What

Add explicit guards in _query_openai() before accessing choices[0].message.content on both the primary and fallback model paths.

Why

openai.chat.completions.create() can return two distinct empty-response shapes:

1. choices = [] — on content-policy rejections, rate-limit errors, or provider failures
2. choices[0].message = None — Gemini 2.5 Flash (via the OpenAI-compatible endpoint) returns HTTP 200 with finish_reason: PROHIBITED_CONTENT and message=None rather than raising an exception

Both currently crash with IndexError or AttributeError. The outer except Exception catches these crashes silently, masking structural response issues as provider errors and incorrectly triggering the fallback model.

With the guards, a ValueError is raised explicitly so the fallback is only triggered by genuine provider-level failures, not malformed responses.

Change

# Before — crashes on empty choices or message=None
return completion.choices[0].message.content

# After — explicit guard
if not completion.choices or completion.choices[0].message is None:
    raise ValueError("LLM returned empty or filtered response")
return completion.choices[0].message.content

Applied to both the primary (gpt-5) and fallback (gpt-4.1) paths.

Corpus context

Detected by pact (llm_response_unguarded mode), a Z3-verified static analyzer for LLM crash vectors. This pattern was found in 13.5k+ violations across 761 repos.