[abrichr]

Fixes the homonym-row fail-open the realism audit reproduced in headless Chromium (REALISM_AUDIT identity-8, audit PR #1467).

Before

A worklist shows two rows with the same text, "John Smith Follow-up Dr Lee" (data-id 1001 and 1002). The recording opens 1001 and clicks "Sign visit note". After the rows swap order, replay clicks the row where 1001 used to be, which is now 1002. The structured identity check returns verified, because the text matches exactly, and the run reports success=True with "Signed chart 1002" on screen. Every rung behaves this way: once the point lands on a row whose text matches, nothing checks whether another shown row reads the same.

After

Once the identity ladder verifies, the runtime counts the shown rows that carry the same identity:

Shown rows with that identity	Record id recorded at teach time	Result
1	none, or the same id	verified, as before
1	a different id	identity mismatch, halt
2 or more	yes, and one shown row has it	acts on that row; a template or text resolution moves onto it
2 or more	none, or several rows share it	halts before acting, whatever the step's risk
too many rows to count	any	halts
the target is not a row (a form field, a button)	any	proceeds as before
the surface can't count rows (no census on the backend, or a pixel crop with no OCR band)	any	halts if this step or a later one is a consequential write (identity_uncounted), under every profile; otherwise proceeds and records census_status="cannot_count"

• The browser backend gets identity_candidates_at(x, y). It lists each shown row (tr, li, [role=row], [role=listitem]) whose structured identity equals the identity under the point, with the row's stable record id: app-owned data-* id attributes (data-id, data-record-id, data-mrn, ...) and the path of the row's link. Attribute names that look like an index, and values equal to the row's position, are ignored.
• The recorder captures that id on click events. The compiler stores it in the identity template as a salted HMAC, so the bundle never holds the plaintext. It isn't stored when the row's identity contains a run parameter, since the demonstrated id would belong to another record.
• A structural resolution is never moved. If it points at the wrong record, the identity check refuses it.
• On pixel-only screens the same count runs over the frame's OCR rows, using the same band verifier as the OCR tier.
• The recorder also records whether the identity came from a row (structured_row). That lets a replay surface with no census still run form fields and buttons.
• "Sign" now counts as a write verb ("Sign visit note", "Co-sign", "e-sign"), never "sign in", "sign on" or "sign out". In the audit repro, the compiled Sign step wasn't treated as consequential before this change.
• Qualification checks retained identity evidence against the ladder verdict alone. The census reads the whole screen, which that evidence doesn't hold.
• IdentityCheck gains candidate_count, ambiguity_halt and census_status. Both are left out of the JSON when unset, and so is the template's record_key, so existing bundle and report bytes don't change.

With the fix, the audit's replay signs chart 1001 and reports success. Without data ids, the run stops at the first click and nothing is opened.

Tests

• tests/test_realism_browser.py (real headless Chromium): this PR carries the file from test: realism audit and real-browser tests for gaps the fakes hide #1467 with the strict xfail removed. The audit test passes. New cases cover rows in the recorded order (no false stop), a swap with ids (signs 1001), two and three identical rows without ids in several orders (halt, nothing opened), and a unique row after a swap (passes).
• tests/test_identity_census.py: the decision rules for two and three identical candidates, identical text with distinct ids (picked by id), a unique row, a unique row carrying another id, a recorded id on two rows, frames, incomplete censuses, hashing of the record id, and the OCR row count.
• On a backend with no census (a Playwright backend with the census removed, standing in for native and remote surfaces), the swapped worklist halts before opening a chart, and the note form still saves.
• The first CI run failed on two shards, for real reasons. The OCR census's extra screen read used up the scripted OCR results in fake-vision tests, and qualification's exact-equality check saw the new candidate_count. The scripts now include the census read. Fakes that model a single record row now expose a one-row census.
• I ran ruff, mypy (including the strict safety path) and 79 targeted test files (2,971 passed) locally. CI runs the full suite.
• Behavior change on native and remote surfaces: a structured or pixel identity that leads into a write now halts there until those backends get a census.

Not covered here

• The native accessibility backends (Windows, macOS, Linux) and pixel crops with no OCR band have no candidate census yet. They now halt before writes (above) instead of guessing.
• The in-page interactive recorder doesn't capture the record id. Its bundles still get the census, so identical rows halt there instead of being picked by id.
• tests/e2e/test_chaos.py::TestLayoutSwapMidRun::test_swapped_type_buttons_still_select_the_right_type fails on origin/main as well. Swapped type buttons replay as success and select the wrong type. That's a separate fail-open and isn't touched here.

🤖 Generated with Claude Code