@@ -5,12 +5,14 @@
 
   * plumbing — the wrappers declare the input (default '') and the optional
     ANTHROPIC_API_KEY, and pass both to the base unchanged;
-  * exactly one runner — the Cursor job is gated on the input being empty, the
-    separate `axis-direct` job (hard-pinned to `ubuntu-latest`) on it being
-    set, and nothing falls back;
+  * exactly one runner — the Cursor job runs when the input is empty or
+    `axis-probe` found the direct key unusable, the separate `axis-direct` job
+    (hard-pinned to `ubuntu-latest`) when the probe picked direct; nothing
+    falls back once the direct runner runs;
   * confinement — the cells' flags: Read/Grep/Glob, `--restricted`,
     `--setting-sources ""`, /proc and /sys denied, never `--bare`;
-  * the key is referenced by the `axis-direct` job alone, never the Cursor job;
+  * the key is referenced by the `axis-direct` and `axis-probe` jobs alone,
+    never the Cursor job;
   * usage — `usage-direct-axis-<axis>-<model>`, the cells' script byte for byte
     but for the result path, best effort and time-boxed;
   * the API-error diagnostic — agent-error.py runs on the OUTCOME, not on the
@@ -30,8 +32,10 @@
 HERE = os.path.dirname(os.path.abspath(__file__))
 ROOT = os.path.normpath(os.path.join(HERE, "..", "..", ".."))
 WORKFLOWS = os.path.join(ROOT, ".github", "workflows")
-DIRECT_IF = "inputs.axis_direct_model != ''"
-CURSOR_IF = "inputs.axis_direct_model == ''"
+PROBE_IF = "inputs.axis_direct_model != ''"
+DIRECT_IF = "${{ !cancelled() && needs.axis-probe.outputs.runner == 'direct' }}"
+CURSOR_IF = ("${{ !cancelled() && (inputs.axis_direct_model == '' "
+             "|| needs.axis-probe.outputs.runner == 'cursor') }}")
 
 
 def read(name):
@@ -68,6 +72,7 @@ def run_block(step_text):
 BASE = read("cursor-axis-base.yml")
 CURSOR_JOB = job(BASE, "axis")
 DIRECT_JOB = job(BASE, "axis-direct")
+PROBE_JOB = job(BASE, "axis-probe")
 # Without comment lines, for the "never mentioned" checks below.
 CURSOR_CODE = "\n".join(ln for ln in CURSOR_JOB.split("\n") if not ln.lstrip().startswith("#"))
 DIRECT_CODE = "\n".join(ln for ln in DIRECT_JOB.split("\n") if not ln.lstrip().startswith("#"))
@@ -100,7 +105,8 @@ def test_the_id_is_validated_and_never_combined_with_context_tools(self):
         # The run names its runner, on both paths.
         self.assertIn("::notice::", check)
         self.assertEqual(check.count("GITHUB_STEP_SUMMARY"), 1)
-        self.assertEqual(CURSOR["Check inputs"].count("GITHUB_STEP_SUMMARY"), 1)
+        # Once on each branch: the plain line, or the one naming a fallback.
+        self.assertEqual(CURSOR["Check inputs"].count("GITHUB_STEP_SUMMARY"), 2)
         # The direct job reads neither, so it does not gate on them.
         self.assertNotIn("inputs.model", DIRECT_JOB)
         self.assertNotIn("inputs.runs_on", DIRECT_JOB)
@@ -128,10 +134,13 @@ def test_the_check_executes(self):
 
 class ExactlyOneRunner(unittest.TestCase):
     def test_each_job_is_gated_on_the_input(self):
+        self.assertIn(f"\n    if: {PROBE_IF}\n", PROBE_JOB)
         self.assertIn(f"\n    if: {CURSOR_IF}\n", CURSOR_JOB)
         self.assertIn(f"\n    if: {DIRECT_IF}\n", DIRECT_JOB)
+        for body in (CURSOR_JOB, DIRECT_JOB):
+            self.assertIn("\n    needs: axis-probe\n", body)
         self.assertEqual(re.findall(r"^  ([A-Za-z0-9_-]+):$", BASE[BASE.index("\njobs:\n"):], re.MULTILINE),
-                         ["axis", "axis-direct"])
+                         ["axis-probe", "axis", "axis-direct"])
 
