@memoarchitect/ontology 0.6.5 → 0.7.0

package/examples/ui-screen-regions/model/catalog/viewpoints/ui_layout/views/ui_region_trace.sysml

@@ -0,0 +1,54 @@
+package memo_examples_ui_screen_regions_viewpoints_ui_layout_views_ui_region_trace {
+    private import ScalarValues::*;
+
+    private import memo_core_relationships::*;
+    private import memo_core_annotations::*;
+    private import memo_architecture_functional_functions::*;
+    private import memo_architecture_implementation_ui::*;
+    private import memo_assurance_requirements::*;
+    private import memo_assurance_requirements_needs::*;
+    private import memo_assurance_human_factors::*;
+    private import memo_assurance_safety_risk::*;
+    private import memo_assurance_verification_validation::*;
+    private import memo_artifacts_core::*;
+
+    private import memo_viewpoints_definitions::*;
+    private import memo_core_enumerations::*;
+    private import memo_viewpoints_ui_layout_views_screen_layout_view::*;
+    private import memo_examples_ui_screen_regions_viewpoints_ui_layout::*;
+    private import memo_examples_ui_screen_regions_architecture_implementation_ui::*;
+    private import memo_examples_ui_screen_regions_architecture_functional_functions::*;
+    private import memo_examples_ui_screen_regions_assurance_requirements::*;
+    private import memo_examples_ui_screen_regions_assurance_requirements_needs::*;
+    private import memo_examples_ui_screen_regions_assurance_human_factors::*;
+    private import memo_examples_ui_screen_regions_assurance_safety_risk::*;
+    private import memo_examples_ui_screen_regions_assurance_verification_validation::*;
+    private import memo_examples_ui_screen_regions_artifacts_assets::*;
+    private import memo_examples_ui_screen_regions_artifacts_reviews_comments::*;
+    private import memo_examples_ui_screen_regions_artifacts_reviews_rationales::*;
+    private import memo_examples_ui_screen_regions_artifacts_reviews_notes::*;
+    private import memo_examples_ui_screen_regions_traces::*;
+
+    // The same content as a graph, for reviewers who want to read the trace
+    // chain rather than look at the screen.
+    view uiRegionTrace : MemoDiagramView {
+        expose memo_examples_ui_screen_regions_architecture_implementation_ui::*;
+        expose memo_examples_ui_screen_regions_architecture_functional_functions::*;
+        expose memo_examples_ui_screen_regions_assurance_requirements::*;
+        expose memo_examples_ui_screen_regions_assurance_requirements_needs::*;
+        expose memo_examples_ui_screen_regions_assurance_human_factors::*;
+        expose memo_examples_ui_screen_regions_assurance_safety_risk::*;
+        expose memo_examples_ui_screen_regions_assurance_verification_validation::*;
+        expose memo_examples_ui_screen_regions_artifacts_assets::*;
+        expose memo_examples_ui_screen_regions_artifacts_reviews_comments::*;
+        expose memo_examples_ui_screen_regions_artifacts_reviews_rationales::*;
+        expose memo_examples_ui_screen_regions_artifacts_reviews_notes::*;
+        expose memo_examples_ui_screen_regions_traces::*;
+        attribute :>> id = "UIV-001";
+        attribute depth = 3;
+        attribute :>> title = "UI Region Traceability";
+        attribute :>> viewKind = DiagramViewKind::general;
+        attribute :>> diagramType = "bdd";
+        part :>> viewpointDefinition = uiLayoutViewpoint;
+    }
+}

package/memo.manifest.yaml

@@ -17,5 +17,7 @@ templates:
 examples:
   gpca: ./examples/gpca-pump
   standard-sysml-diagrams: ./examples/sysml-diagram-samples
+  ui-screen-regions: ./examples/ui-screen-regions
+  nested-architecture-dsm: ./examples/nested-architecture-dsm
   extension-template: ./examples/extensions/template
   clinical-extension: ./examples/extensions/clinical

