@memoarchitect/ontology 0.13.2 → 0.15.0

package/examples/gpca-pump/model/catalog/gpca_verification.sysml

@@ -2,6 +2,7 @@ package memo_examples_gpca_pump_gpca_verification {
     private import memo_examples_gpca_pump_gpca_requirements::*;
     private import memo_examples_gpca_pump_gpca_formal_behavior::*;
     private import memo_examples_gpca_pump_gpca_architecture::*;
+    private import memo_examples_gpca_pump_gpca_behavior_subsystems::*;
     private import memo_examples_gpca_pump_gpca_risk::*;
     private import memo_examples_gpca_pump_gpca_behavior_modes::*;
     private import ScalarValues::*;
@@ -13,59 +14,60 @@ package memo_examples_gpca_pump_gpca_verification {
 
     private import memo_core_common::MemoIdentity;
     // ── Verification cases ──────────────────────────────────────
+    // A safety-critical function is verified when a test traces to it
+    // (CR-ONT-040), which is not the same as the requirement it satisfies being
+    // verified or the module it is allocated to being tested. Each function is
+    // named as a subject of the case whose acceptance criteria exercise the
+    // output its `outputSummary` describes. AcquireSensorData and
+    // AggregateSensorStatus are not: no case here tests the debounced,
+    // range-checked status vector, and naming one would claim a test that
+    // does not exist.
     verification vcModeRange : VerificationCase {
-        @MemoIdentity { :>> providedId = "VER-001"; }
-        attribute :>> name = "VerifyModeRange";
+        @MemoIdentity { :>> providedId = "VER-001"; :>> label = "VerifyModeRange"; }
         attribute :>> methodKind = MemoVerificationMethodKind::formalProof;
         attribute :>> acceptanceCriteria = "Current_System_mode only takes valid exclusive values";
         attribute :>> status = ElementStatusKind::approved;
 
-        objective { verify reqCs01; }
-        subject verified : Base::Anything[*] = (guaranteeExclusiveMode, gpcaDevice.gpcaSoftware.tlm, gpcaDevice.gpcaSoftware.outputBus);
+        objective { verify reqCs01; verify guaranteeExclusiveMode; }
+        subject verified : Base::Anything[*] = (gpcaSoftware.tlm, gpcaSoftware.outputBus, fnManageInfusion);
     }
     verification vcLockout : VerificationCase {
-        @MemoIdentity { :>> providedId = "VER-002"; }
-        attribute :>> name = "VerifyBolusLockout";
+        @MemoIdentity { :>> providedId = "VER-002"; :>> label = "VerifyBolusLockout"; }
         attribute :>> methodKind = MemoVerificationMethodKind::test;
         attribute :>> acceptanceCriteria = "No patient bolus initiated when lockout or max bolus constraints active";
         attribute :>> status = ElementStatusKind::approved;
 
-        objective { verify reqCs25; }
-        subject verified : Base::Anything[*] = (lockoutControl, guaranteeLockoutPreventsBolus, tcBolusResponse, gpcaDevice.gpcaSoftware.infusionMgr);
+        objective { verify reqCs25; verify guaranteeLockoutPreventsBolus; verify tcBolusResponse; }
+        subject verified : Base::Anything[*] = (lockoutControl, gpcaSoftware.infusionMgr, fnEnforceLimits);
     }
     verification vcSameStepAlarm : VerificationCase {
-        @MemoIdentity { :>> providedId = "VER-003"; }
-        attribute :>> name = "VerifySameStepAlarmStop";
+        @MemoIdentity { :>> providedId = "VER-003"; :>> label = "VerifySameStepAlarmStop"; }
         attribute :>> methodKind = MemoVerificationMethodKind::modelChecking;
         attribute :>> acceptanceCriteria = "Alarm output affects infusion in same execution step";
         attribute :>> status = ElementStatusKind::approved;
 
-        objective { verify reqCs19; }
-        subject verified : Base::Anything[*] = (propAlarmStopsSameStep, guaranteeAlarmStopsSameStep, tcAlarmLatency, gpcaDevice.gpcaSoftware.alarm);
+        objective { verify reqCs19; verify propAlarmStopsSameStep; verify guaranteeAlarmStopsSameStep; verify tcAlarmLatency; }
+        subject verified : Base::Anything[*] = (gpcaSoftware.alarm, fnMonitorAlarm);
     }
     verification vcTemporalModeSafety : VerificationCase {
-        @MemoIdentity { :>> providedId = "VER-004"; }
-        attribute :>> name = "VerifyTemporalModeSafety";
+        @MemoIdentity { :>> providedId = "VER-004"; :>> label = "VerifyTemporalModeSafety"; }
         attribute :>> methodKind = MemoVerificationMethodKind::modelChecking;
         attribute :>> acceptanceCriteria = "No invalid transitions and pause on critical alarms";
         attribute :>> status = ElementStatusKind::approved;
 
-        objective { verify reqCs75; verify reqDoorOpen; }
-        subject verified : Base::Anything[*] = (propLockoutTimerMonotonic, temporalNoInvalidTransition);
+        objective { verify reqCs75; verify reqDoorOpen; verify propLockoutTimerMonotonic; verify temporalNoInvalidTransition; }
     }
     verification vcAirInLine : VerificationCase {
-        @MemoIdentity { :>> providedId = "VER-005"; }
-        attribute :>> name = "VerifyAirInLineStop";
+        @MemoIdentity { :>> providedId = "VER-005"; :>> label = "VerifyAirInLineStop"; }
         attribute :>> methodKind = MemoVerificationMethodKind::test;
         attribute :>> acceptanceCriteria = "Injected air above threshold pauses infusion and annunciates per the REQ 59 High-priority actions (REQ-CS-21)";
         attribute :>> status = ElementStatusKind::approved;
 
