fix(asks): one submit saves every ask on the page

Operator report (via infra-ops): on a page with several asks, a submit
saved only the pressed one and the reload wiped the rest. Confirmed on
auk-audition: one POST at 15:02:23 saved the last ask on the page, then a
400 from the submit of an ask the reload had just blanked.

Client-side on both surfaces; /answer is unchanged. A submit on a pick
form, while another pick form on the page holds unsent input, sends every
changed ("dirty") pick form: one POST each, to its own action, with
Accept: application/json, in document order. A refusal stops nothing, and
untouched forms are never re-sent. With no other dirty form, a submit is
exactly what it was.

- embed.js (verbatim reports): reloads only when nothing was refused and
  nothing of ours is dirty. Otherwise a server-rendered status line in the
  submit block says what did not save, and input stays. A form the server
  took gets a new baseline. A press during the flight is ignored.
- base.html (marks page, lightbox, review rail): one refresh in place. A
  batch never reloads. Only forms the server took count as sent. In-flight
  state and "just sent" are keyed by form identity (formKey) plus the fields
  at the press, not the DOM node.

Two heid bug-hunt rounds: a four-arm panel on the first cut, then Hulda
alone on the fold. Ten findings reproduced red in a browser before their
fixes. Contracts: U3 "Submitting several asks at once" + INV-8, R2 C3
steps 2, 3 and 3a. Mutation tables u3_submit_all (15) and r2_submit_all
(11), all proved. Suite 928 -> 951.

tests/mutations/r2_flow.toml

@@ -118,7 +118,7 @@ new = '''        except OSError:
 label = 'C3 client: no busy guard (a double-click writes twice)'
 file = "booth/templates/base.html"
 test = "tests/test_flow_browser.py::test_an_unsaved_choice_survives_a_save_elsewhere_and_a_double_click_writes_once"
-old = '''      if (form.__busy) return;
+old = '''      if (pending[flightKey(form)]) return;
 '''
 new = ''''''
 
@@ -133,8 +133,8 @@ new = ''''''
 label = 'C3 client: saves are not serialized'
 file = "booth/templates/base.html"
 test = "tests/test_flow_browser.py::test_quick_successive_flags_all_show"
-old = '''      queue = queue.then(function () { return run(form, data); })'''
-new = '''      queue = run(form, data)'''
+old = '''      queue = queue.then(function () { return run(form, data, snap); })'''
+new = '''      queue = run(form, data, snap)'''
 
 [[mutation]]
 label = 'C3 the standalone marks page has no region'