package/methodologies/default/memo.package.yaml

@@ -1,9 +1,19 @@
-name: "@memoarchitect/methodology-default"
-version: "0.6.4"
-type: methodology
-extends: "@memoarchitect/ontology"
-sysmlDir: "../../src/methodology"
-description: "MEMO default medical-device methodology — selects viewpoints/views/DHF documents from @memoarchitect/ontology and adds rules, gates, patterns, profiles, and workflow."
-license: "MIT"
-tags: ["methodology", "medical-device", "iso-14971", "iec-62304", "memo"]
-usage: ["viewpoints", "views", "rules", "gates", "patterns", "profiles", "workflow", "dhf"]
+# Application/distribution descriptor for this MEMO package.
+#
+# Identity and location only. It records what this package is called, what
+# version it is, and where its SysML source sits so a resolver can find it.
+# It does not select model content: the project's native SysML imports and its
+# ProjectMethodBinding decide what is in the model. Semantic fields
+# (`type`, `extends`, `usage`, `ontologies`, `methodology`, `modules`) were
+# removed at the native semantic flip and are now rejected if present.
+name: '@memoarchitect/methodology-default'
+version: 0.7.0
+description: "MEMO default medical-device methodology \u2014 selects viewpoints/views/DHF documents from @memoarchitect/ontology and adds rules, gates, patterns, profiles, and workflow."
+license: MIT
+tags:
+- methodology
+- medical-device
+- iso-14971
+- iec-62304
+- memo
+sysmlDir: ../../src/methodology

package/methodologies/gpca/memo.package.yaml

@@ -1,9 +1,18 @@
-name: "@memoarchitect/methodology-gpca"
-version: "0.6.4"
-type: methodology
-extends: "@memoarchitect/methodology-default"
-sysmlDir: "../../examples/gpca-pump/methodology"
-description: "GPCA infusion pump methodology — subtraction-based tailoring of @memoarchitect/methodology-default for the non-networked prototype variant. Excludes cybersecurity and SOUP."
-license: "MIT"
-tags: ["methodology", "medical-device", "gpca", "tailoring"]
-usage: ["viewpoints", "views", "rules", "gates", "patterns", "profiles", "workflow", "dhf"]
+# Application/distribution descriptor for this MEMO package.
+#
+# Identity and location only. It records what this package is called, what
+# version it is, and where its SysML source sits so a resolver can find it.
+# It does not select model content: the project's native SysML imports and its
+# ProjectMethodBinding decide what is in the model. Semantic fields
+# (`type`, `extends`, `usage`, `ontologies`, `methodology`, `modules`) were
+# removed at the native semantic flip and are now rejected if present.
+name: '@memoarchitect/methodology-gpca'
+version: 0.7.0
+description: "GPCA infusion pump methodology \u2014 subtraction-based tailoring of @memoarchitect/methodology-default for the non-networked prototype variant. Excludes cybersecurity and SOUP."
+license: MIT
+tags:
+- methodology
+- medical-device
+- gpca
+- tailoring
+sysmlDir: ../../examples/gpca-pump/methodology

package/ontology/memo.package.yaml

@@ -1,8 +1,23 @@
-name: "@memoarchitect/ontology"
-version: "0.6.4"
-type: ontology
-description: "MEMO — the single canonical medical-device ontology: core semantics, the Arcadia-inspired architecture layers (context, requirements, behavior, structure, interfaces, risk, cybersecurity, assurance, …), compliance, viewpoints, views, and invariant rules. One namespace (memo::), one src/ tree."
-license: "MIT"
-tags: ["mbse", "sysml-v2", "arcadia", "iso-42010", "medical-device", "ontology", "iso-14971", "iec-62304"]
-usage: ["kinds", "relationships"]
-sysmlDir: "../src"
+# Application/distribution descriptor for this MEMO package.
+#
+# Identity and location only. It records what this package is called, what
+# version it is, and where its SysML source sits so a resolver can find it.
+# It does not select model content: the project's native SysML imports and its
+# ProjectMethodBinding decide what is in the model. Semantic fields
+# (`type`, `extends`, `usage`, `ontologies`, `methodology`, `modules`) were
+# removed at the native semantic flip and are now rejected if present.
+name: '@memoarchitect/ontology'
+version: 0.7.0
+description: "MEMO \u2014 the single canonical medical-device ontology: core semantics, the Arcadia-inspired architecture layers (context, requirements, behavior, structure, interfaces, risk, cybersecurity,\
+  \ assurance, \u2026), compliance, viewpoints, views, and invariant rules. One namespace (memo::), one src/ tree."
+license: MIT
+tags:
+- mbse
+- sysml-v2
+- arcadia
+- iso-42010
+- medical-device
+- ontology
+- iso-14971
+- iec-62304
+sysmlDir: ../src