         objective { verify reqCs21; }
-        subject verified : Base::Anything[*] = (airDetectionControl);
+        subject verified : Base::Anything[*] = (airDetectionControl, fnAcquireSensors.cfnDetectAirInLine);
     }
     verification vcOcclusion : VerificationCase {
-        @MemoIdentity { :>> providedId = "VER-006"; }
-        attribute :>> name = "VerifyOcclusionDetection";
+        @MemoIdentity { :>> providedId = "VER-006"; :>> label = "VerifyOcclusionDetection"; }
         attribute :>> methodKind = MemoVerificationMethodKind::test;
         attribute :>> acceptanceCriteria = "Clamped line above pressure threshold pauses infusion and annunciates (REQ-X-04)";
         attribute :>> status = ElementStatusKind::approved;
@@ -74,47 +76,43 @@ package memo_examples_gpca_pump_gpca_verification {
         subject verified : Base::Anything[*] = (occlusionAlarmControl);
     }
     verification vcEmptyReservoir : VerificationCase {
-        @MemoIdentity { :>> providedId = "VER-007"; }
-        attribute :>> name = "VerifyEmptyReservoirStop";
+        @MemoIdentity { :>> providedId = "VER-007"; :>> label = "VerifyEmptyReservoirStop"; }
         attribute :>> methodKind = MemoVerificationMethodKind::test;
         attribute :>> acceptanceCriteria = "Reservoir-empty assertion transitions to PAUSED (KVO flow) and annunciates per the REQ 59 High-priority actions (REQ-CS-23)";
         attribute :>> status = ElementStatusKind::approved;
 
         objective { verify reqCs23; }
-        subject verified : Base::Anything[*] = (reservoirMonitorControl, gpcaDevice.gpcaSoftware.systemStatus);
+        subject verified : Base::Anything[*] = (reservoirMonitorControl, gpcaSoftware.systemStatus);
     }
     verification vcPost : VerificationCase {
-        @MemoIdentity { :>> providedId = "VER-008"; }
-        attribute :>> name = "VerifyPowerOnSelfTest";
+        @MemoIdentity { :>> providedId = "VER-008"; :>> label = "VerifyPowerOnSelfTest"; }
         attribute :>> methodKind = MemoVerificationMethodKind::test;
         attribute :>> acceptanceCriteria = "Each injected POST fault (CPU, RAM, ROM, watchdog, sensors) blocks therapy and alarms (REQ-X-02)";
         attribute :>> status = ElementStatusKind::approved;
 
         objective { verify reqPost; }
-        subject verified : Base::Anything[*] = (gpcaDevice.gpcaSoftware.systemMonitor);
+        subject verified : Base::Anything[*] = (gpcaSoftware.systemMonitor, fnSelfTest);
     }
     verification vcPowerLoss : VerificationCase {
-        @MemoIdentity { :>> providedId = "VER-009"; }
-        attribute :>> name = "VerifyPowerLossRetentionAndResume";
+        @MemoIdentity { :>> providedId = "VER-009"; :>> label = "VerifyPowerLossRetentionAndResume"; }
         attribute :>> methodKind = MemoVerificationMethodKind::test;
         attribute :>> acceptanceCriteria = "Prescription and log intact after power cycle; therapy resumes only after confirmation (REQ-X-03)";
         attribute :>> status = ElementStatusKind::approved;
 
         objective { verify reqPowerLossRetention; verify reqBatteryBackup; }
+        subject verified : Base::Anything[*] = (fnManagePower);
     }
     verification vcWatchdog : VerificationCase {
-        @MemoIdentity { :>> providedId = "VER-010"; }
-        attribute :>> name = "VerifyWatchdogSafeState";
+        @MemoIdentity { :>> providedId = "VER-010"; :>> label = "VerifyWatchdogSafeState"; }
         attribute :>> methodKind = MemoVerificationMethodKind::test;
         attribute :>> acceptanceCriteria = "Induced CPU hang forces zero flow and continuous alarm within 60 ms (REQ-X-08, TC-003)";
         attribute :>> status = ElementStatusKind::approved;
 
-        objective { verify reqWatchdogSafeState; }
-        subject verified : Base::Anything[*] = (watchdogControl, tcWatchdogTimeout);
+        objective { verify reqWatchdogSafeState; verify tcWatchdogTimeout; }
+        subject verified : Base::Anything[*] = watchdogControl;
     }
     verification vcHourlyMax : VerificationCase {
-        @MemoIdentity { :>> providedId = "VER-011"; }
-        attribute :>> name = "VerifyHourlyDoseCeiling";
+        @MemoIdentity { :>> providedId = "VER-011"; :>> label = "VerifyHourlyDoseCeiling"; }
         attribute :>> methodKind = MemoVerificationMethodKind::simulation;
         attribute :>> acceptanceCriteria = "Randomized bolus/basal schedules never exceed hourly maximum in sliding window (REQ-X-06)";
         attribute :>> status = ElementStatusKind::approved;
@@ -122,26 +120,25 @@ package memo_examples_gpca_pump_gpca_verification {
         objective { verify reqMaxHourlyDose; }
     }
     verification vcPumpAccuracy : VerificationCase {
-        @MemoIdentity { :>> providedId = "VER-012"; }
-        attribute :>> name = "VerifyDeliveryAccuracy";
+        @MemoIdentity { :>> providedId = "VER-012"; :>> label = "VerifyDeliveryAccuracy"; }
         attribute :>> methodKind = MemoVerificationMethodKind::test;
         attribute :>> acceptanceCriteria = "Gravimetric bench measurement within ±5% (Tolerance_Min_const) across rate range (REQ-X-11)";
         attribute :>> status = ElementStatusKind::approved;
 
