Record gdalcubes read failures after open; drop items without a mask asset (#99)

[NewGraphEnvironment]

Summary

#87 made drift abort when gdalcubes fails to open an image. Reads that fail after the open still came back with chunk status OK. The worst is a cloud-mask (SCL) read that fails: the scene is used unmasked and cloud reaches the median. This PR does two things.

• The cause is fixed in gdalcubes, on our fork: NewGraphEnvironment/gdalcubes#2.
  • warp_simple() ignored ChunkAndWarpImage()'s return. It now returns nullptr, and gdalcubes' existing code marks the chunk INCOMPLETE.
  • A mask that fails to open is now recorded.
  • A worker chunk file the main process can't read back is now ERROR.
  • A worker killed by a signal no longer hangs write_ncdf(). The hang was the log printer spinning on a missing log file.
  • Upstream PR drafted, not posted: planning/archive/2026-10-issue-99-read-failures-after-open/upstream-pr-draft.md.
• drift side (Remotes: stays appelmar/gdalcubes):
  • stac_cube_items() drops STAC items that have no mask asset. gdalcubes would otherwise read them unmasked. The drop is announced, and an all-dropped listing raises c("drift_no_mask_items", "drift_no_items"). dft_stac_composite() skips that year with its own reason rather than "no scenes".
  • New fixtures delete or corrupt a band or SCL COG, corrupting the tile with the IFD intact.
  • Tests that need the fork fix are gated on a capability probe, read_failures_recorded(). On 0.7.5 they SKIP with a drift#99 reason. The probe is cross-checked, ungated, against an independent read failure, so a wrong "no" fails a test instead of skipping.
  • cube_check_chunks() abort text, the roxygen and inst/notes/gdalcubes-pc-gotchas.md now say what is recorded with and without the fix.

Correction to the issue table. In drift's read shape (apply_pixel() with no select_bands()), gdalcubes also reads SCL as a band. So a deleted SCL is already caught on 0.7.5; an ungated real-path test pins that. The case drift really missed is a corrupted SCL:

SCL	drift's shape, 0.7.5	fork
deleted	9 chunks failed	9
corrupted	0 (scene unmasked)	9

Related Issues

• Relates to gdalcubes read failures after open, mask-open failures and worker crashes are still silent #99. Recommend keeping it open until the fix is in the gdalcubes drift actually runs, through the upstream merge or a fork install.
• Follows Failed gdalcubes chunk reads are silent: a partial cube passes the empty check and is cached #87
• Relates to NewGraphEnvironment/sred-2025-2026#16

Test plan

• devtools::test() green on installed gdalcubes 0.7.5 (gated tests SKIP, naming drift#99)
• cube and composite tests green on the fork build (R_LIBS=<fork build>)
• DRIFT_TEST_ASSUME_READ_STATUS=true against 0.7.5: exactly the gated tests fail
• Mutations go red:
  • unwiring the mask-asset drop;
  • a probe forced to FALSE;
  • select_bands() inserted in stac_cube_assemble();
  • the composite handler order swapped.
• gdalcubes fork: test_chunk_status.R gives 10 of 32 failing on 0.7.5 and 32 of 32 passing on the fork; test_worker_failure.R times out on 0.7.5 and passes in about 1 s; full tinytest 159/159
• lintr::lint_package() adds nothing (211 on main and branch); pkgdown::check_pkgdown() clean
• /code-check: fork 3 rounds and drift 3 rounds, each ended by an enumeration (fork: 39-row ownership walk; drift: every new assertion and guard checked with mutations)

Notes

• No BULK RSS run. The drift changes read no pixels: the drop runs on the STAC listing, and the rest is tests and docs. The fork patch changes only error paths.
• Until the fork fix is installed, a corrupted or throttled read after a successful open is still silent in normal runs. GDAL HTTP retries (Failed gdalcubes chunk reads are silent: a partial cube passes the empty check and is cached #87) remain the mitigation.
• Pre-existing and out of scope, both noted in the upstream draft: the two-band mask segfault (dft_stac_composite(aggregation = "count") silently returns reflectance, not a clear-observation count #92), and a warp_complex() overview transformer type confusion that crashes GCP-georeferenced images that have overviews.
• NEWS and the version bump come in the release commit at merge.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PRhUJsuKABLfpBGktPoiBN