Answer API errors in the envelope, say when supplies are unread, badge each chain

Three more findings from the 2026-09-03 run.

Werkzeug answered 405, 415 and a malformed JSON body itself, in HTML. A client
written against the documented {status,data,meta} contract got a page of markup
with no error code, which is indistinguishable from the server having fallen
over. The 405 had a second edge: on a route the caller cannot otherwise see, a
method-not-allowed CONFIRMS the path exists, so a gated kiosk route meant to
read as absent announced itself by refusing the wrong verb. All three now
answer in the envelope, and only under /api/ - everything else is the SPA and
keeps the framework's behaviour, deep links included.

The Toner Report rendered "0 Printers Checked / 0 Low / 0 Critical" and "No
printers match the selected filter" while the API it had just called said
supply monitoring was unreachable. Zeros read as a clean bill of health for a
fleet nobody has looked at. The page now carries the reason the API gave and
suppresses the counts, because a number nobody measured is not a result. Same
defect shape as the supplies card fixed on 2026-08-29; `unavailable` was
already in the payload and the page ignored it.

Backup revisions badged "current" per (asset, kind). NTLARS settings describe a
MACHINE but are read off the controlling PC, so a machine with two reporting
PCs has two independent chains of the same kind - and only the higher revision
id was badged, so the second PC's newest revision showed as history and lost
its last-verified stamp. The machine looked like one source re-reporting rather
than two. sourcehostname is the chain; a revision without one forms its own,
which keeps the old behaviour for everything that has only ever had one source.

Nine tests. The envelope ones verified by planting: remove the three handlers
and three fail.

Scope: product

tests/test_plugins/test_backups.py

@@ -1525,3 +1525,46 @@ def test_secret_name_matching_covers_the_usual_spellings():
         assert issecretname(name), name
     for name in ('FtpUser', 'FMSHost', 'Retries', 'Passive'):
         assert not issecretname(name), name
+
+
+# --- "current" is per source chain, not per kind -----------------------------
+#
+# NTLARS settings describe a MACHINE but are read off the controlling PC, so a
+# machine with two reporting PCs has two independent chains of the same kind.
+# islatest was computed per kind, so only the highest revision id was badged
+# current: the second PC's newest revision showed as history and lost its "last
+# verified" stamp, making the machine look like one source re-reporting rather
+# than two.
+
+def test_each_reporting_pc_keeps_its_own_current_revision(bk_app, bk_plugin):
+    from plugins.backups.api.routes import _summary
+    from plugins.backups.models import BackupRevision
+
+    with bk_app.app_context():
+        # Two PCs reporting the same machine, each twice.
+        bk_plugin.apply_collector_payload(_payload())
+        changed = CONFIGUREDREG.replace('"Cnc"=""', '"Cnc"="OKUMA"')
+        bk_plugin.apply_collector_payload(_payload(reg=changed))
+        bk_plugin.apply_collector_payload(
+            _payload(sourcehostname='NEWPC001'))
+        again = CONFIGUREDREG.replace('"Cnc"=""', '"Cnc"="MAZAK"')
+        bk_plugin.apply_collector_payload(
+            _payload(reg=again, sourcehostname='NEWPC001'))
+
+        revisions = (_db.session.query(BackupRevision)
+                     .order_by(BackupRevision.backuprevisionid.desc()).all())
+        assert len(revisions) >= 4
+
+        # Mirror what the listing route does.
+        seen = set()
+        current = {}
+        for revision in revisions:
+            chain = (revision.backupkind,
+                     (revision.sourcehostname or '').strip().lower())
+            if chain not in seen:
+                seen.add(chain)
+                current[revision.sourcehostname] = revision.backuprevisionid
+
+        assert set(current) == {'GGBX0NH3ESF', 'NEWPC001'}, \
+            'each reporting PC has a current revision of its own'
+        assert _summary(revisions[0], islatest=True)['islatest'] is True