@memoarchitect/ontology 0.7.0 → 0.8.22

package/src/architecture/implementation/software/runtime/memo_software_runtime.sysml

@@ -1,10 +1,17 @@
-// Software runtime (component-and-connector) view (§11). Runtime structure
-// with concurrency, scheduling, health monitoring, fault containment, and
-// update/rollback semantics. Module structure lives in
+// Software runtime (component-and-connector) view (§11), matching the SEI
+// Views and Beyond distinction between runtime components and implementation
+// modules. Runtime structure carries concurrency, scheduling, health
+// monitoring, fault containment, and update/rollback semantics. Module structure lives in
 // memo_architecture_implementation_software_structure; allocation in
-// memo_architecture_realization_deployment. Detailed AADL categories stay in the AADL
-// correspondence profile (examples/aadl-mapping).
+// memo_architecture_realization_deployment.
+//
+// Detailed AADL categories live in the AADL correspondence profile, which is
+// an extension package: `extensions/aadl` (plan §C5). It carries the process /
+// thread / virtual-processor families and a correspondence rule per mapped
+// name and property. This comment pointed at `examples/aadl-mapping` for a
+// long time and that directory never existed; the pointer above resolves.
 package memo_architecture_implementation_software_runtime {
+    private import Metaobjects::SemanticMetadata;
     private import ScalarValues::*;
 
     private import memo_core_common::*;
@@ -25,7 +32,7 @@ package memo_architecture_implementation_software_runtime {
         enum messageBroker;
     }
 
-    part def SoftwareComponent specializes SoftwareItem {
+    part def SoftwareComponent specializes SoftwareElement {
         attribute runtimeKind : RuntimeKind;
         attribute responsibility : String;
         attribute periodMs : Real;
@@ -36,7 +43,10 @@ package memo_architecture_implementation_software_runtime {
         attribute activation : String;
         attribute synchronizationMechanism : String;
         attribute sharedResources : String;
-        attribute memoryBudget : String;
+        // Maximum resident memory allocation in megabytes.  The public name
+        // predates MEMO's unit-suffixed scalar convention, so document the
+        // unit here rather than silently changing the published feature name.
+        attribute memoryBudget : Real;
         attribute healthMonitoring : String;
         attribute restartPolicy : String;
         attribute faultContainment : String;
@@ -45,24 +55,38 @@ package memo_architecture_implementation_software_runtime {
         attribute auditable : Boolean;
         attribute updatePolicy : String;
         attribute rollbackPolicy : String;
-        // runtime-kind-specific detail (set only for the relevant runtimeKind)
-        attribute addressSpaceIsolated : Boolean[0..1];
-        attribute owningProcessName : String[0..1];
-        attribute serviceContract : String[0..1];
-        attribute discoveryMechanism : String[0..1];
-        attribute imageReference : String[0..1];
-        attribute orchestrationPlatform : String[0..1];
-        attribute partitionBudget : String[0..1];
-        attribute isolationMechanism : String[0..1];
-        attribute storageKind : String[0..1];
-        attribute retentionPolicy : String[0..1];
-        attribute deliverySemantics : String[0..1];
-        attribute topicStructure : String[0..1];
+        // Twelve runtime-kind-conditional attributes used to follow, each
+        // documented "set only for the relevant runtimeKind" — which is a
+        // subtype family in disguise, and a technology the base ontology had
+        // no business asserting. They are gone; every one of them now lives on
+        // a type in an extension, where it is unconditional and therefore
+        // checkable (plan §10.3 D3, extensions/README.md):
+        //
+        //   addressSpaceIsolated, owningProcessName,
+        //   partitionBudget, isolationMechanism          -> extensions/aadl
+        //   serviceContract, discoveryMechanism,
+        //   storageKind, retentionPolicy                 -> extensions/cloud
+        //   imageReference, orchestrationPlatform        -> extensions/container
+        //   deliverySemantics, topicStructure            -> extensions/messaging
+        //
+        // The last two were also on the wrong metaclass: a component does not
+        // have a topic, a publication does.
+        //
+        // What stays is what is true of EVERY runtime component in every
+        // regulated project — the AADL thread properties above and the
+        // assurance ones — plus `runtimeKind` itself, which says which family
+        // a component belongs to without claiming to describe it.
     }
 
     connection def ComponentConnects :> MemoRelationship {
         attribute protocolSummary : String;
-        end sourceComponent : SoftwareComponent;
-        end targetComponent : SoftwareComponent;
+        end sourceComponent : SoftwareComponent :>> source;
+        end targetComponent : SoftwareComponent :>> target;
+    }
+    abstract connection componentConnectsLinks : ComponentConnects[*];
+    metadata def <componentConnects> ComponentConnectsMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = componentConnectsLinks meta SysML::Usage;
     }
 }

package/src/architecture/implementation/software/structure/memo_software_structure.sysml

@@ -1,7 +1,10 @@
-// Software module view (§11; IEC 62304 5.3-5.4). Code/module structure only:
-// runtime structure lives in memo_architecture_implementation_software_runtime and
-// allocation in memo_architecture_realization_deployment.
+// Software module view (§11; IEC 62304 5.3-5.4). Following the SEI Views and
+// Beyond viewtypes, modules are implementation/code units; interacting runtime
+// elements are SoftwareComponents in
+// memo_architecture_implementation_software_runtime, and allocation lives in
+// memo_architecture_realization_deployment.
 package memo_architecture_implementation_software_structure {
+    private import Metaobjects::SemanticMetadata;
     private import ScalarValues::*;
 
     private import memo_core_common::*;
@@ -21,12 +24,16 @@ package memo_architecture_implementation_software_structure {
     // software view inherits it rather than re-declaring it: the code view
     // (SoftwareModule), the runtime view (SoftwareComponent), the system, and
     // the user interface (memo_architecture_implementation_ui::UIElement).
-    abstract part def SoftwareItem specializes ArchitectureElement {
+    // Structural software decomposition is part-native. IEC 62304 also uses
+    // the term "software item" for this concept, but reserving SoftwareItem
+    // for the native SysML item family keeps structural parts and exchanged
+    // values unambiguous in the model.
+    abstract part def SoftwareElement specializes ArchitectureElement {
         attribute safetyClass : SafetyClassKind;
         attribute complexity : ComplexityKind;
     }
 
-    part def SoftwareSystem specializes SoftwareItem {
+    part def SoftwareSystem specializes SoftwareElement {
         attribute version : String;
         attribute operatingSystem : String;
     }
@@ -44,7 +51,7 @@ package memo_architecture_implementation_software_structure {
         enum soup;
     }
 
-    part def SoftwareModule specializes SoftwareItem {
+    part def SoftwareModule specializes SoftwareElement {
         attribute moduleKind : ModuleKind;
         attribute responsibility : String;
         // module-kind-specific detail (set only for the relevant moduleKind)
@@ -78,7 +85,15 @@ package memo_architecture_implementation_software_structure {
         attribute version : String;
     }
 
-    item def SBOMEntry specializes MemoExchangeItem {
+    // Software data/content that may be stored or exchanged through ports.
+    abstract item def SoftwareItem specializes MemoItem {
+        attribute schemaIdentifier : String;
+        attribute schemaVersion : String;
+        attribute encoding : String;
+        attribute timestampRequired : Boolean;
+    }
+
+    item def SBOMEntry specializes SoftwareItem {
         attribute componentName : String;
         attribute version : String;
         attribute supplier : String;
@@ -86,8 +101,20 @@ package memo_architecture_implementation_software_structure {
         attribute hash : String;
     }
 
-    connection def ModuleUses :> MemoRelationship {
-        end usingModule : SoftwareModule;
-        end usedModule : SoftwareModule;
+    // `ModuleUses` is native `dependency` (R10-S6): write
+    // `dependency <usingModule> to <usedModule>;` instead of a connection.
+
+    // ── Relations owned by this package ─────────────────────────────
+    // Moved out of memo_core_relationships: their ends are typed against
+    // types declared here, and core must not depend on a domain package.
+    connection def DependsOnSoup :> MemoRelationship {
+        end component : ArchitectureElement :>> source;
+        end soupItem : SoftwareElement :>> target;
+    }
+    abstract connection dependsOnSoupLinks : DependsOnSoup[*];
+    metadata def <dependsOnSoup> DependsOnSoupMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = dependsOnSoupLinks meta SysML::Usage;
     }
 }

package/src/architecture/implementation/ui/memo_ui.sysml

@@ -5,10 +5,12 @@
 // UI is an implementation concern (rendered UI is software; physical controls
 // are hardware), so it lives in the implementation layer, not operational.
 package memo_architecture_implementation_ui {
+    private import Metaobjects::SemanticMetadata;
     private import ScalarValues::*;
 
     private import memo_core_common::*;
     private import memo_core_enumerations::*;
+    private import memo_assurance_safety_risk::*;   // RiskControlMeasure
     private import memo_core_relationships::*;
     private import memo_architecture_operational_activities::*;
     private import memo_architecture_operational_scenarios::*;
@@ -143,15 +145,15 @@ package memo_architecture_implementation_ui {
     // errors, and risk controls already trace to it. Screen layout adds four
     // numbers to that tree — it does not add a tree.
     //
-    // A UIElement IS a SOFTWARE ITEM (IEC 62304 §3.25) and specializes the
-    // SoftwareItem base, inheriting safetyClass and complexity, so the
+    // A UIElement IS a structural SOFTWARE ITEM (IEC 62304 §3.25) and
+    // specializes SoftwareElement, inheriting safetyClass and complexity, so the
     // interface is classified and decomposed like the software it is.
     //
-    // It specializes SoftwareItem and NOT SoftwareModule: the module view is
+    // It specializes SoftwareElement and NOT SoftwareModule: the module view is
     // CODE, and a screen is not a source module. Runtime processes are
     // SoftwareComponent, code is SoftwareModule, and the UI is a third view of
     // the same software — a sibling of those, not a kind of either.
-    part def UIElement specializes SoftwareItem, InteractionElement {
+    part def UIElement specializes SoftwareElement, InteractionElement {
         attribute formKind : UIElementFormKind;
         // ── screen layout (optional; set for elements that are laid out) ──
         // Bounds are relative to the parent element in the Composes tree; a
@@ -169,6 +171,11 @@ package memo_architecture_implementation_ui {
         // Capture-relative fill transparency for region review overlays. A
         // modelled value keeps interactive review and exported figures aligned.
         attribute boundaryOpacity : Real[0..1];
+        // Stroke width of the same box, in pixels. Colour and opacity are
+        // modelled so a review print, an exported figure, and the workbench
+        // agree on which box is which; a width chosen per renderer breaks that
+        // agreement for exactly the same reason.
+        attribute boundaryWidth : Real[0..1];
         attribute detectionMethod : BoundsDetectionKind[0..1];
         attribute detectionConfidence : Real[0..1];
         attribute confirmedBy : String;
@@ -267,38 +274,44 @@ package memo_architecture_implementation_ui {
     }
 
     // A reusable dialogue structure through the UI; a selected path through
-    // it is an UIScenario.
+    // it is a MemoScenario with scenarioKind `ui`.
     action def InteractionFlow specializes MemoAction {
         attribute entryPoint : String;
         attribute exitPoint : String;
     }
 
