@memoarchitect/ontology 0.12.1 → 0.15.0

package/src/architecture/functional/behavior/memo_behavior.sysml

@@ -40,21 +40,34 @@ package memo_architecture_functional_behavior {
     // records so the two are not confused.
     metadata def TransitionRecord {
         attribute id : String;
-        attribute name : String;
         attribute trigger : String;
         attribute guardSummary : String;
         attribute effectSummary : String;
         attribute sourceReference : String;
     }
 
-    // A verifiable behavioural constraint, such as an invariant, transition
-    // rule, temporal claim, assumption, or guarantee.
-    part def BehaviorProperty specializes VerifiableElement {
+    // A behavioural obligation, such as an invariant, transition rule,
+    // temporal claim, assumption, or guarantee. It is a `requirement def`
+    // because that is what it is: a claim the design must meet and a
+    // verification case can `verify`. It was a `part def` under
+    // VerifiableElement, which made a property a structural thing and left
+    // native `verify` unable to name it.
+    requirement def BehaviorProperty :> MemoRequirementElement {
         attribute propertyKind : BehaviorPropertyKind;
         attribute languageKind : PropertyLanguageKind;
         attribute formalExpression : String;
     }
-    part def Contract specializes VerifiableElement { attribute contractScope : String; }
+    // An assume/guarantee contract on one component, AGREE's shape one to one:
+    // the component is the `subject`, each assumption an `assume` member and
+    // each guarantee a `require` member naming a BehaviorProperty. The subject
+    // replaces `contractScope : String`, which named the component in prose
+    // and could not be navigated.
+    //
+    // This is not the procurement contract of a deliverable; that is a
+    // different definition.
+    requirement def Contract :> MemoRequirementElement {
+        subject component : MemoPart;
+    }
     // `part def PropertySet specializes VerifiableElement { attribute
     // propertySetScope : String; }` stood here and is DELETED (plan C3,
     // open question §14.6). It was AADL's property-set idea imported as a
@@ -70,7 +83,12 @@ package memo_architecture_functional_behavior {
     // annotate a BASE element rather than declare its own type, the SysML-
     // native answer is `metadata def` + `Metaobjects::SemanticMetadata`, which
     // is what every MEMO relation already carries since A4.
-    part def ActivityAction specializes MemoPart {
+    // An `action def`: every field it carries — what it does, what goes in and
+    // out, its worst-case execution time — describes behaviour. It was a
+    // `part def specializes MemoPart`, the same A0 residue `FunctionalFlow`
+    // carried, and a behaviour cannot specialize a structure, so nothing could
+    // have performed one.
+    action def ActivityAction specializes FunctionalAction {
         attribute actionKind : ActionKind;
         attribute inputSummary : String;
         attribute outputSummary : String;
@@ -84,7 +102,9 @@ package memo_architecture_functional_behavior {
     }
     // UI scenarios are OperativeScenario usages with scenarioKind `ui`.
 
-    part def TimingConstraint specializes VerifiableElement {
+    // A timing budget is an obligation on what it measures, so it is a
+    // requirement like BehaviorProperty.
+    requirement def TimingConstraint :> MemoRequirementElement {
         attribute constraintKind : TimingConstraintKind;
         attribute minMs : String;
         attribute maxMs : String;

package/src/architecture/functional/functions/memo_functions.sysml

@@ -27,6 +27,23 @@
 // project argues in — therapy, alarm, platform, protection. A function can be
 // `sense` in the `protection` category, and a safety case reasons about both.
 //
+// ─── A functional exchange is a flow ─────────────────────────────────────
+//
+// `FunctionalExchange` is an `abstract flow def`, and an exchange is a typed
+// named `flow` between function parameters: the edge IS the exchange. It was
+// a `part def` beside a separate `flow`, with its ends stored as
+// `sourceFunction`/`targetFunction` refs, because a flow could not be the
+// target of an allocation or a trace. A named flow now carries a qualified id
+// that `allocate`, `satisfy` and the rest resolve, so the part reached no
+// rule, query or diagram and existed only to be kept in step with its edge.
+//
+// It is `abstract` because a flow definition specializes the association
+// `Flows::MessageAction`, and a concrete association must declare its two
+// ends (`association-related-types`); here the ends are the usage's
+// parameters. A usage says what it carries through the item type of those
+// parameters, not with `of`: `of` and `: FunctionalExchange` together declare
+// a second `payload`, and a SysML v2 compiler rejects the pair.
+//
 // ─── System function vs. component function ──────────────────────────────
 //
 // ARCADIA's functional chain does not stop at the system boundary: system
@@ -80,34 +97,20 @@ package memo_architecture_functional_functions {
     // component is a responsibility nobody has accepted.
     action def ComponentFunction specializes MemoFunction;
 
-    // Named traceable route between functions. Native `flow of` usages carry
-    // the transported item; this element exists for the budgets and assurance
-    // attributes below.
-    //
-    // The reason is MEMO's grammar, NOT the language — the earlier wording here
-    // said "attributes that a flow usage cannot own", and that was a false
-    // claim about SysML v2. The standard's `FlowUsage` is
-    // `OccurrenceUsagePrefix 'flow' FlowDeclaration DefinitionBody`
-    // (SysML-textual-bnf.kebnf:829), so a conforming flow usage takes a name
-    // from its `UsageDeclaration` and owns attributes in its body like any
-    // other usage. MEMO's own production is
-    // `'flow' 'of' itemType 'from' … 'to' … ';'` — no name, no body — so a
-    // MEMO flow can carry neither an `id` nor a latency budget, and nothing
-    // can refer to it. Every MEMO element rests on the identification core in
-    // memo_core_common, and an anonymous attribute-less edge cannot join it.
+    // A transfer between two functions, carrying the budgets and assurance
+    // attributes a reader needs on the transfer itself. Authored as a typed
+    // named flow from an `out` parameter of one function to an `in` parameter
+    // of another:
     //
-    // So this part def is a workaround for a MEMO gap, not a design MEMO is
-    // entitled to. Restoring the two dropped clauses is what would let it
-    // collapse into the flow it stands in for.
-    part def FunctionalExchange specializes MemoPart {
+    //     flow lfFlowCommand : FunctionalExchange
+    //         from fnManageInfusion.flowCommandOut to fnCommandPump.flowCommandIn {
+    //         attribute :>> latencyBudgetMs = 20.0;
+    //     }
+    abstract flow def FunctionalExchange {
         attribute flowKind : FlowKind;
         attribute latencyBudgetMs : Real;
         attribute staleAfterMs : Real;
         attribute integrityLevel : String;
-        // MemoFunction, not SystemFunction: an exchange between two component
-        // functions is the ordinary case once the chain is decomposed.
-        ref sourceFunction : MemoFunction[0..1];
-        ref targetFunction : MemoFunction[0..1];
     }
 
     // A system function enables operational work; it does not perform it.
@@ -132,14 +135,25 @@ package memo_architecture_functional_functions {
         attribute safetyRelevant : Boolean;
         attribute securityRelevant : Boolean;
     }
-    action def FunctionalFlowStep specializes MemoAction {
-        ref function : MemoFunction[0..1];
-        ref exchange : FunctionalExchange[0..1];
-        ref item exchangedItem : MemoItem[0..1];
-    }
+    // A step is not a definition. `action def FunctionalFlowStep` stood here
+    // with `ref function`, `ref exchange` and `ref item exchangedItem`: a
+    // wrapper that pointed at the function it stood for. A step is that
+    // function performed at one position in the flow, which SysML says
+    // directly as an action usage nested in the flow that subsets it:
+    //
+    //   action fcPatientBolus : FunctionalFlow {
+    //       action fcsBolusCommand :> fnManageInfusion { out item flowCommand :> cdFlowCommand; }
+    //       action fcsBolusActuate :> fnCommandPump { in item flowCommand :> cdFlowCommand; }
+    //       first fcsBolusCommand then fcsBolusActuate;
+    //       flow from fcsBolusCommand.flowCommand to fcsBolusActuate.flowCommand;
+    //   }
+    //
+    // Each position keeps its own identity and evidence scope. The exchanged
+    // item is a directed parameter of the step, and the exchange a `flow`
+    // between two steps' parameters. A step's parameters redefine its
+    // function's by position.
 
     // `InvolvesFunction` is native `perform` (R10-S6): a `FunctionalFlow`
-    // already names its functions via its step chain
-    // (`perform <step>;` + the step's own `ref function`), and a flow with no
-    // step chain performs its functions directly.
+    // performs the function each of its steps subsets, and a flow with no
+    // steps performs its functions directly.
 }

package/src/architecture/functional/memo_architecture_functional.sysml

@@ -0,0 +1,14 @@
+// The functional (system) analysis layer as one package.
+//
+// A layer is a namespace of packages: every package whose name begins
+// `memo_architecture_functional_`. This package publicly imports each of them, so
+// `public import memo_architecture_functional::*;` in a methodology's package selects the whole
+// layer, and the same import in any package makes the layer's definitions
+// visible. It declares nothing of its own. test/package.test.mjs holds the list
+// to exactly the packages in the namespace, so a package added to the layer is
+// selected with it.
+package memo_architecture_functional {
+    public import memo_architecture_functional_behavior::*;
+    public import memo_architecture_functional_constraints::*;
+    public import memo_architecture_functional_functions::*;
+}

package/src/architecture/implementation/memo_architecture_implementation.sysml

@@ -0,0 +1,21 @@
+// The implementation (software, hardware, user interface) layer as one package.
+//
+// A layer is a namespace of packages: every package whose name begins
+// `memo_architecture_implementation_`. This package publicly imports each of them, so
+// `public import memo_architecture_implementation::*;` in a methodology's package selects the whole
+// layer, and the same import in any package makes the layer's definitions
+// visible. It declares nothing of its own. test/package.test.mjs holds the list
+// to exactly the packages in the namespace, so a package added to the layer is
+// selected with it.
+package memo_architecture_implementation {
+    public import memo_architecture_implementation_hardware_common::*;
+    public import memo_architecture_implementation_hardware_electrical::*;
+    public import memo_architecture_implementation_hardware_fluidic::*;
+    public import memo_architecture_implementation_hardware_mechanical::*;
+    public import memo_architecture_implementation_hardware_optical::*;
+    public import memo_architecture_implementation_hardware_sensing::*;
+    public import memo_architecture_implementation_hardware_structure::*;
+    public import memo_architecture_implementation_software_runtime::*;
+    public import memo_architecture_implementation_software_structure::*;
+    public import memo_architecture_implementation_ui::*;
+}

package/src/architecture/implementation/software/runtime/memo_software_runtime.sysml

@@ -78,4 +78,11 @@ package memo_architecture_implementation_software_runtime {
         // a component belongs to without claiming to describe it.
     }
 
+    // A runtime service or process that exists only because an OTS module is
+    // deployed. Optional: a library the product links normally needs only the
+    // module.
+    part def OTSSoftwareComponent specializes SoftwareComponent {
+        ref sourceModule : OTSSoftwareModule[0..1];
+    }
+
 }

package/src/architecture/implementation/software/structure/memo_software_structure.sysml

@@ -24,10 +24,9 @@ package memo_architecture_implementation_software_structure {
     // software view inherits it rather than re-declaring it: the code view
     // (SoftwareModule), the runtime view (SoftwareComponent), the system, and
     // the user interface (memo_architecture_implementation_ui::UIElement).
-    // Structural software decomposition is part-native. IEC 62304 also uses
-    // the term "software item" for this concept, but reserving SoftwareItem
-    // for the native SysML item family keeps structural parts and exchanged
-    // values unambiguous in the model.
+    // Structural software decomposition is part-native. The standard's
+    // "software item" is this part, not an `item def`: exchanged or stored
+    // values are DataItem, below.
     abstract part def SoftwareElement specializes MemoPart {
         attribute safetyClass : SafetyClassKind;
         attribute complexity : ComplexityKind;
@@ -40,7 +39,8 @@ package memo_architecture_implementation_software_structure {
 
     // Module-view element (design responsibility). Runtime properties
     // (period, WCET, scheduling) moved to SoftwareComponent.
-    // item / unit / package / library / code / firmware / soup (IEC 62304).
+    // item / unit / package / library / code / firmware (IEC 62304). SOUP is
+    // a type (SOUPSoftwareModule), not a value here.
     enum def ModuleKind {
         enum 'item';
         enum unit;
@@ -48,7 +48,6 @@ package memo_architecture_implementation_software_structure {
         enum 'library';
         enum code;
         enum firmware;
-        enum soup;
     }
 
     part def SoftwareModule specializes SoftwareElement {
@@ -62,12 +61,6 @@ package memo_architecture_implementation_software_structure {
         attribute internallyDeveloped : Boolean[0..1];
         attribute firmwareTarget : String[0..1];
         attribute updateMechanism : String[0..1];
-        // SOUP (IEC 62304 §8) — set only when moduleKind = soup
-        attribute soupVersion : String[0..1];
-        attribute soupVendor : String[0..1];
-        attribute knownAnomalies : String[0..1];
-        attribute riskAcceptance : String[0..1];
-        attribute soupClassification : SOUPClassificationKind[0..1];
     }
 
     part def Algorithm specializes MemoPart {
@@ -85,20 +78,68 @@ package memo_architecture_implementation_software_structure {
         attribute version : String;
     }
 
-    // Software data/content that may be stored or exchanged through ports.
-    abstract item def SoftwareItem specializes MemoItem {
+    // Data content that may be stored or exchanged through ports. Named
+    // DataItem, not SoftwareItem: IEC 62304 uses "software item" for a
+    // structural part of a program (a SoftwareElement here), and the item
+    // family is the exchanged or stored value.
+    abstract item def DataItem specializes MemoItem {
         attribute schemaIdentifier : String;
         attribute schemaVersion : String;
         attribute :>> encoding : String;
         attribute :>> timestampRequired : Boolean;
     }
 
-    item def SBOMEntry specializes SoftwareItem {
+    // SOUP and OTS (IEC 62304 §3.29). The standard's SOUP definition covers
+    // off-the-shelf software and also previously developed software that
+    // lacks development records, so OTS is the narrower type: every OTS
+    // module is SOUP, and SOUP also covers legacy in-house code with no
+    // supplier, license or package to record. SOUP is a type, not a
+    // module-kind value; the CR-MED-015..017 closure rules apply to it and so
+    // to OTS.
+    //
+    // §8.1.2 (SOUP identification: supplier, version) and §7.1.3 (published
+    // anomaly lists) are SOUP obligations, so those attributes sit here; the
+    // acquisition identity of a bought or downloaded package sits on
+    // OTSSoftwareModule.
+    part def SOUPSoftwareModule specializes SoftwareModule {
+        attribute supplier : String[0..1];
+        attribute version : String[0..1];
+        attribute knownAnomalies : String[0..1];
+        attribute riskAcceptance : String[0..1];
+        attribute soupClassification : SOUPClassificationKind[0..1];
+    }
+    part def OTSSoftwareModule specializes SOUPSoftwareModule {
+        attribute licenseExpression : String;
+        attribute packageUrl : String;
+        attribute checksum : String;
+    }
+
+    enum def SbomFormatKind {
+        enum spdx;
+        enum cycloneDx;
+        enum other;
+    }
+
+    // An SBOM is a document; its entries are inventory records. An entry
+    // names one software element and says what is known about it as shipped.
+    // Vulnerabilities, anomalies and risks are separate objects that point at
+    // the entry; they are not attributes of the document.
+    part def SBOMEntry specializes MemoPart {
         attribute componentName : String;
         attribute version : String;
         attribute supplier : String;
-        attribute license : String;
-        attribute hash : String;
+        attribute licenseExpression : String;
+        attribute checksum : String;
+        attribute packageUrl : String;
+        attribute bomReference : String;
+        ref inventoriedElement : SoftwareElement[0..1];
+    }
+    part def SoftwareBillOfMaterials specializes MemoPart {
+        attribute sbomFormat : SbomFormatKind;
+        attribute specVersion : String;
+        attribute generationTool : String;
+        attribute generatedOn : String;
+        part sbomEntry : SBOMEntry[0..*];
     }
 
     // `ModuleUses` is native `dependency` (R10-S6): write

package/src/architecture/implementation/ui/memo_ui.sysml

@@ -299,7 +299,7 @@ package memo_architecture_implementation_ui {
     // `PresentsState` had zero usages anywhere in the tree (R10-S6). Its
     // audited native form, `exhibit state`, does not actually fit: `UIState`
     // is a `part def` with plain string attributes, not a `state def`, and
-    // SysIDE rejects `exhibit` referencing anything that does not conform to
+    // a SysML v2 compiler rejects `exhibit` referencing anything that does not conform to
     // `States::StateAction` ("An exhibit state must reference another
     // state"). Free deletion rather than a migration — nothing referenced
     // it, so nothing to preserve. If `UIState` is ever restructured onto a

package/src/architecture/logical/interfaces/memo_interfaces.sysml

@@ -1,3 +1,39 @@
+// Logical interfaces: the Interface definition, ports, exchange items, and
+// the component exchange.
+//
+// ─── A component exchange is an interface ────────────────────────────────
+//
+// `ComponentExchange` is an `interface def`: the edge between two ports IS
+// the exchange. It was a `part def` whose `sourceEndpoint`/`targetEndpoint`
+// refs named the ports, beside a separate `flow` or `bind` naming them again,
+// and CR-ONT-076 existed only to keep the two representations in step. It
+// also lost information: the builder stored a dotted ref value as its first
+// segment only, so every endpoint read as the enclosing device, and
+// CR-ONT-072/073 checked the device instead of the port.
+//
+// Its ends are the ports, and they are ports, never components: §6.2 of the
+// architecture plan requires an actual boundary port, and a rule
+// (CR-ONT-072/073) says so because the compiler does not — it accepts a
+// part at an interface end even when the definition types its ends.
+//
+// ─── Transport, delegation, and the choice between them ──────────────────
+//
+// Two ports joined by an interface still need a statement of what moves:
+// the `flow` between the same two ports. The interface is the path, and the
+// flow is the transfer over it.
+//
+// An enclosing part's boundary port and the port of a part inside it are a
+// different case, decided per hop:
+//
+//   flow     when the hop has something of its own to model: a delay, a
+//            queue, a timing or latency budget, a protocol. Write it inside
+//            the enclosing part's body, where the boundary port is a source.
+//   binding  when the boundary port is the inner port exposed and nothing
+//            happens between them: `binding name bind outer = inner { … }`,
+//            carrying the connection's identity and citation in its body.
+//
+// A delegation that is a binding is not a ComponentExchange: nothing
+// interacts, and one feature is seen from both sides.
 package memo_architecture_logical_interfaces {
     private import ScalarValues::*;
 
@@ -15,40 +51,40 @@ package memo_architecture_logical_interfaces {
     // DigitalInterface / SPIInterface / RestInterface … hierarchy: those were
     // 20+ classes that differed only in the value of `protocol`.
 
