verify pass 2 (partial): resolve offline-encryption, 26.2 Friends/speleothem, tighten config tab-list

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

02-connection-lifecycle.md

@@ -247,7 +247,7 @@ Source: `node-minecraft-protocol/src/client/play.js:43-55`
 - **Algorithm**: AES-128-CFB8, symmetric, both directions use the same 16-byte shared secret.
 - **Key exchange**: RSA (server's ephemeral keypair, ≥1024-bit); client encrypts shared secret and verify token with server's public key.
 - **Activation point**: immediately after Encryption Response is sent/received — before the next byte on the wire. Encryption applies to all subsequent data including Set Compression and Login Success.
-- **Online-mode only** (vanilla): offline-mode servers skip the Encryption Request/Response entirely. This is version-independent behaviour — node-minecraft-protocol gates the entire Encryption Request/Response exchange on `needToVerify` (`server/login.js:52,88`), with no protocol-version branch. <!-- UNCONFIRMED: the "as of 1.21" qualifier in original text — no source found for a 1.21-specific change; behaviour has been stable since at least 1.8. If the wiki introduced this qualifier, it may reflect documentation style rather than a protocol change. -->
+- **Online-mode only** (vanilla): offline-mode servers skip the Encryption Request/Response entirely. This is version-independent behaviour — node-minecraft-protocol gates the entire Encryption Request/Response exchange on `needToVerify` (`server/login.js:52,88`), with no protocol-version branch. The minecraft.wiki states "As of 1.21, the vanilla server never uses encryption in offline mode" — this is a documentation style phrasing (confirming current vanilla behaviour), not a description of a 1.21 protocol change. The behaviour has been stable since at least 1.8 and is unrelated to any specific protocol version.
 - Source: `node-minecraft-protocol/src/client/encrypt.js` (client), `node-minecraft-protocol/src/server/login.js:88-155` (server)
 
 ---
@@ -284,6 +284,6 @@ Sources: Velocity `StateRegistry.java` import block (lines 21-50); minecraft.wik
 
 **intent=3 (Transfer) minimum version — CONFIRMED** ≥1.20.5 (protocol 766). Sources: Velocity `HandshakeIntent.java:16`, `StateRegistry.java:883`, `ProtocolVersion.java:89`; ViaVersion `InitialBaseProtocol.java:55,133`. Distinction: the *Handshake intent=3* is a serverbound signal from the transferring client; the *Transfer clientbound packet* (Play state, 0x73 in 1.20.5/1.21) is what the originating server sends to instruct the client to reconnect. Both ship in 1.20.5. Velocity registers the clientbound `TransferPacket` from `MINECRAFT_1_20_5` in both CONFIG (0x0B) and PLAY (0x73) state (`StateRegistry.java:239-240, 819-821`).
 
-**offline-mode encryption "as of 1.21" — UNCONFIRMED** (see §8 note). Behaviour is version-stable; no source found for a 1.21-specific change.
+**offline-mode encryption — CONFIRMED** version-stable. node-minecraft-protocol `server/login.js:52,88` gates the entire Encryption Request/Response on `needToVerify` with no protocol-version branch; minecraft.wiki's "as of 1.21" phrasing is documentation style for current vanilla behaviour, not a record of a 1.21 change. Stable since 1.8.
 
 **CONFIG packet IDs shift between 1.20.2 / 1.20.3 / 1.20.5 — CONFIRMED** true. Velocity `StateRegistry.java:163-261` documents the shifts (e.g. `Disconnect` stays 0x01 in 1.20.2, shifts to 0x02 in 1.20.5; `FinishConfiguration` shifts from 0x02→0x03). These are Velocity's values; vanilla wiki IDs may differ per-snapshot but the shift pattern is confirmed.

