fix(inplace,embed): input set back mid-flight, report inputs, ambiguous anchors

Four items owed after S5b, reported by design-dev during the anti-slop run:

- carry() measured a sent-then-changed form against its OLD DEFAULTS. An
  answer set back mid-flight to the value the page first showed read as
  untouched, and the swap put the just-saved value over it. A form sent and
  then changed is now measured against its sent snapshot (sentSet.snapOf).
- The embed's clean-batch reload saw only our own forms. A report's own
  inputs lost whatever the operator had typed into them. Unsaved text in
  any control we don't own now holds the reload, and the page says so.
- Two r2b.toml rows ("D3 a stored theme...", "D3 forced light...") matched
  twice, so they proved only by where the first match fell. Both are
  re-anchored, and scripts/mutation_check.py now refuses any anchor that
  matches more than once. A new tool control covers that.
- The r2_flow contract's C3 steps 2 and 4 now say what S5b superseded. U3
  gains the report-input rule.

Mutation rows: u3_submit_all +1, r2_submit_all +1. Four rows were
re-anchored onto the moved lines.

scripts/mutation_check.py

@@ -80,8 +80,14 @@ def check(mutation: dict, repo: Path = REPO) -> tuple[bool, str]:
         return False, f"BASELINE RED — {test} fails BEFORE the mutation"
 
     src = path.read_text()
-    if mutation["old"] not in src:
+    hits = src.count(mutation["old"])
+    if hits == 0:
         return False, f"anchor not found in {mutation['file']} — the table has drifted"
+    if hits > 1:
+        # The replace below takes the FIRST match, so an anchor that matches
+        # twice proves by where that match happens to fall, not by the line the
+        # row names. Two r2b rows proved that way until 2026-09-28.
+        return False, f"anchor is ambiguous — it matches {hits} places in {mutation['file']}"
 
     INFLIGHT.write_text(f"{path}\n")
     stat = path.stat()  # mtime included; see the restore below