Ask the repository that owns the path, and pin the wirings that had no test

Round four of the independent review found seven record and coverage
defects. The functional side it verified by running; these are the fixes.

- `_tracked` asked the current checkout's index, so a reviewer in a worktree
  pointing at the main checkout's committed report was told it was untracked.
  It now asks the repository that owns the path, and the guard no longer
  compares directories: any tracked file is committed evidence.
- `retrieval.py` claimed the dense index "catches up inside search". It does
  not: `_stale` is only used by `sync()` and `stats()`, so a store upgraded
  from v11 ranks an empty dense leg until `ely-eye build-dense-index` runs.
  The docstring now states that, and `doctor` already names it.
- Four wirings had no discriminating test, each proven by mutation:
  a stubbed `_tracked` (now a test uses the real git index), `copy_store`
  claiming the scratch (now a live holder blocks the copy before a byte is
  copied), `_stale` reading the atoms table (now a closed memory that loses
  its vector is owed one), and the v10/v11 to v12 `DROP VIEW` gate (now a
  hand-made v11 store is upgraded and its view body re-checked).
- The record corrected against the reviewer's measurements: the five
  mutations did not each turn one test red (M1 turned two, M3 turned two,
  `_stale` alone turned none), the pyright/mypy file set was wrong, and the
  round added seven tests rather than three.

Gates: 422 passed; ruff clean; filesize clean; audit clean; mypy 24 errors in
9 files repo-wide, equal to the 9cb46c1 baseline; pyright 0 on the nine
touched files; zero whole-line comment blocks over 157 tracked files.

backend/src/ely_eye/retrieval.py

@@ -104,7 +104,9 @@ class RetrievalService:
 
         Every filter is applied inside the engine, in the same statement as the nearest-neighbour
         walk, so a scoped search cannot return a memory the caller was never allowed to see. The
-        index catches up inside `search`, so nothing here has to rebuild it first.
+        writer indexes a memory in the call that saves it, so a search never waits for a rebuild;
+        a store upgraded from an older schema is the exception, and `ely-eye doctor` names it until
+        `ely-eye build-dense-index` runs.
         """
         query_vector = self.embeddings.embed_query(query)
         return self.vectors.search(

backend/tests/test_memory_schema.py

@@ -311,3 +311,34 @@ def test_a_ninth_version_database_gains_the_tiers_in_place(tmp_path: Path) -> No
     assert hidden == 0, (
         "the old view body survived the upgrade, so an archived memory would still answer"
     )
+
+
+def test_an_eleventh_version_database_learns_that_a_future_retirement_is_still_current(tmp_path: Path) -> None:
+    """v11's view hid a memory whose retirement is scheduled for next year; the upgrade must rewrite the body."""
+    clock = datetime.now(UTC)
+    database = _database(tmp_path)
+    _seed_source(database)
+    database.upsert_atoms([_atom("key", ingested_at=clock, valid_from=clock, valid_to=clock + timedelta(days=365))])
+    with database.connect() as connection:
+        # The body v11 shipped, written out here so the upgrade is judged against the thing it replaced.
+        connection.executescript(
+            """
+            DROP VIEW IF EXISTS v_atoms_current;
+            CREATE VIEW v_atoms_current AS
+              SELECT * FROM atoms
+              WHERE valid_to IS NULL
+                AND (valid_from IS NULL OR valid_from <= strftime('%Y-%m-%dT%H:%M:%f+00:00','now'))
+                AND (retention_until IS NULL OR retention_until >= strftime('%Y-%m-%dT%H:%M:%f+00:00','now'));
+            PRAGMA user_version = 11;
+            """
+        )
+        hidden = connection.execute("SELECT count(*) FROM v_atoms_current").fetchone()[0]
+    assert hidden == 0, "the fixture must really look like a v11 store before it is upgraded"
+
+    upgraded = _database(tmp_path)
+    with upgraded.connect() as connection:
+        assert int(connection.execute("PRAGMA user_version").fetchone()[0]) == SCHEMA_VERSION
+        visible = [str(row[0]) for row in connection.execute("SELECT atom_id FROM v_atoms_current")]
+    assert visible == ["key"], (
+        "the old view body survived, so a memory retiring next year would answer nothing today"
+    )

backend/tests/test_vector_index.py

@@ -244,6 +244,22 @@ def test_a_superseded_memory_keeps_its_vector_but_leaves_the_current_answer_alon
     assert list(then) == [old.atom_id], "asked before the retirement, the old memory is still findable"
 
 
+def test_a_closed_memory_owes_the_index_a_vector_even_though_it_answers_nothing_now(
+    tmp_path: Path, fake_embeddings: Callable[[], Any]
+) -> None:
+    """`sync` walks the atoms table, not the current view, or an as-of question would find nothing."""
+    settings, database = _settings(tmp_path), Database(_settings(tmp_path))
+    index = _index(settings, database, fake_embeddings)
+    memory = _memory(settings, database, index)
+    old = memory.remember(KEYS, holder_id="wife", origin=MemoryOrigin.self_)
+    memory.supersede(old.atom_id, text=PASSPORT, holder_id="wife")
+    index.drop_atoms([old.atom_id])
+
+    assert index.stats()["pending"] == 1, "the closed memory answers nothing now, but the index still owes it a vector"
+    assert index.sync()["encoded"] == 1, "sync re-encodes the closed memory rather than skipping it"
+    assert index.stats()["vectors"] == 2
+
+
 def test_a_store_that_never_built_its_index_says_so_instead_of_stalling_a_search(
     tmp_path: Path, fake_embeddings: Callable[[], Any]
 ) -> None: