feat(blueprints): launch 3 system blueprints, 12 topology layers & in-article mounting

2026-10-27 01:33:56 +08:00
1 parent 419c962e2f
commit c5e473aaad
@@ -48,6 +48,17 @@ Living list of what's done and what's next for blog.hoelee.com. Work through the
 - ✅ **B5 baseline & hygiene** (2026-10-18, `3f63150`) — `/og-default.jpg` 211 KB → 45 KB carrying the headshot; banner-404 sweep to 72/72 clean; CJK system font stack; A2 branding alignment.
 - ✅ **B6 visual redesign + Ideogram 4 pipeline** (2026-10-18) — the consultant's hybrid "one art, four targets" template; bento theme tokens (a hardcoded dark scrim measured 1.96:1 text contrast in the light theme → 6.10). Phase F is its rollout.
 - ✅ **B7 review-response** (2026-10-19, `5941e85` + `5ec321a`) — About counter derived from the collection (71 → **72**); reading time is CJK-aware (ZH **1 min → 5 分钟**); ZH wording fixes; `hello-world`'s stale language policy and container count; hero leads with the capability; featured cards got the `srcset` they lacked; **48/48** mobile-overflow combinations at 0 px.
+- ✅ **B8 Consultant Review R4 & Blueprints Architecture** (2026-10-27) —
+  - Stream separation: Homepage splits into 6 engineering posts + bottom GPU & Multimodal Lab strip.
+  - Top navigation: `Blueprints | Case Studies | All Posts | Work With Me` (ZH: `系统蓝图 | 工程案例 | 全部文章 | 关于与合作`).
+  - Hero CTA: Malaysian SME button anchors directly to `/about/#sme` (ZH: `/zh/about/#sme`).
+  - Dual-track `/about/` retains canonical URL, redirects `/work-with-me/` via 301.
+  - Three System Blueprints (`/blueprints/` and `/zh/blueprints/`):
+    - `self-hosted-infrastructure` (162 Containers, 4 Layers)
+    - `ai-agent-automation` (Deterministic Workflows + GPU Inference, 4 Layers)
+    - `sme-digital-suite` (High-Performance Web, SifuMail, Entitlements, 4 Layers)
+  - 94 post files mounted to the 12 Blueprint Layers across EN and ZH with in-article breadcrumbs.
+  - Schema.org `TechArticle` enrichment with `dependencies` and `audience`.

 ---

@@ -4,6 +4,8 @@ description: "Receiving mail took four DNS records and worked first try. Sending
 pubDate: 2025-05-06
 updatedDate: 2026-10-16
 category: notes
+blueprint: sme-digital-suite
+blueprintLayer: L2-sifumail-communication
 tags: ["email", "dns", "mailcow", "smtp", "deliverability"]
 ogImage: /og/adding-a-domain-to-someone-elses-mail-server.jpg
 banner: /banners/adding-a-domain-to-someone-elses-mail-server.jpg
@@ -4,6 +4,8 @@ description: "Browsers expose no JavaScript API to trigger translation — and m
 pubDate: 2025-06-11
 updatedDate: 2026-09-29
 category: engineering
+blueprint: sme-digital-suite
+blueprintLayer: L1-high-conversion-web
 tags: ["i18n", "nginx", "vue", "javascript", "self-hosting"]
 ogImage: "/og/adding-english-mode-to-a-chinese-only-web-app.jpg"
 banner: "/banners/adding-english-mode-to-a-chinese-only-web-app.jpg"
@@ -4,6 +4,8 @@ description: "My authentik forward-auth gate returned a clean 302 to the login p
 pubDate: 2026-08-12
 updatedDate: 2026-09-29
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L2-edge-proxy-runtime
 tags: ["authentik", "forward-auth", "cloudflare", "nginx", "docker", "self-hosting"]
 ogImage: /og/authentik-forward-auth-gate-wasnt-live.jpg
 banner: /banners/authentik-forward-auth-gate-wasnt-live.jpg
@@ -3,6 +3,8 @@ title: "Authentik 2025.8 to 2026.8: The Breakable Parts Nobody Warns You About"
 description: "A year's worth of authentik major-version upgrade pain: storage mount changes, RBAC session cleanup, trusted proxies, and the authorization_flow vs authentication_flow mix-up that broke SSO."
 pubDate: 2026-09-09
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L2-edge-proxy-runtime
 tags: [authentik, sso, docker, portainer, self-hosting, oidc, upgrade]
 ogImage: /og/authentik-major-upgrade-gotchas.jpg
 banner: /banners/authentik-major-upgrade-gotchas.jpg
@@ -3,6 +3,8 @@ title: "Docker Reported Exit 0. The Kernel Had Already OOM-Killed It."
 description: "A container on my NAS kept stopping unexpectedly while Docker reported exit 0 and OOMKilled=false. The honest evidence was in dmesg: six cgroup OOM kills."
 pubDate: 2026-10-16
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L2-edge-proxy-runtime
 tags: ["docker", "oom", "traefik", "synology", "crawlers"]
 ogImage: /og/docker-reported-exit-0-the-oom-killer-disagreed.jpg
 banner: /banners/docker-reported-exit-0-the-oom-killer-disagreed.jpg
@@ -3,6 +3,8 @@ title: "From Audio to a 4-Minute Music Video: Orchestrating Gemini Argon 4, AI D
 description: "A complete production breakdown of building a 4-minute 1080p anime OP music video (Crescent Bay): AI music generation, Gemini Argon 4 storyboard prompting, iterative image-to-video rerolls, and Filmora VFX editing."
 pubDate: 2026-10-25
 category: case-studies
+blueprint: ai-agent-automation
+blueprintLayer: L4-aigc-media-pipelines
 stream: creative-lab
 tags: ["ai-video", "music-video", "gemini", "filmora", "face-swapping", "ai-music", "creative-workflows"]
 ogImage: "/og/from-audio-to-a-4-minute-ai-music-video.jpg"
@@ -3,6 +3,8 @@ title: "Generating Full-Length Songs with YuE2 BF16: Overcoming Duration Limits
 description: "AI music tools cut off complex tracks mid-sentence. Here is how I solved the 240s duration wall using YuE2 BF16, 295s headroom budgeting, and a 60-song pipeline."
 pubDate: 2026-10-26
 category: tutorials
+blueprint: ai-agent-automation
+blueprintLayer: L4-aigc-media-pipelines
 stream: creative-lab
 tags: ["ai-music", "yue2", "comfyui", "audio-engineering", "subtitles", "python"]
 ogImage: "/og/generating-full-length-songs-with-yue2-comfyui.jpg"
@@ -3,6 +3,8 @@ title: "Generating Subtitles for Songs That Ship Without Timestamps"
 description: "AI music tools give you audio and nothing else — no line timings, no karaoke. Here is the pipeline I use to produce LRC and SRT subtitles for 18 songs, why plain transcription fails, and the two bugs that made the lyrics box scroll to the bottom."
 pubDate: 2026-10-20
 category: tutorials
+blueprint: ai-agent-automation
+blueprintLayer: L3-local-gpu-inference
 stream: creative-lab
 tags: ["subtitles", "lrc", "srt", "whisper", "forced-alignment", "ai-music", "python"]
 ogImage: "/og/generating-subtitles-for-songs-without-timestamps.jpg"
@@ -4,6 +4,8 @@ description: "Out of curiosity I mirrored my portfolio and git server onto the d
 pubDate: 2025-12-10
 updatedDate: 2026-09-09
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L4-secops-cicd-dr
 tags: [tor, docker, security, self-hosting, networking]
 ogImage: /og/hardening-a-tor-onion-service.jpg
 banner: /banners/hardening-a-tor-onion-service.jpg
@@ -4,6 +4,8 @@ description: 'Explore an automated music video workflow using Remotion, Whisper,
 pubDate: 2025-04-18
 updatedDate: 2026-10-22
 category: case-studies
+blueprint: ai-agent-automation
+blueprintLayer: L4-aigc-media-pipelines
 stream: creative-lab
 tags: ["remotion", "docker", "cdp", "youtube", "automation", "video-generation", "whisper"]
 ogImage: "/og/how-i-built-an-automated-music-video-pipeline.jpg"
@@ -3,6 +3,8 @@ title: "How I Built the DigiKedai Telegram AI Bot"
 description: "A customer-support AI bot that answers questions and provisions free-trial accounts over Telegram and WhatsApp — TypeScript, grammY, a Cloudflare tunnel webhook, and a self-hosted LiteLLM gateway."
 pubDate: 2026-09-06
 category: case-studies
+blueprint: ai-agent-automation
+blueprintLayer: L1-deterministic-orchestration
 tags: [telegram, docker, cloudflare, litellm, typescript, ai]
 ogImage: /og/how-i-built-the-digikedai-telegram-bot.jpg
 banner: /banners/how-i-built-the-digikedai-telegram-bot.jpg
@@ -3,6 +3,8 @@ title: "How I Host This Blog: Astro, Gitea Actions, and Self-Hosted CI/CD"
 description: "A walkthrough of the end-to-end pipeline that builds and serves this site — git-as-CMS, a self-hosted runner on my unRaid server, and Cloudflare in front."
 pubDate: 2026-09-04
 category: case-studies
+blueprint: sme-digital-suite
+blueprintLayer: L1-high-conversion-web
 tags: [astro, gitea, ci-cd, self-hosting, docker, cloudflare]
 ogImage: /og/how-i-host-this-blog.jpg
 banner: /banners/how-i-host-this-blog.jpg
@@ -4,6 +4,8 @@ description: "A case study in orchestrating parallel AI subagents to run due dil
 pubDate: 2025-11-12
 updatedDate: 2026-09-09
 category: case-studies
+blueprint: sme-digital-suite
+blueprintLayer: L4-managed-ops-handover
 tags: [ai-orchestration, subagents, due-diligence, hosting, devops]
 ogImage: /og/how-i-vetted-20-vps-providers-with-parallel-subagents.jpg
 banner: /banners/how-i-vetted-20-vps-providers-with-parallel-subagents.jpg
@@ -4,6 +4,8 @@ description: "A reusable checklist for separating real hosting claims from marke
 pubDate: 2025-11-26
 updatedDate: 2026-09-09
 category: tutorials
+blueprint: sme-digital-suite
+blueprintLayer: L4-managed-ops-handover
 tags: [hosting, vps, due-diligence, whois, devops]
 ogImage: /og/how-to-verify-a-hosting-provider-before-you-buy.jpg
 banner: /banners/how-to-verify-a-hosting-provider-before-you-buy.jpg
@@ -3,6 +3,8 @@ title: "Loop Engineering Without a Coding Agent: The 11 Cron Jobs That Run My In
 description: "Loop engineering is 2026's term for designing the system that prompts and checks an agent. I applied it to self-hosted infrastructure, not a codebase: 11 cron jobs, 8 with no AI at all."
 pubDate: 2026-10-01
 category: case-studies
+blueprint: self-hosted-infrastructure
+blueprintLayer: L3-observability-self-healing
 tags: ["loop-engineering", "ai-agents", "cron", "self-hosting", "automation", "monitoring"]
 ogImage: "/og/loop-engineering-without-a-coding-agent.jpg"
 banner: "/banners/loop-engineering-without-a-coding-agent.jpg"
@@ -3,6 +3,8 @@ title: "Migrating a CodeIgniter 4 App From IIS to OpenLiteSpeed"
 description: "I moved a 17,000-line CodeIgniter 4 app from Windows IIS to OpenLiteSpeed on CyberPanel. Two fatal errors appeared that IIS had been hiding behind SSO."
