The local socket and the tunnel already mount the same four routes; naming
that table `router` gives the fuzz targets the very door a client reaches,
not a copy of it. `local/fuzz_door` (behind the `fuzzing` feature, off in
every shipped build) builds a book, two live tokens and that router, and
answers one request through `tower::oneshot`: no socket, no port, no clock.
The target's oracle is then the code that enforces it: INVARIANT 8 (a book
only behind a live bearer token) is checked by asking `Books::bearer`, not
by a second model of the rule that could drift from it.
swaits
5e474cd1ac