Dropping the per-line fflush from ac_log looked like a free win, since the log sits on USB vfat and every key press writes a line. It was the wrong thing to economize. Without it a line waits in this process's stdio buffer, so a boot that dies before the 300-frame flush takes the last few seconds of log with it — exactly the seconds that explain the death, in the one situation where the log on the stick is the only instrument there is. It also costs less than it appeared to: fflush hands the bytes to the kernel with a write(), it does not wait for the stick. The call that touches slow media is the fsync, and that stays batched in ac_log_flush.