 pubDate: 2026-09-27
 category: engineering
+blueprint: sme-digital-suite
+blueprintLayer: L1-high-conversion-web
 tags: [codeigniter, php, openspeedway, cyberpanel, iis, migration, litespeed, linux]
 ogImage: /og/migrating-codeigniter-iis-to-openlitespeed.jpg
 banner: /banners/migrating-codeigniter-iis-to-openlitespeed.jpg
@@ -4,6 +4,8 @@ description: "A 1 TB restic seed stalled at zero bytes. The log named a Google p
 pubDate: 2026-10-15
 updatedDate: 2026-10-16
 category: notes
+blueprint: self-hosted-infrastructure
+blueprintLayer: L4-secops-cicd-dr
 tags: ["rclone", "backup", "google-drive", "oauth", "restic"]
 ogImage: /og/my-backup-was-using-someone-elses-api-quota.jpg
 banner: /banners/my-backup-was-using-someone-elses-api-quota.jpg
@@ -4,6 +4,8 @@ description: "Three hosts, one Prometheus, one Grafana. The coverage matrix, the
 pubDate: 2026-07-29
 updatedDate: 2026-09-29
 category: case-studies
+blueprint: self-hosted-infrastructure
+blueprintLayer: L3-observability-self-healing
 tags: [prometheus, grafana, unraid, synology, dsm, cadvisor, monitoring, self-hosting]
 ogImage: /og/one-prometheus-for-unraid-synology-and-a-vps.jpg
 banner: /banners/one-prometheus-for-unraid-synology-and-a-vps.jpg
@@ -3,6 +3,8 @@ title: "PHP2Shell: I Measured Every PHP Runtime I Manage. All of Them Were Vulne
 description: "CVE-2026-109618 and CVE-2026-109619 are unauthenticated RCE in PHP itself, exploited before disclosure. What I measured across the infrastructure I manage — and the exact fix that closed it."
 pubDate: 2026-10-23
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L4-secops-cicd-dr
 tags: ["php", "security", "cve", "cyberpanel", "litespeed", "wordpress", "patching", "self-hosting"]
 ogImage: /og/php2shell-patching-every-php-runtime-i-manage.jpg
 banner: /banners/php2shell-patching-every-php-runtime-i-manage.jpg
@@ -4,6 +4,8 @@ description: "A self-hosted app whose front page was a Chinese login box — and
 pubDate: 2025-06-24
 updatedDate: 2026-10-06
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L2-edge-proxy-runtime
 tags: ["nginx", "docker", "self-hosting", "seo", "branding"]
 ogImage: "/og/putting-a-front-door-on-an-app-you-cant-modify.jpg"
 banner: "/banners/putting-a-front-door-on-an-app-you-cant-modify.jpg"
@@ -3,6 +3,8 @@ title: "A Read-Only NocoDB Dashboard for a Database on Another Machine"
 description: "Point NocoDB at a MySQL/MariaDB database on another machine without copying a single row — and avoid the Docker SNAT source-IP trap and two API traps I hit."
 pubDate: 2026-09-29
 category: devops
+blueprint: sme-digital-suite
+blueprintLayer: L3-entitlement-backoffice
 tags: ["nocodb", "mysql", "mariadb", "docker", "networking", "dashboard"]
 ogImage: /og/read-only-nocodb-dashboard-for-a-remote-database.jpg
 banner: /banners/read-only-nocodb-dashboard-for-a-remote-database.jpg
@@ -3,6 +3,8 @@ title: "Replacing RDPGuard With IPBan: The Traps Nobody Documents"
 description: "I migrated from paid RDPGuard 7.8.7 to open-source IPBan 4.1.0 — and hit three undocumented traps, including an uninstaller that would have silently unbanned 12 attackers."
 pubDate: 2026-09-19
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L4-secops-cicd-dr
 tags: [windows, security, rdp, ipban, rdpguard, brute-force, firewall, self-hosting]
 ogImage: /og/replacing-rdpguard-with-ipban.jpg
 banner: /banners/replacing-rdpguard-with-ipban.jpg
@@ -3,6 +3,8 @@ title: "Running AI Video Locally on a 12 GB GPU: Real Numbers for Wan 2.2 and Se
 description: "Measured on an RTX 3060: Wan 2.2 TI2V-5B generation, SeedVR2 upscaling, the 1080p resolution trap, and the one command that fixed five failed runs."
 pubDate: 2026-10-20
 category: ai
+blueprint: ai-agent-automation
+blueprintLayer: L4-aigc-media-pipelines
 stream: creative-lab
 tags: [ai-video, wan, comfyui, seedvr2, local-llm, gpu, cost]
 ogImage: /og/running-ai-video-locally-on-a-12gb-gpu.jpg
@@ -3,6 +3,8 @@ title: "Running Production Infrastructure Solo: 162 Containers Across Three Host
 description: "One operator, three hosts, 162 containers in 78 compose stacks — Traefik, SSO, monitoring, mail, CI/CD and backups — and the two failures that changed how I verify my own numbers."
 pubDate: 2026-10-06
 category: case-studies
+blueprint: self-hosted-infrastructure
+blueprintLayer: L1-compute-storage-network
 tags: [docker, traefik, monitoring, infrastructure, devops]
 ogImage: /og/running-production-infrastructure-solo.jpg
 banner: /banners/running-production-infrastructure-solo.jpg
@@ -3,6 +3,8 @@ title: "I Ran a Text-to-Speech Service for a Year on Two Cron Containers"
 description: "A reading app needed TTS. Cloud free tiers expire tokens in 10 minutes and 1 hour. Here's the sidecar pattern that kept Azure and Google voices working for a year with no secrets in any workflow."
 pubDate: 2026-09-18
 category: ai
+blueprint: ai-agent-automation
+blueprintLayer: L3-local-gpu-inference
 tags: [n8n, tts, azure, google-cloud, docker, automation, sidecar]
 ogImage: /og/running-tts-as-a-service-with-token-sidecars.jpg
 banner: /banners/running-tts-as-a-service-with-token-sidecars.jpg
@@ -3,6 +3,8 @@ title: "Self-Healing Access Control for Digital Goods: NocoDB, n8n, and AList"
 description: "How I built a five-workflow entitlement system that grants, expires, and continuously repairs customer file access — with a build-time code-sharing trick and a public endpoint designed to leak nothing."
 pubDate: 2026-09-18
 category: case-studies
+blueprint: sme-digital-suite
+blueprintLayer: L3-entitlement-backoffice
 tags: [n8n, nocodb, alist, access-control, docker, automation, digital-goods]
 ogImage: /og/self-healing-digital-goods-entitlements.jpg
 banner: /banners/self-healing-digital-goods-entitlements.jpg
@@ -3,6 +3,8 @@ title: "How I Replaced Cloud TTS with a Self-Hosted Neural Voice Stack on an RTX
 description: "How I migrated our production automation workflows from cloud speech APIs to a self-hosted CosyVoice 2 pipeline on a 12GB RTX 3060, integrated with Synology N8N."
 pubDate: 2026-10-22
 category: case-studies
+blueprint: ai-agent-automation
+blueprintLayer: L3-local-gpu-inference
 tags: ["tts", "ai", "n8n", "gpu", "cosyvoice", "self-hosting"]
 ogImage: "/og/self-hosted-tts-cosyvoice2-n8n-gpu.jpg"
 banner: "/banners/self-hosted-tts-cosyvoice2-n8n-gpu.jpg"
@@ -3,6 +3,8 @@ title: "Shipping an AI Photo Editor as a WordPress Plugin: 22 Versions of Hard L
 description: "From a single HTML file to a shipped WordPress plugin: the fal.ai async queue, a watermark that must never silently fail, optional lead capture, and five bugs that only appeared in production."
 pubDate: 2026-09-18
 category: case-studies
+blueprint: sme-digital-suite
+blueprintLayer: L1-high-conversion-web
 tags: [wordpress, php, fal-ai, docker, ai-image, javascript]
 ogImage: /og/shipping-an-ai-photo-editor-as-a-wordpress-plugin.jpg
 banner: /banners/shipping-an-ai-photo-editor-as-a-wordpress-plugin.jpg
@@ -4,6 +4,8 @@ description: "Why dumping source files into LLM prompts leads to token bankruptc
 pubDate: 2026-04-28
 updatedDate: 2026-10-25
 category: ai
+blueprint: ai-agent-automation
+blueprintLayer: L2-llm-gateway-agents
 tags: ["ai", "agents", "ast", "performance", "architecture"]
 ogImage: "/og/slashing-agent-context-with-a-code-graph.jpg"
 banner: "/banners/slashing-agent-context-with-a-code-graph.jpg"
@@ -3,6 +3,8 @@ title: "Stop Writing Agent Prompts for Deterministic Work"
 description: "One of my scheduled jobs failed 29 times in a row because I put a model in a loop that only needed a string comparison. Here is the rule I use now."
 pubDate: 2026-10-01
 category: notes
+blueprint: ai-agent-automation
+blueprintLayer: L1-deterministic-orchestration
 tags: ["loop-engineering", "cron", "ai-agents", "automation"]
 ogImage: "/og/stop-writing-agent-prompts-for-deterministic-work.jpg"
 banner: "/banners/stop-writing-agent-prompts-for-deterministic-work.jpg"
@@ -4,6 +4,8 @@ description: "How I sync my Hermes agent's skills, config, and cron jobs between
 pubDate: 2026-02-18
 updatedDate: 2026-09-11
 category: case-studies
+blueprint: ai-agent-automation
+blueprintLayer: L2-llm-gateway-agents
 tags: [hermes, git, gitea, ai-agents, devops, sync]
 ogImage: /og/syncing-a-self-improving-ai-agent-across-machines.jpg
 banner: /banners/syncing-a-self-improving-ai-agent-across-machines.jpg
@@ -4,6 +4,8 @@ description: "How to automate Synology Office spreadsheets: the official spreads
 pubDate: 2025-08-20
 updatedDate: 2026-09-26
 category: devops
+blueprint: sme-digital-suite
+blueprintLayer: L3-entitlement-backoffice
 tags: [synology, dsm, docker, portainer, rest-api, spreadsheet, debugging, self-hosting]
 ogImage: /og/synology-spreadsheet-api-is-a-container.jpg
 banner: /banners/synology-spreadsheet-api-is-a-container.jpg
@@ -3,6 +3,8 @@ title: "I Was About to RMA This SSD — the Fault Was a SATA Cable"
 description: "A Seagate IronWolf 110 SSD threw WRITE FPDMA timeouts, failed mkfs with 'superblock magic doesn't match', and went silent — a textbook dying drive. I swapped one SATA cable and it formatted clean with zero errors. How to test before condemning a drive."
 pubDate: 2026-09-16
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L1-compute-storage-network
 tags: [unraid, sata, ssd, storage, troubleshooting, smart, fio, cable]
 draft: false
 ogImage: /og/that-dying-ssd-was-just-a-bad-sata-cable.jpg
@@ -4,6 +4,8 @@ description: "Two small gotchas from backfilling 300 rows: NocoDB ignores a path
 pubDate: 2026-02-04
 updatedDate: 2026-09-10
 category: notes
+blueprint: sme-digital-suite
+blueprintLayer: L3-entitlement-backoffice
 tags: [nocodb, backfill, python, regex, data-pipeline]
 ogImage: /og/the-nocodb-attachment-that-wouldnt-update.jpg
 banner: /banners/the-nocodb-attachment-that-wouldnt-update.jpg
@@ -4,6 +4,8 @@ description: "Why letting multiple AI agents write code causes race conditions a
 pubDate: 2026-08-26
 updatedDate: 2026-10-25
 category: case-studies
+blueprint: ai-agent-automation
+blueprintLayer: L2-llm-gateway-agents
 tags: ["ai", "agents", "architecture", "devops"]
 ogImage: "/og/the-single-writer-rule-for-coding-agents.jpg"
 banner: "/banners/the-single-writer-rule-for-coding-agents.jpg"
@@ -3,6 +3,8 @@ title: "Why Unraid Hangs When You Stop the Array With a Swapfile — and the Fix
 description: "My Unraid array stop hung forever at unmounting disks because an 8 GB btrfs swapfile pinned /mnt/cache. Root cause, the /boot/config/stop trap, and two User Scripts that fix it."
