@memoarchitect/ontology 0.7.0 → 0.8.24

package/src/architecture/logical/interfaces/memo_interfaces.sysml

@@ -44,12 +44,24 @@ package memo_architecture_logical_interfaces {
         attribute apiStyle : String;
     }
 
+    // Software interaction contracts specialize the native MEMO interface
+    // family. Concrete technologies add their protocol roles and message
+    // flows; ports remain the endpoints that components actually own.
+    abstract interface def SoftwareInterface specializes Interface {
+        // `default`, not `=`. A bare `=` in a definition BINDS the value, and
+        // a binding cannot be overridden by a usage — which asserted that
+        // every software interface is bidirectional and made a directional one
+        // inexpressible. A ROS topic publisher → subscriber is the obvious
+        // counterexample, and it is the common case rather than an exotic one.
+        attribute :>> direction default DirectionKind::inputOutput;
+    }
+
     // A typed thing exchanged at a boundary. Concrete items such as
     // AlarmSignal and FlowCommand specialize this type; they are neither
     // functions nor generic action-flow notation.
     // The kind of item is given by itemKind (data / command / signal / …);
     // the control-specific fields below apply only when itemKind = command.
-    item def InterfaceItem specializes MemoExchangeItem {
+    item def InterfaceItem specializes MemoItem {
         attribute itemKind : InterfaceItemKind;
         attribute confidentialityClass : String;
         attribute integrityClass : String;
@@ -73,16 +85,47 @@ package memo_architecture_logical_interfaces {
     port def SensorPort specializes DataPort { attribute sensorDomain : String; }
     port def CommandPort specializes DataPort { attribute commandDomain : String; }
 
-    part def ComponentExchange specializes ArchitectureElement {
+    part def ComponentExchange specializes MemoPart {
         attribute exchangeKind : FlowKind;
-        // Typed endpoints (CR-ONT-002). A component or a boundary port may
-        // terminate an exchange, so the ends are MemoPart-typed.
-        ref sourceEndpoint : MemoPart[0..1];
-        ref targetEndpoint : MemoPart[0..1];
-        // Descriptive port paths (e.g. "TLM.TLM_MODE_OUT") for AADL
-        // round-trips; labels only — never references.
-        attribute sourcePortPath : String;
-        attribute targetPortPath : String;
+        // Metaclass-neutral endpoints. CR-ONT-002 used to read: "Typed
+        // endpoints. A component or a boundary port may terminate an exchange,
+        // so the ends are MemoPart-typed." That reasoning was circular —
+        // PhysicalPort and SoftwarePort are part defs precisely SO THAT they
+        // could satisfy this typing, and the typing was justified by their
+        // being parts. Track A0 cut the circle at the ends, which is the side
+        // that has to move first: A1 turns those two into `port def`s, and a
+        // port cannot specialize a part-based type.
+        //
+        // The constraint the type was carrying — an endpoint is a component or
+        // a boundary port, never a requirement or a document — is now stated
+        // where it can be checked across metaclasses, as CR-ONT-072/073 in
+        // src/rules/ontology/ontology_invariants.sysml.
+        //
+        // `Base::Anything` rather than no type at all — the only place in this
+        // change that reaches for it. The 36 untyped ends in
+        // memo_core_relationships are `end` declarations, and an untyped `end`
+        // is established practice; an untyped `ref` with a multiplicity is not
+        // something MEMO's own grammar accepts (`Expecting token of type ';'
+        // but found '['`), and the grammar is not in this session's scope.
+        // `Base::Anything` is what the standard's `Allocations::Allocation`
+        // types its own ends with, so it is the conforming spelling of "any
+        // element", not a workaround.
+        ref sourceEndpoint : Base::Anything[0..1];
+        ref targetEndpoint : Base::Anything[0..1];
+        // `sourcePortPath` / `targetPortPath` are GONE. They were String
+        // "descriptive port paths (e.g. TLM.TLM_MODE_OUT) for AADL round-trips;
+        // labels only — never references", which is §13.3's string
+        // pseudo-reference: nothing can follow a string to an element, so
+        // anything built on them produced no traceability.
+        //
+        // Measured across the 92 sites in the GPCA example before removing
+        // them: 23 merely restated the endpoint the ref already named (15 gave
+        // the port's own display name, 8 were prose like "HW-001:
+        // GPCA_HW_Sensors"), and the other 69 named a port ON the endpoint
+        // component, resolving to 49 distinct AADL features. Those 49 are
+        // declared as real ports now and the endpoint refs point straight at
+        // them, which is what Track A1 making SoftwarePort a `port def` is for.
+        // The AADL round-trip is better served by an element than by its name.
         ref allocatedExchanges : FunctionalExchange[0..*];
         attribute direction : DirectionKind;
         // Connection timing discipline from the source architecture
@@ -93,9 +136,18 @@ package memo_architecture_logical_interfaces {
     // Boundary data port of a software system (e.g. an AADL top-level
     // data port), modeled as a first-class element so exchanges can
     // reference it and views can render the system boundary.
-    part def SoftwarePort specializes InterfaceElement {
+    //
+    // A `port def` (Track A1) — see PhysicalPort in
+    // memo_architecture_realization_physical for why the specialization moved
+    // off InterfaceElement, why `direction` is native now (Track A2), and why
+    // `portKind` is duplicated on both ports instead of hoisted onto a base.
+    port def SoftwarePort specializes MemoPort {
         attribute portKind : InterfaceKind;
-        attribute direction : DirectionKind;
+        // AADL port category (plan C2). Sampled vs. queued delivery decides
+        // whether a missed deadline drops a sample or grows a queue, which the
+        // timing analysis and the safety case both need and neither could ask
+        // the model for. `portKind` says what crosses; this says how.
+        attribute portCategory : PortCategoryKind;
         attribute dataTypeName : String;
     }
 }