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@memoarchitect/ontology",
-  "version": "0.6.5",
+  "version": "0.7.0",
   "packageManager": "pnpm@9.15.0",
-  "description": "MEMO — Medical Engineering Modelling Ontology. Pure SysML v2 medical-device ontology with native constraints, portable to any conformant SysML v2 tool (SysIDE, SysON, sysand).",
+  "description": "MEMO \u2014 Medical Engineering Modelling Ontology. Pure SysML v2 medical-device ontology with native constraints, portable to any conformant SysML v2 tool (SysIDE, SysON, sysand).",
   "scripts": {
     "build": "bash scripts/build-kpar.sh",
     "check": "bash scripts/build-kpar.sh",
@@ -49,14 +49,12 @@
     "LICENSE",
     "memo.manifest.yaml",
     "ontology/memo.package.yaml",
-    "ontology/memo.rendering.yaml",
     "profile/memo.package.yaml",
     "methodologies/default/memo.package.yaml",
     "methodologies/gpca/memo.package.yaml",
     "src/assurance/",
     "src/architecture/",
     "src/artifacts/",
-    "src/compliance/",
     "src/core/",
     "src/methodology/archetypes/",
     "src/methodology/core/",

package/profile/memo.package.yaml

@@ -1,9 +1,18 @@
-name: "@memoarchitect/medical-modeling-profile"
-version: "0.6.4"
-type: profile
-extends:
-  - "@memoarchitect/ontology"
-description: "Closure rules and viewpoints for medical device modeling"
-license: "MIT"
-tags: ["medical-device", "iso-14971", "iec-62304", "iso-13485", "modeling-profile"]
-usage: ["rules", "viewpoints"]
+# Application/distribution descriptor for this MEMO package.
+#
+# Identity and location only. It records what this package is called, what
+# version it is, and where its SysML source sits so a resolver can find it.
+# It does not select model content: the project's native SysML imports and its
+# ProjectMethodBinding decide what is in the model. Semantic fields
+# (`type`, `extends`, `usage`, `ontologies`, `methodology`, `modules`) were
+# removed at the native semantic flip and are now rejected if present.
+name: '@memoarchitect/medical-modeling-profile'
+version: 0.7.0
+description: Closure rules and viewpoints for medical device modeling
+license: MIT
+tags:
+- medical-device
+- iso-14971
+- iec-62304
+- iso-13485
+- modeling-profile

package/src/architecture/decisions/memo_decisions.sysml

@@ -3,10 +3,17 @@ package memo_architecture_decisions {
 
     private import memo_core_common::*;
     private import memo_core_enumerations::*;
+    private import memo_core_relationships::*;
+    private import memo_artifacts_core::*;
     part def DesignDecision specializes MemoPart {
         attribute decisionKind : String;
         attribute alternatives : String;
         attribute selectedOption : String;
         attribute decisionStatus : DesignDecisionStatusKind;
     }
+
+    connection def DecisionRecordedInADR :> MemoRelationship {
+        end decision : DesignDecision;
+        end adr : ADRArtifact;
+    }
 }

package/src/architecture/functional/behavior/memo_behavior.sysml

@@ -42,7 +42,7 @@ package memo_architecture_functional_behavior {
         attribute wcetMs : String;
         attribute safetyRelevant : Boolean;
     }
-    part def ActivityFlow specializes ArchitectureElement {
+    action def ActivityFlow specializes MemoAction {
         attribute flowKind : ActivityFlowKind;
         attribute guardCondition : String;
         attribute weight : String;

package/src/architecture/functional/functions/memo_functions.sysml

@@ -28,11 +28,11 @@ package memo_architecture_functional_functions {
         ref performedFunction : SystemFunction[0..1];
     }
 
