Masking adds a band on Windows for grayscale, so "output band counts do not change" is platform-conditional

[NewGraphEnvironment]

Found by the three-platform R CMD check workflow added in #52, on its first run — job log.

The claim

CLAUDE.md, a Key Decision from v0.11.0 (#23):

Output band counts do not change, because -srcalpha excludes the alpha band from the warped band list. That is what let masking default to on without moving stac_airphoto_bc.

inst/notes/border-masking.md carries the same statement, and test-fly_georef_mask.R asserts it:

expect_equal(fly_gdal_bands(fly_gdal_info(on_file)),
             fly_gdal_bands(fly_gdal_info(off_file)))
expect_equal(fly_gdal_bands(fly_gdal_info(on_file)), if (bands >= 3L) 4L else 1L)

What Windows does

For a grayscale (1-band) source, masking on gives 2 bands, masking off gives 1:

── Failure ('test-fly_georef_mask.R:194:5') ──
Expected `fly_gdal_bands(fly_gdal_info(on_file))` to equal `fly_gdal_bands(fly_gdal_info(off_file))`.
  `actual`: 2
`expected`: 1

ubuntu-latest and macos-latest both pass. So the invariant holds on two of the three GDAL builds and not on the third — it was measured on one platform and written down as unconditional.

The 3-band RGB case is not implicated: both arms give 4 there on every runner.

Why it matters beyond a red tick

The stated reason this invariant was worth having is that it is what let masking default to on without moving stac_airphoto_bc. If a Windows-produced grayscale GeoTIFF carries an extra band, that consumer's schema assumption is wrong for those files — silently, since an extra band is not an error anywhere.

Grayscale is also the arm with the weaker contract already (-dstnodata 0 rather than -dstalpha, fly#56), so it is the arm where a band appearing is least expected and least likely to be noticed.

What would settle it

• Which GDAL version the Windows CRAN sf binary carries, against ubuntu-24.04's 3.8.4 and the macOS binary — this may be a version difference rather than a platform one.
• Whether -srcalpha is being applied at all on that build for a 1-band source, or whether -dstnodata is producing the mask band.
• Then either pin the band count in fly_georef() regardless of platform, or state the invariant conditionally and tell stac_airphoto_bc which files can carry the extra band.

Meanwhile

#52 marks the two band-count assertions as skipped on Windows, citing this issue, so the rest of that test — including the collar-removal measurements — keeps running on all three platforms. The skip is printed by that workflow's "Report skipped tests" step on every run rather than being silent.

[NewGraphEnvironment]

Second symptom from the same run, on the green pass this time — run 35681274310, windows-latest only:

── Warning ('test-fly_georef.R:183:3') ──
GDAL Message 1: Value 0 in the source dataset has been changed to 1 in the destination
dataset to avoid being treated as NoData. To avoid this, select a different NoData value
for the destination dataset.

Twice, from fly_georef() on real catalogue thumbnails. ubuntu-latest and macos-latest emit neither, and it does not fail the check — testthat reports WARN 2 and R CMD check still says Status: OK, so nothing would have surfaced this without reading the log.

It is the same root as the band count above and it is worse in kind. The band count changes the file's shape, which a consumer could at least notice. This one silently changes pixel values: genuine zeros in a georeferenced output produced on Windows become 1. For imagery that is a small fidelity loss; for anything downstream that treats 0 as meaningful it is a wrong value with no signal.

Both point at the same question — what that GDAL build does with nodata and alpha on the warp — so they are worth settling together rather than separately:

• Windows grayscale masked: 2 bands where the other two platforms give 1.
• Windows warp: -dstnodata 0 collides with real zeros in the source and GDAL shifts them rather than the nodata value.

The second reads as a direct consequence of the grayscale path's -dstnodata 0 (the weaker contract recorded in inst/notes/border-masking.md and fly#56), which suggests the fix for one may be the fix for both: pick a destination nodata value that cannot collide, or carry alpha on grayscale too.

Worth capturing the Windows runner's GDAL version while investigating — if it is ahead of ubuntu-24.04's 3.8.4, this may be a version difference the other platforms reach later rather than a platform one.