tests: pty_run flakes when stdin isn't a terminal — 'script: tcgetattr/ioctl: Operation not supported on socket'

[martin-conur]

Problem

pty_run (added in #198 to regression-test the tty branch of cmd_unregister) fails when
the invoking shell's stdin is not a terminal — which is the normal case inside an agent
harness, a CI step, or any piped invocation:

script: tcgetattr/ioctl: Operation not supported on socket

Observed 2026-09-14: 3 failures in radio_lifecycle.bats's #198 pty tests during a local
full-suite run under an agent worker. They pass in isolation (61/61), pass on a clean
re-run (1013/1013), and CI is green on both runners — so it is intermittent, environment-
dependent, and not a product defect.

Why it's worth fixing rather than tolerating

A flaky test in the suite that verifies radio is corrosive in a specific way: it trains
whoever runs it to discount red. Today a worker correctly diagnosed it as pre-existing and
out of scope — the next one may instead spend a round chasing it, or worse, learn to
re-run until green. That habit is exactly what would have hidden #203.

BSD script (macOS) and util-linux script (Linux) both want a real tty on stdin to
allocate the pty. The helper already handles the syntax difference between the two; it
does not handle the precondition that stdin be a terminal.

Fix options

1. Give script a tty on stdin — < /dev/tty where available, so the helper doesn't
   depend on inheriting one.
2. Skip with a reason when no pty can be allocated. bats' skip is honest and keeps
   the suite green in harnesses that genuinely cannot provide one; CI (which can) still
   exercises the branch, so coverage isn't lost where it matters.
3. Both — prefer a real pty, skip explicitly when one is unobtainable.

(3) is the shape that keeps the signal and drops the noise. A silent skip would be worse
than the flake, so whichever path is taken the reason must be printed.

Acceptance

• Full suite green when run with stdin a socket/pipe (the agent-harness case).
• The radio unregister: the tty gate still bypasses #187's guard — demote -t 0 from wipe-authority to stderr hint #198 tty behaviour is still genuinely exercised wherever a pty is available,
  including both CI runners — not skipped away everywhere.
• A skip states why, so nobody reads it as the test having passed.

Notes

Found by the #191 worker during an intermediate full-suite run; correctly scoped out of
that PR since it touches neither pty_run nor radio_lifecycle.bats. Pre-existing
fragility introduced with #198, not a regression from #203/#191.

[martin-conur]

PM note before dispatch — the trigger is narrower than "stdin isn't a terminal"

I tried to reproduce and failed in the two obvious ways, which is itself useful:

echo "" | ./run_tests.sh radio_lifecycle     # passes
./run_tests.sh radio_lifecycle </dev/null    # passes

So a pipe and /dev/null are both fine. That matches the reported error text exactly —
Operation not supported **on socket** — and points at the real trigger: script calls
tcgetattr() on inherited stdin, and the failure mode depends on what that fd is:

stdin	tcgetattr()	result
tty	succeeds	fine
pipe / /dev/null	ENOTTY	script tolerates it — observed passing
socket	ENOTSOCK / EOPNOTSUPP	script aborts — the reported failure

An agent harness that wires stdin to a socket hits the third row; a normal shell, a pipe,
or a CI step does not. That's why it's intermittent, why it passes in isolation and on
both CI runners, and why < /dev/null alone would not be a fix — it's already
equivalent to a passing case.

The helper is tests/helpers/common.bash:87, 4 call sites in radio_lifecycle.bats:

pty_run() {
  local cmd="$1" out rc=0
  if script --version 2>/dev/null | grep -qi util-linux; then
    out=$(script -qec "$cmd" /dev/null) || rc=$?
  else
    out=$(script -q /dev/null bash -c "$cmd") || rc=$?
  fi
  ...

What this implies for the fix

< /dev/tty is the promising arm — it gives script an fd tcgetattr actually succeeds
on, rather than one it merely tolerates. But /dev/tty doesn't exist in every context
either, so it needs a fallback, and per the issue the fallback must be an explicit skip
with a stated reason, never a silent pass.

Suggested shape: try /dev/tty; if unavailable or script still fails, skip naming the
cause. Coverage is preserved where it matters — both CI runners can allocate a pty, so the
#198 tty branch stays genuinely exercised there.

Don't over-fit to my analysis

I could not reproduce it, so the table above is inference from the error string plus two
negative results — not a confirmed diagnosis. If you can construct a socket-stdin repro,
trust that over this. If your fix makes the tests pass in a context where they currently
fail, say which context and how you verified it, rather than asserting the flake is gone.

A test that skips everywhere would satisfy "suite green" and defeat the ticket entirely.