act on what the binary declares: callable Pulse shims, ConVars, string anchors; gen v2.1

fuzz/fuzz_targets/fuzz_pulse.rs

@@ -16,6 +16,20 @@ fuzz_target!(|data: &[u8]| {
         return;
     };
     let bindings = valvetab::pulse_bindings(&img);
+    // The invocation shim's read-measurement walks a file-chosen address with its own span arithmetic,
+    // and its verdict is emitted as `call.needs`, so it must degrade rather than panic or over-claim.
+    for b in &bindings {
+        if b.shim == 0 {
+            continue;
+        }
+        if let Some(r) = pulse::shim_reads(&img, b.shim) {
+            assert!(r.reads.len() <= 7, "more argument slots than the shim has");
+            assert!(
+                matches!(r.needs(), "args-only" | "output-sink" | "pulse-context" | "other-slots"),
+                "needs() left its closed vocabulary"
+            );
+        }
+    }
     let pairs: Vec<(u64, u64)> = bindings
         .iter()
         .take(64)