An investigation card could vanish from a reply that contained step
separators: the winning revision was keyed by its position in the
untouched reply, while rendering walked the stripped parts. Both now
index the same stripped list.
A host-written `data-view` card counted towards winning a revision but
was never drawn as a card, so it could suppress the tool-rendered card
it competed with into nothing. Both carriers now render.
`apiGet` left `fetch` and `res.json()` unguarded, so a connection reset
threw out of the tool, and a transport failure that did land could read
as a definite 404. It now returns a transport failure the way the
sibling paths do.
Also: guard the card's Hypotheses section on length, as Evidence
already is, and move the reports auth resource out of the serializer so
rendering a report doesn't pull the route builder in.
Katia Bulatova
2aacd26c84