Function migrate_bpmn_instance 

pub async fn migrate_bpmn_instance(
    configuration: &Configuration,
    workspace: &str,
    id: &str,
    migrate_bpmn_instance_request: MigrateBpmnInstanceRequest,
) -> Result<BpmnMigrationResult, Error<MigrateBpmnInstanceError>>

Validated pointer swap (#922). Validates the (current, target) pair against the identity-migration contract and, only if it passes, moves v2_job.runnable_id to the target version, refreshes the denormalised bpmn_process_status.bpmn_version (which no engine writer ever refreshes) and appends a bpmn_instance_migration ledger row – all in one transaction. process_status is never written and suspend_until is never nudged; the instance runs on the target version from its next step, because the engine re-resolves the pinned definition on every step. A pair that fails the contract is refused with a 400 naming every offending identifier – it is never migrated and flagged.