diff --git a/.claude/skills/fix-issue/findings/mdl-executor.jsonl b/.claude/skills/fix-issue/findings/mdl-executor.jsonl
index 713002bfb4..d05e03d1d6 100644
--- a/.claude/skills/fix-issue/findings/mdl-executor.jsonl
+++ b/.claude/skills/fix-issue/findings/mdl-executor.jsonl
@@ -735,3 +735,4 @@
 {"area": "mdl/executor", "date": "2026-09-27", "symptom": "describe of a published REST service with no resources printed `create or modify published rest service M.S ( \u2026 )` followed by a bare `;`, which does not parse (`mismatched input ';' expecting '{'`); found while making describe end every statement with `;` (ako/mxcli#744).", "cause": "The resource block `{ \u2026 }` is mandatory in the grammar (publishedRestService: \u2026 RPAREN LBRACE publishedRestResource* RBRACE), but the describer only printed it when the service had resources and otherwise closed the statement with `;` alone.", "file": "mdl/executor/cmd_published_rest.go", "fix": "Always print the block: `{\\n};` when there are no resources.", "insight": "A describe test that asserts substrings never parses the output; feeding every Describe*_Mock output through the parser (assertTerminated, #744) found this at once. The empty-collection branch of a describer is the one no fixture exercises.", "test": "TestDescribePublishedRestService_Mock (assertTerminated)"}
 {"area": "mdl/executor", "date": "2026-09-27", "symptom": "Running an external entity's describe output (create or modify external entity, either form) turns each attribute's Rest$ODataMappedValue into a DomainModels$StoredValue (RemoteName/RemoteType/Filterable... gone), re-mints attribute $IDs on the `from odata client` form, and rewrites String(36) as unlimited", "cause": "Both rewrite paths rebuilt attributes from the AST, which has no spelling for the OData mapping; the `from odata client` path minted fresh IDs; describe external entity printed GetTypeName() (`String`) instead of formatAttributeType", "file": "mdl/executor/cmd_entities.go (carryStoredAttributeState), cmd_odata.go", "insight": "Carry per attribute by name what the statement cannot spell, in the shared merge, and enumerate every path that rebuilds attributes: there were two statements for one document kind", "refs": ["ako/mxcli#743"]}
 {"area": "mdl/executor", "date": "2026-09-27", "symptom": "create or modify odata service over a Studio Pro service: EntitySet PageSize 10000 -> 0, entity sets reordered, member CanBeEmpty recomputed, ExportLevel deleted, AuthenticationTypes marker 1 -> 3", "cause": "The modify path rebuilt entity types/sets from the publish block (no spelling for PageSize without paging, set order, CanBeEmpty); the model had no ExportLevel; the writer used a marker-3 list copied from the legacy writer, not Studio Pro", "file": "mdl/executor/cmd_odata.go (carryPublishedEntityState), mdl/backend/modelsdk/odata_write.go", "insight": "Parity with the legacy writer is not evidence of what Studio Pro writes; measure markers on a Studio Pro fixture. A probe that runs describe output with the verb rewritten to create or modify (mdl/roundtrip TestTestAppCreateOrModifyProbe) shows what a verb switch would lose before switching it", "refs": ["ako/mxcli#743"]}
+{"area": "mdl/executor", "date": "2026-09-27", "symptom": "describe microflow printed `validation feedback $O/A message '{1} \u2026';` with no template arguments; describe -> exec stored the feedback with none", "cause": "formatAction's ValidationFeedbackAction case never read TemplateParameters, although the reader (textTemplateFromGen) and the writer both carried them", "file": "mdl/executor/cmd_microflows_format_action.go (templateArgsClause)", "insight": "A text template has two halves, the text and its parameters; check every describe case that prints one prints both. Found while switching the template form to `with ({1} = \u2026)` (ako/mxcli#751)."}
diff --git a/.claude/skills/fix-issue/findings/mdl-visitor.jsonl b/.claude/skills/fix-issue/findings/mdl-visitor.jsonl
index 78b509ca39..81eedde092 100644
--- a/.claude/skills/fix-issue/findings/mdl-visitor.jsonl
+++ b/.claude/skills/fix-issue/findings/mdl-visitor.jsonl
@@ -36,3 +36,4 @@
 {"area":"mdl-visitor","date":"2026-09-24","refs":["#653"],"symptom":"describe entity on a view entity, exec'd back, was never idempotent: \"Each cycle reports `Modified view entity` and stores the query with every line after the first indented two spaces further.\" Re-exec of the SAME described file reported Unchanged, so it looked stable until you described again","cause":"The two directions did not mirror: describe (cmd_entities_describe.go, and cmd_diff_mdl.go) prefixes two spaces to every stored OQL line; the visitor stored extractOriginalText(oqlCtx), which starts at the query's first token, so line 1 lost its indentation and lines 2…n kept all of it — +2 per cycle","file":"`mdl/visitor/visitor_entity.go` (dedentOQL, leadingLineWhitespace); tests `mdl/visitor/visitor_view_entity_oql_indent_test.go`, `mdl/executor/view_entity_oql_roundtrip_test.go`; bug-test `mdl-examples/bug-tests/653-view-entity-oql-indent-drift.mdl`","insight":"**Any verbatim-source capture that starts at the first token is asymmetric**: line 1 is dedented for free, the continuation lines are not. Fix it on the way IN (exec), not by making describe emit less: strip the common leading-whitespace prefix of the non-blank lines, counting line 1 at its column when only whitespace precedes it (read it from the input stream, start.GetStart()-GetColumn()). Compare prefixes byte-wise, not by width, so a Studio Pro query indented with tabs comes back byte-identical under describe's two spaces. A round-trip test must run describe → exec at least twice AND start from stored text mxcli did not write (flat, tabs, blank lines, comments): one pass from a script is exactly how this went unnoticed. Control: stubbing dedentOQL to return raw fails every round-trip case with lines 2…n two spaces deeper; a real 11.12.1 project with the old binary printed Modified ×3 with growing indent, the fixed one Unchanged ×3. Separate, not fixed here: a comment AFTER the query's last token is outside the captured span and is dropped on exec"}
 {"area": "mdl/visitor", "date": "2026-09-25", "symptom": "A page action's microflow argument `Flag: true and false` was stored as the expression \"trueandfalse\", `Mode: if true then 'a' else 'b'` as \"iftruethen'a'else'b'\", and a REST call parameter `$OrderId = if $x then $id else 'none'` as \"if$xthen$idelse'none'\" (measured by decoding the units on a copy of ako/TestApp). `check -p --references` passed; describe printed the fused text back", "cause": "Four sites stored an expression as text via ANTLR's ctx.GetText(), which concatenates tokens without the hidden-channel whitespace: microflowArgV3 values (page/nanoflow call arguments), contentparams values, send-rest-request WITH parameters, and a dynamic `execute database query`. Literals, `+` and a lone $currentObject are single tokens or need no spacing, so every common case looked correct", "file": "`mdl/visitor/visitor_helpers.go` (`expressionSourceText`), `mdl/visitor/visitor_page_v3.go` (`buildMicroflowArgV3`, `buildParamAssignmentV3`), `mdl/visitor/visitor_microflow_actions.go` (dynamic query, send rest params)", "insight": "**GetText() on an expression context is always a bug** — grep `Expression().*GetText()` / `expr.GetText()` in mdl/visitor; each hit either builds the AST or must use expressionSourceText (whitespace kept, MDL comments stripped). The earlier comment-leak fix moved the six microflow sites to extractExpressionText and missed these four because they lived in page/REST code, not microflow statements: fix a text-extraction defect by searching for the call, not the feature. The tell that hid it: tests used `$currentObject` and `'a' + 'b'`, both immune; a probe with `and` / `if…then` exposed all four at once. Found while writing PROPOSAL_first_class_expressions.md §5.1. Tests `visitor_expression_source_text_test.go`", "refs": ["mendixlabs/mxcli#750"]}
 {"area": "mdl/visitor", "date": "2026-09-26", "refs": ["ako/mxcli#706"], "rules": ["MDL-IDX01", "MDL-ENUMDOC01"], "symptom": "Five forms parsed and `check` printed \"Syntax OK\", then the model lost or changed them: `throw 'x';` vanished from the microflow; `Amount: float` / `currency` became String(unlimited) (Void as a microflow type) and `date` became DateTime; `create association X (from A to B, type: referenceset, storage: table)` was stored as a Reference with column storage; a `/** … */` on an enumeration value and an index name (`index Idx on (…)`, `create index Idx on E (…)`) were read and written nowhere", "cause": "Three different gaps behind one symptom: throwStatement had a grammar rule and no listener (a whole statement); buildDataType/buildMicroflowDataType end in a default return (String / Void) that the FLOAT_TYPE and CURRENCY_TYPE tokens fell into, and DATE_TYPE mapped to an ast.TypeDate the writers alias to DateTime; ExitCreateAssociationStatement read only ctx.AssociationOptions(), while the parenthesised alternative puts its options directly under the statement as `(COMMA associationOption)*`. Enumeration-value docs and index names have no home in the metamodel (EnumerationValue and Index have no such property)", "file": "`mdl/visitor/visitor_silent_drops.go` (ExitThrowStatement, EnterDataType, EnterNonListDataType, rejectParenthesisedAssociation), `mdl/executor/validate_unstored_text.go` (MDL-IDX01, MDL-ENUMDOC01); tests `mdl/visitor/silent_drops_706_test.go`, `mdl/executor/validate_unstored_text_test.go`", "insight": "**Split by what is lost: refuse when the MODEL would be wrong, warn when only WORDS are lost.** throw/types/association write a different model, so they are visitor errors with the working spelling in the message; doc comments on values and index names leave a correct model, and were used in 56 places in our own examples, so they are check warnings. **Refuse from the parse tree, not by deleting the grammar alternative**: `float`, `currency`, `date` and `throw` are also keywords-as-identifiers, so removing `| FLOAT_TYPE` from dataType would let `Amount: float` re-parse as an enumeration reference named float — the same silence again. A listener on EnterDataType covers every place a type is written (attribute, parameter, return, declare, constant, service rules) in one method; checking only the direct child token keeps `M.Currency` and `enumeration(M.Float)` legal (the control). To find these: any `if … ; return ast.DataType{Kind: …}` fall-through default in a builder is a silent-substitution site, and a grammar alternative whose sub-rules differ from its sibling's (`associationOption` vs `associationOptions`) needs its own read. Sweep: run old vs new `mxcli check` over `git ls-files '*.mdl'` and diff exit codes — it found every example that relied on the dropped forms (5 files)"}
+{"date": "2026-09-27", "area": "mdl/visitor", "symptom": "A member path after `*`, `div`, `mod` (`$a/X * $b/Y`) is stored as division: `describe` shows `$a/X * $b / Y`, and inside a list `filter` `$b / $currentObject/Y`. `mxcli check`, `mx check` and the build are all green; Mendix evaluates a different expression.", "cause": "`/` shares a precedence level with `*`, `div`, `mod` in `multiplicativeExpression` (MDLSettings.g4), so the left-associative chain parses `$a/X * $b/Y` as `(($a/X) * $b) / Y`. `buildMultiplicativeExpression` only turned `/ Member` into an AttributePathExpr when the WHOLE left side was a variable or path; here `$b` was already the right operand of the product, so the `/` stayed a BinaryExpr. The serializer then printed a spaced `/` and the filter's `qualifyIteratorAttributes` read the stranded `Y` as a bare attribute.", "file": "mdl/visitor/visitor_microflow_expression.go (attachPathToLastOperand)", "fix": "When a `/ Member` step cannot attach to the whole left side, attach it to the last operand of the preceding multiplicative BinaryExpr (`*`, `div`, `mod`, `%`, `:`): `(L op $b) / Y` becomes `L op ($b/Y)`. Mendix has no `/` division, so `/` followed by a member name is always navigation. Division by a parenthesised expression is left alone (control test).", "insight": "Fixing it where the AST is BUILT fixes every consumer at once (serializer, iterator qualification, MDL045's slash-division check), where the earlier #52 fix only taught MDL045 to tolerate the mis-nested tree. Test: `TestMemberPathAfterMultiplicativeOperatorIsStoredAsWritten` (flow builder, stored strings for sum, filter, declare, div chain) plus a control `TestSlashAfterNonPathIsNotMadeAMemberPath`. Revert check: stubbing the fix brings back all four wrong strings. A unary-minus branch was dropped because removing it failed nothing (`2 * -$b/Y` was already stored correctly).", "refs": ["#768", "#52"], "rules": []}
diff --git a/.claude/skills/mendix/alter-page/SKILL.md b/.claude/skills/mendix/alter-page/SKILL.md
index 751c31a3c0..861a4fa7a7 100644
--- a/.claude/skills/mendix/alter-page/SKILL.md
+++ b/.claude/skills/mendix/alter-page/SKILL.md
@@ -146,14 +146,14 @@ set (Documentation: 'What this page is for.')
 
