docs(go): add Section 7 - Logging (slog default + backend decision matrix)

- 210-go.mdc: add a dedicated "Logging" section covering the modern
  Go logging story. Default for new code is log/slog (stdlib since
  1.21); JSON handler with AddSource and slog.LevelVar for runtime
  level control; pass *slog.Logger via DI
- Three calling conventions ordered by safety: loose key-value
  (error-prone, compiles cleanly with mistyped keys / odd argument
  counts), context-accepting *Context variants (recommended; required
  for trace correlation), LogAttrs typed-only (safest, compile-time
  type-checked)
- otelslog bridge for first-class OpenTelemetry logs that carry the
  active span trace and span IDs (requires *Context call variants
  with an active span)
- LogValuer pattern for centralized redaction of sensitive types so
  call sites cannot leak by accident
- Decision matrix for when to swap the slog backend (only with
  profiling evidence): slog stdlib default; phuslu/log as backend
  for ~2.7x throughput; zerolog native for max throughput; zap
  native for extensibility/test observers; charmbracelet/log for
  CLI output; do not start new code on logrus
- Footguns documented: zerolog as slog backend re-encodes WithAttrs
  per call (~46x slower than zerolog native); zerolog chain without
  Msg/Send drops + leaks pooled Event; zap.SugaredLogger adds 1
  alloc per call; slog ships no TRACE/FATAL by default
- Library landscape one-liner table with stars + benchmark numbers
  (phuslu/log ~25 ns; zerolog ~25 ns; zap ~51 ns; slog ~101 ns;
  logrus ~9 us; charmbracelet ~16 us)
- Add sloglint to the CI Gates (Non-Negotiable) section so the
  loose key-value form cannot silently produce malformed entries
- Renumber subsequent sections (8-17) since the Logging section is
  inserted at 7. Fixes a pre-existing duplicate "## 8" between
  Troubleshooting and CI/CD Integration along the way
- skills/go-rust-systems/SKILL.md: add a "Go Logging - Default Stack"
  section mirroring the rule's calling-convention guidance, otelslog
  bridge, LogValuer redaction, decision matrix, footguns, and the
  required CI lint. Cross-link to the rule for full rationale
- Source: https://www.dash0.com/guides/golang-logging-libraries
  (April 2026 benchmarks, captured here without external dependency)

Closes the gap between code samples that already used slog and the
absence of any explicit "use slog as default; here is when and why
to swap" guidance.

