feat(framework+cli): fw-4.14.2 / cli-3.13.1 — TDE terminal resolved (closes #149) (#151)

Closes #149 — surfaced by Sentinel post-CHARTER-17 housekeeping. TDE
adopters who keep documents on disk as audit history after the debt is
paid had no canonical status to mark the closure; `accepted` /
`superseded` / `deprecated` all carry the wrong semantics. The
validator rejected `resolved` with META-003.

This release ships Option A of the issue's proposal triplet (flat enum
+ `resolved`) and documents Option B (per-doc-type lifecycle vocabulary)
as the deliberate next evolution.

CLI changes (cli-3.13.1):
- cli/src/validation.rs:48: add `resolved` to VALID_STATUSES with an
  extensive comment explaining (1) the TDE semantics it captures vs.
  the alternatives, (2) why Option A ships now over B/C, and (3) what
  the future per-doc-type lookup will tighten.
- cli/tests/validate_test.rs: two new regression tests —
  `test_validate_tde_resolved_terminal_state` (positive) and
  `test_validate_rejects_non_canonical_ailog_terminals` (negative;
  `final` / `closed` / `completed` continue to fail per #149's
  Sentinel-invention caveat).

Framework changes (fw-4.14.2):
- dist/.straymark/00-governance/DOCUMENTATION-POLICY.md §3 (EN + ES +
  zh-CN): lifecycle diagram extended with the `resolved` terminal
  branch; new row in the status table with the principled distinction
  from `accepted` / `superseded` / `deprecated`; §6 TDE row annotated
  with the `identified → resolved` lifecycle.
- dist/.straymark/templates/TEMPLATE-TDE.md (EN + ES + zh-CN):
  frontmatter `status: identified` annotated with the transition; new
  optional `## Resolution` body section (Resolved by / Date /
  Verification / Notes).

Adopter guidance: `straymark update-framework` + `straymark update-cli`
unblock TDE files marked `status: resolved` immediately. AILOGs
invented `final` / `closed` / `completed` continue to fail —
canonical AILOG terminal is `accepted` per TEMPLATE-AILOG.md.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: montfort

CHANGELOG.md

@@ -7,6 +7,39 @@ and this project uses [independent versioning](README.md#versioning) for Framewo
 
 ---
 
+## Framework 4.14.2 / CLI 3.13.1 — TDE terminal `resolved` (closes #149)
+
+Closes [#149](https://github.com/StrangeDaysTech/straymark/issues/149) — surfaced by Sentinel post-CHARTER-17 housekeeping. TDE adopters who keep documents on disk as audit history after the debt is paid had no canonical status to mark the closure; `accepted` / `superseded` / `deprecated` all carry the wrong semantics. The validator rejected `resolved` with `META-003`.
+
+This release ships **Option A** of the issue's proposal triplet (flat enum + `resolved`) and documents **Option B** (per-doc-type lifecycle vocabulary) as the deliberate next evolution.
+
+### Added (CLI)
+
+- **`resolved`** is now a valid value in `VALID_STATUSES` (`cli/src/validation.rs:48`). Adopter-facing effect: `straymark validate` accepts `status: resolved` on TDE documents without `META-003`. Two new tests pin the behavior:
+  - `test_validate_tde_resolved_terminal_state` — TDE with `status: resolved` passes.
+  - `test_validate_rejects_non_canonical_ailog_terminals` — `final`, `closed`, `completed` (Sentinel's invented AILOG terminals reported in #149) continue to fail with `META-003`. Adopters using these on AILOGs should migrate to `accepted` per `TEMPLATE-AILOG.md` and `DOCUMENTATION-POLICY.md §6`.
+
+### Changed (Framework)
+
+- **`dist/.straymark/00-governance/DOCUMENTATION-POLICY.md` §3 (EN + i18n/es + i18n/zh-CN)** — lifecycle diagram extended with the `resolved` terminal branch (TDE-only); new `resolved` row in the status table with the principled distinction from `accepted` / `superseded` / `deprecated`; §6 table column updated to note that TDE enters at `identified` and has its own terminal `resolved`.
+- **`dist/.straymark/templates/TEMPLATE-TDE.md` (EN + i18n/es + i18n/zh-CN)** — frontmatter `status: identified` annotated with the `→ resolved` transition; new optional `## Resolution` body section (omit while the debt is still open) with fields for Resolved by / Date / Verification / Notes.
+
+### Deliberately deferred (Option B)
+
+The principled fix to the per-doc-type lifecycle vocabulary problem is to promote the flat `VALID_STATUSES` enum to a `HashMap<DocType, Vec<&str>>` so each doc type has its own canonical state machine and the validator inspects `doc.doc_type` before deciding which set to apply. The reasons to defer:
+
+- Option A unblocks adopters today (Sentinel reports 2 TDE files with `status: resolved`); shipping it is ~30 LOC + docs.
+- Option B is ~150 LOC + a per-type test matrix expansion + non-trivial decisions about which terminals each type should have. Doing it pre-announcement risks calcifying choices we'd rather make based on a second adopter's lifecycle needs.
+- The `VALID_STATUSES` constant doc-comment in `validation.rs` and the explanatory paragraph in `DOCUMENTATION-POLICY.md §3` both name the trade-off explicitly: "TDE is the only type today with a custom terminal; the validator accepts `resolved` globally as a stop-gap. Issue #149 Option B will scope `resolved` strictly to TDE; until then, using it on non-TDE documents passes validation but is semantically incorrect."
+
+### Adopter guidance
+
+- `straymark update-framework` brings the new `TEMPLATE-TDE.md` and `DOCUMENTATION-POLICY.md`. Existing TDE files are unaffected — the template change is purely additive.
+- `straymark update-cli` brings the relaxed validator. TDE files marked `status: resolved` start passing immediately.
+- Sentinel-side AILOGs marked `final` / `closed` / `completed` continue to fail validation. The fix is to migrate those to `accepted` (the canonical AILOG terminal per `TEMPLATE-AILOG.md`) and capture the "work completed" semantics in the body or in the originating Charter's telemetry, not in the AILOG status field.
+
+---
+
 ## Framework 4.14.1 — Docs sync for batch-complete + Batch Ledger discoverability
 