 pubDate: 2026-09-15
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L1-compute-storage-network
 tags: [unraid, swap, btrfs, zram, docker, user-scripts]
 ogImage: /og/unraid-stop-array-hangs-on-swapfile.jpg
 banner: /banners/unraid-stop-array-hangs-on-swapfile.jpg
@@ -4,6 +4,8 @@ description: "Verify a PDF report page by page: print the same HTML from your br
 pubDate: 2026-09-28
 updatedDate: 2026-09-29
 category: engineering
+blueprint: sme-digital-suite
+blueprintLayer: L4-managed-ops-handover
 tags: [php, codeigniter, pdf, css, print, testing]
 ogImage: /og/verifying-a-pdf-report-page-by-page.jpg
 banner: /banners/verifying-a-pdf-report-page-by-page.jpg
@@ -3,6 +3,8 @@ title: "How I Vet an Open-Source Dependency Before Betting On It"
 description: "Six checks that catch a repo which doesn't do what its docs claim — grep for the feature, read the doc's target branch, check the tier gate and the payment rail."
 pubDate: 2026-09-29
 category: devops
+blueprint: sme-digital-suite
+blueprintLayer: L4-managed-ops-handover
 tags: ["open-source", "due-diligence", "oidc", "self-hosting", "docker"]
 ogImage: "/og/vetting-an-open-source-dependency-before-you-bet-on-it.jpg"
 banner: "/banners/vetting-an-open-source-dependency-before-you-bet-on-it.jpg"
@@ -3,6 +3,8 @@ title: "When SMART Says Healthy and Your RAID Is Silently Corrupting Data"
 description: "A btrfs RAID1 pool on two healthy-looking NVMe drives quietly corrupted a Windows VM. How I caught it with a checksum forensic — and why the root cause (M.2 riser link fault vs batch defect) is still uncertain, with both drives now testing clean."
 pubDate: 2026-09-16
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L1-compute-storage-network
 tags: [unraid, btrfs, nvme, raid, storage, data-loss, troubleshooting]
 ogImage: /og/when-smart-says-healthy-but-your-raid-is-corrupting-data.jpg
 banner: /banners/when-smart-says-healthy-but-your-raid-is-corrupting-data.jpg
@@ -3,6 +3,8 @@ title: "I Committed 518,000 Lines in 30 Days. Production Kept 235,000."
 description: "Over 30 days, autonomous coding agents added 518,000 lines across 5 repos, yet production kept 235,000. Here is why verification gates matter more than generation."
 pubDate: "2026-10-18"
 category: "engineering"
+blueprint: ai-agent-automation
+blueprintLayer: L2-llm-gateway-agents
 tags: ["ai", "git", "devops", "testing", "refactoring"]
 ogImage: "/og/why-500000-lines-of-commit-churn-only-left-230000-in-production.jpg"
 banner: "/banners/why-500000-lines-of-commit-churn-only-left-230000-in-production.jpg"
@@ -3,6 +3,8 @@ title: "Why I Still Bought a GPU to Run AI When Claude and GPT Are Obviously Str
 description: "Claude Opus and GPT are stronger than anything I can run locally. Here is the cost, control, and uptime argument for owning a GPU anyway — with real numbers."
 pubDate: 2026-09-21
 category: ai
+blueprint: ai-agent-automation
+blueprintLayer: L3-local-gpu-inference
 tags: [local-llm, gpu, llama-cpp, lm-studio, agents, self-hosting, cost]
 ogImage: /og/why-i-still-bought-a-local-gpu.jpg
 banner: /banners/why-i-still-bought-a-local-gpu.jpg
@@ -3,6 +3,8 @@ title: "Why Is My TTS Model Repeating \"Percent\"? The URL-Encoding Trap in Spee
 description: "Why our newly deployed local TTS engine synthesized endless 'percent' repetitions instead of spoken Chinese, and how character normalization and n8n sandbox limits collided."
 pubDate: 2026-10-22
 category: notes
+blueprint: ai-agent-automation
+blueprintLayer: L1-deterministic-orchestration
 tags: ["tts", "debugging", "n8n", "urlencode", "python", "ai"]
 ogImage: "/og/why-is-my-tts-model-repeating-percent.jpg"
 banner: "/banners/why-is-my-tts-model-repeating-percent.jpg"
@@ -4,6 +4,8 @@ description: "Why swarms of autonomous coding agents step on each other, play th
 pubDate: 2025-07-29
 updatedDate: 2026-10-25
 category: notes
+blueprint: ai-agent-automation
+blueprintLayer: L2-llm-gateway-agents
 tags: ["ai", "agents", "architecture", "debugging"]
 ogImage: "/og/why-multi-agent-coding-fails.jpg"
 banner: "/banners/why-multi-agent-coding-fails.jpg"
@@ -4,6 +4,8 @@ description: "A debugging story: a Dockerized telegram monitor whose sendPhoto c
 pubDate: 2026-03-25
 updatedDate: 2026-09-09
 category: devops
+blueprint: ai-agent-automation
+blueprintLayer: L1-deterministic-orchestration
 tags: [docker, telegram, python, dns, ipv6, debugging, portainer]
 ogImage: /og/why-telegram-bot-notifications-die.jpg
 banner: /banners/why-telegram-bot-notifications-die.jpg
@@ -4,6 +4,8 @@ description: "Every target up, data in Prometheus, panel expressions correct —
 pubDate: 2026-05-17
 updatedDate: 2026-09-29
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L3-observability-self-healing
 tags: [grafana, prometheus, dashboards, monitoring, promql, observability]
 ogImage: /og/why-your-grafana-dashboard-shows-no-data.jpg
 banner: /banners/why-your-grafana-dashboard-shows-no-data.jpg
@@ -4,6 +4,8 @@ description: "3% free sounds like an emergency until you notice it is 500 GB. On
 pubDate: 2026-06-24
 updatedDate: 2026-09-29
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L3-observability-self-healing
 tags: [monitoring, alerting, prometheus, grafana, storage, capacity, observability]
 ogImage: /og/your-disk-full-alert-is-lying.jpg
 banner: /banners/your-disk-full-alert-is-lying.jpg
@@ -3,6 +3,8 @@ title: "Why My AI Songs Kept Losing Their Endings: Running YuE2 on a 12 GB GPU"
 description: "Twelve Mandarin songs came out exactly 240.000 seconds long with the outros missing. The cause wasn't the lyrics — it was a hard cap, a VRAM ceiling, and a planner that ignores BPM."
 pubDate: 2026-10-20
 category: ai
+blueprint: ai-agent-automation
+blueprintLayer: L4-aigc-media-pipelines
 stream: creative-lab
 tags: ["yue2", "comfyui", "ai-music", "local-ai", "gpu", "vram", "mandarin"]
 ogImage: "/og/yue2-on-a-12gb-gpu-songs-that-lost-their-endings.jpg"
@@ -4,6 +4,8 @@ description: "收信只要四条 DNS 记录，一次就通了；而从它发信
 pubDate: 2025-05-06
 updatedDate: 2026-10-16
 category: notes
+blueprint: sme-digital-suite
+blueprintLayer: L2-sifumail-communication
 tags: ["email", "dns", "mailcow", "smtp", "deliverability"]
 ogImage: /og/zh-adding-a-domain-to-someone-elses-mail-server.jpg
 banner: /banners/adding-a-domain-to-someone-elses-mail-server.jpg
@@ -4,6 +4,8 @@ description: "浏览器不提供触发翻译的 JavaScript API,而我的应用
 pubDate: 2025-06-11
 updatedDate: 2026-09-29
 category: engineering
+blueprint: sme-digital-suite
+blueprintLayer: L1-high-conversion-web
 tags: ["i18n", "nginx", "vue", "javascript", "self-hosting"]
 ogImage: "/og/zh-adding-english-mode-to-a-chinese-only-web-app.jpg"
 banner: "/banners/adding-english-mode-to-a-chinese-only-web-app.jpg"
@@ -4,6 +4,8 @@ description: "我的 authentik forward-auth 网关在宿主机上返回了干净
 pubDate: 2026-08-12
 updatedDate: 2026-09-29
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L2-edge-proxy-runtime
 tags: ["authentik", "forward-auth", "cloudflare", "nginx", "docker", "self-hosting"]
 ogImage: /og/zh-authentik-forward-auth-gate-wasnt-live.jpg
 banner: /banners/authentik-forward-auth-gate-wasnt-live.jpg
@@ -3,6 +3,8 @@ title: "Authentik 从 2025.8 升级到 2026.8：那些没人提醒你会坏掉
 description: "一年份的 authentik 大版本升级踩坑记录：存储挂载变更、RBAC 会话清理、可信代理，以及 authorization_flow 与 authentication_flow 搞混导致 SSO 彻底瘫痪。"
 pubDate: 2026-09-09
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L2-edge-proxy-runtime
 tags: [authentik, sso, docker, portainer, self-hosting, oidc, upgrade]
 ogImage: /og/zh-authentik-major-upgrade-gotchas.jpg
 banner: /banners/authentik-major-upgrade-gotchas.jpg
@@ -3,6 +3,8 @@ title: "Docker 报告退出码 0，内核却早已执行 OOM-Kill"
 description: "NAS 上的一个容器反复异常退出，Docker 却上报 exit 0 与 OOMKilled=false。真实的证据在 dmesg 里：六次 cgroup OOM-kill。"
 pubDate: 2026-10-16
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L2-edge-proxy-runtime
 tags: ["docker", "oom", "traefik", "synology", "crawlers"]
 ogImage: /og/zh-docker-reported-exit-0-the-oom-killer-disagreed.jpg
 banner: /banners/docker-reported-exit-0-the-oom-killer-disagreed.jpg
@@ -3,6 +3,8 @@ title: "从一首歌到 4 分钟完整 MV：我如何用 Gemini、AI 生成与 F
 description: "基于《月牙湾》1080P 高清动漫 OP 制作实录：详解 AI 音乐重构、Gemini Argon 4 提示词分镜规划、文字生图与图生视频多次抽卡调优，以及 Filmora 剪辑与特效合成的真实生产实践。"
 pubDate: 2026-10-25
 category: case-studies
+blueprint: ai-agent-automation
+blueprintLayer: L4-aigc-media-pipelines
 stream: creative-lab
 tags: ["ai-video", "music-video", "gemini", "filmora", "face-swapping", "ai-music", "creative-workflows"]
 ogImage: "/og/zh-from-audio-to-a-4-minute-ai-music-video.jpg"
@@ -3,6 +3,8 @@ title: "用 YuE2 BF16 生成完整长歌：突破时长限制与音频硬截断"
 description: "AI 音乐工具常在歌词中途戛然而止。本文详解如何利用 YuE2 BF16、295秒余量预留公式与本地 ComfyUI，成功批量跑出 60 首自然收尾的完整长歌全集。"
 pubDate: 2026-10-26
 category: tutorials
+blueprint: ai-agent-automation
+blueprintLayer: L4-aigc-media-pipelines
 stream: creative-lab
 tags: ["ai-music", "yue2", "comfyui", "audio-engineering", "subtitles", "python"]
 ogImage: "/og/zh-generating-full-length-songs-with-yue2-comfyui.jpg"
@@ -3,6 +3,8 @@ title: "给没有时间戳的歌曲自动生成字幕"
 description: "AI 音乐工具只给你音频 —— 没有逐行时间，没有卡拉 OK。这是我给 18 首歌生成 LRC 与 SRT 字幕的完整流程，为什么单纯转写不行，以及让歌词框滚到底的两个 bug。"
 pubDate: 2026-10-20
 category: tutorials
+blueprint: ai-agent-automation
+blueprintLayer: L3-local-gpu-inference
