@memoarchitect/ontology 0.11.0 → 0.12.0

package/README.md

@@ -23,7 +23,7 @@ pin an exact release; the package has no repository or runtime dependency on Mem
 Tools or Memo Architect.
 
 ```bash
-pnpm add @memoarchitect/ontology@0.11.0
+pnpm add @memoarchitect/ontology@0.12.0
 ```
 
 > **Pre-1.0 notice:** ontology names, relationships, and package layout may

package/examples/gpca-pump/model/catalog/gpca_system.sysml

@@ -15,7 +15,7 @@ package memo_examples_gpca_pump_gpca_system {
     // retired: "mission" duplicated the regulated intended-use statement.
 
     // ── Functional chains ───────────────────────────────────────
-    part fcPatientBolus : FunctionalFlow {
+    action fcPatientBolus : FunctionalFlow {
         @MemoIdentity { :>> providedId = "FC-001"; }
         attribute :>> name = "PatientBolusChain";
         attribute :>> flowCategory = FunctionalFlowKind::nominal;
@@ -54,7 +54,7 @@ package memo_examples_gpca_pump_gpca_system {
     first fcsBolusCommand then fcsBolusActuate;
     first fcsBolusActuate then fcsBolusLog;
 
-    part fcAlarmStop : FunctionalFlow {
+    action fcAlarmStop : FunctionalFlow {
         @MemoIdentity { :>> providedId = "FC-002"; }
         attribute :>> name = "AlarmDetectionToSafeStateChain";
         attribute :>> flowCategory = FunctionalFlowKind::alarm;
@@ -87,7 +87,7 @@ package memo_examples_gpca_pump_gpca_system {
     first fcsAlarmEvaluate then fcsAlarmStopInfusion;
     first fcsAlarmStopInfusion then fcsAlarmAnnunciate;
 
-    part fcStartup : FunctionalFlow {
+    action fcStartup : FunctionalFlow {
         @MemoIdentity { :>> providedId = "FC-003"; }
         attribute :>> name = "PowerOnSelfTestChain";
         attribute :>> flowCategory = FunctionalFlowKind::startup;

package/extensions/aadl/memo.package.yaml

@@ -7,7 +7,7 @@
 # (`type`, `extends`, `usage`, `ontologies`, `methodology`, `modules`) were
 # removed at the native semantic flip and are now rejected if present.
 name: '@memoarchitect/extension-aadl'
-version: 0.11.0
+version: 0.12.0
 description: AADL (SAE AS5506) correspondence profile and runtime component families
 license: MIT
 tags:

package/extensions/cloud/memo.package.yaml

@@ -7,7 +7,7 @@
 # (`type`, `extends`, `usage`, `ontologies`, `methodology`, `modules`) were
 # removed at the native semantic flip and are now rejected if present.
 name: '@memoarchitect/extension-cloud'
-version: 0.11.0
+version: 0.12.0
 description: Networked services and managed data stores
 license: MIT
 tags:

package/extensions/container/memo.package.yaml

@@ -7,7 +7,7 @@
 # (`type`, `extends`, `usage`, `ontologies`, `methodology`, `modules`) were
 # removed at the native semantic flip and are now rejected if present.
 name: '@memoarchitect/extension-container'
-version: 0.11.0
+version: 0.12.0
 description: OCI container images and container runtimes as deployment content
 license: MIT
 tags:

package/extensions/messaging/memo.package.yaml

@@ -7,7 +7,7 @@
 # (`type`, `extends`, `usage`, `ontologies`, `methodology`, `modules`) were
 # removed at the native semantic flip and are now rejected if present.
 name: '@memoarchitect/extension-messaging'
-version: 0.11.0
+version: 0.12.0
 description: Publish/subscribe messaging — topics, brokers, and delivery semantics
 license: MIT
 tags:

package/extensions/ros/memo.package.yaml

@@ -7,7 +7,7 @@
 # (`type`, `extends`, `usage`, `ontologies`, `methodology`, `modules`) were
 # removed at the native semantic flip and are now rejected if present.
 name: '@memoarchitect/extension-ros'
-version: 0.11.0
+version: 0.12.0
 description: ROS 2 nodes, messages, topic/service/action interfaces, QoS, and containerized deployment
 license: MIT
 tags:

package/methodologies/default/memo.package.yaml

@@ -7,7 +7,7 @@
 # (`type`, `extends`, `usage`, `ontologies`, `methodology`, `modules`) were
 # removed at the native semantic flip and are now rejected if present.
 name: '@memoarchitect/methodology-default'
-version: 0.11.0
+version: 0.12.0
 description: "MEMO default medical-device methodology \u2014 selects viewpoints/views/DHF documents from @memoarchitect/ontology and adds rules, gates, patterns, profiles, and workflow."
 license: MIT
 tags:

package/methodologies/gpca/memo.package.yaml

@@ -7,7 +7,7 @@
 # (`type`, `extends`, `usage`, `ontologies`, `methodology`, `modules`) were
 # removed at the native semantic flip and are now rejected if present.
 name: '@memoarchitect/methodology-gpca'
-version: 0.11.0
+version: 0.12.0
 description: "GPCA infusion pump methodology \u2014 subtraction-based tailoring of @memoarchitect/methodology-default for the non-networked prototype variant. Excludes cybersecurity and SOUP."
 license: MIT
 tags:

package/ontology/memo.package.yaml

@@ -7,7 +7,7 @@
 # (`type`, `extends`, `usage`, `ontologies`, `methodology`, `modules`) were
 # removed at the native semantic flip and are now rejected if present.
 name: '@memoarchitect/ontology'
-version: 0.11.0
+version: 0.12.0
 description: "MEMO \u2014 the single canonical medical-device ontology: core semantics, the Arcadia-inspired architecture layers (context, requirements, behavior, structure, interfaces, risk, cybersecurity,\
   \ assurance, \u2026), compliance, viewpoints, views, and invariant rules. One namespace (memo::), one src/ tree."
 license: MIT

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@memoarchitect/ontology",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "packageManager": "pnpm@9.15.0",
   "description": "MEMO — Medical Engineering Modelling Ontology. Pure SysML v2 medical-device ontology with native constraints, portable to any conformant SysML v2 tool (SysIDE, SysON, sysand).",
   "scripts": {

package/profile/memo.package.yaml

@@ -7,7 +7,7 @@
 # (`type`, `extends`, `usage`, `ontologies`, `methodology`, `modules`) were
 # removed at the native semantic flip and are now rejected if present.
 name: '@memoarchitect/medical-modeling-profile'
-version: 0.11.0
+version: 0.12.0
 description: Closure rules and viewpoints for medical device modeling
 license: MIT
 tags:

package/src/architecture/functional/behavior/memo_behavior.sysml

@@ -88,7 +88,14 @@ package memo_architecture_functional_behavior {
         attribute constraintKind : TimingConstraintKind;
         attribute minMs : String;
         attribute maxMs : String;
-        ref referenceElement : MemoPart[1];
+        // Untyped, the way `InteractsInContext::systemOfInterest` is: what a
+        // latency or period is measured against is a behaviour at least as
+        // often as it is a structure — a functional flow, an action, a port.
+        // `MemoPart[1]` said otherwise and could only ever have held the
+        // structural half, which is the same A0 residue that kept
+        // `FunctionalFlow` a part def. MEMO has no root above the metaclasses
+        // by design, so spanning them means naming none.
+        ref referenceElement[1];
         attribute verificationMethod : MemoVerificationMethodKind;
     }
 }

package/src/architecture/functional/functions/memo_functions.sysml

@@ -17,7 +17,9 @@
 // ZERO example files. The ends are metaclass-neutral now (CR-ONT-060..073), so
 // the split has no cause and is gone: OperativeAction is merged into the function
 // family, and its `actionKind` moved onto MemoFunction where it was always
-// describing the function anyway.
+// describing the function anyway. `FunctionalFlow` was the one element A0 left
+// behind on the part side; it is an `action def` now, for the same reason and
+// on the same evidence.
 //
 // `functionCategory` and `actionKind` are NOT two spellings of one axis, and
 // merging them would lose information. `actionKind` is the verb — sense,
@@ -112,7 +114,19 @@ package memo_architecture_functional_functions {
 
