Remediate the 2026-09-03 feature-test findings

plugins/backups/api/routes.py

@@ -116,13 +116,25 @@ def asset_revisions(assetid):
 
     revisions = query.order_by(BackupRevision.backuprevisionid.desc()).all()
 
-    # "Latest" is per kind, not per asset, so an unfiltered listing still marks
-    # the current revision of each kind correctly.
+    # "Latest" is per kind AND per source chain. Per kind alone was wrong on
+    # the case this exists for: NTLARS settings describe a machine but are read
+    # off the controlling PC, so a machine with two reporting PCs has two
+    # independent chains of the same kind. Marking only the highest revision id
+    # meant the second PC's current revision was badged as history and lost its
+    # "last verified" stamp - the machine looked like it had one source that
+    # kept re-reporting, rather than two.
+    #
+    # sourcehostname is the chain: it records which PC produced the revision.
+    # A revision with none (an older row, or a share-drop with no host) forms
+    # its own chain under the empty key, which keeps the per-kind behaviour for
+    # everything that has only ever had one source.
     seen = set()
     out = []
     for revision in revisions:
-        islatest = revision.backupkind not in seen
-        seen.add(revision.backupkind)
+        chain = (revision.backupkind,
+                 (revision.sourcehostname or '').strip().lower())
+        islatest = chain not in seen
+        seen.add(chain)
         out.append(_summary(revision, islatest=islatest))
     return success_response(out)
 
@@ -297,6 +309,23 @@ def diff_revision(backuprevisionid):
     againstid = request.args.get('against', type=int)
     if againstid:
         other = db.session.get(BackupRevision, againstid)
+        # It has to belong to the SAME asset. Any revision id was accepted, so
+        # ?against=<another asset's revision> rendered that asset's
+        # configuration values as the "before" side of this asset's history -
+        # a diff that reads as a change on this machine and describes a
+        # different one. The default branch below has always been asset-scoped;
+        # only the explicit one was not.
+        if other is not None and other.assetid != revision.assetid:
+            return error_response(
+                ErrorCodes.VALIDATION_ERROR,
+                'Revision {} belongs to a different asset and cannot be '
+                'compared against this one'.format(againstid))
+        if other is not None and other.backupkind != revision.backupkind:
+            return error_response(
+                ErrorCodes.VALIDATION_ERROR,
+                'Revision {} is a {} backup and this one is {} - there is '
+                'nothing to compare'.format(againstid, other.backupkind,
+                                            revision.backupkind))
     else:
         # The previous revision FROM THE SAME PC. Several PCs can share a
         # machine number, and diffing across them reported one device's COM port