+    // The common contract of an interface, whatever layer it is on: what
+    // crosses, which way, under what timing, and how much it matters to
+    // safety and security. It is abstract. An interface is a LOGICAL one
+    // (between components, in terms of what is exchanged), a SOFTWARE one
+    // (a contract between software items) or a PHYSICAL one (between
+    // hardware ports), and those are three different things that share
+    // attributes, not one thing with three sets of optional fields. Each
+    // specialization adds only what its layer can state: PhysicalInterface
+    // the signal and the medium, SoftwareInterface the API.
+    //
     // Specializes the standard library interface as well as MEMO's base,
     // rather than shadowing it — see the note on UseCase.
-    interface def Interface specializes MemoInterface, Interfaces::Interface {
-        attribute interfaceKind : InterfaceKind;   // semantic + signaling family
+    abstract interface def Interface specializes MemoInterface, Interfaces::Interface {
+        attribute interfaceKind : InterfaceKind;   // what crosses
         attribute direction : DirectionKind;
         attribute protocol : String;               // "SPI", "CAN", "Ethernet", "REST", "4-20mA"
         attribute protocolSemantics : String;
+        attribute timeoutMs : Real[0..1];
+        attribute retryPolicy : String[0..1];
         attribute interactionPattern : String;     // request-response, pub-sub, streaming…
-        attribute signalKind : String;
         attribute timingSummary : String;
         attribute timingConstraint : String;
         attribute bandwidth : String;
-        attribute schemaReference : String;
         attribute compatibilitySummary : String;
         attribute isolationRequirement : String;
         attribute safetyRelevant : Boolean;
         attribute securityCriticality : CriticalityKind;
         // Applied-part/patient-contact interfaces (IEC 60601-1) must state it.
         attribute patientContactInterface : Boolean;
-        // ── hardware-signal descriptors (optional) ──
-        attribute directionality : DirectionKind[0..1];
-        attribute electricalStandard : String;
-        attribute nominalVoltageV : Real[0..1];
-        attribute nominalCurrentA : Real[0..1];
-        attribute bitRateBps : String;
-        attribute signaling : String;
-        attribute signalRange : String;
-        // ── software-API descriptors (optional) ──
-        attribute apiStyle : String;
     }
 
-    // Software interaction contracts specialize the native MEMO interface
-    // family. Concrete technologies add their protocol roles and message
-    // flows; ports remain the endpoints that components actually own.
+    // Software interaction contracts. Concrete technologies add their
+    // protocol roles and message flows; ports remain the endpoints that
+    // components actually own.
     abstract interface def SoftwareInterface specializes Interface {
         // `default`, not `=`. A bare `=` in a definition BINDS the value, and
         // a binding cannot be overridden by a usage — which asserted that
@@ -56,6 +92,8 @@ package memo_architecture_logical_interfaces {
         // inexpressible. A ROS topic publisher → subscriber is the obvious
         // counterexample, and it is the common case rather than an exotic one.
         attribute :>> direction default DirectionKind::inputOutput;
+        attribute apiStyle : String;
+        attribute schemaReference : String;
     }
 
     // A typed thing exchanged at a boundary. Concrete items such as
@@ -87,48 +125,19 @@ package memo_architecture_logical_interfaces {
     port def SensorPort specializes DataPort { attribute sensorDomain : String; }
     port def CommandPort specializes DataPort { attribute commandDomain : String; }
 