Author: d-padmanabhan

rules/210-go.mdc

@@ -1435,6 +1435,7 @@ staticcheck ./...
 golangci-lint run
 go test -race ./...
 govulncheck ./...
+sloglint -no-mixed-args -static-msg ./...   # see Section 7 - Logging
 ```
 
 ### CI Gates (Hardening Extension - Recommended)
@@ -1624,7 +1625,142 @@ func (c *Cache) Get(key string) (interface{}, bool) {
 
 ---
 
-## 7. Troubleshooting Guide
+## 7. Logging
+
+**Default:** application code uses `log/slog` (stdlib since Go 1.21). Initialize with the JSON handler; pass `*slog.Logger` via dependency injection (no globals after `slog.SetDefault()` in `main`).
+
+```go
+opts := &slog.HandlerOptions{
+    AddSource: true,
+    Level:     slog.LevelInfo,
+}
+logger := slog.New(slog.NewJSONHandler(os.Stderr, opts))
+slog.SetDefault(logger)
+```
+
+This gives structured JSON, source attribution, runtime level control via `slog.LevelVar` (goroutine-safe), and zero external dependencies.
+
+### Three calling conventions, ordered by safety
+
+```go
+// 1) Loosely typed key-value (convenient, ERROR-PRONE)
+//    Odd argument count, mistyped key, or swapped key/value compile cleanly
+//    and produce silently malformed output at runtime.
+slog.Info("request", "method", "GET", "status", 200)
+
+// 2) Context-accepting (RECOMMENDED default in handlers/services)
+//    Required for trace correlation via the otelslog bridge.
+slog.InfoContext(ctx, "request",
+    slog.String("method", "GET"),
+    slog.Int("status", 200),
+)
+
+// 3) Typed attributes only (SAFEST; catches type errors at compile time)
+logger.LogAttrs(ctx, slog.LevelInfo, "request",
+    slog.String("method", "GET"),
+    slog.Int("status", 200),
+)
+```
+
+Use `LogAttrs` in hot paths and anywhere correctness matters; loose key-value form is acceptable in scripts and tests where the calls are easy to eyeball. Always run `sloglint` (see CI Gates) so the loose form does not silently rot in long-running services.
+
+### Trace correlation via `otelslog`
+
+Use the `go.opentelemetry.io/contrib/bridges/otelslog` handler to route slog through the OpenTelemetry Logs SDK. Logs become first-class OTel signals that carry the active span's trace/span IDs, enabling automatic log <-> trace correlation in your backend.
+
+```go
+import (
+    "go.opentelemetry.io/contrib/bridges/otelslog"
+    "go.opentelemetry.io/otel/log/global"
+)
+
+logger := otelslog.NewLogger(
+    "service-name",
+    otelslog.WithLoggerProvider(global.GetLoggerProvider()),
+)
+slog.SetDefault(logger)
+```
+
+Trace correlation only fires when the call accepts a context with an active span. Use `*Context` variants:
+
+```go
+// Correlated (context carries the span):
+logger.InfoContext(ctx, "processing order", slog.String("order_id", id))
+
+// NOT correlated (no context, no span):
+logger.Info("processing order", slog.String("order_id", id))
+```
+
+### Redaction via `LogValuer`
+
+Implement `slog.LogValuer` on sensitive types so they cannot leak by accident. Centralized redaction beats relying on every call site to remember.
+
+```go
+type APIKey string
+
+func (APIKey) LogValue() slog.Value { return slog.StringValue("REDACTED") }
+```
+
+Same pattern for emails, JWT tokens, PII fields, and PCI numbers - one method per type, one source of truth for the redacted form.
+
+### When to swap the slog backend (only with evidence)
+
+Default is `slog.NewJSONHandler` and it is fast enough for the vast majority of services (~101 ns/op, zero allocs in steady state). Only swap when profiling shows logging as a bottleneck. Decision matrix:
+
+| Need | Choice |
+|---|---|
+| OpenTelemetry trace correlation | slog + `otelslog` bridge (default for new services running on OTel) |
+| Profiler shows logging is a hot path; want to keep slog API | `phuslu/log` as slog backend (~38 ns/op, ~2.7x stdlib) or `zap` adapter (~70 ns/op) |