 stream: creative-lab
 tags: ["subtitles", "lrc", "srt", "whisper", "forced-alignment", "ai-music", "python"]
 ogImage: "/og/zh-generating-subtitles-for-songs-without-timestamps.jpg"
@@ -4,6 +4,8 @@ description: "出于对暗网的好奇,我把个人主页和 Git 服务器镜像
 pubDate: 2025-12-10
 updatedDate: 2026-09-09
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L4-secops-cicd-dr
 tags: [tor, docker, security, self-hosting, networking]
 ogImage: /og/zh-hardening-a-tor-onion-service.jpg
 banner: /banners/hardening-a-tor-onion-service.jpg
@@ -4,6 +4,8 @@ description: '基于 Remotion、Whisper、Docker 与 Chrome DevTools Protocol
 pubDate: 2025-04-18
 updatedDate: 2026-10-22
 category: case-studies
+blueprint: ai-agent-automation
+blueprintLayer: L4-aigc-media-pipelines
 stream: creative-lab
 tags: ["remotion", "docker", "cdp", "youtube", "automation", "video-generation", "whisper"]
 ogImage: "/og/zh-how-i-built-an-automated-music-video-pipeline.jpg"
@@ -3,6 +3,8 @@ title: "我是如何构建 DigiKedai Telegram AI 客服机器人的"
 description: "一个跨 Telegram 与 WhatsApp 解答疑问并全自动开通免费试用账号的 AI 客服机器人——TypeScript、grammY、Cloudflare 隧道 webhook，以及自建 LiteLLM 网关。"
 pubDate: 2026-09-06
 category: case-studies
+blueprint: ai-agent-automation
+blueprintLayer: L1-deterministic-orchestration
 tags: [telegram, docker, cloudflare, litellm, typescript, ai]
 ogImage: /og/zh-how-i-built-the-digikedai-telegram-bot.jpg
 banner: /banners/how-i-built-the-digikedai-telegram-bot.jpg
@@ -3,6 +3,8 @@ title: "我是如何托管这个博客的：Astro、Gitea Actions 与自托管 C
 description: "这篇文章完整拆解了这个网站背后的构建与部署管线——以 Git 作为 CMS、跑在 unRaid 服务器上的自托管 runner，以及最前端的 Cloudflare。"
 pubDate: 2026-09-04
 category: case-studies
+blueprint: sme-digital-suite
+blueprintLayer: L1-high-conversion-web
 tags: [astro, gitea, ci-cd, self-hosting, docker, cloudflare]
 ogImage: /og/zh-how-i-host-this-blog.jpg
 banner: /banners/how-i-host-this-blog.jpg
@@ -4,6 +4,8 @@ description: "一个关于编排并行 AI 子代理对 20 家主机服务商做
 pubDate: 2025-11-12
 updatedDate: 2026-09-09
 category: case-studies
+blueprint: sme-digital-suite
+blueprintLayer: L4-managed-ops-handover
 tags: [ai-orchestration, subagents, due-diligence, hosting, devops]
 ogImage: /og/zh-how-i-vetted-20-vps-providers-with-parallel-subagents.jpg
 banner: /banners/how-i-vetted-20-vps-providers-with-parallel-subagents.jpg
@@ -4,6 +4,8 @@ description: "一份可复用的核查清单，帮你把真实的主机声明和
 pubDate: 2025-11-26
 updatedDate: 2026-09-09
 category: tutorials
+blueprint: sme-digital-suite
+blueprintLayer: L4-managed-ops-handover
 tags: [hosting, vps, due-diligence, whois, devops]
 ogImage: /og/zh-how-to-verify-a-hosting-provider-before-you-buy.jpg
 banner: /banners/how-to-verify-a-hosting-provider-before-you-buy.jpg
@@ -3,6 +3,8 @@ title: "没有 Coding Agent 的 Loop Engineering：撑起我这套基础设施
 description: "Loop engineering 是 2026 年对「设计让 agent 自己反复跑的系统」的叫法。我把它用在自己的自托管基础设施上而不是代码库上：11 个 cron，其中 8 个完全没有 AI。"
 pubDate: 2026-10-01
 category: case-studies
+blueprint: self-hosted-infrastructure
+blueprintLayer: L3-observability-self-healing
 tags: ["loop-engineering", "ai-agents", "cron", "self-hosting", "automation", "monitoring"]
 ogImage: "/og/zh-loop-engineering-without-a-coding-agent.jpg"
 banner: "/banners/loop-engineering-without-a-coding-agent.jpg"
@@ -3,6 +3,8 @@ title: "把 CodeIgniter 4 应用从 IIS 迁移到 OpenLiteSpeed"
 description: "我把一个 17,000 行的 CodeIgniter 4 应用从 Windows IIS 搬到了 CyberPanel 上的 OpenLiteSpeed。迁移后冒出两个致命错误——而 IIS 一直靠 SSO 把它们藏着。"
 pubDate: 2026-09-27
 category: engineering
+blueprint: sme-digital-suite
+blueprintLayer: L1-high-conversion-web
 tags: [codeigniter, php, openspeedway, cyberpanel, iis, migration, litespeed, linux]
 ogImage: /og/zh-migrating-codeigniter-iis-to-openlitespeed.jpg
 banner: /banners/migrating-codeigniter-iis-to-openlitespeed.jpg
@@ -4,6 +4,8 @@ description: "1 TB 的 restic 种子传输卡在零字节。日志里点名的
 pubDate: 2026-10-15
 updatedDate: 2026-10-16
 category: notes
+blueprint: self-hosted-infrastructure
+blueprintLayer: L4-secops-cicd-dr
 tags: ["rclone", "backup", "google-drive", "oauth", "restic"]
 ogImage: /og/zh-my-backup-was-using-someone-elses-api-quota.jpg
 banner: /banners/my-backup-was-using-someone-elses-api-quota.jpg
@@ -4,6 +4,8 @@ description: "三台主机、一个 Prometheus、一个 Grafana：覆盖矩阵
 pubDate: 2026-07-29
 updatedDate: 2026-09-29
 category: case-studies
+blueprint: self-hosted-infrastructure
+blueprintLayer: L3-observability-self-healing
 tags: [prometheus, grafana, unraid, synology, dsm, cadvisor, monitoring, self-hosting]
 ogImage: /og/zh-one-prometheus-for-unraid-synology-and-a-vps.jpg
 banner: /banners/one-prometheus-for-unraid-synology-and-a-vps.jpg
@@ -3,6 +3,8 @@ title: "PHP2Shell：我管的每台机器，PHP 运行时全都中了"
 description: "CVE-2026-109618 与 CVE-2026-109619 是 PHP 语言本身的未授权远程代码执行，披露前就已被利用。这篇记录我在自己管理的系统上实测到的版本、先修哪里，以及真正把它关掉的那几条命令。"
 pubDate: 2026-10-23
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L4-secops-cicd-dr
 tags: ["php", "security", "cve", "cyberpanel", "litespeed", "wordpress", "patching", "self-hosting"]
 ogImage: /og/zh-php2shell-patching-every-php-runtime-i-manage.jpg
 banner: /banners/php2shell-patching-every-php-runtime-i-manage.jpg
@@ -4,6 +4,8 @@ description: "我自托管阅读服务的门面，是一个中文登录框；而
 pubDate: 2025-06-24
 updatedDate: 2026-10-06
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L2-edge-proxy-runtime
 tags: ["nginx", "docker", "self-hosting", "seo", "branding"]
 ogImage: "/og/zh-putting-a-front-door-on-an-app-you-cant-modify.jpg"
 banner: "/banners/putting-a-front-door-on-an-app-you-cant-modify.jpg"
@@ -3,6 +3,8 @@ title: "给另一台机器上的数据库配一个 NocoDB 只读看板"
 description: "把 NocoDB 直接指向另一台机器上的 MySQL/MariaDB，一行数据都不用复制 —— 以及我踩到的 Docker SNAT 源 IP 陷阱和两个 API 陷阱。"
 pubDate: 2026-09-29
 category: devops
+blueprint: sme-digital-suite
+blueprintLayer: L3-entitlement-backoffice
 tags: ["nocodb", "mysql", "mariadb", "docker", "networking", "dashboard"]
 ogImage: /og/zh-read-only-nocodb-dashboard-for-a-remote-database.jpg
 banner: /banners/read-only-nocodb-dashboard-for-a-remote-database.jpg
@@ -3,6 +3,8 @@ title: "用 IPBan 替换 RDPGuard：没人写出来的三个坑"
 description: "我把付费的 RDPGuard 7.8.7 换成了开源的 IPBan 4.1.0，踩到三个没有文档的坑——其中一个卸载程序会悄悄放走 12 个正在攻击的 IP。"
 pubDate: 2026-09-19
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L4-secops-cicd-dr
 tags: [windows, security, rdp, ipban, rdpguard, brute-force, firewall, self-hosting]
 ogImage: /og/zh-replacing-rdpguard-with-ipban.jpg
 banner: /banners/replacing-rdpguard-with-ipban.jpg
@@ -3,6 +3,8 @@ title: "12GB 显卡跑本地 AI 视频：Wan 2.2 加 SeedVR2 的真实数据"
 description: "在 RTX 3060 上实测：Wan 2.2 TI2V-5B 生成、SeedVR2 放大、1080p 分辨率陷阱，以及那条让连续五次失败全部通过的命令。"
 pubDate: 2026-10-20
 category: ai
+blueprint: ai-agent-automation
+blueprintLayer: L4-aigc-media-pipelines
 stream: creative-lab
 tags: [ai-video, wan, comfyui, seedvr2, local-llm, gpu, cost]
 ogImage: /og/zh-running-ai-video-locally-on-a-12gb-gpu.jpg
@@ -3,6 +3,8 @@ title: "一个人跑生产基础设施：三台主机、162 个容器"
 description: "一个人、三台主机、78 个 compose stack 里的 162 个容器——Traefik、SSO、监控、邮件、CI/CD 与备份，以及两次改变了我「怎么核对数字」的故障。"
 pubDate: 2026-10-06
 category: case-studies
+blueprint: self-hosted-infrastructure
+blueprintLayer: L1-compute-storage-network
 tags: [docker, traefik, monitoring, infrastructure, devops]
 ogImage: /og/zh-running-production-infrastructure-solo.jpg
 banner: /banners/running-production-infrastructure-solo.jpg
@@ -3,6 +3,8 @@ title: "我用两个 Cron 容器跑了一年的语音合成服务"
 description: "一个阅读应用需要 TTS，而云服务免费版的 token 十分钟、一小时就过期。这是那套让 Azure 和 Google 语音稳定运行一年的边车模式——任何工作流里都没有存放密钥。"
 pubDate: 2026-09-18
 category: ai
+blueprint: ai-agent-automation
+blueprintLayer: L3-local-gpu-inference
 tags: [n8n, tts, azure, google-cloud, docker, automation, sidecar]
 ogImage: /og/zh-running-tts-as-a-service-with-token-sidecars.jpg
 banner: /banners/running-tts-as-a-service-with-token-sidecars.jpg
@@ -3,6 +3,8 @@ title: "数字商品的自愈式访问控制：NocoDB、n8n 与 AList"
 description: "我如何用五个工作流搭出一套权限系统，自动授予、到期失效并持续修复客户的文件访问——包括一个构建期代码共享技巧，以及一个设计上刻意不泄露任何信息的公开接口。"
 pubDate: 2026-09-18
 category: case-studies
+blueprint: sme-digital-suite
+blueprintLayer: L3-entitlement-backoffice
 tags: [n8n, nocodb, alist, access-control, docker, automation, digital-goods]
 ogImage: /og/zh-self-healing-digital-goods-entitlements.jpg
 banner: /banners/self-healing-digital-goods-entitlements.jpg
@@ -3,6 +3,8 @@ title: "从云端转本地：在 12GB 显卡与群晖 N8N 上搭建中英混读
 description: "记录如何将内部自动化工作流从依赖公网 TTS API 迁移至本地 RTX 3060 12GB 显卡，基于 CosyVoice 2 与群晖 N8N 实现中英混读与多音色零样本克隆。"
 pubDate: 2026-10-22
 category: case-studies
+blueprint: ai-agent-automation
+blueprintLayer: L3-local-gpu-inference
 tags: ["tts", "ai", "n8n", "gpu", "cosyvoice", "self-hosting"]
 ogImage: "/og/zh-self-hosted-tts-cosyvoice2-n8n-gpu.jpg"
 banner: "/banners/self-hosted-tts-cosyvoice2-n8n-gpu.jpg"
@@ -3,6 +3,8 @@ title: "把 AI 修图工具做成 WordPress 插件：22 个版本换来的经验
 description: "从单个 HTML 文件到一个真正上线的 WordPress 插件：fal.ai 异步队列、绝不能静默失败的水印、可选的名单元件，以及五个只有在真实环境里才会出现的 bug。"
 pubDate: 2026-09-18
 category: case-studies
+blueprint: sme-digital-suite
+blueprintLayer: L1-high-conversion-web
 tags: [wordpress, php, fal-ai, docker, ai-image, javascript]
 ogImage: /og/zh-shipping-an-ai-photo-editor-as-a-wordpress-plugin.jpg
 banner: /banners/shipping-an-ai-photo-editor-as-a-wordpress-plugin.jpg
@@ -4,6 +4,8 @@ description: "为什么盲目向 LLM 灌入源代码会导致 Token 账单爆炸
 pubDate: 2026-04-28
 updatedDate: 2026-10-25
 category: ai
+blueprint: ai-agent-automation