 -- Retarget a button's on-click action. Any form `create page` accepts works
 -- here, including the combined ones.
-set (Action: microflow Module.ACT_Other) on btnSave
-set (Action: SAVE_CHANGES CLOSE_PAGE) on btnSave
-set (Action: SHOW_PAGE Module.DetailPage) on btnEdit
+set (Action: call microflow Module.ACT_Other) on btnSave
+set (Action: SAVE CHANGES CLOSE PAGE) on btnSave
+set (Action: SHOW PAGE Module.DetailPage) on btnEdit
 
 -- Retarget ONE named action slot of a pluggable widget, by the widget's own
 -- property key (the same key `create page` takes: `createFileAction: …`).
-set ('createFileAction': microflow Module.ACT_CreateFile) on fileUploader1
-set ('onSelectionChange': show_page Module.Detail) on dgOrders
+set ('createFileAction': call microflow Module.ACT_CreateFile) on fileUploader1
+set ('onSelectionChange': show page Module.Detail) on dgOrders
 
 -- Rebind a data-bound widget
 set (DataSource: $OrderParam) on dvOrder
@@ -174,8 +174,8 @@ so a silent write would build cleanly and then fail to open.
 
 | Property | Widget Types | Value Type | Example |
 |----------|-------------|------------|---------|
-| `Action` | Widgets with an on-click action (ACTIONBUTTON, LINKBUTTON, clickable containers) | Any `create page` action expression | `set (Action: microflow M.ACT_Go) on btnSave` |
-| `'<slotKey>'` | Pluggable widgets — any **action-typed** property (File Uploader `createFileAction`, DataGrid 2 `onSelectionChange`, …) | Any `create page` action expression | `set ('createFileAction': microflow M.ACT_Create) on fileUploader1` — refused, naming the widget's action slots, if the key is not action-typed |
+| `Action` | Widgets with an on-click action (ACTIONBUTTON, LINKBUTTON, clickable containers) | Any `create page` action expression | `set (Action: call microflow M.ACT_Go) on btnSave` |
+| `'<slotKey>'` | Pluggable widgets — any **action-typed** property (File Uploader `createFileAction`, DataGrid 2 `onSelectionChange`, …) | Any `create page` action expression | `set ('createFileAction': call microflow M.ACT_Create) on fileUploader1` — refused, naming the widget's action slots, if the key is not action-typed |
 | `caption` | ACTIONBUTTON, LINKBUTTON | String | `set (caption: 'Submit') on btnSave` |
 | `content` | DYNAMICTEXT | String | `set (content: 'New Heading') on txtTitle` |
 | `label` | TEXTBOX, TEXTAREA, DATEPICKER, COMBOBOX, CHECKBOX, RADIOBUTTONS | String | `set (label: 'full Name') on txtName` |
@@ -267,7 +267,7 @@ insert after txtName {
 
 -- Insert before a widget
 insert before btnSave {
-  actionbutton btnPreview (caption: 'Preview', action: microflow Module.ACT_Preview)
+  actionbutton btnPreview (caption: 'Preview', action: call microflow Module.ACT_Preview)
 }
 
