vendor: the client session — Socks5Stream<S>::use_stream path

Extract the T-generic client session from fast-socks5 v1.0.0's
client.rs into src/vendor/client.rs (ADR-011 §Amendment extraction,
vendor.md cut table row 2): Socks5Stream<S> with use_stream (the
greeting, method-choice read, password sub-handshake, request
encoder, reply reader, socket accessors), the AsyncRead/AsyncWrite
impls, and the pruned Config (skip_auth only).

- typed MissingTargetAddr variant replaces upstream's
  anyhow::Error::msg(...).into() at client.rs:285 (the one SocksError
  addition; the client.rs:528 Other(anyhow!) site went with the cut
  Socks5Datagram)
- use_password_auth's unreachable!() is an error return (upstream's
  None-arm message; convention 2), and the sub-negotiation reply's
  version byte is now checked (was only a dropped debug!)
- write -> write_all in request_header (clippy unused_io_amount;
  byte-identical on a healthy stream)
- cut (not copied): Socks5Datagram, the Socks5Stream<TcpStream>
  convenience impl (connect*/connect_raw), Config::connect_timeout
- 14 first-party duplex tests vs raw-byte mock servers (uncorrelated
  from the vendored server typestate): both handshakes, 0xff
  refusal, version mismatch, domain/IP request forms, the full
  failure-code table, UDP-ASSOCIATE zero fallback, skip_auth,
  io-impl copy, socket accessors
- mod.rs: doc touch-ups (client module now landed; fixed the
  pre-existing broken intra-doc link)

Verification: cargo test (37 pass), --all-features, clippy
--all-targets -D warnings (native + wasm32), cargo check --target
wasm32-unknown-unknown, cargo fmt --check, cargo doc --no-deps.

tasks/implementation/vendor-client-session.md

@@ -1,7 +1,7 @@
 ---
 id: implementation/vendor-client-session
 name: Vendor — the client session (Socks5Stream::use_stream path)
-status: pending
+status: completed
 depends_on: [implementation/vendor-wire-vocabulary]
 scope: narrow
 risk: low
@@ -74,17 +74,17 @@ shape (vendor.md's extraction table).
 
 ## Acceptance Criteria
 
-- [ ] `src/vendor/client.rs` exists with the inventory above;
+- [x] `src/vendor/client.rs` exists with the inventory above;
       `cargo test` compiles
-- [ ] `cargo check --target wasm32-unknown-unknown` clean
-- [ ] No `Socks5Datagram`, no `Socks5Stream<TcpStream>` convenience
+- [x] `cargo check --target wasm32-unknown-unknown` clean
+- [x] No `Socks5Datagram`, no `Socks5Stream<TcpStream>` convenience
       impl (`connect`/`connect_with_password`/`connect_raw`) anywhere
       under `src/vendor/`
-- [ ] No `anyhow`, `log`, `tokio::net`, `UdpSocket` anywhere under
+- [x] No `anyhow`, `log`, `tokio::net`, `UdpSocket` anywhere under
       `src/vendor/`
-- [ ] No `unwrap`/`expect`/`unreachable!`/panic paths in the extracted
+- [x] No `unwrap`/`expect`/`unreachable!`/panic paths in the extracted
       client code (convention 2)
-- [ ] `Socks5Stream::use_stream` over an in-memory duplex completes:
+- [x] `Socks5Stream::use_stream` over an in-memory duplex completes:
       no-auth handshake, password handshake (both accept and reject
       paths), CONNECT request + reply read (success and each mapped
       failure code), domain-target and IP-target request encoding —
@@ -93,10 +93,10 @@ shape (vendor.md's extraction table).
       task parallel with the typestate extraction and the client's
       wire expectations uncorrelated from the server implementation;
       tokio duplex streams, no sockets)
-- [ ] `Socks5Stream<S>` implements `AsyncRead` + `AsyncWrite` (the
+- [x] `Socks5Stream<S>` implements `AsyncRead` + `AsyncWrite` (the
       impls extracted) and the impls are exercised by at least one
       test (e.g. `tokio::io::copy` through the session)
-- [ ] `cargo clippy --all-targets -- -D warnings` and
+- [x] `cargo clippy --all-targets -- -D warnings` and
       `cargo fmt --check` clean
 
