage)) } : {}),
       ...(deps.onCompletedResponse ? { onCompletedResponse: deps.onCompletedResponse } : {}),
     },
   );
diff --git a/src/web-search/progress-stream.ts b/src/web-search/progress-stream.ts
index e3889eb5bca..521b17d86be 100644
--- a/src/web-search/progress-stream.ts
+++ b/src/web-search/progress-stream.ts
@@ -1,5 +1,5 @@
 import type { ProviderAdapter } from "../adapters/base";
-import type { AdapterEvent } from "../types";
+import type { AdapterEvent, OcxUsage } from "../types";
 import {
   isTranslatorBudgetExceededError,
   TRANSLATOR_MAX_TURN_BYTES,
@@ -32,6 +32,8 @@ export interface ParseStreamWithProgressOptions {
   signal?: AbortSignal;
   /** Kept configurable for focused tests; production callers should use the 5 second default. */
   postTerminalDrainTimeoutMs?: number;
+  /** Receives the usage an adapter `error` event carries before the stream fails on it. */
+  onErrorUsage?: (usage: OcxUsage) => void;
 }
 
 type ParseStream = ProviderAdapter["parseStream"];
@@ -296,6 +298,7 @@ export async function* parseStreamWithProgress(
           );
         }
         if (event.type === "error") {
+          if (event.usage) options.onErrorUsage?.(event.usage);
           fail(event.code === "translation_buffer_limit"
             ? new TranslatorBudgetExceededError("live_transient", TRANSLATOR_MAX_TURN_BYTES)
             : new Error(event.message));
diff --git a/structure/runtime.md b/structure/runtime.md
index dc720c31f82..bfc650bfdea 100644
--- a/structure/runtime.md
+++ b/structure/runtime.md
@@ -398,7 +398,7 @@ Automatic Codex pool selection and account status share the [plan exclusion cont
 
 ### Empty forced search answers
 
-Both search loops keep `web_search` declared after the search budget is exhausted. Further calls receive a paired limit-reached result without another physical search; at most `maxSearches + 3` model iterations run before a terminal error. Ordinary caller tools and cancellation still end the loop. Empty-answer recovery alone removes all tools. `src/web-search/loop.ts` makes at most one extra answer attempt after a clean forced-answer terminal with no visible output or tool call, only while an iteration remains. The recovery has no tools and reuses gathered search results. Malformed calls fail before refusal/truncation passthrough, and well-formed recognized refusal/truncation terminals pass through unchanged, including empty or partial answers. The extra generation may incur provider usage. `src/web-search/run-turn-loop.ts` shares this recovery and checks the ceiling before dispatch so it cannot start an unused request; below the search cap, `emptyCompletionRetry` permits one identical empty-answer retry per request with current tools and results. Errors and invalid terminals never authorize another search. Batched results from one call share one 8,000-character budget in `src/web-search/format-result.ts`, planned per query before serialization (#6621): every query keeps its label and status, shortened answers and unlisted sources carry markers with their original counts outside the untrusted boundary, structured output stays one valid JSON document, and a batch whose fixed parts alone overflow is condensed to status lines with a per-status count of any query that still did not fit.