     // A reusable functional route through system responsibilities. Functional
     // flows are part of functional architecture, never logical structure.
-    part def FunctionalFlow specializes MemoPart {
+    //
+    // An `action def`, like every other behaviour in MEMO. It was
+    // `part def ... specializes MemoPart` for the Track A0 reason described at
+    // the top of this file — relation ends typed on part-based types, and
+    // KerML forbids a behaviour from specializing one — and it was the single
+    // element A0 did not carry across when that reason went away. A route
+    // through responsibilities is the same shape as the `OperationalWorkflow`
+    // and `OperativeScenario` it sits beside: the scenarios package calls a
+    // scenario "a selected path through a workflow (or functional flow)",
+    // naming the two as one kind of thing, and its steps are `action def`s
+    // already. A structure whose whole body is `perform` is a behaviour that
+    // has not been allowed to say so.
+    action def FunctionalFlow specializes MemoAction {
         attribute flowCategory : FunctionalFlowKind;
         attribute endToEndLatencyBudgetMs : String;
         attribute safetyRelevant : Boolean;

package/src/architecture/implementation/ui/memo_ui.sysml

@@ -115,21 +115,15 @@ package memo_architecture_implementation_ui {
         attribute uiTechnology : String;
     }
 
-    // What a rendered control and a physical one genuinely share: a label, an
-    // accessibility story, and — when they annunciate — an alarm character.
-    // The base exists so that the §18 traceability relations can type against
-    // "something the user interacts with" rather than against software
-    // specifically. Without it a use error on a knob would be unmodellable,
-    // because ErrorAtElement would only accept a UIElement.
-    abstract part def InteractionElement specializes MemoPart {
-        attribute labelText : String;
-        attribute accessibilitySummary : String;
-        // alarm annunciation (optional; IEC 60601-1-8)
-        attribute alarmPriority : NotificationPriorityKind[0..1];
-        attribute annunciationModality : String;
-        attribute silenceable : Boolean;
-    }
-
+    // `InteractionElement` was an abstract base over UIElement and
+    // OperatorInterfaceElement, existing so the §18 relations could type
+    // against "something the user interacts with". It was both redundant and
+    // too narrow: the nearest real common ancestor is already `MemoPart`, and
+    // IEC 62366-1 puts the whole means of interaction in scope — a mis-keyed
+    // connector, a moulded marking on a housing, a tube routed backwards are
+    // use errors at parts that were never interaction elements and so could
+    // not be named. `ErrorAtElement` and `ElementTriggersAction` now take
+    // `MemoPart`; the attributes moved to whichever type actually set them.
 
     // One UIElement — the single UI part type. The widget form — holding
     // (screen/panel/dialog), acting (button/knob/slider), presenting
@@ -153,8 +147,20 @@ package memo_architecture_implementation_ui {
     // CODE, and a screen is not a source module. Runtime processes are
     // SoftwareComponent, code is SoftwareModule, and the UI is a third view of
     // the same software — a sibling of those, not a kind of either.
-    part def UIElement specializes SoftwareElement, InteractionElement {
+    part def UIElement specializes SoftwareElement {
         attribute formKind : UIElementFormKind;
+        // The visible label. Held here rather than on a shared interaction
+        // base: a physical control's label is moulded or printed, and is
+        // `legendText` on OperatorInterfaceElement.
+        attribute labelText : String;
+        // ── alarm annunciation (optional; IEC 60601-1-8) ──
+        // On the rendered element, because that is where every modelled
+        // annunciation lives. A physical annunciator that needs a priority
+        // wants an alarm concept of its own, not three attributes copied onto
+        // every front-panel part.
+        attribute alarmPriority : NotificationPriorityKind[0..1];
+        attribute annunciationModality : String;
+        attribute silenceable : Boolean;
         // ── screen layout (optional; set for elements that are laid out) ──
         // Bounds are relative to the parent element in the Composes tree; a
         // root screen's bounds are the full frame.
@@ -222,7 +228,7 @@ package memo_architecture_implementation_ui {
         enum printedMarking;
     }
 
-    part def OperatorInterfaceElement specializes PhysicalComponent, InteractionElement {
+    part def OperatorInterfaceElement specializes PhysicalComponent {
         attribute formKind : OperatorInterfaceFormKind;
         // actuation (optional; set for actuated forms)
         attribute actuationForce : String;
@@ -267,7 +273,17 @@ package memo_architecture_implementation_ui {
         attribute intent : InteractionIntentKind;
     }
 
-    action def UIAction specializes MemoAction {
+    // Clicking a button IS an operative action: it has a trigger, a
+    // precondition, a criticality, a potential harm and a frequency of use,
+    // exactly as turning a knob does. Specializing MemoAction directly made
+    // UIAction a SIBLING of OperativeAction, which cost two things — a UI
+    // action could carry none of those ten attributes, and `CommitsUseError`
+    // (source end: OperativeAction) would not accept it, so a use error
+    // committed by a click was unmodellable.
+    //
+    // The three attributes here are what a UI action adds on top: what the
+    // user meant by it, what came back, and whether it asks first.
+    action def UIAction specializes OperativeAction {
         attribute intent : InteractionIntentKind;
         attribute feedbackProvided : String;
         attribute confirmationRequired : Boolean;
@@ -310,8 +326,13 @@ package memo_architecture_implementation_ui {
     // from here, and only this relation says so.
 
     // ── §18 traceability ─────────────────────────────────────────
+    // Source is `MemoPart`, not a UI-specific base: a foot pedal and a
+    // rendered button trigger the same kind of action, and the two are a
+    // PhysicalComponent and a SoftwareElement whose only common ancestor is
+    // MemoPart. CR-MED-111 still holds rendered controls to it, and it is
+    // scoped to UIElement, so the wider end does not weaken the rule.
     connection def ElementTriggersAction :> MemoRelationship {
-        end element : InteractionElement :>> source;
+        end element : MemoPart :>> source;
         end triggeredAction : UIAction :>> target;
     }
     abstract connection elementTriggersActionLinks : ElementTriggersAction[*];
@@ -334,9 +355,14 @@ package memo_architecture_implementation_ui {
     }
     // A UI scenario realizes a functional scenario one layer up: each is a
     // OperativeScenario selected by scenarioKind rather than a separate definition.
+    // Target is `MemoPart`. IEC 62366-1 scopes the user interface to every
+    // means of interaction, so a use error lands wherever the user got it
+    // wrong — a mis-keyed connector, a moulded marking, a tube routed
+    // backwards — not only on a control. Narrowing this to an interaction
+    // base made those unmodellable.
     connection def ErrorAtElement :> MemoRelationship {
         end useError : UseError :>> source;
-        end element : InteractionElement :>> target;
+        end element : MemoPart :>> target;
     }
     abstract connection errorAtElementLinks : ErrorAtElement[*];
     metadata def <errorAtElement> ErrorAtElementMetadata :> SemanticMetadata {

package/src/assurance/cybersecurity/memo_cybersecurity.sysml

@@ -46,6 +46,11 @@ package memo_assurance_cybersecurity {
         attribute affectedLayer : String;
         attribute cweReference : String;
         attribute remediable : Boolean;
+        // CVSS v3.1 quantitative rating — the core output of a vulnerability
+        // analysis (e.g. RSK-00058). `cvssBaseScore` is the 0.0-10.0 numeric
+        // score; `cvssVector` the source vector string (AV:.../AC:.../...).
+        attribute cvssBaseScore : Real;
+        attribute cvssVector : String;
     }
 