 Framework-only patch that closes the documentation gap left by `fw-4.14.0` / `cli-3.13.0`. The release added the `batch-complete` subcommand and the Batch Ledger workflow but didn't surface them in three places adopters and contributors discover the project from: the root `README.md` (and i18n overlays), the project's user-facing comparison/feature lists, and **`dist/STRAYMARK.md`** — the governance file shipped to every adopter via `straymark init`.

README.md

@@ -274,8 +274,8 @@ StrayMark uses independent version tags for each component:
 
 | Component | Tag prefix | Example | Includes |
 |-----------|-----------|---------|----------|
-| Framework | `fw-` | `fw-4.14.1` | Templates (12 types), governance, directives, Charter template + schema |
-| CLI | `cli-` | `cli-3.13.0` | The `straymark` binary |
+| Framework | `fw-` | `fw-4.14.2` | Templates (12 types), governance, directives, Charter template + schema |
+| CLI | `cli-` | `cli-3.13.1` | The `straymark` binary |
 
 Check installed versions with `straymark status` or `straymark about`.
 
@@ -307,7 +307,7 @@ See [CLI Reference](https://github.com/StrangeDaysTech/straymark/blob/main/docs/
 ```bash
 # Download the latest framework release ZIP from GitHub
 # Go to https://github.com/StrangeDaysTech/straymark/releases
-# and download the latest fw-* release (e.g., fw-4.14.1)
+# and download the latest fw-* release (e.g., fw-4.14.2)
 
 # Extract and copy to your project
 unzip straymark-fw-*.zip -d your-project/

cli/Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "straymark-cli"
-version = "3.13.0"
+version = "3.13.1"
 edition = "2021"
 description = "CLI for StrayMark — the cognitive discipline your AI-assisted projects need"
 license = "MIT"

cli/Cargo.toml

@@ -42,14 +42,33 @@ impl ValidationResult {
 }
 
 /// Valid status values per DOCUMENTATION-POLICY.md §3 lifecycle + §6 per-type defaults.
-/// `identified` is the canonical TDE entry state (agent-driven discovery, awaits
-/// human prioritization); functionally equivalent to `draft` for lifecycle gating
-/// but semantically distinct in adopter analytics.
+///
+/// - `identified` is the canonical TDE entry state (agent-driven discovery, awaits
+///   human prioritization); functionally equivalent to `draft` for lifecycle gating
+///   but semantically distinct in adopter analytics (regression #130).
+/// - `resolved` is the canonical TDE terminal state for "the debt described here
+///   was addressed; document is kept on disk as audit history". Neither `accepted`
+///   ("we accept this debt continues to exist"), `superseded` ("another TDE took
+///   its place"), nor `deprecated` ("the TDE concept itself is no longer relevant")
+///   captures this semantics correctly. Issue #149 surfaced the gap empirically
+///   in Sentinel post-CHARTER-17 housekeeping.
+///
+/// **Per-doc-type lifecycle vocabulary** (Option B in issue #149) is the principled
+/// next evolution: promote this flat enum to a `HashMap<DocType, Vec<&str>>` so each
+/// doc type has its own canonical state machine and the validator inspects
+/// `doc.doc_type` before deciding which set to apply. Deferred deliberately —
+/// shipping Option A (flat enum + `resolved`) keeps the validator's surface stable
+/// and avoids per-type branching until a second doc type needs a non-standard
+/// terminal. Adding `resolved` flat-globally is mildly permissive (an ADR with
+/// `status: resolved` would pass) but the damage is bounded: `DOCUMENTATION-POLICY`
+/// documents `resolved` as TDE-specific, and the per-type expansion in Option B
+/// will tighten the validation without breaking any existing TDE adopters.
 const VALID_STATUSES: &[&str] = &[
     "draft",
     "identified",
     "review",
     "accepted",
+    "resolved",
     "superseded",
