Merge branch 'claude/main-page-group-hierarchy-3a3210'

docs/crypto.md

@@ -300,7 +300,7 @@ value can forge a field boundary. UUIDs must be serialised in RFC 4122 order —
 
 `1` User, `2` Device, `3` Vault, `4` Host, `5` Credential, `6` SshKey, `7` HostGroup,
 `8` Tag, `9` Snippet, `10` PortForward, `11` KnownHostKey, `12` HostTag,
-`13` HostCredential.
+`13` HostCredential, `14` ConnectionLogEntry, `15` ActivityLogEntry, `16` ObjectStore.
 
 > **Added 2026-07-29:** `12` and `13`. `Contracts.SyncEntityType` has listed `HostTag` and
 > `HostCredential` as syncable since the contract was frozen, but this table had no value for
@@ -308,6 +308,17 @@ value can forge a field boundary. UUIDs must be serialised in RFC 4122 order —
 > implementation to need one would have had to invent a value or reuse a neighbour's. Append
 > only, and no such item has been stored.
 
+> **Recorded 2026-08-04:** `14`, `15` and `16`. Unlike `12` and `13` these were not a hole — they
+> were added to `CryptoSpec.AadResourceType` when the two logs and the buckets shipped, and items
+> **have** been sealed under them. What was missing was this table, which had gone three item kinds
+> without being updated. Nothing changes on the wire or on disk; the normative list now says what
+> the code has been doing.
+>
+> **They are the first members that are not a fixed offset from their `SyncEntityType`
+> counterparts** — the two enums drifted apart when `12` and `13` closed the hole above, so
+> `ConnectionLogEntry` is `11` there and `14` here. Nothing casts between them, and
+> `AadResourceTypeTests` pins each pairing by name for exactly that reason.
+
 `0` means not applicable and is legal only where the table in §4.2 implies no resource.
 
 ### 4.4 What this prevents