Fresh OpenEMR referral fails clinical-write: clicks into six unlabelled text fields need a risk review #1532

What certify reports

A freshly recorded and compiled OpenEMR referral (the patient-registration program from the OpenEMR quickstart, #1431, recorded with the benchmark's scripted recorder and compiled with drop_redundant_keys and pixel_verify_enabled) fails openadapt-flow certify BUNDLE --policy clinical-write with 9 violations. Six of them have this one cause:

(require_reviewed_action_risk) [step_009] write-shaped action risk has no current, bound operator classification — qualification must apply and certify an explicit risk override (unlabelled pointer control may be navigation, focus, or a state change)

The same message appears for step_018, step_021, step_027, step_030 and step_033. These are the clicks into the text fields #form_DOB, #form_street, #form_city, #form_postal_code, #form_phone_home and #form_email. Each click is followed by Ctrl+A and a typed parameter in the same field.

Only qualification's reviewed risk overrides clear them today, so the quickstart replays a pre-certified bundle instead of the user's own recording.

Why a fresh recording hits it

1. The OpenEMR recorder adapter drops the field's name. OpenEMRPlaywrightBackend.structural_locator_at (packages/flow/scripts/openemr_local_demo.py:312-330) rebuilds the locator from _form_target, whose result has no name, so it records name=None even though the generic locator from super().structural_locator_at has one (the generic field-label code finds form_DOB from the name attribute; the following type event records field_label: "form_DOB").
2. The risk classifier then sees a click with no label. In infer_step_risk (packages/flow/openadapt_flow/risk.py:826-847), a click with no meaningful OCR text and no structural name is "unlabelled pointer control" and requires_review=True. An empty text box has no OCR text. #form_fname and #form_lname pass only because OCR reads their placeholder text.

Check

Recompiling the same recording with structural.name set to the field id on these six clicks removes all six violations (certify then reports nothing for these steps).

Suggested fix

• Recorder: in structural_locator_at (scripts/openemr_local_demo.py:329), keep the generic name when the adapter has none: name=target.get("name") or located.name.
• Compiler: in infer_step_risk (openadapt_flow/risk.py:830), classify a click whose structural role is textbox/combobox and whose next input step types into that same field as a focus click (reversible, no review), with a sealed check like the existing local-edit pattern. That covers apps that give a field no name at all.

Related: #1329 (the same rule on an unlabelled click in another app).

The other violations on the same fresh bundle: #1533 (step_039) and #1534 (step_040).