[GidonFrischkorn]

Closes the CI part of #438 (ADR 0003). No fit file is moved or removed here.

What the checks do

file-size (new; PRs into master, develop and dev-*) fails a PR when any commit in it adds a blob above 1 MiB, even if a later commit deletes the file. A merge commit keeps every commit of the PR, so a blob that a PR adds and removes still lands in the history for good (a squash merge would not, but the check cannot know which one will be used). The step names the path and commit of every blob over the limit. A blob held anywhere in the history of the base or of origin/develop passes, so renames, forward merges and restores of the fits tracked today (32 files, 150.6 MiB, in vignettes/articles/assets/; 87 .rds blobs, 471.8 MiB, reachable from develop) do not trip it. It also runs on edited, which is what retargeting a stacked PR raises.

The first version compared the PR tip with the base. A PR that added a 2 MB fit and deleted it in the next commit passed that scan. The new scan fails it.

pkgdown (changed):

• A new step after the fits download checks every string-literal file = that an evaluated R chunk passes to bmm(), brm(), readRDS() or read_rds(), in the articles pkgdown builds (vignettes/**/*.[Rrq]md without _-prefixed files and vignettes/tutorials/). A fits/ file must be in the release, any other file must be tracked. It fails, naming the article and the file, when one is missing or readRDS() cannot read it. A fits/ path it cannot check fails too: a positional readRDS("fits/<name>"), a path built with paste0() or file.path(), a file = of any other function except a writer, and inline code that names one. With this step the no-release case (HTTP 404) stays a harmless no-op. No article loads from fits/ yet. On the current tree it checks 26 references in 16 articles, all in assets/, with 0 problems.
• The job is skipped for the release event of the article-fits tag. Creating that release fires release: published (a pre-release does too), and without the guard the job builds the tagged commit and deploys it to gh-pages.

CONTRIBUTING states this scope.

Changes after review

• The fit step moved from the workflow YAML to .github/scripts/check-article-fits.R.
• The scanner follows knitr's fence rule: a chunk opens at any ```{r …} header line and #| options count only at the top of the chunk. Four shapes were missed before: a chunk shown inside a longer fenced block, a {r} header after an unclosed plain fence, a chunk that is never closed, and #| eval: false after the first line of code.
• Files that pkgdown does not build (_-prefixed, vignettes/tutorials/) are not checked.
• Every string-literal file = passed to bmm(), brm(), readRDS() or read_rds() is checked, assets/... as well as fits/.... A fits/ file must be in the release, any other file must be tracked. .rds is appended only where bmm() and brm() append it; readRDS() and read_rds() paths are checked as written.
• A file = passed to a writer (saveRDS(), save(), write_rds(), write.csv(), write.table(), writeLines(), cat(), sink(), ggsave(), png(), jpeg(), pdf(), svg()) is ignored. Any other file =, such as read.csv(file = "assets/data.csv") or update(fit, file = "assets/x"), is ignored unless it names a fits/ path, which fails because it cannot be checked. update() is in neither list: update.bmmfit() only writes file, but update() of a brm() fit reads it.
• The step stops with an error when there is no vignettes/ folder, so a changed working directory cannot turn it into a silent pass.
• The widened check found three missing assets/ fits in evaluated chunks on the stale branch 308-hypothesis-testing-article (assets/bmmfit_postestimation_{sdm,sdm_null,mix2p}). The old step looked only at fits/ paths and did not see them.
• file-size fails when an object cannot be fetched.
• The annotation shows the short commit.

The limit

I set it at 1 MiB. That settles the open line in ADR 0003, whose text is not edited here.

Branches that fail today

Measured against origin/develop (c47e6f9) for the 57 remote branches other than develop and gh-pages:

Branch	Large blob	What it has to do
race-lnr (#501)	bmmfit_lnr_hierarchical_vignette.rds, 3.3 MB	Upload the fit to the release first, load it from fits/, and drop the commit that added it from the branch. A later delete does not help.
352-log-normal-race-model	the same fit	Superseded by race-lnr.
mv-article	three fits, 8.1 MB	Same as race-lnr.
reliability	tests/testthat/assets/bmmfit_sdm_reliability.rds, 1.45 MB	A test fixture, not an article fit. Shrink it below 1 MiB or decide on an exception.
feature/chkptstanr	stale checkpoint files	Nothing, unless revived.

