From c5e473aaad516f21f681a08e623d2ac1afcb460d Mon Sep 17 00:00:00 2001
From: hoelee <me@hoelee.com>
Date: Tue, 27 Oct 2026 01:33:56 +0800
Subject: [PATCH] feat(blueprints): launch 3 system blueprints, 12 topology
 layers & in-article mounting

---
 docs/project-state.md                         |  11 +
 ...g-a-domain-to-someone-elses-mail-server.md |   2 +
 ...-english-mode-to-a-chinese-only-web-app.md |   2 +
 .../authentik-forward-auth-gate-wasnt-live.md |   2 +
 .../posts/authentik-major-upgrade-gotchas.md  |   2 +
 ...eported-exit-0-the-oom-killer-disagreed.md |   2 +
 ...from-audio-to-a-4-minute-ai-music-video.md |   2 +
 ...ing-full-length-songs-with-yue2-comfyui.md |   2 +
 ...-subtitles-for-songs-without-timestamps.md |   2 +
 .../posts/hardening-a-tor-onion-service.md    |   2 +
 ...built-an-automated-music-video-pipeline.md |   2 +
 .../how-i-built-the-digikedai-telegram-bot.md |   2 +
 src/content/posts/how-i-host-this-blog.md     |   2 +
 ...0-vps-providers-with-parallel-subagents.md |   2 +
 ...erify-a-hosting-provider-before-you-buy.md |   2 +
 ...loop-engineering-without-a-coding-agent.md |   2 +
 ...rating-codeigniter-iis-to-openlitespeed.md |   2 +
 ...ackup-was-using-someone-elses-api-quota.md |   2 +
 ...rometheus-for-unraid-synology-and-a-vps.md |   2 +
 ...ell-patching-every-php-runtime-i-manage.md |   2 +
 ...-a-front-door-on-an-app-you-cant-modify.md |   2 +
 ...-nocodb-dashboard-for-a-remote-database.md |   2 +
 .../posts/replacing-rdpguard-with-ipban.md    |   2 +
 .../running-ai-video-locally-on-a-12gb-gpu.md |   2 +
 .../running-production-infrastructure-solo.md |   2 +
 ...ng-tts-as-a-service-with-token-sidecars.md |   2 +
 ...self-healing-digital-goods-entitlements.md |   2 +
 .../self-hosted-tts-cosyvoice2-n8n-gpu.md     |   2 +
 ...n-ai-photo-editor-as-a-wordpress-plugin.md |   2 +
 ...lashing-agent-context-with-a-code-graph.md |   2 +
 ...ng-agent-prompts-for-deterministic-work.md |   2 +
 ...self-improving-ai-agent-across-machines.md |   2 +
 ...synology-spreadsheet-api-is-a-container.md |   2 +
 ...hat-dying-ssd-was-just-a-bad-sata-cable.md |   2 +
 ...e-nocodb-attachment-that-wouldnt-update.md |   2 +
 ...he-single-writer-rule-for-coding-agents.md |   2 +
 .../unraid-stop-array-hangs-on-swapfile.md    |   2 +
 .../verifying-a-pdf-report-page-by-page.md    |   2 +
 ...-source-dependency-before-you-bet-on-it.md |   2 +
 ...ealthy-but-your-raid-is-corrupting-data.md |   2 +
 ...it-churn-only-left-230000-in-production.md |   2 +
 .../posts/why-i-still-bought-a-local-gpu.md   |   2 +
 .../why-is-my-tts-model-repeating-percent.md  |   2 +
 .../posts/why-multi-agent-coding-fails.md     |   2 +
 .../why-telegram-bot-notifications-die.md     |   2 +
 ...hy-your-grafana-dashboard-shows-no-data.md |   2 +
 .../posts/your-disk-full-alert-is-lying.md    |   2 +
 ...-12gb-gpu-songs-that-lost-their-endings.md |   2 +
 ...g-a-domain-to-someone-elses-mail-server.md |   2 +
 ...-english-mode-to-a-chinese-only-web-app.md |   2 +
 .../authentik-forward-auth-gate-wasnt-live.md |   2 +
 .../zh/authentik-major-upgrade-gotchas.md     |   2 +
 ...eported-exit-0-the-oom-killer-disagreed.md |   2 +
 ...from-audio-to-a-4-minute-ai-music-video.md |   2 +
 ...ing-full-length-songs-with-yue2-comfyui.md |   2 +
 ...-subtitles-for-songs-without-timestamps.md |   2 +
 .../posts/zh/hardening-a-tor-onion-service.md |   2 +
 ...built-an-automated-music-video-pipeline.md |   2 +
 .../how-i-built-the-digikedai-telegram-bot.md |   2 +
 src/content/posts/zh/how-i-host-this-blog.md  |   2 +
 ...0-vps-providers-with-parallel-subagents.md |   2 +
 ...erify-a-hosting-provider-before-you-buy.md |   2 +
 ...loop-engineering-without-a-coding-agent.md |   2 +
 ...rating-codeigniter-iis-to-openlitespeed.md |   2 +
 ...ackup-was-using-someone-elses-api-quota.md |   2 +
 ...rometheus-for-unraid-synology-and-a-vps.md |   2 +
 ...ell-patching-every-php-runtime-i-manage.md |   2 +
 ...-a-front-door-on-an-app-you-cant-modify.md |   2 +
 ...-nocodb-dashboard-for-a-remote-database.md |   2 +
 .../posts/zh/replacing-rdpguard-with-ipban.md |   2 +
 .../running-ai-video-locally-on-a-12gb-gpu.md |   2 +
 .../running-production-infrastructure-solo.md |   2 +
 ...ng-tts-as-a-service-with-token-sidecars.md |   2 +
 ...self-healing-digital-goods-entitlements.md |   2 +
 .../zh/self-hosted-tts-cosyvoice2-n8n-gpu.md  |   2 +
 ...n-ai-photo-editor-as-a-wordpress-plugin.md |   2 +
 ...lashing-agent-context-with-a-code-graph.md |   2 +
 ...ng-agent-prompts-for-deterministic-work.md |   2 +
 ...self-improving-ai-agent-across-machines.md |   2 +
 ...synology-spreadsheet-api-is-a-container.md |   2 +
 ...hat-dying-ssd-was-just-a-bad-sata-cable.md |   2 +
 ...e-nocodb-attachment-that-wouldnt-update.md |   2 +
 ...he-single-writer-rule-for-coding-agents.md |   2 +
 .../zh/unraid-stop-array-hangs-on-swapfile.md |   2 +
 .../zh/verifying-a-pdf-report-page-by-page.md |   2 +
 ...-source-dependency-before-you-bet-on-it.md |   2 +
 ...ealthy-but-your-raid-is-corrupting-data.md |   2 +
 ...it-churn-only-left-230000-in-production.md |   2 +
 .../zh/why-i-still-bought-a-local-gpu.md      |   2 +
 .../why-is-my-tts-model-repeating-percent.md  |   2 +
 .../posts/zh/why-multi-agent-coding-fails.md  |   2 +
 .../zh/why-telegram-bot-notifications-die.md  |   2 +
 ...hy-your-grafana-dashboard-shows-no-data.md |   2 +
 .../posts/zh/your-disk-full-alert-is-lying.md |   2 +
 ...-12gb-gpu-songs-that-lost-their-endings.md |   2 +
 src/layouts/BaseLayout.astro                  |   5 +-
 src/lib/blueprints.ts                         | 416 ++++++++++++++++++
 src/pages/blueprints/[slug].astro             | 117 +++++
 src/pages/blueprints/index.astro              |  56 +++
 src/pages/posts/[...slug].astro               |  12 +
 src/pages/zh/blueprints/[slug].astro          | 118 +++++
 src/pages/zh/blueprints/index.astro           |  57 +++
 src/styles/global.css                         | 312 +++++++++++++
 103 files changed, 1290 insertions(+), 2 deletions(-)
 create mode 100644 src/lib/blueprints.ts
 create mode 100644 src/pages/blueprints/[slug].astro
 create mode 100644 src/pages/blueprints/index.astro
 create mode 100644 src/pages/zh/blueprints/[slug].astro
 create mode 100644 src/pages/zh/blueprints/index.astro

diff --git a/docs/project-state.md b/docs/project-state.md
index 473a57f..8e88be9 100644
--- a/docs/project-state.md
+++ b/docs/project-state.md
@@ -48,6 +48,17 @@ Living list of what's done and what's next for blog.hoelee.com. Work through the
 - ✅ **B5 baseline & hygiene** (2026-10-18, `3f63150`) — `/og-default.jpg` 211 KB → 45 KB carrying the headshot; banner-404 sweep to 72/72 clean; CJK system font stack; A2 branding alignment.
 - ✅ **B6 visual redesign + Ideogram 4 pipeline** (2026-10-18) — the consultant's hybrid "one art, four targets" template; bento theme tokens (a hardcoded dark scrim measured 1.96:1 text contrast in the light theme → 6.10). Phase F is its rollout.
 - ✅ **B7 review-response** (2026-10-19, `5941e85` + `5ec321a`) — About counter derived from the collection (71 → **72**); reading time is CJK-aware (ZH **1 min → 5 分钟**); ZH wording fixes; `hello-world`'s stale language policy and container count; hero leads with the capability; featured cards got the `srcset` they lacked; **48/48** mobile-overflow combinations at 0 px.
+- ✅ **B8 Consultant Review R4 & Blueprints Architecture** (2026-10-27) —
+  - Stream separation: Homepage splits into 6 engineering posts + bottom GPU & Multimodal Lab strip.
+  - Top navigation: `Blueprints | Case Studies | All Posts | Work With Me` (ZH: `系统蓝图 | 工程案例 | 全部文章 | 关于与合作`).
+  - Hero CTA: Malaysian SME button anchors directly to `/about/#sme` (ZH: `/zh/about/#sme`).
+  - Dual-track `/about/` retains canonical URL, redirects `/work-with-me/` via 301.
+  - Three System Blueprints (`/blueprints/` and `/zh/blueprints/`):
+    - `self-hosted-infrastructure` (162 Containers, 4 Layers)
+    - `ai-agent-automation` (Deterministic Workflows + GPU Inference, 4 Layers)
+    - `sme-digital-suite` (High-Performance Web, SifuMail, Entitlements, 4 Layers)
+  - 94 post files mounted to the 12 Blueprint Layers across EN and ZH with in-article breadcrumbs.
+  - Schema.org `TechArticle` enrichment with `dependencies` and `audience`.
 
 ---
 
diff --git a/src/content/posts/adding-a-domain-to-someone-elses-mail-server.md b/src/content/posts/adding-a-domain-to-someone-elses-mail-server.md
index cbca980..22c4c92 100644
--- a/src/content/posts/adding-a-domain-to-someone-elses-mail-server.md
+++ b/src/content/posts/adding-a-domain-to-someone-elses-mail-server.md
@@ -4,6 +4,8 @@ description: "Receiving mail took four DNS records and worked first try. Sending
 pubDate: 2025-05-06
 updatedDate: 2026-10-16
 category: notes
+blueprint: sme-digital-suite
+blueprintLayer: L2-sifumail-communication
 tags: ["email", "dns", "mailcow", "smtp", "deliverability"]
 ogImage: /og/adding-a-domain-to-someone-elses-mail-server.jpg
 banner: /banners/adding-a-domain-to-someone-elses-mail-server.jpg
diff --git a/src/content/posts/adding-english-mode-to-a-chinese-only-web-app.md b/src/content/posts/adding-english-mode-to-a-chinese-only-web-app.md
index 04d15c0..15477e7 100644
--- a/src/content/posts/adding-english-mode-to-a-chinese-only-web-app.md
+++ b/src/content/posts/adding-english-mode-to-a-chinese-only-web-app.md
@@ -4,6 +4,8 @@ description: "Browsers expose no JavaScript API to trigger translation — and m
 pubDate: 2025-06-11
 updatedDate: 2026-09-29
 category: engineering
+blueprint: sme-digital-suite
+blueprintLayer: L1-high-conversion-web
 tags: ["i18n", "nginx", "vue", "javascript", "self-hosting"]
 ogImage: "/og/adding-english-mode-to-a-chinese-only-web-app.jpg"
 banner: "/banners/adding-english-mode-to-a-chinese-only-web-app.jpg"
diff --git a/src/content/posts/authentik-forward-auth-gate-wasnt-live.md b/src/content/posts/authentik-forward-auth-gate-wasnt-live.md
index 0041401..922a659 100644
--- a/src/content/posts/authentik-forward-auth-gate-wasnt-live.md
+++ b/src/content/posts/authentik-forward-auth-gate-wasnt-live.md
@@ -4,6 +4,8 @@ description: "My authentik forward-auth gate returned a clean 302 to the login p
 pubDate: 2026-08-12
 updatedDate: 2026-09-29
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L2-edge-proxy-runtime
 tags: ["authentik", "forward-auth", "cloudflare", "nginx", "docker", "self-hosting"]
 ogImage: /og/authentik-forward-auth-gate-wasnt-live.jpg
 banner: /banners/authentik-forward-auth-gate-wasnt-live.jpg
diff --git a/src/content/posts/authentik-major-upgrade-gotchas.md b/src/content/posts/authentik-major-upgrade-gotchas.md
index 104057c..a9b9812 100644
--- a/src/content/posts/authentik-major-upgrade-gotchas.md
+++ b/src/content/posts/authentik-major-upgrade-gotchas.md
@@ -3,6 +3,8 @@ title: "Authentik 2025.8 to 2026.8: The Breakable Parts Nobody Warns You About"
 description: "A year's worth of authentik major-version upgrade pain: storage mount changes, RBAC session cleanup, trusted proxies, and the authorization_flow vs authentication_flow mix-up that broke SSO."
 pubDate: 2026-09-09
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L2-edge-proxy-runtime
 tags: [authentik, sso, docker, portainer, self-hosting, oidc, upgrade]
 ogImage: /og/authentik-major-upgrade-gotchas.jpg
 banner: /banners/authentik-major-upgrade-gotchas.jpg
diff --git a/src/content/posts/docker-reported-exit-0-the-oom-killer-disagreed.md b/src/content/posts/docker-reported-exit-0-the-oom-killer-disagreed.md
index 4d9197a..b637e34 100644
--- a/src/content/posts/docker-reported-exit-0-the-oom-killer-disagreed.md
+++ b/src/content/posts/docker-reported-exit-0-the-oom-killer-disagreed.md
@@ -3,6 +3,8 @@ title: "Docker Reported Exit 0. The Kernel Had Already OOM-Killed It."
 description: "A container on my NAS kept stopping unexpectedly while Docker reported exit 0 and OOMKilled=false. The honest evidence was in dmesg: six cgroup OOM kills."
 pubDate: 2026-10-16
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L2-edge-proxy-runtime
 tags: ["docker", "oom", "traefik", "synology", "crawlers"]
 ogImage: /og/docker-reported-exit-0-the-oom-killer-disagreed.jpg
 banner: /banners/docker-reported-exit-0-the-oom-killer-disagreed.jpg
diff --git a/src/content/posts/from-audio-to-a-4-minute-ai-music-video.md b/src/content/posts/from-audio-to-a-4-minute-ai-music-video.md
index 9851c44..576ed11 100644
--- a/src/content/posts/from-audio-to-a-4-minute-ai-music-video.md
+++ b/src/content/posts/from-audio-to-a-4-minute-ai-music-video.md
@@ -3,6 +3,8 @@ title: "From Audio to a 4-Minute Music Video: Orchestrating Gemini Argon 4, AI D
 description: "A complete production breakdown of building a 4-minute 1080p anime OP music video (Crescent Bay): AI music generation, Gemini Argon 4 storyboard prompting, iterative image-to-video rerolls, and Filmora VFX editing."
 pubDate: 2026-10-25
 category: case-studies
+blueprint: ai-agent-automation
+blueprintLayer: L4-aigc-media-pipelines
 stream: creative-lab
 tags: ["ai-video", "music-video", "gemini", "filmora", "face-swapping", "ai-music", "creative-workflows"]
 ogImage: "/og/from-audio-to-a-4-minute-ai-music-video.jpg"
diff --git a/src/content/posts/generating-full-length-songs-with-yue2-comfyui.md b/src/content/posts/generating-full-length-songs-with-yue2-comfyui.md
index 1a5f005..884e5c6 100644
--- a/src/content/posts/generating-full-length-songs-with-yue2-comfyui.md
+++ b/src/content/posts/generating-full-length-songs-with-yue2-comfyui.md
@@ -3,6 +3,8 @@ title: "Generating Full-Length Songs with YuE2 BF16: Overcoming Duration Limits
 description: "AI music tools cut off complex tracks mid-sentence. Here is how I solved the 240s duration wall using YuE2 BF16, 295s headroom budgeting, and a 60-song pipeline."
 pubDate: 2026-10-26
 category: tutorials
+blueprint: ai-agent-automation
+blueprintLayer: L4-aigc-media-pipelines
 stream: creative-lab
 tags: ["ai-music", "yue2", "comfyui", "audio-engineering", "subtitles", "python"]
 ogImage: "/og/generating-full-length-songs-with-yue2-comfyui.jpg"
diff --git a/src/content/posts/generating-subtitles-for-songs-without-timestamps.md b/src/content/posts/generating-subtitles-for-songs-without-timestamps.md
index bae2213..d432d10 100644
--- a/src/content/posts/generating-subtitles-for-songs-without-timestamps.md
+++ b/src/content/posts/generating-subtitles-for-songs-without-timestamps.md
@@ -3,6 +3,8 @@ title: "Generating Subtitles for Songs That Ship Without Timestamps"
 description: "AI music tools give you audio and nothing else — no line timings, no karaoke. Here is the pipeline I use to produce LRC and SRT subtitles for 18 songs, why plain transcription fails, and the two bugs that made the lyrics box scroll to the bottom."
 pubDate: 2026-10-20
 category: tutorials
+blueprint: ai-agent-automation
+blueprintLayer: L3-local-gpu-inference
 stream: creative-lab
 tags: ["subtitles", "lrc", "srt", "whisper", "forced-alignment", "ai-music", "python"]
 ogImage: "/og/generating-subtitles-for-songs-without-timestamps.jpg"
diff --git a/src/content/posts/hardening-a-tor-onion-service.md b/src/content/posts/hardening-a-tor-onion-service.md
index 9599456..4cec53a 100644
--- a/src/content/posts/hardening-a-tor-onion-service.md
+++ b/src/content/posts/hardening-a-tor-onion-service.md
@@ -4,6 +4,8 @@ description: "Out of curiosity I mirrored my portfolio and git server onto the d
 pubDate: 2025-12-10
 updatedDate: 2026-09-09
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L4-secops-cicd-dr
 tags: [tor, docker, security, self-hosting, networking]
 ogImage: /og/hardening-a-tor-onion-service.jpg
 banner: /banners/hardening-a-tor-onion-service.jpg
diff --git a/src/content/posts/how-i-built-an-automated-music-video-pipeline.md b/src/content/posts/how-i-built-an-automated-music-video-pipeline.md
index a781793..cb1c60a 100644
--- a/src/content/posts/how-i-built-an-automated-music-video-pipeline.md
+++ b/src/content/posts/how-i-built-an-automated-music-video-pipeline.md
@@ -4,6 +4,8 @@ description: 'Explore an automated music video workflow using Remotion, Whisper,
 pubDate: 2025-04-18
 updatedDate: 2026-10-22
 category: case-studies
+blueprint: ai-agent-automation
+blueprintLayer: L4-aigc-media-pipelines
 stream: creative-lab
 tags: ["remotion", "docker", "cdp", "youtube", "automation", "video-generation", "whisper"]
 ogImage: "/og/how-i-built-an-automated-music-video-pipeline.jpg"
diff --git a/src/content/posts/how-i-built-the-digikedai-telegram-bot.md b/src/content/posts/how-i-built-the-digikedai-telegram-bot.md
index 88067b3..b140097 100644
--- a/src/content/posts/how-i-built-the-digikedai-telegram-bot.md
+++ b/src/content/posts/how-i-built-the-digikedai-telegram-bot.md
@@ -3,6 +3,8 @@ title: "How I Built the DigiKedai Telegram AI Bot"
 description: "A customer-support AI bot that answers questions and provisions free-trial accounts over Telegram and WhatsApp — TypeScript, grammY, a Cloudflare tunnel webhook, and a self-hosted LiteLLM gateway."
