05_figures.R reports writing fig_main.pdf when the PDF device failed, and leaves Rplots.pdf behind #156

Revision: 6246c35 (main, after the v2.6.0 merge). Found by the verifier agent during the v2.6.0 pre-commit check; reproduced by hand.

Observed. On macOS without XQuartz (R 4.3.1), Rscript scripts/R/00_run_all.R exits 0 and logs Wrote …/output/fig_main.pdf. No fig_main.pdf exists, and a stray Rplots.pdf (7,977 bytes) appears in the working directory (the repo root). The log also shows failed to load cairo DLL.

Expected. Either output/fig_main.pdf exists, or the run stops with an error that names the missing figure. No file is written outside output/.

Root cause. capabilities("cairo") returns TRUE because cairo is compiled in, but the library fails to load at run time (Library not loaded: /opt/X11/lib/libXrender.1.dylib). The script picks cairo_pdf from capabilities() alone. The device never opens, so ggsave draws on R's default device, which is Rplots.pdf in the working directory, and the "Wrote" message prints anyway because nothing checks the file.

Reproducer. On a machine where capabilities("cairo") is TRUE but the cairo DLL cannot load:

Rscript scripts/R/00_run_all.R; ls output/ Rplots.pdf

Result: 1 of 1 runs on the affected machine. Control: fig_main.svg (via svglite) is written correctly in the same run.

Consequence. A promised artifact goes silently missing. A Beamer deck that includes output/fig_main.pdf then fails later, far from the cause. Meanwhile the log claims success, which breaks the script's own contract to fail loudly rather than skip a promised figure. The stray Rplots.pdf can also end up committed by accident.

Scope. scripts/R/05_figures.R only. Non-scope: installing cairo or XQuartz, and other scripts (none of the others write a figure).

Acceptance criteria.

1. The PDF device is chosen by actually opening it, not from capabilities(): cairo is used when it works, otherwise grDevices::pdf.
2. After each ggsave, the file must exist and be non-empty, or the script stops and names the file.
3. The "Wrote" message prints only after that check.
4. No Rplots.pdf is created.
5. On the affected machine the pipeline produces output/fig_main.pdf (through the fallback device) and exits 0, and the quality score stays at 100/100.