One run that belongs to this sweep, unscoped, for the side-by-side modal.

404 unless item_id is an item of this sweep that named the run — the same id on another company's history, or a sibling item that reused the run for a different file, is not this click's business. Findings come back with citation boxes so the PDF pane can highlight them. Only this collateral's findings: a run can carry more than one upload, and boxes on another file are coordinates in different bytes. Suppressed and obsolete risks are omitted — matching the customer surface — and suppressed_by_rule_id is not in the payload, because this modal has no suppression UI.

This is the whole analysis, not a summary of it. The modal draws the product's own risk cards, requirement citations and all, so everything they render is served here rather than fetched from the customer routes: those answer for the caller's company, and staff comparing two runs of a tenant's collateral are not in it. One request per pane, no masquerade.