package/src/architecture/logical/structure/memo_logical_structure.sysml

@@ -4,6 +4,7 @@
 // plus independence constraints — never by duplicating identically named
 // components.
 package memo_architecture_logical_structure {
+    private import Metaobjects::SemanticMetadata;
     private import ScalarValues::*;
 
     private import memo_core_common::*;
@@ -115,7 +116,7 @@ package memo_architecture_logical_structure {
     // optional so a component carries only the ones its role needs. A channel
     // claiming independence must still be linked by IndependentOf with its
     // basis stated.
-    part def LogicalComponent specializes ArchitectureElement {
+    part def LogicalComponent specializes MemoPart {
         attribute componentRole : ComponentRoleKind;
         attribute systemType : SystemTypeKind[0..1];
         attribute responsibility : String;
@@ -144,7 +145,7 @@ package memo_architecture_logical_structure {
         end providerPort : LogicalPort;
         end consumerPort : ~LogicalPort;
     }
-    item def LogicalExchangeItem specializes MemoExchangeItem {
+    item def LogicalExchangeItem specializes MemoItem {
         attribute contentKind : FlowContentKind;
     }
 
@@ -152,11 +153,17 @@ package memo_architecture_logical_structure {
     connection def LogicalConnector :> MemoRelationship {
         attribute contentKind : FlowContentKind;
         attribute direction : DirectionKind;
-        end sourceComponent : LogicalComponent;
-        end targetComponent : LogicalComponent;
+        end sourceComponent : LogicalComponent :>> source;
+        end targetComponent : LogicalComponent :>> target;
+    }
+    abstract connection logicalConnectorLinks : LogicalConnector[*];
+    metadata def <logicalConnector> LogicalConnectorMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = logicalConnectorLinks meta SysML::Usage;
     }
     // A transfer of a typed item across a connector.
-    part def LogicalExchange specializes ArchitectureElement {
+    part def LogicalExchange specializes MemoPart {
         attribute contentKind : FlowContentKind;
         attribute direction : DirectionKind;
         attribute latencyRequirement : String;
@@ -167,40 +174,34 @@ package memo_architecture_logical_structure {
 
     // States and modes of the logical solution (kept distinct from UI state
     // and from physical device configuration).
-    part def LogicalState specializes ArchitectureElement {
-        attribute stateInvariant : String;
-    }
-    part def LogicalMode specializes ArchitectureElement {
-        attribute modePurpose : String;
-        attribute entryCondition : String;
-        attribute exitCondition : String;
-    }
-    part def LogicalBehavior specializes ArchitectureElement {
+
+    part def LogicalBehavior specializes MemoPart {
         attribute behaviorSummary : String;
         attribute executionSemantics : String;
     }
 