 ## References
@@ -116,8 +116,118 @@ shape (vendor.md's extraction table).
 
 ## Notes
 
-> To be filled by implementation agent
+- **Verbatim-code lint posture**: no module-level clippy allows were
+  needed for this file (unlike `server.rs`'s
+  `wrong_self_convention`) — upstream's client region compiles clean
+  under the newer clippy after the mechanical adjustments. The
+  posture note stays in the module doc for the re-vendor diff.
+- **Clippy `unused_io_amount` fix (the one non-verbatim line)**:
+  upstream's `request_header` writes with `self.socket.write(&packet
+  [..padding])` (upstream `client.rs:331`); in-tree it is
+  `write_all` — `deny(clippy::unused_io_amount)` is on by default and
+  a partial write of a SOCKS5 request header would corrupt the
+  conversation anyway, so `write_all` is the faithful translation
+  (byte-identical on the wire for a healthy stream; strictly better
+  on a partial-write stream). The comment above the write (why the
+  packet is length-limited) is upstream's, preserved.
+- **`anyhow::Error::msg("target addr should be present").into()`**
+  (upstream `client.rs:285`) became the typed
+  `SocksError::MissingTargetAddr` variant — added to `SocksError` in
+  `mod.rs` (the wire-vocabulary task's error enum, extended by one
+  variant; the message text is upstream's, kept as the variant's
+  `#[error]` string). This is the task's "typed variants where
+  upstream used `anyhow::Error::msg(...).into()`" adjustment; the
+  variant is wire-inert (error surface only).
+- **`use_password_auth`'s `unreachable!()`** (upstream
+  `client.rs:207`): upstream's match has three arms —
+  `Some(Password{..})` → Ok, `Some(None)` → `unreachable!()`, `None`
+  → `AuthenticationRejected("missing user pass")`. In-tree the
+  `Some(None)` and `None` arms collapse to a single
+  `AuthenticationRejected("Authentication rejected, missing user
+  pass")` return — the same message as upstream's `None` arm, an
+  error return instead of a panic (convention 2). The state is
+  reachable only by misuse (`auth = Some(AuthenticationMethod::None)`
+  while the server picks password).
+- **`Config` pruned to `skip_auth`**: `connect_timeout` + its setter
+  are cut with `connect_raw` (their only consumer). With one field
+  left, the struct stayed (fidelity — the field is load-bearing in
+  `use_stream`'s handshake branch); `Default` was derived instead of
+  the manual impl (upstream's manual `Default` only existed to spell
+  the now-cut field). `set_skip_auth` is upstream verbatim.
+- **Dropped `log` calls leave bindings unused**: the `debug!` drops
+  in `read_request_reply`/`use_password_auth` leave `rsv`/`version`
+  unconsumed → renamed `_rsv`/`_version` (same mechanical adjustment
+  as the server-typestate task). `which_method_accepted`'s version
+  binding is still consumed (the mismatch check).
+- **`use_password_auth` gains a version check**: upstream read the
+  auth-sub-negotiation reply and compared only `is_success`; the
+  destructured `version` fed only a dropped `debug!`. In-tree the
+  dropped-log rename would have discarded it entirely; instead it is
+  checked against `SOCKS5_VERSION` (→ `UnsupportedSocksVersion`) —
+  the same check every other reply read in this file performs; the
+  alternative (an `_version` binding) silently accepts a v4 reply on
+  the sub-negotiation. Byte-level behavior on a compliant server is
+  unchanged.
+- **`request`'s dropped `debug!`**: the
+  `debug!("Requesting headers ...")` consumed `&self.target_addr`
+  only via formatting; nothing renamed (the field is written on the
+  previous line, read in `request_header`).
+- **Tests are first-party** (upstream's client test module rides the
+  cut net region — it tests `connect` against real listeners): the
+  test module here is written fresh against the crate's test layout —
+  raw-byte mock servers over tokio duplex streams, pinned byte
+  sequences written directly (uncorrelated from the vendored server
+  typestate, per the task). Coverage: no-auth handshake + CONNECT
+  success (greeting `[5,1,0]`, method-choice `[5,0]`, domain request
+  `5 1 0 3 len… port`, reply → bind addr, and post-reply pass-through
+  both directions), password accept (greeting `[5,2,0,2]`, the 14-byte
+  user/pass packet, status `[1,0]`, IP-target request bytes),
+  password reject (status `[1,0xff]` → `AuthenticationRejected`),
+  unacceptable method (`[5,0xff]` reply written by the client, then
+  `AuthMethodUnacceptable`), version mismatch (both greeting
+  directions), missing target addr (typed `MissingTargetAddr`),
+  UDP ASSOCIATE zero fallback (`[5,3,0,1,0,0,0,0,0,0]`),
+  `skip_auth` (greeting bypassed — request is the first bytes),
+  the full mapped failure-code table (0x01–0x08 →
+  `SocksError::ReplyError` with the code round-tripped), domain
+  >255 (→ `ExceededMaxDomainLen(256)`), `tokio::io::copy` through
+  the session (the `AsyncRead`/`AsyncWrite` impls), and the socket
+  accessors (`get_socket_ref`/`get_socket_mut`/`get_socket`).
+- **`request_header` is exercised directly** in two tests (the
+  missing-target and the zero-fallback one) — it is private; the
+  tests live in the same module, so this is in-crate visibility, no
+  surface change.
 
