fix(box): run the log processor in the shim (box-lifetime), not the CLI

Detached `run -d` boxes truncated their logs: the json-file/syslog processor
was a tokio spawn_blocking task in the EPHEMERAL launching CLI, which exits on
detach — so container.json only ever got the lines written before the CLI left
(reliably repro'd: `echo early; sleep 5; echo late` captured only 'early').

Move the processor to the SHIM — the box's own per-process lifetime that already
writes console.log. This is the daemonless home (like containerd-shim): it works
identically for foreground and detached, with no daemon dependency, and drains
the final lines on teardown.

- core/log.rs: moved the sync processing engine here (run_log_processor +
  json-file/syslog/RotatingWriter/tail_next_line), keyed off a `stop` flag.
  When the VM exits the shim sets stop, the processor drains to EOF (flushing a
  trailing partial line) and returns — no last-line teardown race. (start_enter
  DOES return the guest status, despite the legacy 'never returns' comment.)
- core/vmm.rs: InstanceSpec gains log_config (serialized to the shim).
- shim/main.rs: spawn the processor thread before start_enter; stop+join after.
- runtime/vm: VmManager carries log_config (set_log_config); spec threads it.
- runtime/log.rs: now just re-exports json_log_path/is_runtime_console_noise.
- cli: set_log_config on the VM; removed the 3 ephemeral CLI spawns.

KVM-verified: detached `early; sleep 5; late` -> BOTH lines, timestamps ~5s
apart (so --timestamps now shows REAL per-line emission time too); last-line
before exit preserved; logs still clean (noise=0); exit code 7 propagates; exec
unaffected; no VM leak. Known separate/pre-existing gap: foreground non-`--rm`
boxes wipe their dir (logs included) on destroy, so `logs` after a foreground
run is empty — orthogonal to this fix; tracked for follow-up.

Author: Roy Lin

src/Cargo.lock

@@ -189,6 +189,8 @@ pub async fn boot_from_record(
 
     // Activate Prometheus metrics collection
     vm.set_metrics(RuntimeMetrics::try_new()?);
+    // The shim runs the log processor for the box's lifetime.
+    vm.set_log_config(record.log_config.clone());
 
     let mut resource_guard = ensure_boot_resources(record)?;
     if let Err(error) = vm.boot().await {
@@ -206,14 +208,9 @@ pub async fn boot_from_record(
         );
     }
 
-    // Spawn structured log processor (json-file driver writes container.json)
-    let log_dir = record.box_dir.join("logs");
-    let _ = std::fs::create_dir_all(&log_dir);
-    let _log_handle = a3s_box_runtime::log::spawn_log_processor(
-        record.console_log.clone(),
-        log_dir,
-        record.log_config.clone(),
-    );
+    // Ensure the log dir exists so the shim's container.json (and console.log)
+    // have a home; the shim itself runs the log processor.
+    let _ = std::fs::create_dir_all(record.box_dir.join("logs"));
 
     let pid = vm.pid().await;
     let exec_socket_path = vm.exec_socket_path().map(PathBuf::from);

src/cli/src/boot.rs

@@ -613,13 +613,9 @@ async fn execute_up(
             );
         }
 
-        // Spawn log processor
-        let log_dir = box_dir.join("logs");
-        let _ = a3s_box_runtime::log::spawn_log_processor(
-            box_dir.join("logs").join("console.log"),
-            log_dir,
-            Default::default(),
-        );
+        // Ensure the log dir exists; the shim runs the log processor (default
+        // json-file driver) for each service box's lifetime.
+        let _ = std::fs::create_dir_all(box_dir.join("logs"));
 
         println!(" ✓");
     }

src/cli/src/commands/compose.rs

@@ -188,6 +188,9 @@ async fn setup_and_boot(args: &RunArgs) -> Result<RunContext, Box<dyn std::error
 
     let emitter = EventEmitter::new(256);
     let mut vm = VmManager::new(config, emitter);
+    // The shim runs the log processor for the box's lifetime (so detached boxes
+    // keep logging after this CLI exits).
+    vm.set_log_config(log_config.clone());
     let box_id = vm.box_id().to_string();
     println!(
         "Creating box {} ({})...",
@@ -376,11 +379,10 @@ async fn setup_and_boot(args: &RunArgs) -> Result<RunContext, Box<dyn std::error
         .await;
         return Err(error.into());
     }
-    let _log_handle = a3s_box_runtime::log::spawn_log_processor(
-        box_dir.join("logs").join("console.log"),
-        log_dir,
-        log_config,
-    );
+    // Log processing now runs in the shim for the box's lifetime; see
+    // VmManager::set_log_config above. (log_dir is still created so the shim's
+    // container.json has a home.)
+    let _ = &log_dir;
 
     let health_checker = health_check.as_ref().map(|hc| {
         crate::health::spawn_health_checker(box_id.clone(), exec_socket_path.clone(), hc.clone())

src/cli/src/commands/run.rs

@@ -18,6 +18,7 @@ thiserror = { workspace = true }
 tracing = { workspace = true }
 chrono = { workspace = true }
 dirs = { workspace = true }
+flate2 = "1.0"
 
 [lib]
 name = "a3s_box_core"