-    action def UIScenario specializes MemoScenario {
-        ref parentFlow : InteractionFlow[0..1];
-    }
-
-    connection def UITransition :> MemoRelationship {
-        attribute triggeringEvent : String;
-        attribute guardCondition : String;
-        end sourceState : UIState;
-        end targetState : UIState;
-    }
     connection def DataBinding :> MemoRelationship {
         attribute bindingExpression : String;
         attribute refreshPolicy : String;
-        end boundElement : InteractionElement;
-        end dataSource : MemoPart;
+        end boundElement : InteractionElement :>> source;
+        end dataSource : MemoItem :>> target;
     }
-    connection def PresentsState :> MemoRelationship {
-        end userInterface : UserInterface;
-        end uiState : UIState;
+    abstract connection dataBindingLinks : DataBinding[*];
+    metadata def <dataBinding> DataBindingMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = dataBindingLinks meta SysML::Usage;
     }
+    // `PresentsState` had zero usages anywhere in the tree (R10-S6). Its
+    // audited native form, `exhibit state`, does not actually fit: `UIState`
+    // is a `part def` with plain string attributes, not a `state def`, and
+    // SysIDE rejects `exhibit` referencing anything that does not conform to
+    // `States::StateAction` ("An exhibit state must reference another
+    // state"). Free deletion rather than a migration — nothing referenced
+    // it, so nothing to preserve. If `UIState` is ever restructured onto a
+    // real state machine, `exhibit state` becomes available then.
 
     // ── Screen layout relations ──────────────────────────────────
     // Which modelled screen an image is a rendering of.
     connection def CapturesScreen :> MemoRelationship {
-        end capture : ScreenCapture;
-        end screen : UIElement;
+        end capture : ScreenCapture :>> source;
+        end screen : UIElement :>> target;
+    }
+    abstract connection capturesScreenLinks : CapturesScreen[*];
+    metadata def <capturesScreen> CapturesScreenMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = capturesScreenLinks meta SysML::Usage;
     }
 
     // Activating this element opens another screen. This is NAVIGATION, not
@@ -309,34 +322,61 @@ package memo_architecture_implementation_ui {
     // from here, and only this relation says so.
     connection def NavigatesTo :> MemoRelationship {
         attribute triggerGesture : String;
-        end sourceElement : UIElement;
-        end targetScreen : UIElement;
+        end sourceElement : UIElement :>> source;
+        end targetScreen : UIElement :>> target;
+    }
+    abstract connection navigatesToLinks : NavigatesTo[*];
+    metadata def <navigatesTo> NavigatesToMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = navigatesToLinks meta SysML::Usage;
     }
 
     // ── §18 traceability ─────────────────────────────────────────
     connection def ElementTriggersAction :> MemoRelationship {
-        end element : InteractionElement;
-        end triggeredAction : UIAction;
+        end element : InteractionElement :>> source;
+        end triggeredAction : UIAction :>> target;
     }
-    connection def ActionInvokesFunction :> MemoRelationship {
-        end uiAction : UIAction;
-        end systemFunction : SystemFunction;
+    abstract connection elementTriggersActionLinks : ElementTriggersAction[*];
+    metadata def <elementTriggersAction> ElementTriggersActionMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = elementTriggersActionLinks meta SysML::Usage;
     }
+    // `ActionInvokesFunction` is native `perform` (R10-S6): write
+    // `perform <systemFunction>;` inside the `UIAction` usage instead.
     connection def FlowServesUseCase :> MemoRelationship {
-        end interactionFlow : InteractionFlow;
-        end useCase : UseCase;
+        end interactionFlow : InteractionFlow :>> source;
+        end useCase : UseCase :>> target;
+    }
+    abstract connection flowServesUseCaseLinks : FlowServesUseCase[*];
+    metadata def <flowServesUseCase> FlowServesUseCaseMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = flowServesUseCaseLinks meta SysML::Usage;
     }
-    // The UI-layer scenario realizes exactly one FunctionalScenario one layer
-    // up (the interaction sequence that carries out the function sequence),
-    // completing the OperativeScenario → FunctionalScenario → UIScenario chain.
+    // A UI scenario realizes a functional scenario one layer up: each is a
+    // MemoScenario selected by scenarioKind rather than a separate definition.
     connection def ErrorAtElement :> MemoRelationship {
-        end useError : UseError;
-        end element : InteractionElement;
+        end useError : UseError :>> source;
+        end element : InteractionElement :>> target;
+    }
+    abstract connection errorAtElementLinks : ErrorAtElement[*];
+    metadata def <errorAtElement> ErrorAtElementMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = errorAtElementLinks meta SysML::Usage;
     }
     // A risk control implemented by a UI element or by task design
     // (confirmation dialog, lockout, guarded control).
     connection def ControlImplementedBy :> MemoRelationship {
-        end riskControl : VerifiableElement;
-        end implementingElement : ArchitectureElement;
+        end riskControl : RiskControlMeasure :>> source;
+        end implementingElement : ArchitectureElement :>> target;
+    }
+    abstract connection controlImplementedByLinks : ControlImplementedBy[*];
+    metadata def <controlImplementedBy> ControlImplementedByMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = controlImplementedByLinks meta SysML::Usage;
     }
 }

