verify pass: resolve VERIFY flags (corrections + citations + honest UNCONFIRMED)

Corrected real errors: several 1.7.x release dates, resource_pack_send version,
config packet ordering, structured-component count (56), PLAYER_LOADED (1.21.4),
entity_sound_effect field order. Confirmed+cited the rest; remaining ~19 items
re-marked UNCONFIRMED (third-party/ViaLegacy/26.2 internals unreachable from refs).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

05-login-encryption.md

@@ -50,9 +50,9 @@ Version notes:
 - **≤1.19.2:** `Signature` container present (profile public key for chat-signing); removed in 1.19.3.
   - **1.19:** only `signature` field (no UUID).
   - **1.19.2:** adds optional `playerUUID` after the signature.
-- **1.19.1–1.20.1:** UUID is optional (preceded by a boolean flag).
+- **1.19.1–1.20.1:** UUID is optional (preceded by a boolean flag read via `buf.readBoolean()`).
 - **1.20.2+:** UUID is unconditionally included (no flag byte).
-  (`BungeeCord LoginRequest.java:35–38`: `if (protocolVersion >= MINECRAFT_1_20_2)` reads UUID directly.)
+  (`BungeeCord LoginRequest.java:33–38`: `if (protocolVersion >= MINECRAFT_1_20_2)` reads UUID directly; for 1.19.1–1.20.1 the flag is `buf.readBoolean()` at line 33. Confirmed: `minecraft-data/data/pc/1.20.2/protocol.json` `login.toServer.types.packet_login_start` shows `username` + `playerUUID` with no optional wrapper.)
 
 ---
 
@@ -225,6 +225,7 @@ sequenceDiagram
 
 - BungeeCord: `EncryptionUtil.java:51` — `generator.initialize(1024)`
 - Velocity: `VelocityServer.java:255` — `EncryptionUtils.createRsaKeyPair(1024)`
+- Vanilla: minecraft.wiki/w/Java_Edition_protocol/Encryption — "The server generates a 1024-bit RSA keypair on startup." (vanilla NMS uses the same size; modified servers may use longer keys without breaking official clients.)
 
 **Public key encoding:** The bytes sent in Encryption Request are the **DER-encoded
 X.509 SubjectPublicKeyInfo** (i.e. `java.security.PublicKey.getEncoded()` using the
@@ -432,7 +433,10 @@ BungeeCord `InitialHandler.java:527–528`: URL construction with `URLEncoder.en
 The original `sessionserver.mojang.com` endpoints still work after the Mojang → Microsoft
 account migration. All Minecraft clients (Bedrock and Java launcher) now use Microsoft OAuth
 tokens internally, but the session server interface is unchanged at the API level.
-<!-- VERIFY: confirm current sessionserver.mojang.com still accepts calls in 2025/2026 -->
+Verified live as of 2026-06-19: `POST /session/minecraft/join` returns HTTP 403 (credential
+rejected, not dead endpoint); `GET /session/minecraft/hasJoined` returns HTTP 204 (player
+not found, endpoint alive). The minecraft.wiki/w/Java_Edition_protocol/Encryption page
+continues to list these URLs as the current endpoints without any migration note.
 
 ### 4.4 Offline Mode
 
@@ -614,6 +618,4 @@ compressed bytes and does not know about packet boundaries.
 | minecraft-data features.json | `minecraft-data/data/pc/common/features.json` |
 | minecraft.wiki Protocol Encryption | `https://minecraft.wiki/w/Java_Edition_protocol/Encryption` |
 
-<!-- VERIFY: sessionserver.mojang.com/session/minecraft/join and hasJoined still live as of 2026 — Microsoft migration kept these endpoints but confirm they remain unredirected. -->
-<!-- VERIFY: RSA-1024 key size — BungeeCord and Velocity both confirmed at 1024 bits; check if vanilla Minecraft server (NMS) uses a different size. -->
-<!-- VERIFY: Login Start UUID presence in 1.19.1 exact behaviour — BungeeCord LoginRequest.java:33–38 shows optional boolean + UUID; verify the flag is `buf.readBoolean()` not some other encoding in vanilla packets. -->
+<!-- sessionserver.mojang.com confirmed live 2026-06-19; RSA-1024 confirmed in vanilla wiki + BungeeCord + Velocity; Login Start UUID flag confirmed buf.readBoolean() in BungeeCord LoginRequest.java:33–38 -->