+blueprintLayer: L2-llm-gateway-agents
 tags: ["ai", "agents", "ast", "performance", "architecture"]
 ogImage: "/og/zh-slashing-agent-context-with-a-code-graph.jpg"
 banner: "/banners/slashing-agent-context-with-a-code-graph.jpg"
@@ -3,6 +3,8 @@ title: "确定性的活，别再用 Agent Prompt 去跑"
 description: "我有一个定时任务连续失败 29 次，原因是我在一个只需要字符串比较的循环里塞了个模型。这是我现在用的规则。"
 pubDate: 2026-10-01
 category: notes
+blueprint: ai-agent-automation
+blueprintLayer: L1-deterministic-orchestration
 tags: ["loop-engineering", "cron", "ai-agents", "automation"]
 ogImage: "/og/zh-stop-writing-agent-prompts-for-deterministic-work.jpg"
 banner: "/banners/stop-writing-agent-prompts-for-deterministic-work.jpg"
@@ -4,6 +4,8 @@ description: "如何用基于 git 的 profile distribution 在两台电脑之间
 pubDate: 2026-02-18
 updatedDate: 2026-09-11
 category: case-studies
+blueprint: ai-agent-automation
+blueprintLayer: L2-llm-gateway-agents
 tags: [hermes, git, gitea, ai-agents, devops, sync]
 ogImage: /og/zh-syncing-a-self-improving-ai-agent-across-machines.jpg
 banner: /banners/syncing-a-self-improving-ai-agent-across-machines.jpg
@@ -4,6 +4,8 @@ description: "如何在 Synology Office 电子表格上做自动化：官方的
 pubDate: 2025-08-20
 updatedDate: 2026-09-26
 category: devops
+blueprint: sme-digital-suite
+blueprintLayer: L3-entitlement-backoffice
 tags: [synology, dsm, docker, portainer, rest-api, spreadsheet, debugging, self-hosting]
 ogImage: /og/zh-synology-spreadsheet-api-is-a-container.jpg
 banner: /banners/synology-spreadsheet-api-is-a-container.jpg
@@ -3,6 +3,8 @@ title: "我差点把这颗 SSD 送修——真正坏的是 SATA 数据线"
 description: "一颗 Seagate IronWolf 110 SSD 疯狂报 WRITE FPDMA 超时、mkfs 报 'superblock magic doesn't match'、然后读写静默——教科书般的坏盘。我只换了一根 SATA 线，它就干净格式化、零报错。动手判死刑前，先这样排查。"
 pubDate: 2026-09-16
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L1-compute-storage-network
 tags: [unraid, sata, ssd, storage, troubleshooting, smart, fio, cable]
 draft: false
 ogImage: /og/zh-that-dying-ssd-was-just-a-bad-sata-cable.jpg
@@ -4,6 +4,8 @@ description: "回填 300 行数据时踩到的两个小坑：NocoDB 在附件保
 pubDate: 2026-02-04
 updatedDate: 2026-09-10
 category: notes
+blueprint: sme-digital-suite
+blueprintLayer: L3-entitlement-backoffice
 tags: [nocodb, backfill, python, regex, data-pipeline]
 ogImage: /og/zh-the-nocodb-attachment-that-wouldnt-update.jpg
 banner: /banners/the-nocodb-attachment-that-wouldnt-update.jpg
@@ -4,6 +4,8 @@ description: "为什么让多个 AI Agent 同时写代码必然导致分支冲
 pubDate: 2026-08-26
 updatedDate: 2026-10-25
 category: case-studies
+blueprint: ai-agent-automation
+blueprintLayer: L2-llm-gateway-agents
 tags: ["ai", "agents", "architecture", "devops"]
 ogImage: "/og/zh-the-single-writer-rule-for-coding-agents.jpg"
 banner: "/banners/the-single-writer-rule-for-coding-agents.jpg"
@@ -3,6 +3,8 @@ title: "Unraid 停止阵列时卡死的真相：Swapfile 锁住挂载点 — 附
 description: "Unraid 停止阵列时一直卡在卸载磁盘：btrfs RAID1 上的 8GB swapfile 通过 loop 设备锁住 /mnt/cache。根因分析、/boot/config/stop 陷阱、两个 User Scripts 彻底修复。"
 pubDate: 2026-09-15
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L1-compute-storage-network
 tags: [unraid, swap, btrfs, zram, docker, user-scripts]
 ogImage: /og/zh-unraid-stop-array-hangs-on-swapfile.jpg
 banner: /banners/unraid-stop-array-hangs-on-swapfile.jpg
@@ -4,6 +4,8 @@ description: "如何逐页验证生成的 PDF 报告：用浏览器打印同一
 pubDate: 2026-09-28
 updatedDate: 2026-09-29
 category: engineering
+blueprint: sme-digital-suite
+blueprintLayer: L4-managed-ops-handover
 tags: [php, codeigniter, pdf, css, print, testing]
 ogImage: /og/zh-verifying-a-pdf-report-page-by-page.jpg
 banner: /banners/verifying-a-pdf-report-page-by-page.jpg
@@ -3,6 +3,8 @@ title: "如何在押注前验证一个开源依赖：我用的六项检查"
 description: "六项检查，专门抓出「文档说得漂亮、代码里其实没有」的仓库：用 grep 找功能、读文档头部标注的目标分支、看清付费档位门槛，以及收款通道在不在你的国家能用。"
 pubDate: 2026-09-29
 category: devops
+blueprint: sme-digital-suite
+blueprintLayer: L4-managed-ops-handover
 tags: ["open-source", "due-diligence", "oidc", "self-hosting", "docker"]
 ogImage: "/og/zh-vetting-an-open-source-dependency-before-you-bet-on-it.jpg"
 banner: "/banners/vetting-an-open-source-dependency-before-you-bet-on-it.jpg"
@@ -3,6 +3,8 @@ title: "SMART 显示健康，RAID 却在悄悄损坏数据"
 description: "两块看起来完全健康的 NVMe 组成的 btrfs RAID1 阵列，静默地把 Windows 虚拟机喂成了全零字节。我靠校验和取证抓住它——但根因（M.2 转接卡链路故障 vs 批次缺陷）至今仍未定论，现在两块盘测试都干净。"
 pubDate: 2026-09-16
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L1-compute-storage-network
 tags: [unraid, btrfs, nvme, raid, storage, data-loss, troubleshooting]
 ogImage: /og/zh-when-smart-says-healthy-but-your-raid-is-corrupting-data.jpg
 banner: /banners/when-smart-says-healthy-but-your-raid-is-corrupting-data.jpg
@@ -3,6 +3,8 @@ title: "30 天提交 51.8 万行，生产环境只留下 23.5 万行"
 description: "过去 30 天，自主编程 Agent 在 5 个仓库中累计新增了 51.8 万行代码，但最终留存仅 23.5 万行。为什么在 AI 时代，验证闸门与代码剪枝比生成速度重要十倍？"
 pubDate: "2026-10-18"
 category: "engineering"
+blueprint: ai-agent-automation
+blueprintLayer: L2-llm-gateway-agents
 tags: ["ai", "git", "devops", "testing", "refactoring"]
 ogImage: "/og/zh-why-500000-lines-of-commit-churn-only-left-230000-in-production.jpg"
 banner: "/banners/why-500000-lines-of-commit-churn-only-left-230000-in-production.jpg"
@@ -3,6 +3,8 @@ title: "Claude 和 GPT 明明更強，我為什麼還是買了 GPU 跑本地 AI"
 description: "Claude Opus 和 GPT 確實比我能在本地跑的任何模型都強。但我還是買了 GPU——這篇講成本、控制權與可用性，附實際的判斷標準。"
 pubDate: 2026-09-21
 category: ai
+blueprint: ai-agent-automation
+blueprintLayer: L3-local-gpu-inference
 tags: [local-llm, gpu, llama-cpp, lm-studio, agents, self-hosting, cost]
 ogImage: /og/zh-why-i-still-bought-a-local-gpu.jpg
 banner: /banners/why-i-still-bought-a-local-gpu.jpg
@@ -3,6 +3,8 @@ title: "为什么本地语音合成一直在念 “Percent”？语音管线里
 description: "记录本地部署 CosyVoice 2 并通过群晖 n8n 对接时，语音合成陷入无限重复 “Percent” 的现象剖析，以及字符前端规范化与 n8n 沙盒表达式避坑。"
 pubDate: 2026-10-22
 category: notes
+blueprint: ai-agent-automation
+blueprintLayer: L1-deterministic-orchestration
 tags: ["tts", "debugging", "n8n", "urlencode", "python", "ai"]
 ogImage: "/og/zh-why-is-my-tts-model-repeating-percent.jpg"
 banner: "/banners/why-is-my-tts-model-repeating-percent.jpg"
@@ -4,6 +4,8 @@ description: "为什么让多个自主 AI Agent 协同开发必然导致分支
 pubDate: 2025-07-29
 updatedDate: 2026-10-25
 category: notes
+blueprint: ai-agent-automation
+blueprintLayer: L2-llm-gateway-agents
 tags: ["ai", "agents", "architecture", "debugging"]
 ogImage: "/og/zh-why-multi-agent-coding-fails.jpg"
 banner: "/banners/why-multi-agent-coding-fails.jpg"
@@ -4,6 +4,8 @@ description: "一次排障记录：一个跑在 Docker 里的 Telegram 监控机
 pubDate: 2026-03-25
 updatedDate: 2026-09-09
 category: devops
+blueprint: ai-agent-automation
+blueprintLayer: L1-deterministic-orchestration
 tags: [docker, telegram, python, dns, ipv6, debugging, portainer]
 ogImage: /og/zh-why-telegram-bot-notifications-die.jpg
 banner: /banners/why-telegram-bot-notifications-die.jpg
@@ -4,6 +4,8 @@ description: "所有 target 都是 up、数据就在 Prometheus 里、面板表
 pubDate: 2026-05-17
 updatedDate: 2026-09-29
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L3-observability-self-healing
 tags: [grafana, prometheus, dashboards, monitoring, promql, observability]
 ogImage: /og/zh-why-your-grafana-dashboard-shows-no-data.jpg
 banner: /banners/why-your-grafana-dashboard-shows-no-data.jpg
@@ -4,6 +4,8 @@ description: "\"剩余 3%\"听着像紧急事故，直到你发现那是 500 GB
 pubDate: 2026-06-24
 updatedDate: 2026-09-29
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L3-observability-self-healing
 tags: [monitoring, alerting, prometheus, grafana, storage, capacity, observability]
 ogImage: /og/zh-your-disk-full-alert-is-lying.jpg
 banner: /banners/your-disk-full-alert-is-lying.jpg
@@ -3,6 +3,8 @@ title: "为什么我的 AI 歌曲总是丢结尾：在 12GB 显卡上跑 YuE2"
 description: "12 首中文歌时长全都恰好 240.000 秒，尾奏不见了。原因不在歌词 —— 是一道硬上限、一堵显存天花板，和一个不看 BPM 的规划器。"
 pubDate: 2026-10-20
 category: ai
+blueprint: ai-agent-automation
+blueprintLayer: L4-aigc-media-pipelines
 stream: creative-lab
 tags: ["yue2", "comfyui", "ai-music", "local-ai", "gpu", "vram", "mandarin"]
 ogImage: "/og/zh-yue2-on-a-12gb-gpu-songs-that-lost-their-endings.jpg"
@@ -62,8 +62,8 @@ const switchLabel = isZh ? 'EN' : '中文';

 // Locale-aware nav labels
 const nav = isZh
-  ? { caseStudies: '工程案例', posts: '全部文章', about: '关于与合作' }
-  : { caseStudies: 'Case Studies', posts: 'All Posts', about: 'Work With Me' };
+  ? { blueprints: '系统蓝图', caseStudies: '工程案例', posts: '全部文章', about: '关于与合作' }
+  : { blueprints: 'Blueprints', caseStudies: 'Case Studies', posts: 'All Posts', about: 'Work With Me' };
 ---

 <!doctype html>
@@ -184,6 +184,7 @@ const nav = isZh
            whole group onto a second row (`flex-basis: 100%`) instead of letting
            individual links wrap around the search / language / theme controls. */}
        <ul class="nav-links">
+          <li><a class="nav-link" href={isZh ? '/zh/blueprints/' : '/blueprints/'}>{nav.blueprints}</a></li>
          <li><a class="nav-link" href={isZh ? '/zh/categories/case-studies/' : '/categories/case-studies/'}>{nav.caseStudies}</a></li>
          <li><a class="nav-link" href={isZh ? '/zh/posts/' : '/posts/'}>{nav.posts}</a></li>
          <li><a class="nav-link" href={isZh ? '/zh/about/' : '/about/'}>{nav.about}</a></li>
@@ -0,0 +1,416 @@
+/**
+ * Blueprints (Pillar Pages) Metadata & Hierarchical Layer Tree
+ * Single source of truth for the 3 core architectural pillars and their 12 standard layers.