+Both search loops keep `web_search` declared after the search budget is exhausted. Further calls receive a paired limit-reached result without another physical search; at most `maxSearches + 3` model iterations run before a terminal error. Ordinary caller tools and cancellation still end the loop. Empty-answer recovery alone removes all tools. `src/web-search/loop.ts` makes at most one extra answer attempt after a clean forced-answer terminal with no visible output or tool call, only while an iteration remains. The recovery has no tools and reuses gathered search results. Malformed calls fail before refusal/truncation passthrough, and well-formed recognized refusal/truncation terminals pass through unchanged, including empty or partial answers. The extra generation may incur provider usage. Every iteration re-sends the full context, so `src/web-search/loop.ts` adds the usage of each iteration whose terminal the client never sees (search-calling passes and the discarded empty answer) to what `onUsage` reports for the request log, including on an in-stream or translator-budget error; token and cache counts add, while `contextTotalTokens` and `rawUsage` come only from the final terminal, never an earlier iteration's. The client-facing terminal keeps the last iteration's usage, because Codex and Claude Code size the context window from it (`tests/web-search/web-search-loop-iteration-usage.test.ts`). A pass that ends in an adapter `error` event was billed too: `parseStreamWithProgress` hands that event's usage to `onErrorUsage` before failing, so `src/web-search/loop.ts` and `src/images/loop.ts` (which already puts its hidden iterations' usage on the failed terminal) add it to the usage they report, while the turn still fails with the same error (`tests/web-search/web-search-loop-error-usage.test.ts`, `tests/images/loop.test.ts`). `src/web-search/run-turn-loop.ts` shares this recovery and checks the ceiling before dispatch so it cannot start an unused request; below the search cap, `emptyCompletionRetry` permits one identical empty-answer retry per request with current tools and results. Errors and invalid terminals never authorize another search. Batched results from one call share one 8,000-character budget in `src/web-search/format-result.ts`, planned per query before serialization (#6621): every query keeps its label and status, shortened answers and unlisted sources carry markers with their original counts outside the untrusted boundary, structured output stays one valid JSON document, and a batch whose fixed parts alone overflow is condensed to status lines with a per-status count of any query that still did not fit. A 429 rotation inside either loop splits the request into one attempt row per account, so the hidden usage already gathered belongs to the account the loop is leaving. Right after a rotation each loop offers it through `onRotatedUsage`; `src/server/responses/sidecar-execution.ts` accepts only when the next send will open a new attempt (`attemptAccountChanged`), binds it to the still-open attempt, and the loop drops it from what `onUsage` later reports, so the surviving attempt carries only its own rounds and nothing is counted twice. The image loop still puts the whole turn on the client terminal (`tests/web-search/web-search-rotation-usage-attribution.test.ts`, `tests/images/loop.test.ts`).
 
 `src/web-search/loop.ts` uses `src/web-search/header-deadline.ts` to suspend the cumulative response-header deadline while each physical send awaits local pacing admission. Ordinary fetches, adapter executors, reset retries and pool-key rotations retain the remaining budget after admission; same-target 429 backoff still clears and restarts that budget. The default remains 200,000 ms. Client cancellation remains linked during queued admission and after final headers, and the existing pacing slot wrapper retains leases through body completion or cancellation. Streaming retry heartbeats and body inactivity deadlines keep their existing ownership. `tests/web-search/web-search-pacing-deadline.test.ts` covers queued success, real header stalls, queued cancellation, retry admission and cumulative rotation time. OpenAI sidecar 429 replays run only when their backoff fits the remaining sidecar deadline; otherwise the original 429 remains the routing-health outcome rather than becoming a timeout. Reset recovery and 429 replays share one three-send budget per search, so the two layers cannot multiply physical sends. Direct vision/search helpers and the alpha/search relay retain the resolver's live [stored-account credit policy](codex-account-controls.md#stored-account-authentication-policy) through physical sends and retries; a local hold prevents the send without becoming an upstream connection failure.
