HuiJun · Oct 10, 2026 · Oct 2, 2026 · Oct 2, 2026 · Oct 2, 2026 · Oct 2, 2026
diff --git a/.circleci/config.yml b/.circleci/config.yml
@@ -17,7 +17,7 @@ executors:
       # It carries Node LTS, 24 or later, which the gate needs.
       - image: cimg/go:1.25-node
     resource_class: medium
-  
+
   python-executor:
     docker:
       - image: cimg/python:3.11
@@ -1047,7 +1047,7 @@ jobs:
     executor: python-executor
     steps:
       - checkout
-      
+
       - attach_workspace:
           at: .
 
@@ -1070,7 +1070,7 @@ jobs:
             mkdir -p ~/.opensysml/bin
             cp bin/sysml-grpc ~/.opensysml/bin/
             chmod +x ~/.opensysml/bin/sysml-grpc
-      
+
       - run:
           name: Install Python client
           command: |
@@ -1083,7 +1083,7 @@ jobs:
             # its wheels with python -m build.
             pip install --only-binary :all: jupyter_client==8.10.0 build==1.6.1
             make jupyter-kernel-install
-      
+
       # The integration tests connect to a service on the standard port with
       # auto_start=False, which is the explicit opt-in to one the client does not
       # manage; without it they skip, exercising nothing, so one runs here for
@@ -2251,66 +2251,66 @@ jobs:
       - go/load-cache
       - go/mod-download
       - go/save-cache
-      
+
       - run:
           name: Build release binaries
           command: |
             VERSION=${CIRCLE_TAG}
             COMMIT=${CIRCLE_SHA1}
             BUILD_TIME=$(date -u '+%Y-%m-%d_%H:%M:%S')
             GO_VERSION=$(go version | awk '{print $3}')
-            
+
             # Build for multiple platforms using make
             mkdir -p dist
-            
+
             GOOS=linux GOARCH=amd64 make build-sysml VERSION="$VERSION" COMMIT="$COMMIT" BUILD_TIME="$BUILD_TIME" GO_VERSION="$GO_VERSION"
             mv bin/sysml dist/sysml-linux-amd64
-            
+
             GOOS=linux GOARCH=arm64 make build-sysml VERSION="$VERSION" COMMIT="$COMMIT" BUILD_TIME="$BUILD_TIME" GO_VERSION="$GO_VERSION"
             mv bin/sysml dist/sysml-linux-arm64
-            
+
             GOOS=darwin GOARCH=amd64 make build-sysml VERSION="$VERSION" COMMIT="$COMMIT" BUILD_TIME="$BUILD_TIME" GO_VERSION="$GO_VERSION"
             mv bin/sysml dist/sysml-darwin-amd64
-            
+
             GOOS=darwin GOARCH=arm64 make build-sysml VERSION="$VERSION" COMMIT="$COMMIT" BUILD_TIME="$BUILD_TIME" GO_VERSION="$GO_VERSION"
             mv bin/sysml dist/sysml-darwin-arm64
-            
+
             GOOS=windows GOARCH=amd64 make build-sysml VERSION="$VERSION" COMMIT="$COMMIT" BUILD_TIME="$BUILD_TIME" GO_VERSION="$GO_VERSION"
             mv bin/sysml dist/sysml-windows-amd64.exe
-            
+
             GOOS=linux GOARCH=amd64 make build-lsp VERSION="$VERSION" COMMIT="$COMMIT" BUILD_TIME="$BUILD_TIME" GO_VERSION="$GO_VERSION"
             mv bin/sysml-lsp dist/sysml-lsp-linux-amd64
-            
+
             GOOS=linux GOARCH=arm64 make build-lsp VERSION="$VERSION" COMMIT="$COMMIT" BUILD_TIME="$BUILD_TIME" GO_VERSION="$GO_VERSION"