 -- Insert INTO a container — append as its last child (works on an EMPTY container)
@@ -313,8 +313,8 @@ Removes widgets and their entire subtree from the page.
 -- Replace a single widget with new content
 replace footer1 with {
   footer newFooter {
-    actionbutton btnSave (caption: 'Save', action: save_changes, buttonstyle: primary)
-    actionbutton btnCancel (caption: 'Cancel', action: cancel_changes)
+    actionbutton btnSave (caption: 'Save', action: save changes, buttonstyle: primary)
+    actionbutton btnCancel (caption: 'Cancel', action: cancel changes)
   }
 }
 ```
@@ -422,9 +422,9 @@ alter page MyModule.Customer_Edit {
 alter page MyModule.Customer_Edit {
   replace footer1 with {
     footer newFooter {
-      actionbutton btnSave (caption: 'Save', action: save_changes, buttonstyle: success)
+      actionbutton btnSave (caption: 'Save', action: save changes, buttonstyle: success)
       actionbutton btnDelete (caption: 'Delete', action: delete, buttonstyle: danger)
-      actionbutton btnCancel (caption: 'Cancel', action: cancel_changes)
+      actionbutton btnCancel (caption: 'Cancel', action: cancel changes)
     }
   }
 };
@@ -436,7 +436,7 @@ alter page MyModule.Customer_Edit {
 alter snippet MyModule.NavigationMenu {
   set (caption: 'Dashboard') on btnHome;
   insert after btnHome {
-    actionbutton btnReports (caption: 'Reports', action: show_page MyModule.Reports_Overview)
+    actionbutton btnReports (caption: 'Reports', action: show page MyModule.Reports_Overview)
   }
 };
 ```
@@ -555,7 +555,7 @@ page and bind the buttons at creation time instead of rewiring afterwards:
 
 1. **`SET` cannot rewire a button's action.** `set` accepts a fixed property list
    (`caption`, `class`, `visible`, …) — `action` is not on it, so
-   `set Action = microflow … on btnSave` is a parse error. Set the button's action
+   `set Action = call microflow … on btnSave` is a parse error. Set the button's action
    when the button is created (or `REPLACE` the button subtree).
 
 2. **`REPLACE` cannot reuse a widget name that lives inside the subtree being
diff --git a/.claude/skills/mendix/atlas-design/reference/building-blocks.md b/.claude/skills/mendix/atlas-design/reference/building-blocks.md
index f903115571..ef4f318f1b 100644
--- a/.claude/skills/mendix/atlas-design/reference/building-blocks.md
+++ b/.claude/skills/mendix/atlas-design/reference/building-blocks.md
@@ -137,7 +137,7 @@ rebind overrides that rewrite the block's outermost datasource / first button:
 
 ```mdl
 use building block Atlas_Web_Content.List_Cards
-  (datasource: database Sales.Order, action: microflow Sales.Open) as orders_;
+  (datasource: database Sales.Order, action: call microflow Sales.Open) as orders_;
 ```
 
 For a binding the override rule can't reach, copy the block in (`as prefix_`) and
diff --git a/.claude/skills/mendix/cheatsheet-errors/SKILL.md b/.claude/skills/mendix/cheatsheet-errors/SKILL.md
index 8565ba1801..03ef288d06 100644
--- a/.claude/skills/mendix/cheatsheet-errors/SKILL.md
+++ b/.claude/skills/mendix/cheatsheet-errors/SKILL.md
@@ -265,7 +265,7 @@ Run with `-p` for the fullest coverage.
 | CE0104 | Action activity is unreachable | Code after RETURN |
 | CE0105 | Must end with end event | Missing RETURN |
 | CE0117 | Error in expression | Unqualified association path |
-| CE1571 | No argument selected for parameter | A microflow/nanoflow call with a parameter nothing fills — as a `datasource:` **or** an `action:`. Give it an argument (`action: nanoflow M.NF($P = $value)`), or nest the widget in a data container of the parameter's type. `check -p` reports both |
+| CE1571 | No argument selected for parameter | A microflow/nanoflow call with a parameter nothing fills — as a `datasource:` **or** an `action:`. Give it an argument (`action: call nanoflow M.NF(P = $value)`), or nest the widget in a data container of the parameter's type. `check -p` reports both |
 | CE1571 | …in a control bar | A control bar is **not** row-scoped, so the grid's row does not fill it: pass the grid's selection (`$dgOrders`, with `Selection:` set) or move the widget into a column. `$currentObject` there is MDL-BUTTON01 |
 | CE1834 | The 'Page' property is required | Workflow user task without a `page` — `check` flags MDL-WF01 |
 | CE1876 | Single outcome must not contain activities | Single-outcome user task with a nested activity flow — `check` flags MDL-WF02 |
diff --git a/.claude/skills/mendix/check-syntax/SKILL.md b/.claude/skills/mendix/check-syntax/SKILL.md
index dbed9603e8..3777a7c839 100644
--- a/.claude/skills/mendix/check-syntax/SKILL.md
+++ b/.claude/skills/mendix/check-syntax/SKILL.md
@@ -249,14 +249,14 @@ Before writing any MDL, verify these requirements:
 - `retrieve $Var from Module.Entity [where condition];`
 - `$Result = call microflow Module.Name (Param = $value);` (NOT `set $Result = ...`)
 - `$Result = call nanoflow Module.Name (Param = $value);`
-- `show page Module.PageName ($Param = $value);`
+- `show page Module.PageName (Param = $value);`
 - `close page;`
 - `validation feedback $entity/attribute message 'message';`
 - `log info|warning|error [node 'name'] 'message';`
 - `if condition then ... [else ...] end if;`
 - `loop $item in $list begin ... end loop;`
 - `return $value;`
-- `on error continue|rollback|{ handler };`
+- `on error continue|rollback|[without rollback] begin handler end error;`
 
 **Now Supported (previously not):**
 - `rollback $entity [refresh];` - Reverts uncommitted changes
diff --git a/.claude/skills/mendix/connect-rapidminer-graph/SKILL.md b/.claude/skills/mendix/connect-rapidminer-graph/SKILL.md
index 8f947bc75d..adff1ad41b 100644
--- a/.claude/skills/mendix/connect-rapidminer-graph/SKILL.md
+++ b/.claude/skills/mendix/connect-rapidminer-graph/SKILL.md
@@ -213,7 +213,7 @@ create page MyModule.Customer_Overview (
   layout: Atlas_Core.Atlas_Default
 ) {
   dynamictext heading (content: 'Customers', rendermode: H2)
-  actionbutton btnRefresh (caption: 'Refresh', action: microflow MyModule.ACT_RefreshCustomers, buttonstyle: primary)
+  actionbutton btnRefresh (caption: 'Refresh', action: call microflow MyModule.ACT_RefreshCustomers, buttonstyle: primary)
   datagrid gridCustomers (datasource: database MyModule.Customer sort by CustomerId asc) {
     column   (attribute: CustomerId,   caption: 'ID')
     column (attribute: CustomerName, caption: 'Name')
diff --git a/.claude/skills/mendix/create-page/SKILL.md b/.claude/skills/mendix/create-page/SKILL.md
index fb81af9fab..3f944f0807 100644
--- a/.claude/skills/mendix/create-page/SKILL.md
+++ b/.claude/skills/mendix/create-page/SKILL.md
@@ -70,7 +70,7 @@ Both are optional and can be changed later with `alter page … { set Class = '
 | Password field | `Password: true` | `textbox tbPw (attribute: Secret, Password: true)` |
 | Widget validation | `Validation: '<expr>'` + `ValidationMessage: '<text>'` | `Validation: 'length(toString($value)) > 0'` — quoted, not `[bracketed]` |
 | Variable binding | `datasource: $Var` | `dataview dv (datasource: $Product) { ... }` |
-| Action binding | `action: type` | `actionbutton btn (caption: 'Save', action: save_changes)` |
+| Action binding | `action: type` | `actionbutton btn (caption: 'Save', action: save changes)` |
 | Database source | `datasource: database entity` | `datagrid dg (datasource: database Module.Entity)` |
 | Selection binding | `datasource: selection widget` | `dataview dv (datasource: selection galleryList)` |
 | CSS class | `class: 'classes'` | `container c (class: 'card mx-spacing-top-large')` |
@@ -200,10 +200,10 @@ create page MyModule.CustomerPage
     }
     row {
       column (desktopwidth: 6) {
-        actionbutton btnSave (caption: 'Save', action: save_changes, buttonstyle: primary)
+        actionbutton btnSave (caption: 'Save', action: save changes, buttonstyle: primary)
       }
       column (desktopwidth: 6) {
-        actionbutton btnCancel (caption: 'Cancel', action: cancel_changes)
+        actionbutton btnCancel (caption: 'Cancel', action: cancel changes)
       }
     }
   }
diff --git a/.claude/skills/mendix/create-page/reference/examples.md b/.claude/skills/mendix/create-page/reference/examples.md
index d700533d5a..65c1b431c3 100644
--- a/.claude/skills/mendix/create-page/reference/examples.md
+++ b/.claude/skills/mendix/create-page/reference/examples.md
@@ -28,8 +28,8 @@ create or replace page CRM.CustomerEdit
           checkbox cbActive (label: 'Active', attribute: IsActive)
 