     // Isolation, fault containment, and trust boundaries (§10).
-    part def IsolationBoundary specializes ArchitectureElement {
+    part def IsolationBoundary specializes MemoPart {
         attribute boundaryKind : String;
         attribute isolationMechanism : String;
     }
-    part def FaultContainmentRegion specializes ArchitectureElement {
+    part def FaultContainmentRegion specializes MemoPart {
         attribute containmentRationale : String;
     }
 
     // Claimed independence between channels (common-cause defense).
     connection def IndependentOf :> MemoRelationship {
         attribute independenceBasis : String;
-        end channel : LogicalComponent;
-        end otherChannel : LogicalComponent;
-    }
-    connection def MonitorsChannel :> MemoRelationship {
-        end monitorChannel : LogicalComponent;
-        end monitoredComponent : LogicalComponent;
+        end channel : LogicalComponent :>> source;
+        end otherChannel : LogicalComponent :>> target;
     }
-    connection def ExhibitsMode :> MemoRelationship {
-        end component : LogicalComponent;
-        end mode : LogicalMode;
+    abstract connection independentOfLinks : IndependentOf[*];
+    metadata def <independentOf> IndependentOfMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = independentOfLinks meta SysML::Usage;
     }
+    // `MonitorsChannel` is native `dependency` (R10-S6): write
+    // `dependency <monitorChannel> to <monitoredComponent>;` instead.
+
 }

package/src/architecture/operational/activities/memo_activities.sysml

@@ -1,12 +1,13 @@
-// Operational activities and user tasks (§7, §17). Activities are behavioral
-// concepts (action defs on MemoAction). An OperationalActivity is work
-// performed in the operational world; a UserTask is a unit of user work within
-// an activity (IEC 62366-1); a critical task is a UserTask whose criticality is
-// high/catastrophic — its failure could cause serious harm (FDA HF guidance) and
-// it must trace to usability validation.
-// Task difficulty belongs to a task performed in a context — never to an
-// instrument (TaskDifficultyAssessment).
+// Operational actions (§7, §17). One `OperativeAction` (action def on
+// MemoAction) is a unit of operational work; whether a User or the system
+// performs it is a native `perform` relationship, not a subtype.
+// A critical task is an OperativeAction with high/catastrophic criticality that
+// a User performs — its failure could cause serious harm (IEC 62366-1 / FDA HF
+// guidance) and it must trace to usability validation. Task difficulty belongs
+// to an action performed in a context (TaskDifficultyAssessment), never to an
+// instrument.
 package memo_architecture_operational_activities {
+    private import Metaobjects::SemanticMetadata;
     private import ScalarValues::*;
 
     private import memo_core_common::*;
@@ -23,33 +24,25 @@ package memo_architecture_operational_activities {
         enum extreme;
     }
 
-    action def OperationalActivity specializes MemoAction {
+    // One operational action / step. Who performs it — a human actor or the
+    // system — is a relationship (native `perform`), not a subtype, so an
+    // action can migrate from user- to system-performed (automation, as-is →
+    // to-be) without changing type. This one type merges the former
+    // OperationalActivity, UserTask, SystemAction and TaskStep: a "user task"
+    // is simply an OperativeAction a User performs; finer steps are nested
+    // OperativeActions. Human-factors fields (potentialHarm, severityIfFailed,
+    // perceptualCue …) are optional, meaningful when a User is the performer.
+    action def OperativeAction specializes MemoAction {
         attribute trigger : String;
         attribute preCondition : String;
         attribute postCondition : String;
         attribute criticality : CriticalityKind;
-        ref performedBy : Actor[0..*];
-    }
-
-    // A human task. A critical task (IEC 62366-1 / FDA HF guidance §3) is a
-    // UserTask whose criticality is high or catastrophic — a use error could
-    // cause serious harm. potentialHarm/severityIfFailed are set only for such
-    // tasks. Modeled as an attribute, like SystemFunction.criticality.
-    action def UserTask specializes MemoAction {
         attribute taskGoal : String;
-        attribute preCondition : String;
-        attribute postCondition : String;
         attribute expectedDuration : String;
         attribute frequencyOfUse : String;
-        attribute criticality : CriticalityKind;
         attribute potentialHarm : String[0..1];
         attribute severityIfFailed : SeverityKind[0..1];
-        ref performingUser : User[0..1];
-    }
-
-    // An elementary perceptual/cognitive/motor step within a user task
-    // (task analysis granularity: grasp needle, drive needle, tie knot …).
-    action def TaskStep specializes MemoAction {
+        attribute automated : Boolean;
         attribute perceptualCue : String;
         attribute feedbackExpected : String;
     }
@@ -71,7 +64,6 @@ package memo_architecture_operational_activities {
         attribute assessor : String;
         attribute assessmentMethod : String;
 