             mv bin/sysml-lsp dist/sysml-lsp-linux-arm64
-            
+
             GOOS=darwin GOARCH=amd64 make build-lsp VERSION="$VERSION" COMMIT="$COMMIT" BUILD_TIME="$BUILD_TIME" GO_VERSION="$GO_VERSION"
             mv bin/sysml-lsp dist/sysml-lsp-darwin-amd64
-            
+
             GOOS=darwin GOARCH=arm64 make build-lsp VERSION="$VERSION" COMMIT="$COMMIT" BUILD_TIME="$BUILD_TIME" GO_VERSION="$GO_VERSION"
             mv bin/sysml-lsp dist/sysml-lsp-darwin-arm64
-            
+
             GOOS=windows GOARCH=amd64 make build-lsp VERSION="$VERSION" COMMIT="$COMMIT" BUILD_TIME="$BUILD_TIME" GO_VERSION="$GO_VERSION"
             mv bin/sysml-lsp dist/sysml-lsp-windows-amd64.exe
-            
+
             # The gRPC service backs the Python client, which downloads one
             # file per platform and verifies it against a .sha256 sidecar, so
             # these are published raw rather than archived. They are built into
             # a subdirectory to keep them out of the archive globs below.
             mkdir -p dist/grpc
-            
+
             GOOS=linux GOARCH=amd64 make build-grpc VERSION="$VERSION" COMMIT="$COMMIT" BUILD_TIME="$BUILD_TIME" GO_VERSION="$GO_VERSION"
             mv bin/sysml-grpc dist/grpc/sysml-grpc-linux-amd64
-            
+
             GOOS=linux GOARCH=arm64 make build-grpc VERSION="$VERSION" COMMIT="$COMMIT" BUILD_TIME="$BUILD_TIME" GO_VERSION="$GO_VERSION"
             mv bin/sysml-grpc dist/grpc/sysml-grpc-linux-arm64
-            
+
             GOOS=darwin GOARCH=amd64 make build-grpc VERSION="$VERSION" COMMIT="$COMMIT" BUILD_TIME="$BUILD_TIME" GO_VERSION="$GO_VERSION"
             mv bin/sysml-grpc dist/grpc/sysml-grpc-darwin-amd64
-            
+
             GOOS=darwin GOARCH=arm64 make build-grpc VERSION="$VERSION" COMMIT="$COMMIT" BUILD_TIME="$BUILD_TIME" GO_VERSION="$GO_VERSION"
             mv bin/sysml-grpc dist/grpc/sysml-grpc-darwin-arm64
-            
+
             GOOS=windows GOARCH=amd64 make build-grpc VERSION="$VERSION" COMMIT="$COMMIT" BUILD_TIME="$BUILD_TIME" GO_VERSION="$GO_VERSION"
             mv bin/sysml-grpc dist/grpc/sysml-grpc-windows-amd64.exe
 
@@ -2345,7 +2345,7 @@ jobs:
             mkdir -p dist/wasm
             make build-release-wasm VERSION="$VERSION" COMMIT="$COMMIT" BUILD_TIME="$BUILD_TIME" GO_VERSION="$GO_VERSION"
             mv bin/wasm/release/sysml-wasm.wasm bin/wasm/release/wasm_exec.js dist/wasm/
-            
+
             # Create tarballs
             cd dist
             for binary in sysml-*; do
@@ -2355,7 +2355,7 @@ jobs:
                 tar czf "${binary}.tar.gz" "$binary"
               fi
             done
-            
+
             # Bundle archives: both binaries under their plain names
             # (sysml, sysml-lsp), which is the layout a Homebrew formula or a
             # PATH install expects, with their manual pages beside them under
@@ -2376,7 +2376,7 @@ jobs:
             cp sysml-lsp-windows-amd64.exe stage/windows-amd64/sysml-lsp.exe
             (cd stage/windows-amd64 && zip -q ../../opensysml-windows-amd64.zip sysml.exe sysml-lsp.exe)