           footer footer1 {
-            actionbutton btnSave (caption: 'Save', action: save_changes, buttonstyle: primary)
-            actionbutton btnCancel (caption: 'Cancel', action: cancel_changes)
+            actionbutton btnSave (caption: 'Save', action: save changes, buttonstyle: primary)
+            actionbutton btnCancel (caption: 'Cancel', action: cancel changes)
           }
         }
       }
@@ -97,8 +97,8 @@ create page CRM.Customer_MasterDetail
           textbox txtPhone (label: 'Phone', attribute: Phone)
 
           footer footer1 {
-            actionbutton btnSave (caption: 'Save', action: save_changes, buttonstyle: primary)
-            actionbutton btnCancel (caption: 'Cancel', action: cancel_changes)
+            actionbutton btnSave (caption: 'Save', action: save changes, buttonstyle: primary)
+            actionbutton btnCancel (caption: 'Cancel', action: cancel changes)
           }
         }
       }
diff --git a/.claude/skills/mendix/create-page/reference/widgets.md b/.claude/skills/mendix/create-page/reference/widgets.md
index a2a3059599..8cfd2ee1b4 100644
--- a/.claude/skills/mendix/create-page/reference/widgets.md
+++ b/.claude/skills/mendix/create-page/reference/widgets.md
@@ -117,30 +117,28 @@ describe icon collection Atlas_Core.Atlas_Filled   -- every icon + its reference
 
 **Action Bindings:**
 - `action: nothing` - Deliberately no action (a decorative button, a card that is not clickable)
-- `action: save_changes` - Save changes to object
-- `action: save_changes close_page` - Save and close page
-- `action: cancel_changes` - Cancel changes
-- `action: close_page` - Close the page
+- `action: save changes` - Save changes to object
+- `action: save changes close page` - Save and close page
+- `action: cancel changes` - Cancel changes
+- `action: close page` - Close the page
 - `action: delete` - Delete object
-- `action: microflow Module.MicroflowName` - Call microflow
-- `action: microflow Module.MicroflowName(Param: $value)` - Call microflow with parameters
-- `action: nanoflow Module.NanoflowName` - Call nanoflow (client-side)
-- `action: nanoflow Module.NanoflowName(Param: $value)` - Call nanoflow with parameters
-- `action: nanoflow Module.NanoflowName($Param = $value)` - Also accepted (microflow-style)
-- `action: open_link 'https://example.com'` - Open a fixed web address
-- `action: open_link $currentObject/URL` - Open the address held in an attribute of the enclosing data container's object (inside a data container only; not over an association)
+- `action: call microflow Module.MicroflowName` - Call microflow
+- `action: call microflow Module.MicroflowName(Param = $value)` - Call microflow with parameters
+- `action: call nanoflow Module.NanoflowName` - Call nanoflow (client-side)
+- `action: call nanoflow Module.NanoflowName(Param = $value)` - Call nanoflow with parameters
+- `action: open link 'https://example.com'` - Open a fixed web address
+- `action: open link $currentObject/URL` - Open the address held in an attribute of the enclosing data container's object (inside a data container only; not over an association)
 - **Every parameter needs an argument, or an enclosing data container of its
   type.** A flow called with a parameter nothing fills is **CE1571**; `mxcli
   check -p` reports it. This is the same on every widget that takes an action,
   a clickable `container` included.
-- `action: show_page Module.PageName` - Navigate to page
-- `action: show_page Module.PageName(Param: $value)` - Navigate with parameters
-- `action: show_page Module.PageName($Param = $value)` - Also accepted (microflow-style)
-- `action: create_object Module.Entity then show_page Module.PageName` - Create and navigate
-- **A `show_page` argument must be the context object, and there has to BE one.**
+- `action: show page Module.PageName` - Navigate to page
+- `action: show page Module.PageName(Param = $value)` - Navigate with parameters
+- `action: create object Module.Entity then show page Module.PageName` - Create and navigate
+- **A `show page` argument must be the context object, and there has to BE one.**
   Mendix takes the page argument from the enclosing data widget, so the only
   spellings that mean anything are `$currentObject` or the name of the variable
-  that widget is bound to (`datasource: $Customer` → `(Customer: $Customer)` is
+  that widget is bound to (`datasource: $Customer` → `(Customer = $Customer)` is
   fine). Naming any other variable is refused as **MDL-PAGEARG01** — it used to be
   accepted and silently opened the page with the context object anyway.
 - **Outside a data widget the same rule leaves nothing at all**, so a button sitting
@@ -150,11 +148,11 @@ describe icon collection Atlas_Core.Atlas_Filled   -- every icon + its reference
   mxbuild reports **CE1571** per parameter of the target page, and a page whose
   parameters are optional would simply show the wrong data. MDL-PAGEARG01 refuses
   that too (mendixlabs/mxcli#1029). To open a parameterised page from such a
-  button, call a microflow that does `show page Module.Page(Param: $value)` —
+  button, call a microflow that does `show page Module.Page(Param = $value)` —
   that path wires the arguments properly.
 - **The list above is the whole vocabulary, and a keyword without its argument is
-  not in it.** `action: open_link` with no URL, `action: show_page` with no page,
-  `action: microflow` with no name — each is **MDL-WIDGET28**. Until
+  not in it.** `action: open link` with no URL, `action: show page` with no page,
+  `action: call microflow` with no name — each is **MDL-WIDGET28**. Until
   mendixlabs/mxcli#1062 these were written as a widget with *no action at all*:
   it rendered, carried its caption, and did nothing, while `mxcli check`, `exec`
   and mxbuild all reported success, because a no-action widget is legal Mendix.
@@ -170,22 +168,22 @@ describe icon collection Atlas_Core.Atlas_Filled   -- every icon + its reference
 **Examples:**
 ```sql
 -- Save with style
-actionbutton btnSave (caption: 'Save', action: save_changes, buttonstyle: primary)
+actionbutton btnSave (caption: 'Save', action: save changes, buttonstyle: primary)
 
 -- Navigate with parameter (inside DATAVIEW)
-actionbutton btnEdit (caption: 'Edit', action: show_page Module.EditPage(Product: $Product))
+actionbutton btnEdit (caption: 'Edit', action: show page Module.EditPage(Product = $Product))
 
 -- Navigate with $currentObject (inside DATAGRID column)
-actionbutton btnEdit (caption: 'Edit', action: show_page Module.EditPage(Product: $currentObject))
+actionbutton btnEdit (caption: 'Edit', action: show page Module.EditPage(Product = $currentObject))
 
 -- Call microflow with page/dataview parameter
-actionbutton btnProcess (caption: 'Process', action: microflow Module.ACT_Process(Order: $Order), buttonstyle: success)
+actionbutton btnProcess (caption: 'Process', action: call microflow Module.ACT_Process(Order = $Order), buttonstyle: success)
 
 -- Call microflow with $currentObject (inside DATAGRID/LISTVIEW column)
-actionbutton btnDelete (caption: 'Delete', action: microflow Module.ACT_Delete(Target: $currentObject), buttonstyle: danger)
+actionbutton btnDelete (caption: 'Delete', action: call microflow Module.ACT_Delete(Target = $currentObject), buttonstyle: danger)
 
 -- Create object and show page
-actionbutton btnNew (caption: 'New', action: create_object Module.Product then show_page Module.Product_Edit, buttonstyle: primary)
+actionbutton btnNew (caption: 'New', action: create object Module.Product then show page Module.Product_Edit, buttonstyle: primary)
 ```
 
 **Using `$currentObject`:**
@@ -368,7 +366,7 @@ correctly on the default engine (mxbuild-verified, 0 errors) — an earlier CE04
 
 ```sql
 column (caption: 'Actions') {
-  actionbutton btnView (caption: 'View', action: close_page)
+  actionbutton btnView (caption: 'View', action: close page)
 }
 ```
 
@@ -448,8 +446,8 @@ dataview dvName (datasource: $VariableName) {
   textarea txtDescription (label: 'Description', attribute: description)
 
   footer footer1 {
-    actionbutton btnSave (caption: 'Save', action: save_changes, buttonstyle: primary)
-    actionbutton btnCancel (caption: 'Cancel', action: cancel_changes)
+    actionbutton btnSave (caption: 'Save', action: save changes, buttonstyle: primary)
+    actionbutton btnCancel (caption: 'Cancel', action: cancel changes)
   }
 }
 ```
@@ -508,8 +506,8 @@ dataview dataView1 (datasource: $Customer) {
   datepicker dpCreated (label: 'Created', attribute: CreateDate)
 
   footer footer1 {
-    actionbutton btnSave (caption: 'Save', action: save_changes, buttonstyle: primary)
-    actionbutton btnCancel (caption: 'Cancel', action: cancel_changes)
+    actionbutton btnSave (caption: 'Save', action: save changes, buttonstyle: primary)
+    actionbutton btnCancel (caption: 'Cancel', action: cancel changes)
   }
 }
 ```
@@ -645,9 +643,9 @@ Create a menu with action items:
 
 ```sql
 navigationlist navName {
-  item itemEdit (caption: 'Edit', action: show_page Module.EditPage(entity: $EntityParameter))
+  item itemEdit (caption: 'Edit', action: show page Module.EditPage(entity = $EntityParameter))
   item itemDelete (caption: 'Delete', action: delete)
-  item itemBack (caption: 'Back', action: close_page)
+  item itemBack (caption: 'Back', action: close page)
 }
 ```
 
@@ -843,7 +841,7 @@ conditional visibility — or put the condition in the microflow it calls:
 
 ```sql
 actionbutton btnSubmit (
-  caption: 'Submit', action: microflow Mod.ACT_Submit,
+  caption: 'Submit', action: call microflow Mod.ACT_Submit,
   visible: [$currentObject/Status = Mod.Status.Draft]
 )
 ```
@@ -885,13 +883,13 @@ Two shapes, two remedies:
 
 ```sql
 -- WRONG: silently does nothing
-dataview dvOrder (datasource: microflow Mod.DS_Order, onclick: show_page Mod.Detail) {
+dataview dvOrder (datasource: microflow Mod.DS_Order, onclick: show page Mod.Detail) {
   dynamictext t (content: 'Open')
 }
 
 -- RIGHT: the container carries the click
 dataview dvOrder (datasource: microflow Mod.DS_Order) {
-  container clickable (onclick: show_page Mod.Detail) {
+  container clickable (onclick: show page Mod.Detail) {
     dynamictext t (content: 'Open')
   }
 }
@@ -927,10 +925,10 @@ customcontainer outer1 (class: 'section') {
 
 **Clickable container (On click action).** A container can trigger an action when
 clicked — use `OnClick:` (or the equivalent `Action:` keyword) with any client
-action (`microflow`, `nanoflow`, `show_page`, `save_changes`, …):
+action (`microflow`, `nanoflow`, `show page`, `save changes`, …):
 
 ```sql
-container card1 (OnClick: microflow MyModule.ACT_OpenDetails, class: 'clickable-card') {
+container card1 (OnClick: call microflow MyModule.ACT_OpenDetails, class: 'clickable-card') {
   dynamictext title (content: 'Open details')
 }
 ```
@@ -947,7 +945,7 @@ as an `actionbutton`'s `action:`:
 
 ```sql
 -- Rich, parameterised trigger: a card that opens the object it represents
-container tileCard (OnClick: microflow MyModule.ACT_Open(Item: $currentObject), class: 'tile') {
+container tileCard (OnClick: call microflow MyModule.ACT_Open(Item = $currentObject), class: 'tile') {
   dynamictext tileValue (content: '4')
   dynamictext tileLabel (content: '4 LEFT', class: 'tile-label')
 }
@@ -964,8 +962,8 @@ Container for form action buttons:
 
 ```sql
 footer footerName {
-  actionbutton btnSave (caption: 'Save', action: save_changes, buttonstyle: primary)
-  actionbutton btnCancel (caption: 'Cancel', action: cancel_changes)
+  actionbutton btnSave (caption: 'Save', action: save changes, buttonstyle: primary)
+  actionbutton btnCancel (caption: 'Cancel', action: cancel changes)
 }
 ```
 
@@ -985,7 +983,7 @@ Control bar for data widgets:
 
 ```sql
 controlbar {
-  actionbutton btnNew (caption: 'New', action: create_object Module.Entity then show_page Module.EditPage, buttonstyle: primary)
+  actionbutton btnNew (caption: 'New', action: create object Module.Entity then show page Module.EditPage, buttonstyle: primary)
 }
 ```
 
@@ -1004,7 +1002,7 @@ datagrid dgMaterials (
 
   -- Row-scoped: the grid's row supplies the parameter, no argument needed.
   column (caption: 'Row') {
-    container cRowUnlink (action: nanoflow Module.ACT_UnLink, class: 'command') {
+    container cRowUnlink (action: call nanoflow Module.ACT_UnLink, class: 'command') {
       actionbutton btnRowUnlink (caption: 'Unlink')
     }
   }
@@ -1013,7 +1011,7 @@ datagrid dgMaterials (
     -- Not row-scoped: pass the selection explicitly.
     container cUnlink (
       class: 'command',
-      action: nanoflow Module.ACT_UnLink ($Material = $dgMaterials)
+      action: call nanoflow Module.ACT_UnLink (Material = $dgMaterials)
     ) {
       actionbutton btnUnlink (caption: 'Unlink')
     }
diff --git a/.claude/skills/mendix/custom-widgets/SKILL.md b/.claude/skills/mendix/custom-widgets/SKILL.md
index 192b7c0465..bf0bd33717 100644
--- a/.claude/skills/mendix/custom-widgets/SKILL.md
+++ b/.claude/skills/mendix/custom-widgets/SKILL.md
@@ -368,8 +368,8 @@ object-list item mappings use:
 overlap with `dataSourceExprV3` and the datasource alternative has to win, or a
 chart series' `staticDataSource: microflow M.X` would become an action. The
 executor converts them, because the widget definition is the only layer that
-knows the slot is action-typed. Every other action form (`show_page`,
-`save_changes`, …) reaches the AST as an action directly.
+knows the slot is action-typed. Every other action form (`show page`,
+`save changes`, …) reaches the AST as an action directly.
 
 **A slot may be conditional, and writing into a pruned one is CE0463.** DataGrid 2's
 `onSelectionChange` is *hidden when `itemSelection` = None*, so it needs
@@ -477,7 +477,7 @@ widgets take a different, simpler path than the MPR writer:
   selection, datasource, widgets (child slots), object lists, expression,
   texttemplate (including `{AttrName}` placeholders and `<Name>Params` /
   `contentparams` bindings -> template parameters),
-  and action (`microflow Module.Flow`, `show_page Module.Page`, or none).
+  and action (`microflow Module.Flow`, `show page Module.Page`, or none).
 - **Rejected loudly** (widget refused, nothing sent): actions *with argument
   mappings*, other action kinds (save/cancel/close/delete/create/open-link/
   nanoflow), and any operation the MCP builder does not translate. The error
diff --git a/.claude/skills/mendix/fragments/SKILL.md b/.claude/skills/mendix/fragments/SKILL.md
index 2846dff2e4..5e592cf509 100644
--- a/.claude/skills/mendix/fragments/SKILL.md
+++ b/.claude/skills/mendix/fragments/SKILL.md
@@ -29,8 +29,8 @@ Fragments are **script-scoped, transient** widget groups:
 ```mdl
 define fragment SaveCancelFooter as {
   footer footer1 {
-    actionbutton btnSave (caption: 'Save', action: save_changes, buttonstyle: primary)
-    actionbutton btnCancel (caption: 'Cancel', action: cancel_changes)
+    actionbutton btnSave (caption: 'Save', action: save changes, buttonstyle: primary)
+    actionbutton btnCancel (caption: 'Cancel', action: cancel changes)
   }
 };
 ```
@@ -135,7 +135,7 @@ create page Module.Orders (title: 'Orders', layout: Atlas_Core.Atlas_Default) {
 ```
 
 Rules:
-- Param kinds are `datasource` (`$var` / `database E` / `$currentObject/Assoc` / `microflow M`) and `action` (a microflow / nanoflow / `save_changes` / `show_page` / …).
+- Param kinds are `datasource` (`$var` / `database E` / `$currentObject/Assoc` / `microflow M`) and `action` (a microflow / nanoflow / `save changes` / `show page` / …).
 - Every declared parameter must be supplied; unknown args and type mismatches are errors.
 - Values substitute at expansion — `describe page` shows the concrete datasource/action, no `$param`.
 
@@ -145,7 +145,7 @@ outermost datasource and/or its first button after the copy:
 
 ```mdl
 use building block Atlas_Web_Content.List_Cards
-  (datasource: database Module.Order, action: microflow Module.OpenOrder) as orders_;
+  (datasource: database Module.Order, action: call microflow Module.OpenOrder) as orders_;
 ```
 
 Binding-point rule (prototype): datasource → the first widget carrying a
@@ -173,8 +173,8 @@ describe fragment SaveCancelFooter;
 ```mdl
 define fragment CrudFooter as {
   footer footer1 {
-    actionbutton btnSave (caption: 'Save', action: save_changes, buttonstyle: primary)
-    actionbutton btnCancel (caption: 'Cancel', action: cancel_changes)
+    actionbutton btnSave (caption: 'Save', action: save changes, buttonstyle: primary)
+    actionbutton btnCancel (caption: 'Cancel', action: cancel changes)
   }
 };
 
@@ -218,8 +218,8 @@ create page Module.Customer_Edit (...) {
 
 ```mdl
 define fragment ActionButtons as {
-  actionbutton btnApprove (caption: 'Approve', action: save_changes, buttonstyle: success)
-  actionbutton btnReject (caption: 'Reject', action: cancel_changes, buttonstyle: danger)
+  actionbutton btnApprove (caption: 'Approve', action: save changes, buttonstyle: success)
+  actionbutton btnReject (caption: 'Reject', action: cancel changes, buttonstyle: danger)
 };
 
 create page Module.DualPanel (...) {
diff --git a/.claude/skills/mendix/generate-domain-model/reference/patterns.md b/.claude/skills/mendix/generate-domain-model/reference/patterns.md
index fc2f87f6aa..209e471e3c 100644
--- a/.claude/skills/mendix/generate-domain-model/reference/patterns.md
+++ b/.claude/skills/mendix/generate-domain-model/reference/patterns.md
@@ -45,13 +45,13 @@ create enumeration ECommerce.OrderStatus (
 @position(50, 50)
 create persistent entity ECommerce.Customer (
   /** Unique customer identifier */
-  CustomerId: long not null error 'Customer ID is required' unique error 'Customer ID must be unique',
+  CustomerId: long not null error message 'Customer ID is required' unique error message 'Customer ID must be unique',
   /** Customer full name */
-  FullName: string(200) not null error 'Full name is required',
+  FullName: string(200) not null error message 'Full name is required',
   /** Email address */
-  Email: string(200) not null error 'Email is required' unique error 'Email must be unique',
+  Email: string(200) not null error message 'Email is required' unique error message 'Email must be unique',
   /** Registration date */
-  RegistrationDate: datetime not null error 'Registration date is required'
+  RegistrationDate: datetime not null error message 'Registration date is required'
 );
 
 /**
@@ -64,15 +64,15 @@ create persistent entity ECommerce.Customer (
 @position(50, 250)
 create persistent entity ECommerce.Product (
   /** Unique product identifier */
-  ProductId: long not null error 'Product ID is required' unique error 'Product ID must be unique',
+  ProductId: long not null error message 'Product ID is required' unique error message 'Product ID must be unique',
   /** Product name */
-  ProductName: string(200) not null error 'Product name is required',
+  ProductName: string(200) not null error message 'Product name is required',
   /** Product SKU */
-  SKU: string(50) not null error 'SKU is required' unique error 'SKU must be unique',
+  SKU: string(50) not null error message 'SKU is required' unique error message 'SKU must be unique',
   /** Unit price */
-  Price: decimal not null error 'Price is required',
+  Price: decimal not null error message 'Price is required',
   /** Stock quantity */
-  StockQuantity: integer not null error 'Stock quantity is required'
+  StockQuantity: integer not null error message 'Stock quantity is required'
 );
 
 /**
@@ -85,15 +85,15 @@ create persistent entity ECommerce.Product (
 @position(300, 150)
 create persistent entity ECommerce.SalesOrder (
   /** Unique order identifier */
-  OrderId: long not null error 'Order ID is required' unique error 'Order ID must be unique',
+  OrderId: long not null error message 'Order ID is required' unique error message 'Order ID must be unique',
   /** Order number */
-  OrderNumber: string(50) not null error 'Order number is required' unique error 'Order number must be unique',
+  OrderNumber: string(50) not null error message 'Order number is required' unique error message 'Order number must be unique',
   /** Order date */
-  OrderDate: datetime not null error 'Order date is required',
+  OrderDate: datetime not null error message 'Order date is required',
   /** Total amount */
-  TotalAmount: decimal not null error 'Total amount is required',
+  TotalAmount: decimal not null error message 'Total amount is required',
   /** Order status */
-  status: enumeration(ECommerce.OrderStatus) not null error 'Status is required'
+  status: enumeration(ECommerce.OrderStatus) not null error message 'Status is required'
 );
 
 -- Associations
diff --git a/.claude/skills/mendix/generate-domain-model/reference/syntax.md b/.claude/skills/mendix/generate-domain-model/reference/syntax.md
index e3a4445521..8c3247d7b4 100644
--- a/.claude/skills/mendix/generate-domain-model/reference/syntax.md
+++ b/.claude/skills/mendix/generate-domain-model/reference/syntax.md
@@ -180,17 +180,17 @@ Cross-module associations have no anchors at all — Mendix stores none, and
 @position(100, 100)
 create persistent entity Module.EntityName (
   /** Unique identifier */
-  Id: long not null error 'ID is required' unique error 'ID must be unique',
+  Id: long not null error message 'ID is required' unique error message 'ID must be unique',
   /** Attribute description */
-  attributename: string(200) not null error 'Attribute name is required',
+  attributename: string(200) not null error message 'Attribute name is required',
   /** Numeric value */
   Amount: decimal,
   /** Date field (there is no date-only type) */
   CreationDate: datetime,
   /** Boolean flag */
-  IsActive: boolean not null error 'IsActive flag is required' default true,
+  IsActive: boolean not null error message 'IsActive flag is required' default true,
   /** Enumeration field */
-  status: enumeration(Module.StatusEnum) not null error 'Status is required'
+  status: enumeration(Module.StatusEnum) not null error message 'Status is required'
 );
 ```
 
@@ -474,7 +474,7 @@ create association Module.EntityWithFK_ReferencedEntity
 from Module.EntityWithFK to Module.ReferencedEntity
 type reference
 owner default
-delete_behavior DELETE_BUT_KEEP_REFERENCES
+on delete set null
 comment 'Additional documentation';
 ```
 
@@ -520,12 +520,10 @@ both is refused as **MDL067**.
 > to-many collection and a list widget works. See master-detail-pages for the
 > widget patterns.
 
-**Delete Behaviors**:
-- `DELETE_AND_REFERENCES` - Delete object and all referencing objects
-- `DELETE_BUT_KEEP_REFERENCES` - Delete object, keep references (nullify)
-- `DELETE_IF_NO_REFERENCES` - Only delete if no objects reference it
-- `cascade` - Cascade delete to associated objects
-- `prevent` - Prevent deletion if references exist
+**Delete Behaviors** (`on delete …`; the old `delete_behavior …` clause is deprecated, MDL-DEPR022):
+- `on delete cascade` - Delete object and all referencing objects
+- `on delete set null` - Delete object, keep references (nullify) — the default
+- `on delete restrict [error message '…']` - Only delete if no objects reference it
 
 **Naming Convention**: `{FromEntity}_{ToEntity}` (e.g., `Order_Customer`, `Transaction_Account`)
 
@@ -603,13 +601,13 @@ Each constraint can have a custom error message using `error 'message'` syntax:
 ```sql
 create persistent entity Module.Customer (
   /** Customer name - required with custom error */
-  Name: string(200) not null error 'Name is required',
+  Name: string(200) not null error message 'Name is required',
   /** Email - required and unique with separate error messages */
-  Email: string(200) not null error 'Email is required' unique error 'Email must be unique',
+  Email: string(200) not null error message 'Email is required' unique error message 'Email must be unique',
   /** Age with default value */
   Age: integer default 0,
   /** Active status flag */
-  IsActive: boolean not null error 'IsActive flag is required' default true
+  IsActive: boolean not null error message 'IsActive flag is required' default true
 );
 ```
 
@@ -617,23 +615,23 @@ create persistent entity Module.Customer (
 - Place `error 'message'` immediately after the constraint
 - Multiple constraints can each have their own error message
 - Keep messages clear and user-friendly
-- Follow the pattern: `not null error 'X is required'` for required fields
-- For UNIQUE: `unique error 'X must be unique'`
+- Follow the pattern: `not null error message 'X is required'` for required fields
+- For UNIQUE: `unique error message 'X must be unique'`
 - Error messages are shown to end users during validation
 
 **Common patterns:**
 ```sql
 -- Required field
-Name: string(200) not null error 'Name is required',
+Name: string(200) not null error message 'Name is required',
 
 -- Required and unique
-Email: string(200) not null error 'Email is required' unique error 'Email must be unique',
+Email: string(200) not null error message 'Email is required' unique error message 'Email must be unique',
 
 -- Required with default
-IsActive: boolean not null error 'IsActive flag is required' default true,
+IsActive: boolean not null error message 'IsActive flag is required' default true,
 
 -- Enum with required error
-status: enumeration(Module.Status) not null error 'Status is required',
+status: enumeration(Module.Status) not null error message 'Status is required',
 
 -- Enum with default value (use fully qualified Module.Enum.Value)
 Priority: enumeration(Module.Priority) default Module.Priority.Normal
diff --git a/.claude/skills/mendix/master-detail-pages/SKILL.md b/.claude/skills/mendix/master-detail-pages/SKILL.md
index 330a55280e..f60378fefc 100644
--- a/.claude/skills/mendix/master-detail-pages/SKILL.md
+++ b/.claude/skills/mendix/master-detail-pages/SKILL.md
@@ -39,7 +39,7 @@ create page Module.Entity_MasterDetail
           textbox txtName (label: 'Name', attribute: Name)
 
           footer footer1 {
-            actionbutton btnSave (caption: 'Save', action: save_changes, buttonstyle: success)
+            actionbutton btnSave (caption: 'Save', action: save changes, buttonstyle: success)
           }
         }
       }
@@ -124,8 +124,8 @@ create page CRM.Customer_MasterDetail
           textbox txtPhone (label: 'Phone', attribute: Phone)
 
           footer footer1 {
-            actionbutton btnSave (caption: 'Save', action: save_changes, buttonstyle: success)
-            actionbutton btnCancel (caption: 'Cancel', action: cancel_changes)
+            actionbutton btnSave (caption: 'Save', action: save changes, buttonstyle: success)
+            actionbutton btnCancel (caption: 'Cancel', action: cancel changes)
           }
         }
       }
@@ -172,7 +172,7 @@ template template1 {
 | Where filter | `datasource: database from entity where [IsActive = true]` |
 | Selection mode | `selection: single` |
 | Attribute binding | `attribute: attributename` |
-| Action binding | `action: save_changes` |
+| Action binding | `action: save changes` |
 | Button style | `buttonstyle: success` |
 | Text content | `content: 'text'` with `contentparams: [{1} = attr]` |
 | Render mode | `rendermode: H4` |
diff --git a/.claude/skills/mendix/mdl-entities/SKILL.md b/.claude/skills/mendix/mdl-entities/SKILL.md
index b8a8912abe..8491cb05d8 100644
--- a/.claude/skills/mendix/mdl-entities/SKILL.md
+++ b/.claude/skills/mendix/mdl-entities/SKILL.md
@@ -164,7 +164,7 @@ the entity being referenced (the "one" / parent side). Name convention is `Child
  */
 create association Module.Product_Category
 from Module.Product to Module.Category
-type reference_set
+type ReferenceSet
 owner both;
 /
 ```
@@ -178,14 +178,14 @@ owner both;
 create association Module.Order_Customer
 from Module.Order to Module.Customer
 type reference
-delete_behavior DELETE_AND_REFERENCES;
+on delete cascade;
 /
 ```
 
 Delete behaviors (applied to the referenced `to` entity):
-- `delete_behavior DELETE_AND_REFERENCES` - delete the referencing objects too (cascade)
-- `delete_behavior DELETE_BUT_KEEP_REFERENCES` - delete, nullify the reference (default)
-- `delete_behavior DELETE_IF_NO_REFERENCES` - only delete when nothing references it
+- `on delete cascade` - delete the referencing objects too (cascade)
+- `on delete set null` - delete, nullify the reference (default)
+- `on delete restrict` - only delete when nothing references it
 
 ## Enumerations
 
@@ -330,7 +330,7 @@ type reference;
 create association Shop.OrderLine_Order
 from Shop.OrderLine to Shop.Order
 type reference
-delete_behavior DELETE_AND_REFERENCES;
+on delete cascade;
 /
 
 create association Shop.OrderLine_Product
@@ -347,7 +347,7 @@ not by re-running `describe` output:
 
 ```mdl
 alter entity Shop.Order add attribute Note: string(200);
-alter association Shop.Order_Customer set delete_behavior DELETE_BUT_KEEP_REFERENCES;
+alter association Shop.Order_Customer set on delete set null;
 alter enumeration Shop.OrderStatus add value Cancelled caption 'Cancelled';
 ```
 
@@ -374,10 +374,10 @@ attributename: type [(length)] [not null] [unique] [default value]
 ```mdl
 create association Module.Child_Parent
 from Module.ChildEntity to Module.ParentEntity
-[type reference | reference_set]
+[type reference | ReferenceSet]
 [owner default | both]
 [storage column | table]
-[delete_behavior DELETE_AND_REFERENCES | DELETE_BUT_KEEP_REFERENCES | DELETE_IF_NO_REFERENCES];
+[on delete cascade | restrict | set null [error message '...']];
 ```
 
 ### Enumeration Syntax
diff --git a/.claude/skills/mendix/migrate-k2-nintex/SKILL.md b/.claude/skills/mendix/migrate-k2-nintex/SKILL.md
index 502a4d9039..0e09625c0e 100644
--- a/.claude/skills/mendix/migrate-k2-nintex/SKILL.md
+++ b/.claude/skills/mendix/migrate-k2-nintex/SKILL.md
@@ -197,8 +197,8 @@ create page CRM.Customer_Edit
 