+ */
+
+export const BLUEPRINT_SLUGS = [
+  'self-hosted-infrastructure',
+  'ai-agent-automation',
+  'sme-digital-suite',
+] as const;
+
+export type BlueprintSlug = (typeof BLUEPRINT_SLUGS)[number];
+
+export interface BlueprintLayer {
+  slug: string;
+  name: { en: string; zh: string };
+  scope: { en: string; zh: string };
+  summary: { en: string; zh: string };
+  keyTech: string[];
+}
+
+export interface BlueprintMeta {
+  slug: BlueprintSlug;
+  title: { en: string; zh: string };
+  tagline: { en: string; zh: string };
+  metrics: { en: string; zh: string };
+  stats: { value: string; label: { en: string; zh: string } }[];
+  tradeOffs: {
+    title: { en: string; zh: string };
+    content: { en: string; zh: string };
+  };
+  cta: {
+    track: 'sme' | 'hiring';
+    heading: { en: string; zh: string };
+    body: { en: string; zh: string };
+    buttonText: { en: string; zh: string };
+    buttonLink: string;
+  };
+  layers: BlueprintLayer[];
+}
+
+export const BLUEPRINTS: Record<BlueprintSlug, BlueprintMeta> = {
+  'self-hosted-infrastructure': {
+    slug: 'self-hosted-infrastructure',
+    title: {
+      en: 'Production Self-Hosted Infrastructure: 162 Containers Across Three Hosts',
+      zh: '生产级自托管基础设施全景：三宿主 162 容器高可用架构',
+    },
+    tagline: {
+      en: 'How one engineer operates 162 production containers across bare metal, NAS, and cloud edge without managed PaaS crutches.',
+      zh: '一名工程师如何借助确定性脚本、内核隔离与三端拓扑，实现 162 个生产容器单人高可用运维。',
+    },
+    metrics: {
+      en: '3 Hosts · 162 Containers · 78 Stacks · 0 Managed PaaS Crutches',
+      zh: '3 台物理主机 · 162 个生产容器 · 78 套编排栈 · 0 云厂商依赖',
+    },
+    stats: [
+      { value: '162', label: { en: 'Containers in Prod', zh: '运行中生产容器' } },
+      { value: '3 Hosts', label: { en: 'Unraid · Synology · VPS', zh: '三端异构宿主' } },
+      { value: '78', label: { en: 'Compose Stacks', zh: '服务编排栈' } },
+      { value: '11', label: { en: 'Deterministic Cron Loops', zh: '确定性自愈巡检' } },
+    ],
+    tradeOffs: {
+      title: {
+        en: 'Architectural Decisions & Production Trade-offs',
+        zh: '核心架构抉择与生产权衡',
+      },
+      content: {
+        en: `Running 162 production containers solo requires strict architectural boundaries rather than brute-force DevOps hours. 
+The foundation splits responsibilities strictly across three disparate tiers: Unraid manages high-capacity persistent storage and raw GPU compute; Synology DSM hosts always-on internal operational services behind Btrfs snapshots; a public VPS serves as the hardened, DMZ ingress reverse proxy. 
+
+Instead of adding heavy distributed consensus engines (Kubernetes/Nomad) that introduce fragile control-plane overhead, every stack is defined as a self-contained Docker Compose unit bound to local volumes. Reliability is maintained by 11 deterministic inspection loops that continuously audit health checks, memory limits, and container lifecycles — proving that deterministic simplicity beats complex orchestration for medium-scale sovereign workloads.`,
+        zh: `单人运维 162 个生产容器，核心在于极度清晰的物理边界与责任划分，而非堆砌运维工时。
+三端架构各司其职：Unraid 承担大容量持久化阵列存储与 GPU 算力；群晖 DSM 依托成熟的 Btrfs 快照运行 7×24 内部生产服务与数据库；公网 VPS 充当 DMZ 边缘硬化入口。
+
+放弃在轻量节点上维护脆弱的分布式控制面（如 Kubernetes/Nomad），全站 78 个服务全部收敛为具备独立卷绑定的 Docker Compose 声明单元。系统的长期免维护性由 11 个零 AI 介入的确定性定时巡检脚本守护，以极简的确定性设计压制意外复杂度。`,
+      },
+    },
+    cta: {
+      track: 'hiring',
+      heading: {
+        en: 'Need Battle-Tested Infrastructure & DevOps Engineering?',
+        zh: '需要具备全链路实战能力的系统与 DevOps 工程师？',
+      },
+      body: {
+        en: 'I build, harden, and operate mission-critical systems with complete ownership from kernel cgroups up to application code.',
+        zh: '我具备从 Linux 内核排障、网络穿透到应用代码的全链路端到端交付能力，欢迎查阅完整履历或预约洽谈。',
+      },
+      buttonText: {
+        en: 'View Hiring Profile & Tech Stack →',
+        zh: '查看招聘方评估与技术栈 →',
+      },
+      buttonLink: '/about/#hiring',
+    },
+    layers: [
+      {
+        slug: 'L1-compute-storage-network',
+        name: {
+          en: 'L1: Compute, Storage & Hybrid Network',
+          zh: 'L1: 异构算力、存储与混合组网',
+        },
+        scope: {
+          en: 'Unraid array / Synology NAS / Public VPS / CGNAT traversal / WireGuard & Tailscale mesh / Storage redundancy',
+          zh: 'Unraid 阵列 / 群晖 NAS / 公网 VPS / CGNAT 穿透 / 跨端私有组网 / 存储冗余',
+        },
+        summary: {
+          en: 'The hardware and network topology dividing high-capacity bulk I/O, enterprise services, and edge ingress across three geographically distinct nodes.',
+          zh: '物理硬件、网络拓扑与存储划分底座，将大容量 I/O、核心生产服务与公网入口合理分散在三台物理节点上。',
+        },
+        keyTech: ['Unraid', 'Synology DSM', 'VPS (Ubuntu)', 'Btrfs', 'Cloudflare Tunnels', 'Tailscale'],
+      },
+      {
+        slug: 'L2-edge-proxy-runtime',
+        name: {
+          en: 'L2: Edge Gateway, Runtime & Identity',
+          zh: 'L2: 边缘网关、容器运行时与身份',
+        },
+        scope: {
+          en: 'Traefik edge reverse proxy / Compose conventions / Linux cgroup memory ceilings / Kernel OOM isolation / Authentik SSO',
+          zh: 'Traefik 反向代理 / 78 栈编排规范 / Linux cgroups 内存隔离 / 内核 OOM 守卫 / Authentik SSO 统一中枢',
+        },
+        summary: {
+          en: 'Production ingress routing, declarative Docker service definitions, kernel-level memory boundaries, and centralized SSO security gates.',
+          zh: '公网流量入口路由、声明式 Compose 服务治理、Linux 内核级内存隔离防护，以及统管全域服务的 SSO 鉴权中枢。',
+        },
+        keyTech: ['Traefik v3', 'Docker Engine', 'Linux Kernel (cgroups/dmesg)', 'Authentik SSO', 'Let\'s Encrypt'],
+      },
+      {
+        slug: 'L3-observability-self-healing',
+        name: {
+          en: 'L3: Observability, Loops & Self-Healing',
+          zh: 'L3: 全域可观测性、巡检闭环与自愈',
+        },
+        scope: {
+          en: 'Prometheus cross-host metrics / Grafana dashboards / 11 deterministic inspection crons (Loop Engineering) / Alert deduplication',
+          zh: '跨三端统一 Prometheus 采集 / Grafana 看板 / 11 个确定性巡检脚本（Loop Engineering）/ 告警降噪',
+        },
+        summary: {
+          en: 'Unified monitoring that unmasks false container states, combined with zero-AI deterministic feedback loops that heal infrastructure automatically.',
+          zh: '穿透 Docker 假象的真实底层监控，结合无需人工值守、无 AI 幻觉的确定性定时自愈闭环。',
+        },
+        keyTech: ['Prometheus', 'Grafana', 'Node Exporter', 'cAdvisor', 'Loop Engineering (Shell/Python)'],
+      },
+      {
+        slug: 'L4-secops-cicd-dr',
+        name: {
+          en: 'L4: SecOps, CI/CD & Disaster Recovery',
+          zh: 'L4: 安全基线、CI/CD 与异地容灾',
+        },
+        scope: {
+          en: 'Zero-day runtime mitigation (PHP2Shell) / Gitea + GitHub dual-remote CI/CD / act_runner on unRaid / 3-2-1 Backrest backups',
+          zh: '运行时 0-day 漏洞加固 / Gitea + GitHub 双远端构建 / unRaid act_runner / 3-2-1 异地容灾快照',
+        },
+        summary: {
+          en: 'Defensive engineering: rapid runtime vulnerability patching, automated dual-remote deployments with edge cache purging, and verified disaster recovery.',
+          zh: '安全防御体系：紧急漏洞就地补丁、双代码源自动化发布流水线与经过实测恢复验证的 3-2-1 灾备链条。',
+        },
+        keyTech: ['Gitea Actions', 'Cloudflare Cache Purge', 'Restic / Backrest', 'IPBan', 'Security Hardening'],
+      },
+    ],
+  },
+
+  'ai-agent-automation': {
+    slug: 'ai-agent-automation',
+    title: {
+      en: 'AI Agent & Local GPU Automation: Deterministic Workflows + RTX 3060 Inference',
+      zh: '企业级 AI Agent 与本地 GPU 算力自动化：确定性状态机与本地推理管线',
+    },
+    tagline: {
+      en: 'Combining deterministic state machines, local GPU inference, and disciplined agent orchestration into robust business automation.',
+      zh: '用确定性状态机约束大模型边界，依托本地 RTX 3060 显存调度与 Agent 工程闭环，落地高可靠业务自动化。',
+    },
+    metrics: {
+      en: '1 RTX 3060 12GB · 175+ Unit Tests · Multi-Agent Orchestration · 24/7 Production Loops',
+      zh: '1 块 RTX 3060 12GB · 175+ 单元测试 · 多 Agent 协同治理 · 24/7 生产闭环',
+    },
+    stats: [
+      { value: '12 GB', label: { en: 'VRAM Managed on RTX 3060', zh: 'RTX 3060 极限显存调度' } },
+      { value: '175+', label: { en: 'Unit Tests for Bot Logic', zh: '状态机与网关单测用例' } },
+      { value: '24/7', label: { en: 'Unattended Lead Bots', zh: '全天候自动获客接单' } },
+      { value: '0', label: { en: 'Price & Data Hallucinations', zh: '生产零报价/信息幻觉' } },
+    ],
+    tradeOffs: {
+      title: {
+        en: 'Deterministic Engineering vs. Raw Prompt Engineering',
+        zh: '确定性工程设计与纯 Prompt 堆叠的根本区别',
+      },
+      content: {
+        en: `Generative models are brilliant for unstructured semantic comprehension, but notoriously brittle at maintaining state, enforcing catalog boundaries, and processing transactions.