 ## Scoped provider quota for Combo selection
diff --git a/tests/fixtures/test-layout-expected.json b/tests/fixtures/test-layout-expected.json
index f5047535934..c9cdde106ad 100644
--- a/tests/fixtures/test-layout-expected.json
+++ b/tests/fixtures/test-layout-expected.json
@@ -126,7 +126,9 @@
   "cli-combo-partial-update.test.ts": "cli", "desktop-app-server-shim.test.ts": "clients",
   "desktop-app-server-shim-launcher.test.ts": "clients", "desktop-chatgpt-config.test.ts": "clients",
   "owner-registry-acl.test.ts": "config", "minimax-combo-image-input.test.ts": "providers",
-  "web-search-forced-declaration.test.ts": "web-search", "claude-devin-output-order.test.ts": "claude-integration",
+  "web-search-forced-declaration.test.ts": "web-search", "web-search-loop-iteration-usage.test.ts": "web-search",
+  "web-search-loop-error-usage.test.ts": "web-search", "web-search-rotation-usage-attribution.test.ts": "web-search",
+  "claude-devin-output-order.test.ts": "claude-integration",
   "codex-config-preservation.test.ts": "codex-integration", "codex-credits.test.ts": "codex-integration",
   "codex-credits-settings.test.ts": "codex-integration", "codex-credits-probes.test.ts": "codex-integration",
     "codex-credits-after-limit.test.ts": "codex-integration",
diff --git a/tests/images/loop.test.ts b/tests/images/loop.test.ts
index cda36e3373e..0827062da2a 100644
--- a/tests/images/loop.test.ts
+++ b/tests/images/loop.test.ts
@@ -1299,3 +1299,73 @@ describe.each(["runTurn", "parseStream"] as const)("image-loop provider identity
     expect(seen).toEqual(["github-copilot", "github-copilot"]);
   });
 });
+
+describe("image-loop adapter error usage", () => {
+  const imageCall = (usage: { inputTokens: number; outputTokens: number }): AdapterEvent[] => [
+    { type: "tool_call_start", id: "call_1", name: "image_gen" },
+    { type: "tool_call_delta", arguments: '{"prompt":"a cat"}' },
+    { type: "tool_call_end" },
+    { type: "done", usage },
+  ];
+  const errored: AdapterEvent = { type: "error", message: "provider blew up", usage: { inputTokens: 3, outputTokens: 2 } };
+
+  test("parseStream: an errored iteration's usage is added to the hidden iterations'", async () => {
+    useRealProgressStream = true;
+    streamQueue = [imageCall({ inputTokens: 10, outputTokens: 4 }), [{ type: "text_delta", text: "partial" }, errored]];
+    let seen: unknown = "unset";
+    const response = await runWithImageBridge({ parsed: makeParsed(), adapter: mockAdapter, plan, onUsage: usage => { seen = usage; } });
+    const sse = await response.text();
+    expect(sse).toContain("Provider stream error: provider blew up");
+    expect(seen).toEqual({ inputTokens: 13, outputTokens: 6 });
+  });
+
+  test("runTurn: an errored iteration's usage is reported", async () => {
+    const queue = [imageCall({ inputTokens: 10, outputTokens: 4 }), [errored]];
+    const adapter: ProviderAdapter = {
+      ...mockAdapter,
+      runTurn: async (_parsed: OcxParsedRequest, _incoming: IncomingMeta, emit: (e: AdapterEvent) => void) => {
+        for (const e of queue.shift() ?? []) emit(e);
+      },
+    };
+    let seen: unknown = "unset";
+    const response = await runWithImageBridge({ parsed: makeParsed(), adapter, plan, onUsage: usage => { seen = usage; } });
+    const sse = await response.text();
+    expect(sse).toContain("provider blew up");
+    expect(seen).toEqual({ inputTokens: 13, outputTokens: 6 });
+  });
+});
+
+describe("image-loop rotated usage", () => {
+  // Hidden rounds before a 429 rotation were spent by the account the loop left. Once the caller
+  // bills them to that account's attempt, the final report must not bill them again; the client
+  // terminal still shows the whole turn.