             rm -rf stage
-            
+
             # The checksum manifest and the per-file sidecars are
             # build-release's, once the Python distributions exist to list.
             ls -l . grpc jupyter
@@ -2457,17 +2457,17 @@ jobs:
           name: Assemble the release and write its checksum manifest
           command: |
             cd dist
-            
+
             # The opensysml wheel and sdist, released with the binaries they drive,
             # and the jupyter-opensysml-kernel platform wheels and sdist likewise.
             cp ../client/python/dist/opensysml-*.whl ../client/python/dist/opensysml-*.tar.gz .
             cp ../client/jupyter-kernel/dist/jupyter_opensysml_kernel-*.whl \
                ../client/jupyter-kernel/dist/jupyter_opensysml_kernel-*.tar.gz .
-            
+
             # Checksums over every published archive, so a Homebrew formula
             # (or a careful user) can verify a download.
             sha256sum ./*.tar.gz ./*.zip ./*.whl | sed 's|\./||' > SHA256SUMS.txt
-            
+
             # Same for the raw gRPC binaries, through the per-file sidecars
             # written beside them when they were built, the only checksum
             # opensysml reads: checked against the bytes here, then folded in.
@@ -2623,7 +2623,7 @@ jobs:
                        <(jq -r '.dsseEnvelope.payload' provenance.intoto.json.bundle | base64 -d \
                          | jq -r '.subject[] | "\(.name) \(.digest.sha256)"' | sort)
 
-      
+
       - rehearsal-skip:
           what: "cosign keyless signing and attestation (they write to the public Rekor log)"
       - run:
@@ -3301,7 +3301,7 @@ jobs:
             - rehearsal-tag
       - attach_workspace:
           at: .
-      
+
       - unless:
           condition: << pipeline.parameters.release_rehearsal >>
           steps:
@@ -3315,7 +3315,7 @@ jobs:
                   fi
                   echo "Publishing release $VERSION"
                   ls -la dist/
-            
+
                   # Move only tarballs to a release directory
                   mkdir -p dist/release
                   mv dist/*.tar.gz dist/*.zip dist/release/ 2>/dev/null || true
@@ -3333,14 +3333,14 @@ jobs:
                   mv dist/provenance.intoto.json dist/provenance.intoto.json.bundle dist/release/
                   echo "Release artifacts:"
                   ls -la dist/release/
-            
+
                   # Try different token variable names
                   TOKEN="${GITHUB_TOKEN:-${GH_TOKEN:-${CIRCLE_TOKEN}}}"
                   if [ -z "$TOKEN" ]; then
                     echo "Error: No GitHub token found. Tried GITHUB_TOKEN, GH_TOKEN, CIRCLE_TOKEN"
                     exit 1
                   fi
-            
+
                   # '-replace' reuses an existing release and only re-uploads assets of
                   # the same name, so hand-written notes, title and prerelease/latest
                   # flags survive a re-run. Never '-delete': that is an alias of

diff --git a/changes/unreleased/case-step-order.fixed.md b/changes/unreleased/case-step-order.fixed.md
@@ -3,4 +3,5 @@
   interleaving of them instead of only declaration order, so a case such as
   `action s1 { assign x := x * 10; } action s2 { assign x := x + 2; }` reports both `12` and `30`.
   `declared` and the default `reverse` schedule still perform the steps in declaration order, so
-  default results do not change.
+  default results do not change. A case inherited as an action step keeps its case-body lowering and
+  declaring scope.
diff --git a/changes/unreleased/inherited-action-steps.fixed.md b/changes/unreleased/inherited-action-steps.fixed.md
@@ -0,0 +1,6 @@
+- **An action definition that specializes another now performs the inherited steps, successions, flows and statements.** Previously `action def P :> B` silently ran only its own members, so `action def Plain :> Base;` completed with no results and `action def Extra :> Base { action b { ... } }` ran `b` but not `Base::a`. Inherited content is lowered into the specialization's flow (nearest general first, a diamond's shared general once), a step redefined by name replaces the inherited one and inherited successions retarget to it, and cyclic specialization, a redefinition naming a missing step, an incompatible replacement and an ambiguous retarget are reported as errors, and a specialization's own flows may connect inherited steps.
