Add activated workspace reflection and Studio definition watches

Expose bounded snapshot-bound definition reads and latest-only watches from the serving checked bundle. Add checked reflection dependency ports, generated SDK bindings and selector-scoped invocation authority.

Move Studio factory, contract and query discovery to public reflection inventories. Share an active-definition watch across canvas and standalone routes and invalidate/reload on epoch changes instead of polling GetWorkspace.

Document the API and deferred scope; cover compiler/codegen, SDK injection, transport authorization, activation publication, pagination and reconnect behavior. Keep all work local; no deployment or publication.

proto/quixos/orch.proto

@@ -9,6 +9,8 @@ import "quixos/refs.proto";
 import "quixos/runtime.proto";
 
 service OrchestratorRuntime {
+  rpc ReadDefinitions(DefinitionRequest) returns (DefinitionPage);
+  rpc WatchDefinitions(DefinitionRequest) returns (stream DefinitionPage);
   rpc ExecuteQuery(camino.QueryRequest) returns (camino.QueryResponse);
   rpc WatchQuery(camino.QueryRequest) returns (stream QueryEvent);
   rpc TryConform(TryConformRequest) returns (TryConformResponse);
@@ -26,6 +28,83 @@ service OrchestratorRuntime {
   rpc CloseActivation(CloseActivationRequest) returns (CloseActivationResponse);
 }
 
+// Activated definitions, not runtime metrics or object data. Nested type JSON
+// uses the compiler's canonical ValueType/InterfaceRevision public contracts.
+message DefinitionSelector {
+  string kind = 1;  // active | atoms | interfaces | conformances | queries | indexes
+  repeated string ids = 2;
+  string atom_id = 3;
+  string interface_revision_id = 4;
+  string package_revision_id = 5;
+}
+message DefinitionIdentity {
+  string workspace_id = 1;
+  string workspace_revision_id = 2;
+  string source_root_commit = 3;
+  string workspace_epoch = 4;
+  string definition_digest = 5;
+}
+message DefinitionRequest {
+  DefinitionSelector selector = 1;
+  uint32 first = 2;  // 1..100; 0 uses 50
+  string after = 3;
+  string snapshot = 4;         // issued definition_digest; current serving snapshot only
+  string workspace_id = 5;     // required for injected package authority
+  string workspace_epoch = 6;  // required for invocation-bound package calls
+}
+message ReflectedAtom {
+  string id = 1;
+  string display_name = 2;
+  string constructor_input_type_json = 3;
+}
+message ReflectedInterface {
+  string id = 1;
+  string interface_id = 2;
+  string display_name = 3;
+  string contract_json = 4;  // canonical interface contract, excluding source location
+}
+message ReflectedConformance {
+  string id = 1;
+  string atom_id = 2;
+  string interface_revision_id = 3;
+  string definition_id = 4;
+  repeated string operation_ids = 5;
+  repeated ClassCapability class_capabilities = 6;
+  bool instance = 7;
+}
+message ReflectedQuery {
+  string id = 1;
+  string name = 2;
+  string package_revision_id = 3;
+  string definition_digest = 4;
+  string binding_digest = 5;
+  string root_kind = 6;
+  string interface_revision_id = 7;
+  string variables_type_json = 8;
+  string output_type_json = 9;
+  string effects_json = 10;
+  bool watch = 11;
+  WorkspaceQueryScope workspace_scope = 12;
+}
+message ReflectedIndex {
+  string id = 1;
+  string contract_json = 2;
+}
+message DefinitionRecord {
+  oneof definition {
+    ReflectedAtom atom = 1;
+    ReflectedInterface interface = 2;
+    ReflectedConformance conformance = 3;
+    ReflectedQuery query = 4;
+    ReflectedIndex index = 5;
+  }
+}
+message DefinitionPage {
+  DefinitionIdentity identity = 1;
+  repeated DefinitionRecord records = 2;
+  string next_cursor = 3;
+}
+
 message QueryEvent {
   string run_id = 1;
   uint64 sequence = 2;

proto/quixos/refs.proto

@@ -45,12 +45,19 @@ message InjectedDependency {
     string constructor_atom_id = 5;
     string query_id = 7;
     WorkspaceQueryDependency workspace_query = 8;
+    ReflectionDependency reflection = 9;
   }
   // Defaults to the invocation receiver. A checked dependency traversal can
   // select a related object explicitly before the package runtime starts.
   string object_id = 6;
 }
 
+message ReflectionDependency {
+  string workspace_id = 1;
+  string workspace_epoch = 2;
+  repeated string selectors = 3;
+}
+
 // Scope evidence is not authority by itself. The caller must also hold the
 // matching workspace-query grant (or the authenticated workspace user grant).
 message WorkspaceQueryScope {