fix(inplace,embed): input set back mid-flight, report inputs, ambiguous anchors

Four items owed after S5b, reported by design-dev during the anti-slop run:

- carry() measured a sent-then-changed form against its OLD DEFAULTS. An
  answer set back mid-flight to the value the page first showed read as
  untouched, and the swap put the just-saved value over it. A form sent and
  then changed is now measured against its sent snapshot (sentSet.snapOf).
- The embed's clean-batch reload saw only our own forms. A report's own
  inputs lost whatever the operator had typed into them. Unsaved text in
  any control we don't own now holds the reload, and the page says so.
- Two r2b.toml rows ("D3 a stored theme...", "D3 forced light...") matched
  twice, so they proved only by where the first match fell. Both are
  re-anchored, and scripts/mutation_check.py now refuses any anchor that
  matches more than once. A new tool control covers that.
- The r2_flow contract's C3 steps 2 and 4 now say what S5b superseded. U3
  gains the report-input rule.

Mutation rows: u3_submit_all +1, r2_submit_all +1. Four rows were
re-anchored onto the moved lines.

tests/test_mutation_check.py

@@ -128,3 +128,17 @@ def test_a_reverted_file_keeps_its_mtime(tmp_path):
     check({"label": "flip", "file": "mod.py", "test": "test_probe.py::test_f",
            "old": "return 2", "new": "return 3"}, repo=repo)
     assert mod.stat().st_mtime_ns == before
+
+
+def test_an_ambiguous_anchor_is_reported_not_guessed(tmp_path):
+    """An `old` that matches twice mutates whichever comes FIRST, so the row
+    proves or fails by where the first match happens to fall rather than by
+    the line it names. design-dev found two r2b rows proving that way
+    (2026-09-28). A row must name exactly one place."""
+    repo = _tree(tmp_path, "def f():\n    x = 2\n    x = 2\n    return x\n",
+                 "def test_f():\n    assert f() == 2\n")
+    proved, note = check(
+        {"label": "twice", "file": "mod.py", "test": "test_probe.py::test_f",
+         "old": "    x = 2\n", "new": "    x = 3\n"}, repo=repo)
+    assert not proved
+    assert "ambiguous" in note