One function call. Seven detectors. Zero config.
Call devMode() once at app startup. PulsCheck auto-instruments fetch, setTimeout, setInterval, clearTimeout, clearInterval, addEventListener, removeEventListener, and WebSocket. No manual placement, no configuration.
after-teardown, response-reorder, double-trigger, dangling-async, sequence-gap, stale-overwrite, and layout-thrash. The runtime timing bugs that static analysis cannot see. Four fire on the current audit; three require manual instrumentation and are not yet validated.
85.7% detection rate on a 77-bug corpus sourced from 71 open-source repositories. Breakdown — timers 25/25, listeners 20/20, fetch 16/25, mixed real-code 5/7. Test inputs are real fetch, setTimeout, and addEventListener calls captured by instrument() — no hand-crafted events.
Gate devMode() behind import.meta.env.DEV or process.env.NODE_ENV in your entrypoint. The registry no-ops when NODE_ENV is production, but the package does not strip itself — the call site must do the guarding.
Every finding includes the pattern, severity, call sites extracted from stack traces, and a concrete fix suggestion. Structurally deduplicated by (pattern, sorted labels, call site) — one report per bug, not per occurrence.
npx pulscheck scan src/ runs 9 regex-based source-level patterns that map onto the runtime detectors. npx pulscheck ci outputs SARIF and exits non-zero on findings for CI gates.