 pubDate: 2026-09-06
 category: case-studies
+blueprint: ai-agent-automation
+blueprintLayer: L1-deterministic-orchestration
 tags: [telegram, docker, cloudflare, litellm, typescript, ai]
 ogImage: /og/how-i-built-the-digikedai-telegram-bot.jpg
 banner: /banners/how-i-built-the-digikedai-telegram-bot.jpg
diff --git a/src/content/posts/how-i-host-this-blog.md b/src/content/posts/how-i-host-this-blog.md
index c3fd4ae..bcb80df 100644
--- a/src/content/posts/how-i-host-this-blog.md
+++ b/src/content/posts/how-i-host-this-blog.md
@@ -3,6 +3,8 @@ title: "How I Host This Blog: Astro, Gitea Actions, and Self-Hosted CI/CD"
 description: "A walkthrough of the end-to-end pipeline that builds and serves this site — git-as-CMS, a self-hosted runner on my unRaid server, and Cloudflare in front."
 pubDate: 2026-09-04
 category: case-studies
+blueprint: sme-digital-suite
+blueprintLayer: L1-high-conversion-web
 tags: [astro, gitea, ci-cd, self-hosting, docker, cloudflare]
 ogImage: /og/how-i-host-this-blog.jpg
 banner: /banners/how-i-host-this-blog.jpg
diff --git a/src/content/posts/how-i-vetted-20-vps-providers-with-parallel-subagents.md b/src/content/posts/how-i-vetted-20-vps-providers-with-parallel-subagents.md
index 79e2783..1dc577b 100644
--- a/src/content/posts/how-i-vetted-20-vps-providers-with-parallel-subagents.md
+++ b/src/content/posts/how-i-vetted-20-vps-providers-with-parallel-subagents.md
@@ -4,6 +4,8 @@ description: "A case study in orchestrating parallel AI subagents to run due dil
 pubDate: 2025-11-12
 updatedDate: 2026-09-09
 category: case-studies
+blueprint: sme-digital-suite
+blueprintLayer: L4-managed-ops-handover
 tags: [ai-orchestration, subagents, due-diligence, hosting, devops]
 ogImage: /og/how-i-vetted-20-vps-providers-with-parallel-subagents.jpg
 banner: /banners/how-i-vetted-20-vps-providers-with-parallel-subagents.jpg
diff --git a/src/content/posts/how-to-verify-a-hosting-provider-before-you-buy.md b/src/content/posts/how-to-verify-a-hosting-provider-before-you-buy.md
index cb4cbb8..beb8c68 100644
--- a/src/content/posts/how-to-verify-a-hosting-provider-before-you-buy.md
+++ b/src/content/posts/how-to-verify-a-hosting-provider-before-you-buy.md
@@ -4,6 +4,8 @@ description: "A reusable checklist for separating real hosting claims from marke
 pubDate: 2025-11-26
 updatedDate: 2026-09-09
 category: tutorials
+blueprint: sme-digital-suite
+blueprintLayer: L4-managed-ops-handover
 tags: [hosting, vps, due-diligence, whois, devops]
 ogImage: /og/how-to-verify-a-hosting-provider-before-you-buy.jpg
 banner: /banners/how-to-verify-a-hosting-provider-before-you-buy.jpg
diff --git a/src/content/posts/loop-engineering-without-a-coding-agent.md b/src/content/posts/loop-engineering-without-a-coding-agent.md
index 37b3459..f0956d9 100644
--- a/src/content/posts/loop-engineering-without-a-coding-agent.md
+++ b/src/content/posts/loop-engineering-without-a-coding-agent.md
@@ -3,6 +3,8 @@ title: "Loop Engineering Without a Coding Agent: The 11 Cron Jobs That Run My In
 description: "Loop engineering is 2026's term for designing the system that prompts and checks an agent. I applied it to self-hosted infrastructure, not a codebase: 11 cron jobs, 8 with no AI at all."
 pubDate: 2026-10-01
 category: case-studies
+blueprint: self-hosted-infrastructure
+blueprintLayer: L3-observability-self-healing
 tags: ["loop-engineering", "ai-agents", "cron", "self-hosting", "automation", "monitoring"]
 ogImage: "/og/loop-engineering-without-a-coding-agent.jpg"
 banner: "/banners/loop-engineering-without-a-coding-agent.jpg"
diff --git a/src/content/posts/migrating-codeigniter-iis-to-openlitespeed.md b/src/content/posts/migrating-codeigniter-iis-to-openlitespeed.md
index b4da1fa..fefe44c 100644
--- a/src/content/posts/migrating-codeigniter-iis-to-openlitespeed.md
+++ b/src/content/posts/migrating-codeigniter-iis-to-openlitespeed.md
@@ -3,6 +3,8 @@ title: "Migrating a CodeIgniter 4 App From IIS to OpenLiteSpeed"
 description: "I moved a 17,000-line CodeIgniter 4 app from Windows IIS to OpenLiteSpeed on CyberPanel. Two fatal errors appeared that IIS had been hiding behind SSO."
 pubDate: 2026-09-27
 category: engineering
+blueprint: sme-digital-suite
+blueprintLayer: L1-high-conversion-web
 tags: [codeigniter, php, openspeedway, cyberpanel, iis, migration, litespeed, linux]
 ogImage: /og/migrating-codeigniter-iis-to-openlitespeed.jpg
 banner: /banners/migrating-codeigniter-iis-to-openlitespeed.jpg
diff --git a/src/content/posts/my-backup-was-using-someone-elses-api-quota.md b/src/content/posts/my-backup-was-using-someone-elses-api-quota.md
index 6898666..339dd63 100644
--- a/src/content/posts/my-backup-was-using-someone-elses-api-quota.md
+++ b/src/content/posts/my-backup-was-using-someone-elses-api-quota.md
@@ -4,6 +4,8 @@ description: "A 1 TB restic seed stalled at zero bytes. The log named a Google p
 pubDate: 2026-10-15
 updatedDate: 2026-10-16
 category: notes
+blueprint: self-hosted-infrastructure
+blueprintLayer: L4-secops-cicd-dr
 tags: ["rclone", "backup", "google-drive", "oauth", "restic"]
 ogImage: /og/my-backup-was-using-someone-elses-api-quota.jpg
 banner: /banners/my-backup-was-using-someone-elses-api-quota.jpg
diff --git a/src/content/posts/one-prometheus-for-unraid-synology-and-a-vps.md b/src/content/posts/one-prometheus-for-unraid-synology-and-a-vps.md
index 2d299d3..d36b105 100644
--- a/src/content/posts/one-prometheus-for-unraid-synology-and-a-vps.md
+++ b/src/content/posts/one-prometheus-for-unraid-synology-and-a-vps.md
@@ -4,6 +4,8 @@ description: "Three hosts, one Prometheus, one Grafana. The coverage matrix, the
 pubDate: 2026-07-29
 updatedDate: 2026-09-29
 category: case-studies
+blueprint: self-hosted-infrastructure
+blueprintLayer: L3-observability-self-healing
 tags: [prometheus, grafana, unraid, synology, dsm, cadvisor, monitoring, self-hosting]
 ogImage: /og/one-prometheus-for-unraid-synology-and-a-vps.jpg
 banner: /banners/one-prometheus-for-unraid-synology-and-a-vps.jpg
diff --git a/src/content/posts/php2shell-patching-every-php-runtime-i-manage.md b/src/content/posts/php2shell-patching-every-php-runtime-i-manage.md
index 4f149d5..27db691 100644
--- a/src/content/posts/php2shell-patching-every-php-runtime-i-manage.md
+++ b/src/content/posts/php2shell-patching-every-php-runtime-i-manage.md
@@ -3,6 +3,8 @@ title: "PHP2Shell: I Measured Every PHP Runtime I Manage. All of Them Were Vulne
 description: "CVE-2026-109618 and CVE-2026-109619 are unauthenticated RCE in PHP itself, exploited before disclosure. What I measured across the infrastructure I manage — and the exact fix that closed it."
 pubDate: 2026-10-23
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L4-secops-cicd-dr
 tags: ["php", "security", "cve", "cyberpanel", "litespeed", "wordpress", "patching", "self-hosting"]
 ogImage: /og/php2shell-patching-every-php-runtime-i-manage.jpg
 banner: /banners/php2shell-patching-every-php-runtime-i-manage.jpg
diff --git a/src/content/posts/putting-a-front-door-on-an-app-you-cant-modify.md b/src/content/posts/putting-a-front-door-on-an-app-you-cant-modify.md
index 6dbd0c9..ede3734 100644
--- a/src/content/posts/putting-a-front-door-on-an-app-you-cant-modify.md
+++ b/src/content/posts/putting-a-front-door-on-an-app-you-cant-modify.md
@@ -4,6 +4,8 @@ description: "A self-hosted app whose front page was a Chinese login box — and
 pubDate: 2025-06-24
 updatedDate: 2026-10-06
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L2-edge-proxy-runtime
 tags: ["nginx", "docker", "self-hosting", "seo", "branding"]
 ogImage: "/og/putting-a-front-door-on-an-app-you-cant-modify.jpg"
 banner: "/banners/putting-a-front-door-on-an-app-you-cant-modify.jpg"
diff --git a/src/content/posts/read-only-nocodb-dashboard-for-a-remote-database.md b/src/content/posts/read-only-nocodb-dashboard-for-a-remote-database.md
index 9eeec0e..83029e6 100644
--- a/src/content/posts/read-only-nocodb-dashboard-for-a-remote-database.md
+++ b/src/content/posts/read-only-nocodb-dashboard-for-a-remote-database.md
@@ -3,6 +3,8 @@ title: "A Read-Only NocoDB Dashboard for a Database on Another Machine"
 description: "Point NocoDB at a MySQL/MariaDB database on another machine without copying a single row — and avoid the Docker SNAT source-IP trap and two API traps I hit."
 pubDate: 2026-09-29
 category: devops
+blueprint: sme-digital-suite
+blueprintLayer: L3-entitlement-backoffice
 tags: ["nocodb", "mysql", "mariadb", "docker", "networking", "dashboard"]
 ogImage: /og/read-only-nocodb-dashboard-for-a-remote-database.jpg
 banner: /banners/read-only-nocodb-dashboard-for-a-remote-database.jpg
diff --git a/src/content/posts/replacing-rdpguard-with-ipban.md b/src/content/posts/replacing-rdpguard-with-ipban.md
index 3a3fc56..1447c23 100644
--- a/src/content/posts/replacing-rdpguard-with-ipban.md
+++ b/src/content/posts/replacing-rdpguard-with-ipban.md
@@ -3,6 +3,8 @@ title: "Replacing RDPGuard With IPBan: The Traps Nobody Documents"
 description: "I migrated from paid RDPGuard 7.8.7 to open-source IPBan 4.1.0 — and hit three undocumented traps, including an uninstaller that would have silently unbanned 12 attackers."
 pubDate: 2026-09-19
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L4-secops-cicd-dr
 tags: [windows, security, rdp, ipban, rdpguard, brute-force, firewall, self-hosting]
 ogImage: /og/replacing-rdpguard-with-ipban.jpg
 banner: /banners/replacing-rdpguard-with-ipban.jpg
diff --git a/src/content/posts/running-ai-video-locally-on-a-12gb-gpu.md b/src/content/posts/running-ai-video-locally-on-a-12gb-gpu.md
index 7c32c60..ae9560c 100644
--- a/src/content/posts/running-ai-video-locally-on-a-12gb-gpu.md
+++ b/src/content/posts/running-ai-video-locally-on-a-12gb-gpu.md
@@ -3,6 +3,8 @@ title: "Running AI Video Locally on a 12 GB GPU: Real Numbers for Wan 2.2 and Se
 description: "Measured on an RTX 3060: Wan 2.2 TI2V-5B generation, SeedVR2 upscaling, the 1080p resolution trap, and the one command that fixed five failed runs."
 pubDate: 2026-10-20
 category: ai
+blueprint: ai-agent-automation
+blueprintLayer: L4-aigc-media-pipelines
 stream: creative-lab
 tags: [ai-video, wan, comfyui, seedvr2, local-llm, gpu, cost]
 ogImage: /og/running-ai-video-locally-on-a-12gb-gpu.jpg
diff --git a/src/content/posts/running-production-infrastructure-solo.md b/src/content/posts/running-production-infrastructure-solo.md
index 0db688c..72c9af5 100644
--- a/src/content/posts/running-production-infrastructure-solo.md
+++ b/src/content/posts/running-production-infrastructure-solo.md
@@ -3,6 +3,8 @@ title: "Running Production Infrastructure Solo: 162 Containers Across Three Host
 description: "One operator, three hosts, 162 containers in 78 compose stacks — Traefik, SSO, monitoring, mail, CI/CD and backups — and the two failures that changed how I verify my own numbers."
 pubDate: 2026-10-06
 category: case-studies
+blueprint: self-hosted-infrastructure
+blueprintLayer: L1-compute-storage-network
 tags: [docker, traefik, monitoring, infrastructure, devops]
 ogImage: /og/running-production-infrastructure-solo.jpg
 banner: /banners/running-production-infrastructure-solo.jpg
diff --git a/src/content/posts/running-tts-as-a-service-with-token-sidecars.md b/src/content/posts/running-tts-as-a-service-with-token-sidecars.md
index 0daa53a..37fa6fd 100644
--- a/src/content/posts/running-tts-as-a-service-with-token-sidecars.md
+++ b/src/content/posts/running-tts-as-a-service-with-token-sidecars.md
@@ -3,6 +3,8 @@ title: "I Ran a Text-to-Speech Service for a Year on Two Cron Containers"
 description: "A reading app needed TTS. Cloud free tiers expire tokens in 10 minutes and 1 hour. Here's the sidecar pattern that kept Azure and Google voices working for a year with no secrets in any workflow."
 pubDate: 2026-09-18
 category: ai
+blueprint: ai-agent-automation
+blueprintLayer: L3-local-gpu-inference
 tags: [n8n, tts, azure, google-cloud, docker, automation, sidecar]
 ogImage: /og/running-tts-as-a-service-with-token-sidecars.jpg
 banner: /banners/running-tts-as-a-service-with-token-sidecars.jpg
diff --git a/src/content/posts/self-healing-digital-goods-entitlements.md b/src/content/posts/self-healing-digital-goods-entitlements.md
index 0474ab5..ea78203 100644
--- a/src/content/posts/self-healing-digital-goods-entitlements.md
+++ b/src/content/posts/self-healing-digital-goods-entitlements.md
@@ -3,6 +3,8 @@ title: "Self-Healing Access Control for Digital Goods: NocoDB, n8n, and AList"
 description: "How I built a five-workflow entitlement system that grants, expires, and continuously repairs customer file access — with a build-time code-sharing trick and a public endpoint designed to leak nothing."
 pubDate: 2026-09-18
 category: case-studies
+blueprint: sme-digital-suite
+blueprintLayer: L3-entitlement-backoffice
 tags: [n8n, nocodb, alist, access-control, docker, automation, digital-goods]
 ogImage: /og/self-healing-digital-goods-entitlements.jpg
 banner: /banners/self-healing-digital-goods-entitlements.jpg
diff --git a/src/content/posts/self-hosted-tts-cosyvoice2-n8n-gpu.md b/src/content/posts/self-hosted-tts-cosyvoice2-n8n-gpu.md
index 52291a3..4f9844c 100644
--- a/src/content/posts/self-hosted-tts-cosyvoice2-n8n-gpu.md
+++ b/src/content/posts/self-hosted-tts-cosyvoice2-n8n-gpu.md
@@ -3,6 +3,8 @@ title: "How I Replaced Cloud TTS with a Self-Hosted Neural Voice Stack on an RTX
 description: "How I migrated our production automation workflows from cloud speech APIs to a self-hosted CosyVoice 2 pipeline on a 12GB RTX 3060, integrated with Synology N8N."
 pubDate: 2026-10-22
 category: case-studies
+blueprint: ai-agent-automation
+blueprintLayer: L3-local-gpu-inference
 tags: ["tts", "ai", "n8n", "gpu", "cosyvoice", "self-hosting"]
 ogImage: "/og/self-hosted-tts-cosyvoice2-n8n-gpu.jpg"
 banner: "/banners/self-hosted-tts-cosyvoice2-n8n-gpu.jpg"
diff --git a/src/content/posts/shipping-an-ai-photo-editor-as-a-wordpress-plugin.md b/src/content/posts/shipping-an-ai-photo-editor-as-a-wordpress-plugin.md
index db8cf4b..3bcd4db 100644
--- a/src/content/posts/shipping-an-ai-photo-editor-as-a-wordpress-plugin.md
+++ b/src/content/posts/shipping-an-ai-photo-editor-as-a-wordpress-plugin.md
@@ -3,6 +3,8 @@ title: "Shipping an AI Photo Editor as a WordPress Plugin: 22 Versions of Hard L
 description: "From a single HTML file to a shipped WordPress plugin: the fal.ai async queue, a watermark that must never silently fail, optional lead capture, and five bugs that only appeared in production."
 pubDate: 2026-09-18
 category: case-studies
+blueprint: sme-digital-suite
+blueprintLayer: L1-high-conversion-web
 tags: [wordpress, php, fal-ai, docker, ai-image, javascript]
 ogImage: /og/shipping-an-ai-photo-editor-as-a-wordpress-plugin.jpg
 banner: /banners/shipping-an-ai-photo-editor-as-a-wordpress-plugin.jpg
diff --git a/src/content/posts/slashing-agent-context-with-a-code-graph.md b/src/content/posts/slashing-agent-context-with-a-code-graph.md
index 65c8f51..d663b37 100644
--- a/src/content/posts/slashing-agent-context-with-a-code-graph.md
+++ b/src/content/posts/slashing-agent-context-with-a-code-graph.md
@@ -4,6 +4,8 @@ description: "Why dumping source files into LLM prompts leads to token bankruptc
 pubDate: 2026-04-28
 updatedDate: 2026-10-25
 category: ai
+blueprint: ai-agent-automation
+blueprintLayer: L2-llm-gateway-agents
 tags: ["ai", "agents", "ast", "performance", "architecture"]
 ogImage: "/og/slashing-agent-context-with-a-code-graph.jpg"
 banner: "/banners/slashing-agent-context-with-a-code-graph.jpg"
diff --git a/src/content/posts/stop-writing-agent-prompts-for-deterministic-work.md b/src/content/posts/stop-writing-agent-prompts-for-deterministic-work.md
index 56777f0..80bbc0d 100644
--- a/src/content/posts/stop-writing-agent-prompts-for-deterministic-work.md
+++ b/src/content/posts/stop-writing-agent-prompts-for-deterministic-work.md
@@ -3,6 +3,8 @@ title: "Stop Writing Agent Prompts for Deterministic Work"
 description: "One of my scheduled jobs failed 29 times in a row because I put a model in a loop that only needed a string comparison. Here is the rule I use now."