     item def CyberHazard specializes Hazard {

package/src/assurance/safety_risk/memo_risk.sysml

@@ -39,22 +39,10 @@ package memo_assurance_safety_risk {
         attribute riskLevelMapping : String;
         attribute acceptabilityThresholds : String;
     }
-    part def DesignControlRiskRow specializes Risk {
-        attribute rowTitle : String;
-        attribute hazardAnalysis : String;
-        attribute hazardCategory : String;
-        attribute hazardSubcategory : String;
-        attribute causeSequenceOfEventsFailure : String;
-        attribute harmText : String;
-        attribute probabilityBeforeRaw : String;
-        attribute severityBeforeRaw : String;
-        attribute riskBeforeMeasureRaw : String;
-        attribute probabilityAfterRaw : String;
-        attribute severityAfterRaw : String;
-        attribute riskAfterMitigationRaw : String;
-        attribute cannotReduceFurther : Boolean;
-        attribute linkSummary : String;
-    }
+    // `DesignControlRiskRow` was a denormalized spreadsheet transcription.
+    // Risk rows now decompose into the ISO 14971 chain below: Risk owns its
+    // Hazard, SequenceOfEvents, HazardousSituation, and Harm items, linked by
+    // TracesRisk / LeadsToHarm, with ResidualRisk after mitigation.
     // A device characteristic whose implementation, failure, or misuse can
     // affect safety. This is the modelable output of ISO 14971 §5.3.
     part def SafetyRelatedCharacteristic specializes MemoPart {
@@ -102,6 +90,8 @@ package memo_assurance_safety_risk {
     item def HazardousSituation specializes RiskItem {
         attribute exposedPersons : String;
         attribute operatingCondition : String;
+        // ISO 14971 P1: probability that the hazardous situation occurs.
+        attribute probabilityOfOccurrence : ProbabilityKind;
     }
     item def Harm specializes RiskItem {
         attribute clinicalImpact : String;
@@ -138,6 +128,19 @@ package memo_assurance_safety_risk {
         :> annotatedElement : SysML::ConnectionUsage;
         :>> baseType = tracesRiskLinks meta SysML::Usage;
     }
+    // The final ISO 14971 chain edge. P2 is the conditional probability that
+    // the hazardous situation results in the harm.
+    connection def LeadsToHarm :> MemoRelationship {
+        attribute conditionalProbability : ProbabilityKind;
+        end hazardousSituation : HazardousSituation :>> source;
+        end resultingHarm : Harm :>> target;
+    }
+    abstract connection leadsToHarmLinks : LeadsToHarm[*];
+    metadata def <leadsToHarm> LeadsToHarmMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = leadsToHarmLinks meta SysML::Usage;
+    }
     // IEC 62366-1 3.9's hazard-related use scenario: the scenario a hazard can
     // arise in. It is declared HERE rather than as a `hazardReference` string
     // on the scenario, which is what stood in for it: a string names nothing a

package/src/assurance/verification_validation/memo_assurance.sysml

@@ -21,10 +21,28 @@ package memo_assurance_verification_validation {
     // a second spelling of `status`.
     // Specializes the standard library verification case as well as MEMO's
     // base, rather than shadowing it — see the note on UseCase.
+    // Reusable test action, distinct from a case's pass/fail criteria.
+    action def TestStep specializes MemoAction {
+        attribute stepAction : String;
+        attribute expectedResult : String;
+        attribute referencedItem : String;
+    }
     verification def VerificationCase :> MemoVerificationCase, VerificationCases::VerificationCase {
         attribute methodKind : MemoVerificationMethodKind;
         attribute acceptanceCriteria : String;
     }
+    // Orders a reusable TestStep within a verification or validation case.
+    connection def PerformsStep :> MemoRelationship {
+        attribute sequence : Integer;
+        end verificationCase : MemoVerificationCase :>> source;
+        end testStep : TestStep :>> target;
+    }
+    abstract connection performsStepLinks : PerformsStep[*];
+    metadata def <performsStep> PerformsStepMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = performsStepLinks meta SysML::Usage;
+    }
     verification def ValidationCase :> MemoVerificationCase {
         attribute validationMethod : ValidationMethodKind;
         attribute userParticipation : String;

package/src/core/enumerations/memo_enumerations.sysml

@@ -1,6 +1,35 @@
 package memo_core_enumerations {
     private import ScalarValues::*;
 
+    // Where a legend gets the value it colours by, when that value is not
+    // stored on the element at all but derived from the model.
+    enum def LegendSourceKind {
+        // Depth in the view's own composition hierarchy: the root is 0, its
+        // parts 1, theirs 2. This is what "L0 / L1 / L2" actually means, and
+        // the tree already computes it — reading it back out of an id string
+        // would make a naming convention load-bearing and break the moment
+        // something is renamed or re-parented.
+        enum hierarchyDepth;
+        // The element's ontology kind, which is a field rather than an
+        // attribute — and on a block definition diagram it is usually the only
+        // thing worth colouring by, since definitions carry few attributes.
+        enum elementKind;
+    }
+
+    // What a legend colours. The values are SysML's own usage keywords, so a
+    // renderer matches an element's construct directly rather than translating
+    // a private vocabulary into one.
+    enum def LegendScopeKind {
+        // Plural, because `part`, `item`, `port`, `action` and `connection` are
+        // SysML keywords and cannot name an enum literal. The renderer maps
+        // each to the construct it scopes.
+        enum parts;
+        enum items;
+        enum ports;
+        enum actions;
+        enum connections;
+    }
+
     enum def ConcernKind {
         enum safety;
         enum usability;
@@ -228,6 +257,26 @@ package memo_core_enumerations {
     }
     // The eight standard SysML v2 view kinds (spec taxonomy). Every
     // diagram view resolves to exactly one of these (Epic KK).
+    // How much of an interconnection drawing's port and connector detail is
+    // shown. Declared on the view, because how much detail a drawing carries
+    // is part of what the drawing IS — a summary IBD and a fully expanded one
+    // answer different questions about the same elements.
+    // `everything` and `hidden`, not `all` and `none`: both of those are SysML
+    // keywords and a literal cannot be named one — the same reason
+    // LegendScopeKind is plural. The renderer maps each to the display mode it
+    // names.
+    enum def PortDisplayKind {
+        enum everything;
+        enum ports;
+        enum hidden;
+    }
+
+    enum def ConnectionDisplayKind {
+        enum summary;
+        enum everything;
+        enum hidden;
+    }
+
     enum def DiagramViewKind {
         enum general;
         enum interconnection;
@@ -343,19 +392,6 @@ package memo_core_enumerations {
         enum evidence;
         enum documents;
     }
-    enum def AudienceKind {
-        enum systemArchitect;
-        enum softwareArchitect;
-        enum hardwareEngineer;
-        enum safetyEngineer;
-        enum verificationEngineer;
-        enum regulatoryEngineer;
-        enum projectLead;
-        enum securityEngineer;
-        enum privacyEngineer;
-        enum clinicalEngineer;
-        enum usabilityEngineer;
-    }
     enum def ThreatCategoryKind {
         enum spoofing;
         enum tampering;

package/src/memo_namespaces.sysml

@@ -39,6 +39,7 @@ package memo {
     public import memo_architecture_decisions::*;
 
     public import memo_viewpoints_definitions::*;
+    public import memo_viewpoints_stakeholders_concerns::*;
     public import memo_viewpoints_catalog::*;
     public import memo_viewpoints_context_context_viewpoint::*;
     public import memo_viewpoints_context_views_system_context_view::*;
@@ -530,6 +531,7 @@ package memo_namespace_viewpoints_cybersecurity {
 
 package memo_namespace_viewpoints_definitions {
     public import memo_viewpoints_definitions::*;
+    public import memo_viewpoints_stakeholders_concerns::*;
 }
 
 package memo_namespace_viewpoints_functional {

package/src/viewpoints/clinical/clinical_viewpoint.sysml

@@ -3,6 +3,7 @@ package memo_viewpoints_clinical_clinical_viewpoint {
 
     private import memo_viewpoints_definitions::*;
     private import memo_core_enumerations::*;
+    private import memo_viewpoints_stakeholders_concerns::*;
 