+  test.each([true, false])("a rotation offers the hidden usage; accepted=%p", async accepted => {
+    streamQueue = [
+      [
+        { type: "tool_call_start", id: "call_1", name: "image_gen" },
+        { type: "tool_call_delta", arguments: '{"prompt":"a cat"}' },
+        { type: "tool_call_end" },
+        { type: "done", usage: { inputTokens: 10, outputTokens: 4 } },
+      ],
+      [{ type: "text_delta", text: "after rotate" }, { type: "done", usage: { inputTokens: 30, outputTokens: 3 } }],
+    ];
+    let sends = 0;
+    const adapter: ProviderAdapter = {
+      ...mockAdapter,
+      fetchResponse: async () => ++sends === 2 ? new Response("rate limited", { status: 429 }) : new Response("{}"),
+    };
+    const offered: unknown[] = [];
+    let reported: unknown;
+    const response = await runWithImageBridge({
+      parsed: makeParsed(), adapter, plan,
+      on429: async () => ({ adapter, recoveryKind: "oauth-account-429" }),
+      onRotatedUsage: usage => { offered.push(usage); return accepted; },
+      onUsage: usage => { reported = usage; },
+    });
+    const sse = await response.text();
+    expect(sends).toBe(3);
+    expect(offered).toEqual([{ inputTokens: 10, outputTokens: 4 }]);
+    expect(reported).toEqual(accepted ? { inputTokens: 30, outputTokens: 3 } : { inputTokens: 40, outputTokens: 7 });
+    expect(sse).toContain('"input_tokens":40');
+  });
+});
diff --git a/tests/web-search/web-search-loop-error-usage.test.ts b/tests/web-search/web-search-loop-error-usage.test.ts
new file mode 100644
index 00000000000..29ee616551b
--- /dev/null
+++ b/tests/web-search/web-search-loop-error-usage.test.ts
@@ -0,0 +1,44 @@
+import { afterEach, expect, spyOn, test } from "bun:test";
+import type { ProviderAdapter } from "../../src/adapters/base";
+import type { AdapterEvent, OcxParsedRequest } from "../../src/types";
+import { runWithWebSearch } from "../../src/web-search/loop";
+import { buildWebSearchTool } from "../../src/web-search/synthetic-tool";
+import { createTestTranslatorBudget } from "../helpers/translator-budget";
+
+const originalFetch = globalThis.fetch;
+afterEach(() => { globalThis.fetch = originalFetch; });
+
+// A pass that ends in an adapter error was billed; the request log must meter it, and the turn
+// must still fail with the same error.
+test("an errored iteration's usage reaches the request log beside the search pass", async () => {
+  spyOn(globalThis, "fetch").mockResolvedValue(Response.json({ results: [] }));
+  const passes: AdapterEvent[][] = [
+    [
+      { type: "tool_call_start", id: "ws1", name: "web_search" },
+      { type: "tool_call_delta", arguments: JSON.stringify({ query: "docs" }) },
+      { type: "tool_call_end" },
+      { type: "done", usage: { inputTokens: 1000, outputTokens: 50 } },
+    ],
+    [{ type: "text_delta", text: "partial" }, { type: "error", message: "provider blew up", usage: { inputTokens: 1400, outputTokens: 30 } }],
+  ];
+  const adapter: ProviderAdapter = {
+    name: "errored-iteration",
+    buildRequest: () => ({ url: "https://routed.test/v1", method: "POST", headers: {}, body: "{}" }),
+    fetchResponse: async () => new Response("wire"),
+    async *parseStream() { yield* passes.shift()!; },
+  };
+  const parsed: OcxParsedRequest = {
+    modelId: "fixture", stream: true, options: {}, context: { messages: [], tools: [buildWebSearchTool()] },
+  };
+  const reported: unknown[] = [];
+  const response = await runWithWebSearch({
+    parsed, adapter, backend: "exa", exaApiKey: "fixture", hostedTool: { type: "web_search" },
+    settings: { model: "fixture", reasoning: "low", timeoutMs: 1000 }, maxSearches: 1,
+    incomingMeta: { headers: new Headers(), translatorBudget: createTestTranslatorBudget() },
+    onUsage: usage => reported.push(usage),
+  });
+  const text = await response.text();
+  expect(text).toContain("response.failed");
+  expect(text).toContain("Provider stream error: provider blew up");
+  expect(reported).toEqual([expect.objectContaining({ inputTokens: 2400, outputTokens: 80 })]);
+});
diff --git a/tests/web-search/web-search-loop-iteration-usage.test.ts b/tests/web-search/web-search-loop-iteration-usage.test.ts
new file mode 100644
index 00000000000..115257677c8
--- /dev/null
+++ b/tests/web-search/web-search-loop-iteration-usage.test.ts
@@ -0,0 +1,107 @@
+import { afterEach, describe, expect, spyOn, test } from "bun:test";
+import type { ProviderAdapter } from "../../src/adapters/base";
+import type { AdapterEvent, OcxParsedRequest, OcxUsage } from "../../src/types";
+import { runWithWebSearch } from "../../src/web-search/loop";
+import { buildWebSearchTool } from "../../src/web-search/synthetic-tool";
+import { createTestTranslatorBudget } from "../helpers/translator-budget";
+
+// Every routed-model iteration re-sends the full context, so the usage ledger (onUsage) must get the
+// sum of all of them. The client-facing terminal keeps the last iteration's usage: Codex and Claude
+// Code size the context window from it, and a sum would trigger early auto-compaction.
+const usage = (input: number, output: number, extra: Partial<OcxUsage> = {}): OcxUsage =>
+  ({ inputTokens: input, outputTokens: output, totalTokens: input + output, ...extra });
+const search = (id: string, u: OcxUsage): AdapterEvent[] => [
+  { type: "tool_call_start", id, name: "web_search" },
+  { type: "tool_call_delta", arguments: JSON.stringify({ query: id }) },
+  { type: "tool_call_end" }, { type: "done", usage: u },
+];
+const answer = (u: OcxUsage): AdapterEvent[] => [{ type: "text_delta", text: "answer" }, { type: "done", usage: u }];
+
+const originalFetch = globalThis.fetch;
+afterEach(() => { globalThis.fetch = originalFetch; });
+
+async function drive(passes: AdapterEvent[][], refuseFrom = Infinity) {
+  spyOn(globalThis, "fetch").mockResolvedValue(Response.json({ results: [] }));
+  const reported: (OcxUsage | undefined)[] = [];
+  let events: AdapterEvent[] = [];
+  let iteration = 0;
+  const adapter: ProviderAdapter = {
+    name: "fixture",
+    buildRequest() {
+      events = passes[iteration++]!;
+      return { url: "https://routed.test/v1", method: "POST", headers: {}, body: "{}" };
+    },
+    fetchResponse: async () => iteration > refuseFrom ? new Response("refused", { status: 500 }) : new Response("wire"),
+    async *parseStream() { yield* events; },
+  };
+  const parsed: OcxParsedRequest = {
+    modelId: "fixture", stream: true, options: {}, context: { messages: [], tools: [buildWebSearchTool()] },
+  };
+  const response = await runWithWebSearch({
+    parsed, adapter, backend: "exa", exaApiKey: "fixture", hostedTool: { type: "web_search" },
+    settings: { model: "fixture", reasoning: "low", timeoutMs: 1000 }, maxSearches: 1,
+    incomingMeta: { headers: new Headers(), translatorBudget: createTestTranslatorBudget() },
+    onUsage: u => reported.push(u),
+  });
+  const text = await response.text();
+  const terminal = text.split("\n").filter(line => line.startsWith("data: {")).map(line => JSON.parse(line.slice(6)))
+    .find(frame => frame.type === "response.completed" || frame.type === "response.failed");
+  return { reported, text, clientUsage: terminal?.response?.usage };
+}
+
+describe("web-search loop iteration usage", () => {
+  test("search passes are added to the final answer's usage", async () => {
+    const { reported, text, clientUsage } = await drive([
+      search("first", usage(1000, 50, { cachedInputTokens: 0, cacheCreationInputTokens: 900, contextTotalTokens: 1050 })),
+      answer(usage(1400, 80, { cachedInputTokens: 900, cacheReadInputTokens: 900, contextTotalTokens: 1480 })),
+    ]);
+    expect(text).toContain("response.completed");
+    expect(reported).toHaveLength(1);
+    expect(reported[0]).toMatchObject({
+      inputTokens: 2400, outputTokens: 130, totalTokens: 2530,
+      cachedInputTokens: 900, cacheReadInputTokens: 900, cacheCreationInputTokens: 900,
+      // An absolute context checkpoint is the last iteration's, never a sum.
+      contextTotalTokens: 1480,
+    });
+    // Client wire derives input from the last checkpoint: 1480 - 80.