 pubDate: 2026-10-01
 category: notes
+blueprint: ai-agent-automation
+blueprintLayer: L1-deterministic-orchestration
 tags: ["loop-engineering", "cron", "ai-agents", "automation"]
 ogImage: "/og/stop-writing-agent-prompts-for-deterministic-work.jpg"
 banner: "/banners/stop-writing-agent-prompts-for-deterministic-work.jpg"
diff --git a/src/content/posts/syncing-a-self-improving-ai-agent-across-machines.md b/src/content/posts/syncing-a-self-improving-ai-agent-across-machines.md
index a2c504a..297cf79 100644
--- a/src/content/posts/syncing-a-self-improving-ai-agent-across-machines.md
+++ b/src/content/posts/syncing-a-self-improving-ai-agent-across-machines.md
@@ -4,6 +4,8 @@ description: "How I sync my Hermes agent's skills, config, and cron jobs between
 pubDate: 2026-02-18
 updatedDate: 2026-09-11
 category: case-studies
+blueprint: ai-agent-automation
+blueprintLayer: L2-llm-gateway-agents
 tags: [hermes, git, gitea, ai-agents, devops, sync]
 ogImage: /og/syncing-a-self-improving-ai-agent-across-machines.jpg
 banner: /banners/syncing-a-self-improving-ai-agent-across-machines.jpg
diff --git a/src/content/posts/synology-spreadsheet-api-is-a-container.md b/src/content/posts/synology-spreadsheet-api-is-a-container.md
index 7ed006f..ef1ca90 100644
--- a/src/content/posts/synology-spreadsheet-api-is-a-container.md
+++ b/src/content/posts/synology-spreadsheet-api-is-a-container.md
@@ -4,6 +4,8 @@ description: "How to automate Synology Office spreadsheets: the official spreads
 pubDate: 2025-08-20
 updatedDate: 2026-09-26
 category: devops
+blueprint: sme-digital-suite
+blueprintLayer: L3-entitlement-backoffice
 tags: [synology, dsm, docker, portainer, rest-api, spreadsheet, debugging, self-hosting]
 ogImage: /og/synology-spreadsheet-api-is-a-container.jpg
 banner: /banners/synology-spreadsheet-api-is-a-container.jpg
diff --git a/src/content/posts/that-dying-ssd-was-just-a-bad-sata-cable.md b/src/content/posts/that-dying-ssd-was-just-a-bad-sata-cable.md
index 099f155..c3bfb3d 100644
--- a/src/content/posts/that-dying-ssd-was-just-a-bad-sata-cable.md
+++ b/src/content/posts/that-dying-ssd-was-just-a-bad-sata-cable.md
@@ -3,6 +3,8 @@ title: "I Was About to RMA This SSD — the Fault Was a SATA Cable"
 description: "A Seagate IronWolf 110 SSD threw WRITE FPDMA timeouts, failed mkfs with 'superblock magic doesn't match', and went silent — a textbook dying drive. I swapped one SATA cable and it formatted clean with zero errors. How to test before condemning a drive."
 pubDate: 2026-09-16
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L1-compute-storage-network
 tags: [unraid, sata, ssd, storage, troubleshooting, smart, fio, cable]
 draft: false
 ogImage: /og/that-dying-ssd-was-just-a-bad-sata-cable.jpg
diff --git a/src/content/posts/the-nocodb-attachment-that-wouldnt-update.md b/src/content/posts/the-nocodb-attachment-that-wouldnt-update.md
index 7e9fa3e..f892732 100644
--- a/src/content/posts/the-nocodb-attachment-that-wouldnt-update.md
+++ b/src/content/posts/the-nocodb-attachment-that-wouldnt-update.md
@@ -4,6 +4,8 @@ description: "Two small gotchas from backfilling 300 rows: NocoDB ignores a path
 pubDate: 2026-02-04
 updatedDate: 2026-09-10
 category: notes
+blueprint: sme-digital-suite
+blueprintLayer: L3-entitlement-backoffice
 tags: [nocodb, backfill, python, regex, data-pipeline]
 ogImage: /og/the-nocodb-attachment-that-wouldnt-update.jpg
 banner: /banners/the-nocodb-attachment-that-wouldnt-update.jpg
diff --git a/src/content/posts/the-single-writer-rule-for-coding-agents.md b/src/content/posts/the-single-writer-rule-for-coding-agents.md
index a659107..73a7171 100644
--- a/src/content/posts/the-single-writer-rule-for-coding-agents.md
+++ b/src/content/posts/the-single-writer-rule-for-coding-agents.md
@@ -4,6 +4,8 @@ description: "Why letting multiple AI agents write code causes race conditions a
 pubDate: 2026-08-26
 updatedDate: 2026-10-25
 category: case-studies
+blueprint: ai-agent-automation
+blueprintLayer: L2-llm-gateway-agents
 tags: ["ai", "agents", "architecture", "devops"]
 ogImage: "/og/the-single-writer-rule-for-coding-agents.jpg"
 banner: "/banners/the-single-writer-rule-for-coding-agents.jpg"
diff --git a/src/content/posts/unraid-stop-array-hangs-on-swapfile.md b/src/content/posts/unraid-stop-array-hangs-on-swapfile.md
index 8cf08fd..b17ebba 100644
--- a/src/content/posts/unraid-stop-array-hangs-on-swapfile.md
+++ b/src/content/posts/unraid-stop-array-hangs-on-swapfile.md
@@ -3,6 +3,8 @@ title: "Why Unraid Hangs When You Stop the Array With a Swapfile — and the Fix
 description: "My Unraid array stop hung forever at unmounting disks because an 8 GB btrfs swapfile pinned /mnt/cache. Root cause, the /boot/config/stop trap, and two User Scripts that fix it."
 pubDate: 2026-09-15
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L1-compute-storage-network
 tags: [unraid, swap, btrfs, zram, docker, user-scripts]
 ogImage: /og/unraid-stop-array-hangs-on-swapfile.jpg
 banner: /banners/unraid-stop-array-hangs-on-swapfile.jpg
diff --git a/src/content/posts/verifying-a-pdf-report-page-by-page.md b/src/content/posts/verifying-a-pdf-report-page-by-page.md
index d678aca..7faec65 100644
--- a/src/content/posts/verifying-a-pdf-report-page-by-page.md
+++ b/src/content/posts/verifying-a-pdf-report-page-by-page.md
@@ -4,6 +4,8 @@ description: "Verify a PDF report page by page: print the same HTML from your br
 pubDate: 2026-09-28
 updatedDate: 2026-09-29
 category: engineering
+blueprint: sme-digital-suite
+blueprintLayer: L4-managed-ops-handover
 tags: [php, codeigniter, pdf, css, print, testing]
 ogImage: /og/verifying-a-pdf-report-page-by-page.jpg
 banner: /banners/verifying-a-pdf-report-page-by-page.jpg
diff --git a/src/content/posts/vetting-an-open-source-dependency-before-you-bet-on-it.md b/src/content/posts/vetting-an-open-source-dependency-before-you-bet-on-it.md
index f2a1b86..e4d38f3 100644
--- a/src/content/posts/vetting-an-open-source-dependency-before-you-bet-on-it.md
+++ b/src/content/posts/vetting-an-open-source-dependency-before-you-bet-on-it.md
@@ -3,6 +3,8 @@ title: "How I Vet an Open-Source Dependency Before Betting On It"
 description: "Six checks that catch a repo which doesn't do what its docs claim — grep for the feature, read the doc's target branch, check the tier gate and the payment rail."
 pubDate: 2026-09-29
 category: devops
+blueprint: sme-digital-suite
+blueprintLayer: L4-managed-ops-handover
 tags: ["open-source", "due-diligence", "oidc", "self-hosting", "docker"]
 ogImage: "/og/vetting-an-open-source-dependency-before-you-bet-on-it.jpg"
 banner: "/banners/vetting-an-open-source-dependency-before-you-bet-on-it.jpg"
diff --git a/src/content/posts/when-smart-says-healthy-but-your-raid-is-corrupting-data.md b/src/content/posts/when-smart-says-healthy-but-your-raid-is-corrupting-data.md
index 85fe544..c385763 100644
--- a/src/content/posts/when-smart-says-healthy-but-your-raid-is-corrupting-data.md
+++ b/src/content/posts/when-smart-says-healthy-but-your-raid-is-corrupting-data.md
@@ -3,6 +3,8 @@ title: "When SMART Says Healthy and Your RAID Is Silently Corrupting Data"
 description: "A btrfs RAID1 pool on two healthy-looking NVMe drives quietly corrupted a Windows VM. How I caught it with a checksum forensic — and why the root cause (M.2 riser link fault vs batch defect) is still uncertain, with both drives now testing clean."
 pubDate: 2026-09-16
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L1-compute-storage-network
 tags: [unraid, btrfs, nvme, raid, storage, data-loss, troubleshooting]
 ogImage: /og/when-smart-says-healthy-but-your-raid-is-corrupting-data.jpg
 banner: /banners/when-smart-says-healthy-but-your-raid-is-corrupting-data.jpg
diff --git a/src/content/posts/why-500000-lines-of-commit-churn-only-left-230000-in-production.md b/src/content/posts/why-500000-lines-of-commit-churn-only-left-230000-in-production.md
index e5b9797..98961b9 100644
--- a/src/content/posts/why-500000-lines-of-commit-churn-only-left-230000-in-production.md
+++ b/src/content/posts/why-500000-lines-of-commit-churn-only-left-230000-in-production.md
@@ -3,6 +3,8 @@ title: "I Committed 518,000 Lines in 30 Days. Production Kept 235,000."
 description: "Over 30 days, autonomous coding agents added 518,000 lines across 5 repos, yet production kept 235,000. Here is why verification gates matter more than generation."
 pubDate: "2026-10-18"
 category: "engineering"
+blueprint: ai-agent-automation
+blueprintLayer: L2-llm-gateway-agents
 tags: ["ai", "git", "devops", "testing", "refactoring"]
 ogImage: "/og/why-500000-lines-of-commit-churn-only-left-230000-in-production.jpg"
 banner: "/banners/why-500000-lines-of-commit-churn-only-left-230000-in-production.jpg"
diff --git a/src/content/posts/why-i-still-bought-a-local-gpu.md b/src/content/posts/why-i-still-bought-a-local-gpu.md
index d8fe461..a0450b3 100644
--- a/src/content/posts/why-i-still-bought-a-local-gpu.md
+++ b/src/content/posts/why-i-still-bought-a-local-gpu.md
@@ -3,6 +3,8 @@ title: "Why I Still Bought a GPU to Run AI When Claude and GPT Are Obviously Str
 description: "Claude Opus and GPT are stronger than anything I can run locally. Here is the cost, control, and uptime argument for owning a GPU anyway — with real numbers."
 pubDate: 2026-09-21
 category: ai
+blueprint: ai-agent-automation
+blueprintLayer: L3-local-gpu-inference
 tags: [local-llm, gpu, llama-cpp, lm-studio, agents, self-hosting, cost]
 ogImage: /og/why-i-still-bought-a-local-gpu.jpg
 banner: /banners/why-i-still-bought-a-local-gpu.jpg
diff --git a/src/content/posts/why-is-my-tts-model-repeating-percent.md b/src/content/posts/why-is-my-tts-model-repeating-percent.md
index 40f73dd..eeb49c2 100644
--- a/src/content/posts/why-is-my-tts-model-repeating-percent.md
+++ b/src/content/posts/why-is-my-tts-model-repeating-percent.md
@@ -3,6 +3,8 @@ title: "Why Is My TTS Model Repeating \"Percent\"? The URL-Encoding Trap in Spee
 description: "Why our newly deployed local TTS engine synthesized endless 'percent' repetitions instead of spoken Chinese, and how character normalization and n8n sandbox limits collided."
 pubDate: 2026-10-22
 category: notes
+blueprint: ai-agent-automation
+blueprintLayer: L1-deterministic-orchestration
 tags: ["tts", "debugging", "n8n", "urlencode", "python", "ai"]
 ogImage: "/og/why-is-my-tts-model-repeating-percent.jpg"
 banner: "/banners/why-is-my-tts-model-repeating-percent.jpg"
diff --git a/src/content/posts/why-multi-agent-coding-fails.md b/src/content/posts/why-multi-agent-coding-fails.md
index d8eacaf..2c70db5 100644
--- a/src/content/posts/why-multi-agent-coding-fails.md
+++ b/src/content/posts/why-multi-agent-coding-fails.md
@@ -4,6 +4,8 @@ description: "Why swarms of autonomous coding agents step on each other, play th
 pubDate: 2025-07-29
 updatedDate: 2026-10-25
 category: notes
+blueprint: ai-agent-automation
+blueprintLayer: L2-llm-gateway-agents
 tags: ["ai", "agents", "architecture", "debugging"]
 ogImage: "/og/why-multi-agent-coding-fails.jpg"
 banner: "/banners/why-multi-agent-coding-fails.jpg"
diff --git a/src/content/posts/why-telegram-bot-notifications-die.md b/src/content/posts/why-telegram-bot-notifications-die.md
index ae981ae..4421e08 100644
--- a/src/content/posts/why-telegram-bot-notifications-die.md
+++ b/src/content/posts/why-telegram-bot-notifications-die.md
@@ -4,6 +4,8 @@ description: "A debugging story: a Dockerized telegram monitor whose sendPhoto c
 pubDate: 2026-03-25
 updatedDate: 2026-09-09
 category: devops
+blueprint: ai-agent-automation
+blueprintLayer: L1-deterministic-orchestration
 tags: [docker, telegram, python, dns, ipv6, debugging, portainer]
 ogImage: /og/why-telegram-bot-notifications-die.jpg
 banner: /banners/why-telegram-bot-notifications-die.jpg
diff --git a/src/content/posts/why-your-grafana-dashboard-shows-no-data.md b/src/content/posts/why-your-grafana-dashboard-shows-no-data.md
index 52707be..bc0f3c5 100644
--- a/src/content/posts/why-your-grafana-dashboard-shows-no-data.md
+++ b/src/content/posts/why-your-grafana-dashboard-shows-no-data.md
@@ -4,6 +4,8 @@ description: "Every target up, data in Prometheus, panel expressions correct —
 pubDate: 2026-05-17
 updatedDate: 2026-09-29
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L3-observability-self-healing
 tags: [grafana, prometheus, dashboards, monitoring, promql, observability]
 ogImage: /og/why-your-grafana-dashboard-shows-no-data.jpg
 banner: /banners/why-your-grafana-dashboard-shows-no-data.jpg
diff --git a/src/content/posts/your-disk-full-alert-is-lying.md b/src/content/posts/your-disk-full-alert-is-lying.md
index 7493e26..76dd4d0 100644
--- a/src/content/posts/your-disk-full-alert-is-lying.md
+++ b/src/content/posts/your-disk-full-alert-is-lying.md
@@ -4,6 +4,8 @@ description: "3% free sounds like an emergency until you notice it is 500 GB. On
 pubDate: 2026-06-24
 updatedDate: 2026-09-29
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L3-observability-self-healing
 tags: [monitoring, alerting, prometheus, grafana, storage, capacity, observability]
 ogImage: /og/your-disk-full-alert-is-lying.jpg
 banner: /banners/your-disk-full-alert-is-lying.jpg
diff --git a/src/content/posts/yue2-on-a-12gb-gpu-songs-that-lost-their-endings.md b/src/content/posts/yue2-on-a-12gb-gpu-songs-that-lost-their-endings.md
index d27ad63..2fa790f 100644
--- a/src/content/posts/yue2-on-a-12gb-gpu-songs-that-lost-their-endings.md
+++ b/src/content/posts/yue2-on-a-12gb-gpu-songs-that-lost-their-endings.md
@@ -3,6 +3,8 @@ title: "Why My AI Songs Kept Losing Their Endings: Running YuE2 on a 12 GB GPU"
 description: "Twelve Mandarin songs came out exactly 240.000 seconds long with the outros missing. The cause wasn't the lyrics — it was a hard cap, a VRAM ceiling, and a planner that ignores BPM."
