refactor(gui): slot system standard — single register, four props shares, framework store seat

The definitive slot model for the web client, replacing the first-generation
define/register two-step, ScopedSlots whitelist faces, and binding handles:

- 'root' is the only a-priori slot (SlotsService built-in); the shell renders
  exactly ctx.slots.renderSlot('root', {}).
- register is the single API: children = slot declaration + render
  authorization + runtime spec in one options object; misconfiguration fails
  loud at load (duplicate declaration, undeclared contribution, one store
  handle under two scopes).
- Component props arrive in four auto-derived shares: PropsRuntime<K>
  (owner params + session/global standard kits via declare-merge),
  PropsRenderSlots<S>, PropsStore<H>, and the inject business face.
  sessionId is framework-supplied; hooks are framework-made only.
- Framework store seat: defineStore factories declare schema/actions/persist;
  read = useStore, write = baked actions only; store scope derives from the
  mounting entry; per-session persist keys and clearPersisted lifecycle.
- inject factories read the apply closure's own ctx (binding handles retired;
  root-ctx back door closed); SessionProvider is self-wired render-prop.
- Rendering sits behind the SlotRenderer install seam; runtime stays
  React-free; ownership ledger keyed to the single entry axis closes the
  stale-authority window (StaleAuthorizationError probes).

Docs: the slot type-chain note is refreshed in place as the slot system
standard RFC (bilingual pair re-recorded); the web client architecture RFC
defers its slot sections there; packages/client/AGENTS.md gains the slot and
props discipline; gui-testing/web-styling notes drop missions/ references.

Tests: suites rewritten to the standard (props fed directly, real store
engines via createXXXStore().create(), no render machinery); load-time
negative samples for declaration/authorization/store conflicts; verified by
real-host playwright run (three columns, empty state, collapse, keyed session
remount, cross-slot selection sharing).

docs(ui-sidebar): point contract reference at the committed slot standard RFC

missions/ is workspace-local and never committed; the README must not cite it.

packages/client/web-react/src/index.ts

@@ -1,14 +1,22 @@
 /**
- * ctx-to-React glue: uSES bridge, SessionProvider (dependency-inverted),
- * scopedSlots outlet factory, useInvoke. Contract: api-contracts v3 section 2.
+ * ctx-to-React machinery (slot terminal design §8): createSlotRenderer (the
+ * install-seam implementation), SessionProvider (framework-wired render
+ * prop), the defineStore shell, and useInvoke. Contract types (SlotRenderer
+ * family, store family, four-share props) are ui-slots authority — this face
+ * re-exports the ones its own values traffic in. The snapshot-store ENGINE
+ * (createSnapshotStore) is framework-internal — runtime/i18n reach it through
+ * the './store' subpath; business plugins declare stores via defineStore
+ * only. React contexts stay in-package: business components see none.
  */
-import type { ReactNode } from 'react'
 import type { SnapshotSelectorHook } from './store/index.ts'
 
+// -- store: the declarative shell is public; the engine stays off this face --
 export type {
+  ActionsDecl, BakedActions, BoundActions, EngineStoreHandle, EngineStoreInstance,
   ObservableSnapshot, SnapshotSelectorHook, SnapshotStore,
+  StoreFactory, StoreHandle, StoreInstance, StoreSpec,
 } from './store/index.ts'
-export { createSnapshotStore, shallowEqual } from './store/index.ts'
+export { defineStore, shallowEqual } from './store/index.ts'
 export { bindSnapshotSelector } from './bind.ts'
 
 /**
@@ -19,23 +27,15 @@ export { bindSnapshotSelector } from './bind.ts'
  */
 export type UseSession<Snap extends object = object> = SnapshotSelectorHook<Snap>
 
-/** Session assembly handle narrowed from ui-slots' structural form. */
-export interface SessionBinding<Snap extends object = object> {
-  readonly sessionId: string
-  readonly session: { useSelector: UseSession<Snap> }
-  readonly ctx: unknown
-}
+// -- renderer: the install-seam implementation; contract lives in ui-slots --
+export type {
+  HostObservable, RenderOpts, SessionCell,
+  SlotRenderer, SlotRendererHost, StoreInstanceLike,
+} from '@deepseek-ai/dsh-client-ui-slots'
+export { SlotOwnershipError, StaleAuthorizationError } from '@deepseek-ai/dsh-client-ui-slots'
+export { createSlotRenderer } from './scoped-slots.tsx'
 
-/** SessionProvider dependency surface (inverted: web-react never imports runtime). */
-export interface SessionProviderDeps {
-  useCurrent: () => string | undefined
-  resolveBinding: (id: string) => SessionBinding | undefined
-  /** Assembler-owned body: the shell closes over its own scopedSlots to render the session slots. */
-  renderBody: (id: string) => ReactNode
-}
-
-export { createSessionProvider, RootBindingProvider, SlotAssemblyError, useRootBinding, useSessionBinding } from './session-provider.tsx'
-
-export { scopedSlots } from './scoped-slots.tsx'
+// -- session area: the framework-wired provider; binding contexts stay internal --
+export { SessionProvider, SlotAssemblyError, type SessionProviderProps } from './session-provider.tsx'
 
 export { useInvoke } from './use-invoke.ts'