+| Maximum throughput; willing to use library API | `zerolog` native API (~25 ns/op, zero allocs); pleasant chained API; built-in sampling for high-throughput log dedup |
+| Extensibility, advanced cores, test observers | `zap` native (`zapcore.Core` composition, `zaptest/observer`, `AtomicLevel`); ~51 ns/op typed, ~82 ns/op sugared |
+| CLI tool, human reads the terminal | `charmbracelet/log` as slog backend (intelligent coloring, icons, color-downsampling for SSH/file pipes) |
+| Existing logrus codebase | Migrate hot paths to slog; leave the rest until you get to it. **Do not start new code on logrus** - in maintenance mode, ~15x slower than slog, ~50x slower than zerolog |
+
+**Footguns to remember:**
+
+- `zerolog` natively is fast, but its `slog.Handler` bridge re-encodes `WithAttrs` on every `Handle()` call - ~46x slower than its native API. If you want zerolog speed, use its native API; do not run zerolog *as* a slog backend.
+- `zerolog` API: forgetting `.Msg()` / `.Send()` at the end of a chain silently drops the entry AND leaks a pooled `Event` object. Use `sloglint` analogue or code review.
+- `zap.SugaredLogger` adds one allocation per call from the variadic `interface{}` boxing - small but compounds under load.
+- `slog` does not include `TRACE` or `FATAL` levels by default. Define your own (`slog.Level(-8)` for trace) or accept the standard set.
+
+### Library landscape (one-liner per option)
+
+| Library | Stars | When |
+|---|---|---|
+| **`log/slog`** (stdlib) | n/a | Default for new code. Frontend the ecosystem aligned on. |
+| **`zerolog`** (~12k) | ~25 ns/op native, zero allocs | Maximum throughput when you can use the library API directly. |
+| **`zap`** (~24k) | ~51 ns/op typed | Production tooling: AtomicLevel, zapcore composition, zaptest/observer. |
+| **`phuslu/log`** (~840) | ~25 ns/op native, ~38 ns/op as slog backend | Fastest available; small community + single maintainer is the trade-off. No OTel bridge yet. |
+| **`logrus`** (~25k) | ~9 us/op | Maintenance mode; do not start new code on it. |
+| **`charmbracelet/log`** (Charm TUI) | ~16 us/op | CLI / TUI tooling where humans read the output. Implements `slog.Handler`. |
+
+### Required CI lint
+
+Add `sloglint` to the CI gate so the loosely-typed key-value form cannot silently produce malformed log entries.
+
+```bash
+go install github.com/go-simpler/sloglint/cmd/sloglint@latest
+sloglint -kv-only -no-mixed-args ./...    # enforce typed attrs in hot paths
+```
+
+Reasonable defaults:
+
+- `-no-mixed-args` - reject mixing `slog.Attr` and key-value in the same call
+- `-kv-only` or `-attr-only` - pick a house style and enforce it
+- `-static-msg` - reject computed message strings (the message is the search key in observability tools)
+
+### Practical defaults summary
+
+- **Always-on:** `log/slog` + JSON handler + `otelslog` bridge if the service runs on OpenTelemetry; pass `*slog.Logger` via DI.
+- **Always-on:** `LogAttrs(ctx, ...)` for hot paths and any sensitive-data path; loose key-value only in scripts and tests.
+- **Always-on:** `LogValuer` on every sensitive type.
+- **Always-on:** `sloglint` in CI.
+- **Conditionally:** swap to `phuslu/log` or `zap` backend only when profiling shows logging is the bottleneck.
+- **Never:** start new code on logrus; bridge zerolog *into* slog (use zerolog natively if you want its speed).
+
+---
+
+## 8. Troubleshooting Guide
 
 ### Debug Logging
 
@@ -1886,7 +2022,7 @@ func (c *Cache) Set(key string, obj *LargeObject) {
 
 ---
 
-## 8. CI/CD Integration
+## 9. CI/CD Integration
 
 ### GitHub Actions Example
 
@@ -1920,7 +2056,7 @@ jobs:
 
 ---
 
-## 9. Advanced Patterns
+## 10. Advanced Patterns
 
 ### Fan-Out, Fan-In
 
@@ -2000,7 +2136,7 @@ func (rl *RateLimiter) Wait(ctx context.Context) error {
 
 ---
 
-## 10. AWS & Cloud Integration
+## 11. AWS & Cloud Integration
 
 ### AWS SDK for Go (v2)
 
@@ -2185,7 +2321,7 @@ func ValidateRegion(region string) error {
 }
 ```
 