-        ref assessedTask : UserTask[0..1];
         ref userPopulation : User[0..1];
         ref useEnvironment : UseEnvironment[0..1];
         ref instrument : MemoPart[0..1];
@@ -79,7 +71,13 @@ package memo_architecture_operational_activities {
     }
 
     connection def AssessesDifficulty :> MemoRelationship {
-        end assessment : TaskDifficultyAssessment;
-        end task : UserTask;
+        end assessment : TaskDifficultyAssessment :>> source;
+        end task : OperativeAction :>> target;
+    }
+    abstract connection assessesDifficultyLinks : AssessesDifficulty[*];
+    metadata def <assessesDifficulty> AssessesDifficultyMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = assessesDifficultyLinks meta SysML::Usage;
     }
 }

package/src/architecture/operational/context/actors/memo_actors.sysml

@@ -1,14 +1,14 @@
-// Actor hierarchy (§4). An Actor interacts with the system; it is distinct
-// from a Stakeholder (memo_architecture_operational_context_stakeholders), who has concerns about the
-// system but need not interact with it. "User" is reserved for a human who
-// interacts with the medical device.
+// Operational participants (§4) interact with the system. A stakeholder —
+// someone with a concern about the system who need not interact with it — is
+// a native SysML notion (a Part in a stakeholder membership on a concern or
+// viewpoint), not a separate MEMO type; the same Part may fill both roles.
+// "User" is reserved for a human who interacts with the medical device.
 package memo_architecture_operational_context_actors {
     private import ScalarValues::*;
 
     private import memo_core_common::*;
     private import memo_core_enumerations::*;
-
-    abstract part def Actor specializes MemoPart {
+    abstract part def OperationalParticipant specializes MemoPart {
         attribute actorKind : ActorKind;
         attribute trainingLevel : String;
         attribute responsibility : String;
@@ -19,7 +19,7 @@ package memo_architecture_operational_context_actors {
     // The human actor. The specific role is given by actorKind
     // (patient / clinician / caregiver / technician / administrator); the
     // role-specific fields below are set only for the relevant actorKind.
-    part def User specializes Actor {
+    part def User specializes OperationalParticipant {
         attribute userPopulation : String;
         attribute impairmentConsiderations : String;
         attribute intendedTraining : String;
@@ -32,7 +32,5 @@ package memo_architecture_operational_context_actors {
 
     // A non-human actor (external system, external device, or environmental
     // agent). The specific kind is described by externalKind.
-    part def NonHumanActor specializes Actor {
-        attribute externalKind : String[0..1];
-    }
+
 }

package/src/architecture/operational/context/stakeholders/memo_stakeholders.sysml

@@ -1,28 +1,18 @@
-// ISO/IEC/IEEE 42010 architecture-description core (§4). A Stakeholder has
-// interests (Concerns) in the system; a Viewpoint frames concerns; a View
-// (memo_viewpoints_definitions::MemoView) is governed by a viewpoint within an
-// ArchitectureDescription. The same real-world entity may play both the
-// Stakeholder and the Actor role — expressed by ActsAsActor, never by merging
-// the types.
+// ISO/IEC/IEEE 42010 architecture-description core (§4): ArchitectureDescription,
+// ModelKind, and CorrespondenceRule below. Stakeholders and concerns — 42010's
+// other cornerstones — are native SysML v2 constructs (stakeholder memberships
+// and `concern def`), used directly rather than reinvented as MEMO types. A
+// View (memo_viewpoints_definitions::MemoView) conforms to a Viewpoint within
+// an ArchitectureDescription.
 package memo_architecture_operational_context_stakeholders {
+    private import Metaobjects::SemanticMetadata;
     private import ScalarValues::*;
 
