Stop three ways the collector and the forms wrote things nobody asked for

A review of last week's device-identity work found these; two were writing bad
data and one was reproduced against a live server before being fixed.

AN UPDATE COULD BLANK AN ASSET NUMBER, on all six asset update paths. Create
validates it and the column is NOT NULL, but the conflict check only runs when
the value DIFFERS, and '' collides with nothing - so an empty assetnumber went
straight through to a required column. This is the likely source of the assets
found with no number: a form that loaded blank and was then saved.

MACHINEFORM COULD LOAD BLANK AND LET YOU SAVE IT. One try/catch wrapped eight
reference loads AND the machine fetch, so a single transient failure among them
- one page of listAll() timing out during a collector cycle is enough - rejected
the whole block and rendered a fully editable EDIT form with every field empty,
the error banner far below next to Save. Typing an asset number and saving then
wrote the blanks over a real machine. The record now loads in its own try, and a
failure shows the reason INSTEAD of the form: an empty edit form is
indistinguishable from a record whose fields are genuinely empty.

NAMING A DEVICE THAT DID NOT RESOLVE STILL MINTED A TWIN. Both device paths
warned "not linked" and then fell through to mint <HOST>-PARTMARKER or
<HOST>-CMM - the hostname-derived twin the resolution order exists to prevent.
The warning was true about the typo'd number and false about the twin. Naming a
device is a commitment: if the name does not resolve, or resolves to the wrong
kind of thing, link nothing and say so. Silence still means "work it out", so a
bay with no file keeps the reuse-then-mint behaviour it always had.

TWO PCS COULD BOTH HOLD ONE DEVICE, ACTIVELY, WITH NO WARNING. Verified against
a live server: report as one host, then as another naming the same marker, and
both controls rows stayed active. Neither device path had ever looked at who
else held the target - only at links whose source was THIS PC - so a replaced PC
kept its link forever and an asset-id.txt copied to a second bay claimed the
device silently. It now reuses the machine link's rule rather than inventing a
second one: an incumbent that has gone quiet past the claim window or been moved
off In Use has yielded and is archived, never deleted; a live incumbent keeps
the device and the challenger is recorded dormant.

The swap test asserted the old behaviour and now asserts the new one, split in
two: a live incumbent keeps it, and handover completes once the incumbent
yields. Two other tests were passing while their names lied - the unknown-device
one checked only that the typo'd asset was not created, not that nothing was
linked, and it passed while a twin was minted beside it.

plugins/machines/api/routes.py

@@ -437,6 +437,17 @@ def update_machine(machine_id: int):
 
     asset = mach.asset
 
+    # An UPDATE may not blank the asset number. Create validates it and the
+    # column is NOT NULL, but the conflict check below only runs when the value
+    # DIFFERS, and '' never collides with anything - so a payload carrying an
+    # empty assetnumber wrote it straight through. A form that loaded blank
+    # (a failed reference load, a partial fetch) then saved the blank over a
+    # real record.
+    if 'assetnumber' in data and not (data['assetnumber'] or '').strip():
+        return error_response(
+            ErrorCodes.VALIDATION_ERROR,
+            'assetnumber cannot be empty')
+
     # Check for conflicting assetnumber
     if 'assetnumber' in data and data['assetnumber'] != asset.assetnumber:
         if Asset.query.filter_by(assetnumber=data['assetnumber']).first():

plugins/machines/frontend/views/MachineForm.vue

@@ -7,6 +7,11 @@
     <div class="card">
       <div v-if="loading" class="loading">Loading...</div>
 
+      <!-- The record failed to load. Show the reason INSTEAD of the form: an
+           empty edit form is indistinguishable from a record whose fields are
+           genuinely empty, and saving it would write the blanks back. -->
+      <div v-else-if="loadFailed" class="error-message">{{ error }}</div>
+
       <form v-else @submit.prevent="saveMachine">
         <!-- Identity Section -->
         <h3 class="form-section-title">Identity</h3>
@@ -425,6 +430,10 @@ const statuses = ref([])
 const vendors = ref([])
 const locations = ref([])
 const models = ref([])
+// Set when the record itself could not be loaded, as opposed to a reference
+// list failing. The form is withheld entirely, because an empty edit form is
+// indistinguishable from a record whose fields are genuinely empty.
+const loadFailed = ref(false)
 const businessunits = ref([])
 const pcs = ref([])
 const relationshipTypes = ref([])
@@ -506,9 +515,29 @@ onMounted(async () => {
       relationshipTypeId.value = controlsType.relationshiptypeid
     }
 
-    // Load machine if editing
+    // Load machine if editing.
+    //
+    // ITS OWN try/catch, deliberately. This used to sit inside the same block
+    // as the eight reference loads above, so ONE transient failure among them -
+    // a page of listAll() timing out on a busy collector cycle - rejected the
+    // whole thing and rendered a fully editable EDIT form with every field
+    // BLANK, including the required Asset Number, next to a Save button. Typing
+    // a number and saving then wrote the blank-loaded values over a real
+    // machine. The reference lists degrade to empty dropdowns; the record must
+    // not degrade at all.
     if (isEdit.value) {
-      const response = await machinesApi.get(route.params.id)
+      let response
+      try {
+        response = await machinesApi.get(route.params.id)
+      } catch (err) {
+        console.error('Error loading machine:', err)
+        error.value = 'Could not load this machine. Nothing has been changed - '
+          + 'reload the page rather than saving, or the blank form would '
+          + 'overwrite the record.'
+        loadFailed.value = true
+        loading.value = false
+        return
+      }
       const data = response.data.data
       currentAssetId.value = data.assetid || null
       currentMachine.value = data