package/src/architecture/logical/interfaces/memo_interfaces.sysml

@@ -44,12 +44,24 @@ package memo_architecture_logical_interfaces {
         attribute apiStyle : String;
     }
 
+    // Software interaction contracts specialize the native MEMO interface
+    // family. Concrete technologies add their protocol roles and message
+    // flows; ports remain the endpoints that components actually own.
+    abstract interface def SoftwareInterface specializes Interface {
+        // `default`, not `=`. A bare `=` in a definition BINDS the value, and
+        // a binding cannot be overridden by a usage — which asserted that
+        // every software interface is bidirectional and made a directional one
+        // inexpressible. A ROS topic publisher → subscriber is the obvious
+        // counterexample, and it is the common case rather than an exotic one.
+        attribute :>> direction default DirectionKind::inputOutput;
+    }
+
     // A typed thing exchanged at a boundary. Concrete items such as
     // AlarmSignal and FlowCommand specialize this type; they are neither
     // functions nor generic action-flow notation.
     // The kind of item is given by itemKind (data / command / signal / …);
     // the control-specific fields below apply only when itemKind = command.
-    item def InterfaceItem specializes MemoExchangeItem {
+    item def InterfaceItem specializes MemoItem {
         attribute itemKind : InterfaceItemKind;
         attribute confidentialityClass : String;
         attribute integrityClass : String;
@@ -75,14 +87,45 @@ package memo_architecture_logical_interfaces {
 
     part def ComponentExchange specializes ArchitectureElement {
         attribute exchangeKind : FlowKind;
-        // Typed endpoints (CR-ONT-002). A component or a boundary port may
-        // terminate an exchange, so the ends are MemoPart-typed.
-        ref sourceEndpoint : MemoPart[0..1];
-        ref targetEndpoint : MemoPart[0..1];
-        // Descriptive port paths (e.g. "TLM.TLM_MODE_OUT") for AADL
-        // round-trips; labels only — never references.
-        attribute sourcePortPath : String;
-        attribute targetPortPath : String;
+        // Metaclass-neutral endpoints. CR-ONT-002 used to read: "Typed
+        // endpoints. A component or a boundary port may terminate an exchange,
+        // so the ends are MemoPart-typed." That reasoning was circular —
+        // PhysicalPort and SoftwarePort are part defs precisely SO THAT they
+        // could satisfy this typing, and the typing was justified by their
+        // being parts. Track A0 cut the circle at the ends, which is the side
+        // that has to move first: A1 turns those two into `port def`s, and a
+        // port cannot specialize a part-based type.
+        //
+        // The constraint the type was carrying — an endpoint is a component or
+        // a boundary port, never a requirement or a document — is now stated
+        // where it can be checked across metaclasses, as CR-ONT-072/073 in
+        // src/rules/ontology/ontology_invariants.sysml.
+        //
+        // `Base::Anything` rather than no type at all — the only place in this
+        // change that reaches for it. The 36 untyped ends in
+        // memo_core_relationships are `end` declarations, and an untyped `end`
+        // is established practice; an untyped `ref` with a multiplicity is not
+        // something MEMO's own grammar accepts (`Expecting token of type ';'
+        // but found '['`), and the grammar is not in this session's scope.
+        // `Base::Anything` is what the standard's `Allocations::Allocation`
+        // types its own ends with, so it is the conforming spelling of "any
+        // element", not a workaround.
+        ref sourceEndpoint : Base::Anything[0..1];
+        ref targetEndpoint : Base::Anything[0..1];
+        // `sourcePortPath` / `targetPortPath` are GONE. They were String
+        // "descriptive port paths (e.g. TLM.TLM_MODE_OUT) for AADL round-trips;
+        // labels only — never references", which is §13.3's string
+        // pseudo-reference: nothing can follow a string to an element, so
+        // anything built on them produced no traceability.
+        //
+        // Measured across the 92 sites in the GPCA example before removing
+        // them: 23 merely restated the endpoint the ref already named (15 gave
+        // the port's own display name, 8 were prose like "HW-001:
+        // GPCA_HW_Sensors"), and the other 69 named a port ON the endpoint
+        // component, resolving to 49 distinct AADL features. Those 49 are
+        // declared as real ports now and the endpoint refs point straight at
+        // them, which is what Track A1 making SoftwarePort a `port def` is for.
+        // The AADL round-trip is better served by an element than by its name.
         ref allocatedExchanges : FunctionalExchange[0..*];
         attribute direction : DirectionKind;
         // Connection timing discipline from the source architecture
@@ -93,9 +136,18 @@ package memo_architecture_logical_interfaces {
     // Boundary data port of a software system (e.g. an AADL top-level
     // data port), modeled as a first-class element so exchanges can
     // reference it and views can render the system boundary.
-    part def SoftwarePort specializes InterfaceElement {
+    //
+    // A `port def` (Track A1) — see PhysicalPort in
+    // memo_architecture_realization_physical for why the specialization moved
+    // off InterfaceElement, why `direction` is native now (Track A2), and why
+    // `portKind` is duplicated on both ports instead of hoisted onto a base.
+    port def SoftwarePort specializes MemoPort {
         attribute portKind : InterfaceKind;
-        attribute direction : DirectionKind;
+        // AADL port category (plan C2). Sampled vs. queued delivery decides
+        // whether a missed deadline drops a sample or grows a queue, which the
+        // timing analysis and the safety case both need and neither could ask
+        // the model for. `portKind` says what crosses; this says how.
+        attribute portCategory : PortCategoryKind;
         attribute dataTypeName : String;
     }
 }