-    part def ComponentExchange specializes MemoPart {
+    // An interaction between two component ports, and the properties of that
+    // connection itself: what kind of thing it carries and its timing
+    // discipline. Authored as a typed named interface between the two ports,
+    // with the transport over it as a `flow` between the same ports:
+    //
+    //     interface ceTlmOutToOutput : ComponentExchange
+    //         connect tlm.portTlmModeOut to outputBus.portOutputTlmModeIn {
+    //         attribute :>> exchangeKind = FlowKind::status;
+    //     }
+    //     flow ceTlmOutToOutputFlow of InterfaceItem
+    //         from tlm.portTlmModeOut to outputBus.portOutputTlmModeIn;
+    interface def ComponentExchange specializes MemoInterface {
         attribute exchangeKind : FlowKind;
-        // Metaclass-neutral endpoints. CR-ONT-002 used to read: "Typed
-        // endpoints. A component or a boundary port may terminate an exchange,
-        // so the ends are MemoPart-typed." That reasoning was circular —
-        // PhysicalPort and SoftwarePort are part defs precisely SO THAT they
-        // could satisfy this typing, and the typing was justified by their
-        // being parts. Track A0 cut the circle at the ends, which is the side
-        // that has to move first: A1 turns those two into `port def`s, and a
-        // port cannot specialize a part-based type.
-        //
-        // The constraint the type was carrying — an endpoint is a component or
-        // a boundary port, never a requirement or a document — is now stated
-        // where it can be checked across metaclasses, as CR-ONT-072/073 in
-        // src/rules/ontology/ontology_invariants.sysml.
-        //
-        // `Base::Anything` rather than no type at all — the only place in this
-        // change that reaches for it. The 36 untyped ends in
-        // memo_core_relationships are `end` declarations, and an untyped `end`
-        // is established practice; an untyped `ref` with a multiplicity is not
-        // something MEMO's own grammar accepts (`Expecting token of type ';'
-        // but found '['`), and the grammar is not in this session's scope.
-        // `Base::Anything` is what the standard's `Allocations::Allocation`
-        // types its own ends with, so it is the conforming spelling of "any
-        // element", not a workaround.
-        ref sourceEndpoint : Base::Anything[0..1];
-        ref targetEndpoint : Base::Anything[0..1];
-        // `sourcePortPath` / `targetPortPath` are GONE. They were String
-        // "descriptive port paths (e.g. TLM.TLM_MODE_OUT) for AADL round-trips;
-        // labels only — never references", which is §13.3's string
-        // pseudo-reference: nothing can follow a string to an element, so
-        // anything built on them produced no traceability.
-        //
-        // Measured across the 92 sites in the GPCA example before removing
-        // them: 23 merely restated the endpoint the ref already named (15 gave
-        // the port's own display name, 8 were prose like "HW-001:
-        // GPCA_HW_Sensors"), and the other 69 named a port ON the endpoint
-        // component, resolving to 49 distinct AADL features. Those 49 are
-        // declared as real ports now and the endpoint refs point straight at
-        // them, which is what Track A1 making SoftwarePort a `port def` is for.
-        // The AADL round-trip is better served by an element than by its name.
-        ref allocatedExchanges : FunctionalExchange[0..*];
         attribute direction : DirectionKind;
         // Connection timing discipline from the source architecture
         // (e.g. AADL Communication_Properties::Timing — immediate

package/src/architecture/logical/memo_architecture_logical.sysml

@@ -0,0 +1,13 @@
+// The logical architecture layer as one package.
+//
+// A layer is a namespace of packages: every package whose name begins
+// `memo_architecture_logical_`. This package publicly imports each of them, so
+// `public import memo_architecture_logical::*;` in a methodology's package selects the whole
+// layer, and the same import in any package makes the layer's definitions
+// visible. It declares nothing of its own. test/package.test.mjs holds the list
+// to exactly the packages in the namespace, so a package added to the layer is
+// selected with it.
+package memo_architecture_logical {
+    public import memo_architecture_logical_interfaces::*;
+    public import memo_architecture_logical_structure::*;
+}

package/src/architecture/logical/structure/memo_logical_structure.sysml

@@ -10,6 +10,7 @@ package memo_architecture_logical_structure {
     private import memo_core_common::*;
     private import memo_core_enumerations::*;
     private import memo_core_relationships::*;
+    private import memo_architecture_logical_interfaces::Interface;
 
     // What a logical connection carries: information and control, but also
     // energy, material, fluid, and mechanical force (§10).
@@ -139,9 +140,8 @@ package memo_architecture_logical_structure {
 
