winlog emits Windows ETW TraceLogging events from Ruby with no manifest, no message DLL, no registry writes, and no elevation: register a provider by name (standard ETW name-hashed GUID), then log runtime-dynamic events with typed fields (UTF-8 text, binary, int64, double, boolean) plus levels, keywords, opcodes, and explicit activity IDs for correlation. Events are self-describing and decode in WPA, PerfView, and the inbox logman/tracerpt with zero setup; when no session is listening, a log call is gated in native code before field processing and costs about one Ruby method call. Built on Microsoft's MIT-licensed TraceLoggingDynamic.h (vendored). Emit-only: events go to ETW sessions, not the Windows Event Log. Windows MSVC (mswin) Ruby only.