         objective { verify reqPumpAccuracy; }
+        subject verified : Base::Anything[*] = (fnCommandPump);
     }
     verification vcAlarmLoudness : VerificationCase {
-        @MemoIdentity { :>> providedId = "VER-013"; }
-        attribute :>> name = "VerifyAlarmSoundPressure";
+        @MemoIdentity { :>> providedId = "VER-013"; :>> label = "VerifyAlarmSoundPressure"; }
         attribute :>> methodKind = MemoVerificationMethodKind::test;
         attribute :>> acceptanceCriteria = "Each priority tone meets Audio_level_const, 50 db for 2 s per I 8 (REQ-X-12)";
         attribute :>> status = ElementStatusKind::approved;
 
         objective { verify reqCs72; verify reqAlarmLoudness; }
+        subject verified : Base::Anything[*] = (fnAnnunciate);
     }
     verification vcFreeFlow : VerificationCase {
-        @MemoIdentity { :>> providedId = "VER-014"; }
-        attribute :>> name = "VerifyAntiFreeFlowValve";
+        @MemoIdentity { :>> providedId = "VER-014"; :>> label = "VerifyAntiFreeFlowValve"; }
         attribute :>> methodKind = MemoVerificationMethodKind::test;
         attribute :>> acceptanceCriteria = "No gravity flow with set disengaged under worst-case head height (REQ-X-14)";
         attribute :>> status = ElementStatusKind::approved;
@@ -150,8 +147,7 @@ package memo_examples_gpca_pump_gpca_verification {
         subject verified : Base::Anything[*] = (freeFlowValveControl);
     }
     verification vcStuckButton : VerificationCase {
-        @MemoIdentity { :>> providedId = "VER-015"; }
-        attribute :>> name = "VerifyStuckButtonDetection";
+        @MemoIdentity { :>> providedId = "VER-015"; :>> label = "VerifyStuckButtonDetection"; }
         attribute :>> methodKind = MemoVerificationMethodKind::test;
         attribute :>> acceptanceCriteria = "Shorted pendant input yields no bolus and Medium-priority notification after 60 s (REQ-X-09)";
         attribute :>> status = ElementStatusKind::approved;
@@ -159,48 +155,44 @@ package memo_examples_gpca_pump_gpca_verification {
         objective { verify reqStuckButton; }
     }
     verification vcFlowCrossCheck : VerificationCase {
-        @MemoIdentity { :>> providedId = "VER-016"; }
-        attribute :>> name = "VerifyFlowCrossCheck";
+        @MemoIdentity { :>> providedId = "VER-016"; :>> label = "VerifyFlowCrossCheck"; }
         attribute :>> methodKind = MemoVerificationMethodKind::test;
         attribute :>> acceptanceCriteria = "Injected deviation beyond Tolerance_Min_const sustained past Max_Duration_OverInfusion_const pauses therapy and annunciates (REQ-X-10)";
         attribute :>> status = ElementStatusKind::approved;
 
         objective { verify reqFlowCrossCheck; }
-        subject verified : Base::Anything[*] = (flowCrossCheckControl);
+        subject verified : Base::Anything[*] = (flowCrossCheckControl, fnAcquireSensors.cfnMeasureFlowRate);
     }
 
     verification vcDrugLibrary : VerificationCase {
-        @MemoIdentity { :>> providedId = "VER-017"; }
-        attribute :>> name = "VerifyDrugLibraryEnforcement";
+        @MemoIdentity { :>> providedId = "VER-017"; :>> label = "VerifyDrugLibraryEnforcement"; }
         attribute :>> methodKind = MemoVerificationMethodKind::test;
         attribute :>> acceptanceCriteria = "Hard-limit entries rejected, soft-limit entries require confirmation, both logged (REQ-X-01)";
         attribute :>> status = ElementStatusKind::approved;
 
         objective { verify reqDrugLibraryLimits; }
-        subject verified : Base::Anything[*] = (drugLibraryControl, gpcaDevice.gpcaSoftware.config);
+        subject verified : Base::Anything[*] = (drugLibraryControl, gpcaSoftware.config, fnValidatePrescription);
     }
     verification vcPrescriptionConfirm : VerificationCase {
-        @MemoIdentity { :>> providedId = "VER-018"; }
-        attribute :>> name = "VerifyPrescriptionConfirmation";
+        @MemoIdentity { :>> providedId = "VER-018"; :>> label = "VerifyPrescriptionConfirmation"; }
         attribute :>> methodKind = MemoVerificationMethodKind::demonstration;
         attribute :>> acceptanceCriteria = "Therapy cannot start without distinct confirmation; displayed values equal stored values (REQ-CS-09)";
         attribute :>> status = ElementStatusKind::approved;
 
         objective { verify reqCs09; }
+        subject verified : Base::Anything[*] = (fnPresentStatus);
     }
     verification vcEventLog : VerificationCase {
-        @MemoIdentity { :>> providedId = "VER-019"; }
-        attribute :>> name = "VerifyEventLogIntegrity";
+        @MemoIdentity { :>> providedId = "VER-019"; :>> label = "VerifyEventLogIntegrity"; }
         attribute :>> methodKind = MemoVerificationMethodKind::test;
         attribute :>> acceptanceCriteria = "Operational/error log entries per REQ-CS-78..81; tampering detectable (REQ-X-07)";
         attribute :>> status = ElementStatusKind::approved;
 
