How part D of #200 is built: the review list, merging, protected values and name mappings. For what they do, see Asset review. For why, see the design. Matching itself is unchanged; see Asset reconciliation - Developer Guide.

asset_review_items
  tenant_id, kind, match_key   UNIQUE (tenant_id, match_key) - one row per case however often seen
  asset_id, other_asset_id     FK assets ON DELETE CASCADE
  source, detail (JSON)        e.g. {"serial": "...", "model": "...", "observed_at": "..."}
  first_seen_at, last_seen_at
  status                       open | merged | different | ignored | resolved
  resolved_by_id, resolved_at

Decisions stick. record() only reopens a resolved case (one that sorted itself out); merged, different and ignored stay. sync() and openFor() pass $touch = false, so finding a known case again never moves its dates.

Self-resolution. sync() closes shared_serial cases whose pair no longer shares a serial. applyObserved() calls settle() when a peripheral's serial now matches exactly one asset.

Why openFor() re-checks one serial. The asset page should say an asset shares a serial even if nobody has opened the Review tab yet. It runs sync()'s check for that one serial, with the same keys, so the two never disagree.

AssetMergeService::merge($conn, $ctx, $keepId, $goneId, $reviewItemId), in one transaction:

1. Lock both assets; refuse different companies, and two assets both out on a lease.
2. Walk REFERENCES, every column that refers to an asset, and apply its rule.
3. polymorphic(): document_links (parent_type asset), asset_field_values.value_ref_id for fields whose ref_kind is asset, analyst_recent_trail.
4. Fill the kept record's empty FILL fields from the other; widen first_seen and last_seen.
5. Write asset_merges and a merged history row on the kept asset.
6. Delete the merged asset, then apply the filled fields (so a filled asset tag or serial never meets its own original).

The unique rule is one self-join:

UPDATE `$table` g LEFT JOIN `$table` k ON k.`$col` = :keep AND k.key <=> g.key ...
   SET g.`$col` = :keep WHERE g.`$col` = :gone AND k.`$col` IS NULL;
DELETE FROM `$table` WHERE `$col` = :gone;   -- what was left is a duplicate

One left out keeps pointing at a deleted asset, or behind ON DELETE CASCADE is silently deleted with it. tests/asset-merge.php scans db_verify_schema.php for *asset_id and host_id columns and fails naming any that is not in REFERENCES or NOT_REFERENCES. Taking one entry out makes it fail. Add a polymorphic reference to polymorphic() and POLYMORPHIC by hand; the scan cannot see those.

asset_merges   merged_asset_id (UNIQUE, no FK - it is gone), into_asset_id (FK CASCADE),
               merged_hostname, merged_service_tag, merged_asset_tag, merged_qr_token, merged_by_id, merged_at, summary

• current($id) follows asset_merges (chains included) to the asset an id means today. Used by the asset page (a redirect at the top of index.php), POST /assets/{id}/inventory (before apiLoadAsset()), and a REST connection's connected_asset_id.
• intoForQrToken($token) is the fallback in assetIdForToken(), so a scanned label on the merged device opens the kept asset.

asset_protected_fields   asset_id (FK CASCADE), field_name   UNIQUE (asset_id, field_name)
                         protected_by_id, protected_at, reported_value, reported_source, reported_at

FIELDS is hostname, manufacturer, model: the built-in fields a person can edit on Key info that a source also writes. The serial is excluded on purpose (it is the matching key).

Enforcement is in exactly the two places a source writes them:

filterReported($conn, $assetId, ['field' => value], $source) returns what the source may write and stores what it said for each protected field, or clears it when it agrees again. $source is shown on the page: the agent, Intune, software inventory.

People are not stopped. updateFields() (the page, REST PATCH, the spreadsheet import) writes as before. update_asset_field.php then calls afterPersonEdit(), which protects the field when the setting asset_protect_on_edit is on (the default; '0' turns it off) and the asset has last_seen (a source reports it).

asset_name_mappings   field ('manufacturer' | 'model'), from_value, to_value   UNIQUE (field, from_value)

Install-wide; matching ignores case (the collation, and mb_strtolower() in lookup()). Never written back to assets.

save() refuses a name mapped to itself, and refuses mapping to a name that is itself mapped. It repoints anything that mapped to the new from, so there are never chains to follow. Not applied to labels, handover documents or other printouts: they show the stored value.

• Merging two assets from anywhere but the review list. There is deliberately no free-form "merge any two assets" button: a merge should start from a reason.
• Watchtower does not count open review cases.
• Name mappings on printouts.