OpenEMR referral record check has no idempotency key unless qualification adds it #1534

What certify reports

A freshly recorded and compiled OpenEMR referral (see #1431) fails openadapt-flow certify BUNDLE --policy clinical-write on the save click (#confirmCreate):

(require_idempotency_key_for) [step_040] step matches require_idempotency_key_for but no declared system-of-record effect carries an idempotency key — a retried/duplicated submission could land as a silent duplicate write

Why a fresh recording hits it

The compile path binds the save step's record check from patient_effects() (packages/flow/openadapt_flow/benchmark/openemr_local.py:109-131, called from packages/flow/scripts/openemr_local_demo.py:840). Its RECORD_WRITTEN effect matches on email and lname but sets no idempotency_key.

Qualification adds the key: benchmark/openemr_local/verify.yaml declares duplicate_key: email, and openadapt_flow/qualify/campaign.py:173-175 turns it into idempotency_key and key_field. So the certified bundle passes and a fresh compile does not. The two paths describe the same write differently.

Check

Recompiling the same recording with idempotency_key=ValueExpr(param="email") and key_field="email" on the RECORD_WRITTEN effect removes this violation.

Suggested fix

Set idempotency_key=ValueExpr(param="email") and key_field="email" on the RECORD_WRITTEN effect in patient_effects() (openemr_local.py:123), so the compile path and verify.yaml agree. Better still, have both read one definition.

Related: #1393 (a duplicate key made of several fields for OpenEMR).

The other violations on the same fresh bundle: #1532 (six field clicks) and #1533 (step_039).