         objective { verify reqCs78; verify reqEventLogging; }
-        subject verified : Base::Anything[*] = (gpcaDevice.gpcaSoftware.logging);
+        subject verified : Base::Anything[*] = (gpcaSoftware.logging);
     }
     verification vcReverseDeliveryPause : VerificationCase {
-        @MemoIdentity { :>> providedId = "VER-020"; }
-        attribute :>> name = "VerifyReverseDeliveryPause";
+        @MemoIdentity { :>> providedId = "VER-020"; :>> label = "VerifyReverseDeliveryPause"; }
         attribute :>> methodKind = MemoVerificationMethodKind::modelChecking;
         attribute :>> acceptanceCriteria = "Continuous or cumulative reverse delivery beyond the REQ-CS-22 duration limits transitions to PAUSED and raises the Reverse Delivery notification (NOTIF-04)";
         attribute :>> status = ElementStatusKind::approved;
@@ -208,8 +200,7 @@ package memo_examples_gpca_pump_gpca_verification {
         subject verified : Base::Anything[*] = (reverseDeliveryPauseControl);
     }
     verification vcAntiRefluxMechanism : VerificationCase {
-        @MemoIdentity { :>> providedId = "VER-021"; }
-        attribute :>> name = "VerifyContinuousReverseDeliveryPrevention";
+        @MemoIdentity { :>> providedId = "VER-021"; :>> label = "VerifyContinuousReverseDeliveryPrevention"; }
         attribute :>> methodKind = MemoVerificationMethodKind::test;
         attribute :>> acceptanceCriteria = "During normal use and single fault condition, continuous reverse delivery is not possible (IEC 601-2-24 basis per GPCA safety requirements)";
         attribute :>> status = ElementStatusKind::approved;
@@ -217,8 +208,7 @@ package memo_examples_gpca_pump_gpca_verification {
         subject verified : Base::Anything[*] = (antiRefluxDesignControl);
     }
     verification vcVtbiCeiling : VerificationCase {
-        @MemoIdentity { :>> providedId = "VER-022"; }
-        attribute :>> name = "VerifyVtbiCeilingPause";
+        @MemoIdentity { :>> providedId = "VER-022"; :>> label = "VerifyVtbiCeilingPause"; }
         attribute :>> methodKind = MemoVerificationMethodKind::modelChecking;
         attribute :>> acceptanceCriteria = "Actual volume infused above the drug-database maximum VTBI transitions to PAUSED with flow at most KVO (REQ-CS-20, AGREE GP-008) and raises NOTIF-06";
         attribute :>> status = ElementStatusKind::approved;
@@ -226,8 +216,7 @@ package memo_examples_gpca_pump_gpca_verification {
         subject verified : Base::Anything[*] = (vtbiLimitPauseControl);
     }
     verification vcInfusionComplete : VerificationCase {
-        @MemoIdentity { :>> providedId = "VER-023"; }
-        attribute :>> name = "VerifyInfusionCompleteStop";
+        @MemoIdentity { :>> providedId = "VER-023"; :>> label = "VerifyInfusionCompleteStop"; }
         attribute :>> methodKind = MemoVerificationMethodKind::test;
         attribute :>> acceptanceCriteria = "Reaching prescribed total duration or maximum VTBI transitions ACTIVE to IDLE with Infusion Complete actions (REQ-CS-28)";
         attribute :>> status = ElementStatusKind::approved;
@@ -235,8 +224,7 @@ package memo_examples_gpca_pump_gpca_verification {
         subject verified : Base::Anything[*] = (infusionCompleteControl);
     }
     verification vcDoorInterlock : VerificationCase {
-        @MemoIdentity { :>> providedId = "VER-024"; }
-        attribute :>> name = "VerifyDoorOpenDeliveryInhibit";
+        @MemoIdentity { :>> providedId = "VER-024"; :>> label = "VerifyDoorOpenDeliveryInhibit"; }
         attribute :>> methodKind = MemoVerificationMethodKind::test;
         attribute :>> acceptanceCriteria = "Door open during THERAPY limits flow to at most KVO and raises a notification (AGREE GP-011; REQ-X-05)";
         attribute :>> status = ElementStatusKind::approved;
@@ -246,16 +234,14 @@ package memo_examples_gpca_pump_gpca_verification {
 
     // ── Validation cases (design validation / IEC 62366) ────────
     verification valSimulatedWard : ValidationCase {
-        @MemoIdentity { :>> providedId = "VAL-001"; }
-        attribute :>> name = "SimulatedWardTherapyValidation";
+        @MemoIdentity { :>> providedId = "VAL-001"; :>> label = "SimulatedWardTherapyValidation"; }
         attribute :>> validationMethod = ValidationMethodKind::simulatedUse;
         attribute :>> userParticipation = "nurses and physicians on a simulated ward";
         attribute :>> acceptanceCriteria = "Complete therapy scenarios OS-001..OS-006 executed without unresolved use difficulty";
         attribute :>> clinicalContext = "post-operative PCA therapy in acute care";
     }
     verification valSummativeUsability : ValidationCase {
-        @MemoIdentity { :>> providedId = "VAL-002"; }
-        attribute :>> name = "SummativeUsabilityTest";
+        @MemoIdentity { :>> providedId = "VAL-002"; :>> label = "SummativeUsabilityTest"; }
         attribute :>> validationMethod = ValidationMethodKind::summativeUsabilityTest;
         attribute :>> userParticipation = "15 representative clinical users per user group";
         attribute :>> acceptanceCriteria = "No critical use errors (UE-001..UE-004) observed on safety-related tasks; residual difficulty acceptable per IEC 62366-1";
@@ -265,8 +251,7 @@ package memo_examples_gpca_pump_gpca_verification {
     // ── Test artifacts and evidence ─────────────────────────────
     part testReportLockout : MemoEvidence {
         attribute :>> evidenceKind = EvidenceKind::testArtifact;
-        @MemoIdentity { :>> providedId = "TEST-001"; }
-        attribute :>> name = "BolusLockoutTestReport";
+        @MemoIdentity { :>> providedId = "TEST-001"; :>> label = "BolusLockoutTestReport"; }
         attribute :>> version = "0.1";
         attribute :>> lifecycleState = LifecycleStateKind::development;
         attribute :>> artifactKind = ArtifactKind::testReport;
@@ -274,8 +259,7 @@ package memo_examples_gpca_pump_gpca_verification {
     }
     part testProtocolSafetySuite : MemoEvidence {
         attribute :>> evidenceKind = EvidenceKind::testArtifact;
-        @MemoIdentity { :>> providedId = "TEST-002"; }
-        attribute :>> name = "SafetyAlarmTestProtocol";
+        @MemoIdentity { :>> providedId = "TEST-002"; :>> label = "SafetyAlarmTestProtocol"; }
         attribute :>> version = "0.1";
         attribute :>> lifecycleState = LifecycleStateKind::development;
         attribute :>> artifactKind = ArtifactKind::testProtocol;
@@ -283,8 +267,7 @@ package memo_examples_gpca_pump_gpca_verification {
     }
     part evidenceLockout : MemoEvidence {
         attribute :>> evidenceKind = EvidenceKind::evidence;
-        @MemoIdentity { :>> providedId = "EVD-001"; }
-        attribute :>> name = "BolusLockoutEvidence";
+        @MemoIdentity { :>> providedId = "EVD-001"; :>> label = "BolusLockoutEvidence"; }
         attribute :>> version = "0.1";
         attribute :>> lifecycleState = LifecycleStateKind::development;
         attribute :>> evidenceType = "verification evidence";
@@ -292,8 +275,7 @@ package memo_examples_gpca_pump_gpca_verification {
     }
     part evidenceModeRange : MemoEvidence {
         attribute :>> evidenceKind = EvidenceKind::evidence;
-        @MemoIdentity { :>> providedId = "EVD-002"; }
-        attribute :>> name = "ModeRangeEvidence";
+        @MemoIdentity { :>> providedId = "EVD-002"; :>> label = "ModeRangeEvidence"; }
         attribute :>> version = "0.1";
         attribute :>> lifecycleState = LifecycleStateKind::development;
         attribute :>> evidenceType = "formal proof evidence";
@@ -301,8 +283,7 @@ package memo_examples_gpca_pump_gpca_verification {
     }
     part evidenceSameStepAlarm : MemoEvidence {
         attribute :>> evidenceKind = EvidenceKind::evidence;
-        @MemoIdentity { :>> providedId = "EVD-003"; }
-        attribute :>> name = "SameStepAlarmEvidence";
+        @MemoIdentity { :>> providedId = "EVD-003"; :>> label = "SameStepAlarmEvidence"; }
         attribute :>> version = "0.1";
         attribute :>> lifecycleState = LifecycleStateKind::development;
         attribute :>> evidenceType = "model checking evidence";
@@ -310,8 +291,7 @@ package memo_examples_gpca_pump_gpca_verification {
     }
     part evidenceTemporalModeSafety : MemoEvidence {
         attribute :>> evidenceKind = EvidenceKind::evidence;
-        @MemoIdentity { :>> providedId = "EVD-004"; }
-        attribute :>> name = "TemporalModeSafetyEvidence";
+        @MemoIdentity { :>> providedId = "EVD-004"; :>> label = "TemporalModeSafetyEvidence"; }
         attribute :>> version = "0.1";
         attribute :>> lifecycleState = LifecycleStateKind::development;
         attribute :>> evidenceType = "model checking evidence";
@@ -319,8 +299,7 @@ package memo_examples_gpca_pump_gpca_verification {
     }
     part evidenceSafetyAlarmSuite : MemoEvidence {
         attribute :>> evidenceKind = EvidenceKind::evidence;
-        @MemoIdentity { :>> providedId = "EVD-005"; }
-        attribute :>> name = "SafetyAlarmSuiteEvidence";
+        @MemoIdentity { :>> providedId = "EVD-005"; :>> label = "SafetyAlarmSuiteEvidence"; }
         attribute :>> version = "0.1";
         attribute :>> lifecycleState = LifecycleStateKind::development;
         attribute :>> evidenceType = "bench test evidence for alarm-driven safe states";
@@ -328,8 +307,7 @@ package memo_examples_gpca_pump_gpca_verification {
     }
     part evidenceUsability : MemoEvidence {
         attribute :>> evidenceKind = EvidenceKind::evidence;
-        @MemoIdentity { :>> providedId = "EVD-006"; }
-        attribute :>> name = "SummativeUsabilityEvidence";
+        @MemoIdentity { :>> providedId = "EVD-006"; :>> label = "SummativeUsabilityEvidence"; }
         attribute :>> version = "0.1";
         attribute :>> lifecycleState = LifecycleStateKind::development;
         attribute :>> evidenceType = "summative usability report per IEC 62366-1";
@@ -337,8 +315,7 @@ package memo_examples_gpca_pump_gpca_verification {
     }
     part evidenceHardwareBench : MemoEvidence {
         attribute :>> evidenceKind = EvidenceKind::evidence;
-        @MemoIdentity { :>> providedId = "EVD-008"; }
-        attribute :>> name = "HardwareBenchEvidence";
+        @MemoIdentity { :>> providedId = "EVD-008"; :>> label = "HardwareBenchEvidence"; }
         attribute :>> version = "0.1";
         attribute :>> lifecycleState = LifecycleStateKind::development;
         attribute :>> evidenceType = "bench evidence for alarm loudness and anti-free-flow valve";
@@ -346,8 +323,7 @@ package memo_examples_gpca_pump_gpca_verification {
     }
     part evidenceDoseProgramming : MemoEvidence {
         attribute :>> evidenceKind = EvidenceKind::evidence;
-        @MemoIdentity { :>> providedId = "EVD-009"; }
-        attribute :>> name = "DoseProgrammingEvidence";
+        @MemoIdentity { :>> providedId = "EVD-009"; :>> label = "DoseProgrammingEvidence"; }
         attribute :>> version = "0.1";
         attribute :>> lifecycleState = LifecycleStateKind::development;
         attribute :>> evidenceType = "test evidence for prescription limits, confirmation, dose ceiling, and event log";
@@ -355,8 +331,7 @@ package memo_examples_gpca_pump_gpca_verification {
     }
     part evidenceDeliveryAccuracy : MemoEvidence {
         attribute :>> evidenceKind = EvidenceKind::evidence;
-        @MemoIdentity { :>> providedId = "EVD-007"; }
-        attribute :>> name = "DeliveryAccuracyEvidence";
+        @MemoIdentity { :>> providedId = "EVD-007"; :>> label = "DeliveryAccuracyEvidence"; }
         attribute :>> version = "0.1";
         attribute :>> lifecycleState = LifecycleStateKind::development;
         attribute :>> evidenceType = "gravimetric bench test evidence";

package/examples/gpca-pump/model/catalog/viewpoints/context/views/context_system_context_view.sysml