     private import memo_core_common::*;
     private import memo_core_enumerations::*;
     private import memo_core_relationships::*;
     private import memo_architecture_operational_context_actors::*;
-
-    part def Stakeholder specializes MemoPart {
-        attribute stakeholderCategory : String;
-        attribute influence : String;
-    }
-
-    part def Concern specializes MemoPart {
-        attribute concernKind : ConcernKind;
-        attribute question : String;
-    }
-
-    part def ArchitectureDescription specializes DocumentedElement {
+    part def ArchitectureDescription specializes MemoPart {
         attribute systemOfInterest : String;
         attribute version : String;
     }
@@ -38,19 +28,6 @@ package memo_architecture_operational_context_stakeholders {
         attribute ruleExpression : String;
     }
 
-    connection def HasConcern :> MemoRelationship {
-        end interestedStakeholder : Stakeholder;
-        end stakeholderConcern : Concern;
-    }
-    connection def FramesConcern :> MemoRelationship {
-        end framingViewpoint : MemoPart;
-        end framedConcern : Concern;
-    }
-    // Links the stakeholder to the actor role the same entity plays, if any.
-    connection def ActsAsActor :> MemoRelationship {
-        end interestedStakeholder : Stakeholder;
-        end actorRole : Actor;
-    }
     // Governs unifies GovernsCorrespondence / GovernsUse, keyed by governKind.
     enum def GovernKind {
         enum correspondence;
@@ -58,7 +35,13 @@ package memo_architecture_operational_context_stakeholders {
     }
     connection def Governs :> MemoRelationship {
         attribute governKind : GovernKind;
-        end governor : MemoPart;
-        end governedElement : MemoPart;
+        end governor : MemoPart :>> source;
+        end governedElement : MemoPart :>> target;
+    }
+    abstract connection governsLinks : Governs[*];
+    metadata def <governs> GovernsMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = governsLinks meta SysML::Usage;
     }
 }

package/src/architecture/operational/context/use_context/memo_use_context.sysml

@@ -1,7 +1,16 @@
 // Operational use context (IEC 62366-1 use specification). Intended use and
 // reasonably foreseeable misuse are assurance requirements/risk inputs and
 // live in memo_assurance_requirements.
+//
+// This package once defined `ExchangesWith` for directional context-level data
+// flow between boundary entities. It is deleted: SysML v2's own `flow` covers
+// every case and is strictly stronger, because `of <ItemDef>` says WHAT moves
+// and two untyped connection ends cannot. Delegation between a boundary port
+// and the interior it stands for is `bind` — identity, not transport. SysML v2
+// keeps the two apart the same way: training ch. 13 wires components with
+// `flow`, ch. 12 delegates across a boundary with `bind`.
 package memo_architecture_operational_context_use_context {
+    private import Metaobjects::SemanticMetadata;
     private import ScalarValues::*;
 
     private import memo_core_common::*;
@@ -14,7 +23,6 @@ package memo_architecture_operational_context_use_context {
         attribute environment : String;
         attribute jurisdiction : String;
         attribute connectedUse : Boolean;
-        attribute intendedUseReference : String;
     }
 
     // The physical/organizational environment of use (IEC 62366-1 3.20),
@@ -47,32 +55,49 @@ package memo_architecture_operational_context_use_context {
         attribute contextSide : ContextSideKind;
         // The verb, as it should read on the edge ("Directs procedure").
         attribute interactionLabel : String[0..1];
-        end contextParticipant : MemoPart;
+        end contextParticipant : MemoPart :>> source;
         // Untyped: the system of interest may be a part or an operational activity.
-        end systemOfInterest;
+        end systemOfInterest :>> target;
+    }
+    abstract connection interactsInContextLinks : InteractsInContext[*];
+    metadata def <interactsInContext> InteractsInContextMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = interactsInContextLinks meta SysML::Usage;
     }
 