Not covered

• The workflows have not run on GitHub, and actionlint is not installed. The file-size block was run as text extracted from the YAML, and the fit check as Rscript .github/scripts/check-article-fits.R.
• file-size is not a required check. Today develop requires only the three R-CMD-check jobs, so a red file-size blocks nothing until it is added.
• A PR runs the workflow files of its own merge commit, so a PR that edits file-size.yaml can weaken its own check. Review of .github/ is the guard. This is inferred from the docs and was not run.
• The fit step sees string-literal file = arguments to bmm(), brm(), readRDS() and read_rds() in evaluated R chunks. It does not see sourced code, child documents, or a directory held in a variable. It only reads the fit, so a readable fit from the wrong model passes.
• Not confirmed from the GitHub docs: that uploading assets to an existing release fires no event. The docs list seven release activity types and none concerns assets. Also untested: whether a job skipped by if still takes the pkgdown concurrency slot.

What was run

• Scan: 15 scratch repos, 5 in a scratch partial clone, and 19 real ranges in a fresh blob:none clone of the repository, all as expected (16 of the real ranges also in the full local repo). It fails an add-then-delete, a large base file rewritten to a smaller large file, a large blob that exists only in a merge resolution, a blob on a merged side branch, and 1,048,577 bytes. It passes a rename, 1,048,576 bytes, a dev-* base whose PR head merged a develop that holds a large fit, and a restore of a fit that develop or the base had deleted earlier. Controls: pointing origin/develop elsewhere makes the dev-* range fail.
• Real ranges that fail: docs: From brms to bmm article (#390) #470 (two 2.1 MB fits; origin/develop pinned to the PR base because the PR is merged) and origin/race-model-core..origin/race-lnr. Real ranges that pass: Add multinomial processing tree models with mpt() (MPT 1/6, #255) #484 to MPT article, ppp(), mpt_data_reshape() and mpt() API changes (MPT 6/6, #255) #489, Add trial-to-trial variability in non-decision time (sndt) to cswald() (#387) #406, Add the shared infrastructure for the race models (lba, lnr, rdm) #499, Add the Linear Ballistic Accumulator (lba) on the shared race core (#349) #500, Add the Racing Diffusion Model (rdm) on the shared race core (#353) #502, Add the psychometric function model (psychometric()) #507, fix(conditional_effects): ask brms only for a parameter's own effects on the multinomial route #515, merge dev-1.5.0 into dev-1.6.0 #516, and origin/dev-1.5.0..origin/434-circmix-equivalence.
• Cost: the largest range is dev-1.5.0..434-circmix-equivalence with 180 blobs; mpt(): design-fixed covariates and impossible categories (MPT 3/6, #255) #486 has 138 and Add multinomial processing tree models with mpt() (MPT 1/6, #255) #484 125. A PR range takes 0.6 to 0.9 s cold in a fresh clone and 0.2 s warm. Looking blobs up one by one in a blob:none clone takes 0.4 s each and aborts after about 50 (48 blobs in 20.6 s, then a fatal error), so the step lists them with --missing=print and fetches them in one request. A filter: blob:limit=1m checkout would also work (clone 3.4 s, 52 MB .git, same set of oversize blobs); it is not part of this PR.
• Fit step: 33 scratch article folders (missing fit, truncated .rds, non-literal paths, prose and comment mentions, eval = FALSE, blockquote and nested fences, subfolders, .qmd, Latin-1), all as expected, plus the real vignettes (26 references, 0 problems). 17 more scratch folders cover the reader rule (readers, writers, .RDS case for readRDS(), bmm() and brm(), a reader nested in a writer, positional and computed fits/ paths, a missing vignettes/), all as expected. The vignettes/ of nine branches give the same counts before and after the rule: develop, 255-mpt-article, 434-circmix-equivalence, dev-1.5.0 and this branch 26, mv-article and race-lnr 30, 136-vwm-change-detection 7, all with 0 problems; 308-hypothesis-testing-article 9 with 3 problems.
• An independent review (a fresh opus agent) found the restore false positive, the missing edited trigger, the fits the step could not see and the references it rejected for no reason. The second review's findings are fixed in the commits listed under Changes after review.

After merging

Merge this PR first. A release event runs the workflow file at the tagged commit, so the guard has to be on develop before the release exists. Then create the release, then mark file-size required on develop and dev-* (repository settings, branch protection or rulesets, required status checks; the check is offered once it has run on a PR).

gh release create article-fits \
  --prerelease --latest=false \
  --target develop \
  --title "Article fits" \
  --notes "Cached fits for the articles (ADR 0003)"

A normal release would become "Latest", and install_github("popov-lab/bmm@*release") would resolve to it.

Optional follow-up for #489

The MPT article fits three models on every site build (fit-2htm, fit-ol, fit-ol-restricted; none uses file =). Uploading those fits to the release and adding file = "fits/..." would end that. It needs the release first, so it is not part of this PR.