Retrieve an application's form definition and state together

Returns the resolved form definition and the matching application state in a single call. When no state exists, the latest active definition is returned with state: null (the frontend creates the state). When state exists, the latest active definition within the state's pinned major is resolved; if it is newer than the stored version, the state's version fields are upgraded.

Unlike the other /state routes, this endpoint does NOT enforce the lock via a pre-handler. Because it is partly responsible for resolving the grantVersion, a cold first call cannot yet carry a version-bearing token. The lock token is still required (it identifies the owner), but its grantVersion claim is optional: the endpoint resolves the authoritative version and then acquires/refreshes the application lock against that resolved version, returning 423 if another owner holds it. When a version upgrade is persisted, the now-orphaned lock on the previous version is released on a best-effort basis (any failure is ignored and that lock simply expires via its TTL).

The response always includes an upgraded boolean indicating whether a version upgrade was persisted on this call. When upgraded is true, fromVersion and toVersion report the previous and new grantVersion respectively.

Set includeDefinition: false in the request body for a state-only read: the caller already holds the form definition locally (e.g. a legacy YAML-sourced form), so the backend skips all definition resolution and version-upgrade work and returns only the stored state (and its version) with no definition payload. In that mode the lock is acquired against the state's existing version, and a 404 is never returned (a missing state simply yields state: null).