tests/mutations/r2_submit_all.toml

@@ -0,0 +1,109 @@
+# R2 C3 step 3a, 2026-09-27: one submit saves every changed pick on a Booth
+# page (the marks page, the lightbox's verdict aside, the review rail). The
+# Booth-page half of the operator's report; the verbatim half is
+# u3_submit_all.toml. Contract: docs/contracts/r2_flow.contract.md, C3 step 3a.
+# The flight-window and refusal rows came from the heid bug-hunt panel on the
+# first cut.
+
+unit = "r2 submit all"
+
+[[mutation]]
+label = "the other pick forms are ignored (one form, one save, as before)"
+file = "booth/templates/base.html"
+test = "tests/test_flow_browser.py::test_one_submit_on_the_marks_page_saves_every_changed_pick"
+old = '''
+      var batch = pickBatch(form);'''
+new = '''
+      var batch = null;'''
+
+[[mutation]]
+label = "the pressed pick is sent even when blank (its 400 reloads the rest away)"
+file = "booth/templates/base.html"
+test = "tests/test_flow_browser.py::test_pressing_a_blank_picks_submit_saves_the_others_and_skips_it"
+old = '''
+      return others ? picks.filter(function (f) { return dirty(f) && !pending[flightKey(f)]; }) : null;'''
+new = '''
+      return others ? picks.filter(function (f) { return (f === form || dirty(f)) && !pending[flightKey(f)]; }) : null;'''
+
+[[mutation]]
+label = "a refusal stops the picks after it"
+file = "booth/templates/base.html"
+test = "tests/test_flow_browser.py::test_a_refused_pick_in_a_batch_costs_only_itself_and_clears_nothing"
+old = '''
+          return post(f, datas[i]).then(function () {'''
+new = '''
+          if (refused.length) return;
+          return post(f, datas[i]).then(function () {'''
+
+[[mutation]]
+label = "a refused batch reloads (the refused pick and every draft are lost)"
+file = "booth/templates/base.html"
+test = "tests/test_flow_browser.py::test_a_refused_pick_in_a_batch_costs_only_itself_and_clears_nothing"
+old = '''
+        var shown = saved.length ? refresh(saved, true) : Promise.resolve(true);'''
+new = '''
+        if (refused.length) { fail(); return; }
+        var shown = saved.length ? refresh(saved, true) : Promise.resolve(true);'''
+
+[[mutation]]
+label = "a refused pick counts as sent, so its input comes back as the server has it"
+file = "booth/templates/base.html"
+test = "tests/test_flow_browser.py::test_a_refused_pick_in_a_batch_costs_only_itself_and_clears_nothing"
+old = '''
+          }, function (e) { refused.push(askOf(f) + ' (' + e.message + ')'); });'''
+new = '''
+          }, function (e) { saved.push({key: flightKey(f), snap: snaps[i]}); refused.push(askOf(f) + ' (' + e.message + ')'); });'''
+
+[[mutation]]
+label = "a form in flight stops counting as another dirty form (a clean press 400s mid-save)"
+file = "booth/templates/base.html"
+test = "tests/test_flow_browser.py::test_pressing_a_clean_pick_during_a_batch_sends_nothing"
+old = '''
+        return f.getAttribute('action') === action && isPick(f);'''
+new = '''
+        return f.getAttribute('action') === action && isPick(f) && !pending[flightKey(f)];'''
+
+[[mutation]]
+label = "in flight is marked on the node, so a swap's fresh copy can be sent twice"
+file = "booth/templates/base.html"
+test = "tests/test_flow_browser.py::test_a_pick_in_flight_stays_in_flight_across_another_saves_swap"
+old = '''
+    function flightKey(f) { return formKey(f); }'''
+new = '''
+    var nth = 0;
+    function flightKey(f) { return f.__fk || (f.__fk = 'n' + (++nth)); }'''
+
+[[mutation]]
+label = "a new save does not clear the last one's words"
+file = "booth/templates/base.html"
+test = "tests/test_flow_browser.py::test_a_later_save_clears_a_stale_not_saved_line"
+old = '''
+      if (st) { st.textContent = ''; st.hidden = true; }'''
+new = ''''''
+
+[[mutation]]
+label = "a batch whose refresh fails reloads (every unsent draft with it)"
+file = "booth/templates/base.html"
+test = "tests/test_flow_browser.py::test_a_batch_whose_refresh_fails_keeps_the_page"
+old = '''
+        var shown = saved.length ? refresh(saved, true) : Promise.resolve(true);'''
+new = '''
+        var shown = saved.length ? refresh(saved, true).catch(function (e) { fail(); throw e; }) : Promise.resolve(true);'''
+
+[[mutation]]
+label = "a sent form counts as sent even when it changed after the press"
+file = "booth/templates/base.html"
+test = "tests/test_flow_browser.py::test_a_change_to_a_sent_pick_during_the_flight_is_kept"
+old = '''
+          if (recs[i].key === k && recs[i].snap === serial(f)) return true;'''
+new = '''
+          if (recs[i].key === k) return true;'''
+
+[[mutation]]
+label = "no form counts as sent (a saved note's text carries back as a draft)"
+file = "booth/templates/base.html"
+test = "tests/test_flow_browser.py::test_a_saved_notes_box_comes_back_empty"
+old = '''
+          if (recs[i].key === k && recs[i].snap === serial(f)) return true;'''
+new = '''
+          if (false) return true;'''

