Identity: placeholder-only controls in generic resource forms compile unarmed #1577

Found while bringing OpenAdapt up on Medplum 5.2.8 (#1548, bug 21).

What happens

Medplum's new-patient page is a generic FHIR resource form. Several of its controls have nothing readable beside them in their row:

• the "Add Name" button;
• the Telecom system selects and Value fields;
• Gender and Birth Date.

Their visible label sits in a header row above, or there is only a placeholder.

The compiler's identity check reads row text and excludes the control's own label as mutable evidence. So 7 of the 17 identity-relevant clicks compiled unarmed. The reasons it gave were "the only readable row text is the target's own label" and "row text outside the target's label is too generic". clinical-write then refuses the program (prohibit_unarmed_clicks).

The workaround in #1548 re-teaches those fields by keyboard (Tab and Shift+Tab from armed clicks). That works, but a person should not have to know this, and it needs the focus_on postcondition for the key steps.

Option to consider: the placeholder as the accessible name

Browsers already use a field's placeholder as its accessible name when it has no label (Playwright's role locator sees Medplum's Telecom value field as textbox "Value"). The identity check could accept a placeholder as the name when:

• it is unique on the page at teach time, and
• the field is empty at teach time, so the placeholder is showing and is not a typed value.

Trade-offs:

• For: no re-teach by keyboard. The evidence is structural (role plus name from the accessibility tree), not OCR, and replay already resolves role plus name.
• Against: placeholders are weak identity.
  • Many forms reuse "Value", "Search" or "Enter text". Uniqueness at teach time doesn't stop a later row from adding a second "Value".
  • A placeholder vanishes once the field has text, so it can't be re-read after typing.
  • It names a kind of field, not a record. Identity on a field click guards the wrong field, not the wrong record, so this matters less than on a save.
• Needed to be safe:
  • Re-check uniqueness at replay; zero or several matches halts.
  • Never use it on a consequential step.
  • Require the field to be empty when the click lands, and keep the record check after the save as the real guard.

Not built; this issue records the option and its trade-offs for a decision.

🤖 Generated with Claude Code