Give the assistant a standing memory file

A small operator-written file handed to the model at the start of every
conversation — who you are, how this install is set up, what has already been
decided. Injected ahead of the retrieved passages and marked operator-authored
so it outranks anything they contradict, and never cited as a source.

Deliberately not indexed and deliberately under DATA_DIR: it changes
constantly, vector similarity is the wrong way to retrieve things you were
told to remember, and gitignoring it keeps personal notes out of a pushed
repository. The character cap is a context budget — this text costs its share
of 16k on every single turn.

Deployment/master.conf.template

@@ -1626,6 +1626,21 @@
     AI_SEARCH_K=8                   # chunks retrieved per query
     AI_SEARCH_PER_FILE=3            # cap per file so one document cannot fill the context
 
+# ━━━ AI Memory ━━━
+# A small operator-maintained file the assistant is given at the start of every conversation:
+# who you are, how this install is set up, decisions already made, things it should stop asking.
+#
+# Injected into the prompt, never indexed. It lives under DATA_DIR, which is gitignored — that
+# is deliberate and load-bearing. Indexing it would embed a file that changes constantly, and
+# vector similarity is the wrong way to retrieve "things I was told to remember"; it also keeps
+# personal notes out of a repository that gets pushed.
+#
+# The character cap is a context budget, not a style guide. At 16384 the retrieved passages,
+# the model's reasoning and the conversation history are already competing; memory takes its
+# share off the top of every single turn, so keep it short and factual.
+    AI_MEMORY_FILE="$DATA_DIR/ai_memory.md"
+    AI_MEMORY_MAX_CHARS=4000        # ~1000 tokens — truncated with a notice if exceeded
+
 # ━━━ AI Retrieval Bridge ━━━
 # AI/ai_serve.js — a retrieval-only HTTP endpoint for clients that cannot see this filesystem.
 # Open-WebUI runs in its own container with no WebGUI session, and nginx applies auth_request to