tests/mutations/u3_submit_all.toml

@@ -0,0 +1,141 @@
+# U3 amendment, 2026-09-27: one submit saves every ask on a verbatim report.
+# The operator answered three asks top to bottom, pressed the last button, and
+# the 303 reload wiped the first two (`auk-audition`, 15:02:23). Contract:
+# docs/contracts/u3_declared_embed_seam.contract.md, "Submitting several asks at
+# once" and INV-8. Every row is a change tests/test_embed_browser.py claims to
+# forbid. The flight-window rows came from the heid bug-hunt panel on the first
+# cut, where every guard of that window survived its mutation.
+
+unit = "u3 submit all"
+
+[[mutation]]
+label = "only the pressed form is sent (the reported defect)"
+file = "booth/static/embed.js"
+test = "tests/test_embed_browser.py::test_one_submit_saves_every_answered_ask_on_the_page[a3]"
+old = '''
+    var batch = forms.filter(dirty);'''
+new = '''
+    var batch = [form];'''
+
+[[mutation]]
+label = "the pressed form is sent whether or not it is dirty (a blank one 400s)"
+file = "booth/static/embed.js"
+test = "tests/test_embed_browser.py::test_a_blank_ask_is_skipped_never_refused"
+old = '''
+    var batch = forms.filter(dirty);'''
+new = '''
+    var batch = forms.filter(function (f) { return f === form || dirty(f); });'''
+
+[[mutation]]
+label = "every form is sent, touched or not (re-dates an answer nobody gave)"
+file = "booth/static/embed.js"
+test = "tests/test_embed_browser.py::test_an_ask_nobody_touched_is_not_re_sent"
+old = '''
+    var batch = forms.filter(dirty);'''
+new = '''
+    var batch = forms;'''
+
+[[mutation]]
+label = "a lone dirty form is intercepted instead of left to the browser"
+file = "booth/static/embed.js"
+test = "tests/test_embed_browser.py::test_one_changed_ask_still_submits_as_a_plain_form"
+old = '''
+    if (!others) return;                        // the browser's own POST and 303'''
+new = ''''''
+
+[[mutation]]
+label = "the forms are sent in reverse document order"
+file = "booth/static/embed.js"
+test = "tests/test_embed_browser.py::test_the_asks_are_sent_in_document_order"
+old = '''
+    var batch = forms.filter(dirty);'''
+new = '''
+    var batch = forms.filter(dirty).reverse();'''
+
+[[mutation]]
+label = "a refusal stops the forms after it"
+file = "booth/static/embed.js"
+test = "tests/test_embed_browser.py::test_a_refused_ask_costs_only_itself_and_clears_nothing"
+old = '''
+        return send(f, bodies[n]).then(function (why) {'''
+new = '''
+        if (failed.length) return;
+        return send(f, bodies[n]).then(function (why) {'''
+
+[[mutation]]
+label = "a refusal reloads the page and clears what was entered"
+file = "booth/static/embed.js"
+test = "tests/test_embed_browser.py::test_a_refused_ask_costs_only_itself_and_clears_nothing"
+old = '''
+      if (!failed.length && !changed) { location.reload(); return; }'''
+new = '''
+      location.reload(); return;'''
+
+[[mutation]]
+label = "only dirtiness blocks the reload (a refused form set back to its first value reloads over the failure)"
+file = "booth/static/embed.js"
+test = "tests/test_embed_browser.py::test_a_refusal_blocks_the_reload_even_when_nothing_reads_dirty"
+old = '''
+      if (!failed.length && !changed) { location.reload(); return; }'''
+new = '''
+      if (!changed) { location.reload(); return; }'''
+
+[[mutation]]
+label = "a refusal is never said"
+file = "booth/static/embed.js"
+test = "tests/test_embed_browser.py::test_a_refused_ask_costs_only_itself_and_clears_nothing"
+old = '''
+      st.hidden = false;'''
+new = ''''''
+
+[[mutation]]
+label = "an author's own form is taken over (no ownership check at the entry)"
+file = "booth/static/embed.js"
+test = "tests/test_embed_browser.py::test_an_authors_own_form_is_never_taken_over"
+old = '''
+    if (forms.indexOf(form) < 0) return;'''
+new = ''''''
+
+[[mutation]]
+label = "an author's form wearing our id prefix counts as ours (no mounted-root check)"
+file = "booth/static/embed.js"
+test = "tests/test_embed_browser.py::test_an_authors_own_form_is_never_taken_over"
+old = '''
+        if (ours[j].contains(all[i])) { out.push(all[i]); break; }'''
+new = '''
+        out.push(all[i]); break;'''
+
+[[mutation]]
+label = "a press during the flight falls through to the browser (a native POST races the batch)"
+file = "booth/static/embed.js"
+test = "tests/test_embed_browser.py::test_a_press_inside_the_flight_never_fires_a_native_post"
+old = '''
+    if (sending) { ev.preventDefault(); return; }'''
+new = ''''''
+
+[[mutation]]
+label = "a change made during the flight is reloaded away"
+file = "booth/static/embed.js"
+test = "tests/test_embed_browser.py::test_input_made_during_the_flight_is_kept_and_saved_on_the_next_press"
+old = '''
+      var changed = forms.some(dirty);'''
+new = '''
+      var changed = false;'''
+
+[[mutation]]
+label = "a saved form keeps its old baseline, so a retry re-sends (re-dates) it"
+file = "booth/static/embed.js"
+test = "tests/test_embed_browser.py::test_a_retry_after_a_refusal_sends_only_what_did_not_save"
+old = '''
+          if (why === null) f.__bkSaved = bodies[n].toString();
+          else failed.push'''
+new = '''
+          if (why !== null) failed.push'''
+
+[[mutation]]
+label = "the empty status line shows under a host `p{display:block}`"
+file = "booth/static/embed.js"
+test = "tests/test_embed_browser.py::test_the_empty_status_line_stays_hidden_under_host_css"
+old = '''
+    ".bk-ask-status[hidden]{display:none}",'''
+new = ''''''