     connection def InteractsWith :> MemoRelationship {
-        end contextParticipant : Actor;
+        end contextParticipant : OperationalParticipant :>> source;
         // Untyped so operational activities (action def) can be targets as well as parts.
         end target;
     }
-    // Directional context-level data flow between boundary entities.
-    connection def ExchangesWith :> MemoRelationship {
-        end source : MemoPart;
-        end target : MemoPart;
-    }
-    // Physical connection between boundary entities (fluid path, mounting).
-    connection def ConnectsPhysically :> MemoRelationship {
-        end source : MemoPart;
-        end target : MemoPart;
+    abstract connection interactsWithLinks : InteractsWith[*];
+    metadata def <interactsWith> InteractsWithMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = interactsWithLinks meta SysML::Usage;
     }
+    // `ConnectsPhysically` is native `connect` (R10-S6): write
+    // `connection connect source ::> <a> to target ::> <b>;` — the ordinary
+    // untyped binary connection — instead of a connection def for it.
     connection def AppliesInContext :> MemoRelationship {
-        end useContext : UseContext;
-        end subjectElement : MemoPart;
+        end useContext : UseContext :>> source;
+        end subjectElement : MemoPart :>> target;
+    }
+    abstract connection appliesInContextLinks : AppliesInContext[*];
+    metadata def <appliesInContext> AppliesInContextMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = appliesInContextLinks meta SysML::Usage;
     }
     connection def SituatedIn :> MemoRelationship {
-        end useContext : UseContext;
-        end environment : UseEnvironment;
+        end useContext : UseContext :>> source;
+        end environment : UseEnvironment :>> target;
+    }
+    abstract connection situatedInLinks : SituatedIn[*];
+    metadata def <situatedIn> SituatedInMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = situatedInLinks meta SysML::Usage;
     }
 }

package/src/architecture/operational/scenarios/memo_scenarios.sysml

@@ -1,10 +1,10 @@
 // Scenario foundation. A scenario is a selected path through a
-// workflow (or functional flow), classified by three independent typed
-// dimensions — variant, operational condition, purpose — replacing the former
-// single ScenarioKind. An occurrence is an actual or hypothetical execution
+// workflow (or functional flow), classified by its kind plus three independent
+// dimensions — variant, operational condition, and purpose. An occurrence is an actual or hypothetical execution
 // of a scenario. Alternate scenarios reference their base scenario and
 // variation point instead of duplicating the workflow.
 package memo_architecture_operational_scenarios {
+    private import Metaobjects::SemanticMetadata;
     private import ScalarValues::*;
 
     private import memo_core_common::*;
@@ -16,45 +16,15 @@ package memo_architecture_operational_scenarios {
     private import memo_architecture_operational_workflows::*;
     private import memo_architecture_operational_use_cases::*;
 
-    enum def ScenarioVariantKind {
+    // A scenario is a nominal path or an alternate (exception/recovery) path.
+    // Defaults to nominal.
+    enum def ScenarioKind {
         enum nominal;
         enum alternate;
-        enum exception;
-        enum recovery;
     }
 
-    enum def OperationalConditionKind {
-        enum normal;
-        enum degraded;
-        enum emergency;
-        enum maintenance;
-        enum startup;
-        enum shutdown;
-        enum timeout;
-        enum misuse;
-        enum foreseeableMisuse;
-    }
-
-    // `memoAnalysis` and `memoVerification` keep the regulated terms `analysis`
-    // and `verification` intact but prefixed, because both are SysML v2 reserved
-    // words and cannot be bare enum names. `validation` is not reserved.
-    enum def ScenarioPurposeKind {
-        enum memoAnalysis;
-        enum design;
-        enum memoVerification;
-        enum validation;
-        enum risk;
-        enum cybersecurity;
-    }
-
-    // Shared scenario foundation. Specializations exist only where structure
-    // or invariants differ (OperativeScenario here; FunctionalScenario in
-    // memo_functions; UIScenario in memo_architecture_implementation_ui;
-    // VerificationScenario / ThreatScenario in assurance packages).
-    abstract action def MemoScenario specializes MemoAction {
-        attribute variantKind : ScenarioVariantKind;
-        attribute operationalCondition : OperationalConditionKind;
-        attribute scenarioPurpose : ScenarioPurposeKind[0..*];
+    action def OperativeScenario specializes MemoAction {
+        attribute scenarioKind : ScenarioKind default ScenarioKind::nominal;
         attribute initialState : String;
         attribute trigger : String;
         attribute preCondition : String;
@@ -62,55 +32,37 @@ package memo_architecture_operational_scenarios {
         attribute postCondition : String;
         attribute pathSummary : String;
 