 pubDate: 2026-10-20
 category: ai
+blueprint: ai-agent-automation
+blueprintLayer: L4-aigc-media-pipelines
 stream: creative-lab
 tags: ["yue2", "comfyui", "ai-music", "local-ai", "gpu", "vram", "mandarin"]
 ogImage: "/og/yue2-on-a-12gb-gpu-songs-that-lost-their-endings.jpg"
diff --git a/src/content/posts/zh/adding-a-domain-to-someone-elses-mail-server.md b/src/content/posts/zh/adding-a-domain-to-someone-elses-mail-server.md
index 8d6a55f..5374dde 100644
--- a/src/content/posts/zh/adding-a-domain-to-someone-elses-mail-server.md
+++ b/src/content/posts/zh/adding-a-domain-to-someone-elses-mail-server.md
@@ -4,6 +4,8 @@ description: "收信只要四条 DNS 记录，一次就通了；而从它发信
 pubDate: 2025-05-06
 updatedDate: 2026-10-16
 category: notes
+blueprint: sme-digital-suite
+blueprintLayer: L2-sifumail-communication
 tags: ["email", "dns", "mailcow", "smtp", "deliverability"]
 ogImage: /og/zh-adding-a-domain-to-someone-elses-mail-server.jpg
 banner: /banners/adding-a-domain-to-someone-elses-mail-server.jpg
diff --git a/src/content/posts/zh/adding-english-mode-to-a-chinese-only-web-app.md b/src/content/posts/zh/adding-english-mode-to-a-chinese-only-web-app.md
index a245cd5..cfacbf2 100644
--- a/src/content/posts/zh/adding-english-mode-to-a-chinese-only-web-app.md
+++ b/src/content/posts/zh/adding-english-mode-to-a-chinese-only-web-app.md
@@ -4,6 +4,8 @@ description: "浏览器不提供触发翻译的 JavaScript API,而我的应用
 pubDate: 2025-06-11
 updatedDate: 2026-09-29
 category: engineering
+blueprint: sme-digital-suite
+blueprintLayer: L1-high-conversion-web
 tags: ["i18n", "nginx", "vue", "javascript", "self-hosting"]
 ogImage: "/og/zh-adding-english-mode-to-a-chinese-only-web-app.jpg"
 banner: "/banners/adding-english-mode-to-a-chinese-only-web-app.jpg"
diff --git a/src/content/posts/zh/authentik-forward-auth-gate-wasnt-live.md b/src/content/posts/zh/authentik-forward-auth-gate-wasnt-live.md
index b7b2f49..4ffb006 100644
--- a/src/content/posts/zh/authentik-forward-auth-gate-wasnt-live.md
+++ b/src/content/posts/zh/authentik-forward-auth-gate-wasnt-live.md
@@ -4,6 +4,8 @@ description: "我的 authentik forward-auth 网关在宿主机上返回了干净
 pubDate: 2026-08-12
 updatedDate: 2026-09-29
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L2-edge-proxy-runtime
 tags: ["authentik", "forward-auth", "cloudflare", "nginx", "docker", "self-hosting"]
 ogImage: /og/zh-authentik-forward-auth-gate-wasnt-live.jpg
 banner: /banners/authentik-forward-auth-gate-wasnt-live.jpg
diff --git a/src/content/posts/zh/authentik-major-upgrade-gotchas.md b/src/content/posts/zh/authentik-major-upgrade-gotchas.md
index 2122c88..5d2adc2 100644
--- a/src/content/posts/zh/authentik-major-upgrade-gotchas.md
+++ b/src/content/posts/zh/authentik-major-upgrade-gotchas.md
@@ -3,6 +3,8 @@ title: "Authentik 从 2025.8 升级到 2026.8：那些没人提醒你会坏掉
 description: "一年份的 authentik 大版本升级踩坑记录：存储挂载变更、RBAC 会话清理、可信代理，以及 authorization_flow 与 authentication_flow 搞混导致 SSO 彻底瘫痪。"
 pubDate: 2026-09-09
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L2-edge-proxy-runtime
 tags: [authentik, sso, docker, portainer, self-hosting, oidc, upgrade]
 ogImage: /og/zh-authentik-major-upgrade-gotchas.jpg
 banner: /banners/authentik-major-upgrade-gotchas.jpg
diff --git a/src/content/posts/zh/docker-reported-exit-0-the-oom-killer-disagreed.md b/src/content/posts/zh/docker-reported-exit-0-the-oom-killer-disagreed.md
index e9d8936..0bf1b61 100644
--- a/src/content/posts/zh/docker-reported-exit-0-the-oom-killer-disagreed.md
+++ b/src/content/posts/zh/docker-reported-exit-0-the-oom-killer-disagreed.md
@@ -3,6 +3,8 @@ title: "Docker 报告退出码 0，内核却早已执行 OOM-Kill"
 description: "NAS 上的一个容器反复异常退出，Docker 却上报 exit 0 与 OOMKilled=false。真实的证据在 dmesg 里：六次 cgroup OOM-kill。"
 pubDate: 2026-10-16
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L2-edge-proxy-runtime
 tags: ["docker", "oom", "traefik", "synology", "crawlers"]
 ogImage: /og/zh-docker-reported-exit-0-the-oom-killer-disagreed.jpg
 banner: /banners/docker-reported-exit-0-the-oom-killer-disagreed.jpg
diff --git a/src/content/posts/zh/from-audio-to-a-4-minute-ai-music-video.md b/src/content/posts/zh/from-audio-to-a-4-minute-ai-music-video.md
index 555a3d2..cb19bd3 100644
--- a/src/content/posts/zh/from-audio-to-a-4-minute-ai-music-video.md
+++ b/src/content/posts/zh/from-audio-to-a-4-minute-ai-music-video.md
@@ -3,6 +3,8 @@ title: "从一首歌到 4 分钟完整 MV：我如何用 Gemini、AI 生成与 F
 description: "基于《月牙湾》1080P 高清动漫 OP 制作实录：详解 AI 音乐重构、Gemini Argon 4 提示词分镜规划、文字生图与图生视频多次抽卡调优，以及 Filmora 剪辑与特效合成的真实生产实践。"
 pubDate: 2026-10-25
 category: case-studies
+blueprint: ai-agent-automation
+blueprintLayer: L4-aigc-media-pipelines
 stream: creative-lab
 tags: ["ai-video", "music-video", "gemini", "filmora", "face-swapping", "ai-music", "creative-workflows"]
 ogImage: "/og/zh-from-audio-to-a-4-minute-ai-music-video.jpg"
diff --git a/src/content/posts/zh/generating-full-length-songs-with-yue2-comfyui.md b/src/content/posts/zh/generating-full-length-songs-with-yue2-comfyui.md
index b5849a8..2a9aec1 100644
--- a/src/content/posts/zh/generating-full-length-songs-with-yue2-comfyui.md
+++ b/src/content/posts/zh/generating-full-length-songs-with-yue2-comfyui.md
@@ -3,6 +3,8 @@ title: "用 YuE2 BF16 生成完整长歌：突破时长限制与音频硬截断"
 description: "AI 音乐工具常在歌词中途戛然而止。本文详解如何利用 YuE2 BF16、295秒余量预留公式与本地 ComfyUI，成功批量跑出 60 首自然收尾的完整长歌全集。"
 pubDate: 2026-10-26
 category: tutorials
+blueprint: ai-agent-automation
+blueprintLayer: L4-aigc-media-pipelines
 stream: creative-lab
 tags: ["ai-music", "yue2", "comfyui", "audio-engineering", "subtitles", "python"]
 ogImage: "/og/zh-generating-full-length-songs-with-yue2-comfyui.jpg"
diff --git a/src/content/posts/zh/generating-subtitles-for-songs-without-timestamps.md b/src/content/posts/zh/generating-subtitles-for-songs-without-timestamps.md
index 54970eb..ff047c0 100644
--- a/src/content/posts/zh/generating-subtitles-for-songs-without-timestamps.md
+++ b/src/content/posts/zh/generating-subtitles-for-songs-without-timestamps.md
@@ -3,6 +3,8 @@ title: "给没有时间戳的歌曲自动生成字幕"
 description: "AI 音乐工具只给你音频 —— 没有逐行时间，没有卡拉 OK。这是我给 18 首歌生成 LRC 与 SRT 字幕的完整流程，为什么单纯转写不行，以及让歌词框滚到底的两个 bug。"
 pubDate: 2026-10-20
 category: tutorials
+blueprint: ai-agent-automation
+blueprintLayer: L3-local-gpu-inference
 stream: creative-lab
 tags: ["subtitles", "lrc", "srt", "whisper", "forced-alignment", "ai-music", "python"]
 ogImage: "/og/zh-generating-subtitles-for-songs-without-timestamps.jpg"
diff --git a/src/content/posts/zh/hardening-a-tor-onion-service.md b/src/content/posts/zh/hardening-a-tor-onion-service.md
index 73ccba9..1d2ba71 100644
--- a/src/content/posts/zh/hardening-a-tor-onion-service.md
+++ b/src/content/posts/zh/hardening-a-tor-onion-service.md
@@ -4,6 +4,8 @@ description: "出于对暗网的好奇,我把个人主页和 Git 服务器镜像
 pubDate: 2025-12-10
 updatedDate: 2026-09-09
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L4-secops-cicd-dr
 tags: [tor, docker, security, self-hosting, networking]
 ogImage: /og/zh-hardening-a-tor-onion-service.jpg
 banner: /banners/hardening-a-tor-onion-service.jpg
diff --git a/src/content/posts/zh/how-i-built-an-automated-music-video-pipeline.md b/src/content/posts/zh/how-i-built-an-automated-music-video-pipeline.md
index f004495..0ca3ccd 100644
--- a/src/content/posts/zh/how-i-built-an-automated-music-video-pipeline.md
+++ b/src/content/posts/zh/how-i-built-an-automated-music-video-pipeline.md
@@ -4,6 +4,8 @@ description: '基于 Remotion、Whisper、Docker 与 Chrome DevTools Protocol 
 pubDate: 2025-04-18
 updatedDate: 2026-10-22
 category: case-studies
+blueprint: ai-agent-automation
+blueprintLayer: L4-aigc-media-pipelines
 stream: creative-lab
 tags: ["remotion", "docker", "cdp", "youtube", "automation", "video-generation", "whisper"]
 ogImage: "/og/zh-how-i-built-an-automated-music-video-pipeline.jpg"
diff --git a/src/content/posts/zh/how-i-built-the-digikedai-telegram-bot.md b/src/content/posts/zh/how-i-built-the-digikedai-telegram-bot.md
index 7f24658..ca0fbfb 100644
--- a/src/content/posts/zh/how-i-built-the-digikedai-telegram-bot.md
+++ b/src/content/posts/zh/how-i-built-the-digikedai-telegram-bot.md
@@ -3,6 +3,8 @@ title: "我是如何构建 DigiKedai Telegram AI 客服机器人的"
 description: "一个跨 Telegram 与 WhatsApp 解答疑问并全自动开通免费试用账号的 AI 客服机器人——TypeScript、grammY、Cloudflare 隧道 webhook，以及自建 LiteLLM 网关。"
 pubDate: 2026-09-06
 category: case-studies
+blueprint: ai-agent-automation
+blueprintLayer: L1-deterministic-orchestration
 tags: [telegram, docker, cloudflare, litellm, typescript, ai]
 ogImage: /og/zh-how-i-built-the-digikedai-telegram-bot.jpg
 banner: /banners/how-i-built-the-digikedai-telegram-bot.jpg
diff --git a/src/content/posts/zh/how-i-host-this-blog.md b/src/content/posts/zh/how-i-host-this-blog.md
index 2a5db52..63cf577 100644
--- a/src/content/posts/zh/how-i-host-this-blog.md
+++ b/src/content/posts/zh/how-i-host-this-blog.md
@@ -3,6 +3,8 @@ title: "我是如何托管这个博客的：Astro、Gitea Actions 与自托管 C
 description: "这篇文章完整拆解了这个网站背后的构建与部署管线——以 Git 作为 CMS、跑在 unRaid 服务器上的自托管 runner，以及最前端的 Cloudflare。"
 pubDate: 2026-09-04
 category: case-studies
+blueprint: sme-digital-suite
+blueprintLayer: L1-high-conversion-web
 tags: [astro, gitea, ci-cd, self-hosting, docker, cloudflare]
 ogImage: /og/zh-how-i-host-this-blog.jpg
 banner: /banners/how-i-host-this-blog.jpg
diff --git a/src/content/posts/zh/how-i-vetted-20-vps-providers-with-parallel-subagents.md b/src/content/posts/zh/how-i-vetted-20-vps-providers-with-parallel-subagents.md
index f2ebd6a..c477f88 100644
--- a/src/content/posts/zh/how-i-vetted-20-vps-providers-with-parallel-subagents.md
+++ b/src/content/posts/zh/how-i-vetted-20-vps-providers-with-parallel-subagents.md
@@ -4,6 +4,8 @@ description: "一个关于编排并行 AI 子代理对 20 家主机服务商做
 pubDate: 2025-11-12
 updatedDate: 2026-09-09
 category: case-studies
+blueprint: sme-digital-suite
+blueprintLayer: L4-managed-ops-handover
 tags: [ai-orchestration, subagents, due-diligence, hosting, devops]
 ogImage: /og/zh-how-i-vetted-20-vps-providers-with-parallel-subagents.jpg
 banner: /banners/how-i-vetted-20-vps-providers-with-parallel-subagents.jpg
diff --git a/src/content/posts/zh/how-to-verify-a-hosting-provider-before-you-buy.md b/src/content/posts/zh/how-to-verify-a-hosting-provider-before-you-buy.md
index 4f92b63..2e0c866 100644
--- a/src/content/posts/zh/how-to-verify-a-hosting-provider-before-you-buy.md
+++ b/src/content/posts/zh/how-to-verify-a-hosting-provider-before-you-buy.md
@@ -4,6 +4,8 @@ description: "一份可复用的核查清单，帮你把真实的主机声明和
 pubDate: 2025-11-26
 updatedDate: 2026-09-09
 category: tutorials
+blueprint: sme-digital-suite
+blueprintLayer: L4-managed-ops-handover
 tags: [hosting, vps, due-diligence, whois, devops]
 ogImage: /og/zh-how-to-verify-a-hosting-provider-before-you-buy.jpg
 banner: /banners/how-to-verify-a-hosting-provider-before-you-buy.jpg
diff --git a/src/content/posts/zh/loop-engineering-without-a-coding-agent.md b/src/content/posts/zh/loop-engineering-without-a-coding-agent.md
index 8dcdcb7..4e9ed41 100644
--- a/src/content/posts/zh/loop-engineering-without-a-coding-agent.md
+++ b/src/content/posts/zh/loop-engineering-without-a-coding-agent.md
@@ -3,6 +3,8 @@ title: "没有 Coding Agent 的 Loop Engineering：撑起我这套基础设施
 description: "Loop engineering 是 2026 年对「设计让 agent 自己反复跑的系统」的叫法。我把它用在自己的自托管基础设施上而不是代码库上：11 个 cron，其中 8 个完全没有 AI。"
 pubDate: 2026-10-01
 category: case-studies
+blueprint: self-hosted-infrastructure
+blueprintLayer: L3-observability-self-healing
 tags: ["loop-engineering", "ai-agents", "cron", "self-hosting", "automation", "monitoring"]
 ogImage: "/og/zh-loop-engineering-without-a-coding-agent.jpg"
 banner: "/banners/loop-engineering-without-a-coding-agent.jpg"
diff --git a/src/content/posts/zh/migrating-codeigniter-iis-to-openlitespeed.md b/src/content/posts/zh/migrating-codeigniter-iis-to-openlitespeed.md
index bd6a391..5a27e5d 100644
--- a/src/content/posts/zh/migrating-codeigniter-iis-to-openlitespeed.md
+++ b/src/content/posts/zh/migrating-codeigniter-iis-to-openlitespeed.md
@@ -3,6 +3,8 @@ title: "把 CodeIgniter 4 应用从 IIS 迁移到 OpenLiteSpeed"
 description: "我把一个 17,000 行的 CodeIgniter 4 应用从 Windows IIS 搬到了 CyberPanel 上的 OpenLiteSpeed。迁移后冒出两个致命错误——而 IIS 一直靠 SSO 把它们藏着。"
 pubDate: 2026-09-27
 category: engineering
+blueprint: sme-digital-suite
+blueprintLayer: L1-high-conversion-web
 tags: [codeigniter, php, openspeedway, cyberpanel, iis, migration, litespeed, linux]
 ogImage: /og/zh-migrating-codeigniter-iis-to-openlitespeed.jpg
 banner: /banners/migrating-codeigniter-iis-to-openlitespeed.jpg
diff --git a/src/content/posts/zh/my-backup-was-using-someone-elses-api-quota.md b/src/content/posts/zh/my-backup-was-using-someone-elses-api-quota.md
index 1a659a9..16aff8c 100644
--- a/src/content/posts/zh/my-backup-was-using-someone-elses-api-quota.md
+++ b/src/content/posts/zh/my-backup-was-using-someone-elses-api-quota.md
@@ -4,6 +4,8 @@ description: "1 TB 的 restic 种子传输卡在零字节。日志里点名的
 pubDate: 2026-10-15
 updatedDate: 2026-10-16
 category: notes
+blueprint: self-hosted-infrastructure
+blueprintLayer: L4-secops-cicd-dr
 tags: ["rclone", "backup", "google-drive", "oauth", "restic"]
 ogImage: /og/zh-my-backup-was-using-someone-elses-api-quota.jpg
 banner: /banners/my-backup-was-using-someone-elses-api-quota.jpg
diff --git a/src/content/posts/zh/one-prometheus-for-unraid-synology-and-a-vps.md b/src/content/posts/zh/one-prometheus-for-unraid-synology-and-a-vps.md
index dccf769..ed5aa9b 100644
--- a/src/content/posts/zh/one-prometheus-for-unraid-synology-and-a-vps.md
+++ b/src/content/posts/zh/one-prometheus-for-unraid-synology-and-a-vps.md
@@ -4,6 +4,8 @@ description: "三台主机、一个 Prometheus、一个 Grafana：覆盖矩阵
 pubDate: 2026-07-29
 updatedDate: 2026-09-29
 category: case-studies
+blueprint: self-hosted-infrastructure
+blueprintLayer: L3-observability-self-healing
 tags: [prometheus, grafana, unraid, synology, dsm, cadvisor, monitoring, self-hosting]
 ogImage: /og/zh-one-prometheus-for-unraid-synology-and-a-vps.jpg
 banner: /banners/one-prometheus-for-unraid-synology-and-a-vps.jpg
diff --git a/src/content/posts/zh/php2shell-patching-every-php-runtime-i-manage.md b/src/content/posts/zh/php2shell-patching-every-php-runtime-i-manage.md
index fb3a7c4..75b4d63 100644
--- a/src/content/posts/zh/php2shell-patching-every-php-runtime-i-manage.md
+++ b/src/content/posts/zh/php2shell-patching-every-php-runtime-i-manage.md
@@ -3,6 +3,8 @@ title: "PHP2Shell：我管的每台机器，PHP 运行时全都中了"
 description: "CVE-2026-109618 与 CVE-2026-109619 是 PHP 语言本身的未授权远程代码执行，披露前就已被利用。这篇记录我在自己管理的系统上实测到的版本、先修哪里，以及真正把它关掉的那几条命令。"
 pubDate: 2026-10-23
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L4-secops-cicd-dr
 tags: ["php", "security", "cve", "cyberpanel", "litespeed", "wordpress", "patching", "self-hosting"]
 ogImage: /og/zh-php2shell-patching-every-php-runtime-i-manage.jpg
 banner: /banners/php2shell-patching-every-php-runtime-i-manage.jpg
diff --git a/src/content/posts/zh/putting-a-front-door-on-an-app-you-cant-modify.md b/src/content/posts/zh/putting-a-front-door-on-an-app-you-cant-modify.md
index 2c8d4a8..2af4968 100644
--- a/src/content/posts/zh/putting-a-front-door-on-an-app-you-cant-modify.md
+++ b/src/content/posts/zh/putting-a-front-door-on-an-app-you-cant-modify.md
@@ -4,6 +4,8 @@ description: "我自托管阅读服务的门面，是一个中文登录框；而
 pubDate: 2025-06-24
 updatedDate: 2026-10-06
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L2-edge-proxy-runtime
 tags: ["nginx", "docker", "self-hosting", "seo", "branding"]
 ogImage: "/og/zh-putting-a-front-door-on-an-app-you-cant-modify.jpg"
 banner: "/banners/putting-a-front-door-on-an-app-you-cant-modify.jpg"
diff --git a/src/content/posts/zh/read-only-nocodb-dashboard-for-a-remote-database.md b/src/content/posts/zh/read-only-nocodb-dashboard-for-a-remote-database.md
index 039183f..3ced209 100644
--- a/src/content/posts/zh/read-only-nocodb-dashboard-for-a-remote-database.md
+++ b/src/content/posts/zh/read-only-nocodb-dashboard-for-a-remote-database.md
@@ -3,6 +3,8 @@ title: "给另一台机器上的数据库配一个 NocoDB 只读看板"
 description: "把 NocoDB 直接指向另一台机器上的 MySQL/MariaDB，一行数据都不用复制 —— 以及我踩到的 Docker SNAT 源 IP 陷阱和两个 API 陷阱。"
 pubDate: 2026-09-29
 category: devops
+blueprint: sme-digital-suite
+blueprintLayer: L3-entitlement-backoffice
 tags: ["nocodb", "mysql", "mariadb", "docker", "networking", "dashboard"]
 ogImage: /og/zh-read-only-nocodb-dashboard-for-a-remote-database.jpg
 banner: /banners/read-only-nocodb-dashboard-for-a-remote-database.jpg
diff --git a/src/content/posts/zh/replacing-rdpguard-with-ipban.md b/src/content/posts/zh/replacing-rdpguard-with-ipban.md
index 916eeb9..41bd932 100644
--- a/src/content/posts/zh/replacing-rdpguard-with-ipban.md
+++ b/src/content/posts/zh/replacing-rdpguard-with-ipban.md
@@ -3,6 +3,8 @@ title: "用 IPBan 替换 RDPGuard：没人写出来的三个坑"
 description: "我把付费的 RDPGuard 7.8.7 换成了开源的 IPBan 4.1.0，踩到三个没有文档的坑——其中一个卸载程序会悄悄放走 12 个正在攻击的 IP。"
 pubDate: 2026-09-19
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L4-secops-cicd-dr
 tags: [windows, security, rdp, ipban, rdpguard, brute-force, firewall, self-hosting]
 ogImage: /og/zh-replacing-rdpguard-with-ipban.jpg
 banner: /banners/replacing-rdpguard-with-ipban.jpg
diff --git a/src/content/posts/zh/running-ai-video-locally-on-a-12gb-gpu.md b/src/content/posts/zh/running-ai-video-locally-on-a-12gb-gpu.md
index 9cf8939..155198a 100644
--- a/src/content/posts/zh/running-ai-video-locally-on-a-12gb-gpu.md
+++ b/src/content/posts/zh/running-ai-video-locally-on-a-12gb-gpu.md
@@ -3,6 +3,8 @@ title: "12GB 显卡跑本地 AI 视频：Wan 2.2 加 SeedVR2 的真实数据"
 description: "在 RTX 3060 上实测：Wan 2.2 TI2V-5B 生成、SeedVR2 放大、1080p 分辨率陷阱，以及那条让连续五次失败全部通过的命令。"
 pubDate: 2026-10-20
 category: ai
+blueprint: ai-agent-automation
+blueprintLayer: L4-aigc-media-pipelines
 stream: creative-lab
 tags: [ai-video, wan, comfyui, seedvr2, local-llm, gpu, cost]
 ogImage: /og/zh-running-ai-video-locally-on-a-12gb-gpu.jpg
diff --git a/src/content/posts/zh/running-production-infrastructure-solo.md b/src/content/posts/zh/running-production-infrastructure-solo.md
index 5d0eee5..f92460b 100644
--- a/src/content/posts/zh/running-production-infrastructure-solo.md
+++ b/src/content/posts/zh/running-production-infrastructure-solo.md
@@ -3,6 +3,8 @@ title: "一个人跑生产基础设施：三台主机、162 个容器"
 description: "一个人、三台主机、78 个 compose stack 里的 162 个容器——Traefik、SSO、监控、邮件、CI/CD 与备份，以及两次改变了我「怎么核对数字」的故障。"
 pubDate: 2026-10-06
 category: case-studies
+blueprint: self-hosted-infrastructure
+blueprintLayer: L1-compute-storage-network
 tags: [docker, traefik, monitoring, infrastructure, devops]
 ogImage: /og/zh-running-production-infrastructure-solo.jpg
 banner: /banners/running-production-infrastructure-solo.jpg
diff --git a/src/content/posts/zh/running-tts-as-a-service-with-token-sidecars.md b/src/content/posts/zh/running-tts-as-a-service-with-token-sidecars.md
index d235215..4bce008 100644
--- a/src/content/posts/zh/running-tts-as-a-service-with-token-sidecars.md
+++ b/src/content/posts/zh/running-tts-as-a-service-with-token-sidecars.md
@@ -3,6 +3,8 @@ title: "我用两个 Cron 容器跑了一年的语音合成服务"
 description: "一个阅读应用需要 TTS，而云服务免费版的 token 十分钟、一小时就过期。这是那套让 Azure 和 Google 语音稳定运行一年的边车模式——任何工作流里都没有存放密钥。"
 pubDate: 2026-09-18
 category: ai
+blueprint: ai-agent-automation
+blueprintLayer: L3-local-gpu-inference
 tags: [n8n, tts, azure, google-cloud, docker, automation, sidecar]
 ogImage: /og/zh-running-tts-as-a-service-with-token-sidecars.jpg
 banner: /banners/running-tts-as-a-service-with-token-sidecars.jpg
diff --git a/src/content/posts/zh/self-healing-digital-goods-entitlements.md b/src/content/posts/zh/self-healing-digital-goods-entitlements.md
index b304b91..1b7afe1 100644
--- a/src/content/posts/zh/self-healing-digital-goods-entitlements.md
+++ b/src/content/posts/zh/self-healing-digital-goods-entitlements.md
@@ -3,6 +3,8 @@ title: "数字商品的自愈式访问控制：NocoDB、n8n 与 AList"
 description: "我如何用五个工作流搭出一套权限系统，自动授予、到期失效并持续修复客户的文件访问——包括一个构建期代码共享技巧，以及一个设计上刻意不泄露任何信息的公开接口。"
 pubDate: 2026-09-18
 category: case-studies
+blueprint: sme-digital-suite
+blueprintLayer: L3-entitlement-backoffice
 tags: [n8n, nocodb, alist, access-control, docker, automation, digital-goods]
 ogImage: /og/zh-self-healing-digital-goods-entitlements.jpg
 banner: /banners/self-healing-digital-goods-entitlements.jpg
diff --git a/src/content/posts/zh/self-hosted-tts-cosyvoice2-n8n-gpu.md b/src/content/posts/zh/self-hosted-tts-cosyvoice2-n8n-gpu.md
index fc09ccb..fa3bdcd 100644
--- a/src/content/posts/zh/self-hosted-tts-cosyvoice2-n8n-gpu.md
+++ b/src/content/posts/zh/self-hosted-tts-cosyvoice2-n8n-gpu.md
@@ -3,6 +3,8 @@ title: "从云端转本地：在 12GB 显卡与群晖 N8N 上搭建中英混读
 description: "记录如何将内部自动化工作流从依赖公网 TTS API 迁移至本地 RTX 3060 12GB 显卡，基于 CosyVoice 2 与群晖 N8N 实现中英混读与多音色零样本克隆。"
 pubDate: 2026-10-22
 category: case-studies
+blueprint: ai-agent-automation
+blueprintLayer: L3-local-gpu-inference
 tags: ["tts", "ai", "n8n", "gpu", "cosyvoice", "self-hosting"]
 ogImage: "/og/zh-self-hosted-tts-cosyvoice2-n8n-gpu.jpg"
 banner: "/banners/self-hosted-tts-cosyvoice2-n8n-gpu.jpg"
diff --git a/src/content/posts/zh/shipping-an-ai-photo-editor-as-a-wordpress-plugin.md b/src/content/posts/zh/shipping-an-ai-photo-editor-as-a-wordpress-plugin.md
index 72ed414..d89fa90 100644
--- a/src/content/posts/zh/shipping-an-ai-photo-editor-as-a-wordpress-plugin.md
+++ b/src/content/posts/zh/shipping-an-ai-photo-editor-as-a-wordpress-plugin.md
@@ -3,6 +3,8 @@ title: "把 AI 修图工具做成 WordPress 插件：22 个版本换来的经验
 description: "从单个 HTML 文件到一个真正上线的 WordPress 插件：fal.ai 异步队列、绝不能静默失败的水印、可选的名单元件，以及五个只有在真实环境里才会出现的 bug。"
 pubDate: 2026-09-18
 category: case-studies
+blueprint: sme-digital-suite
+blueprintLayer: L1-high-conversion-web
 tags: [wordpress, php, fal-ai, docker, ai-image, javascript]
 ogImage: /og/zh-shipping-an-ai-photo-editor-as-a-wordpress-plugin.jpg
 banner: /banners/shipping-an-ai-photo-editor-as-a-wordpress-plugin.jpg
diff --git a/src/content/posts/zh/slashing-agent-context-with-a-code-graph.md b/src/content/posts/zh/slashing-agent-context-with-a-code-graph.md
index 72e210a..996ae44 100644
--- a/src/content/posts/zh/slashing-agent-context-with-a-code-graph.md
+++ b/src/content/posts/zh/slashing-agent-context-with-a-code-graph.md
@@ -4,6 +4,8 @@ description: "为什么盲目向 LLM 灌入源代码会导致 Token 账单爆炸
 pubDate: 2026-04-28
 updatedDate: 2026-10-25
 category: ai
+blueprint: ai-agent-automation
+blueprintLayer: L2-llm-gateway-agents
 tags: ["ai", "agents", "ast", "performance", "architecture"]
 ogImage: "/og/zh-slashing-agent-context-with-a-code-graph.jpg"
 banner: "/banners/slashing-agent-context-with-a-code-graph.jpg"
diff --git a/src/content/posts/zh/stop-writing-agent-prompts-for-deterministic-work.md b/src/content/posts/zh/stop-writing-agent-prompts-for-deterministic-work.md
index 326768c..db22ffb 100644
--- a/src/content/posts/zh/stop-writing-agent-prompts-for-deterministic-work.md
+++ b/src/content/posts/zh/stop-writing-agent-prompts-for-deterministic-work.md
@@ -3,6 +3,8 @@ title: "确定性的活，别再用 Agent Prompt 去跑"
 description: "我有一个定时任务连续失败 29 次，原因是我在一个只需要字符串比较的循环里塞了个模型。这是我现在用的规则。"
 pubDate: 2026-10-01
 category: notes
+blueprint: ai-agent-automation
+blueprintLayer: L1-deterministic-orchestration
 tags: ["loop-engineering", "cron", "ai-agents", "automation"]
 ogImage: "/og/zh-stop-writing-agent-prompts-for-deterministic-work.jpg"
 banner: "/banners/stop-writing-agent-prompts-for-deterministic-work.jpg"
diff --git a/src/content/posts/zh/syncing-a-self-improving-ai-agent-across-machines.md b/src/content/posts/zh/syncing-a-self-improving-ai-agent-across-machines.md
index 0996e9d..5653676 100644
--- a/src/content/posts/zh/syncing-a-self-improving-ai-agent-across-machines.md
+++ b/src/content/posts/zh/syncing-a-self-improving-ai-agent-across-machines.md
@@ -4,6 +4,8 @@ description: "如何用基于 git 的 profile distribution 在两台电脑之间
 pubDate: 2026-02-18
 updatedDate: 2026-09-11
 category: case-studies
+blueprint: ai-agent-automation
+blueprintLayer: L2-llm-gateway-agents
 tags: [hermes, git, gitea, ai-agents, devops, sync]
 ogImage: /og/zh-syncing-a-self-improving-ai-agent-across-machines.jpg
 banner: /banners/syncing-a-self-improving-ai-agent-across-machines.jpg
diff --git a/src/content/posts/zh/synology-spreadsheet-api-is-a-container.md b/src/content/posts/zh/synology-spreadsheet-api-is-a-container.md
index fa36616..0eec13e 100644
--- a/src/content/posts/zh/synology-spreadsheet-api-is-a-container.md
+++ b/src/content/posts/zh/synology-spreadsheet-api-is-a-container.md
@@ -4,6 +4,8 @@ description: "如何在 Synology Office 电子表格上做自动化：官方的
 pubDate: 2025-08-20
 updatedDate: 2026-09-26
 category: devops
+blueprint: sme-digital-suite
+blueprintLayer: L3-entitlement-backoffice
 tags: [synology, dsm, docker, portainer, rest-api, spreadsheet, debugging, self-hosting]
 ogImage: /og/zh-synology-spreadsheet-api-is-a-container.jpg
 banner: /banners/synology-spreadsheet-api-is-a-container.jpg
diff --git a/src/content/posts/zh/that-dying-ssd-was-just-a-bad-sata-cable.md b/src/content/posts/zh/that-dying-ssd-was-just-a-bad-sata-cable.md
index efc5720..85cc0c3 100644
--- a/src/content/posts/zh/that-dying-ssd-was-just-a-bad-sata-cable.md
+++ b/src/content/posts/zh/that-dying-ssd-was-just-a-bad-sata-cable.md
@@ -3,6 +3,8 @@ title: "我差点把这颗 SSD 送修——真正坏的是 SATA 数据线"
 description: "一颗 Seagate IronWolf 110 SSD 疯狂报 WRITE FPDMA 超时、mkfs 报 'superblock magic doesn't match'、然后读写静默——教科书般的坏盘。我只换了一根 SATA 线，它就干净格式化、零报错。动手判死刑前，先这样排查。"
 pubDate: 2026-09-16
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L1-compute-storage-network
 tags: [unraid, sata, ssd, storage, troubleshooting, smart, fio, cable]
 draft: false
 ogImage: /og/zh-that-dying-ssd-was-just-a-bad-sata-cable.jpg
diff --git a/src/content/posts/zh/the-nocodb-attachment-that-wouldnt-update.md b/src/content/posts/zh/the-nocodb-attachment-that-wouldnt-update.md
index aad0eb1..3216bca 100644
--- a/src/content/posts/zh/the-nocodb-attachment-that-wouldnt-update.md
+++ b/src/content/posts/zh/the-nocodb-attachment-that-wouldnt-update.md
@@ -4,6 +4,8 @@ description: "回填 300 行数据时踩到的两个小坑：NocoDB 在附件保
 pubDate: 2026-02-04
 updatedDate: 2026-09-10
 category: notes
+blueprint: sme-digital-suite
+blueprintLayer: L3-entitlement-backoffice
 tags: [nocodb, backfill, python, regex, data-pipeline]
 ogImage: /og/zh-the-nocodb-attachment-that-wouldnt-update.jpg
 banner: /banners/the-nocodb-attachment-that-wouldnt-update.jpg
diff --git a/src/content/posts/zh/the-single-writer-rule-for-coding-agents.md b/src/content/posts/zh/the-single-writer-rule-for-coding-agents.md
index 3abae2d..177df20 100644
--- a/src/content/posts/zh/the-single-writer-rule-for-coding-agents.md
+++ b/src/content/posts/zh/the-single-writer-rule-for-coding-agents.md
@@ -4,6 +4,8 @@ description: "为什么让多个 AI Agent 同时写代码必然导致分支冲
 pubDate: 2026-08-26
 updatedDate: 2026-10-25
 category: case-studies
+blueprint: ai-agent-automation
+blueprintLayer: L2-llm-gateway-agents
 tags: ["ai", "agents", "architecture", "devops"]
 ogImage: "/og/zh-the-single-writer-rule-for-coding-agents.jpg"
 banner: "/banners/the-single-writer-rule-for-coding-agents.jpg"
diff --git a/src/content/posts/zh/unraid-stop-array-hangs-on-swapfile.md b/src/content/posts/zh/unraid-stop-array-hangs-on-swapfile.md
index 0f6f822..66c76f6 100644
--- a/src/content/posts/zh/unraid-stop-array-hangs-on-swapfile.md
+++ b/src/content/posts/zh/unraid-stop-array-hangs-on-swapfile.md
@@ -3,6 +3,8 @@ title: "Unraid 停止阵列时卡死的真相：Swapfile 锁住挂载点 — 附
 description: "Unraid 停止阵列时一直卡在卸载磁盘：btrfs RAID1 上的 8GB swapfile 通过 loop 设备锁住 /mnt/cache。根因分析、/boot/config/stop 陷阱、两个 User Scripts 彻底修复。"
 pubDate: 2026-09-15
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L1-compute-storage-network
 tags: [unraid, swap, btrfs, zram, docker, user-scripts]
 ogImage: /og/zh-unraid-stop-array-hangs-on-swapfile.jpg
 banner: /banners/unraid-stop-array-hangs-on-swapfile.jpg
diff --git a/src/content/posts/zh/verifying-a-pdf-report-page-by-page.md b/src/content/posts/zh/verifying-a-pdf-report-page-by-page.md
index 2e6a25f..b870046 100644
--- a/src/content/posts/zh/verifying-a-pdf-report-page-by-page.md
+++ b/src/content/posts/zh/verifying-a-pdf-report-page-by-page.md
@@ -4,6 +4,8 @@ description: "如何逐页验证生成的 PDF 报告：用浏览器打印同一
 pubDate: 2026-09-28
 updatedDate: 2026-09-29
 category: engineering
+blueprint: sme-digital-suite
+blueprintLayer: L4-managed-ops-handover
 tags: [php, codeigniter, pdf, css, print, testing]
 ogImage: /og/zh-verifying-a-pdf-report-page-by-page.jpg
 banner: /banners/verifying-a-pdf-report-page-by-page.jpg
diff --git a/src/content/posts/zh/vetting-an-open-source-dependency-before-you-bet-on-it.md b/src/content/posts/zh/vetting-an-open-source-dependency-before-you-bet-on-it.md
index 198ebb8..1357a02 100644
--- a/src/content/posts/zh/vetting-an-open-source-dependency-before-you-bet-on-it.md
+++ b/src/content/posts/zh/vetting-an-open-source-dependency-before-you-bet-on-it.md
@@ -3,6 +3,8 @@ title: "如何在押注前验证一个开源依赖：我用的六项检查"
 description: "六项检查，专门抓出「文档说得漂亮、代码里其实没有」的仓库：用 grep 找功能、读文档头部标注的目标分支、看清付费档位门槛，以及收款通道在不在你的国家能用。"
 pubDate: 2026-09-29
 category: devops
+blueprint: sme-digital-suite
+blueprintLayer: L4-managed-ops-handover
 tags: ["open-source", "due-diligence", "oidc", "self-hosting", "docker"]
 ogImage: "/og/zh-vetting-an-open-source-dependency-before-you-bet-on-it.jpg"
 banner: "/banners/vetting-an-open-source-dependency-before-you-bet-on-it.jpg"
diff --git a/src/content/posts/zh/when-smart-says-healthy-but-your-raid-is-corrupting-data.md b/src/content/posts/zh/when-smart-says-healthy-but-your-raid-is-corrupting-data.md
index 483ed27..b49f600 100644
--- a/src/content/posts/zh/when-smart-says-healthy-but-your-raid-is-corrupting-data.md
+++ b/src/content/posts/zh/when-smart-says-healthy-but-your-raid-is-corrupting-data.md
@@ -3,6 +3,8 @@ title: "SMART 显示健康，RAID 却在悄悄损坏数据"
 description: "两块看起来完全健康的 NVMe 组成的 btrfs RAID1 阵列，静默地把 Windows 虚拟机喂成了全零字节。我靠校验和取证抓住它——但根因（M.2 转接卡链路故障 vs 批次缺陷）至今仍未定论，现在两块盘测试都干净。"
 pubDate: 2026-09-16
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L1-compute-storage-network
 tags: [unraid, btrfs, nvme, raid, storage, data-loss, troubleshooting]
 ogImage: /og/zh-when-smart-says-healthy-but-your-raid-is-corrupting-data.jpg
 banner: /banners/when-smart-says-healthy-but-your-raid-is-corrupting-data.jpg
diff --git a/src/content/posts/zh/why-500000-lines-of-commit-churn-only-left-230000-in-production.md b/src/content/posts/zh/why-500000-lines-of-commit-churn-only-left-230000-in-production.md
index a06e02b..9b38bd6 100644
--- a/src/content/posts/zh/why-500000-lines-of-commit-churn-only-left-230000-in-production.md
+++ b/src/content/posts/zh/why-500000-lines-of-commit-churn-only-left-230000-in-production.md
@@ -3,6 +3,8 @@ title: "30 天提交 51.8 万行，生产环境只留下 23.5 万行"
 description: "过去 30 天，自主编程 Agent 在 5 个仓库中累计新增了 51.8 万行代码，但最终留存仅 23.5 万行。为什么在 AI 时代，验证闸门与代码剪枝比生成速度重要十倍？"
 pubDate: "2026-10-18"
 category: "engineering"
+blueprint: ai-agent-automation
+blueprintLayer: L2-llm-gateway-agents
 tags: ["ai", "git", "devops", "testing", "refactoring"]
 ogImage: "/og/zh-why-500000-lines-of-commit-churn-only-left-230000-in-production.jpg"
 banner: "/banners/why-500000-lines-of-commit-churn-only-left-230000-in-production.jpg"
diff --git a/src/content/posts/zh/why-i-still-bought-a-local-gpu.md b/src/content/posts/zh/why-i-still-bought-a-local-gpu.md
index 80c7a20..ed4aab3 100644
--- a/src/content/posts/zh/why-i-still-bought-a-local-gpu.md
+++ b/src/content/posts/zh/why-i-still-bought-a-local-gpu.md
@@ -3,6 +3,8 @@ title: "Claude 和 GPT 明明更強，我為什麼還是買了 GPU 跑本地 AI"
 description: "Claude Opus 和 GPT 確實比我能在本地跑的任何模型都強。但我還是買了 GPU——這篇講成本、控制權與可用性，附實際的判斷標準。"
 pubDate: 2026-09-21
 category: ai
+blueprint: ai-agent-automation
+blueprintLayer: L3-local-gpu-inference
 tags: [local-llm, gpu, llama-cpp, lm-studio, agents, self-hosting, cost]
 ogImage: /og/zh-why-i-still-bought-a-local-gpu.jpg
 banner: /banners/why-i-still-bought-a-local-gpu.jpg
diff --git a/src/content/posts/zh/why-is-my-tts-model-repeating-percent.md b/src/content/posts/zh/why-is-my-tts-model-repeating-percent.md
index ca8c4ec..f89b7d5 100644
--- a/src/content/posts/zh/why-is-my-tts-model-repeating-percent.md
+++ b/src/content/posts/zh/why-is-my-tts-model-repeating-percent.md
@@ -3,6 +3,8 @@ title: "为什么本地语音合成一直在念 “Percent”？语音管线里
 description: "记录本地部署 CosyVoice 2 并通过群晖 n8n 对接时，语音合成陷入无限重复 “Percent” 的现象剖析，以及字符前端规范化与 n8n 沙盒表达式避坑。"
 pubDate: 2026-10-22
 category: notes
+blueprint: ai-agent-automation
+blueprintLayer: L1-deterministic-orchestration
 tags: ["tts", "debugging", "n8n", "urlencode", "python", "ai"]
 ogImage: "/og/zh-why-is-my-tts-model-repeating-percent.jpg"
 banner: "/banners/why-is-my-tts-model-repeating-percent.jpg"
diff --git a/src/content/posts/zh/why-multi-agent-coding-fails.md b/src/content/posts/zh/why-multi-agent-coding-fails.md
index 75ae52c..392b4e0 100644
--- a/src/content/posts/zh/why-multi-agent-coding-fails.md
+++ b/src/content/posts/zh/why-multi-agent-coding-fails.md
@@ -4,6 +4,8 @@ description: "为什么让多个自主 AI Agent 协同开发必然导致分支
 pubDate: 2025-07-29
 updatedDate: 2026-10-25
 category: notes
+blueprint: ai-agent-automation
+blueprintLayer: L2-llm-gateway-agents
 tags: ["ai", "agents", "architecture", "debugging"]
 ogImage: "/og/zh-why-multi-agent-coding-fails.jpg"
 banner: "/banners/why-multi-agent-coding-fails.jpg"
diff --git a/src/content/posts/zh/why-telegram-bot-notifications-die.md b/src/content/posts/zh/why-telegram-bot-notifications-die.md
index f90aa09..db891d2 100644
--- a/src/content/posts/zh/why-telegram-bot-notifications-die.md
+++ b/src/content/posts/zh/why-telegram-bot-notifications-die.md
@@ -4,6 +4,8 @@ description: "一次排障记录：一个跑在 Docker 里的 Telegram 监控机
 pubDate: 2026-03-25
 updatedDate: 2026-09-09
 category: devops
+blueprint: ai-agent-automation
+blueprintLayer: L1-deterministic-orchestration
 tags: [docker, telegram, python, dns, ipv6, debugging, portainer]
 ogImage: /og/zh-why-telegram-bot-notifications-die.jpg
 banner: /banners/why-telegram-bot-notifications-die.jpg
diff --git a/src/content/posts/zh/why-your-grafana-dashboard-shows-no-data.md b/src/content/posts/zh/why-your-grafana-dashboard-shows-no-data.md
index 0aa467c..b8f6378 100644
--- a/src/content/posts/zh/why-your-grafana-dashboard-shows-no-data.md
+++ b/src/content/posts/zh/why-your-grafana-dashboard-shows-no-data.md
@@ -4,6 +4,8 @@ description: "所有 target 都是 up、数据就在 Prometheus 里、面板表
 pubDate: 2026-05-17
 updatedDate: 2026-09-29
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L3-observability-self-healing
 tags: [grafana, prometheus, dashboards, monitoring, promql, observability]
 ogImage: /og/zh-why-your-grafana-dashboard-shows-no-data.jpg
 banner: /banners/why-your-grafana-dashboard-shows-no-data.jpg
diff --git a/src/content/posts/zh/your-disk-full-alert-is-lying.md b/src/content/posts/zh/your-disk-full-alert-is-lying.md
index d2ba5f5..ee3000d 100644
--- a/src/content/posts/zh/your-disk-full-alert-is-lying.md
+++ b/src/content/posts/zh/your-disk-full-alert-is-lying.md
@@ -4,6 +4,8 @@ description: "\"剩余 3%\"听着像紧急事故，直到你发现那是 500 GB
 pubDate: 2026-06-24
 updatedDate: 2026-09-29
 category: devops
+blueprint: self-hosted-infrastructure
+blueprintLayer: L3-observability-self-healing
 tags: [monitoring, alerting, prometheus, grafana, storage, capacity, observability]
 ogImage: /og/zh-your-disk-full-alert-is-lying.jpg
 banner: /banners/your-disk-full-alert-is-lying.jpg
diff --git a/src/content/posts/zh/yue2-on-a-12gb-gpu-songs-that-lost-their-endings.md b/src/content/posts/zh/yue2-on-a-12gb-gpu-songs-that-lost-their-endings.md
index a6a2138..ebda9c6 100644
--- a/src/content/posts/zh/yue2-on-a-12gb-gpu-songs-that-lost-their-endings.md
+++ b/src/content/posts/zh/yue2-on-a-12gb-gpu-songs-that-lost-their-endings.md
@@ -3,6 +3,8 @@ title: "为什么我的 AI 歌曲总是丢结尾：在 12GB 显卡上跑 YuE2"
 description: "12 首中文歌时长全都恰好 240.000 秒，尾奏不见了。原因不在歌词 —— 是一道硬上限、一堵显存天花板，和一个不看 BPM 的规划器。"
 pubDate: 2026-10-20
 category: ai
+blueprint: ai-agent-automation
+blueprintLayer: L4-aigc-media-pipelines
 stream: creative-lab
 tags: ["yue2", "comfyui", "ai-music", "local-ai", "gpu", "vram", "mandarin"]
 ogImage: "/og/zh-yue2-on-a-12gb-gpu-songs-that-lost-their-endings.jpg"
diff --git a/src/layouts/BaseLayout.astro b/src/layouts/BaseLayout.astro
index 4d03f30..a8705f2 100644
--- a/src/layouts/BaseLayout.astro
+++ b/src/layouts/BaseLayout.astro
@@ -62,8 +62,8 @@ const switchLabel = isZh ? 'EN' : '中文';
 
 // Locale-aware nav labels
 const nav = isZh
-  ? { caseStudies: '工程案例', posts: '全部文章', about: '关于与合作' }
-  : { caseStudies: 'Case Studies', posts: 'All Posts', about: 'Work With Me' };
+  ? { blueprints: '系统蓝图', caseStudies: '工程案例', posts: '全部文章', about: '关于与合作' }
+  : { blueprints: 'Blueprints', caseStudies: 'Case Studies', posts: 'All Posts', about: 'Work With Me' };
 ---
 
 <!doctype html>
@@ -184,6 +184,7 @@ const nav = isZh
             whole group onto a second row (`flex-basis: 100%`) instead of letting
             individual links wrap around the search / language / theme controls. */}
         <ul class="nav-links">
+          <li><a class="nav-link" href={isZh ? '/zh/blueprints/' : '/blueprints/'}>{nav.blueprints}</a></li>
           <li><a class="nav-link" href={isZh ? '/zh/categories/case-studies/' : '/categories/case-studies/'}>{nav.caseStudies}</a></li>
           <li><a class="nav-link" href={isZh ? '/zh/posts/' : '/posts/'}>{nav.posts}</a></li>
           <li><a class="nav-link" href={isZh ? '/zh/about/' : '/about/'}>{nav.about}</a></li>
diff --git a/src/lib/blueprints.ts b/src/lib/blueprints.ts
new file mode 100644
index 0000000..4363f63
--- /dev/null
+++ b/src/lib/blueprints.ts
@@ -0,0 +1,416 @@
+/**
+ * Blueprints (Pillar Pages) Metadata & Hierarchical Layer Tree
+ * Single source of truth for the 3 core architectural pillars and their 12 standard layers.
+ */
+
+export const BLUEPRINT_SLUGS = [
+  'self-hosted-infrastructure',
+  'ai-agent-automation',
+  'sme-digital-suite',
+] as const;
+
+export type BlueprintSlug = (typeof BLUEPRINT_SLUGS)[number];
+
+export interface BlueprintLayer {
+  slug: string;
+  name: { en: string; zh: string };
+  scope: { en: string; zh: string };
+  summary: { en: string; zh: string };
+  keyTech: string[];
+}
+
+export interface BlueprintMeta {
+  slug: BlueprintSlug;
+  title: { en: string; zh: string };
+  tagline: { en: string; zh: string };
+  metrics: { en: string; zh: string };
+  stats: { value: string; label: { en: string; zh: string } }[];
+  tradeOffs: {
+    title: { en: string; zh: string };
+    content: { en: string; zh: string };
+  };
+  cta: {
+    track: 'sme' | 'hiring';
+    heading: { en: string; zh: string };
+    body: { en: string; zh: string };
+    buttonText: { en: string; zh: string };
+    buttonLink: string;
+  };
+  layers: BlueprintLayer[];
+}
+
+export const BLUEPRINTS: Record<BlueprintSlug, BlueprintMeta> = {
+  'self-hosted-infrastructure': {
+    slug: 'self-hosted-infrastructure',
+    title: {
+      en: 'Production Self-Hosted Infrastructure: 162 Containers Across Three Hosts',
+      zh: '生产级自托管基础设施全景：三宿主 162 容器高可用架构',
+    },
+    tagline: {
+      en: 'How one engineer operates 162 production containers across bare metal, NAS, and cloud edge without managed PaaS crutches.',
+      zh: '一名工程师如何借助确定性脚本、内核隔离与三端拓扑，实现 162 个生产容器单人高可用运维。',
+    },
+    metrics: {
+      en: '3 Hosts · 162 Containers · 78 Stacks · 0 Managed PaaS Crutches',
+      zh: '3 台物理主机 · 162 个生产容器 · 78 套编排栈 · 0 云厂商依赖',
+    },
+    stats: [
+      { value: '162', label: { en: 'Containers in Prod', zh: '运行中生产容器' } },
+      { value: '3 Hosts', label: { en: 'Unraid · Synology · VPS', zh: '三端异构宿主' } },
+      { value: '78', label: { en: 'Compose Stacks', zh: '服务编排栈' } },
+      { value: '11', label: { en: 'Deterministic Cron Loops', zh: '确定性自愈巡检' } },
+    ],
+    tradeOffs: {
+      title: {
+        en: 'Architectural Decisions & Production Trade-offs',
+        zh: '核心架构抉择与生产权衡',
+      },
+      content: {
+        en: `Running 162 production containers solo requires strict architectural boundaries rather than brute-force DevOps hours. 
+The foundation splits responsibilities strictly across three disparate tiers: Unraid manages high-capacity persistent storage and raw GPU compute; Synology DSM hosts always-on internal operational services behind Btrfs snapshots; a public VPS serves as the hardened, DMZ ingress reverse proxy. 
+
+Instead of adding heavy distributed consensus engines (Kubernetes/Nomad) that introduce fragile control-plane overhead, every stack is defined as a self-contained Docker Compose unit bound to local volumes. Reliability is maintained by 11 deterministic inspection loops that continuously audit health checks, memory limits, and container lifecycles — proving that deterministic simplicity beats complex orchestration for medium-scale sovereign workloads.`,
+        zh: `单人运维 162 个生产容器，核心在于极度清晰的物理边界与责任划分，而非堆砌运维工时。
+三端架构各司其职：Unraid 承担大容量持久化阵列存储与 GPU 算力；群晖 DSM 依托成熟的 Btrfs 快照运行 7×24 内部生产服务与数据库；公网 VPS 充当 DMZ 边缘硬化入口。
+
+放弃在轻量节点上维护脆弱的分布式控制面（如 Kubernetes/Nomad），全站 78 个服务全部收敛为具备独立卷绑定的 Docker Compose 声明单元。系统的长期免维护性由 11 个零 AI 介入的确定性定时巡检脚本守护，以极简的确定性设计压制意外复杂度。`,
+      },
+    },
+    cta: {
+      track: 'hiring',
+      heading: {
+        en: 'Need Battle-Tested Infrastructure & DevOps Engineering?',
+        zh: '需要具备全链路实战能力的系统与 DevOps 工程师？',
+      },
+      body: {
+        en: 'I build, harden, and operate mission-critical systems with complete ownership from kernel cgroups up to application code.',
+        zh: '我具备从 Linux 内核排障、网络穿透到应用代码的全链路端到端交付能力，欢迎查阅完整履历或预约洽谈。',
+      },
+      buttonText: {
+        en: 'View Hiring Profile & Tech Stack →',
+        zh: '查看招聘方评估与技术栈 →',
+      },
+      buttonLink: '/about/#hiring',
+    },
+    layers: [
+      {
+        slug: 'L1-compute-storage-network',
+        name: {
+          en: 'L1: Compute, Storage & Hybrid Network',
+          zh: 'L1: 异构算力、存储与混合组网',
+        },
+        scope: {
+          en: 'Unraid array / Synology NAS / Public VPS / CGNAT traversal / WireGuard & Tailscale mesh / Storage redundancy',
+          zh: 'Unraid 阵列 / 群晖 NAS / 公网 VPS / CGNAT 穿透 / 跨端私有组网 / 存储冗余',
+        },
+        summary: {
+          en: 'The hardware and network topology dividing high-capacity bulk I/O, enterprise services, and edge ingress across three geographically distinct nodes.',
+          zh: '物理硬件、网络拓扑与存储划分底座，将大容量 I/O、核心生产服务与公网入口合理分散在三台物理节点上。',
+        },
+        keyTech: ['Unraid', 'Synology DSM', 'VPS (Ubuntu)', 'Btrfs', 'Cloudflare Tunnels', 'Tailscale'],
+      },
+      {
+        slug: 'L2-edge-proxy-runtime',
+        name: {
+          en: 'L2: Edge Gateway, Runtime & Identity',
+          zh: 'L2: 边缘网关、容器运行时与身份',
+        },
+        scope: {
+          en: 'Traefik edge reverse proxy / Compose conventions / Linux cgroup memory ceilings / Kernel OOM isolation / Authentik SSO',
+          zh: 'Traefik 反向代理 / 78 栈编排规范 / Linux cgroups 内存隔离 / 内核 OOM 守卫 / Authentik SSO 统一中枢',
+        },
+        summary: {
+          en: 'Production ingress routing, declarative Docker service definitions, kernel-level memory boundaries, and centralized SSO security gates.',
+          zh: '公网流量入口路由、声明式 Compose 服务治理、Linux 内核级内存隔离防护，以及统管全域服务的 SSO 鉴权中枢。',
+        },
+        keyTech: ['Traefik v3', 'Docker Engine', 'Linux Kernel (cgroups/dmesg)', 'Authentik SSO', 'Let\'s Encrypt'],
+      },
+      {
+        slug: 'L3-observability-self-healing',
+        name: {
+          en: 'L3: Observability, Loops & Self-Healing',
+          zh: 'L3: 全域可观测性、巡检闭环与自愈',
+        },
+        scope: {
+          en: 'Prometheus cross-host metrics / Grafana dashboards / 11 deterministic inspection crons (Loop Engineering) / Alert deduplication',
+          zh: '跨三端统一 Prometheus 采集 / Grafana 看板 / 11 个确定性巡检脚本（Loop Engineering）/ 告警降噪',
+        },
+        summary: {
+          en: 'Unified monitoring that unmasks false container states, combined with zero-AI deterministic feedback loops that heal infrastructure automatically.',
+          zh: '穿透 Docker 假象的真实底层监控，结合无需人工值守、无 AI 幻觉的确定性定时自愈闭环。',
+        },
+        keyTech: ['Prometheus', 'Grafana', 'Node Exporter', 'cAdvisor', 'Loop Engineering (Shell/Python)'],
+      },
+      {
+        slug: 'L4-secops-cicd-dr',
+        name: {
+          en: 'L4: SecOps, CI/CD & Disaster Recovery',
+          zh: 'L4: 安全基线、CI/CD 与异地容灾',
+        },
+        scope: {
+          en: 'Zero-day runtime mitigation (PHP2Shell) / Gitea + GitHub dual-remote CI/CD / act_runner on unRaid / 3-2-1 Backrest backups',
+          zh: '运行时 0-day 漏洞加固 / Gitea + GitHub 双远端构建 / unRaid act_runner / 3-2-1 异地容灾快照',
+        },
+        summary: {
+          en: 'Defensive engineering: rapid runtime vulnerability patching, automated dual-remote deployments with edge cache purging, and verified disaster recovery.',
+          zh: '安全防御体系：紧急漏洞就地补丁、双代码源自动化发布流水线与经过实测恢复验证的 3-2-1 灾备链条。',
+        },
+        keyTech: ['Gitea Actions', 'Cloudflare Cache Purge', 'Restic / Backrest', 'IPBan', 'Security Hardening'],
+      },
+    ],
+  },
+
+  'ai-agent-automation': {
+    slug: 'ai-agent-automation',
+    title: {
+      en: 'AI Agent & Local GPU Automation: Deterministic Workflows + RTX 3060 Inference',
+      zh: '企业级 AI Agent 与本地 GPU 算力自动化：确定性状态机与本地推理管线',
+    },
+    tagline: {
+      en: 'Combining deterministic state machines, local GPU inference, and disciplined agent orchestration into robust business automation.',
+      zh: '用确定性状态机约束大模型边界，依托本地 RTX 3060 显存调度与 Agent 工程闭环，落地高可靠业务自动化。',
+    },
+    metrics: {
+      en: '1 RTX 3060 12GB · 175+ Unit Tests · Multi-Agent Orchestration · 24/7 Production Loops',
+      zh: '1 块 RTX 3060 12GB · 175+ 单元测试 · 多 Agent 协同治理 · 24/7 生产闭环',
+    },
+    stats: [
+      { value: '12 GB', label: { en: 'VRAM Managed on RTX 3060', zh: 'RTX 3060 极限显存调度' } },
+      { value: '175+', label: { en: 'Unit Tests for Bot Logic', zh: '状态机与网关单测用例' } },
+      { value: '24/7', label: { en: 'Unattended Lead Bots', zh: '全天候自动获客接单' } },
+      { value: '0', label: { en: 'Price & Data Hallucinations', zh: '生产零报价/信息幻觉' } },
+    ],
+    tradeOffs: {
+      title: {
+        en: 'Deterministic Engineering vs. Raw Prompt Engineering',
+        zh: '确定性工程设计与纯 Prompt 堆叠的根本区别',
+      },
+      content: {
+        en: `Generative models are brilliant for unstructured semantic comprehension, but notoriously brittle at maintaining state, enforcing catalog boundaries, and processing transactions.
+Our AI architecture rejects "prompt-only" systems. All customer checkout flows, trial provisioning, and deep links are governed by strict finite state machines before an LLM ever touches the user input.