+    expect(clientUsage).toMatchObject({ input_tokens: 1400, output_tokens: 80, total_tokens: 1480 });
+  });
+
+  test("the empty forced answer that was retried is counted too", async () => {
+    const { reported, text, clientUsage } = await drive([
+      search("first", usage(1000, 50)),
+      [{ type: "done", usage: usage(1400, 5) }],
+      answer(usage(1500, 80)),
+    ]);
+    expect(text).toContain("response.completed");
+    expect(reported).toEqual([expect.objectContaining({ inputTokens: 3900, outputTokens: 135, totalTokens: 4035 })]);
+    expect(clientUsage).toMatchObject({ input_tokens: 1500, output_tokens: 80, total_tokens: 1580 });
+  });
+
+  test("an in-stream failure after a search still reports the iterations already sent", async () => {
+    const { reported, text, clientUsage } = await drive([search("first", usage(1000, 50)), answer(usage(1, 1))], 1);
+    expect(text).toContain("response.failed");
+    expect(clientUsage).toBeFalsy();
+    expect(reported).toEqual([expect.objectContaining({ inputTokens: 1000, outputTokens: 50 })]);
+  });
+
+  test("a translator-budget failure after a search still reports the iterations already sent", async () => {
+    const { reported, text } = await drive([
+      search("first", usage(1000, 50)),
+      [{ type: "error", status: 502, code: "translation_buffer_limit", message: "over budget" }],
+    ]);
+    expect(text).toContain("translation_buffer_limit");
+    expect(reported).toEqual([expect.objectContaining({ inputTokens: 1000, outputTokens: 50 })]);
+  });
+
+  test("an earlier iteration's checkpoint and raw usage never stand in for the final terminal's", async () => {
+    const { reported } = await drive([
+      search("first", usage(1000, 50, { contextTotalTokens: 1050, rawUsage: { iteration: 1 } })),
+      answer(usage(1400, 80)),
+    ]);
+    expect(reported).toHaveLength(1);
+    expect(reported[0]).toMatchObject({ inputTokens: 2400, outputTokens: 130 });
+    expect(reported[0]?.contextTotalTokens).toBeUndefined();
+    expect(reported[0]?.rawUsage).toBeUndefined();
+  });
+});
diff --git a/tests/web-search/web-search-rotation-usage-attribution.test.ts b/tests/web-search/web-search-rotation-usage-attribution.test.ts
new file mode 100644
index 00000000000..25ef1df1b66
--- /dev/null
+++ b/tests/web-search/web-search-rotation-usage-attribution.test.ts
@@ -0,0 +1,117 @@
+/**
+ * A web-search turn whose second round is refused with a 429 rotates the OAuth account and
+ * splits the request into two attempt rows. Each row must carry the usage its own account spent:
+ * the search round billed account 0, the answer round billed account 1. Reporting the loop's
+ * total once at the end put both rounds on account 1 and left account 0's row empty.
+ */
+import { afterAll, afterEach, beforeAll, beforeEach, expect, mock, test } from "bun:test";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { clearGenericFailoverHealth } from "../../src/oauth/generic-account-failover";
+import { getAccountSet, saveCredential, setActiveAccount } from "../../src/oauth/store";
+import { addFinalRequestLog, type RequestLogContext, type RequestLogEntry } from "../../src/server/request-log";
+import type { OcxConfig } from "../../src/types";
+import { removeTreeWithRetry } from "../helpers/remove-tree";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
+
+const previousHome = process.env.OPENCODEX_HOME;
+let testHome = "";
+let releaseSpendHome: (() => void) | undefined;
+let handleResponses: typeof import("../../src/server/responses")["handleResponses"];
+
+function chatSse(promptTokens: number, completionTokens: number, delta: object, finishReason: string): Response {
+  const chunks = [
+    { id: "c1", object: "chat.completion.chunk", choices: [{ index: 0, delta: { role: "assistant", ...delta }, finish_reason: null }] },
+    { id: "c1", object: "chat.completion.chunk", choices: [{ index: 0, delta: {}, finish_reason: finishReason }] },
+    { id: "c1", object: "chat.completion.chunk", choices: [],
+      usage: { prompt_tokens: promptTokens, completion_tokens: completionTokens, total_tokens: promptTokens + completionTokens } },
+  ];
+  return new Response(`${chunks.map(chunk => `data: ${JSON.stringify(chunk)}\n\n`).join("")}data: [DONE]\n\n`,
+    { headers: { "content-type": "text/event-stream" } });
+}
+
+beforeAll(async () => {
+  // Copied before mocking: the live namespace would resolve to the mock itself.
