docs(linkedin): apply consultant audit feedback, reorder by wave schedule, and sync NocoDB status

docs/linkedin/09-why-telegram-bot-notifications-die.md

@@ -0,0 +1,63 @@
+# LinkedIn Draft & Consultant Review: Why Dockerized API Notifications Silently Fail: An IPv6 and Framing Post-Mortem
+
+> **文档性质**：从 `blog.hoelee.com` 改写并在 NocoDB 排期的 LinkedIn 生产级动态。
+> **发布状态**：`已通过外部顾问审阅 / NocoDB 已排期待发布`
+> **排期波次**：Wave 3 (收官期) - 槽位 9 (拟发布日期: 2026-11-26 Thu)
+> **源文章**：https://blog.hoelee.com/posts/why-telegram-bot-notifications-die/
+> **系统标识**：`why-telegram-bot-notifications-die` | **分类**：`devops`
+> **字数**：2338 chars (严格控制在 3,000 字符内)
+
+---
+
+## 一、 核心背景与铁律约束提示（供复核对照）
+
+1. **求职画像契合（Senior 全栈/DevOps/AI 架构师）**：彻底脱敏“做生意的老板/小公司创始人”倾向；一切商业实战均转换为“生产系统架构、高可用交付与自动化运维”视角。
+2. **纯洁人设与零禁用词**：绝对禁止 `homelab`, `home lab`, `家用`, `小主机`, `玩具`, `折腾`, `玩票` 等词汇。必须使用 `the infrastructure I manage`, `my self-hosted production nodes`, `production host`。
+3. **第一人称单数**：统一使用单数 `I` / `我`，杜绝虚张声势的复数 `we`。
+4. **数据绝对保真**：所有数字、性能比率、吞吐提升、故障现象严禁凭空捏造。
+5. **OPSEC 安全脱敏**：无内部绝对路径（如 `D:/dev`），无真实私有内网 IP，公网 IP 必须转为文档保留地址。
+
+---
+
+## 二、 LinkedIn 拟发布动态文案（已按顾问意见修订）
+
+```text
+An automated monitoring container in my production stack was scraping data flawlessly, but every Telegram alert suddenly began failing with:
+`sendPhoto failed: 400 ... nginx/1.30.1`
+
+It took a day of forensic debugging to uncover three independent networking and protocol failures masking each other:
+
+Failure 1: Docker's Embedded DNS and IPv6 Blindness
+Inside the container, `api.telegram.org` resolved exclusively to an IPv6 `AAAA` record (`2001:67c:4e8:f004::9`). The container was running on a standard Docker bridge network with no IPv6 routing, causing packets to drop across an unreachable interface.
+Fix: Pin the IPv4 endpoint via `extra_hosts` in compose to immediately unblock routing, then enforce IPv4-only DNS resolution for non-IPv6 bridge networks.
+
+Failure 2: The Telegram Edge Proxy Misdirection
+Even after routing over IPv4, requests returned an HTML error: `400 Bad Request` with `Server: nginx/1.30.1`.
+Because Telegram's API normally responds in JSON, I initially suspected an intermediary firewall or proxy intercept. In reality, `nginx/1.30.1` is Telegram's own ingress reverse proxy. When an HTTP request is structurally malformed at the transport layer, edge nginx rejects it before it ever reaches Telegram's application daemon.
+
+Failure 3: Binary Multipart Boundary Corruption
+The root culprit was an insidious line-delimiter bug in custom Python HTTP framing:
+The payload was constructed by joining chunks with `b"\r\n".join(parts)`.
+Because raw JPEG binary streams naturally contain `0x0A` (`\n`) and `0x0D` (`\r`) bytes, improper newline joining and framing calculations mutated the payload length and broke MIME boundary alignment, causing edge proxies to reject the HTTP stream on sight.
+Fix: Concatenate discrete pre-framed multipart byte chunks verbatim with `b"".join(parts)`.
+
+Hard-won debugging lessons:
+• A Docker container on an IPv4 bridge network can still receive IPv6 `AAAA` records it cannot route.
+• When a third-party API returns an unexpected HTML 400, inspect their ingress proxy layer before assuming an external network intercept.
+• Never assemble binary multipart streams using string or newline helpers.
+
+What is the most deceptive multi-layer network bug you have had to untangle in containerized production?
+
+Write-up: https://blog.hoelee.com/posts/why-telegram-bot-notifications-die/
+```
+
+---
+
+## 三、 外部顾问审阅评估反馈单与归档记录
+
+- [x] **审阅结论**：需微调（已更新修订稿）
+- **1. 诊断与修改批注**：补齐文末思辨提问；明确 extra_hosts 属于应急止血手段，展现专业网络协议排障能力。
+- **2. NocoDB 归档记录**：
+  - Candidate Key: `cand:why-telegram-bot-notifications-die` (Status: `APPROVED`, Priority: `HIGH`)
+  - Draft Key: `cand:why-telegram-bot-notifications-die:v1` (Status: `APPROVED`)
+  - 拟定发布节奏：每周 2 篇（周二/周四），平稳推进 5 周。