@@ -18,10 +18,9 @@ package memo_examples_gpca_pump_viewpoints_context_views_context_system_context_
     view gpcaSystemContextView : MemoDiagramView {
         expose memo_examples_gpca_pump_viewpoints_context_views_context_system_context_view::*;
         attribute depth = 2;
-        @MemoIdentity { :>> providedId = "VIEW-CTX-101"; }
-        attribute :>> name = "GPCA_SystemContextView";
+        @MemoIdentity { :>> providedId = "VIEW-CTX-101"; :>> label = "GPCA_SystemContextView"; }
         @MemoIdentity { :>> shortDescription = "Actors, use contexts, and external entities at the GPCA system boundary."; }
-        attribute :>> description = "Shows the CriSys Fig 2.1 boundary: patient, clinician, prescription, drug reservoir, needle, hospital pharmacy database, and hospital environment around the pump, with directional data flows, physical drug-path connections, and the intended use anchoring the boundary.";
+        doc /* Shows the CriSys Fig 2.1 boundary: patient, clinician, prescription, drug reservoir, needle, hospital pharmacy database, and hospital environment around the pump, with directional data flows, physical drug-path connections, and the intended use anchoring the boundary. */
         attribute :>> outputKind = (ViewOutputKind::diagram);
         attribute :>> presentationKind = (PresentationKind::blockDiagram);
         attribute :>> viewKind = DiagramViewKind::general;
@@ -30,9 +29,8 @@ package memo_examples_gpca_pump_viewpoints_context_views_context_system_context_
         attribute :>> autoPopulate = true;
         attribute :>> queryDescription = "Include actors, use contexts, intended use, and external operational entities.";
         part :>> selectionQuery {
-            @MemoIdentity { :>> providedId = "QRY-CTX-101"; }
-            attribute :>> name = "GPCA_SystemContextQuery";
-            attribute :>> includeElementKinds = ("Actor", "UseContext", "IntendedUse", "ReasonablyForeseeableMisuse", "OperationalEntity");
+            @MemoIdentity { :>> providedId = "QRY-CTX-101"; :>> label = "GPCA_SystemContextQuery"; }
+            attribute :>> includeElementKinds = ("OperationalParticipant", "UseContext", "IntendedUse", "ReasonablyForeseeableMisuse", "OperationalEntity");
             attribute :>> includeRelationshipKinds = ("connect", "flow", "Governs", "AppliesInContext");
             attribute :>> includeLayers = ("context", "operational");
             attribute :>> selectionExpression = "product == 'GPCA'";

package/examples/gpca-pump/model/catalog/viewpoints/cybersecurity/views/cybersecurity_cybersecurity_view.sysml

@@ -19,10 +19,9 @@ package memo_examples_gpca_pump_viewpoints_cybersecurity_views_cybersecurity_cyb
     view gpcaCybersecurityView : MemoDiagramView {
         expose memo_examples_gpca_pump_viewpoints_cybersecurity_views_cybersecurity_cybersecurity_view::*;
         attribute depth = 2;
-        @MemoIdentity { :>> providedId = "VIEW-CYB-001"; }
-        attribute :>> name = "GPCA_CybersecurityView";
+        @MemoIdentity { :>> providedId = "VIEW-CYB-001"; :>> label = "GPCA_CybersecurityView"; }
         @MemoIdentity { :>> shortDescription = "Shows GPCA assets, trust boundaries, threats, vulnerabilities, and mitigations."; }
-        attribute :>> description = "Product-specific cybersecurity view intended for secure product development and cross-reference into cybersecurity risk documentation.";
+        doc /* Product-specific cybersecurity view intended for secure product development and cross-reference into cybersecurity risk documentation. */
         attribute :>> outputKind = (ViewOutputKind::diagram);
         attribute :>> presentationKind = (PresentationKind::custom);
         attribute :>> viewKind = DiagramViewKind::general;
@@ -31,9 +30,8 @@ package memo_examples_gpca_pump_viewpoints_cybersecurity_views_cybersecurity_cyb
         attribute :>> autoPopulate = true;
         attribute :>> queryDescription = "Include cyber assets, trust boundaries, threats, vulnerabilities, cyber hazards, cyber risks, mitigations, security requirements, and verification.";
         part :>> selectionQuery {
-            @MemoIdentity { :>> providedId = "QRY-CYB-001"; }
-            attribute :>> name = "GPCA_CybersecurityQuery";
-            attribute :>> includeElementKinds = ("CybersecurityAsset", "Threat", "Vulnerability", "CyberHazard", "CyberRisk", "CyberMitigation", "SecurityRequirement", "TrustBoundary", "OperativeScenario[scenarioKind=threat]");
+            @MemoIdentity { :>> providedId = "QRY-CYB-001"; :>> label = "GPCA_CybersecurityQuery"; }
+            attribute :>> includeElementKinds = ("CybersecurityAsset", "Threat", "Vulnerability", "CyberHazard", "CyberRisk", "CyberMitigation", "SecurityRequirement", "TrustBoundary", "OperativeScenario");
             attribute :>> includeLayers = ("cybersecurity", "risk", "assurance");
             attribute :>> includeConcerns = (ConcernKind::cybersecurity, ConcernKind::privacy, ConcernKind::safety);
             attribute :>> selectionExpression = "product == 'GPCA'";

package/examples/gpca-pump/model/catalog/viewpoints/cybersecurity/views/document_cyber_assessment_view.sysml

