derived_data.t27: which Boundary paths are derived records (seals, the t27b ledger, FROZEN_HASH), for gc_pair and the refresh bot #9057

Part of #9021 (item 2: derived files are not owned). This is the data that the dispatcher's conflict decision (gc_pair, #9029) marks as GC_EDIT_DERIVED. The same list can feed the refresh bot's only_derived.

Problem

• The Queen reads every Boundary path as a source. On 2026-10-11 at 10:57Z, 13 issues were shut out only because another issue held .trinity/seals/.
• The open backlog has 25 Boundaries that name .trinity/seals/ and 8 that name bootstrap/stage0/FROZEN_HASH. FROZEN_HASH is the digest of compiler.rs, so once regions land, two compiler.rs fixes in disjoint functions would still collide on it.
• queen/golden_chain.t27 (spec(queen): golden chain, the pipeline's own version control -- land on verdicts, not on a queue (Closes #9027) #9029) says a derived path is REGEN, never a conflict. It leaves the marking to the host ("is_gen, derived_data kinds"), but no t27 function maps a path to a derived record.

User Scenarios

• Given two issues that both list .trinity/seals/, when the dispatcher asks which paths are derived, then both are marked derived, and gc_pair answers REGEN rather than MEET.
• Given an issue listing bootstrap/src/compiler.rs, when the dispatcher asks, then it is a source.
• Given .trinity/sealsx/a.json or docs/reports/t27b_expectations.json.bak, when the dispatcher asks, then neither is derived.

Requirements

• FR-001: specs/ci/derived_data.t27 MUST map a Boundary path to the derived record it names: .trinity/seals/ and everything under it, docs/reports/t27b_expectations.json, bootstrap/stage0/FROZEN_HASH. Every other path MUST be a source.
• FR-002: The path MUST be read as QueenBoundaryPaths.normalize reads it. A directory MUST match only at a /.
• FR-003: The spec MUST say what this does not promise: on today's GitHub squash path, nothing regenerates the ledger.

Success Criteria

• t27c test-report specs/ci/derived_data.t27 shows seals_the_ledger_and_frozen_hash_are_derived_paths and sources_and_near_misses_are_not_derived passing, 0 FAIL, 0 vacuous.
• Dropping the seal line from derived_path_kind makes seals_the_ledger_and_frozen_hash_are_derived_paths FAIL.

Boundary

• specs/ci/derived_data.t27
• .trinity/seals/ci_DerivedData.json

🤖 Generated with Claude Code