     private import memo_core_common::*;
     private import memo_core_common::MemoIdentity;
@@ -12,16 +13,14 @@ package memo_viewpoints_clinical_clinical_viewpoint {
         @MemoIdentity { :>> shortDescription = "Shows clinical context, users, use environment, and clinical evidence."; }
         attribute :>> description = "Default viewpoint derived from the context and assurance layers for clinical stakeholders — intended use, patient/clinician interaction, clinical evidence, and clinical safety claims.";
         attribute :>> purpose = "Communicate clinical use context and clinical evidence for the device.";
-        attribute :>> audience = (AudienceKind::clinicalEngineer, AudienceKind::regulatoryEngineer);
+        ref :>> stakeholders = (ClinicalEngineer, RegulatoryEngineer);
         attribute :>> stage = WorkflowStageKind::context;
         attribute :>> abstractionLevel = "clinical";
         attribute :>> outputKind = (ViewOutputKind::documentSection, ViewOutputKind::table);
         attribute :>> presentationKind = (PresentationKind::narrativeSection);
-        attribute :>> concernKinds = (ConcernKind::safety, ConcernKind::clinical);
-        attribute :>> includedLayers = ("context", "assurance");
+        ref :>> framedConcerns = (SafetyConcern, ClinicalConcern);
         attribute :>> explorerLane = "assurance";
         attribute :>> explorerOrder = 4;
-        attribute :>> allowedElementKinds = ("Actor", "UseContext", "MemoEvidence");
         attribute :>> userExtensible = true;
     }
 }

package/src/viewpoints/context/context_viewpoint.sysml

@@ -3,6 +3,7 @@ package memo_viewpoints_context_context_viewpoint {
 
     private import memo_viewpoints_definitions::*;
     private import memo_core_enumerations::*;
+    private import memo_viewpoints_stakeholders_concerns::*;
 
     private import memo_core_common::*;
     private import memo_core_common::MemoIdentity;
@@ -12,25 +13,22 @@ package memo_viewpoints_context_context_viewpoint {
         @MemoIdentity { :>> shortDescription = "Shows actors, use context, and system boundary."; }
         attribute :>> description = "Default viewpoint derived from the context layer to communicate who interacts with the device, under which use conditions, and where trust or safety boundaries exist.";
         attribute :>> purpose = "Communicate operational context and boundaries.";
-        attribute :>> audience = (AudienceKind::systemArchitect);
+        ref :>> stakeholders = (SystemArchitect);
         attribute :>> stage = WorkflowStageKind::context;
         attribute :>> abstractionLevel = "system";
         attribute :>> outputKind = (ViewOutputKind::diagram);
         attribute :>> presentationKind = (PresentationKind::blockDiagram);
-        attribute :>> concernKinds = (ConcernKind::safety, ConcernKind::interoperability);
-        attribute :>> includedLayers = ("context");
+        ref :>> framedConcerns = (SafetyConcern, InteroperabilityConcern);
         attribute :>> explorerLane = "architecture";
         attribute :>> explorerOrder = 0;
         // UseEnvironment (IEC 62366-1 3.20) is what the device sits inside —
         // facility, procedure area, ambient conditions. A context view that
         // cannot show it is missing half of "where is this used".
-        attribute :>> allowedElementKinds = ("Actor", "UseContext", "UseEnvironment", "IntendedUse", "ReasonablyForeseeableMisuse", "OperationalEntity", "TrustBoundary", "LogicalComponent");
         // InteractsInContext is the context relation: a context view draws it
         // and nothing else, so general-purpose model edges cannot leak into the
         // boundary picture. Projects derive their own verbs from it and are
         // picked up through the specialization closure. The three older
         // relations remain for models authored before it existed.
-        attribute :>> allowedRelationshipKinds = ("InteractsInContext", "connect", "flow", "bind");
         attribute :>> userExtensible = true;
     }
 }

package/src/viewpoints/cybersecurity/cybersecurity_viewpoint.sysml

@@ -3,6 +3,7 @@ package memo_viewpoints_cybersecurity_cybersecurity_viewpoint {
 
     private import memo_viewpoints_definitions::*;
     private import memo_core_enumerations::*;
+    private import memo_viewpoints_stakeholders_concerns::*;
 
     private import memo_core_common::*;
     private import memo_core_common::MemoIdentity;
@@ -12,17 +13,14 @@ package memo_viewpoints_cybersecurity_cybersecurity_viewpoint {
         @MemoIdentity { :>> shortDescription = "Shows assets, trust boundaries, threats, vulnerabilities, cyber hazards, cyber risks, and mitigations."; }
         attribute :>> description = "Default viewpoint derived from the cybersecurity layer, using STRIDE-style threat categories by default while allowing safety and privacy impacts to be traced into the broader model.";
         attribute :>> purpose = "Communicate cybersecurity design, threat analysis, and cyber risk posture.";
-        attribute :>> audience = (AudienceKind::securityEngineer);
+        ref :>> stakeholders = (SecurityEngineer);
         attribute :>> stage = WorkflowStageKind::risk;
         attribute :>> abstractionLevel = "analysis";
         attribute :>> outputKind = (ViewOutputKind::diagram);
         attribute :>> presentationKind = (PresentationKind::custom);
-        attribute :>> concernKinds = (ConcernKind::cybersecurity, ConcernKind::privacy, ConcernKind::safety);
-        attribute :>> includedLayers = ("cybersecurity", "software_structure", "hardware_structure", "interfaces", "risk", "assurance");
+        ref :>> framedConcerns = (CybersecurityConcern, PrivacyConcern, SafetyConcern);
         attribute :>> explorerLane = "assurance";
         attribute :>> explorerOrder = 3;
-        attribute :>> allowedElementKinds = ("CybersecurityAsset", "Threat", "Vulnerability", "CyberHazard", "CyberRisk", "CyberMitigation", "SecurityRequirement", "TrustBoundary", "OperativeScenario[scenarioKind=threat]");
-        attribute :>> allowedRelationshipKinds = ("ThreatenedBy", "Exploits", "RealizedByScenario", "Mitigates", "DerivesCyberRequirement", "ImpactsSafety", "CrossesTrustBoundary");
         attribute :>> userExtensible = true;
     }
 }

package/src/viewpoints/definitions/memo_stakeholders_concerns.sysml

@@ -0,0 +1,192 @@
+// Stakeholders and concerns, as elements.
+//
+// ISO/IEC/IEEE 42010 gives a viewpoint three jobs: name the stakeholders,
+// frame their concerns, and be what a view conforms to. MEMO used to do the
+// first two with enumerations — `AudienceKind` and `ConcernKind` — which meant
+// a stakeholder was a literal from a closed list of eleven and a concern was a
+// literal from nine. You could tag a viewpoint with one; you could not declare
+// a concern, give it an id, say who holds it, trace a requirement to it, or
+// add one without editing the ontology.
+//
+// They are elements now. SysML v2 already models both — `ConcernDefinition`
+// and `StakeholderMembership` are in the metamodel, and MEMO's grammar has
+// carried `concern def`, `concern`, `frame` and `stakeholder` all along — so
+// nothing new is invented here. Each carries `@MemoIdentity`, which is what
+// makes it citable in a review the way every other MEMO element is.
+//
+// The literals they replace are kept verbatim as names, so a project reading
+// `AudienceKind::safetyEngineer` finds `SafetyEngineer` and nothing is lost in
+// the move.
+package memo_viewpoints_stakeholders_concerns {
+    private import ScalarValues::*;
+    private import memo_core_common::*;
+
+    // ─── Concerns ────────────────────────────────────────────────────────
+    //
+    // A concern is an interest in the system held by one or more stakeholders.
+    // `concern def` is the native SysML construct for it; a viewpoint frames
+    // the concerns it addresses.
+    abstract concern def MemoConcern;
+
+    concern def SafetyConcern :> MemoConcern {
+        @MemoIdentity { :>> providedId = "CNC-1"; }
+        attribute name = "Safety";
+        attribute description = "Freedom from unacceptable risk of harm to the patient, the operator or a bystander.";
+    }
+    concern def UsabilityConcern :> MemoConcern {
+        @MemoIdentity { :>> providedId = "CNC-2"; }
+        attribute name = "Usability";
+        attribute description = "Whether the intended user can operate the device correctly under use conditions.";
+    }
+    concern def CybersecurityConcern :> MemoConcern {
+        @MemoIdentity { :>> providedId = "CNC-3"; }
+        attribute name = "Cybersecurity";
+        attribute description = "Resistance to compromise of the device, its data, or the network it participates in.";
+    }
+    concern def PerformanceConcern :> MemoConcern {
+        @MemoIdentity { :>> providedId = "CNC-4"; }
+        attribute name = "Performance";
+        attribute description = "Timing, throughput and capacity against what the clinical procedure demands.";
+    }
+    concern def InteroperabilityConcern :> MemoConcern {
+        @MemoIdentity { :>> providedId = "CNC-5"; }
+        attribute name = "Interoperability";
+        attribute description = "Correct exchange with the equipment and systems the device is used alongside.";
+    }
+    concern def ReliabilityConcern :> MemoConcern {
+        @MemoIdentity { :>> providedId = "CNC-6"; }
+        attribute name = "Reliability";
+        attribute description = "Continuity of correct service, and behaviour on failure.";
+    }
+    concern def PrivacyConcern :> MemoConcern {
+        @MemoIdentity { :>> providedId = "CNC-7"; }
+        attribute name = "Privacy";
+        attribute description = "Protection of patient and operator data through its lifecycle.";
+    }
+    concern def RegulatoryConcern :> MemoConcern {
+        @MemoIdentity { :>> providedId = "CNC-8"; }
+        attribute name = "Regulatory";
+        attribute description = "Evidence a submission requires, and conformance to the standards claimed.";
+    }
+    concern def ClinicalConcern :> MemoConcern {
+        @MemoIdentity { :>> providedId = "CNC-9"; }
+        attribute name = "Clinical";
+        attribute description = "Whether the device serves the clinical procedure and its intended use.";
+    }
+
+    // ─── Quality attributes ──────────────────────────────────────────────
+    //
+    // A concern is what a stakeholder cares about; a quality attribute is the
+    // measurable property of the system through which that care is answered.
+    // The SEI's separation (Bass, Clements & Kazman): "performance" as a
+    // concern is a worry, and only becomes designable once it is stated as a
+    // property with a stimulus, a response and a measure.
+    //
+    // `addressesConcerns` is the mapping, and it is many-to-many on purpose.
+    // Availability answers safety AND clinical continuity; security answers
+    // cybersecurity AND privacy. A quality attribute that addresses no concern
+    // is one nobody asked for, and a concern with no quality attribute behind
+    // it is a worry the architecture has not yet answered — both are findings
+    // this mapping makes visible.
+    abstract part def MemoQualityAttribute :> MemoPart {
+        ref addressesConcerns : MemoConcern[*];
+        /** How the property is measured — the response measure of a quality
+         *  attribute scenario, stated once for the attribute. */
+        attribute measure : String;
+    }
+
+    part def Availability :> MemoQualityAttribute {
+        @MemoIdentity { :>> providedId = "QA-1"; }
+        attribute :>> name = "Availability";
+        ref :>> addressesConcerns = (SafetyConcern, ReliabilityConcern, ClinicalConcern);
+        attribute :>> measure = "Proportion of scheduled procedure time the function is delivered, and time to recover after a fault.";
+    }
+    part def Performance :> MemoQualityAttribute {
+        @MemoIdentity { :>> providedId = "QA-2"; }
+        attribute :>> name = "Performance";
+        ref :>> addressesConcerns = (PerformanceConcern, ClinicalConcern);
+        attribute :>> measure = "Latency and throughput under the arrival pattern the procedure produces.";
+    }
+    part def Security :> MemoQualityAttribute {
+        @MemoIdentity { :>> providedId = "QA-3"; }
+        attribute :>> name = "Security";
+        ref :>> addressesConcerns = (CybersecurityConcern, PrivacyConcern, SafetyConcern);
+        attribute :>> measure = "Resistance to a stated threat, and time to detect and recover from a compromise.";
+    }
+    part def Modifiability :> MemoQualityAttribute {
+        @MemoIdentity { :>> providedId = "QA-4"; }
+        attribute :>> name = "Modifiability";
+        ref :>> addressesConcerns = (RegulatoryConcern);
+        attribute :>> measure = "Cost and blast radius of a stated change, including the re-verification it forces.";
+    }
+    part def Testability :> MemoQualityAttribute {
+        @MemoIdentity { :>> providedId = "QA-5"; }
+        attribute :>> name = "Testability";
+        ref :>> addressesConcerns = (RegulatoryConcern, SafetyConcern);
+        attribute :>> measure = "Probability that a fault present is revealed by the next test, and the effort to observe it.";
+    }
+    part def Usability :> MemoQualityAttribute {
+        @MemoIdentity { :>> providedId = "QA-6"; }
+        attribute :>> name = "Usability";
+        ref :>> addressesConcerns = (UsabilityConcern, SafetyConcern, ClinicalConcern);
+        attribute :>> measure = "Task success and use-error rate for the intended user under use conditions (IEC 62366-1).";
+    }
+    part def Interoperability :> MemoQualityAttribute {
+        @MemoIdentity { :>> providedId = "QA-7"; }
+        attribute :>> name = "Interoperability";
+        ref :>> addressesConcerns = (InteroperabilityConcern, ClinicalConcern);
+        attribute :>> measure = "Proportion of exchanges with a named partner system that are correctly understood.";
+    }
+
+    // ─── Stakeholders ────────────────────────────────────────────────────
+    //
+    // A stakeholder holds concerns. These are the engineering and regulatory
+    // roles a viewpoint is written FOR; the clinical actors who operate the
+    // device are OperationalParticipants and are a different population.
+    abstract part def MemoStakeholder :> MemoPart;
+
+    part def SystemArchitect :> MemoStakeholder {
+        @MemoIdentity { :>> providedId = "STK-1"; }
+        attribute :>> name = "System Architect";
+    }
+    part def SoftwareArchitect :> MemoStakeholder {
+        @MemoIdentity { :>> providedId = "STK-2"; }
+        attribute :>> name = "Software Architect";
+    }
+    part def HardwareEngineer :> MemoStakeholder {
+        @MemoIdentity { :>> providedId = "STK-3"; }
+        attribute :>> name = "Hardware Engineer";
+    }
+    part def SafetyEngineer :> MemoStakeholder {
+        @MemoIdentity { :>> providedId = "STK-4"; }
+        attribute :>> name = "Safety Engineer";
+    }
+    part def VerificationEngineer :> MemoStakeholder {
+        @MemoIdentity { :>> providedId = "STK-5"; }
+        attribute :>> name = "Verification Engineer";
+    }
+    part def RegulatoryEngineer :> MemoStakeholder {
+        @MemoIdentity { :>> providedId = "STK-6"; }
+        attribute :>> name = "Regulatory Engineer";
+    }
+    part def ProjectLead :> MemoStakeholder {
+        @MemoIdentity { :>> providedId = "STK-7"; }
+        attribute :>> name = "Project Lead";
+    }
+    part def SecurityEngineer :> MemoStakeholder {
+        @MemoIdentity { :>> providedId = "STK-8"; }
+        attribute :>> name = "Security Engineer";
+    }
+    part def PrivacyEngineer :> MemoStakeholder {
+        @MemoIdentity { :>> providedId = "STK-9"; }
+        attribute :>> name = "Privacy Engineer";
+    }
+    part def ClinicalEngineer :> MemoStakeholder {
+        @MemoIdentity { :>> providedId = "STK-10"; }
+        attribute :>> name = "Clinical Engineer";
+    }
+    part def UsabilityEngineer :> MemoStakeholder {
+        @MemoIdentity { :>> providedId = "STK-11"; }
+        attribute :>> name = "Usability Engineer";
+    }
+}

package/src/viewpoints/definitions/memo_viewpoint_definitions.sysml

@@ -12,6 +12,7 @@ package memo_viewpoints_definitions {
     private import memo_core_dimensions::*;
     private import memo_core_terminology::*;
     private import memo_core_relationships::*;
+    private import memo_viewpoints_stakeholders_concerns::*;
 
     // Extends the native SysML viewpoint (Views::ViewpointCheck, a
     // RequirementCheck whose subject is a View) with MEMO's catalog
@@ -28,16 +29,28 @@ package memo_viewpoints_definitions {
         attribute applicableStandards : ExternalReference[0..*];
         attribute codes : TerminologyCode[0..*];
         attribute purpose : String;
-        attribute audience : AudienceKind[*];
+        /**
+         * Who the viewpoint is written for, and what it frames for them.
+         *
+         * References, not enum literals. A stakeholder and a concern are
+         * elements with ids — citable in a review, traceable from a
+         * requirement, and extensible by a project without editing the
+         * ontology, which `AudienceKind` and `ConcernKind` were not.
+         */
+        ref stakeholders : MemoStakeholder[*];
         attribute stage : WorkflowStageKind;
         attribute abstractionLevel : String;
         attribute outputKind : ViewOutputKind[*];
         attribute presentationKind : PresentationKind[*];
-        attribute concernKinds : ConcernKind[*];
-        attribute includedLayers : String[*];
-        attribute allowedElementKinds : String[*];
-        attribute allowedRelationshipKinds : String[*];
-        attribute filterExpression : String;
+        ref framedConcerns : MemoConcern[*];
+        // A viewpoint identifies stakeholders, the concerns it frames, and the
+        // views that conform to it — ISO/IEC/IEEE 42010, and nothing further.
+        // It used to also carry `includedLayers`, `allowedElementKinds`,
+        // `allowedRelationshipKinds` and `filterExpression`: scoping rules over
+        // its views. Nothing ever read them, and the filtering that did happen
+        // came from a union the deriver accumulated out of the views
+        // themselves. What a view shows is the view's to say, through its own
+        // expose members and selectionQuery.
         attribute extendsViewpointIds : String[*];
         attribute userExtensible : Boolean;
         // Optional navigation grouping interpreted by Memo Architect.
@@ -68,6 +81,53 @@ package memo_viewpoints_definitions {
         attribute rationaleText : String;
     }
 
+    // ─── Legends ────────────────────────────────────────────────────────
+    //
+    // A legend gives colour a meaning, and a view picks exactly one of them —
+    // because two legends at once would put two meanings on the same channel
+    // and neither could be read.
+    //
+    // Each legend is tied to ONE attribute or enumeration, which is what makes
+    // it a legend rather than a palette: every entry is a value of that same
+    // thing, so the key can be stated as "this attribute, these values, these
+    // colours". Colour is otherwise a property of a diagram, defined nowhere,
+    // reproducible in no other view and reviewable by nobody.
+    // A swatch, not an "entry": `entry` is a SysML keyword (a state's entry
+    // action), and the keyword-collision lint is right that a definition should
+    // not reach for one that means something else. A swatch is what this is —
+    // a colour with a label.
+    part def MemoLegendSwatch specializes MemoPart {
+        /** The value of the legend's attribute or enumeration this entry is for. */
+        attribute value : String;
+        /** Shown in the key. Defaults to the value when unstated. */
+        attribute label : String;
+        /** `#RRGGBB`. */
+        attribute color : String;
+    }
+
+    part def MemoLegend specializes MemoPart {
+        /** The attribute whose value each entry names — e.g. "realizationStage". */
+        attribute attributeName : String;
+        /**
+         * An `enum def` whose values each entry names, as an alternative to
+         * `attributeName`.
+         */
+        attribute enumerationName : String;
+        /**
+         * A value the model derives rather than stores — hierarchy depth, or
+         * the element's kind. Use instead of `attributeName` when the thing
+         * being coloured is not written on the element.
+         */
+        attribute derivedFrom : LegendSourceKind[0..1];
+        /**
+         * Which constructs are coloured. A legend may cover parts and the
+         * connections between them, or only one of them. Empty means every
+         * construct the legend has an entry for.
+         */
+        attribute appliesTo : LegendScopeKind[*];
+        part swatches : MemoLegendSwatch[*];
+    }
+
     view def MemoView :> Views::View {
         // Identity comes from the `@MemoIdentity` metadata carrier, which
         // annotates any metaclass — so a view stays native SysML without
@@ -103,6 +163,34 @@ package memo_viewpoints_definitions {
         attribute diagramType : String;
         attribute layoutHint : String;
         attribute styleHint : String;
+        /**
+         * The one legend this view colours by. At most one: colour is a single
+         * channel, and a second legend competing for it makes both unreadable.
+         * Without one, an element keeps its layer colour.
+         */
+        ref legend : MemoLegend[0..1];
+
+        // ── What the drawing SHOWS ────────────────────────────────────────
+        //
+        // These are the view's own statement about what it presents, so they
+        // are declared here and not in the layout companion beside it. That
+        // file records where boxes were dragged to; whether a drawing names
+        // its ports at all is a decision about the view, survives a layout
+        // reset, and belongs where the rest of the view's intent is written.
+        //
+        // Each is optional and the renderer keeps its default when a view says
+        // nothing, so no existing view changes meaning by their arrival.
+        attribute portDisplay : PortDisplayKind[0..1];
+        attribute connectionDisplay : ConnectionDisplayKind[0..1];
+        /** Name each port on the drawing. Off where the connector label
+         *  already carries the same string, as on a ROS pub/sub view where the
+         *  port and the topic share a name. */
+        attribute showPortText : Boolean[0..1];
+        attribute showConnectionText : Boolean[0..1];
+        /** Animate direction along connectors. */
+        attribute flowAnimation : Boolean[0..1];
+        /** The renderer profile this view opts into, by id. */
+        attribute rendererProfile : String[0..1];
     }
 
     view def MemoDocumentBackedView :> MemoView {

package/src/viewpoints/functional/functional_viewpoint.sysml

@@ -3,6 +3,7 @@ package memo_viewpoints_functional_functional_viewpoint {
 
     private import memo_viewpoints_definitions::*;
     private import memo_core_enumerations::*;
+    private import memo_viewpoints_stakeholders_concerns::*;
 
     private import memo_core_common::*;
     private import memo_core_common::MemoIdentity;
@@ -12,16 +13,14 @@ package memo_viewpoints_functional_functional_viewpoint {
         @MemoIdentity { :>> shortDescription = "Shows system functions, their decomposition, and allocation."; }
         attribute :>> description = "Default viewpoint derived from the functions layer for what the system does, independent of how it is structured — function trees, function allocation, and behavior triggers.";
         attribute :>> purpose = "Describe the system's functional decomposition and behavior.";
-        attribute :>> audience = (AudienceKind::systemArchitect);
+        ref :>> stakeholders = (SystemArchitect);
         attribute :>> stage = WorkflowStageKind::architecture;
         attribute :>> abstractionLevel = "functional";
         attribute :>> outputKind = (ViewOutputKind::diagram);
         attribute :>> presentationKind = (PresentationKind::activityDiagram);
-        attribute :>> concernKinds = (ConcernKind::safety, ConcernKind::performance);
-        attribute :>> includedLayers = ("functions");
+        ref :>> framedConcerns = (SafetyConcern, PerformanceConcern);
         attribute :>> explorerLane = "architecture";
         attribute :>> explorerOrder = 2;
-        attribute :>> allowedElementKinds = ("SystemFunction", "ComponentFunction", "FunctionalFlow", "FunctionalFlowStep", "OperativeScenario[scenarioKind=functional]", "FunctionalExchange");
         attribute :>> userExtensible = true;
     }
 }

package/src/viewpoints/logical/logical_viewpoint.sysml

@@ -3,6 +3,7 @@ package memo_viewpoints_logical_logical_viewpoint {
 
     private import memo_viewpoints_definitions::*;
     private import memo_core_enumerations::*;
+    private import memo_viewpoints_stakeholders_concerns::*;
 