+
+On the compute layer, instead of incurring unpredictable cloud API bills and leaking private telemetry, we deploy self-hosted inference pipelines on an on-premise RTX 3060 12GB. By pairing CosyVoice 2 for neural voice synthesis, faster-whisper for acoustic alignment, and ComfyUI API headless runners for multimodal assets, we achieve high throughput with zero ongoing per-token runtime costs.`,
+        zh: `大语言模型擅长处理非结构化语义理解，但在保持会话状态、执行严格商品目录与交易边界时极其脆弱。
+本架构坚决摒弃“纯 Prompt 堆砌”。所有客户下单意图、试用账号发放与深层链接，在进入 LLM 之前全部被确定性有限状态机严格拦截与处理。
+
+在算力层，为了避免高昂且不可预测的云端 API 账单与数据泄露隐患，我们将推理任务收敛至本地 12GB RTX 3060 节点。结合 CosyVoice 2 神经语音合成、faster-whisper 强制音素对齐与 ComfyUI API 无头生成管线，以 0 边际成本实现高吞吐工业化生成。`,
+      },
+    },
+    cta: {
+      track: 'sme',
+      heading: {
+        en: 'Want to Deploy Private AI & Automation for Your Business?',
+        zh: '想为您的企业搭建私有化 AI 客服与自动化系统？',
+      },
+      body: {
+        en: 'Replace fragile manual processes and costly monthly SaaS subscriptions with private, reliable automation pipelines.',
+        zh: '消灭繁琐的人工重复操作与昂贵的按人头 SaaS 订阅，搭建全天候获客与自动交付系统。',
+      },
+      buttonText: {
+        en: 'Discuss Your Automation Project on WhatsApp →',
+        zh: 'WhatsApp 详询自动化定制方案 →',
+      },
+      buttonLink: '/about/#sme',
+    },
+    layers: [
+      {
+        slug: 'L1-deterministic-orchestration',
+        name: {
+          en: 'L1: Deterministic Orchestration & State Machines',
+          zh: 'L1: 确定性编排与业务状态机',
+        },
+        scope: {
+          en: 'Synology Docker n8n / Webhook ingress validation / Sandbox isolation / Finite state machines / Idempotency',
+          zh: '群晖 Docker n8n 编排 / Webhook 签名与限流 / 沙箱执行边界 / 确定性有限状态机 / 幂等性兜底',
+        },
+        summary: {
+          en: 'The execution layer that wraps business logic in deterministic state machines, ensuring orders and trials execute cleanly without LLM intervention.',
+          zh: '用确定性状态机与沙箱包裹核心业务逻辑，确保下单、试用发放与关键路径 100% 确定可控。',
+        },
+        keyTech: ['n8n', 'Node.js / TypeScript', 'grammY (Telegram)', 'State Machines', 'PostgreSQL'],
+      },
+      {
+        slug: 'L2-llm-gateway-agents',
+        name: {
+          en: 'L2: Hybrid LLM Gateway & Agent Loops',
+          zh: 'L2: 混合大模型网关与受控 Agent 闭环',
+        },
+        scope: {
+          en: 'LiteLLM routing / Cloud & local model failover / Hermes Agent autonomous workflows / Verification gates / Structured output contracts',
+          zh: 'LiteLLM 动态网关 / 云端与本地模型故障切换 / Hermes Agent 自主研发流 / 多道验收闸门 / 严格结构化输出',
+        },
+        summary: {
+          en: 'The intelligence broker that decouples agent applications from underlying model providers, enforcing verification gates before output acceptance.',
+          zh: '智能网关中枢：解耦应用与底层模型供应商，多模型负载切换，并通过严格测试闸门规范自主 Agent 产出。',
+        },
+        keyTech: ['LiteLLM', 'Hermes Agent', 'OpenAI/Gemini APIs', 'Zod Schema Validation', 'Mem0'],
+      },
+      {
+        slug: 'L3-local-gpu-inference',
+        name: {
+          en: 'L3: Local GPU Inference Stack (RTX 3060)',
+          zh: 'L3: 本地 GPU 算力底座与语音/视觉推理',
+        },
+        scope: {
+          en: '12GB VRAM lifecycle management / CosyVoice 2 zero-shot TTS / faster-whisper forced alignment / RapidOCR verification',
+          zh: '12GB 显存极限释放 / CosyVoice 2 零样本语音克隆 / faster-whisper 音素对齐 / RapidOCR 自动质检',
+        },
+        summary: {
+          en: 'On-premise GPU inference engine replacing recurring cloud speech and vision APIs with private, zero-token-cost local execution.',
+          zh: '私有 GPU 推理基座，将昂贵的云端语音合成与转写替换为零边际成本的本地高性能模型服务。',
+        },
+        keyTech: ['NVIDIA RTX 3060 (12GB)', 'CosyVoice 2', 'faster-whisper', 'RapidOCR', 'PyTorch / CUDA'],
+      },
+      {
+        slug: 'L4-aigc-media-pipelines',
+        name: {
+          en: 'L4: Automated AIGC & Media Pipelines',
+          zh: 'L4: 多模态 AIGC 工业化生成流水线',
+        },
+        scope: {
+          en: 'ComfyUI headless API scripts / YuE2 BF16 audio headroom formulas / Video diffusion pipelines / Remotion & Filmora automation',
+          zh: 'ComfyUI API 无头批量生成 / YuE2 BF16 长音频防截断预算法 / 本地视频生成 / 自动化分镜与音视频合成',
+        },
+        summary: {
+          en: 'High-throughput multimodal production pipelines turning raw prompts and audio stems into complete, broadcast-quality music and video deliverables.',
+          zh: '工业级多模态生产流水线，将文本歌词与音频素材批量转化为高品质长音频与 1080P 完整视频成品。',
+        },
+        keyTech: ['ComfyUI API', 'YuE2 BF16', 'Wan 2.2 / SeedVR2', 'Remotion', 'Python Pipeline'],
+      },
+    ],
+  },
+
+  'sme-digital-suite': {
+    slug: 'sme-digital-suite',
+    title: {
+      en: 'SME Digital Suite: High-Conversion Web, SifuMail & Entitlement Engines',
+      zh: '中小企业数字资产与商业交付套件：高性能建站、SifuMail 邮局与权限引擎',
+    },
+    tagline: {
+      en: 'Turnkey digital infrastructure for growing enterprises: lightning-fast web, sovereign email, and self-healing access control.',
+      zh: '专为成长型企业定制的高可用数字基础设施：极致速度站点、高送达率企业邮局与自动化权限中台。',
+    },
+    metrics: {
+      en: '100% Deliverability Baseline · Zero SaaS Per-Seat Tax · Self-Healing Access · Turnkey Delivery',
+      zh: '满分邮件送达率 · 0 SaaS 人头月费税 · 自愈权限引擎 · 一站式交付移交',
+    },
+    stats: [
+      { value: '10/10', label: { en: 'SifuMail Deliverability Score', zh: '邮件送达信誉满分' } },
+      { value: '0', label: { en: 'Per-Seat Monthly SaaS Tax', zh: '零按人头月度软件税' } },
+      { value: '5-Way', label: { en: 'Self-Healing Entitlements', zh: '五链路权限自愈引擎' } },
+      { value: '100%', label: { en: 'Client Ownership & Source Handover', zh: '客户资产 100% 完整移交' } },
+    ],
+    tradeOffs: {
+      title: {
+        en: 'Sovereign Digital Ownership vs. Fragile SaaS Subscriptions',
+        zh: '自主数字资产所有权与脆弱 SaaS 订阅的本质对决',
+      },
+      content: {
+        en: `Small and medium enterprises in Southeast Asia often get trapped in two extremes: either slow, poorly-maintained WordPress template sites on shared hosting, or exorbitant enterprise SaaS tools that charge an escalating tax per team member every month.
+The SME Digital Suite delivers sovereign, productized architecture:
+
+1. High-Performance Web: Built on modern static architectures (Astro) or deeply tuned LiteSpeed WordPress engines, achieving Sub-1s page loads and perfect technical SEO schemas.
+2. Sovereign Email (SifuMail): Independent, fully managed mail server instances configured with strict SPF, DKIM, and DMARC alignments — eliminating $6–$12/user monthly GSuite/M365 overhead.
+3. Self-Healing Entitlements: NocoDB and n8n workflows that automatically grant, synchronize, and expire digital access rights without manual intervention.`,
+        zh: `东南亚中小企业在信息化进程中常陷入两极困境：要么购买劣质廉价的主机模板站，加载奇慢且漏洞频发；要么被海外昂贵的 SaaS 软件绑架，每月按人头支付沉重的订阅税。
+SME Digital Suite 提供了真正具备资产自主权的工程解决方案：
+
+1. 极速企业站点：基于现代化 Astro 静态架构或深度调优的 LiteSpeed WordPress，实现秒级加载与满分技术 SEO 结构化数据。
+2. 独立企业邮局（SifuMail）：搭建并维护独立的邮件服务器，严格对齐 SPF、DKIM 与 DMARC 防护，彻底省去每人每月数十马币的企业邮箱开销。
+3. 自愈权限引擎：基于 NocoDB + n8n + AList，实现客户订单与文件权限的自动化开通、实时自愈校验与到期回收。`,
+      },
+    },
+    cta: {
+      track: 'sme',
+      heading: {
+        en: 'Ready to Upgrade Your Business Digital Foundation?',
+        zh: '准备好升级您企业的数字化底层资产了吗？',
+      },
+      body: {
+        en: 'From turnkey high-conversion websites to sovereign mail hosting, get fixed-price delivery with complete ownership.',
+        zh: '从高性能商业建站、企业邮局到私有业务系统，一口价透明交付，享有 100% 源码与数据控制权。',
+      },
+      buttonText: {
+        en: 'Chat with Hoelee on WhatsApp (+60 12-797 2969) →',
+        zh: 'WhatsApp 咨询 Hoelee (+60 12-797 2969) →',
+      },
+      buttonLink: '/about/#sme',
+    },
+    layers: [
+      {
+        slug: 'L1-high-conversion-web',
+        name: {
+          en: 'L1: High-Performance Web & Technical SEO',
+          zh: 'L1: 高性能双语站点与技术 SEO 架构',
+        },
+        scope: {
+          en: 'Astro static edge deployment / OpenLiteSpeed tuning / Bilingual hreflang / TechArticle JSON-LD / Pagefind search',
+          zh: 'Astro 静态边缘构建 / OpenLiteSpeed 深度优化 / 双语 hreflang / TechArticle 结构化数据 / Pagefind 离线检索',
+        },
+        summary: {
+          en: 'Ultra-fast web platforms engineered for credibility, high search engine visibility (SEO/GEO), and zero maintenance overhead.',
+          zh: '极致加载速度与高信任度的企业官方门面，具备完美的搜索引擎与 AI 知识引擎收录架构。',
+        },
+        keyTech: ['Astro', 'OpenLiteSpeed / WordPress', 'Cloudflare Edge Cache', 'Schema.org JSON-LD', 'Pagefind'],
+      },
+      {
+        slug: 'L2-sifumail-communication',
+        name: {
+          en: 'L2: SifuMail & Sovereign Communication',
+          zh: 'L2: SifuMail 独立邮局与高送达率通信',
+        },
+        scope: {
+          en: 'SifuMail mail server deployment / SPF, DKIM, DMARC alignment / Anti-spam hygiene / Dedicated outbound IP routing',
+          zh: 'SifuMail 独立企业邮局部署 / SPF、DKIM、DMARC 满分信誉对齐 / 反垃圾防线 / 独立发信通道隔离',
+        },
+        summary: {
+          en: 'Dedicated enterprise mail infrastructure that keeps business communications out of spam folders without recurring per-mailbox fees.',
+          zh: '高送达率的企业专属独立邮局，确保商业报价信与通知不进垃圾箱，告别昂贵的人头软件税。',
+        },
+        keyTech: ['SifuMail (Mailcow/Postfix)', 'DNS SecOps (SPF/DKIM/DMARC)', 'Rspamd', 'TLS Encryption'],
+      },
+      {
+        slug: 'L3-entitlement-backoffice',
+        name: {
+          en: 'L3: Entitlement Engines & Backoffice CRM',
+          zh: 'L3: 数字商品自愈权限与中台数据底座',
+        },
+        scope: {
+          en: 'NocoDB data store / n8n multi-step workflows / AList drive permission engine / Public verification endpoint',
+          zh: 'NocoDB 关系数据底座 / n8n 多步调度流 / AList 网盘驱动权限引擎 / 零泄露公开查验接口',
+        },
+        summary: {
+          en: 'A self-healing access-control architecture that automatically provisions, verifies, and revokes client file entitlements across storage systems.',
+          zh: '五链路自愈式权限分发中台，全自动处理用户订单、发放网盘访问权限并在到期后平滑回收。',
+        },
+        keyTech: ['NocoDB', 'n8n', 'AList', 'REST APIs', 'PostgreSQL'],
+      },
+      {
+        slug: 'L4-managed-ops-handover',
+        name: {
+          en: 'L4: Managed SecOps, Cost Control & SLA',
+          zh: 'L4: 托管安全运维、TCO 降本与商业交付',
+        },
+        scope: {
+          en: 'Cloud bill audit & SaaS migration / 24/7 uptime monitoring / Anti-lockout procedures / Full documentation handover',
+          zh: '企业云账单审计与 SaaS 降本迁移 / 7×24 生产可用性监控 / 防自锁交付 SOP / 完整资产与文档移交',
+        },
+        summary: {
+          en: 'Complete peace of mind: turnkey handover with full source access, operational runbooks, and ongoing monitoring for zero lock-in.',
+          zh: '让企业主安心的交付闭环：代码与主机资产 100% 移交，配备高可用运维手册与告警接入，绝不设技术门槛扣留客户。',
+        },
+        keyTech: ['Uptime Kuma', 'Traefik Forward-Auth', 'Runbooks / SOP', 'Disaster Recovery Plan'],
+      },
+    ],
+  },
+};
+
+/** Get metadata for a single blueprint. */
+export function getBlueprint(slug: string): BlueprintMeta | undefined {
+  return BLUEPRINTS[slug as BlueprintSlug];
+}
+
+/** Get all blueprints as an array. */
+export function getAllBlueprints(): BlueprintMeta[] {
+  return BLUEPRINT_SLUGS.map((slug) => BLUEPRINTS[slug]);
+}
diff --git a/src/pages/blueprints/[slug].astro b/src/pages/blueprints/[slug].astro
new file mode 100644
index 0000000..6195ef9
--- /dev/null
+++ b/src/pages/blueprints/[slug].astro
@@ -0,0 +1,117 @@
+---
+import BaseLayout from '../../layouts/BaseLayout.astro';
+import PostList from '../../components/PostList.astro';
+import { BLUEPRINT_SLUGS, getBlueprint } from '../../lib/blueprints';
+import { getCollection } from 'astro:content';
+import { isEn } from '../../lib/lang';
+import { SITE } from '../../config';
+
+export async function getStaticPaths() {
+  return BLUEPRINT_SLUGS.map((slug) => ({
+    params: { slug },
+  }));
+}
+
+const { slug } = Astro.params;
+const bp = getBlueprint(slug);
+
+if (!bp) {
+  throw new Error(`Blueprint not found: ${slug}`);
+}
+
+const allPosts = await getCollection('posts', isEn);
+const mountedPosts = allPosts.filter((p) => p.data.blueprint === bp.slug);
+---
+
+<BaseLayout
+  title={`${bp.title.en} — System Blueprint — Mr Hoelee`}
+  description={bp.tagline.en}
+  switchHref={`/zh/blueprints/${bp.slug}/`}
+  altLocaleUrl={`${SITE.url}/zh/blueprints/${bp.slug}/`}
+>
+  <nav class="meta-tag" style="margin-bottom: 1.25rem;">
+    <a href="/blueprints/" style="color: inherit; text-decoration: none;">← All System Blueprints</a>
+  </nav>
+
+  <article class="blueprint-article">
+    <!-- Block 1: Hero & High-Density Stats -->
+    <header class="blueprint-hero">
+      <div class="bp-card-top" style="margin-bottom: 0.5rem;">
+        <span class="bp-card-badge">Production Blueprint</span>
+        <span class="bp-card-metric">{bp.metrics.en}</span>
+      </div>
+      <h1>{bp.title.en}</h1>
+      <p class="blueprint-tagline">{bp.tagline.en}</p>
+
+      <div class="blueprint-stats-grid">
+        {bp.stats.map((st) => (
+          <div class="blueprint-stat-card">
+            <div class="blueprint-stat-val">{st.value}</div>
+            <div class="blueprint-stat-label">{st.label.en}</div>
+          </div>
+        ))}
+      </div>
+    </header>
+
+    <!-- Interactive Layer Jump Bar -->
+    <nav class="layer-nav-bar" aria-label="Quick jump to blueprint layer">
+      <span class="layer-nav-label">Topology Layers:</span>
+      {bp.layers.map((layer) => (
+        <a class="layer-nav-pill" href={`#${layer.slug}`}>
+          {layer.slug.split('-')[0]}: {layer.name.en.split(':')[1]?.trim() || layer.name.en}
+        </a>
+      ))}
+    </nav>
+
+    <!-- Block 2: Architectural Decisions & Production Trade-offs -->
+    <section class="tradeoffs-box">
+      <h2>{bp.tradeOffs.title.en}</h2>
+      <p>{bp.tradeOffs.content.en}</p>
+    </section>
+
+    <!-- Block 3: L1..L4 Layer Guides & Mounted Posts -->
+    <section class="blueprint-layers-section">
+      {bp.layers.map((layer) => {
+        const layerPosts = mountedPosts.filter((p) => p.data.blueprintLayer === layer.slug);
+        return (
+          <div class="layer-block" id={layer.slug}>
+            <div class="layer-head-row">
+              <h2>{layer.name.en}</h2>
+            </div>
+            <div class="layer-scope">Scope: {layer.scope.en}</div>
+            <p class="layer-summary-text">{layer.summary.en}</p>
+
+            <div class="layer-tech-tags">
+              {layer.keyTech.map((tech) => (
+                <span class="layer-tech-pill">{tech}</span>
+              ))}
+            </div>
+
+            <div class="layer-posts-container">
+              <div class="layer-posts-title">
+                {layerPosts.length > 0
+                  ? `Mounted Technical Write-ups (${layerPosts.length})`
+                  : 'Referenced Production Stacks & Runbooks'}
+              </div>
+
+              {layerPosts.length > 0 ? (
+                <PostList posts={layerPosts} limit={10} lang="en" />
+              ) : (
+                <p style="font-size: 0.9rem; color: var(--muted); margin: 0.5rem 0;">
+                  This architectural layer is backed by live production configurations in our primary repository. Related deep-dive case studies are referenced across the broader documentation.
+                </p>
+              )}
+            </div>
+          </div>
+        );
+      })}
+    </section>
+
+    <!-- Block 4: Contextual CTA -->
+    <section class={`blueprint-cta bp-cta-${bp.cta.track}`}>
+      <h3>{bp.cta.heading.en}</h3>
+      <p>{bp.cta.body.en}</p>
+      <a class="btn btn-primary" href={bp.cta.buttonLink}>{bp.cta.buttonText.en}</a>
+    </section>
+  </article>
+</BaseLayout>
diff --git a/src/pages/blueprints/index.astro b/src/pages/blueprints/index.astro
new file mode 100644
index 0000000..d4fb4e5
--- /dev/null
+++ b/src/pages/blueprints/index.astro
@@ -0,0 +1,56 @@
+---
+import BaseLayout from '../../layouts/BaseLayout.astro';
+import { getAllBlueprints } from '../../lib/blueprints';
+import { SITE } from '../../config';
+
+const blueprints = getAllBlueprints();
+---
+
+<BaseLayout
+  title="System Blueprints — Production Architecture Guides — Mr Hoelee"
+  description="Explore three end-to-end architectural blueprints connecting 162 self-hosted containers, local GPU AI automation, and SME sovereign digital assets."
+  switchHref="/zh/blueprints/"
+  altLocaleUrl={`${SITE.url}/zh/blueprints/`}
+>
+  <div class="page-head">
+    <div class="meta-tag">Production Architecture</div>
+    <h1>System Blueprints</h1>
+    <p class="lede">
+      Instead of scattered chronological posts, these <strong>three architectural blueprints</strong> serve as the foundational pillars of everything I run. Each blueprint provides an interactive topology from physical hardware up to application code, organizing 91 bilingual write-ups into four clear, battle-tested engineering layers.
