What is an operation definition versus an operation instance?

A definition is the start/end/reset trigger set you activate. An instance is one completed run of that definition against captured traffic. Definitions live under operation design; instances appear under Runtime → Operations. Flow → Hub needs instances, not definitions alone.