fix: spurious errors/warnings from a pc13v HA deploy (bug-1872..1877)

- bug-1872 (worker): "Failed to find any disk statistics in
  /proc/diskstats" ERROR every 15 s on an NVMe-only host. The whole-disk
  filter guessed from the name and skipped anything ending in a digit or
  containing 'p' -- every nvmeXnY, mmcblkN, even sdp -- so io was never
  reported. diskstats.h now counts a device only when
  /sys/block/<name>/device exists (real disks; not partitions, loop, dm,
  md, zram), and a host with no disk warns once.
- bug-1873 (worker): "Failed to get worker pid" WARN on job start. MainPID
  reads 0 until systemd has forked the new transient unit; xcecd.c already
  retries, so the miss is DEBUG and the final failure names the unit.
- bug-1874 (scheduler): deprecation WARN for the legacy xce_sched_fcfs on
  every start, though builtin_fcfs is the picker. Registration still wraps
  a job_elect_fn plugin but no longer warns; selecting one warns once.
- bug-1875 (apiserver): "Not running as root -- PAM authentication will not
  work" with the default provider config_file; now only for provider pam.
- bug-1876 (controller): standbys logged "cluster_init_phase2 ... failed
  (rc=-22)" WARN every 3 s while waiting for the primary's config push,
  a state the function itself calls normal. It returns -EAGAIN for that
  wait; callers log it at INFO, other failures still WARN.
- bug-1877 (controller): "WAL/snapshot stored unencrypted" warned without
  looking. persist_path_encrypted() checks fscrypt (statx) and dm-crypt
  (sysfs dm/uuid CRYPT-, through LVM slaves); the warning stays when the
  storage is not shown to be encrypted (e.g. a plain /tmp).

Tests: worker diskstats_test (2 of 4 RED on the old filter with pc13v's
/proc/diskstats), controller test_phase2_cold_boot and
test_persist_encryption, scheduler picker tests, apiserver
TestRootWarning. Full ASAN build: all 113 suites pass (controller 319/0,
harness 141/0).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

src/frontend/apiserver/middleware/startserver.go

@@ -1,6 +1,7 @@
 package middleware
 
 import (
+	"apiserver/backend/auth"
 	"apiserver/utils"
 	logger "apiserver/utils"
 	"fmt"
@@ -14,6 +15,16 @@ import (
 	"go.uber.org/zap"
 )
 
+// rootWarning is the start-up warning for running as uid under the given
+// auth provider, or "" when there is nothing to warn about: only the PAM
+// provider needs root (bug-1875: this warned for every provider).
+func rootWarning(uid, provider string) string {
+	if uid == "0" || provider != "pam" {
+		return ""
+	}
+	return "Not running as root — PAM authentication will not work. OK for dev/testing."
+}
+
 // openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout server.key -out server.crt -config openssl.cnf -extensions v3_req
 func StartServer(r *gin.Engine) error {
 	logger.Debug("Enter StartServer() function")
@@ -24,8 +35,12 @@ func StartServer(r *gin.Engine) error {
 			logger.Error("Failed to get current user:", zap.Error(err))
 			os.Exit(1)
 		}
-		if currentUser.Uid != "0" {
-			logger.Warn("Not running as root — PAM authentication will not work. OK for dev/testing.")
+		provider := ""
+		if auth.GlobalProvider != nil {
+			provider = auth.GlobalProvider.Name()
+		}
+		if msg := rootWarning(currentUser.Uid, provider); msg != "" {
+			logger.Warn(msg)
 		}
 	}
 

src/frontend/apiserver/middleware/startserver_test.go

@@ -0,0 +1,25 @@
+package middleware
+
+import "testing"
+
+// bug-1875: the apiserver warned "Not running as root — PAM authentication
+// will not work" on every non-root start, even with the default
+// provider: config_file, where PAM is never used.
+func TestRootWarning(t *testing.T) {
+	cases := []struct {
+		uid, provider string
+		warn          bool
+	}{
+		{"1000", "pam", true},
+		{"0", "pam", false},
+		{"1000", "config_file", false},
+		{"1000", "ldap", false},
+		{"1000", "", false},
+	}
+	for _, c := range cases {
+		got := rootWarning(c.uid, c.provider)
+		if (got != "") != c.warn {
+			t.Errorf("rootWarning(%q, %q) = %q, want warning=%v", c.uid, c.provider, got, c.warn)
+		}
+	}
+}