+Our AI architecture rejects "prompt-only" systems. All customer checkout flows, trial provisioning, and deep links are governed by strict finite state machines before an LLM ever touches the user input.
+
+On the compute layer, instead of incurring unpredictable cloud API bills and leaking private telemetry, we deploy self-hosted inference pipelines on an on-premise RTX 3060 12GB. By pairing CosyVoice 2 for neural voice synthesis, faster-whisper for acoustic alignment, and ComfyUI API headless runners for multimodal assets, we achieve high throughput with zero ongoing per-token runtime costs.`,
+        zh: `大语言模型擅长处理非结构化语义理解，但在保持会话状态、执行严格商品目录与交易边界时极其脆弱。
+本架构坚决摒弃“纯 Prompt 堆砌”。所有客户下单意图、试用账号发放与深层链接，在进入 LLM 之前全部被确定性有限状态机严格拦截与处理。
+
+在算力层，为了避免高昂且不可预测的云端 API 账单与数据泄露隐患，我们将推理任务收敛至本地 12GB RTX 3060 节点。结合 CosyVoice 2 神经语音合成、faster-whisper 强制音素对齐与 ComfyUI API 无头生成管线，以 0 边际成本实现高吞吐工业化生成。`,
+      },
+    },
+    cta: {
+      track: 'sme',
+      heading: {
+        en: 'Want to Deploy Private AI & Automation for Your Business?',
+        zh: '想为您的企业搭建私有化 AI 客服与自动化系统？',
+      },
+      body: {
+        en: 'Replace fragile manual processes and costly monthly SaaS subscriptions with private, reliable automation pipelines.',
+        zh: '消灭繁琐的人工重复操作与昂贵的按人头 SaaS 订阅，搭建全天候获客与自动交付系统。',
+      },
+      buttonText: {
+        en: 'Discuss Your Automation Project on WhatsApp →',
+        zh: 'WhatsApp 详询自动化定制方案 →',
+      },
+      buttonLink: '/about/#sme',
+    },
+    layers: [
+      {
+        slug: 'L1-deterministic-orchestration',
+        name: {
+          en: 'L1: Deterministic Orchestration & State Machines',
+          zh: 'L1: 确定性编排与业务状态机',
+        },
+        scope: {
+          en: 'Synology Docker n8n / Webhook ingress validation / Sandbox isolation / Finite state machines / Idempotency',
+          zh: '群晖 Docker n8n 编排 / Webhook 签名与限流 / 沙箱执行边界 / 确定性有限状态机 / 幂等性兜底',
+        },
+        summary: {
+          en: 'The execution layer that wraps business logic in deterministic state machines, ensuring orders and trials execute cleanly without LLM intervention.',
+          zh: '用确定性状态机与沙箱包裹核心业务逻辑，确保下单、试用发放与关键路径 100% 确定可控。',
+        },
+        keyTech: ['n8n', 'Node.js / TypeScript', 'grammY (Telegram)', 'State Machines', 'PostgreSQL'],
+      },
+      {
+        slug: 'L2-llm-gateway-agents',
+        name: {
+          en: 'L2: Hybrid LLM Gateway & Agent Loops',
+          zh: 'L2: 混合大模型网关与受控 Agent 闭环',
+        },
+        scope: {
+          en: 'LiteLLM routing / Cloud & local model failover / Hermes Agent autonomous workflows / Verification gates / Structured output contracts',
+          zh: 'LiteLLM 动态网关 / 云端与本地模型故障切换 / Hermes Agent 自主研发流 / 多道验收闸门 / 严格结构化输出',
+        },
+        summary: {
+          en: 'The intelligence broker that decouples agent applications from underlying model providers, enforcing verification gates before output acceptance.',
+          zh: '智能网关中枢：解耦应用与底层模型供应商，多模型负载切换，并通过严格测试闸门规范自主 Agent 产出。',
+        },
+        keyTech: ['LiteLLM', 'Hermes Agent', 'OpenAI/Gemini APIs', 'Zod Schema Validation', 'Mem0'],
+      },
+      {
+        slug: 'L3-local-gpu-inference',
+        name: {
+          en: 'L3: Local GPU Inference Stack (RTX 3060)',
+          zh: 'L3: 本地 GPU 算力底座与语音/视觉推理',
+        },
+        scope: {
+          en: '12GB VRAM lifecycle management / CosyVoice 2 zero-shot TTS / faster-whisper forced alignment / RapidOCR verification',
+          zh: '12GB 显存极限释放 / CosyVoice 2 零样本语音克隆 / faster-whisper 音素对齐 / RapidOCR 自动质检',
+        },
+        summary: {
+          en: 'On-premise GPU inference engine replacing recurring cloud speech and vision APIs with private, zero-token-cost local execution.',
+          zh: '私有 GPU 推理基座，将昂贵的云端语音合成与转写替换为零边际成本的本地高性能模型服务。',
+        },
+        keyTech: ['NVIDIA RTX 3060 (12GB)', 'CosyVoice 2', 'faster-whisper', 'RapidOCR', 'PyTorch / CUDA'],
+      },
+      {
+        slug: 'L4-aigc-media-pipelines',
+        name: {
+          en: 'L4: Automated AIGC & Media Pipelines',
+          zh: 'L4: 多模态 AIGC 工业化生成流水线',
+        },
+        scope: {
+          en: 'ComfyUI headless API scripts / YuE2 BF16 audio headroom formulas / Video diffusion pipelines / Remotion & Filmora automation',
+          zh: 'ComfyUI API 无头批量生成 / YuE2 BF16 长音频防截断预算法 / 本地视频生成 / 自动化分镜与音视频合成',
+        },
+        summary: {
+          en: 'High-throughput multimodal production pipelines turning raw prompts and audio stems into complete, broadcast-quality music and video deliverables.',
+          zh: '工业级多模态生产流水线，将文本歌词与音频素材批量转化为高品质长音频与 1080P 完整视频成品。',
+        },
+        keyTech: ['ComfyUI API', 'YuE2 BF16', 'Wan 2.2 / SeedVR2', 'Remotion', 'Python Pipeline'],
+      },
+    ],
+  },
+
+  'sme-digital-suite': {
+    slug: 'sme-digital-suite',
+    title: {
+      en: 'SME Digital Suite: High-Conversion Web, SifuMail & Entitlement Engines',
+      zh: '中小企业数字资产与商业交付套件：高性能建站、SifuMail 邮局与权限引擎',
+    },
+    tagline: {
+      en: 'Turnkey digital infrastructure for growing enterprises: lightning-fast web, sovereign email, and self-healing access control.',
+      zh: '专为成长型企业定制的高可用数字基础设施：极致速度站点、高送达率企业邮局与自动化权限中台。',
+    },
+    metrics: {
+      en: '100% Deliverability Baseline · Zero SaaS Per-Seat Tax · Self-Healing Access · Turnkey Delivery',
+      zh: '满分邮件送达率 · 0 SaaS 人头月费税 · 自愈权限引擎 · 一站式交付移交',
+    },
+    stats: [
+      { value: '10/10', label: { en: 'SifuMail Deliverability Score', zh: '邮件送达信誉满分' } },
+      { value: '0', label: { en: 'Per-Seat Monthly SaaS Tax', zh: '零按人头月度软件税' } },
+      { value: '5-Way', label: { en: 'Self-Healing Entitlements', zh: '五链路权限自愈引擎' } },
+      { value: '100%', label: { en: 'Client Ownership & Source Handover', zh: '客户资产 100% 完整移交' } },
+    ],
+    tradeOffs: {
+      title: {
+        en: 'Sovereign Digital Ownership vs. Fragile SaaS Subscriptions',
+        zh: '自主数字资产所有权与脆弱 SaaS 订阅的本质对决',
+      },
+      content: {
+        en: `Small and medium enterprises in Southeast Asia often get trapped in two extremes: either slow, poorly-maintained WordPress template sites on shared hosting, or exorbitant enterprise SaaS tools that charge an escalating tax per team member every month.
+The SME Digital Suite delivers sovereign, productized architecture:
+
+1. High-Performance Web: Built on modern static architectures (Astro) or deeply tuned LiteSpeed WordPress engines, achieving Sub-1s page loads and perfect technical SEO schemas.
+2. Sovereign Email (SifuMail): Independent, fully managed mail server instances configured with strict SPF, DKIM, and DMARC alignments — eliminating $6–$12/user monthly GSuite/M365 overhead.
