act on what the binary declares: callable Pulse shims, ConVars, string anchors; gen v2.1

src/valvetab.rs

@@ -46,6 +46,14 @@ pub struct PulseBinding {
     pub descriptor: u64,
     /// A second accessor of the same shape, for the binding's argument descriptor.
     pub arg_descriptor: u64,
+    /// The binding's own INVOCATION shim — the one code pointer in the record that is an entry point
+    /// rather than a descriptor accessor. Zero when the slot holds no executable code (8 of 485 on CS2).
+    ///
+    /// Measured as a fixed-signature marshalling stub: seven integer arguments returning int, where the
+    /// fifth is an array of pointers to the argument values (element *k* at `+8+8k`) and the seventh is an
+    /// output sink read by exactly the bindings that declare a return. Not emitted into any artifact — the
+    /// contract has not been validated by an actual call, and a locator nobody has exercised is a claim.
+    pub shim: u64,
     pub flags: PulseFlags,
 }
 
@@ -302,6 +310,10 @@ pub fn pulse_bindings(img: &CodeImage) -> Vec<PulseBinding> {
             description: img.read_ptr(at + 16).and_then(|p| table_string(img, p)),
             descriptor,
             arg_descriptor,
+            shim: img
+                .read_ptr(at + 72)
+                .filter(|&p| img.is_code(p))
+                .unwrap_or(0),
             flags: PulseFlags::decode(
                 img.read_u32(at + 56).unwrap_or(0),
                 img.read_u32(at + 60).unwrap_or(0),