+  const actualWebSearch = { ...await import("../../src/web-search") };
+  mock.module("../../src/web-search", () => ({
+    ...actualWebSearch,
+    shouldResolveOpenAiWebSearchSidecar: () => false,
+    // exa without a key answers each search with an error result, so no search leaves the process.
+    planWebSearch: () => ({
+      backend: "exa",
+      hostedTool: { type: "web_search" },
+      settings: { model: "fixture", reasoning: "low", timeoutMs: 1_000 },
+      maxSearches: 1,
+    }),
+  }));
+  ({ handleResponses } = await import("../../src/server/responses"));
+});
+
+beforeEach(() => {
+  testHome = mkdtempSync(join(tmpdir(), "ocx-sidecar-usage-attribution-"));
+  process.env.OPENCODEX_HOME = testHome;
+  clearGenericFailoverHealth();
+  releaseSpendHome = acquireOwnedSpendHome();
+});
+
+afterEach(() => {
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
+  clearGenericFailoverHealth();
+  removeTreeWithRetry(testHome);
+});
+
+afterAll(() => {
+  if (previousHome === undefined) delete process.env.OPENCODEX_HOME;
+  else process.env.OPENCODEX_HOME = previousHome;
+  mock.restore();
+});
+
+test("each attempt row carries the usage of the account that served its rounds", async () => {
+  for (const accountId of ["first", "second"]) {
+    await saveCredential("xai", {
+      access: `access-${accountId}`, refresh: `refresh-${accountId}`, expires: Date.now() + 3_600_000, accountId,
+    });
+  }
+  await setActiveAccount("xai", getAccountSet("xai")!.accounts[0]!.id);
+  const sends: string[] = [];
+  const config = {
+    port: 0,
+    defaultProvider: "xai",
+    providers: {
+      xai: {
+        adapter: "openai-chat",
+        baseUrl: "https://api.x.ai/v1",
+        authMode: "oauth",
+        models: ["model"],
+        fetch: (async (_input, init) => {
+          sends.push(new Headers(init?.headers).get("authorization") ?? "");
+          if (sends.length === 1) {
+            return chatSse(100, 10, { tool_calls: [{ index: 0, id: "call_1", type: "function",
+              function: { name: "web_search", arguments: JSON.stringify({ query: "fixture" }) } }] }, "tool_calls");
+          }
+          if (sends.length === 2) return new Response("rate limited", { status: 429, headers: { "retry-after": "30" } });
+          return chatSse(300, 30, { content: "answer" }, "stop");
+        }) as typeof fetch,
+      },
+    },
+  } as unknown as OcxConfig;
+  const logCtx = { model: "", provider: "" } as RequestLogContext;
+
+  const response = await handleResponses(new Request("http://localhost/v1/responses", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ model: "xai/model", input: "search", stream: true, tools: [{ type: "web_search" }] }),
+  }), config, logCtx);
+  expect(response.status).toBe(200);
+  await response.text();
+  expect(sends).toEqual(["Bearer access-first", "Bearer access-first", "Bearer access-second"]);
+
+  let entry: RequestLogEntry | undefined;
+  addFinalRequestLog("req-attribution", Date.now(), logCtx, 200, undefined, logged => { entry = logged; });
+  const rows = entry?.attempts ?? [];
+  expect(rows).toHaveLength(2);
+  expect(rows[0]!.accountLogLabel).not.toBe(rows[1]!.accountLogLabel);
+  expect(rows.map(row => [row.usage?.inputTokens, row.usage?.outputTokens])).toEqual([[100, 10], [300, 30]]);
+});