@@ -10,18 +10,16 @@ package memo_examples_gpca_pump_viewpoints_cybersecurity_views_document_cyber_as
     private import memo_core_common::MemoIdentity;
     view cyberAssessmentView : MemoCybersecurityAssessmentView {
         expose memo_examples_gpca_pump_viewpoints_cybersecurity_views_document_cyber_assessment_view::*;
-        @MemoIdentity { :>> providedId = "DOC-003"; }
-        attribute :>> name = "GPCAMemoCybersecurityAssessmentView";
+        @MemoIdentity { :>> providedId = "DOC-003"; :>> label = "GPCAMemoCybersecurityAssessmentView"; }
         @MemoIdentity { :>> shortDescription = "Cybersecurity risk-assessment-oriented document view for GPCA."; }
-        attribute :>> description = "Captures GPCA cyber risks, mitigations, security requirements, verification, and safety/privacy traceability for cybersecurity assessment records.";
+        doc /* Captures GPCA cyber risks, mitigations, security requirements, verification, and safety/privacy traceability for cybersecurity assessment records. */
         attribute :>> version = "0.1";
         attribute :>> lifecycleState = LifecycleStateKind::development;
         attribute :>> marketScope = "generic";
         ref :>> viewpointDefinition = cybersecurityViewpoint;
         part :>> selectionQuery {
-            @MemoIdentity { :>> providedId = "QRY-DOC-009"; }
-            attribute :>> name = "cyberAssessmentViewQuery";
-            attribute :>> includeElementKinds = ("CyberRisk", "CyberHazard", "CybersecurityAsset", "CyberMitigation", "SecurityRequirement", "SecurityClaim", "SBOMEntry", "SoftwareModule[moduleKind=soup]");
+            @MemoIdentity { :>> providedId = "QRY-DOC-009"; :>> label = "cyberAssessmentViewQuery"; }
+            attribute :>> includeElementKinds = ("CyberRisk", "CyberHazard", "CybersecurityAsset", "CyberMitigation", "SecurityRequirement", "SBOMEntry", "SoftwareModule");
             attribute :>> includeRelationshipKinds = ("ImpactsSafety", "Mitigates", "DerivesCyberRequirement", "AssessedAgainst", "DependsOnSoup");
             attribute :>> rationaleText = "Declares what this document-backed view renders; the web renderer is presentation-only.";
         }

package/examples/gpca-pump/model/catalog/viewpoints/cybersecurity/views/document_threat_model_view.sysml

@@ -10,18 +10,16 @@ package memo_examples_gpca_pump_viewpoints_cybersecurity_views_document_threat_m
     private import memo_core_common::MemoIdentity;
     view threatModelView : MemoCybersecurityThreatModelView {
         expose memo_examples_gpca_pump_viewpoints_cybersecurity_views_document_threat_model_view::*;
-        @MemoIdentity { :>> providedId = "DOC-002"; }
-        attribute :>> name = "GPCACyberThreatModelView";
+        @MemoIdentity { :>> providedId = "DOC-002"; :>> label = "GPCACyberThreatModelView"; }
         @MemoIdentity { :>> shortDescription = "Threat-model-oriented document view for GPCA."; }
-        attribute :>> description = "Captures GPCA cyber assets, trust boundaries, threats, threat scenarios, vulnerabilities, and mitigations for secure product development records.";
+        doc /* Captures GPCA cyber assets, trust boundaries, threats, threat scenarios, vulnerabilities, and mitigations for secure product development records. */
         attribute :>> version = "0.1";
         attribute :>> lifecycleState = LifecycleStateKind::development;
         attribute :>> marketScope = "generic";
         ref :>> viewpointDefinition = cybersecurityViewpoint;
         part :>> selectionQuery {
-            @MemoIdentity { :>> providedId = "QRY-DOC-008"; }
-            attribute :>> name = "threatModelViewQuery";
-            attribute :>> includeElementKinds = ("Threat", "OperativeScenario[scenarioKind=threat]", "Vulnerability", "CybersecurityAsset", "TrustBoundary", "AttackSurface", "CyberMitigation", "SecurityRequirement");
+            @MemoIdentity { :>> providedId = "QRY-DOC-008"; :>> label = "threatModelViewQuery"; }
+            attribute :>> includeElementKinds = ("Threat", "OperativeScenario", "Vulnerability", "CybersecurityAsset", "TrustBoundary", "AttackSurface", "CyberMitigation", "SecurityRequirement");
             attribute :>> includeRelationshipKinds = ("ThreatenedBy", "Exploits", "RealizedByScenario", "CrossesTrustBoundary", "Mitigates", "DerivesCyberRequirement");
             attribute :>> rationaleText = "Declares what this document-backed view renders; the web renderer is presentation-only.";
         }

package/examples/gpca-pump/model/catalog/viewpoints/functional/views/functional_function_allocation_view.sysml

@@ -18,8 +18,7 @@ package memo_examples_gpca_pump_viewpoints_functional_views_functional_function_
     view gpcaFunctionAllocationView : MemoDiagramView {
         expose memo_examples_gpca_pump_viewpoints_functional_views_functional_function_allocation_view::*;
         attribute depth = 2;
-        @MemoIdentity { :>> providedId = "VIEW-FUN-102"; }
-        attribute :>> name = "GPCA_FunctionAllocationView";
+        @MemoIdentity { :>> providedId = "VIEW-FUN-102"; :>> label = "GPCA_FunctionAllocationView"; }
         @MemoIdentity { :>> shortDescription = "Allocation of logical functions to software components and hardware assemblies."; }
         attribute :>> outputKind = (ViewOutputKind::matrix);
         attribute :>> presentationKind = (PresentationKind::traceMatrix);
@@ -29,8 +28,7 @@ package memo_examples_gpca_pump_viewpoints_functional_views_functional_function_
         attribute :>> autoPopulate = true;
         attribute :>> queryDescription = "Include logical functions with their AllocatedTo targets.";
         part :>> selectionQuery {
-            @MemoIdentity { :>> providedId = "QRY-FUN-102"; }
-            attribute :>> name = "GPCA_FunctionAllocationQuery";
+            @MemoIdentity { :>> providedId = "QRY-FUN-102"; :>> label = "GPCA_FunctionAllocationQuery"; }
             attribute :>> includeElementKinds = ("SystemFunction", "SoftwareModule", "HardwareAssembly");
             attribute :>> includeRelationshipKinds = ("AllocatedTo");
             attribute :>> includeLayers = ("functions", "software_structure", "hardware_structure");

package/examples/gpca-pump/model/catalog/viewpoints/functional/views/functional_function_browser_view.sysml