     "deprecated",
 ];

cli/src/validation.rs

@@ -349,6 +349,61 @@ fn test_validate_dpia_document_valid() {
         .stdout(predicate::str::contains("passed validation"));
 }
 
+/// Regression test for issue #149: TDE documents can move to `status: resolved`
+/// when the debt described has been addressed. The document is kept on disk as
+/// audit history. `accepted` / `superseded` / `deprecated` do not capture this
+/// semantics correctly.
+#[test]
+fn test_validate_tde_resolved_terminal_state() {
+    let dir = TempDir::new().unwrap();
+    setup_straymark(dir.path());
+
+    create_doc(
+        dir.path(),
+        "06-evolution/technical-debt",
+        "TDE-2026-05-11-001-architectural-refactor.md",
+        "id: TDE-2026-05-11-001\ntitle: Architectural Refactor Debt\nstatus: resolved\ncreated: 2026-05-11\nagent: claude-code-v1.0\nconfidence: high\nreview_required: false\nrisk_level: medium\ntype: architecture\nimpact: high\neffort: medium\ntags:\n  - architecture\nrelated: []\npriority: null\nassigned_to: null",
+    );
+
+    let mut cmd = Command::cargo_bin("straymark").unwrap();
+    cmd.arg("validate")
+        .arg(dir.path().to_str().unwrap())
+        .assert()
+        .success()
+        .stdout(predicate::str::contains("passed validation"));
+}
+
+/// Regression test for issue #149: status values reported by Sentinel as invented
+/// local terminals (`final`, `closed`, `completed`) MUST continue to fail
+/// validation. They are not canonical AILOG terminals — the canonical AILOG
+/// terminal is `accepted` per TEMPLATE-AILOG.md and DOCUMENTATION-POLICY.md §6.
+/// Documented in CHANGELOG fw-4.14.2 / cli-3.13.1 as "adopters using `final` /
+/// `closed` / `completed` should migrate to `accepted`".
+#[test]
+fn test_validate_rejects_non_canonical_ailog_terminals() {
+    for status in ["final", "closed", "completed"] {
+        let dir = TempDir::new().unwrap();
+        setup_straymark(dir.path());
+
+        create_doc(
+            dir.path(),
+            "07-ai-audit/agent-logs",
+            "AILOG-2026-05-13-001-test.md",
+            &format!(
+                "id: AILOG-2026-05-13-001\ntitle: Test\nstatus: {}\ncreated: 2026-05-13\nagent: claude-code-v1.0\nconfidence: high\nreview_required: false\nrisk_level: low\ntags: []\nrelated: []",
+                status
+            ),
+        );
+
+        let mut cmd = Command::cargo_bin("straymark").unwrap();
+        cmd.arg("validate")
+            .arg(dir.path().to_str().unwrap())
+            .assert()
+            .failure()
+            .stdout(predicate::str::contains("META-003"));
+    }
+}
+
 /// Regression test for issue #130: TDE documents ship with `status: identified`
 /// per TEMPLATE-TDE.md and DOCUMENTATION-POLICY.md §6 — the validator must accept
 /// it as a valid lifecycle entry state.

cli/tests/validate_test.rs

@@ -379,4 +379,4 @@ When a project accumulates a high volume of AILOGs across multiple Charters and
 
 ---
 
-*StrayMark v4.14.1 | [Strange Days Tech](https://strangedays.tech)*
+*StrayMark v4.14.2 | [Strange Days Tech](https://strangedays.tech)*

dist/.straymark/00-governance/AGENT-RULES.md

@@ -234,4 +234,4 @@ Use a Level 1 (Context) diagram to illustrate:
 
 ---
 
-*StrayMark v4.14.1 | [Strange Days Tech](https://strangedays.tech)*
+*StrayMark v4.14.2 | [Strange Days Tech](https://strangedays.tech)*

dist/.straymark/00-governance/C4-DIAGRAM-GUIDE.md

@@ -156,17 +156,22 @@ identified ──┐
              │                       └──────► superseded
              │
              └──► (TDE-only entry state, see §6)
+                                      │
+                                      ▼
+                                  resolved
+                                  (TDE-only terminal — debt paid; see §6)
 ```
 