package/src/architecture/logical/structure/memo_logical_structure.sysml

@@ -4,6 +4,7 @@
 // plus independence constraints — never by duplicating identically named
 // components.
 package memo_architecture_logical_structure {
+    private import Metaobjects::SemanticMetadata;
     private import ScalarValues::*;
 
     private import memo_core_common::*;
@@ -144,7 +145,7 @@ package memo_architecture_logical_structure {
         end providerPort : LogicalPort;
         end consumerPort : ~LogicalPort;
     }
-    item def LogicalExchangeItem specializes MemoExchangeItem {
+    item def LogicalExchangeItem specializes MemoItem {
         attribute contentKind : FlowContentKind;
     }
 
@@ -152,8 +153,14 @@ package memo_architecture_logical_structure {
     connection def LogicalConnector :> MemoRelationship {
         attribute contentKind : FlowContentKind;
         attribute direction : DirectionKind;
-        end sourceComponent : LogicalComponent;
-        end targetComponent : LogicalComponent;
+        end sourceComponent : LogicalComponent :>> source;
+        end targetComponent : LogicalComponent :>> target;
+    }
+    abstract connection logicalConnectorLinks : LogicalConnector[*];
+    metadata def <logicalConnector> LogicalConnectorMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = logicalConnectorLinks meta SysML::Usage;
     }
     // A transfer of a typed item across a connector.
     part def LogicalExchange specializes ArchitectureElement {
@@ -167,14 +174,7 @@ package memo_architecture_logical_structure {
 
