Function resolve_data_dir 

pub fn resolve_data_dir(
    env_override: Option<&str>,
    saved: Option<&SelectedMemory>,
    working_dir: &Path,
    user_data_home: &Path,
) -> ResolvedDataDir

Resolution order: the environment override, then the saved selection, then the project .kernel/, then the per-user default.

KMP_MCP_DATA_DIR stays first because it is the most explicit and most local thing anyone can say, and every test, baseline and reproduction script depends on that override meaning exactly one process. A saved selection then beats automatic discovery, which is the whole point of saving one: a workspace with no project marker must reach the memory the operator chose, not whatever the per-user default happens to hold.

Pure function for testability; resolve_data_dir_from_env feeds it from the process environment and the user config file.