Yes. You can use cursors for that. In the following example rowlist contains list of affected ids. You can get it all at the end or get individual ids right before or after the update, or even decide on the update based on id/val values:

Class User.NewClass1 Extends %Persistent
{

Property val;

/// do ##class(User.NewClass1).Test()
ClassMethod Test()
{
   do ..%KillExtent()
   
   &sql(INSERT INTO NewClass1 SET val = 0)
   &sql(INSERT INTO NewClass1 SET val = 3)
   
   set rowlist = ""
   &sql(DECLARE NewClass1 CURSOR FOR
        SELECT %ID,val
        INTO :id, :val
        FROM NewClass1)
   
   &sql(OPEN NewClass1)
   for {
       &sql(FETCH NewClass1)
       quit:SQLCODE'=0
       set val2 = val*2
       write "Processing id: ", id,!
       set rowlist = rowlist _ $lb(id)
       &sql(UPDATE NewClass1 SET val = :val2 WHERE CURRENT OF NewClass1)
   }
   &sql(CLOSE NewClass1)
   
   zw rowlist
}
}

It would output in a terminal:

>do ##class(User.NewClass1).Test()
Processing id: 1
Processing id: 2
rowlist=$lb("1","2")

Documentation:

Here's an example:

Class User.NewClass1 Extends %Persistent
{

Property streams As list Of %Stream.GlobalCharacter;

ClassMethod Test()
{
    do ..%KillExtent()
    
    set obj = ..%New()
    set stream1 = ##class(%Stream.GlobalCharacter).%New()
    do stream1.WriteLine("Hi")
    set stream2 = ##class(%Stream.GlobalCharacter).%New()
    do stream2.WriteLine(123)
    
    do obj.streams.Insert(stream1)
    do obj.streams.Insert(stream2)
    write $System.Status.GetErrorText(obj.%Save())
    
    kill
    
    set obj = ..%OpenId(1)
    for i=1:1:obj.streams.Count() {
        write "Stream #", i, ": ", obj.streams.GetAt(i).Read($$$MaxCacheInt)
    }
}
}

Great article, however, I strongly disagree on the testing tools choice. Curl is not really the option, as CLI tools are really not the best for json editing. Upon the rest of your testing suggestions, I think there are better alternatives, such as:

  • REST clients: “Advanced REST Client” for Chrome and “REST Client” for Firefox, some are also available as a standalone applications
  • Debugging web proxies: Charles, Filddler etc. for the rare cases where REST clients do not offer enough information

The problem I see here is, if only one of the data object's properties has changed, how do we know which? Or do we simply overwrite all properties? 

If you use old json classes, you can send only changed properties, for example this json payload would be converted into  Sample.Person object with id=1 and all properties taken from disk except for Name property, which would be set to Bob:

{ _class: "Sample.Person", _id: 1, Name: "Bob" }

With new json you can get dynamic object from json with only modified properties and change persistent object by iterating over defined properties of a modified object.

IF we use cookies, they will be stored in the Session Cookie Path.

Cookie has a property named path. Whed browser determines, does the cookie apply to a current page, it checks if the cookie path is less or equal to current URL.

I'm thinking that this login cookie would be used somehow if the Login Cookie is selected? Or not used? 

It would be used, if checked.

what does happen if the Login Cookie is selected in the web application?

Login Cookies hold information about the most recently logged-in user. If you want to keep your users from having to log in too often, but you want your applications to remain distinct and unconnected, use Login Cookies. For Login Cookies, place each application in a separate session. Then authentication is shared only when an application is entered for the first time. Login Cookies applications do not form a group. So after login, changes in authentication in one application do not affect the other applications. Documentation.

What could we store in a cookie? Can we possibly find out if a second tab has been opened by using a cookie?

You can store text values in cookie. I suggest you read wiki article on them.

  • Session Cookie Path - Scope of the session cookie. This determines which URLs the browser uses to send the session cookie back to Caché. If your application name is myapp, it defaults to /myapp/ meaning it only sends the cookie for pages under /myapp/. If you restrict this to only what is required by your application, it prevents this session cookie being used by other CSP applications on this machine, or from being seen by any other application on this web server. On the other hand, browsers and cookies are case sensitive. Setting the session cookie to '/' can prevent license or session problems if, for example, an application name changes from capital to lowercase letters.
  • Login Cookies hold information about the most recently logged-in user. If you want to keep your users from having to log in too often, but you want your applications to remain distinct and unconnected, use Login Cookies.

As every BP is also a SQL table, you can select active processes which are older than 1 day  with this query:

SELECT ID, %SessionId, %SuperSession, %TimeCreated, DATEDIFF('day',%TimeCreated, CURRENT_TIMESTAMP) AS DaysOld
FROM <business_process_table>
WHERE DATEDIFF('day', %TimeCreated, CURRENT_TIMESTAMP) > 1
      AND %TimeCompleted IS NULL

As BO messages also get logged, you can check Ens.MessageHeader table for message processing time.