+3. Self-Healing Entitlements: NocoDB and n8n workflows that automatically grant, synchronize, and expire digital access rights without manual intervention.`,
+        zh: `东南亚中小企业在信息化进程中常陷入两极困境：要么购买劣质廉价的主机模板站，加载奇慢且漏洞频发；要么被海外昂贵的 SaaS 软件绑架，每月按人头支付沉重的订阅税。
+SME Digital Suite 提供了真正具备资产自主权的工程解决方案：
+
+1. 极速企业站点：基于现代化 Astro 静态架构或深度调优的 LiteSpeed WordPress，实现秒级加载与满分技术 SEO 结构化数据。
+2. 独立企业邮局（SifuMail）：搭建并维护独立的邮件服务器，严格对齐 SPF、DKIM 与 DMARC 防护，彻底省去每人每月数十马币的企业邮箱开销。
+3. 自愈权限引擎：基于 NocoDB + n8n + AList，实现客户订单与文件权限的自动化开通、实时自愈校验与到期回收。`,
+      },
+    },
+    cta: {
+      track: 'sme',
+      heading: {
+        en: 'Ready to Upgrade Your Business Digital Foundation?',
+        zh: '准备好升级您企业的数字化底层资产了吗？',
+      },
+      body: {
+        en: 'From turnkey high-conversion websites to sovereign mail hosting, get fixed-price delivery with complete ownership.',
+        zh: '从高性能商业建站、企业邮局到私有业务系统，一口价透明交付，享有 100% 源码与数据控制权。',
+      },
+      buttonText: {
+        en: 'Chat with Hoelee on WhatsApp (+60 12-797 2969) →',
+        zh: 'WhatsApp 咨询 Hoelee (+60 12-797 2969) →',
+      },
+      buttonLink: '/about/#sme',
+    },
+    layers: [
+      {
+        slug: 'L1-high-conversion-web',
+        name: {
+          en: 'L1: High-Performance Web & Technical SEO',
+          zh: 'L1: 高性能双语站点与技术 SEO 架构',
+        },
+        scope: {
+          en: 'Astro static edge deployment / OpenLiteSpeed tuning / Bilingual hreflang / TechArticle JSON-LD / Pagefind search',
+          zh: 'Astro 静态边缘构建 / OpenLiteSpeed 深度优化 / 双语 hreflang / TechArticle 结构化数据 / Pagefind 离线检索',
+        },
+        summary: {
+          en: 'Ultra-fast web platforms engineered for credibility, high search engine visibility (SEO/GEO), and zero maintenance overhead.',
+          zh: '极致加载速度与高信任度的企业官方门面，具备完美的搜索引擎与 AI 知识引擎收录架构。',
+        },
+        keyTech: ['Astro', 'OpenLiteSpeed / WordPress', 'Cloudflare Edge Cache', 'Schema.org JSON-LD', 'Pagefind'],
+      },
+      {
+        slug: 'L2-sifumail-communication',
+        name: {
+          en: 'L2: SifuMail & Sovereign Communication',
+          zh: 'L2: SifuMail 独立邮局与高送达率通信',
+        },
+        scope: {
+          en: 'SifuMail mail server deployment / SPF, DKIM, DMARC alignment / Anti-spam hygiene / Dedicated outbound IP routing',
+          zh: 'SifuMail 独立企业邮局部署 / SPF、DKIM、DMARC 满分信誉对齐 / 反垃圾防线 / 独立发信通道隔离',
+        },
+        summary: {
+          en: 'Dedicated enterprise mail infrastructure that keeps business communications out of spam folders without recurring per-mailbox fees.',
+          zh: '高送达率的企业专属独立邮局，确保商业报价信与通知不进垃圾箱，告别昂贵的人头软件税。',
+        },
+        keyTech: ['SifuMail (Mailcow/Postfix)', 'DNS SecOps (SPF/DKIM/DMARC)', 'Rspamd', 'TLS Encryption'],
+      },
+      {
+        slug: 'L3-entitlement-backoffice',
+        name: {
+          en: 'L3: Entitlement Engines & Backoffice CRM',
+          zh: 'L3: 数字商品自愈权限与中台数据底座',
+        },
+        scope: {
+          en: 'NocoDB data store / n8n multi-step workflows / AList drive permission engine / Public verification endpoint',
+          zh: 'NocoDB 关系数据底座 / n8n 多步调度流 / AList 网盘驱动权限引擎 / 零泄露公开查验接口',
+        },
+        summary: {
+          en: 'A self-healing access-control architecture that automatically provisions, verifies, and revokes client file entitlements across storage systems.',
+          zh: '五链路自愈式权限分发中台，全自动处理用户订单、发放网盘访问权限并在到期后平滑回收。',
+        },
+        keyTech: ['NocoDB', 'n8n', 'AList', 'REST APIs', 'PostgreSQL'],
+      },
+      {
+        slug: 'L4-managed-ops-handover',
+        name: {
+          en: 'L4: Managed SecOps, Cost Control & SLA',
+          zh: 'L4: 托管安全运维、TCO 降本与商业交付',
+        },
+        scope: {
+          en: 'Cloud bill audit & SaaS migration / 24/7 uptime monitoring / Anti-lockout procedures / Full documentation handover',
+          zh: '企业云账单审计与 SaaS 降本迁移 / 7×24 生产可用性监控 / 防自锁交付 SOP / 完整资产与文档移交',
+        },
+        summary: {
+          en: 'Complete peace of mind: turnkey handover with full source access, operational runbooks, and ongoing monitoring for zero lock-in.',
+          zh: '让企业主安心的交付闭环：代码与主机资产 100% 移交，配备高可用运维手册与告警接入，绝不设技术门槛扣留客户。',
+        },
+        keyTech: ['Uptime Kuma', 'Traefik Forward-Auth', 'Runbooks / SOP', 'Disaster Recovery Plan'],
+      },
+    ],
+  },
+};
+
+/** Get metadata for a single blueprint. */
+export function getBlueprint(slug: string): BlueprintMeta | undefined {
+  return BLUEPRINTS[slug as BlueprintSlug];
+}
+
+/** Get all blueprints as an array. */
+export function getAllBlueprints(): BlueprintMeta[] {
+  return BLUEPRINT_SLUGS.map((slug) => BLUEPRINTS[slug]);
+}
@@ -0,0 +1,117 @@
+---
+import BaseLayout from '../../layouts/BaseLayout.astro';
+import PostList from '../../components/PostList.astro';
+import { BLUEPRINT_SLUGS, getBlueprint } from '../../lib/blueprints';
+import { getCollection } from 'astro:content';
+import { isEn } from '../../lib/lang';
+import { SITE } from '../../config';
+
+export async function getStaticPaths() {
+  return BLUEPRINT_SLUGS.map((slug) => ({
+    params: { slug },
+  }));
+}
+
+const { slug } = Astro.params;
+const bp = getBlueprint(slug);
+
+if (!bp) {
+  throw new Error(`Blueprint not found: ${slug}`);
+}
+
+const allPosts = await getCollection('posts', isEn);
+const mountedPosts = allPosts.filter((p) => p.data.blueprint === bp.slug);
+---
+
+<BaseLayout
+  title={`${bp.title.en} — System Blueprint — Mr Hoelee`}
+  description={bp.tagline.en}
+  switchHref={`/zh/blueprints/${bp.slug}/`}
+  altLocaleUrl={`${SITE.url}/zh/blueprints/${bp.slug}/`}
+>
+  <nav class="meta-tag" style="margin-bottom: 1.25rem;">
+    <a href="/blueprints/" style="color: inherit; text-decoration: none;">← All System Blueprints</a>
+  </nav>
+
+  <article class="blueprint-article">
+    <!-- Block 1: Hero & High-Density Stats -->
+    <header class="blueprint-hero">
+      <div class="bp-card-top" style="margin-bottom: 0.5rem;">
+        <span class="bp-card-badge">Production Blueprint</span>
+        <span class="bp-card-metric">{bp.metrics.en}</span>
+      </div>
+      <h1>{bp.title.en}</h1>
+      <p class="blueprint-tagline">{bp.tagline.en}</p>
+
+      <div class="blueprint-stats-grid">
+        {bp.stats.map((st) => (
+          <div class="blueprint-stat-card">
+            <div class="blueprint-stat-val">{st.value}</div>
+            <div class="blueprint-stat-label">{st.label.en}</div>
+          </div>
+        ))}
+      </div>
+    </header>
+
+    <!-- Interactive Layer Jump Bar -->
+    <nav class="layer-nav-bar" aria-label="Quick jump to blueprint layer">
+      <span class="layer-nav-label">Topology Layers:</span>
+      {bp.layers.map((layer) => (
+        <a class="layer-nav-pill" href={`#${layer.slug}`}>
+          {layer.slug.split('-')[0]}: {layer.name.en.split(':')[1]?.trim() || layer.name.en}
+        </a>
+      ))}
+    </nav>
+
+    <!-- Block 2: Architectural Decisions & Production Trade-offs -->
+    <section class="tradeoffs-box">
+      <h2>{bp.tradeOffs.title.en}</h2>
+      <p>{bp.tradeOffs.content.en}</p>
+    </section>
+
+    <!-- Block 3: L1..L4 Layer Guides & Mounted Posts -->
+    <section class="blueprint-layers-section">
+      {bp.layers.map((layer) => {
+        const layerPosts = mountedPosts.filter((p) => p.data.blueprintLayer === layer.slug);
+        return (
+          <div class="layer-block" id={layer.slug}>
+            <div class="layer-head-row">
+              <h2>{layer.name.en}</h2>
+            </div>
+            <div class="layer-scope">Scope: {layer.scope.en}</div>
+            <p class="layer-summary-text">{layer.summary.en}</p>
+
+            <div class="layer-tech-tags">
+              {layer.keyTech.map((tech) => (
+                <span class="layer-tech-pill">{tech}</span>
+              ))}
+            </div>
+
+            <div class="layer-posts-container">
+              <div class="layer-posts-title">
+                {layerPosts.length > 0
+                  ? `Mounted Technical Write-ups (${layerPosts.length})`
+                  : 'Referenced Production Stacks & Runbooks'}
+              </div>
+
+              {layerPosts.length > 0 ? (
+                <PostList posts={layerPosts} limit={10} lang="en" />
+              ) : (
+                <p style="font-size: 0.9rem; color: var(--muted); margin: 0.5rem 0;">
+                  This architectural layer is backed by live production configurations in our primary repository. Related deep-dive case studies are referenced across the broader documentation.
+                </p>
+              )}
+            </div>
+          </div>
+        );
+      })}
+    </section>
+
+    <!-- Block 4: Contextual CTA -->
+    <section class={`blueprint-cta bp-cta-${bp.cta.track}`}>
+      <h3>{bp.cta.heading.en}</h3>
+      <p>{bp.cta.body.en}</p>
+      <a class="btn btn-primary" href={bp.cta.buttonLink}>{bp.cta.buttonText.en}</a>
+    </section>
+  </article>
+</BaseLayout>
@@ -0,0 +1,56 @@
+---
+import BaseLayout from '../../layouts/BaseLayout.astro';
+import { getAllBlueprints } from '../../lib/blueprints';
+import { SITE } from '../../config';
+
+const blueprints = getAllBlueprints();
+---
+
+<BaseLayout
+  title="System Blueprints — Production Architecture Guides — Mr Hoelee"
+  description="Explore three end-to-end architectural blueprints connecting 162 self-hosted containers, local GPU AI automation, and SME sovereign digital assets."
+  switchHref="/zh/blueprints/"
+  altLocaleUrl={`${SITE.url}/zh/blueprints/`}
+>
+  <div class="page-head">
+    <div class="meta-tag">Production Architecture</div>
+    <h1>System Blueprints</h1>
+    <p class="lede">
+      Instead of scattered chronological posts, these <strong>three architectural blueprints</strong> serve as the foundational pillars of everything I run. Each blueprint provides an interactive topology from physical hardware up to application code, organizing 91 bilingual write-ups into four clear, battle-tested engineering layers.
+    </p>
+  </div>
+
+  <div class="blueprints-grid">
+    {blueprints.map((bp, idx) => (
+      <a class="blueprint-card" href={`/blueprints/${bp.slug}/`}>
+        <div class="bp-card-top">
+          <span class="bp-card-badge">Pillar 0{idx + 1}</span>
+          <span class="bp-card-metric">{bp.metrics.en}</span>
+        </div>
+        <h2>{bp.title.en}</h2>
+        <p class="bp-tagline">{bp.tagline.en}</p>
+
+        <div class="bp-layers-preview">
+          {bp.layers.map((layer) => (
+            <div class="bp-layer-item">
+              <span class="bp-l-num">{layer.slug.split('-')[0]}</span>
+              <strong>{layer.name.en.split(':')[1]?.trim() || layer.name.en}</strong>
+            </div>
+          ))}
+        </div>
+
+        <div class="bp-card-cta">
+          Explore Blueprint &amp; Layer Guides →
+        </div>
+      </a>
+    ))}
+  </div>
+
+  <div class="blueprint-cta bp-cta-hiring">
+    <h3>Looking for Full-Ownership Engineering?</h3>
+    <p>
+      Whether you need robust Linux kernel and container infrastructure or autonomous AI workflows bound to deterministic state machines, explore my background and live system evidence.
+    </p>
+    <a class="btn btn-primary" href="/about/#hiring">View Tech Stack &amp; Case Studies →</a>
+  </div>
+</BaseLayout>
@@ -4,6 +4,7 @@ import AuthorCard from '../../components/AuthorCard.astro';
 import TableOfContents from '../../components/TableOfContents.astro';
 import ExecutiveSummary from '../../components/ExecutiveSummary.astro';
 import DynamicCTA from '../../components/DynamicCTA.astro';
+import { getBlueprint } from '../../lib/blueprints';
 import { getCollection, render } from 'astro:content';
 import { postLang } from '../../lib/lang';
 import { countWords, readingMinutes } from '../../lib/reading-time';
@@ -29,6 +30,9 @@ const lang = postLang(post.slug);
 const words = countWords(post.body);
 const minutes = readingMinutes(post.body);

+const bpMeta = post.data.blueprint ? getBlueprint(post.data.blueprint) : undefined;
+const bpLayer = bpMeta && post.data.blueprintLayer ? bpMeta.layers.find((l) => l.slug === post.data.blueprintLayer) : undefined;
+
 const fmt = (d: Date) =>
  d.toLocaleDateString(lang === 'zh' ? 'zh-CN' : 'en-US', { year: 'numeric', month: 'long', day: 'numeric' });

@@ -106,6 +110,14 @@ const jsonLd = {
 >
  <script type="application/ld+json" set:html={JSON.stringify(jsonLd)} />
  <article>
+    {bpMeta && bpLayer && (
+      <a class="article-blueprint-badge" href={lang === 'zh' ? `/zh/blueprints/${bpMeta.slug}/#${bpLayer.slug}` : `/blueprints/${bpMeta.slug}/#${bpLayer.slug}`}>
+        <span>📌 {lang === 'zh' ? '隶属于架构蓝图：' : 'Part of Blueprint:'}</span>
+        <strong>{lang === 'zh' ? bpMeta.title.zh.split('：')[0] : bpMeta.title.en.split(':')[0]}</strong>
+        <span>→</span>
+        <span>{lang === 'zh' ? bpLayer.name.zh : bpLayer.name.en}</span>
+      </a>
+    )}
    <header class="article-head">
      <h1>{post.data.title}</h1>
      <div class="meta">