@@ -18,10 +18,9 @@ package memo_examples_gpca_pump_viewpoints_functional_views_functional_function_
     view gpcaFunctionBrowserView : MemoDiagramView {
         expose memo_examples_gpca_pump_viewpoints_functional_views_functional_function_browser_view::*;
         attribute depth = 2;
-        @MemoIdentity { :>> providedId = "VIEW-FUN-103"; }
-        attribute :>> name = "GPCA_FunctionBrowserView";
+        @MemoIdentity { :>> providedId = "VIEW-FUN-103"; :>> label = "GPCA_FunctionBrowserView"; }
         @MemoIdentity { :>> shortDescription = "Membership tree over the functions layer: logical functions, flows, and the exchange item definitions, grouped by kind."; }
-        attribute :>> description = "Browser view (SysML v2 browser view kind) exposing the functions-layer membership hierarchy as a first-class view: the eleven logical functions, the logical flows connecting them, and the data/control definitions they exchange — with kind icons, expand/collapse, and filtering.";
+        doc /* Browser view (SysML v2 browser view kind) exposing the functions-layer membership hierarchy as a first-class view: the eleven logical functions, the logical flows connecting them, and the data/control definitions they exchange — with kind icons, expand/collapse, and filtering. */
         attribute :>> outputKind = (ViewOutputKind::diagram);
         attribute :>> presentationKind = (PresentationKind::blockDiagram);
         attribute :>> viewKind = DiagramViewKind::browser;
@@ -29,9 +28,11 @@ package memo_examples_gpca_pump_viewpoints_functional_views_functional_function_
         attribute :>> autoPopulate = true;
         attribute :>> queryDescription = "Include the functions layer's functions, flows, and exchange item definitions.";
         part :>> selectionQuery {
-            @MemoIdentity { :>> providedId = "QRY-FUN-103"; }
-            attribute :>> name = "GPCA_FunctionBrowserQuery";
-            attribute :>> includeElementKinds = ("SystemFunction", "FunctionalExchange", "InterfaceItem");
+            @MemoIdentity { :>> providedId = "QRY-FUN-103"; :>> label = "GPCA_FunctionBrowserQuery"; }
+            // No "FunctionalExchange": an exchange is a flow between two
+            // functions, not an element, so it is drawn as the edge between
+            // the selected functions rather than selected by kind.
+            attribute :>> includeElementKinds = ("SystemFunction", "InterfaceItem");
             attribute :>> includeLayers = ("functions");
             attribute :>> selectionExpression = "product == 'GPCA'";
             attribute :>> rationaleText = "Auto-populate the function browser from the functions layer.";

package/examples/gpca-pump/model/catalog/viewpoints/logical/views/behavior_action_flow_view.sysml

@@ -18,10 +18,9 @@ package memo_examples_gpca_pump_viewpoints_logical_views_behavior_action_flow_vi
     view gpcaActionFlowView : MemoDiagramView {
         expose memo_examples_gpca_pump_viewpoints_logical_views_behavior_action_flow_view::*;
         attribute depth = 2;
-        @MemoIdentity { :>> providedId = "VIEW-BHV-003"; }
-        attribute :>> name = "GPCA_InfusionDeliveryActionFlowView";
+        @MemoIdentity { :>> providedId = "VIEW-BHV-003"; :>> label = "GPCA_InfusionDeliveryActionFlowView"; }
         @MemoIdentity { :>> shortDescription = "The 20 ms execution-step pipeline from sensor acquisition through alarm evaluation and dose limiting to pump actuation and event logging."; }
-        attribute :>> description = "Action flow over the infusionDeliveryFlow composite action: typed action steps with in/out parameters, item flows carrying the DD/CD exchange items, succession ordering from start to done, and swimlane allocation onto the logical architecture (sensors, alarm, infusion manager, pump motor, logging).";
+        doc /* Action flow over the infusionDeliveryFlow composite action: typed action steps with in/out parameters, item flows carrying the DD/CD exchange items, succession ordering from start to done, and swimlane allocation onto the logical architecture (sensors, alarm, infusion manager, pump motor, logging). */
         attribute :>> outputKind = (ViewOutputKind::diagram);
         attribute :>> presentationKind = (PresentationKind::activityDiagram);
         attribute :>> viewKind = DiagramViewKind::actionflow;
@@ -30,9 +29,8 @@ package memo_examples_gpca_pump_viewpoints_logical_views_behavior_action_flow_vi
         attribute :>> autoPopulate = true;
         attribute :>> queryDescription = "Include the nested action usages of the infusion delivery flow with their flows and successions.";
         part :>> selectionQuery {
-            @MemoIdentity { :>> providedId = "QRY-BHV-103"; }
-            attribute :>> name = "GPCA_ActionFlowQuery";
-            attribute :>> includeElementKinds = ("ActionUsage");
+            @MemoIdentity { :>> providedId = "QRY-BHV-103"; :>> label = "GPCA_ActionFlowQuery"; }
+            attribute :>> includeElementKinds = ("MemoAction");
             attribute :>> selectionExpression = "product == 'GPCA'";
             attribute :>> rationaleText = "Auto-populate the action flow view from the behavior layer's action usages.";
         }