     private import memo_core_common::*;
     private import memo_core_common::MemoIdentity;
@@ -12,16 +13,14 @@ package memo_viewpoints_logical_logical_viewpoint {
         @MemoIdentity { :>> shortDescription = "Shows logical decomposition and interfaces."; }
         attribute :>> description = "Default viewpoint derived from the logical architecture layer for subsystem structure, responsibilities, and major interactions, independent of physical realization.";
         attribute :>> purpose = "Describe the system's logical decomposition.";
-        attribute :>> audience = (AudienceKind::systemArchitect);
+        ref :>> stakeholders = (SystemArchitect);
         attribute :>> stage = WorkflowStageKind::architecture;
         attribute :>> abstractionLevel = "logical";
         attribute :>> outputKind = (ViewOutputKind::diagram);
         attribute :>> presentationKind = (PresentationKind::blockDiagram);
-        attribute :>> concernKinds = (ConcernKind::safety, ConcernKind::performance);
-        attribute :>> includedLayers = ("logical_structure", "interfaces");
+        ref :>> framedConcerns = (SafetyConcern, PerformanceConcern);
         attribute :>> explorerLane = "architecture";
         attribute :>> explorerOrder = 3;
-        attribute :>> allowedElementKinds = ("LogicalComponent", "Interface");
         attribute :>> userExtensible = true;
     }
 }

package/src/viewpoints/operational/operational_viewpoint.sysml

@@ -3,6 +3,7 @@ package memo_viewpoints_operational_operational_viewpoint {
 
     private import memo_viewpoints_definitions::*;
     private import memo_core_enumerations::*;
+    private import memo_viewpoints_stakeholders_concerns::*;
 
     private import memo_core_common::*;
     private import memo_core_common::MemoIdentity;
@@ -12,16 +13,14 @@ package memo_viewpoints_operational_operational_viewpoint {
         @MemoIdentity { :>> shortDescription = "Shows actors, use contexts, operational scenarios, and system capabilities."; }
         attribute :>> description = "Default viewpoint derived from the context, operational, and system layers for how actors use the device — operational scenarios, capabilities, and the functional chains that realize them.";
         attribute :>> purpose = "Communicate how actors interact with the system and which capabilities they invoke.";
-        attribute :>> audience = (AudienceKind::projectLead, AudienceKind::systemArchitect);
+        ref :>> stakeholders = (ProjectLead, SystemArchitect);
         attribute :>> stage = WorkflowStageKind::context;
         attribute :>> abstractionLevel = "operational";
         attribute :>> outputKind = (ViewOutputKind::diagram);
         attribute :>> presentationKind = (PresentationKind::custom);
-        attribute :>> concernKinds = (ConcernKind::performance, ConcernKind::interoperability);
-        attribute :>> includedLayers = ("context", "operational", "system");
+        ref :>> framedConcerns = (PerformanceConcern, InteroperabilityConcern);
         attribute :>> explorerLane = "architecture";
         attribute :>> explorerOrder = 1;
-        attribute :>> allowedElementKinds = ("Actor", "UseContext", "OperativeAction", "OperativeScenario[scenarioKind=operative]");
         attribute :>> userExtensible = true;
     }
 }

package/src/viewpoints/physical/physical_viewpoint.sysml

@@ -3,6 +3,7 @@ package memo_viewpoints_physical_physical_viewpoint {
 
     private import memo_viewpoints_definitions::*;
     private import memo_core_enumerations::*;
+    private import memo_viewpoints_stakeholders_concerns::*;
 
     private import memo_core_common::*;
     private import memo_core_common::MemoIdentity;
@@ -12,16 +13,14 @@ package memo_viewpoints_physical_physical_viewpoint {
         @MemoIdentity { :>> shortDescription = "Shows physical components, hardware structure, and their interconnections."; }
         attribute :>> description = "Default viewpoint derived from the physical and hardware structure layers for bill-of-materials, hardware decomposition, physical interfaces, and network/connectivity topology.";
         attribute :>> purpose = "Describe the system's physical realization and interconnections.";
-        attribute :>> audience = (AudienceKind::hardwareEngineer);
+        ref :>> stakeholders = (HardwareEngineer);
         attribute :>> stage = WorkflowStageKind::architecture;
         attribute :>> abstractionLevel = "physical";
         attribute :>> outputKind = (ViewOutputKind::diagram);
         attribute :>> presentationKind = (PresentationKind::blockDiagram);
-        attribute :>> concernKinds = (ConcernKind::reliability, ConcernKind::interoperability);
-        attribute :>> includedLayers = ("hardware_structure", "physical");
+        ref :>> framedConcerns = (ReliabilityConcern, InteroperabilityConcern);
         attribute :>> explorerLane = "architecture";
         attribute :>> explorerOrder = 5;
-        attribute :>> allowedElementKinds = ("ProcessingNode", "HardwareAssembly", "PhysicalPort");
         attribute :>> userExtensible = true;
     }
 }

package/src/viewpoints/requirements/requirements_viewpoint.sysml

@@ -3,6 +3,7 @@ package memo_viewpoints_requirements_requirements_viewpoint {
 
     private import memo_viewpoints_definitions::*;
     private import memo_core_enumerations::*;
+    private import memo_viewpoints_stakeholders_concerns::*;
 
     private import memo_core_common::*;
     private import memo_core_common::MemoIdentity;
@@ -12,16 +13,14 @@ package memo_viewpoints_requirements_requirements_viewpoint {
         @MemoIdentity { :>> shortDescription = "Shows stakeholder needs and their decomposition into system, software, and hardware requirements."; }
         attribute :>> description = "Default viewpoint derived from the requirements layer for requirements traceability — the chain from stakeholder need through system, software, and hardware requirements, supporting IEC 62304 §5.1.1 and ISO 13485 §7.3.3.";
         attribute :>> purpose = "Communicate requirements decomposition and traceability.";
-        attribute :>> audience = (AudienceKind::regulatoryEngineer, AudienceKind::systemArchitect);
+        ref :>> stakeholders = (RegulatoryEngineer, SystemArchitect);
         attribute :>> stage = WorkflowStageKind::requirements;
         attribute :>> abstractionLevel = "requirements";
         attribute :>> outputKind = (ViewOutputKind::diagram, ViewOutputKind::matrix);
         attribute :>> presentationKind = (PresentationKind::traceMatrix);
-        attribute :>> concernKinds = (ConcernKind::regulatory, ConcernKind::safety);
-        attribute :>> includedLayers = ("requirements");
+        ref :>> framedConcerns = (RegulatoryConcern, SafetyConcern);
         attribute :>> explorerLane = "assurance";
         attribute :>> explorerOrder = 1;
-        attribute :>> allowedElementKinds = ("Need", "Requirement");
         attribute :>> userExtensible = true;
     }
 }

package/src/viewpoints/risk/risk_viewpoint.sysml

@@ -3,6 +3,7 @@ package memo_viewpoints_risk_risk_viewpoint {
 
     private import memo_viewpoints_definitions::*;
     private import memo_core_enumerations::*;
+    private import memo_viewpoints_stakeholders_concerns::*;
 
     private import memo_core_common::*;
     private import memo_core_common::MemoIdentity;
@@ -12,16 +13,14 @@ package memo_viewpoints_risk_risk_viewpoint {
         @MemoIdentity { :>> shortDescription = "Shows hazards, risks, controls, and assurance links."; }
         attribute :>> description = "Default viewpoint derived from the risk layer for ISO 14971-style reasoning across hazard, hazardous situation, harm, control, and verification evidence.";
         attribute :>> purpose = "Communicate safety risk chains and controls.";
-        attribute :>> audience = (AudienceKind::safetyEngineer);
+        ref :>> stakeholders = (SafetyEngineer);
         attribute :>> stage = WorkflowStageKind::risk;
         attribute :>> abstractionLevel = "analysis";
         attribute :>> outputKind = (ViewOutputKind::table);
         attribute :>> presentationKind = (PresentationKind::riskTable);
-        attribute :>> concernKinds = (ConcernKind::safety, ConcernKind::regulatory);
-        attribute :>> includedLayers = ("risk", "assurance");
+        ref :>> framedConcerns = (SafetyConcern, RegulatoryConcern);
         attribute :>> explorerLane = "assurance";
         attribute :>> explorerOrder = 2;
-        attribute :>> allowedElementKinds = ("SafetyRelatedCharacteristic", "HazardCause", "Hazard", "SequenceOfEvents", "HazardousSituation", "Harm", "Risk", "RiskControlMeasure", "ResidualRisk", "Benefit", "OverallResidualRiskEvaluation", "VerificationCase");
         attribute :>> userExtensible = true;
     }
 }