+- **A specialization preserves gates on inherited succession flows.** A guarded succession targeting an inherited succession flow retains its guard and delivery, so the specialized action follows the same guarded path as its general.
+- **A redefining action step with no multiplicity of its own now repeats as often as the step it redefines.** `action :>> a { … }` over `action a[3]` performs three times (it performed once), and `run`, `explore`, `check`, `validate` and the SMT refusal all use the same effective count; a redefining step also keeps the redefined step's body alongside its own.
+- **An inherited assertion stays unchecked unless a succession or flow connection in its declaring body or elsewhere in the specializing action's inheritance chain names it.** A specialization therefore carries an assertion ordered by an intermediate general while leaving an unsequenced assertion unchecked.
+- **A typed action usage, entry/do/exit behavior or performed action that states a body of its own now merges that body with the typed or performed action.** Its own members run alongside the action's inherited content as one flow, unordered unless a succession orders them, and its redefinitions replace inherited steps; an entry/do/exit behavior doing this is no longer reported at execution. A body that only binds pins still performs the action as before. An executable typed body nested in its own type, directly or through inheritance, is refused at execution rather than recursively unfolded; feature-only self-typed bodies remain lazy.
+- **A specialization's body binding on an inherited action node now overrides the inherited binding of that pin.**
diff --git a/changes/unreleased/terminate-usage-body-flow.fixed.md b/changes/unreleased/terminate-usage-body-flow.fixed.md
@@ -1 +1 @@
-- **A terminate action usage's body may state a flow.** `action stop terminate { assign code := 42; then terminate; then assign other := 7; }` now runs its `then` chain, where it was refused as stating no flow of its own. The terminate the usage stands for is unordered against its body's statements: `explore` and `-engine check` reach it falling before, between or after them, an output pin left unwritten binding no value, while `reverse` and `declared` still perform it after the body. A `terminate` naming the usage inside its own body ends the usage's performance rather than the body's.
+- **A terminate action usage's body may state a flow.** `action stop terminate { assign code := 42; then terminate; then assign other := 7; }` now runs its `then` chain, where it was refused as stating no flow of its own. The terminate the usage stands for is unordered against its body's statements: `explore` and `-engine check` reach it falling before, between or after them, an output pin left unwritten binding no value, while `reverse` and `declared` still perform it after the body. A `terminate` naming the usage inside its own body ends the usage's performance rather than the body's. A terminate usage inherited into a specialized action retains its stated body flow.
Original file line number	Diff line number	Diff line change
		@@ -1 +1 @@
		- A terminate action usage's body may state a flow. `action stop terminate { assign code := 42; then terminate; then assign other := 7; }` now runs its `then` chain, where it was refused as stating no flow of its own. The terminate the usage stands for is unordered against its body's statements: `explore` and `-engine check` reach it falling before, between or after them, an output pin left unwritten binding no value, while `reverse` and `declared` still perform it after the body. A `terminate` naming the usage inside its own body ends the usage's performance rather than the body's.
		- A terminate action usage's body may state a flow. `action stop terminate { assign code := 42; then terminate; then assign other := 7; }` now runs its `then` chain, where it was refused as stating no flow of its own. The terminate the usage stands for is unordered against its body's statements: `explore` and `-engine check` reach it falling before, between or after them, an output pin left unwritten binding no value, while `reverse` and `declared` still perform it after the body. A `terminate` naming the usage inside its own body ends the usage's performance rather than the body's. A terminate usage inherited into a specialized action retains its stated body flow.