fix(ai): never wedge on a 0-token empty completion when thinking is off (RIG-2806)

[rigel-mintaka]

My removal of this test was justified by a diagnosis that was wrong. I called
it non-hermetic under the parallel runner; the real cause is that it called
streamOpenAICompletions with no apiKey, so openai-completions.ts:719 fell back
to getEnvApiKey(). My shell exports LITELLM_API_KEY and CI does not, so the
request failed the missing-key check before fetch was reached, captured stayed
undefined, and body.length read 0 -- exactly CI's reported failure. It never
depended on parallelism, and the name-collision claim was unsupported.

Restored with apiKey: "test-key", matching the 28 other sites in this file.
Verified as a four-cell differential rather than a single pass: the old form
fails without a provider key and passes with one; the restored form passes
both ways. Full package under CI's flags in a credential-free environment:
4442 pass / 332 skip / 0 fail.

Also corrects two false claims in the comment that justified the removal.
convertMessages' result is not sent verbatim -- maybeAddAnthropicCacheControl
mutates it in place at :1809 before the assignment at :1810, and
markLatestStableChatCompletionsCacheBreakpoint rewrites elements at :1639.
Those steps only enrich the array (no step removes a message), which is the
property the argument actually needs, so the conclusion held while its stated
reasoning did not. The retry-timing rationale was also false: a first attempt
carrying visible content commits immediately, so the wrapper never engages.

Documents that the completedMessage re-check in the fail-closed guard is
redundant at runtime but load-bearing for TypeScript's narrowing; removing it
produces TS18048 + TS2345.

Co-authored-by: Matt Wilkinson matt@rigel.build

[linear-code]

RIG-2806

[rigel-mintaka]

CI red is an unrelated flake, not this diff

The required CI gate is red via Test coding-agent native/unit (TS). That is a flaky Chromium browser E2E, unrelated to this PR — filed as RIG-3377.

Evidence — same SHA, same job, opposite verdicts (both runs attributed to this PR, both at 925a90f30646):

run	Test coding-agent native/unit (TS)
34016457096	failure
34016536175	success

(fail) browser facade Chromium helper E2E > drives a real page through direct helpers, handles, waits, and function and code runs [30000.23ms]
ToolError: Browser open timed out after 30000ms

It launches a real Chromium and time-gates it at 30s, so it fails whenever the runner misses the window. This diff touches zero coding-agent files (packages/ai + one packages/catalog test only).

I have not re-run CI. A re-run against an unchanged tree is a retry, and AGENTS.md is explicit that a flake is a real bug to fix, not to retry. RIG-3377 asks the owning lane to event-gate the readiness signal.

Note on the PR number

This supersedes #21, which GitHub auto-closed after a stray local jj bookmark (a review subagent's scratch ref for taking pristine measurements) was pushed as a stack parent and hijacked #21's base. The base could not be repaired — GitHub returns 422 … part of a stack through every route — so jj-vine submit re-resolved the bookmark against main and opened this PR. Branch contents are unchanged; all 8 commits and 6 files carried over.

[rigel-mintaka]

Review loop closed — round 8 all clear, zero findings at any severity

Eight adversarial rounds. Head 1fc81805f58e, CI green at that exact sha (14 success / 9 skipped / 0 non-success); only REVIEW_REQUIRED blocks the merge.

The round-8 delta was a comment reduction. That sounds trivial and was the highest-risk part of the diff: seven consecutive versions of that four-line comment were factually false, and four of those were introduced by corrections to earlier versions. The failure modes were (a) annotating a line that turned out to be deletable with zero errors while the load-bearing line sat bare, (b) an under-listed error set, and (c) confusing a diagnostic's cause with its reported position. So version 8 stopped restating the claim and deleted the claim class: no error codes, no line numbers, no counts — only symbolic referents that survive line drift.

Comment clauses verified by a cell partition

cell	mutation (one variable)	diagnostics
baseline	none (pristine)	0
A	delete only the narrowing conjunct	6 (4x TS18048 + TS2345 + TS2322)
B	A + non-null-assert only the spread	5 (TS2322 gone, nothing else moved)
C	A + non-null-assert only the 5 conjuncts	1 (just TS2322, from the spread)
restore	byte-identical to the pushed sha	0

B and C are complements and their diagnostic sets partition A's exactly (5 + 1 = 6), so neither clause rides on the other's evidence — a gap or overlap would itself have been a finding. That partition is the check the earlier wrong-line version lacked.

The causation/position trap reproduced independently: TS2322 is reported at :203 (const errored: AssistantMessage = {) but caused by the ...completedMessage spread at :204. The final comment asserts no position, and a mechanical audit for the retired claim class (grep -oE 'TS[0-9]{4,5}|:[0-9]{2,4}|[0-9]+ errors') returns no match.

No regression from the earlier delete-then-restore

A wire-body test was deleted on a wrong CI diagnosis in an earlier round and later restored. Re-verified:

• Passes with both provider keys unset.
• Both assertion branches non-vacuous: blanking content to " " — present-but-empty, the exact wedge shape a length > 0 check misses — makes each fail.
• Against a narrow post-convertMessages message-dropper it is 1 fail / 77 pass, the sole catcher; the three sibling assertions on convertMessages' return value all stay green, so it is not redundant with them.

Totals and mechanism

packages/ai: 4442 pass / 332 skip / 0 fail, identical across 7 runs (6 credential-free + 1 with an ambient key, same expect() count) — the auth-sensitivity defect that caused the earlier CI-only failure is fully closed. packages/ai typecheck and format clean; house rules pass with fired positive and pattern controls.

The ollama fail-closed path was measured directly rather than inferred from red→green: ATTEMPTS=3, EVENTS=["start","error"] = 1 initial + MAX_EMPTY_COMPLETION_RETRIES (2), then a loud error terminal. A differential alone cannot distinguish a fix from a deletion, so every differential here is paired with an independently measured mechanism.

Notes

• The unidentified 1-in-5 packages/ai intermittent did not reproduce in 7 runs. Unverified, un-triaged, and not attributable to this diff.
• The flaky Chromium browser E2E (browser-prelude-facade.test.ts) is out of scope here and tracked separately; it now has a deterministic reproducer and an acceptance criterion. CI was deliberately not re-run on this PR to chase a green.