     // States and modes of the logical solution (kept distinct from UI state
     // and from physical device configuration).
-    part def LogicalState specializes ArchitectureElement {
-        attribute stateInvariant : String;
-    }
-    part def LogicalMode specializes ArchitectureElement {
-        attribute modePurpose : String;
-        attribute entryCondition : String;
-        attribute exitCondition : String;
-    }
+
     part def LogicalBehavior specializes ArchitectureElement {
         attribute behaviorSummary : String;
         attribute executionSemantics : String;
@@ -192,15 +192,16 @@ package memo_architecture_logical_structure {
     // Claimed independence between channels (common-cause defense).
     connection def IndependentOf :> MemoRelationship {
         attribute independenceBasis : String;
-        end channel : LogicalComponent;
-        end otherChannel : LogicalComponent;
-    }
-    connection def MonitorsChannel :> MemoRelationship {
-        end monitorChannel : LogicalComponent;
-        end monitoredComponent : LogicalComponent;
+        end channel : LogicalComponent :>> source;
+        end otherChannel : LogicalComponent :>> target;
     }
-    connection def ExhibitsMode :> MemoRelationship {
-        end component : LogicalComponent;
-        end mode : LogicalMode;
+    abstract connection independentOfLinks : IndependentOf[*];
+    metadata def <independentOf> IndependentOfMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = independentOfLinks meta SysML::Usage;
     }
+    // `MonitorsChannel` is native `dependency` (R10-S6): write
+    // `dependency <monitorChannel> to <monitoredComponent>;` instead.
+
 }

package/src/architecture/operational/activities/memo_activities.sysml

@@ -7,6 +7,7 @@
 // Task difficulty belongs to a task performed in a context — never to an
 // instrument (TaskDifficultyAssessment).
 package memo_architecture_operational_activities {
+    private import Metaobjects::SemanticMetadata;
     private import ScalarValues::*;
 
     private import memo_core_common::*;
@@ -28,7 +29,7 @@ package memo_architecture_operational_activities {
         attribute preCondition : String;
         attribute postCondition : String;
         attribute criticality : CriticalityKind;
-        ref performedBy : Actor[0..*];
+        ref performedBy : OperationalParticipant[0..*];
     }
 
     // A human task. A critical task (IEC 62366-1 / FDA HF guidance §3) is a
@@ -79,7 +80,13 @@ package memo_architecture_operational_activities {
     }
 
     connection def AssessesDifficulty :> MemoRelationship {
-        end assessment : TaskDifficultyAssessment;
-        end task : UserTask;
+        end assessment : TaskDifficultyAssessment :>> source;
+        end task : UserTask :>> target;
+    }
+    abstract connection assessesDifficultyLinks : AssessesDifficulty[*];
+    metadata def <assessesDifficulty> AssessesDifficultyMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = assessesDifficultyLinks meta SysML::Usage;
     }
 }

package/src/architecture/operational/context/actors/memo_actors.sysml

@@ -1,5 +1,5 @@
-// Actor hierarchy (§4). An Actor interacts with the system; it is distinct
-// from a Stakeholder (memo_architecture_operational_context_stakeholders), who has concerns about the
+// Operational participants (§4) interact with the system; they are distinct
+// from stakeholders (memo_architecture_operational_context_stakeholders), who have concerns about the
 // system but need not interact with it. "User" is reserved for a human who
 // interacts with the medical device.
 package memo_architecture_operational_context_actors {
@@ -7,8 +7,7 @@ package memo_architecture_operational_context_actors {
 
     private import memo_core_common::*;
     private import memo_core_enumerations::*;
-
-    abstract part def Actor specializes MemoPart {
+    abstract part def OperationalParticipant specializes MemoPart {
         attribute actorKind : ActorKind;
         attribute trainingLevel : String;
         attribute responsibility : String;
@@ -19,7 +18,7 @@ package memo_architecture_operational_context_actors {
     // The human actor. The specific role is given by actorKind
     // (patient / clinician / caregiver / technician / administrator); the
     // role-specific fields below are set only for the relevant actorKind.
-    part def User specializes Actor {
+    part def User specializes OperationalParticipant {
         attribute userPopulation : String;
         attribute impairmentConsiderations : String;
         attribute intendedTraining : String;
@@ -32,7 +31,5 @@ package memo_architecture_operational_context_actors {
 
     // A non-human actor (external system, external device, or environmental
     // agent). The specific kind is described by externalKind.
-    part def NonHumanActor specializes Actor {
-        attribute externalKind : String[0..1];
-    }
+
 }