content: 20.09 execution + two Rails posts (EOL, AI-builder migration)

.okf/log.md

@@ -856,3 +856,74 @@ durable+urgent+in-authority item - and patching Rails alone is NOT sufficient,
 libvips must go to >=8.13 and secrets must be rotated. "Vibe code rescue" is no
 longer an uncontested category: justinmckelvey.com (cited in our own strategy as
 proof the model works) now sells it at $25K-$50K under the same name.
+
+## 2026-08-08 — 20.09 execution: funnel links, auth consolidation, CVE post; sourcing blocked
+
+Executed the 20.09 priority stack. Three of four landed.
+
+P1: /services/vibe-code-rescue/ now has inbound links from the six rescue-intent
+posts. It previously had zero from 608 posts.
+
+P2: the 4-post Rails-8-auth cluster consolidated to one canonical with three
+aliases. Merging also fixed a real bug the canonical carried - its password-reset
+action branched on "Email not found", leaking account existence.
+
+P3: first durable-news post shipped (CVE-2026-66066). The review loop caught four
+blockers; the load-bearing one inverted the post's thesis. The draft said the
+patched gem's guard silently no-ops on libvips < 8.13. The advisory says the
+opposite verbatim: "Active Storage will raise an exception during boot in such an
+unsecurable environment." It fails CLOSED. As drafted, the runbook (bump gem,
+deploy, fix libvips later) would crash a reader's app at boot on Ubuntu 22.04,
+which ships libvips 8.12.1. Runbook now lands libvips >= 8.13 first.
+
+Two review lessons worth keeping:
+1. The fact-check critic marked a date VERIFIED that does not exist in its cited
+   source (Rails 7.1 EOL "2025-10-01"; the announcement gives no date and is
+   itself published 2025-10-29). The cold-eyes gate caught it structurally - an
+   announcement cannot announce a date 28 days before its own publication - and
+   correctly routed it back instead of editing fact territory. Verifiers can
+   over-trust secondary sources; a structural reader catches the smell.
+2. Second consecutive technical post where voice-tuned review passed something
+   that would break a reader's production. The source-verifying practitioner
+   critic is now load-bearing, not optional, for developer-targeted posts.
+
+P0 sourcing: BLOCKED, and the diagnosis moved. F5Bot is retired - it matches
+literal substrings and is passive, so it can never backfill the <=30-day window
+card #29 needs. Its replacement (p7-search-sweep.md, ~30 site:+after: queries)
+produced zero rows for venue-specific reasons, in two distinct classes.
+Search-surface limits: bare site:reddit.com queries had the operator dropped
+(returned Substack and Goodreads), while the tool's native domain filter did
+return indiehackers.com and x.com URLs; after: filtering was ineffective
+everywhere tried (IH results dated 2025-07 came back). Venue access: reddit
+rejected the agent user agent outright (hard 400), and thread opens on IH, HN,
+old.reddit, and lobste.rs all returned EGRESS_BLOCKED - so IH was searchable but
+not openable, reddit neither. Card #12's blocker is no longer a 2-minute keyword
+swap; it is venue reachability (thread opening above all), and the query bank
+needs a human browser.
+
+## 2026-08-08 — 3-column markdown tables overflow at 390px; two posts shipped
+
+Published `rails-7-eol-unpatched-security-exposure` and
+`migrate-lovable-replit-app-to-rails`.
+
+**Durable layout finding.** A 3-column markdown table breaks the mobile scroll
+gate in this theme. Measured at 390px: the article container is 354px wide and
+tables render `table-layout: auto` with no `overflow-x` wrapper, so minimum
+content width wins. The migration post's 3 columns computed to 116+132+129 =
+377px and pushed documentSscrollWidth to 396. Trimming cell prose did NOT fix it
+- min-width is set by the longest unbreakable token per column, not by sentence
+length, and a first trim actually made it 1px worse. Collapsing to 2 columns
+fixed it: the sibling EOL post's 2-column table lands at exactly 354px.
+
+Rule: **2 columns maximum in blog tables**, or fold the extra column's value into
+the last cell in bold. Code blocks are unaffected - they already carry
+`overflow-x: auto` and stay inside the container. The systemic fix (wrapping
+tables in a scroll container in the theme) is a CSS change and would trigger the
+full visual regression pair, so it stays a content rule until someone takes that
+on deliberately.
+
+**Also swept**: `<!-- Reference cadence: <author> -->` was shipping in published
+HTML on five posts, three of them already live (kamal-2-multi-server,
+ai-code-ownership-accountability, claude-code-xp-team-workflow). It is internal
+review metadata from the writer brief. Removed sitewide; writers should report
+cadence in the handback, never in the file.

content/blog/47-startups-failed-same-coding-mistake/index.md

@@ -113,7 +113,7 @@ At this point, your dev shop knows how to build features but not how to build ma
 
 ### Month 18: the last window before rewrite
 
-If you're here, your options are limited. A rewrite buys you time, but the rewrite needs discipline or you repeat the pattern. This is where it's worth hiring a rescue-focused team to install the practices that prevent the 25-month timeline from repeating, with [our exit guide](/blog/fire-dev-shop-guide/) covering the contract side.
+If you're here, your options are limited. A rewrite buys you time, but the rewrite needs discipline or you repeat the pattern. This is where it's worth hiring a rescue-focused team to install the practices that prevent the 25-month timeline from repeating, with [our exit guide](/blog/fire-dev-shop-guide/) covering the contract side. For AI-built codebases, that engagement is our [vibe code rescue](/services/vibe-code-rescue/) - audit first, then a fixed-price repair plan.
 
