Bulk identity migration (#922). One validation for the whole batch, because eligibility is a property of the version pair, not of an instance. from_version is the whole bulk key – a bpmn_flow_version row belongs to exactly one flow – and both versions are checked to belong to the same flow before anything moves. Matching no running instance is a 200 with an empty migrated, not an error.
The same per-pair verdict as checkBpmnVersionPair, but resolving this instance’s own current pin and its runtime preconditions (it must not be an inline preview run, and it must still be running).
Runs the identity-migration contract (#922) over two compiled definitions of the same flow and reports every blocker, grouped by rule. Reads no runtime state at all, so the verdict is a property of the (from_version, to_version) pair and applies to every instance pinned to from_version – which is what makes it answerable with no instance and cacheable per version.
#919, narrowed to a single flow. Identical shape to the workspace rollup. A flow that exists but has nothing running answers with an empty flows list, not a 404.
Frontend-facing projection of the process instance’s live runtime state (lifecycle, per-activity status, variables, history, incidents), consumed by the live process token overlay. 404 if the instance isn’t in the workspace, or if the engine has not picked it up yet (no runtime state).
#919. Answers "which of my running instances are on an old definition?" for the whole workspace, and per pinned version whether it is migratable to that flow’s latest and if not why (#922’s validator, computed once per version because eligibility is a property of the (version, latest) pair rather than of an instance). Read-only. An instance is pinned at start to one bpmn_flow_version (v2_job.runnable_id) and resolves its model from that row on every step, so instances complete on the version they started on while new starts use the latest. runnable_id is the source here, never the denormalised bpmn_process_status.bpmn_version, which the engine writes on insert and never refreshes. "Running" means a root instance still queued and uncancelled – the same set a bulk migrate would move. Inline preview runs are excluded: they carry their model on the job row and are on no version.
Validated pointer swap (#922). Validates the (current, target) pair against the identity-migration contract and, only if it passes, moves v2_job.runnable_id to the target version, refreshes the denormalised bpmn_process_status.bpmn_version (which no engine writer ever refreshes) and appends a bpmn_instance_migration ledger row – all in one transaction. process_status is never written and suspend_until is never nudged; the instance runs on the target version from its next step, because the engine re-resolves the pinned definition on every step. A pair that fails the contract is refused with a 400 naming every offending identifier – it is never migrated and flagged.
Start a process instance from an undeployed diagram (#710 stage 3), the "run without deploying" counterpart to POST /bpmn/run/p/{path}. The submitted XML is parsed and validated exactly as a real deploy would – nothing is written to bpmn_flow/bpmn_flow_version.
Validates the ActivityFailed incident, identified by the original failed child job’s id, and records a retry intent on the process instance. The execution engine does not yet act on this intent: retrying an incident is not yet functional end-to-end. This endpoint only validates ownership of the incident and records the intent for a future engine version to consume.