     def test_the_direct_job_is_hosted_and_named_apart(self):
         # Never the caller's `runs_on` pool, as cursor-review's direct cells.
@@ -144,6 +153,9 @@ def test_each_job_carries_only_its_own_runner(self):
         self.assertNotIn("cursor-agent", DIRECT_CODE)
         self.assertNotIn("install-cursor-cli", DIRECT_CODE)
         self.assertNotIn("axis_direct_model", CURSOR_CODE.replace(f"if: {CURSOR_IF}", ""))
+        # The probe runs no reviewer and checks nothing out.
+        for word in ("claude", "cursor-agent", "actions/checkout", "uses:"):
+            self.assertNotIn(word, PROBE_JOB.replace("claude-", ""), word)
 
     def test_no_fallback_a_missing_key_fails_the_axis(self):
         body = run_block(STEPS["Check the Anthropic API key"])
@@ -181,7 +193,11 @@ def test_the_key_is_only_in_the_direct_job(self):
             if "secrets.ANTHROPIC_API_KEY" in body:
                 self.assertIn(name, ("Check the Anthropic API key", "Run the axis (direct)",
                                      "Extract the verdict"), name)
-        self.assertEqual(BASE.count("secrets.ANTHROPIC_API_KEY"), DIRECT_JOB.count("secrets.ANTHROPIC_API_KEY"))
+        self.assertEqual(BASE.count("secrets.ANTHROPIC_API_KEY"),
+                         DIRECT_JOB.count("secrets.ANTHROPIC_API_KEY") + PROBE_JOB.count("secrets.ANTHROPIC_API_KEY"))
+        # The probe job is hosted and checks nothing out (asserted above).
+        self.assertIn("\n    runs-on: ubuntu-latest\n", PROBE_JOB)
+        self.assertNotIn("CURSOR_API_KEY", PROBE_JOB)
         self.assertNotIn("CURSOR_API_KEY", DIRECT_JOB)
 
     def test_every_stdin_python_with_the_key_is_isolated(self):
 
@@ -328,7 +328,7 @@ jobs:
 |---|---|---|---|
 | Secret | `CURSOR_API_KEY` | **yes** | Bills the panel + judge `cursor-agent` calls. |
 | Secret | `OPENAI_API_KEY` | no | Only with `openai_direct_model`: bills the optional direct-OpenAI cells. Use a project-scoped service-account key with a spend limit. |
-| Secret | `ANTHROPIC_API_KEY` | no | Only with `anthropic_direct_model` or `judge_direct_model`: bills the optional direct-Anthropic cells and direct judge. Use a key scoped to its own Anthropic workspace with a spend limit, never a personal key. |
+| Secret | `ANTHROPIC_API_KEY` | no | Only with `anthropic_direct_model` or `judge_direct_model`: bills the optional direct-Anthropic cells and direct judge. Use a key scoped to its own Anthropic workspace with a spend limit, never a personal key. A key that hits that limit falls back to Cursor for the run (see `anthropic_direct_model`). |
 | Secret | `SLACK_BOT_TOKEN` | no | Enables start/complete DMs to the triggerer. |
 | Variable | `CURSOR_REVIEW_DM_EMAIL_MAP` | no | Maps GitHub logins → emails for Slack DM lookup. |
 