 ## When to rewrite vs. rescue
 

content/blog/ai-code-ownership-accountability/index.md

@@ -110,4 +110,3 @@ You don't have to fire anyone or switch agencies. The work fits on a postcard: a
 
 Torvalds didn't change the world. He codified what the kernel had been enforcing informally for a year - a human signature on every patch, AI or not. Your codebase runs the same rule whether your contract says so or not. Find out on a weekend audit, or find out from your diligence partner.
 
-<!-- Reference cadence: patio11 -->

content/blog/claude-code-xp-team-workflow/index.md

@@ -105,4 +105,3 @@ Cost on a small slice (one AC item, 50-100 lines of diff) runs $4-6 on Sonnet or
 
 Send us one sentence (which role your solo Claude Code agent keeps skipping - PM, designer, tech lead, QA, or critic panel) plus your repo URL. We'll reply with the actual `.claude/agents/<role>.md` file we run for that seat, plus a one-page note naming the next two seats to staff for your stack. [Reach us at /contact-us/](/contact-us/).
 
-<!-- Reference cadence: capability map (not how-to), 8-row team after squashing PM+BA+CustomerRep into PM, UX Researcher+UI/UX Designer into Designer, Tech Lead+Driver/Navigator into Tech Lead. Shape-Up-inspired pitches + JT 3-lens betting + XP delivery. Why team-mode beats solo-mode is load-bearing thesis. Low-friction CTA (one role -> rule file). -->

content/blog/dev-shop-red-flags-checklist/index.md

@@ -68,7 +68,7 @@ But the developers who generated it never wrote tests, never handled errors, and
 
 The vibe coding shops skip tests entirely because the AI output "looks like it works." It does - until real users show up and everything breaks at once, leaving you paying emergency rates to fix code that should never have shipped.
 
-If your agency can't tell you their test coverage number, they might not have tests at all. And if they don't have tests but they're shipping fast, they're probably vibe coding - and you should be looking for an exit.
+If your agency can't tell you their test coverage number, they might not have tests at all. And if they don't have tests but they're shipping fast, they're probably vibe coding - and you should be looking for an exit. If you want more than a suspicion, our [vibe code rescue](/services/vibe-code-rescue/) service starts with a 48-hour code audit: a one-page, plain-English scorecard of what's solid, what's fragile, and whether to salvage or rebuild.
 
 ## 5. Can't Explain Technical Decisions in Plain English
 

content/blog/fire-dev-shop-guide/index.md

@@ -121,7 +121,7 @@ Then real users showed up. A user with a `+` in their email tried to sign up on
 
 We opened the codebase and found 2% test coverage, zero error handling, and **14 critical security vulnerabilities**. We had to rewrite the entire thing.
 
-We're seeing this in about half the rescue projects that come through our door now. AI-generated code *looks* professional - good variable names, consistent formatting, reads well. But under the hood you find no tests, no error handling, and [security holes that only show up when real people use the product](/blog/from-what-start-stop-delivering-bugs-when-there-no-time-for-changes-management-agile/). [Qodo's 2025 report](https://www.qodo.ai/reports/state-of-ai-code-quality/) found AI code produces **1.7x more issues** than human-written code. And that's when someone reviews it. When nobody does? It's a time bomb.
+We're seeing this in about half the rescue projects that come through our door now. AI-generated code *looks* professional - good variable names, consistent formatting, reads well. But under the hood you find no tests, no error handling, and [security holes that only show up when real people use the product](/blog/from-what-start-stop-delivering-bugs-when-there-no-time-for-changes-management-agile/). [Qodo's 2025 report](https://www.qodo.ai/reports/state-of-ai-code-quality/) found AI code produces **1.7x more issues** than human-written code. And that's when someone reviews it. When nobody does? It's a time bomb. That's why [vibe code rescue](/services/vibe-code-rescue/) became its own service line for us - it opens with a code audit rather than a rebuild pitch.
 
 We've watched this enough times to see the split. The shops that last [write tests before code](/blog/test-driven-development-tdd-in-ruby-step-by-guide-tutorial-bestpractices/) and have a second person [review every change](/blog/ai-powered-code-reviews-transforming-development-workflows/) before it goes live. The shops that burn out paste AI output and ship without anyone checking whether it actually works.
 

content/blog/hiring-dev-shop-questions/index.md

@@ -106,7 +106,7 @@ What they delivered was a Rails app that pushed untested, unreviewed code straig
 
 A developer writing code produces 5-15 commits per day, each one tied to a specific change with a message that explains the reasoning. Pull requests get review comments from teammates, tests grow alongside the feature they cover, and you can trace any production bug back to the commit that introduced it. [A 2025 code quality analysis](https://www.qodo.ai/reports/state-of-ai-code-quality/) found that **AI-generated code produces 1.7x more defects when merged without human review**.
 
-If the git history looks like a robot wrote it, it probably did - or the shop skipped the review process to ship faster. Learn more about [AI-generated code risks](/blog/vibe-coding-crisis-ai-code-debt/) and how to spot them.
+If the git history looks like a robot wrote it, it probably did - or the shop skipped the review process to ship faster. Learn more about [AI-generated code risks](/blog/vibe-coding-crisis-ai-code-debt/) and how to spot them. And if you're reading this after already signing with one, our [vibe code rescue](/services/vibe-code-rescue/) service covers the cleanup.
 
 ## When These Questions Don't Apply
 

content/blog/kamal-2-multi-server-deployment-complete-guide/index.md

@@ -337,4 +337,3 @@ Versions move: everything here was verified against Kamal 2.12.0 (June 2026). Th
 
 *Single-server setup is covered in [Deploying Rails with Kamal](/blog/deploying-ruby-on-rails-applications-with-kamal-devops-docker/), and CI wiring in [Kamal 2 with GitHub Actions](/blog/automate-your-deployments-with-kamal-2-github-actions-devops-development/).*
 
-<!-- Reference cadence: thoughtbot -->