     // Boundary features and contracts.
     port def LogicalPort specializes MemoPort;
-    interface def LogicalInterface specializes MemoInterface {
+    interface def LogicalInterface specializes Interface {
         attribute contentKind : FlowContentKind;
-        attribute interactionPattern : String;
         end providerPort : LogicalPort;
         end consumerPort : ~LogicalPort;
     }
@@ -162,14 +162,33 @@ package memo_architecture_logical_structure {
         :> annotatedElement : SysML::ConnectionUsage;
         :>> baseType = logicalConnectorLinks meta SysML::Usage;
     }
-    // A transfer of a typed item across a connector.
-    part def LogicalExchange specializes MemoPart {
+    // A transfer between two ports, carrying what a reader needs to know about
+    // the transfer itself. Authored as a typed named flow between the item
+    // features the two ports declare, the way `FunctionalExchange` is between
+    // function parameters:
+    //
+    //     part lcMonitor { out port pSpo2Out : LogicalPort { out item spo2 :> spo2Item; } }
+    //     flow exSpo2ToGateway : LogicalExchange
+    //         from lcMonitor.pSpo2Out.spo2 to lcGateway.pSpo2In.spo2 {
+    //         attribute :>> contentKind = FlowContentKind::measurement;
+    //     }
+    //
+    // It was a `part def` holding `sourcePort`, `targetPort` and
+    // `exchangedItem` refs. No example set either port, so no exchange said
+    // what it connected. The flow's ends are those ports now,
+    // and its payload the item feature on them. `direction` is not carried
+    // over: the ports say `in` and `out`, and a second writable direction is
+    // the duplicate §8 of the architecture plan forbids.
+    //
+    // The ends are not restricted to `LogicalPort`. Two of the three examples
+    // move a specimen or a force between hardware parts, and a flow def that
+    // named `LogicalPort` ends would have refused them. `payload` is not
+    // declared either: `of <type>` on a usage of a flow def that declares a
+    // feature is not distinguishable (namespace distinguishability) from the
+    // library's own `payload`, so the payload lives on the ports.
+    abstract flow def LogicalExchange {
         attribute contentKind : FlowContentKind;
-        attribute direction : DirectionKind;
         attribute latencyRequirement : String;
-        ref exchangedItem : LogicalExchangeItem[0..1];
-        ref sourcePort : LogicalPort[0..1];
-        ref targetPort : LogicalPort[0..1];
     }
 
     // States and modes of the logical solution (kept distinct from UI state

package/src/architecture/operational/context/stakeholders/memo_stakeholders.sysml

@@ -33,9 +33,12 @@ package memo_architecture_operational_context_stakeholders {
         enum correspondence;
         enum 'use';
     }
+    // The governor spans metaclasses — a CorrespondenceRule is a part, an
+    // IntendedUse a requirement — so that end stays untyped, as DerivesFrom's
+    // driver does. What is governed is always a structural element.
     connection def Governs :> MemoRelationship {
         attribute governKind : GovernKind;
-        end governor : MemoPart :>> source;
+        end governor :>> source;
         end governedElement : MemoPart :>> target;
     }
     abstract connection governsLinks : Governs[*];

package/src/architecture/operational/memo_architecture_operational.sysml

@@ -0,0 +1,19 @@
+// The operational analysis layer as one package.
+//
+// A layer is a namespace of packages: every package whose name begins
+// `memo_architecture_operational_`. This package publicly imports each of them, so
+// `public import memo_architecture_operational::*;` in a methodology's package selects the whole
+// layer, and the same import in any package makes the layer's definitions
+// visible. It declares nothing of its own. test/package.test.mjs holds the list
+// to exactly the packages in the namespace, so a package added to the layer is
+// selected with it.
+package memo_architecture_operational {
+    public import memo_architecture_operational_activities::*;
+    public import memo_architecture_operational_context_actors::*;
+    public import memo_architecture_operational_context_stakeholders::*;
+    public import memo_architecture_operational_context_use_context::*;
+    public import memo_architecture_operational_scenarios::*;
+    public import memo_architecture_operational_structure::*;
+    public import memo_architecture_operational_use_cases::*;
+    public import memo_architecture_operational_workflows::*;
+}