docs(flow): add #1616, #1570 and #1618 to the 2.4.1 changelog

llms-full.txt

@@ -2097,7 +2097,11 @@ Flow runs without its benchmark package, a pinned config with Windows line endin
 - Worklists built from plain `div` rows, CSS grid rows or cards are treated as rows. Teach records each row's identity, and replay halts when rows move or look alike, instead of clicking a button by its position (`#open-0`) on another record. A twin row seen at teach time marks the identity ambiguous, and a row nothing can read halts before a write (`identity_uncounted`) ([#1569](https://github.com/OpenAdaptAI/OpenAdapt/pull/1569)).
 - The fault gate admits a record check only when it catches every fault class it claims. Two new classes write outside the table the check reads (`other_table`, `side_write`), and a check must claim both `delta` and `frame`. A check that reads one table of a larger store is no longer admitted, so VERIFIED is issued less often, never more. The receipt lists each class as killed, missed, untestable, not applicable or missing ([#1539](https://github.com/OpenAdaptAI/OpenAdapt/pull/1539)).
 - The provenance round trip applies a field's declared value map before it compares the record with the source document. A document that prints a label (`Massachusetts`) for a stored code (`MA`) can now be checked, so a misread value is caught instead of saved and verified. A document value the map doesn't name is reported as `not_checked` ([#1572](https://github.com/OpenAdaptAI/OpenAdapt/pull/1572)).
+- A step that leaves the store unchanged, such as dismissing a notice, no longer gets a placeholder `record_written` effect. The store snapshots before the step, after it and before the next action must all be equal, and a write request seen on the network cancels this ([#1616](https://github.com/OpenAdaptAI/OpenAdapt/pull/1616)).
+- On a slow app, the recorder waits for the screen to change after a click that has started a change (the URL or title changed, or the page is busy), for up to 8 seconds (`settle_pending_timeout_s`). Before, the old screen was taken as the result, and certification refused navigation clicks ([#1616](https://github.com/OpenAdaptAI/OpenAdapt/pull/1616)).
 
 ### Features
 
 - A key that changes nothing visible, such as a Tab onto an icon button or an ArrowDown that highlights an option, can now be checked: the new `focus_on` postcondition requires the focused element to have the recorded identity and to be the only element with it. The compiler adds it only for an element with a role and a non-empty accessible name; an element without them gets no check and stays unverified ([#1579](https://github.com/OpenAdaptAI/OpenAdapt/pull/1579), [#1595](https://github.com/OpenAdaptAI/OpenAdapt/pull/1595)).
+- A record check can name a duplicate key made of several fields, such as last name, first name and birth date (`Effect.composite_key`; `record.duplicate_key` in `verify.yaml` takes a list; `--idempotency-key` can be repeated). `record_written` is refuted when more than one record carries every key field ([#1618](https://github.com/OpenAdaptAI/OpenAdapt/pull/1618)).
+- Frame checks can key audit entries by a record field (`attribution.record_key`), so another user's edit to the same patient counts as concurrent rather than collateral. `frame.side_records` declares rows a save adds beside its record; a missing or doubled side row refutes the frame ([#1570](https://github.com/OpenAdaptAI/OpenAdapt/pull/1570)).

packages/flow/CHANGELOG.md

@@ -26,10 +26,14 @@ Flow runs without its benchmark package, a pinned config with Windows line endin
 - Worklists built from plain `div` rows, CSS grid rows or cards are treated as rows. Teach records each row's identity, and replay halts when rows move or look alike, instead of clicking a button by its position (`#open-0`) on another record. A twin row seen at teach time marks the identity ambiguous, and a row nothing can read halts before a write (`identity_uncounted`) ([#1569](https://github.com/OpenAdaptAI/OpenAdapt/pull/1569)).
 - The fault gate admits a record check only when it catches every fault class it claims. Two new classes write outside the table the check reads (`other_table`, `side_write`), and a check must claim both `delta` and `frame`. A check that reads one table of a larger store is no longer admitted, so VERIFIED is issued less often, never more. The receipt lists each class as killed, missed, untestable, not applicable or missing ([#1539](https://github.com/OpenAdaptAI/OpenAdapt/pull/1539)).
 - The provenance round trip applies a field's declared value map before it compares the record with the source document. A document that prints a label (`Massachusetts`) for a stored code (`MA`) can now be checked, so a misread value is caught instead of saved and verified. A document value the map doesn't name is reported as `not_checked` ([#1572](https://github.com/OpenAdaptAI/OpenAdapt/pull/1572)).
+- A step that leaves the store unchanged, such as dismissing a notice, no longer gets a placeholder `record_written` effect. The store snapshots before the step, after it and before the next action must all be equal, and a write request seen on the network cancels this ([#1616](https://github.com/OpenAdaptAI/OpenAdapt/pull/1616)).
+- On a slow app, the recorder waits for the screen to change after a click that has started a change (the URL or title changed, or the page is busy), for up to 8 seconds (`settle_pending_timeout_s`). Before, the old screen was taken as the result, and certification refused navigation clicks ([#1616](https://github.com/OpenAdaptAI/OpenAdapt/pull/1616)).
 
 ### Features
 
 - A key that changes nothing visible, such as a Tab onto an icon button or an ArrowDown that highlights an option, can now be checked: the new `focus_on` postcondition requires the focused element to have the recorded identity and to be the only element with it. The compiler adds it only for an element with a role and a non-empty accessible name; an element without them gets no check and stays unverified ([#1579](https://github.com/OpenAdaptAI/OpenAdapt/pull/1579), [#1595](https://github.com/OpenAdaptAI/OpenAdapt/pull/1595)).
+- A record check can name a duplicate key made of several fields, such as last name, first name and birth date (`Effect.composite_key`; `record.duplicate_key` in `verify.yaml` takes a list; `--idempotency-key` can be repeated). `record_written` is refuted when more than one record carries every key field ([#1618](https://github.com/OpenAdaptAI/OpenAdapt/pull/1618)).
+- Frame checks can key audit entries by a record field (`attribution.record_key`), so another user's edit to the same patient counts as concurrent rather than collateral. `frame.side_records` declares rows a save adds beside its record; a missing or doubled side row refutes the frame ([#1570](https://github.com/OpenAdaptAI/OpenAdapt/pull/1570)).
 
 ## v2.4.0 (2026-10-25)