0.2.64 update

CLAUDE.md

@@ -80,6 +80,7 @@ docker compose up -d --build        # from the repo root; needs .env (see .env.e
 ```powershell
 .\deploy-server.ps1                                   # local tree -> 10.0.0.213:/share/Docker/Memby
 .\deploy-server.ps1 -SourceDirectory C:\src\memby -Destination /share/Docker/Memby-test
+.\deploy-server.ps1 -SkipAppRelease -SkipBuilder      # server/admin-only; reuse Android builder image
 ```
 
 It tars the local `server/`, `docker-compose.yml` and `.env.example`, and streams them over
@@ -87,7 +88,9 @@ one SSH connection (interactive password; stdin carries the
 archive, so OpenSSH prompts on the tty). The remote half stages into
 `<destination>.new.$$`, builds, then swaps directories and waits for all three health
 checks, restoring the previous release if anything fails. The named Postgres volume is
-preserved — it never runs `compose down -v`.
+preserved — it never runs `compose down -v`. For a server/admin-only change, combine
+`-SkipAppRelease -SkipBuilder`: this skips the local APK build and preserves the running
+Android builder container and image while only the gateway and admin console are replaced.
 
 **`.env.example` is the configuration.** It holds real values, and every deployment
 overwrites the NAS's `.env` with the local copy (the old one is kept beside it as
@@ -126,13 +129,24 @@ patch` (0.1.53 → 153). Bump both together — the in-app updater compares `ver
 while Android refuses an APK whose `versionCode` went backwards. `release.ps1 -Version`
 rewrites both, so prefer it over editing the build file by hand.
 
-**Releases.** APKs are self-hosted (NAS or any web server), not on a store. `release.ps1`
-builds a signed APK and assembles `dist/out/` — `index.html` (landing page from
-`dist/template/`), `latest.json` (the manifest the app polls) and the versioned APK.
-Release signing reads `memby.keystore` and friends from `local.properties`; with no
-keystore the build still succeeds but emits an unsigned APK and logs a warning. The key
-matters more than the code: Android identifies an app by applicationId **plus** signing
-key, so a changed key forces every user to uninstall and reinstall.
+**Releases.** APKs are self-hosted (NAS or any web server), not on a store. The preferred
+The normal NAS path is Admin Console → App updates → **Build latest release**. The isolated
+service under `builder/` fetches the highest semantic GitHub tag, builds that exact source,
+verifies the APK and publishes it through the gateway into the shared `memby-releases`
+volume. An exact tag may be selected as a deliberate fallback, and
+`docker compose run --rm --build memby-builder release` remains the controller-independent
+command-line fallback. Its keystore, signing credentials and release-publish token are
+read-only Compose secrets under `/run/secrets`; the Gradle cache is a named volume. See
+`builder/README.md`.
+
+The existing `release.ps1` compatibility path builds a signed APK and assembles
+`dist/out/` — `index.html` (landing page from `dist/template/`), `latest.json` (the manifest
+the app polls), the versioned APK and its `.sha256` checksum. Local signing reads
+`memby.keystore` and friends from `local.properties`; with no keystore the build still
+succeeds but emits an unsigned APK and logs a warning. The key matters more than the code:
+Android identifies an app by
+applicationId **plus** signing key, so a changed key forces every user to uninstall and
+reinstall.
 
 Every version bump is also a publish operation: update the version and changelog together,
 commit the complete release, and push it to GitHub. Never leave a bumped version only in the
@@ -611,6 +625,10 @@ pieces make that true and each is easy to undo:
   `json`; the ring buffer the admin page reads is fed the same records in every format.
   That ring is restored from a bounded JSONL archive in the persistent `memby-logs`
   volume, so a deployment replaces the process without erasing the operator's history.
+  History compaction materialises the ordered ring only once per ringful; do not move
+  that copy back onto every append. Cursor reads calculate their ring offset directly.
+  The Admin Console retains and filters the full delivered window but virtualises the
+  display, caches each record's formatted/searchable form and stops polling while hidden.
 - `internal/api/logcontext.go` carries a **`*requestIdentity` in the request context**.
   `withLogging` creates it from the route and the client headers; `authed` fills in the
   viewer and television once the session resolves; both the handler's own events