-    // Typed transfer of information/command/status/etc. between functions
-    // (renamed from LogicalFlow — it belongs to the functional perspective).
+    // Named traceable route between functions. Native `flow of` usages carry
+    // the transported item; this element exists for budgets and assurance
+    // attributes that a flow usage cannot own.
     part def FunctionalExchange specializes ArchitectureElement {
         attribute flowKind : FlowKind;
-        attribute direction : DirectionKind;
         attribute latencyBudgetMs : Real;
         attribute staleAfterMs : Real;
         attribute integrityLevel : String;
@@ -46,15 +46,11 @@ package memo_architecture_functional_functions {
     // flows are part of functional architecture, never logical structure.
     part def FunctionalFlow specializes ArchitectureElement {
         attribute flowCategory : FunctionalFlowKind;
-        ref startFunction : SystemFunction[0..1];
-        ref endFunction : SystemFunction[0..1];
         attribute endToEndLatencyBudgetMs : String;
         attribute safetyRelevant : Boolean;
         attribute securityRelevant : Boolean;
-        ref includedFunctions : SystemFunction[0..*];
     }
-    part def FunctionalFlowStep specializes MemoPart {
-        attribute stepOrder : String;
+    action def FunctionalFlowStep specializes MemoAction {
         ref function : SystemFunction[0..1];
         ref exchange : FunctionalExchange[0..1];
         ref item exchangedItem : MemoExchangeItem[0..1];
@@ -63,10 +59,7 @@ package memo_architecture_functional_functions {
     // The functional-layer scenario selects one functional route and realizes
     // an operative scenario. It is the "what the system does" path, not a
     // logical component interaction.
-    part def FunctionalScenario specializes MemoScenario {
-        ref functionSequence : SystemFunction[0..*];
-        ref functionalFlows : FunctionalExchange[0..*];
-        attribute sequenceDiagramRef : String;
+    action def FunctionalScenario specializes MemoScenario {
         ref selectedFlow : FunctionalFlow[0..1];
     }
     connection def IncludesStep :> MemoRelationship {

package/src/architecture/implementation/software/runtime/memo_software_runtime.sysml

@@ -25,11 +25,9 @@ package memo_architecture_implementation_software_runtime {
         enum messageBroker;
     }
 
-    part def SoftwareComponent specializes ArchitectureElement {
+    part def SoftwareComponent specializes SoftwareItem {
         attribute runtimeKind : RuntimeKind;
         attribute responsibility : String;
-        attribute safetyClass : SafetyClassKind;
-        attribute complexity : ComplexityKind;
         attribute periodMs : Real;
         attribute deadlineMs : Real;
         attribute wcetMs : Real;

package/src/architecture/implementation/software/structure/memo_software_structure.sysml

@@ -9,10 +9,25 @@ package memo_architecture_implementation_software_structure {
     private import memo_core_relationships::*;
     private import memo_architecture_logical_structure::*;
 
-    part def SoftwareSystem specializes ArchitectureElement {
-        attribute version : String;
+    // IEC 62304 §3.25: a SOFTWARE ITEM is "any identifiable part of a computer
+    // program". It is the general, recursive term — a SOFTWARE SYSTEM (§3.24)
+    // is the top item and a SOFTWARE UNIT (§3.26) is one not subdivided
+    // further; both are software items. So this is a base, not a fourth
+    // sibling of system/module/component.
+    //
+    // It exists because §4.3 classifies, and §5.3–5.4 decompose, SOFTWARE
+    // ITEMS — not "modules" or "components" specifically. Anything the
+    // standard obliges at item level therefore belongs here, and every
+    // software view inherits it rather than re-declaring it: the code view
+    // (SoftwareModule), the runtime view (SoftwareComponent), the system, and
+    // the user interface (memo_architecture_implementation_ui::UIElement).
+    abstract part def SoftwareItem specializes ArchitectureElement {
         attribute safetyClass : SafetyClassKind;
         attribute complexity : ComplexityKind;
+    }
+
+    part def SoftwareSystem specializes SoftwareItem {
+        attribute version : String;
         attribute operatingSystem : String;
     }
 
@@ -29,11 +44,9 @@ package memo_architecture_implementation_software_structure {
         enum soup;
     }
 
-    part def SoftwareModule specializes ArchitectureElement {
+    part def SoftwareModule specializes SoftwareItem {
         attribute moduleKind : ModuleKind;
         attribute responsibility : String;
-        attribute safetyClass : SafetyClassKind;
-        attribute complexity : ComplexityKind;
         // module-kind-specific detail (set only for the relevant moduleKind)
         attribute iec62304Role : String[0..1];
         attribute implementationLanguage : String[0..1];

package/src/architecture/implementation/ui/memo_ui.sysml

@@ -14,22 +14,81 @@ package memo_architecture_implementation_ui {
     private import memo_architecture_operational_scenarios::*;
     private import memo_architecture_operational_use_cases::*;
     private import memo_architecture_functional_functions::*;
+    private import memo_architecture_implementation_software_structure::*;
+    private import memo_architecture_implementation_hardware_common::*;
     private import memo_assurance_human_factors::*;
 