-        ref involvedActors : Actor[0..*];
+        // The workflow this scenario belongs to is expressed by the workflow
+        // (HasScenario); a nominal/alternate pair are scenarios of the same
+        // workflow, distinguished by scenarioKind — no baseScenario back-ref.
+        // Actors are derived from `perform` on the nested steps, not listed.
         ref useContext : UseContext[0..1];
-        // Alternate/exception/recovery scenarios reference their base and the
-        // point at which behavior diverges — never a copied workflow.
-        ref baseScenario : MemoScenario[0..1];
-        attribute variationPoint : String;
+        // threat scenario
+        attribute actorDescription : String;
+        attribute assumptionSummary : String;
+        attribute guaranteeSummary : String;
+        attribute securityObjective : String;
+        attribute abuseCaseReference : String;
+        attribute defaultCategory : ThreatCategoryKind[0..1];
+        // verification scenario
+        attribute verificationEnvironment : String;
+        attribute stimulusSummary : String;
+        // hazard-related use scenario (IEC 62366-1 3.9)
+        attribute hazardReference : String;
+        attribute selectionRationale : String;
     }
 
-    // The operational-layer scenario: a path through an OperationalWorkflow in
-    // a use context. It is realized down the V by a FunctionalScenario (the
-    // function sequence) and a UIScenario (the interaction sequence), each owned
-    // by its own architecture layer and linked by typed realization
-    // relationships — never by copying the path. Workflow stays operational;
-    // only the scenario is layered.
-    action def OperativeScenario specializes MemoScenario {
-        ref parentWorkflow : OperationalWorkflow[0..1];
-        ref parentUseCase : UseCase[0..1];
-        // Each scenario owns the operational activity/action flow for its
-        // selected path. Do not reuse one generic activity for every scenario.
-        ref activities : OperationalActivity[0..*];
-    }
-
-    // An actual or hypothetical execution of a scenario (usability test run,
-    // postmarket incident reconstruction, simulated-use session).
-    part def ScenarioOccurrence specializes MemoPart {
-        attribute occurredAt : String;
-        attribute hypothetical : Boolean;
-        attribute outcomeSummary : String;
-        ref executedScenario : MemoScenario[1];
-    }
-
-    // Ordered selection of a workflow step into a scenario path.
-    // Selects unifies SelectsStep / SelectsFlow (a scenario selects its path
-    // element), keyed by selectsKind.
-    enum def SelectsKind {
-        enum step;
-        enum 'flow';
-    }
-    connection def Selects :> MemoRelationship {
-        attribute selectsKind : SelectsKind;
-        attribute pathOrder : Integer[0..1];
-        attribute decisionTaken : String[0..1];
-        end scenario : MemoScenario;
-        // A selected path element may be a WorkflowStep action or a flow
-        // element. Those constructs do not share a MEMO base metaclass.
-        end selected;
+    // A workflow is composed of one or more scenarios (nominal + alternate
+    // paths). ScenarioOccurrence/Executes were removed: an actual execution is
+    // a native SysML *usage* of the scenario, not a separate def + relation.
+    connection def HasScenario :> MemoRelationship {
+        end owningWorkflow : OperationalWorkflow :>> source;
+        end pathScenario : OperativeScenario :>> target;
     }
-    connection def OccursDuring :> MemoRelationship {
-        end occurrence : ScenarioOccurrence;
-        end context : UseContext;
+    abstract connection hasScenarioLinks : HasScenario[*];
+    metadata def <hasScenario> HasScenarioMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = hasScenarioLinks meta SysML::Usage;
     }
 }