Implement shared live fields and checked query hydration

Add native register acknowledgments and idempotent mutation replay, shared optimistic field controllers, overlapping custom setters, non-suspending hooks and explicit Suspense. Carry checked @live provenance through batched queries and hydrate shared browser fields with coverage leases. Update tracker/scaffolds/guides and verify compiler, PostgreSQL, browser and immutable workspace paths.

proto/camino/api.proto

@@ -3,6 +3,7 @@ syntax = "proto3";
 package camino;
 
 import "camino/schema.proto";
+import "quixos/refs.proto";
 
 service CaminoService {
   rpc ExecuteQuery(QueryRequest) returns (QueryResponse);
@@ -69,6 +70,27 @@ message Value {
     CrdtValue crdt_value = 10;
   }
   ValueSource source = 11;
+  // Trusted query coordinator annotation. Travels with values through residual
+  // row selection, then is removed in favor of final-path hydration metadata.
+  QueryFieldOrigin query_origin = 12;
+}
+
+message QueryFieldOrigin {
+  string selection_id = 1;
+  string atom_id = 2;
+  string interface_revision_id = 3;
+  string member_id = 4;
+  StateValueSource source = 5;
+}
+message QueryLiveField {
+  repeated QueryPathPart path = 1;
+  string selection_id = 2;
+  string object_id = 3;
+  quixos.CapabilityRef capability = 4;
+  string watch_operation_id = 5;
+  string setter_operation_id = 6;
+  quixos.FieldEditing editing = 7;
+  StateValueSource source = 8;
 }
 
 message InstallPersistencePlanRequest {
@@ -271,6 +293,7 @@ message QueryResponse {
   // Native reads share one database snapshot; package enrichment does not.
   string consistency = 9;  // native-snapshot | mixed
   repeated QueryRelationalCapture relational_captures = 10;
+  repeated QueryLiveField live_fields = 11;
 }
 
 // Private coordinator input, removed before publishing a result. Memberships

proto/camino/schema.proto

@@ -104,6 +104,8 @@ message QuerySelection {
   repeated QuerySelection selection = 8;
   QueryRelationalPlan relational = 9;
   QueryPredicate predicate = 10;
+  // Stable checked selection identity; empty for ordinary value projections.
+  string live_selection_id = 11;
 }
 // Resolved IDs, not GraphQL names, determine execution. Response selections
 // remain separate so aliases and fragments cannot change relational semantics.

proto/quixos/orch.proto

@@ -87,20 +87,16 @@ message InvokeCapabilityResponse {
   FieldEditing field_editing = 7;
 }
 
-// Resolved from the checked native getter/setter binding, not Value.source.
-message FieldEditing {
-  string getter_operation_id = 1;
-  string setter_operation_id = 2;
-  string document_type = 3;
-  string binding_digest = 4;
-}
 message EditCapabilityFieldRequest {
   // The public getter; setter must belong to the same value member.
   quixos.CapabilityRef capability = 1;
   string object_id = 2;
   string setter_operation_id = 3;
   string binding_digest = 4;
-  camino.CrdtValue update = 5;
+  oneof edit {
+    camino.CrdtValue update = 5;
+    camino.Value replacement = 7;
+  }
   string client_mutation_id = 6;
 }
 

proto/quixos/refs.proto

@@ -9,6 +9,20 @@ message CapabilityRef {
   ConformanceWitness conformance = 3;
 }
 
+// Resolved native editing semantics. A source snapshot alone grants no writer.
+message FieldEditing {
+  string getter_operation_id = 1;
+  string setter_operation_id = 2;
+  string document_type = 3;
+  string binding_digest = 4;
+  enum Mode {
+    UNSPECIFIED = 0;
+    REGISTER = 1;
+    CRDT = 2;
+  }
+  Mode mode = 5;
+}
+
 message ConformanceWitness {
   string object_id = 1;
   string interface_revision_id = 2;