vendor: the differential RFC edge-case suite — 32 duplex-only tests

tests/vendor-differential.rs pins the vendored extraction's RFC edge
behavior as explicit bytes, per vendor.md §Maintenance Posture (the
differential-testing contract; ADR-011):

- negotiation: empty/zero method lists -> 0xff, server-order method
  preference, 0x04 greeting refusal before the methods byte, EOF
  mid-handshake typed error, password sub-protocol EmptyUsername/
  EmptyPassword + the 0x01/0xff-then-error reject path
- command reads: unknown command -> 0x07 reply, RSV != 0 tolerance
  (upstream reads it unchecked), ATYP 0x02/0x05 -> 0x08, the
  255-byte domain wire maximum, truncated v4/domain address errors
- reply forms (new_reply regression guard): 10/22-byte shapes,
  constant VER/RSV across codes, zero-addr error replies, caller
  sock_addr verbatim on success
- client session: per-code ReplyError mapping (incl. the 0x06
  double map), domain request encoding, UDP-ASSOCIATE zero-target
  fallback form, skip_auth emits no greeting
- UDP codec: GarbageInReserved, FRAG passthrough (the parser
  returns it; refusing is the caller's job), v6 round-trip,
  payload split
- transfer/wait_on_tcp: pump both directions to completion, EOF on
  clean close, UnexpectedUdpControlGarbage carries the byte

Every non-obvious expectation names the upstream behavior it pins
(file + line in /workspace/fast-socks5, v1.0.0); the reference is
consulted, never linked — no build-time dependency. Duplex pairs
only (no TcpListener/UdpSocket/tokio::net in test code).

Verification: cargo test (37 unit + 32 differential),
cargo test --all-features (identical), cargo clippy --all-targets
-- -D warnings, cargo fmt --check, cargo check --target
wasm32-unknown-unknown — all clean.

Task: tasks/implementation/vendor-differential-tests.md (status ->
completed).

tasks/implementation/vendor-differential-tests.md

@@ -1,7 +1,7 @@
 ---
 id: implementation/vendor-differential-tests
 name: Vendor — the differential RFC edge-case test suite
-status: pending
+status: completed
 depends_on: [implementation/vendor-server-typestate, implementation/vendor-client-session]
 scope: moderate
 risk: medium
@@ -76,20 +76,20 @@ introduced by this task.
 
 ## Acceptance Criteria
 
-- [ ] The six coverage groups above each have at least one test;
+- [x] The six coverage groups above each have at least one test;
       all pass in `cargo test`
-- [ ] Tests use only duplex/in-memory streams — no `TcpListener`/
+- [x] Tests use only duplex/in-memory streams — no `TcpListener`/
       `UdpSocket`/`tokio::net` in test code (the suite runs in the
       default-feature build)
-- [ ] Every non-obvious expectation carries a doc-comment note naming
+- [x] Every non-obvious expectation carries a doc-comment note naming
       the upstream behavior it pins (file + line in
       `/workspace/fast-socks5`)
-- [ ] `cargo test` (default features) green;
+- [x] `cargo test` (default features) green;
       `cargo test --all-features` green (no feature-gated vendor code
       exists, so both must pass identically)
-- [ ] `cargo check --target wasm32-unknown-unknown` still clean
+- [x] `cargo check --target wasm32-unknown-unknown` still clean
       (tests are dev-only; the crate surface unchanged)
-- [ ] `cargo clippy --all-targets -- -D warnings` and
+- [x] `cargo clippy --all-targets -- -D warnings` and
       `cargo fmt --check` clean
 
 ## References
@@ -108,8 +108,52 @@ introduced by this task.
 
 ## Notes
 
-> To be filled by implementation agent
+- **Suite location**: `tests/vendor-differential.rs` (an integration
+  test — dev-deps only, no crate-surface change). 32 tests over the
+  six coverage groups; tokio duplex pairs throughout, no sockets.
+- **Differential method followed**: each non-obvious expectation's
+  doc comment names the upstream file + line it pins (e.g.
+  `src/server.rs:903-914` for method-order preference,
+  `src/client.rs:277-285` for the UDP-ASSOCIATE zero fallback,
+  `src/server.rs:1236-1242` for the parser/caller FRAG split). The
+  reference checkout was read, not linked — assertions pin bytes.
+- **Client-session private-API edge cases**: two wire behaviors are
+  only reachable through private methods (`request_header`'s
+  `target_addr: None` zero fallback; the `target_addr` field reset
+  the in-module tests use). The integration suite pins the wire form
+  byte-for-byte (the 10-byte zero request, verified decodable to
+  `0.0.0.0:0` via the vendored `read_address`); the code-path forms
+  of those tests already live in `src/vendor/client.rs`'s in-module
+  tests (privacy-scoped), written by the client-session task. No new
+  divergence introduced — the pin notes cross-reference both.
+- **Duplex half-close shape**: `DuplexStream`'s shutdown closes the
+  whole pipe's write side, so the `transfer` half-close-propagation
+  group is driven with drops (full EOF) rather than
+  `shutdown()`-per-direction; the test's doc comment records why.
+- **First-party-only divergence check**: the only in-tree contracts
+  the tests pin beyond upstream behavior are the two recorded
+  carried changes/adjustments (`new_reply` published — group 3; the
+  typed `MissingTargetAddr` replacing upstream's `anyhow::Error` —
+  group 4 note). No new divergence introduced.
 
 ## Summary
 
-> To be filled on completion
+Built the vendor's differential RFC edge-case suite per vendor.md
+§Maintenance Posture: `tests/vendor-differential.rs`, 32 tests
+covering the six groups — negotiation edge cases (empty/zero method
+lists → 0xff, server-order preference, 0x04 greeting refusal, EOF
+mid-handshake typed error, password sub-protocol empty
+username/password + the 0x01/0xff-then-error reject path); command
+reads (unknown command → 0x07, RSV≠0 tolerance, ATYP 0x02/0x05 →
+0x08, the 255-byte domain boundary, truncated v4/domain address
+errors); reply forms (10/22-byte shapes, constant VER/RSV, zero-addr
+error replies, caller-`sock_addr`-verbatim success replies); client
+sessions (per-code `ReplyError` mapping incl. the 0x06 double map,
+domain request encoding, UDP-ASSOCIATE zero fallback,
+`skip_auth`'s no-greeting wire shape); UDP codec (garbage RSV, FRAG
+passthrough contract, v6 round-trip, payload split); and
+`transfer`/`wait_on_tcp` (pump-to-completion, EOF on clean close,
+`UnexpectedUdpControlGarbage` carrying the byte). All expectations
+byte-pinned with upstream file+line references; verification green
+(`cargo test` 37+32, `--all-features` identical, clippy/fmt/wasm
+clean).