Pictures of the regions of this collateral that the named risks cite.

Batched over risk ids the way /files/preview-image-urls is over upload ids, and for the same reason: the caller is a single export that wants every crop at once. Risks that resolve to no picture — no grounded citation, a page the document does not have, a rendition that is not in S3 — are left out of the mapping, so the caller maps back over the ids it asked for.

Risks are grouped by the upload they were flagged on and each group is cropped from its own rendition. Within a group they are honoured in the order asked; across groups the current version comes first, because that is where a risk the reviewer is still looking at lives.