Coding agents don't fail at writing code. They fail at knowing where to start.
FixMap gives any agent a map of your repo before it edits: ranked files with reasons, test routes, risk notes. Local, deterministic, no API key.
My changelog told users a bug was fixed. It wasn't — not for them.
The fix was real. It was merged. It was on main. They just couldn't have it, because I hadn't published a release.
The bug itself was a good one. My tool ranks which files you should open for a coding task, and it deprioritizes build output, because editing a file the next build overwrites is always wrong. A vendored dependency inside Next.js — react-dom.development.js — sailed straight past that and ranked first at high confidence.
It escaped two independent guards.
The content check looks for minified output: 400+ characters per line, or two bundler fingerprints. This file is a readable dev build. 96 characters per line. One fingerprint.
The path check drops generated files that have a maintained source twin. A vendored dependency has no twin, by definition. That rule exists to protect chalk, whose vendored file genuinely IS the implementation.
So: too readable for one guard, too vendored for the other.
I proved it by adding a single bundler marker and changing nothing else. Score went 16 to 4. High confidence to low. The machinery was fine — it had simply never fired.
Then I shipped the mistake that's actually worth writing about. Fix merged, changelog updated, npm untouched. The site said "fixed" while `npm install` handed you the version without it.
Which is the exact bug that started this whole audit, pointed backwards. That one was: the site published an accuracy number the released code no longer achieved. This one: the site published a fix the released code didn't contain. Same root cause both times — a claim living somewhere other than the thing it describes.
The repair isn't "be more careful." I deleted the "Unreleased" section from the changelog, and the code that renders it. Now every entry is a version you can install, and putting an unshipped one back has to be a deliberate act.
An unreleased section in a public changelog is a promise about software nobody can run.
https://t.co/FvPFlZ7yiu