browser.run replay types into the wrong field after unlabeled table columns swap #3293

What happens

A replayed act checks that the recorded element is still the same one by role, accessible name, and, when it has lookalikes, a digest of the text of the ancestor that tells it apart (pageTarget.matches in internal/runtime/builtin/browser/replay_target.go).

Inputs in a line-item grid often have no label, so every one has role textbox and an empty name. The ancestor that tells them apart is the table row, whose text is just the line number. When a redesign swaps two columns, the input at the recorded XPath is now the other column's input, but its role, name, and row text are unchanged, so it "matches". The act replays as cache-hit and types the value into the wrong field, with no heal.

Seen on an order entry screen:

The replay filled the item code into the quantity field and the quantity into the item code field for every line. The system rejected the order only because it validated item codes; a system without that check would save wrong data.

Expected

An input whose column header changed should not match. A replay should treat the header of the cell's column (the th above it, or headers/aria-describedby) as part of an unlabeled input's identity, and heal when it differs.

Reproduce

1. A form with a table of unlabeled inputs: columns "item code" and "quantity".
2. Record a workflow that fills them by "line 1 item code" and so on.
3. Swap the two columns (keep the row text) and replay.

The acts report cache-hit and fill the swapped fields.