[abrichr]

Fixes that cut false stops and wrong writes and make recovery after an app change work under the production configuration (Regulated, problems_only, durable, pinned). They were found and measured on local OpenEMR; the evidence is in OpenAdaptAI/OpenAdapt#1513, which is stacked on this PR.

1. Relabel repair (repair/relabel.py)

A renamed save button stopped every item until a person re-taught the step. Self-repair refuses every failed identity check, because a renamed control usually can't be told from a different one.

propose() handles the one case that can be told apart:

• It rebuilds the recorded structured identity from the observed one, with only the label swapped back.
• It checks that against the recorded salted hash.
• A match proves the control id, kind and form are unchanged.

It refuses:

• input to the halted step or to any earlier save;
• a non-structured or parameter-bearing identity;
• a target found below the structural rung;
• any mismatch.

build() changes only that step's identity hash, intent and OCR text.

readmit() then:

1. re-qualifies the candidate with the parent's campaign on the test copy;
2. asks a person once;
3. signs lineage, when the control is not in the record check.

A save button's identity is part of the record check, so fixed_contract_refusal correctly refuses a lineage hop. In that case readmit() returns fresh_admission: the person's approval admits the certified copy, and the deployment re-pins. Qualified and managed runs stay refused.

2. no_duplicate_candidate postcondition

OpenEMR's duplicate check lists any chart that shares a first or last name or a date of birth. The recorded program required "No matches were found.", so it stopped on any listed chart. 9 of 15 such stops in the before run shared only a first name.

The new postcondition reads the listed rows from the DOM (PlaywrightBackend.element_texts).

• It passes when the list has loaded and no row carries the run's value of any named parameter (here lname, DOB).
• An empty list passes only with its "no matches" marker.
• It fails closed when the list is unreadable or the value is missing.
• A same-name patient with a mistyped date of birth still stops.
• A date is compared as a date. Each date the row shows (Apr 20, 1944, 20.04.1944, 04/20/1944, ISO) is read as intake reads dates, so a chart that shares only the date of birth stops the item, even under another last name. A row date that reads either way counts when either reading matches.

Linear runs now keep their params for this check (_run_params). See docs/DUPLICATE_CHECK.md.

3. Two bugs the live runs found

• Re-qualification was always refused in the process that qualified the parent. A case run's authorization id is its run id, and a process refuses an id it has already used. readmission.requalify now passes a fresh run_id_prefix. Replaying the same authorization is still refused (test_governed_authorization).
• A switched-off problems_only gate never asked a person. The switch check (P1) runs at the save, after the last point a person can be asked. The gate now asks there while the switch log reads off and an approval store is wired, as each_item does.

4. Dates: converted at intake when the order can be told, refused before any step otherwise

A referral that wrote the date of birth as MM/DD/YYYY was typed into the form, and OpenEMR saved today's date. The record check caught it afterwards, but a wrong chart landed, and the problems_only switch turned off for the rest of the run.

A run now refuses before any step when a ParamKind.DATE value is not a canonical ISO date, as hosted dispatch already did (runner.inputs). The OpenEMR program declares DOB as a string; the soak's typed_dob option admits the version that declares it a date.

So that this doesn't just turn a wrong save into a stop, intake now converts a date to ISO when its order can be told. It keeps the original text and the conversion in the provenance file (raw_value, conversion). The order can be told when:

• the date is ISO already;
• the month is spelled out;
• it is written YYYY/MM/DD;
• a numeric date has a part over 12 (12/25/1970), or equal parts;
• the source's order is declared (--date-format DOB=MM/DD/YYYY).

A numeric date that reads either way with no declared format (03/04/1970), and a date that doesn't exist (1970-02-30), go to a person. Intake used to read every numeric date as MM/DD/YYYY, which silently swapped day and month for a DD/MM source. The run-time ISO check stays as the last guard.

Measured (#1513, local OpenEMR, synthetic data, cost model x1)

	before	after
Verified items per operator-minute	0.033	0.327
Entering every item by hand	0.333	0.333
False stops per 100 items	70.4	16.4
Silent wrong	0	0 of 30

• Recovery from the relabel took 8.3 operator minutes and 896 s from the stop to the item done.
• Two malformed dates of birth were saved wrong and caught by the record check; section 4 is the fix. It isn't in the measured after run.

Tests

• New test_repair_relabel.py (10): proof; refusals (another control, another form, a field, unstructured, geometry, a step that may have written); the candidate changes only the label; a failed re-qualification asks nobody; a decline admits nothing; a fresh admission.
• New test_no_duplicate_candidate.py (17): first-name-only hits proceed; a last name or a date of birth in any format stops; an ambiguous row date counts on either reading; unrelated or absent dates proceed; it fails closed.
• New test_intake_dates.py (20): 12/25/1970 converts; 03/04/1970 halts without a declared format and converts with one (either order); 1970-02-30 and other invalid dates halt; the conversion is recorded as provenance; an ambiguous date needs a person. test_provenance.py's fixture date changed from the ambiguous 03/07/1991 to 03/27/1991.
• New typed-date tests in test_program_ir_phase1.py (6): five malformed values refuse before anything is typed; an ISO date runs.
• Two new tests in test_approval_mode_replayer.py (switched off: approve then save; no answer, no save).
• A new run-id test in test_repair_readmission.py.
• Locally:
  • the approval-mode, self-repair, replayer, readback, local-edit, layout-drift and capabilities-map suites pass;
  • test_layout_drift::test_real_render[kw3-font_size_changed] fails the same way on main (local font rendering);
  • ruff and mypy pass.

🤖 Generated with Claude Code