@@ -393,10 +393,10 @@ All optional except `workflows_ref` (required, no default) — pass them under
 | `panel_models` | `''` (built-in list) | JSON array of Cursor model ids that **replaces** the panel list; each still runs both review types and is validated against the live catalog by preflight. For per-repo experiments (e.g. `-xhigh` vs `-max` tiers). |
 | `openai_direct_model` | `''` (off) | OPT-IN. An OpenAI model id reviewed through the OpenAI API directly (pinned Codex CLI, `package.json` here) as two cells (**adversarial** + **edge-case**, the Cursor cells' prompts) on GitHub-hosted runners, by default **replacing** the Cursor `gpt-*` cells (next row). Needs the `OPENAI_API_KEY` secret and a plain id (`[A-Za-z0-9._-]`); without either, preflight warns and leaves the cells off and the panel unchanged. Not part of `panel_models` (not in the Cursor catalog). Whether the cells gate depends on the next row. |
 | `openai_direct_replaces_cursor_openai` | `true` | When the direct cells are in effect, drop the Cursor `gpt-*` cell(s) so the OpenAI lane is reviewed once — the direct cells then **gate** like the Cursor cells they replace: counted in `Panel integrity` and the auto-approve gate, a failed one red in the rollup and named `(direct, <status>)` in the review's "did not contribute" line. `false` runs both for a side-by-side backend comparison, with the direct cells **advisory** (findings reach the judge; never counted, never red). Preflight fails rather than leave the Cursor panel empty. |
-| `anthropic_direct_model` | `''` (off) | OPT-IN. The Anthropic twin of `openai_direct_model`: an Anthropic model id (e.g. `claude-opus-5-5`) reviewed through the Anthropic API directly (pinned Claude Code CLI, `package.json` here) as two cells on GitHub-hosted runners, by default **replacing** the Cursor `claude-*` cells. Needs the `ANTHROPIC_API_KEY` secret and a plain id other than `openai_direct_model`'s; without any of those, preflight warns and leaves the cells off and the panel unchanged. The agent also reads a **read-only PR checkout** (symlinks removed) with Read, Grep and Glob only — no Bash or code-running tool — confined to it by `--restricted`, with `/proc` and `/sys` also denied by explicit deny rules. This panel reviews private-repo diffs and the workflow cannot check the Anthropic organization's data-retention terms: callers on private repos must use a key from an organization with zero data retention. Each cell also uploads a `usage-direct-<review_type>-<model>` artifact (kept 30 days) with the API's token counts for that cell, so cost can be measured without an Admin API key. |
+| `anthropic_direct_model` | `''` (off) | OPT-IN. The Anthropic twin of `openai_direct_model`: an Anthropic model id (e.g. `claude-opus-5-5`) reviewed through the Anthropic API directly (pinned Claude Code CLI, `package.json` here) as two cells on GitHub-hosted runners, by default **replacing** the Cursor `claude-*` cells. Needs the `ANTHROPIC_API_KEY` secret and a plain id other than `openai_direct_model`'s; without any of those, preflight warns and leaves the cells off and the panel unchanged. **A capped or unusable key falls back to Cursor for that run:** before each round the hosted `gate` job makes one 1-token Anthropic call per configured model; a usage-limit or billing refusal, a 401/403, or a 429/529/5xx still failing after retries makes preflight treat the key as absent — the Cursor `claude-*` cells and the Cursor judge run. You can tell from the run: a `::warning::` per lane on the `preflight` job naming the reason class and, for a usage limit, its reset time (never the API's raw message, which can name the organization), a `fell back to Cursor` line in its job summary, and an italic note under the posted review's header. Any other refusal (an unrecognised 4xx; a redirect, never followed) falls back too. An unknown model id (404) fails the run instead; a typo never falls back. A dash-free Claude Code alias (`opus`, `sonnet`) is not probed — the raw API does not know it — so it runs direct as before. If `panel_models` has no `claude-*` id, there is no Cursor cell to fall back to: the warning, summary and note say no Anthropic review cell ran. The agent also reads a **read-only PR checkout** (symlinks removed) with Read, Grep and Glob only — no Bash or code-running tool — confined to it by `--restricted`, with `/proc` and `/sys` also denied by explicit deny rules. This panel reviews private-repo diffs and the workflow cannot check the Anthropic organization's data-retention terms: callers on private repos must use a key from an organization with zero data retention. Each cell also uploads a `usage-direct-<review_type>-<model>` artifact (kept 30 days) with the API's token counts for that cell, so cost can be measured without an Admin API key. |
 | `anthropic_direct_effort` | `xhigh` | `--effort` for the direct Anthropic cells: `low`, `medium`, `high`, `xhigh` or `max`; anything else warns and falls back to `xhigh`. |