 ## Summary
 
-> To be filled on completion
+Extracted the client session from fast-socks5 v1.0.0 into
+`src/vendor/client.rs` per ADR-011 §Amendment + vendor.md (cut table
+row 2): `Socks5Stream<S>` with the `use_stream` path (`send_version_
+and_methods`, `which_method_accepted`, `use_password_auth`,
+`request_header`, `read_request_reply`, `get_socket`/
+`get_socket_ref`/`get_socket_mut`), the `AsyncRead`/`AsyncWrite`
+impls, and the pruned `Config` (`skip_auth` only). The cut regions
+(`Socks5Datagram` struct + impl, the `Socks5Stream<TcpStream>`
+convenience impl with `connect`/`connect_with_password`/
+`connect_raw`, `Config::connect_timeout` + setter) were not copied —
+verified by sweep (only doc-comment provenance mentions remain).
+Extraction-time adjustments applied: `anyhow` dropped (the
+`client.rs:285` site became the typed `SocksError::MissingTargetAddr`
+variant — one variant added to the vocabulary task's `SocksError`;
+the `client.rs:528` `Other(anyhow!(...))` site went with the cut
+`Socks5Datagram`), `log` calls dropped (unused bindings renamed),
+`use_password_auth`'s `unreachable!()` replaced with an error return
+(upstream's `None`-arm message), the `"[::]:0".parse().unwrap()`
+sites verified gone with the cut region, and one clippy-driven
+correction (`write` → `write_all` in `request_header`). 14 first-party
+tests pin the wire behavior against raw-byte mock servers over tokio
+duplex streams (no sockets, no dependency on the vendored server
+typestate): both handshakes (accept + reject paths), the 0xff method
+refusal, version mismatch, CONNECT success with the domain-target and
+IP-target request forms byte-pinned, the full mapped failure-code
+table (0x01–0x08), the UDP-ASSOCIATE zero fallback, `skip_auth`,
+domain-length rejection, the `AsyncRead`/`AsyncWrite` impls via
+`tokio::io::copy`, and the socket accessors. Verified: `cargo test`
+(37 pass), `--all-features`, clippy `--all-targets -- -D warnings`
+native + wasm32, `cargo check --target wasm32-unknown-unknown`,
+`cargo fmt --check`, `cargo doc --no-deps`, and the negative sweeps.