+    // Every concrete UI form, holding and held alike. A screen is not a
+    // different KIND of thing from a button — it is a UIElement that happens to
+    // contain others, exactly as an assembly is a part that contains parts.
+    // The forms below are classifications, not classes, so one tree carries the
+    // whole interface.
     enum def UIElementFormKind {
+        // ── forms that hold other elements ──
+        enum screen;
+        enum dialog;
+        enum panel;
+        enum menu;
+        enum tab;
+        enum drawer;
+        enum wizardStep;
+        // ── controls the user acts on ──
+        // Rendered controls only. A knob, toggle, lamp, or buzzer the user
+        // touches is not software: it is an OperatorInterfaceElement below.
         enum button;
         enum field;
         enum selector;
-        enum knob;
-        enum switchControl;
         enum slider;
+        // ── forms that present information ──
         enum table;
         enum chart;
         enum icon;
-        enum indicatorLamp;
-        enum audibleIndicator;
-        enum hapticIndicator;
         enum textMessage;
+        // ── chrome ──
+        // Non-functional: a rule, a background, a brand mark. Declared, never
+        // merely implied — CR-MED-110 exempts `decoration` from needing a
+        // design record, so an element left unclassified fails rather than
+        // slipping through as scenery.
+        enum decoration;
+    }
+
+    // ─── Screen geometry ─────────────────────────────────────────
+    // Position and size of a UIElement inside its PARENT element, each value
+    // normalized to 0..1 of the parent's box — not pixels. Two consequences
+    // are wanted: an element survives a re-capture at a different resolution
+    // or device scale, and a child's box is stated against its parent, which
+    // is exactly what the containment tree already asserts. Absolute pixels
+    // stay recoverable from the ScreenCapture's pixelWidth / pixelHeight.
+    attribute def RegionBounds {
+        attribute x : Real;
+        attribute y : Real;
+        attribute width : Real;
+        attribute height : Real;
+    }
+
+    // How an element appears relative to its parent and siblings. It records
+    // design intent a bare rectangle cannot: an element whose box escapes its
+    // parent and covers its siblings is a defect if it is `inline` and correct
+    // if it is `overlay`, and the geometry alone does not say which. A
+    // renderer reads it to decide what to clip and what to draw on top; a
+    // reviewer reads it to know whether an overlap is intended.
+    enum def UIDisclosureKind {
+        enum inline;       // laid out inside the parent, sharing space with siblings
+        enum overlay;      // dropdown, popover, modal — drawn OVER parent and siblings
+        enum transient;    // tooltip, toast — appears over everything, then withdraws
+        enum scrolled;     // inside the parent, but beyond its viewport until scrolled
+        enum conditional;  // rendered only while a stated condition holds
+    }
+
+    // How the element's bounds were obtained. Automatic boundary detection
+    // PROPOSES; a reviewer DISPOSES. In a regulated review the reader must be
+    // able to see which boxes a human confirmed and which the tool guessed, so
+    // that provenance is model content and not a workbench-only flag.
+    enum def BoundsDetectionKind {
+        enum manual;
+        enum automatic;
+        enum automaticConfirmed;
+        enum imported;
     }
 
     // The interaction intents a step or action can carry (§18).
@@ -54,20 +113,68 @@ package memo_architecture_implementation_ui {
         attribute uiTechnology : String;
     }
 
-    part def UIContainer specializes ArchitectureElement {
-        attribute containerKind : String;
-        attribute navigationRole : String;
+    // What a rendered control and a physical one genuinely share: a label, an
+    // accessibility story, and — when they annunciate — an alarm character.
+    // The base exists so that the §18 traceability relations can type against
+    // "something the user interacts with" rather than against software
+    // specifically. Without it a use error on a knob would be unmodellable,
+    // because ErrorAtElement would only accept a UIElement.
+    abstract part def InteractionElement specializes ArchitectureElement {
+        attribute labelText : String;
+        attribute accessibilitySummary : String;
+        // alarm annunciation (optional; IEC 60601-1-8)
+        attribute alarmPriority : NotificationPriorityKind[0..1];
+        attribute annunciationModality : String;
+        attribute silenceable : Boolean;
     }
 