 | `anthropic_direct_replaces_cursor_anthropic` | `true` | As `openai_direct_replaces_cursor_openai`, for the Cursor `claude-*` cells. Each lab counts by its own flag. Never touches `judge_model`. |
-| `judge_direct_model` | `''` (off) | OPT-IN. An Anthropic model id (e.g. `claude-opus-5-5`) that runs the **judge** through the Anthropic API directly instead of `judge_model` through Cursor, with the same pinned Claude Code CLI and `ANTHROPIC_API_KEY` as `anthropic_direct_model`. Needs that secret and a plain id (`[A-Za-z0-9._-]`, at most 100); without either, preflight warns and the Cursor judge runs. Same prompt, structured-output tool, step timeout and degraded panel-union fallback as the Cursor judge; the agent reads the PR checkout (symlinks removed) with Read, Grep and Glob only — no Bash or code-running tool — confined to it by `--restricted`, with `/proc` and `/sys` also denied by explicit deny rules. A final review containing the key is replaced by the error seed, so the panel union posts instead; the log shows the judge's status and finding count only. The judge runs in its own `judge-direct` job on GitHub-hosted `ubuntu-latest`, whatever `runs_on` says, so the key never reaches `consolidate`. This judge reads private-repo diffs and the workflow cannot check the Anthropic organization's data-retention terms: callers on private repos must use a key from an organization with zero data retention. The judge also uploads a `usage-direct-judge-<model>` artifact (kept 30 days) with the API's token counts for the judge, the same record the direct cells upload. |
+| `judge_direct_model` | `''` (off) | OPT-IN. An Anthropic model id (e.g. `claude-opus-5-5`) that runs the **judge** through the Anthropic API directly instead of `judge_model` through Cursor, with the same pinned Claude Code CLI and `ANTHROPIC_API_KEY` as `anthropic_direct_model`. Needs that secret and a plain id (`[A-Za-z0-9._-]`, at most 100); without either, preflight warns and the Cursor judge runs — and likewise when the key is capped or unusable for the run (see `anthropic_direct_model`). Same prompt, structured-output tool, step timeout and degraded panel-union fallback as the Cursor judge; the agent reads the PR checkout (symlinks removed) with Read, Grep and Glob only — no Bash or code-running tool — confined to it by `--restricted`, with `/proc` and `/sys` also denied by explicit deny rules. A final review containing the key is replaced by the error seed, so the panel union posts instead; the log shows the judge's status and finding count only. The judge runs in its own `judge-direct` job on GitHub-hosted `ubuntu-latest`, whatever `runs_on` says, so the key never reaches `consolidate`. This judge reads private-repo diffs and the workflow cannot check the Anthropic organization's data-retention terms: callers on private repos must use a key from an organization with zero data retention. The judge also uploads a `usage-direct-judge-<model>` artifact (kept 30 days) with the API's token counts for the judge, the same record the direct cells upload. |
 | `judge_direct_effort` | `xhigh` | `--effort` for the direct judge: `low`, `medium`, `high`, `xhigh` or `max`; anything else warns and falls back to `xhigh`. |
 | `cell_timeout_minutes` | `15` | Wall-clock cap on one reviewer cell's agent step (Cursor or direct). Over it the cell exits 130, uploads `status: error` with no findings, reddens its leg and fails `Panel integrity`. Shared by the cell's in-step retries, so it bounds attempts + backoff. Derives three more caps that cannot be set alone: cell job = this + 15, `Run judge` step = max(30, this × 2), judge job = that + 10. At the default: 15 / 30 / 30 / 40, today's values exactly. Preflight bounds it 10–45. |
 | `skip_bot_branch_prefixes` | `ci/bump- chore/refresh- auto/refresh-` | Skip the panel when the PR author is a Bot **and** the head branch starts with one of these prefixes (machine pin bumps / catalog refreshes). `''` reviews every bot PR. |
 
@@ -3006,6 +3006,14 @@ def main():
             "or the 'context unavailable' banner. Empty/absent renders nothing."
         ),
     )
+    parser.add_argument(
+        "--runner-note",
+        default=None,
+        help=(
+            "Which runner a lane fell back to, e.g. the direct Anthropic lanes on "
+            "Cursor after the key probed unusable. Empty/absent renders nothing."
+        ),
+    )
     args = parser.parse_args()
 
     attribution = f"\n\n_Triggered by @{args.triggered_by}._" if args.triggered_by else ""
@@ -3035,6 +3043,10 @@ def main():
         # banner case matters most: a re-review that ran WITHOUT prior context
         # must never look identical to a genuine first-round review.
         banners += f"\n\n_{neutralize_mentions(args.ledger_note.strip())}_"
+    if args.runner_note and args.runner_note.strip():
+        # A fallback is a different panel than the caller configured: say so,
+        # or a Cursor-judged round reads as a direct-judged one.
+        banners += f"\n\n_{neutralize_mentions(args.runner_note.strip())}_"
     header += banners
     review_header += banners