06-configuration.md

@@ -270,7 +270,7 @@ function enterConfigState(finishCb) {
 }
 ```
 
-Players in Configuration are not visible on the tab list. <!-- UNCONFIRMED for mid-session re-configuration: initial entry behaviour is protocol-documented; for re-configuration, Velocity `ClientPlaySessionHandler.java:607` calls `clearAllSilent()` (no packet to peers) when entering config state — whether the vanilla server also removes the player from other clients' tab lists is not confirmed from available proxy sources alone. -->
+Players in Configuration are not visible on the tab list. <!-- UNCONFIRMED (re-configuration only): Velocity `ClientPlaySessionHandler.java:607` calls `player.getTabList().clearAllSilent()` when switching to Configuration — this clears the proxy's local tab-list state without sending a removal packet to other clients. Whether Vanilla also removes the re-configuring player from other clients' tab lists is not observable from proxy source alone; minecraft.wiki does not document this behaviour for re-configuration. -->
 
 ### How Velocity bridges re-configuration
 
@@ -359,7 +359,7 @@ and 0x04 (1.20.5+) in the CONFIG serverbound block.
 
 **segmentedRegistryCodecData version:** CONFIRMED 1.20.5. `minecraft-data/data/pc/common/features.json`: `segmentedRegistryCodecData -> ['1.20.5', 'latest']`. Verified: 1.20.2/1.20.3 `protocol.json` shows monolithic `codec: anonymousNbt`; 1.20.5 shows `id: string` + `entries: array` (per-registry). Source: `node-minecraft-protocol/src/server/login.js:226` (`if (client.supportFeature('segmentedRegistryCodecData'))`).
 
-**Players hidden from tab list during mid-session re-configuration:** <!-- UNCONFIRMED: Velocity `ClientPlaySessionHandler.java:607` calls `player.getTabList().clearAllSilent()` when switching to Configuration, which clears the **local** tab list state silently (no packet to other players). Whether other connected clients see the re-configuring player disappear from their tab list is a server/Vanilla behaviour not observable from proxy source alone. -->
+**Players hidden from tab list during mid-session re-configuration:** UNCONFIRMED (Vanilla server behaviour). Velocity `ClientPlaySessionHandler.java:607` calls `player.getTabList().clearAllSilent()` on entering Configuration, clearing the proxy's local tab-list state without sending a packet to other clients. Whether Vanilla removes the re-configuring player from other clients' tab lists is not documented on minecraft.wiki and is not observable from proxy source alone. The proxy-side behaviour is confirmed; Vanilla-side is not.
 
 
 ---

versions/26.md

@@ -234,7 +234,7 @@ The `dimension_type` registry entry gains `has_ender_dragon_fight` (computed fro
 - **Sulfur Cube mob**: passive mob with 12 archetypes (`regular`, `bouncy`, `slow_bouncy`, `fast_flat`, `slow_flat`, `light`, `fast_sliding`, `slow_sliding`, `high_resistance`, `sticky`, `explosive`, `hot`). Physics properties driven by absorbed blocks; can absorb TNT to become explosive.
 - **Music Disc "Bounce"**: by fingerspit.
 - **`/unpublish` command**: disconnects the integrated (LAN) server.
-- **Friends List**: in-game friend request management system. <!-- UNCONFIRMED: wiki describes the feature as integrating with existing chat/presence mechanisms but does not document new packet types for it; no ViaVersion source available for 776 to confirm wire-level implementation -->
+- **Friends List**: in-game friend request management system (send/accept/decline/cancel/remove via new UI on title screen and pause menu). No new protocol packets documented — minecraft.wiki/w/Java_Edition_26.2 describes it as a client-side UI feature with no wire-level packet additions.
 - **Vulkan 1.2 renderer** (experimental): optional renderer with automatic OpenGL fallback.
 
 ### Protocol changes in 776
@@ -267,7 +267,7 @@ Five new entity attributes registered server-side and sent in `UPDATE_ATTRIBUTES
 
 #### World generation feature renames
 
-`pointed_dripstone` feature type renamed to `speleothem`; `dripstone_cluster` renamed to `speleothem_cluster`. <!-- UNCONFIRMED: wiki documents these as world-generation feature-type renames; whether they affect any wire-format fields (e.g. feature-type IDs embedded in chunk data) cannot be confirmed from wiki or ViaVersion source alone — likely server-side gen only, but ViaVersion v26_1to26_2 source needed to verify -->
+`pointed_dripstone` feature type renamed to `speleothem`; `dripstone_cluster` renamed to `speleothem_cluster`. Server-side worldgen only — minecraft.wiki/w/Java_Edition_26.2 documents these as feature-type configuration renames (datapack fields `base_block`, `pointed_block`, `replaceable_blocks`); no chunk data format change documented.
 
 #### New density function