-## 11. CLI Development
+## 12. CLI Development
 
 ### Using cobra (Recommended)
 
@@ -2352,7 +2488,7 @@ func outputResult(result interface{}, format string) error {
 }
 ```
 
-## 12. Design Patterns (Expanded)
+## 13. Design Patterns (Expanded)
 
 ### Factory Pattern
 
@@ -2501,7 +2637,7 @@ func (eb *EventBus) Publish(ctx context.Context, event Event, data interface{})
 }
 ```
 
-## 13. Generics (Expanded Coverage)
+## 14. Generics (Expanded Coverage)
 
 ### Generic Functions
 
@@ -2620,7 +2756,7 @@ func (r *UserRepository) Create(ctx context.Context, user *User) error {
 }
 ```
 
-## 14. Deployment & Distribution
+## 15. Deployment & Distribution
 
 ### Building Binaries
 
@@ -2755,7 +2891,7 @@ func printVersion() {
 }
 ```
 
-## 15. Documentation
+## 16. Documentation
 
 - **Package Docs**: Capture purpose in `doc.go`
 - **Exported Items**: Every exported item gets a comment
@@ -2787,7 +2923,7 @@ func GetUser(ctx context.Context, id string) (*User, error) {
 
 ---
 
-## 16. Comprehensive Example Application
+## 17. Comprehensive Example Application
 
 Complete example demonstrating idiomatic Go patterns:
 

skills/go-rust-systems/SKILL.md

@@ -205,6 +205,72 @@ fn process_user(id: &str) -> anyhow::Result<User> {
 }
 ```
 
+## Go Logging - Default Stack
+
+**Default for new code:** `log/slog` (stdlib since 1.21) with the JSON handler. The ecosystem has aligned behind slog as the frontend; backends can be swapped without touching log statements if profiling shows logging is a bottleneck.
+
+```go
+opts := &slog.HandlerOptions{AddSource: true, Level: slog.LevelInfo}
+slog.SetDefault(slog.New(slog.NewJSONHandler(os.Stderr, opts)))
+```
+
+### Calling conventions, ordered by safety
+
+```go
+slog.Info("request", "method", "GET", "status", 200)                    // loose - error-prone
+slog.InfoContext(ctx, "request", slog.String("method", "GET"), ...)     // recommended (enables trace correlation)
+logger.LogAttrs(ctx, slog.LevelInfo, "request", slog.String(...), ...)  // safest (typed; compile-time)
+```
+
+### Trace correlation via `otelslog`
+
+```go
+import "go.opentelemetry.io/contrib/bridges/otelslog"
+
+slog.SetDefault(otelslog.NewLogger("svc", otelslog.WithLoggerProvider(global.GetLoggerProvider())))
+// MUST use *Context variants for span correlation:
+logger.InfoContext(ctx, "processing", slog.String("order_id", id))
+```
+
+### Redaction via `LogValuer`
+
+```go
+type APIKey string
+func (APIKey) LogValue() slog.Value { return slog.StringValue("REDACTED") }
+```
+
+Centralizes redaction so call sites cannot leak by accident.
+
+### Decision matrix - when to swap backend
+
+| Need | Choice | Notes |
+|---|---|---|
+| Default | `slog` + `JSONHandler` | ~101 ns/op, zero allocs; fast enough for almost everyone |
+| OTel correlation | `slog` + `otelslog` bridge | Default if service runs on OpenTelemetry |
+| Profiler shows logging is hot | `phuslu/log` as slog backend | ~38 ns/op (~2.7x stdlib); single maintainer is the trade-off |
+| Maximum throughput, library API OK | `zerolog` native | ~25 ns/op, zero allocs; built-in sampling |
+| Extensibility, advanced cores, test observers | `zap` native | `zapcore.Core` composition, `zaptest/observer`, `AtomicLevel` |
+| CLI / TUI, human reads terminal | `charmbracelet/log` as slog backend | Coloring, icons, color downsampling |
+| Existing logrus | Migrate hot paths to slog | Don't start new code on logrus (maintenance mode, ~15x slower than slog) |
+
+**Footguns:**
+
+- `zerolog` *as* slog backend re-encodes `WithAttrs` per `Handle()` call - ~46x slower than its native API. Use zerolog natively; don't bridge.
+- `zerolog` chain without terminal `.Msg()` / `.Send()` silently drops the entry AND leaks the pooled `Event`.
+- `zap.SugaredLogger` adds 1 alloc per call from variadic boxing.
+- `slog` ships no TRACE / FATAL levels by default.
+
+### Required CI lint
+
+```bash
+go install github.com/go-simpler/sloglint/cmd/sloglint@latest
+sloglint -no-mixed-args -static-msg ./...
+```
+
+For the full rationale, library landscape, and benchmark numbers, see Section 7 (Logging) in `rules/210-go.mdc`.
+
+---
+
 ## Detailed References
 
 - **Go Patterns**: See [references/go-patterns.md](references/go-patterns.md) for concurrency, interfaces, testing