-    // One UIElement. The widget form — screen (field/table/chart) or physical
-    // (knob/switch/indicatorLamp/haptic) — is the `formKind` enum, not a
-    // subclass. Input/output/navigation/alarm/display/physical-control
-    // descriptors are optional attributes; a physical control's mechanical
-    // realization is a hardware part linked by ControlImplementedBy.
-    part def UIElement specializes ArchitectureElement {
+
+    // One UIElement — the single UI part type. The widget form — holding
+    // (screen/panel/dialog), acting (button/knob/slider), presenting
+    // (field/table/chart), physical (knob/switch/indicatorLamp/haptic), or
+    // decorative — is the `formKind` enum, not a subclass.
+    // Input/output/navigation/alarm/display/physical-control descriptors are
+    // optional attributes; a physical control's mechanical realization is a
+    // hardware part linked by ControlImplementedBy.
+    //
+    // Composition is the ordinary `Composes` relation, so a screen's element
+    // tree is an ordinary part tree: CR-ONT-001 already forbids cycles in it,
+    // impact analysis already walks it, and requirements, functions, use
+    // errors, and risk controls already trace to it. Screen layout adds four
+    // numbers to that tree — it does not add a tree.
+    //
+    // A UIElement IS a SOFTWARE ITEM (IEC 62304 §3.25) and specializes the
+    // SoftwareItem base, inheriting safetyClass and complexity, so the
+    // interface is classified and decomposed like the software it is.
+    //
+    // It specializes SoftwareItem and NOT SoftwareModule: the module view is
+    // CODE, and a screen is not a source module. Runtime processes are
+    // SoftwareComponent, code is SoftwareModule, and the UI is a third view of
+    // the same software — a sibling of those, not a kind of either.
+    part def UIElement specializes SoftwareItem, InteractionElement {
         attribute formKind : UIElementFormKind;
-        attribute labelText : String;
-        attribute accessibilitySummary : String;
+        // ── screen layout (optional; set for elements that are laid out) ──
+        // Bounds are relative to the parent element in the Composes tree; a
+        // root screen's bounds are the full frame.
+        attribute bounds : RegionBounds[0..1];
+        attribute disclosureKind : UIDisclosureKind[0..1];
+        // The condition under which the element renders; meaningful when
+        // disclosureKind is `conditional`.
+        attribute visibilityCondition : String;
+        // Boundary colour as a CSS colour token. Presentation, but modelled: a
+        // review print, an exported figure, and the workbench must agree on
+        // which box is which, and a colour assigned only in a tool session does
+        // not survive the export.
+        attribute boundaryColor : String;
+        // Capture-relative fill transparency for region review overlays. A
+        // modelled value keeps interactive review and exported figures aligned.
+        attribute boundaryOpacity : Real[0..1];
+        attribute detectionMethod : BoundsDetectionKind[0..1];
+        attribute detectionConfidence : Real[0..1];
+        attribute confirmedBy : String;
+        attribute confirmedAt : String;
+        // ── role of a holding form (optional) ──
+        attribute navigationRole : String;
         // input descriptors (optional)
         attribute inputConstraints : String;
         attribute defaultValue : String;
@@ -75,15 +182,72 @@ package memo_architecture_implementation_ui {
         attribute updateRate : String;
         attribute unitsDisplayed : String;
         attribute informationContent : String;
-        // navigation (optional)
-        attribute navigationTarget : String;
-        // alarm annunciation (optional)
-        attribute alarmPriority : NotificationPriorityKind[0..1];
-        attribute annunciationModality : String;
-        attribute silenceable : Boolean;
-        // physical control (optional)
+    }
+
+    // ─── Physical operator interface ─────────────────────────────
+    // The hardware the user actually touches and reads. IEC 60601-1 marks
+    // "controls and instruments" and defines OPERATOR; this is that surface,
+    // covering both directions — what the operator actuates and what the
+    // device shows back — because a front panel is one interface, not two.
+    //
+    // It is a PhysicalComponent, so it inherits part number, material, and the
+    // ISO 10993-1 patient-contact characterization that a touched surface
+    // needs and that software can never have. That inheritance is the reason
+    // these forms had to leave UIElement: as UIElementFormKind members they
+    // were software items with no way to state any of it.
+    enum def OperatorInterfaceFormKind {
+        // ── actuated by the operator ──
+        enum knob;
+        enum dial;
+        enum pushButton;
+        enum toggleSwitch;
+        enum rockerSwitch;
+        enum lever;
+        enum physicalSlider;
+        enum keypad;
+        enum footPedal;
+        enum touchSurface;
+        // ── presented to the operator ──
+        enum indicatorLamp;
+        enum gauge;
+        enum audibleIndicator;
+        enum hapticIndicator;
+        enum printedMarking;
+    }
+
+    part def OperatorInterfaceElement specializes PhysicalComponent, InteractionElement {
+        attribute formKind : OperatorInterfaceFormKind;
+        // actuation (optional; set for actuated forms)
         attribute actuationForce : String;
+        attribute actuationTravel : String;
         attribute guardedAgainstInadvertentActuation : Boolean;
+        attribute tactileFeedback : String;
+        // presentation (optional; set for presented forms)
+        attribute legendText : String;
+        attribute luminanceOrVolume : String;
+    }
+
+    // ─── Captured evidence ───────────────────────────────────────
+    // One image of one screen. MemoEvidence, not ArchitectureElement: it
+    // records what a specific build actually displayed at a specific time,
+    // which is the provenance a design review or a usability engineering file
+    // needs before it can rely on the picture. The screen it depicts is an
+    // ordinary UIElement with formKind = screen.
+    part def ScreenCapture specializes MemoEvidence {
+        attribute imageUri : String;
+        // Content hash of the image bytes. The screenshot is the evidence, so
+        // it must be tamper-evident: a DHF reference to a mutable file is not
+        // a reference to anything.
+        attribute imageHash : String;
+        attribute pixelWidth : Integer;
+        attribute pixelHeight : Integer;
+        attribute captureDate : String;
+        // Which build produced this rendering. A screenshot without a build is
+        // undated design intent, not evidence of the device.
+        attribute capturedBuild : String;
+        // Device, viewport, locale, theme, user role — everything that changes
+        // what the screen shows without changing the software.
+        attribute captureContext : String;
     }
 