+    </p>
+  </div>
+
+  <div class="blueprints-grid">
+    {blueprints.map((bp, idx) => (
+      <a class="blueprint-card" href={`/blueprints/${bp.slug}/`}>
+        <div class="bp-card-top">
+          <span class="bp-card-badge">Pillar 0{idx + 1}</span>
+          <span class="bp-card-metric">{bp.metrics.en}</span>
+        </div>
+        <h2>{bp.title.en}</h2>
+        <p class="bp-tagline">{bp.tagline.en}</p>
+
+        <div class="bp-layers-preview">
+          {bp.layers.map((layer) => (
+            <div class="bp-layer-item">
+              <span class="bp-l-num">{layer.slug.split('-')[0]}</span>
+              <strong>{layer.name.en.split(':')[1]?.trim() || layer.name.en}</strong>
+            </div>
+          ))}
+        </div>
+
+        <div class="bp-card-cta">
+          Explore Blueprint &amp; Layer Guides →
+        </div>
+      </a>
+    ))}
+  </div>
+
+  <div class="blueprint-cta bp-cta-hiring">
+    <h3>Looking for Full-Ownership Engineering?</h3>
+    <p>
+      Whether you need robust Linux kernel and container infrastructure or autonomous AI workflows bound to deterministic state machines, explore my background and live system evidence.
+    </p>
+    <a class="btn btn-primary" href="/about/#hiring">View Tech Stack &amp; Case Studies →</a>
+  </div>
+</BaseLayout>
diff --git a/src/pages/posts/[...slug].astro b/src/pages/posts/[...slug].astro
index 4cae6b2..c527f7a 100644
--- a/src/pages/posts/[...slug].astro
+++ b/src/pages/posts/[...slug].astro
@@ -4,6 +4,7 @@ import AuthorCard from '../../components/AuthorCard.astro';
 import TableOfContents from '../../components/TableOfContents.astro';
 import ExecutiveSummary from '../../components/ExecutiveSummary.astro';
 import DynamicCTA from '../../components/DynamicCTA.astro';
+import { getBlueprint } from '../../lib/blueprints';
 import { getCollection, render } from 'astro:content';
 import { postLang } from '../../lib/lang';
 import { countWords, readingMinutes } from '../../lib/reading-time';
@@ -29,6 +30,9 @@ const lang = postLang(post.slug);
 const words = countWords(post.body);
 const minutes = readingMinutes(post.body);
 
+const bpMeta = post.data.blueprint ? getBlueprint(post.data.blueprint) : undefined;
+const bpLayer = bpMeta && post.data.blueprintLayer ? bpMeta.layers.find((l) => l.slug === post.data.blueprintLayer) : undefined;
+
 const fmt = (d: Date) =>
   d.toLocaleDateString(lang === 'zh' ? 'zh-CN' : 'en-US', { year: 'numeric', month: 'long', day: 'numeric' });
 
@@ -106,6 +110,14 @@ const jsonLd = {
 >
   <script type="application/ld+json" set:html={JSON.stringify(jsonLd)} />
   <article>
+    {bpMeta && bpLayer && (
+      <a class="article-blueprint-badge" href={lang === 'zh' ? `/zh/blueprints/${bpMeta.slug}/#${bpLayer.slug}` : `/blueprints/${bpMeta.slug}/#${bpLayer.slug}`}>
+        <span>📌 {lang === 'zh' ? '隶属于架构蓝图：' : 'Part of Blueprint:'}</span>
+        <strong>{lang === 'zh' ? bpMeta.title.zh.split('：')[0] : bpMeta.title.en.split(':')[0]}</strong>
+        <span>→</span>
+        <span>{lang === 'zh' ? bpLayer.name.zh : bpLayer.name.en}</span>
+      </a>
+    )}
     <header class="article-head">
       <h1>{post.data.title}</h1>
       <div class="meta">
diff --git a/src/pages/zh/blueprints/[slug].astro b/src/pages/zh/blueprints/[slug].astro
new file mode 100644
index 0000000..39a3fa0
--- /dev/null
+++ b/src/pages/zh/blueprints/[slug].astro
@@ -0,0 +1,118 @@
+---
+import BaseLayout from '../../../layouts/BaseLayout.astro';
+import PostList from '../../../components/PostList.astro';
+import { BLUEPRINT_SLUGS, getBlueprint } from '../../../lib/blueprints';
+import { getCollection } from 'astro:content';
+import { isZh } from '../../../lib/lang';
+import { SITE } from '../../../config';
+
+export async function getStaticPaths() {
+  return BLUEPRINT_SLUGS.map((slug) => ({
+    params: { slug },
+  }));
+}
+
+const { slug } = Astro.params;
+const bp = getBlueprint(slug);
+
+if (!bp) {
+  throw new Error(`Blueprint not found: ${slug}`);
+}
+
+const allPosts = await getCollection('posts', isZh);
+const mountedPosts = allPosts.filter((p) => p.data.blueprint === bp.slug);
+---
+
+<BaseLayout
+  title={`${bp.title.zh} — 系统架构蓝图 — Mr Hoelee`}
+  description={bp.tagline.zh}
+  lang="zh"
+  switchHref={`/blueprints/${bp.slug}/`}
+  altLocaleUrl={`${SITE.url}/blueprints/${bp.slug}/`}
+>
+  <nav class="meta-tag" style="margin-bottom: 1.25rem;">
+    <a href="/zh/blueprints/" style="color: inherit; text-decoration: none;">← 全部系统架构蓝图</a>
+  </nav>
+
+  <article class="blueprint-article">
+    <!-- Block 1: Hero & High-Density Stats -->
+    <header class="blueprint-hero">
+      <div class="bp-card-top" style="margin-bottom: 0.5rem;">
+        <span class="bp-card-badge">生产级系统蓝图</span>
+        <span class="bp-card-metric">{bp.metrics.zh}</span>
+      </div>
+      <h1>{bp.title.zh}</h1>
+      <p class="blueprint-tagline">{bp.tagline.zh}</p>
+
+      <div class="blueprint-stats-grid">
+        {bp.stats.map((st) => (
+          <div class="blueprint-stat-card">
+            <div class="blueprint-stat-val">{st.value}</div>
+            <div class="blueprint-stat-label">{st.label.zh}</div>
+          </div>
+        ))}
+      </div>
+    </header>
+
+    <!-- Interactive Layer Jump Bar -->
+    <nav class="layer-nav-bar" aria-label="快捷跳转到分层">
+      <span class="layer-nav-label">拓扑分层:</span>
+      {bp.layers.map((layer) => (
+        <a class="layer-nav-pill" href={`#${layer.slug}`}>
+          {layer.slug.split('-')[0]}: {layer.name.zh.split(':')[1]?.trim() || layer.name.zh}
+        </a>
+      ))}
+    </nav>
+
+    <!-- Block 2: Architectural Decisions & Production Trade-offs -->
+    <section class="tradeoffs-box">
+      <h2>{bp.tradeOffs.title.zh}</h2>
+      <p>{bp.tradeOffs.content.zh}</p>
+    </section>
+
+    <!-- Block 3: L1..L4 Layer Guides & Mounted Posts -->
+    <section class="blueprint-layers-section">
+      {bp.layers.map((layer) => {
+        const layerPosts = mountedPosts.filter((p) => p.data.blueprintLayer === layer.slug);
+        return (
+          <div class="layer-block" id={layer.slug}>
+            <div class="layer-head-row">
+              <h2>{layer.name.zh}</h2>
+            </div>
+            <div class="layer-scope">范畴: {layer.scope.zh}</div>
+            <p class="layer-summary-text">{layer.summary.zh}</p>
+
+            <div class="layer-tech-tags">
+              {layer.keyTech.map((tech) => (
+                <span class="layer-tech-pill">{tech}</span>
+              ))}
+            </div>
+
+            <div class="layer-posts-container">
+              <div class="layer-posts-title">
+                {layerPosts.length > 0
+                  ? `本层挂载实战手记 (${layerPosts.length})`
+                  : '生产环境参考栈与运行规约'}
+              </div>
+
+              {layerPosts.length > 0 ? (
+                <PostList posts={layerPosts} limit={10} lang="zh" />
+              ) : (
+                <p style="font-size: 0.9rem; color: var(--muted); margin: 0.5rem 0;">
+                  本拓扑分层完全由我们在主仓库中的实际生产配置运行守护，对应的深度复盘与排障日志收录于相关专题中。
+                </p>
+              )}
+            </div>
+          </div>
+        );
+      })}
+    </section>
+
+    <!-- Block 4: Contextual CTA -->
+    <section class={`blueprint-cta bp-cta-${bp.cta.track}`}>
+      <h3>{bp.cta.heading.zh}</h3>
+      <p>{bp.cta.body.zh}</p>
+      <a class="btn btn-primary" href={bp.cta.buttonLink.replace('/about/', '/zh/about/')}>{bp.cta.buttonText.zh}</a>
+    </section>
+  </article>
+</BaseLayout>
diff --git a/src/pages/zh/blueprints/index.astro b/src/pages/zh/blueprints/index.astro
new file mode 100644
index 0000000..2677c36
--- /dev/null
+++ b/src/pages/zh/blueprints/index.astro
@@ -0,0 +1,57 @@
+---
+import BaseLayout from '../../../layouts/BaseLayout.astro';
+import { getAllBlueprints } from '../../../lib/blueprints';
+import { SITE } from '../../../config';
+
+const blueprints = getAllBlueprints();
+---
+
+<BaseLayout
+  title="系统蓝图 — 生产级系统架构全景指南 — Mr Hoelee"
+  description="探索支撑 162 个自托管生产容器、本地 GPU AI 自动化与中小企业数字资产的三大顶层系统架构蓝图。"
+  lang="zh"
+  switchHref="/blueprints/"
+  altLocaleUrl={`${SITE.url}/blueprints/`}
+>
+  <div class="page-head">
+    <div class="meta-tag">生产级系统架构</div>
+    <h1>系统架构蓝图</h1>
+    <p class="lede">
+      打破传统的碎片化时间线归档，这<strong>三大系统蓝图（Pillar Blueprints）</strong>是我所管理的自托管生产体系的顶层基石。每个蓝图均包含从物理硬件底座到应用层的交互式拓扑全景，将 91 篇实战手记精确归拢至四个清晰的工程分层中。
+    </p>
+  </div>
+
+  <div class="blueprints-grid">
+    {blueprints.map((bp, idx) => (
+      <a class="blueprint-card" href={`/zh/blueprints/${bp.slug}/`}>
+        <div class="bp-card-top">
+          <span class="bp-card-badge">基石 0{idx + 1}</span>
+          <span class="bp-card-metric">{bp.metrics.zh}</span>
+        </div>
+        <h2>{bp.title.zh}</h2>
+        <p class="bp-tagline">{bp.tagline.zh}</p>
+
+        <div class="bp-layers-preview">
+          {bp.layers.map((layer) => (
+            <div class="bp-layer-item">
+              <span class="bp-l-num">{layer.slug.split('-')[0]}</span>
+              <strong>{layer.name.zh.split(':')[1]?.trim() || layer.name.zh}</strong>
+            </div>
+          ))}
+        </div>
+
+        <div class="bp-card-cta">
+          查阅架构拓扑与分层实战指南 →
+        </div>
+      </a>
+    ))}
+  </div>
+
+  <div class="blueprint-cta bp-cta-hiring">
+    <h3>需要具备全链路实战能力的架构与 DevOps 交付？</h3>
+    <p>
+      无论是从零搭建硬化的生产级 Linux 容器基础设施，还是构建接入确定性状态机与沙箱的私有 AI 业务系统，欢迎查阅实战履历与合作方案。
+    </p>
+    <a class="btn btn-primary" href="/zh/about/#hiring">查阅技术栈与代表作 →</a>
+  </div>
+</BaseLayout>
diff --git a/src/styles/global.css b/src/styles/global.css
index a60e89a..4a02f96 100644
--- a/src/styles/global.css
+++ b/src/styles/global.css
@@ -1540,6 +1540,318 @@ a.category-card:hover .art img {
   .author-card { flex-direction: column; align-items: flex-start; }
 }
 
+/* ---------- Blueprints (Pillar Pages) ---------- */
+.blueprints-grid {
+  display: grid;
+  grid-template-columns: 1fr;
+  gap: 2rem;
+  margin: 2rem 0 3rem;
+}
+.blueprint-card {
+  display: flex;
+  flex-direction: column;
+  background: var(--surface);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  padding: 1.75rem;
+  text-decoration: none;
+  color: inherit;
+  transition: transform 0.15s ease, border-color 0.15s ease;
+}
+.blueprint-card:hover {
+  transform: translateY(-2px);
+  border-color: var(--brand);
+}
+.bp-card-top {
+  display: flex;
+  flex-wrap: wrap;
+  justify-content: space-between;
+  align-items: center;
+  gap: 0.5rem;
+  margin-bottom: 0.75rem;
+}
+.bp-card-badge {
+  font-family: var(--font-mono);
+  font-size: 0.75rem;
+  font-weight: 700;
+  color: var(--brand);
+  background: rgba(41, 92, 255, 0.1);
+  border: 1px solid rgba(41, 92, 255, 0.25);
+  border-radius: 9999px;
+  padding: 0.15rem 0.6rem;
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+}
+.bp-card-metric {
+  font-family: var(--font-mono);
+  font-size: 0.8rem;
+  color: var(--faint);
+}
+.blueprint-card h2 {
+  margin: 0 0 0.5rem;
+  font-size: 1.35rem;
+  line-height: 1.3;
+}
+.blueprint-card p.bp-tagline {
+  color: var(--muted);
+  font-size: 0.95rem;
+  margin: 0 0 1.25rem;
+  line-height: 1.5;
+}
+.bp-layers-preview {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(220px, 1fr));
+  gap: 0.65rem;
+  padding-top: 1rem;
+  border-top: 1px solid var(--border);
+}
+.bp-layer-item {
+  font-size: 0.82rem;
+  color: var(--ink);
+  background: var(--surface-subtle, rgba(255, 255, 255, 0.02));
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  padding: 0.45rem 0.65rem;
+  line-height: 1.35;
+}
+.bp-layer-item span.bp-l-num {
+  font-family: var(--font-mono);
+  font-weight: 700;
+  color: var(--brand);
+  margin-right: 0.35rem;
+}
+.bp-card-cta {
+  margin-top: 1.25rem;
+  font-size: 0.9rem;
+  font-weight: 600;
+  color: var(--brand);
+  display: flex;
+  align-items: center;
+  gap: 0.35rem;
+}
+
+/* Individual Blueprint Page Layout */
+.blueprint-hero {
+  margin-bottom: 2rem;
+}
+.blueprint-hero h1 {
+  font-size: 2.1rem;
+  line-height: 1.2;
+  margin: 0 0 0.75rem;
+}
+.blueprint-tagline {
+  font-size: 1.1rem;
+  color: var(--muted);
+  max-width: 50rem;
+  margin: 0 0 1.5rem;
+  line-height: 1.5;
+}
+.blueprint-stats-grid {
+  display: grid;
+  grid-template-columns: repeat(4, 1fr);
+  gap: 0.85rem;
+  margin: 1.5rem 0;
+}
+.blueprint-stat-card {
+  background: var(--surface);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  padding: 0.9rem 1rem;
+}
+.blueprint-stat-val {
+  font-size: 1.5rem;
+  font-weight: 700;
+  line-height: 1.2;
+  font-family: var(--font-mono);
+  color: var(--brand);
+}
+.blueprint-stat-label {
+  font-size: 0.8rem;
+  color: var(--muted);
+  margin-top: 0.35rem;
+  line-height: 1.3;
+}
+
+/* Quick Layer Jump Bar */
+.layer-nav-bar {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 0.65rem;
+  padding: 0.85rem 1rem;
+  margin: 1.5rem 0 2rem;
+  background: var(--surface);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+}
+.layer-nav-label {
+  font-size: 0.82rem;
+  font-weight: 600;
+  color: var(--faint);
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+  margin-right: 0.25rem;
+}
+.layer-nav-pill {
+  font-size: 0.82rem;
+  padding: 0.25rem 0.75rem;
+  border-radius: 9999px;
+  background: var(--surface-subtle, rgba(255, 255, 255, 0.03));
+  border: 1px solid var(--border);
+  color: var(--ink);
+  text-decoration: none;
+  transition: all 0.15s ease;
+}
+.layer-nav-pill:hover {
+  border-color: var(--brand);
+  color: var(--brand);
+}
+
+/* Architectural Trade-offs Section */
+.tradeoffs-box {
+  background: var(--surface);
+  border: 1px solid var(--border);
+  border-left: 4px solid var(--brand);
+  border-radius: var(--radius);
+  padding: 1.5rem;
+  margin: 2rem 0 2.5rem;
+}
+.tradeoffs-box h2 {
+  font-size: 1.25rem;
+  margin: 0 0 0.85rem;
+}
+.tradeoffs-box p {
+  font-size: 0.95rem;
+  line-height: 1.65;
+  color: var(--ink);
+  margin: 0;
+  white-space: pre-line;
+}
+
+/* Layer Section */
+.layer-block {
+  margin: 3rem 0;
+  scroll-margin-top: 5rem;
+  padding-top: 1rem;
+  border-top: 1px solid var(--border);
+}
+.layer-head-row {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: baseline;
+  gap: 0.75rem;
+  margin-bottom: 0.4rem;
+}
+.layer-head-row h2 {
+  font-size: 1.5rem;
+  margin: 0;
+}
+.layer-scope {
+  font-family: var(--font-mono);
+  font-size: 0.82rem;
+  color: var(--muted);
+  margin: 0 0 0.75rem;
+}
+.layer-summary-text {
+  font-size: 0.98rem;
+  line-height: 1.6;
+  color: var(--ink);
+  max-width: 50rem;
+  margin: 0 0 1rem;
+}
+.layer-tech-tags {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.4rem;
+  margin-bottom: 1.5rem;
+}
+.layer-tech-pill {
+  font-family: var(--font-mono);
+  font-size: 0.75rem;
+  padding: 0.15rem 0.55rem;
+  background: var(--surface);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  color: var(--faint);
+}
+
+/* Mounted Posts Grid in Blueprint Layer */
+.layer-posts-container {
+  margin-top: 1rem;
+}
+.layer-posts-title {
+  font-size: 0.85rem;
+  font-weight: 700;
+  text-transform: uppercase;
+  letter-spacing: 0.05em;
+  color: var(--muted);
+  margin: 0 0 0.85rem;
+}
+
+/* Contextual Blueprint CTA */
+.blueprint-cta {
+  margin: 3.5rem 0 2rem;
+  padding: 2rem;
+  background: var(--surface);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  display: flex;
+  flex-direction: column;
+  gap: 1rem;
+}
+.bp-cta-sme {
+  border-top: 4px solid #10b981;
+}
+.bp-cta-hiring {
+  border-top: 4px solid #3b82f6;
+}
+.blueprint-cta h3 {
+  font-size: 1.35rem;
+  margin: 0;
+}
+.blueprint-cta p {
+  color: var(--muted);
+  font-size: 0.98rem;
+  line-height: 1.55;
+  margin: 0;
+  max-width: 48rem;
+}
+.blueprint-cta .btn {
+  align-self: flex-start;
+}
+
+/* In-Article Blueprint Breadcrumb */
+.article-blueprint-badge {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.5rem;
+  font-size: 0.82rem;
+  padding: 0.35rem 0.85rem;
+  background: rgba(41, 92, 255, 0.08);
+  border: 1px solid rgba(41, 92, 255, 0.2);
+  border-radius: var(--radius);
+  color: var(--ink);
+  text-decoration: none;
+  margin-bottom: 1.25rem;
+  transition: all 0.15s ease;
+}
+.article-blueprint-badge:hover {
+  border-color: var(--brand);
+  background: rgba(41, 92, 255, 0.14);
+}
+.article-blueprint-badge strong {
+  color: var(--brand);
+}
+
+@media (max-width: 768px) {
+  .blueprint-stats-grid {
+    grid-template-columns: repeat(2, 1fr);
+  }
+  .blueprint-hero h1 {
+    font-size: 1.65rem;
+  }
+}
+
 /* ---------- Creative Lab Strip (GPU & Multimodal Lab) ---------- */
 .creative-lab-strip {
   margin-top: 3.5rem;