memory: decide whether to move the default graph file out of the package directory (breaking) #5346

Follow-up to #4117, whose fix is deliberately non-breaking: a startup warning on stderr when the memory file is inside a node_modules directory, and README guidance to set MEMORY_FILE_PATH to an absolute path the user owns.

The decision

Should @modelcontextprotocol/server-memory stop defaulting its graph file to memory.jsonl beside dist/index.js, and default instead to a per-user data directory (for example $XDG_DATA_HOME / ~/Library/Application Support / %APPDATA%)?

Under npx or an npm install the current default is inside node_modules, so a reinstall, an update or a cleared npx cache can delete the graph. Setting MEMORY_FILE_PATH avoids that, and the server now warns when it is not avoided, but the default itself is still the fragile location.

Why this is a maintainer decision, not a fix

• It is a breaking change (a major version of the package): every user relying on the default would start on an empty graph unless the server migrates the old file, and the old file is only findable from the install it lived in. An npx cache entry for a new version is a different directory, so a new version cannot reliably find the previous version's file to migrate it.
• Docker depends on the current default: the README's Docker setup (and the VS Code install badges, which embed it) mounts the named volume claude-memory over /app/dist, which also shadows the image's code with the volume's copy after first use. Moving the default needs a matching Docker change (a volume on a data directory plus MEMORY_FILE_PATH), and a migration story for the files already in that volume.
• Prior art: the closed prototype fix(memory): default persistence path to user data directory (#4117) #4272 moved the default with a legacy-file migration.

Options

1. Keep the default; the warning and the README guidance from memory: safer persistence defaults, atomic writes, quotas, redaction, and destructive-operation guardrails #4117 stand (status quo).
2. Move the default in a major release, with a best-effort migration from the package directory and a release note.
3. Make MEMORY_FILE_PATH required in a major release, failing at startup with a message naming a suggested path.