 | Status | Description |
 |--------|-------------|
 | `identified` | Entry state for agent-driven discovery types (TDE today). Functionally equivalent to `draft` for lifecycle gating — a human reviewer is expected to prioritize and promote it. Semantically distinct so adopter analytics can distinguish "agent found this debt" from "human is drafting a deliberate doc". |
 | `draft` | In draft, pending review |
 | `accepted` | Approved and current |
+| `resolved` | **TDE-only terminal state**: the technical debt described in this document has been addressed; the file is kept on disk as audit history. Distinct from `accepted` ("we accept this debt continues to exist"), `superseded` ("another TDE replaced this one"), and `deprecated` ("the TDE concept itself is no longer relevant"). The canonical closing reference (the Charter, PR, or commit that paid the debt) goes in the `## Resolution` body section. |
 | `deprecated` | Obsolete, but kept as reference |
 | `superseded` | Replaced by another document |
 
-The per-type default status mapping lives in §6 — most types enter at `draft` or `accepted`, but TDE enters at `identified` per the agent-autonomy boundary (agent identifies, human prioritizes).
+The per-type default status mapping lives in §6 — most types enter at `draft` or `accepted`, but TDE enters at `identified` per the agent-autonomy boundary (agent identifies, human prioritizes). TDE is the only type today with a custom terminal state (`resolved`); the validator accepts `resolved` globally as a stop-gap. A future per-doc-type lifecycle vocabulary (issue #149 Option B) will scope `resolved` to TDE strictly; until then, using it on non-TDE documents is allowed by the validator but semantically incorrect.
 
 ---
 
@@ -269,7 +274,7 @@ For documents that require multiple reviewers (e.g., ETH with both legal and eng
 | `REQ` | Requirement | `01-requirements/` | `draft` | Yes |
 | `TES` | Test Plan | `04-testing/` | `draft` | Yes |
 | `INC` | Incident Post-mortem | `05-operations/incidents/` | `draft` | Yes |
-| `TDE` | Technical Debt | `06-evolution/technical-debt/` | `identified` | No |
+| `TDE` | Technical Debt | `06-evolution/technical-debt/` | `identified` (enters here; terminal `resolved` when debt paid — TDE-only) | No |
 | `SEC` | Security Assessment | `08-security/` | `draft` | Yes (always) |
 | `MCARD` | Model/System Card | `09-ai-models/` | `draft` | Yes (always) |
 | `SBOM` | Software Bill of Materials | `07-ai-audit/` | `accepted` | No |
@@ -313,4 +318,4 @@ See also [ADR-2025-01-20-001] for architectural context.
 
 ---
 
-*StrayMark v4.14.1 | [Strange Days Tech](https://strangedays.tech)*
+*StrayMark v4.14.2 | [Strange Days Tech](https://strangedays.tech)*

dist/.straymark/00-governance/DOCUMENTATION-POLICY.md

@@ -233,4 +233,4 @@ Contributed via [issue #111](https://github.com/StrangeDaysTech/straymark/issues
 
 ---
 
-*StrayMark v4.14.1 | [Strange Days Tech](https://strangedays.tech)*
+*StrayMark v4.14.2 | [Strange Days Tech](https://strangedays.tech)*