pub const TRACE_OP_LOG: u8 = 6;Expand description
A LOG COPY: [6][owner:12][utf-8 text], variable length.
This is a copy, never the log itself. ctx.log() performs its syscall FIRST and
unconditionally - the kernel ring and serial are written whether or not events is alive, exists,
or is reachable - and only then offers this duplicate so the line can be queried later. The
distinction is the whole design: re-pointing logs AT the service would make observing a failure
depend on a service that can fail, which is the storage argument in CLAUDE.md 15 one layer up.
Adding a copy costs a try_send whose result is discarded and takes nothing away from the floor.
What this cannot carry, stated rather than discovered: lines written BEFORE events exists. Those
live in the kernel’s 16 KiB ring, which no syscall exposes to userspace, so events log begins at
the moment events does. Boot output is serial’s job, and always was.
(2026-10-09: the kernel now also keeps a fixed copy of the first 32 KiB ever logged, readable as
events log boot through InspectKernel query 27 - CLAUDE.md 11.4, amendment 2026-10-08. The
wrapping 16 KiB ring is still exposed by no syscall.)