     // UI state is presentation state — distinct from system/device state.
@@ -109,7 +273,7 @@ package memo_architecture_implementation_ui {
         attribute exitPoint : String;
     }
 
-    part def UIScenario specializes MemoScenario {
+    action def UIScenario specializes MemoScenario {
         ref parentFlow : InteractionFlow[0..1];
     }
 
@@ -122,7 +286,7 @@ package memo_architecture_implementation_ui {
     connection def DataBinding :> MemoRelationship {
         attribute bindingExpression : String;
         attribute refreshPolicy : String;
-        end boundElement : UIElement;
+        end boundElement : InteractionElement;
         end dataSource : MemoPart;
     }
     connection def PresentsState :> MemoRelationship {
@@ -130,9 +294,28 @@ package memo_architecture_implementation_ui {
         end uiState : UIState;
     }
 
+    // ── Screen layout relations ──────────────────────────────────
+    // Which modelled screen an image is a rendering of.
+    connection def CapturesScreen :> MemoRelationship {
+        end capture : ScreenCapture;
+        end screen : UIElement;
+    }
+
+    // Activating this element opens another screen. This is NAVIGATION, not
+    // containment — the opened screen is not laid out inside the element, so
+    // it is not a Composes child and the geometric rules do not relate them.
+    // Conflating the two was the mistake that made "clicking takes you to a
+    // child view" look like spatial nesting; it is a separate frame reached
+    // from here, and only this relation says so.
+    connection def NavigatesTo :> MemoRelationship {
+        attribute triggerGesture : String;
+        end sourceElement : UIElement;
+        end targetScreen : UIElement;
+    }
+
     // ── §18 traceability ─────────────────────────────────────────
     connection def ElementTriggersAction :> MemoRelationship {
-        end element : UIElement;
+        end element : InteractionElement;
         end triggeredAction : UIAction;
     }
     connection def ActionInvokesFunction :> MemoRelationship {
@@ -148,7 +331,7 @@ package memo_architecture_implementation_ui {
     // completing the OperativeScenario → FunctionalScenario → UIScenario chain.
     connection def ErrorAtElement :> MemoRelationship {
         end useError : UseError;
-        end element : UIElement;
+        end element : InteractionElement;
     }
     // A risk control implemented by a UI element or by task design
     // (confirmation dialog, lockout, guarded control).