package/src/viewpoints/software/software_viewpoint.sysml

@@ -3,6 +3,7 @@ package memo_viewpoints_software_software_viewpoint {
 
     private import memo_viewpoints_definitions::*;
     private import memo_core_enumerations::*;
+    private import memo_viewpoints_stakeholders_concerns::*;
 
     private import memo_core_common::*;
     private import memo_core_common::MemoIdentity;
@@ -12,16 +13,14 @@ package memo_viewpoints_software_software_viewpoint {
         @MemoIdentity { :>> shortDescription = "Shows software systems, components, SOUP, and software interfaces."; }
         attribute :>> description = "Default viewpoint derived from the software structure layer for IEC 62304 software architecture description — software item decomposition, SOUP inventory, and software-to-software interfaces, distinct from system-level logical decomposition.";
         attribute :>> purpose = "Describe the software architecture for IEC 62304 design documentation.";
-        attribute :>> audience = (AudienceKind::softwareArchitect);
+        ref :>> stakeholders = (SoftwareArchitect);
         attribute :>> stage = WorkflowStageKind::architecture;
         attribute :>> abstractionLevel = "software";
         attribute :>> outputKind = (ViewOutputKind::diagram);
         attribute :>> presentationKind = (PresentationKind::blockDiagram);
-        attribute :>> concernKinds = (ConcernKind::safety, ConcernKind::reliability);
-        attribute :>> includedLayers = ("software_structure", "interfaces");
+        ref :>> framedConcerns = (SafetyConcern, ReliabilityConcern);
         attribute :>> explorerLane = "architecture";
         attribute :>> explorerOrder = 4;
-        attribute :>> allowedElementKinds = ("SoftwareSystem", "SoftwareModule", "SoftwareModule[moduleKind=soup]", "Interface");
         attribute :>> userExtensible = true;
     }
 }

package/src/viewpoints/ui_layout/ui_layout_viewpoint.sysml

@@ -3,6 +3,7 @@ package memo_viewpoints_ui_layout_ui_layout_viewpoint {
 
     private import memo_viewpoints_definitions::*;
     private import memo_core_enumerations::*;
+    private import memo_viewpoints_stakeholders_concerns::*;
 
     private import memo_core_common::*;
     private import memo_core_common::MemoIdentity;
@@ -12,17 +13,14 @@ package memo_viewpoints_ui_layout_ui_layout_viewpoint {
         @MemoIdentity { :>> shortDescription = "Shows screen captures with the UI element tree laid out over them."; }
         attribute :>> description = "Frames the user interface spatially: a captured rendering of a screen, and the UIElement tree laid out over it by each element's bounds. Supports IEC 62366-1 use-related design review and the UI description in the software design specification, by making 'which control is this, and what does it do' answerable from the picture. There is one tree, not two — the elements carrying the geometry are the same elements carrying the requirements, functions, use errors, and risk controls.";
         attribute :>> purpose = "Review the interface as the user sees it, with every functional area backed by a design record.";
-        attribute :>> audience = (AudienceKind::usabilityEngineer, AudienceKind::softwareArchitect, AudienceKind::safetyEngineer);
+        ref :>> stakeholders = (UsabilityEngineer, SoftwareArchitect, SafetyEngineer);
         attribute :>> stage = WorkflowStageKind::architecture;
         attribute :>> abstractionLevel = "implementation";
         attribute :>> outputKind = (ViewOutputKind::diagram, ViewOutputKind::documentSection);
         attribute :>> presentationKind = (PresentationKind::screenLayout);
-        attribute :>> concernKinds = (ConcernKind::usability, ConcernKind::safety);
-        attribute :>> includedLayers = ("implementation");
+        ref :>> framedConcerns = (UsabilityConcern, SafetyConcern);
         attribute :>> explorerLane = "architecture";
         attribute :>> explorerOrder = 4;
-        attribute :>> allowedElementKinds = ("ScreenCapture", "UIElement", "UserInterface");
-        attribute :>> allowedRelationshipKinds = ("CapturesScreen", "NavigatesTo", "Composes", "satisfy", "ElementTriggersAction");
         attribute :>> defaultViewKind = DiagramViewKind::geometry;
         attribute :>> userExtensible = true;
     }

package/src/viewpoints/usability/usability_viewpoint.sysml

@@ -3,6 +3,7 @@ package memo_viewpoints_usability_usability_viewpoint {
 
     private import memo_viewpoints_definitions::*;
     private import memo_core_enumerations::*;
+    private import memo_viewpoints_stakeholders_concerns::*;
 
     private import memo_core_common::*;
     private import memo_core_common::MemoIdentity;
@@ -12,16 +13,14 @@ package memo_viewpoints_usability_usability_viewpoint {
         @MemoIdentity { :>> shortDescription = "Shows use contexts, actors, use errors, and usability requirements."; }
         attribute :>> description = "Default viewpoint derived from the context and requirements layers for IEC 62366-1 usability engineering — actors, use contexts, identified use errors, and requirements tagged with the usability concern. Reuses existing context-layer elements (Actor, UseContext, UseError) rather than a separate usability layer.";
         attribute :>> purpose = "Communicate use-related hazards and usability requirements for the device.";
-        attribute :>> audience = (AudienceKind::usabilityEngineer, AudienceKind::safetyEngineer);
+        ref :>> stakeholders = (UsabilityEngineer, SafetyEngineer);
         attribute :>> stage = WorkflowStageKind::requirements;
         attribute :>> abstractionLevel = "usability";
         attribute :>> outputKind = (ViewOutputKind::documentSection);
         attribute :>> presentationKind = (PresentationKind::narrativeSection);
-        attribute :>> concernKinds = (ConcernKind::usability, ConcernKind::safety);
-        attribute :>> includedLayers = ("context", "requirements");
+        ref :>> framedConcerns = (UsabilityConcern, SafetyConcern);
         attribute :>> explorerLane = "assurance";
         attribute :>> explorerOrder = 4;
-        attribute :>> allowedElementKinds = ("Actor", "UseContext", "UseError", "Requirement");
         attribute :>> userExtensible = true;
     }
 }

package/src/viewpoints/verification/verification_viewpoint.sysml

@@ -3,6 +3,7 @@ package memo_viewpoints_verification_verification_viewpoint {
 
     private import memo_viewpoints_definitions::*;
     private import memo_core_enumerations::*;
+    private import memo_viewpoints_stakeholders_concerns::*;
 
     private import memo_core_common::*;
     private import memo_core_common::MemoIdentity;
@@ -12,16 +13,14 @@ package memo_viewpoints_verification_verification_viewpoint {
         @MemoIdentity { :>> shortDescription = "Shows verification cases, validation cases, and the evidence they produce, traced to requirements."; }
         attribute :>> description = "Default viewpoint derived from the requirements and assurance layers for V&V coverage — which requirements are verified/validated, by which case, and what evidence was produced, supporting ISO 13485 §7.3.6/§7.3.7 and IEC 62304 §5.7/§5.8.";
         attribute :>> purpose = "Communicate verification and validation coverage against requirements.";
-        attribute :>> audience = (AudienceKind::verificationEngineer);
+        ref :>> stakeholders = (VerificationEngineer);
         attribute :>> stage = WorkflowStageKind::verificationStage;
         attribute :>> abstractionLevel = "verification";
         attribute :>> outputKind = (ViewOutputKind::matrix);
         attribute :>> presentationKind = (PresentationKind::traceMatrix);
-        attribute :>> concernKinds = (ConcernKind::safety, ConcernKind::regulatory);
-        attribute :>> includedLayers = ("requirements", "assurance");
+        ref :>> framedConcerns = (SafetyConcern, RegulatoryConcern);
         attribute :>> explorerLane = "assurance";
         attribute :>> explorerOrder = 5;
-        attribute :>> allowedElementKinds = ("Requirement", "VerificationCase", "ValidationCase", "MemoEvidence");
         attribute :>> userExtensible = true;
     }
 }