     -- Button bar (SmartForms action buttons)
     footer footer1 {
-      actionbutton btnSave (caption: 'Save', action: save_changes, buttonstyle: primary)
-      actionbutton btnCancel (caption: 'Cancel', action: cancel_changes)
+      actionbutton btnSave (caption: 'Save', action: save changes, buttonstyle: primary)
+      actionbutton btnCancel (caption: 'Cancel', action: cancel changes)
     }
   }
 }
@@ -241,7 +241,7 @@ begin
   commit $Order;
 
   -- Show page for review (like K2 "Task" with form)
-  show page CRM.Order_Review ($Order = $Order);
+  show page CRM.Order_Review (Order = $Order);
 end;
 
 -- K2 Decision "Order > $5000?" → Mendix microflow with decision
@@ -252,7 +252,7 @@ begin
 
   if $Order/TotalAmount > 5000 then
     -- Route to manager (K2 Destination Rule equivalent)
-    call microflow CRM.ACT_Order_SubmitForManagerReview ($Order = $Order);
+    call microflow CRM.ACT_Order_SubmitForManagerReview (Order = $Order);
   else
     -- Auto-approve (K2 "Go To" equivalent)
     change $Order (status = CRM.OrderStatus.Approved);
diff --git a/.claude/skills/mendix/migrate-oracle-forms/SKILL.md b/.claude/skills/mendix/migrate-oracle-forms/SKILL.md
index 41ea558e97..b2a6a6fba5 100644
--- a/.claude/skills/mendix/migrate-oracle-forms/SKILL.md
+++ b/.claude/skills/mendix/migrate-oracle-forms/SKILL.md
@@ -225,7 +225,7 @@ end;
 | `for ... loop ... end loop` | `loop $item in $list begin ... end loop` |
 | `while ... loop ... end loop` | Not directly supported; use recursive microflow |
 | `CURSOR` | `retrieve $list from ...` then `loop` |
-| `EXCEPTION when ... then` | `on error { ... }` |
+| `EXCEPTION when ... then` | `on error begin ... end error` |
 
 ### Example: PL/SQL to MDL
 
@@ -272,9 +272,9 @@ begin
     set $Total = $Total + $Order/Amount;
 
     change $Order (status = 'PROCESSED');
-    commit $Order on error {
+    commit $Order on error begin
       log error 'Failed to process order: ' + $Order/OrderNumber;
-    };
+    end error;
   end loop;
 
   log info 'Processed ' + toString($count) + ' orders, total: ' + toString($Total);
@@ -358,7 +358,7 @@ widgets (
 | `PRE-insert` / `PRE-update` | Before commit event handler |
 | `post-insert` / `post-update` | After commit event handler |
 | `key-commit` | Save button action microflow |
-| `on-error` | `on error { ... }` blocks |
+| `on-error` | `on error begin ... end error` blocks |
 
 ## Migration Checklist
 
diff --git a/.claude/skills/mendix/odata-data-sharing/reference/walkthroughs.md b/.claude/skills/mendix/odata-data-sharing/reference/walkthroughs.md
index 4245647149..fa17d592aa 100644
--- a/.claude/skills/mendix/odata-data-sharing/reference/walkthroughs.md
+++ b/.claude/skills/mendix/odata-data-sharing/reference/walkthroughs.md
@@ -406,7 +406,7 @@ an invoice number, an ISIN, an employee number. Mendix requires a key to be
 unique, required and stable (the last is the point here), and the unique
 validation rule it makes you add is checking exactly that.
 
-That is also why the key needs `unique error '…'` on the attribute — see the
+That is also why the key needs `unique error message '…'` on the attribute — see the
 CE6624 note below. Both halves of the same idea: the value identifies one row,
 and keeps identifying it.
 
@@ -526,7 +526,7 @@ Measured on Mendix 11.13, each row a separate build:
 | shape | result |
 |---|---|
 | single key attribute, persistable, no `unique` rule | **CE6624** — add one |
-| single key attribute, persistable, `unique error '…'` | 0 errors |
+| single key attribute, persistable, `unique error message '…'` | 0 errors |
 | **single key attribute, VIEW entity, no `unique` rule** | **0 errors** |
 | **composite key, `OData3`** | **CE7238** "You can only have more than one key attribute when the OData version is 4" |
 | composite key, `OData4`, persistable, no `unique` rules | 0 errors |
diff --git a/.claude/skills/mendix/overview-pages/SKILL.md b/.claude/skills/mendix/overview-pages/SKILL.md
index 2fdc531dde..3faef3acb5 100644
--- a/.claude/skills/mendix/overview-pages/SKILL.md
+++ b/.claude/skills/mendix/overview-pages/SKILL.md
@@ -29,9 +29,9 @@ Create a reusable navigation snippet using NAVIGATIONLIST for vertical sidebar m
 create snippet Module.Entity_Menu
 {
   navigationlist navMenu {
-    item itemCustomers (caption: 'Customers', action: show_page Module.Customer_Overview)
-    item itemOrders (caption: 'Orders', action: show_page Module.Order_Overview)
-    item itemProducts (caption: 'Products', action: show_page Module.Product_Overview)
+    item itemCustomers (caption: 'Customers', action: show page Module.Customer_Overview)
+    item itemOrders (caption: 'Orders', action: show page Module.Order_Overview)
+    item itemProducts (caption: 'Products', action: show page Module.Product_Overview)
   }
 }
 ```
@@ -55,9 +55,9 @@ The NAVIGATIONLIST widget creates a vertical menu with navigation items:
 
 ```sql
 navigationlist widgetName {
-  item itemName (caption: 'Caption', action: show_page Module.PageName)
-  item itemName (caption: 'Caption', action: microflow Module.MicroflowName)
-  item itemName (caption: 'Caption', action: close_page)
+  item itemName (caption: 'Caption', action: show page Module.PageName)
+  item itemName (caption: 'Caption', action: call microflow Module.MicroflowName)
+  item itemName (caption: 'Caption', action: close page)
 }
 ```
 
@@ -105,7 +105,7 @@ create page Module.Entity_Overview
             textfilter textFilter2
           }
           column (caption: 'Actions') {
-            actionbutton btnEdit (caption: 'Edit', action: show_page Module.Entity_NewEdit("entity": $currentObject))
+            actionbutton btnEdit (caption: 'Edit', action: show page Module.Entity_NewEdit("entity" = $currentObject))
             actionbutton btnDelete (caption: 'Delete', action: delete, buttonstyle: danger)
           }
         }
@@ -147,7 +147,7 @@ datagrid GridName (
     textfilter textFilter1
   }
   column (caption: 'Actions') {
-    actionbutton btnEdit (caption: 'Edit', action: show_page Module.Entity_NewEdit("entity": $currentObject))
+    actionbutton btnEdit (caption: 'Edit', action: show page Module.Entity_NewEdit("entity" = $currentObject))
   }
 }
 ```
@@ -253,8 +253,8 @@ create page Module.Entity_NewEdit
           combobox cbStatus (label: 'Status', attribute: status)
 
           footer footer1 {
-            actionbutton btnSave (caption: 'Save', action: save_changes, buttonstyle: success)
-            actionbutton btnCancel (caption: 'Cancel', action: cancel_changes)
+            actionbutton btnSave (caption: 'Save', action: save changes, buttonstyle: success)
+            actionbutton btnCancel (caption: 'Cancel', action: cancel changes)
           }
         }
       }
@@ -276,8 +276,8 @@ create page Module.PageName
 
 - Parameter name conventionally matches the entity name (e.g., `$store`, `$Customer`)
 - The DataView's binding references this parameter (`datasource: $ParamName`)
-- When calling the page via SHOW_PAGE, pass the object by parameter name: `show_page Module.PageName(ParamName: $value)`
-- **Reserved-word parameter names must be quoted in the SHOW_PAGE args.** The generic examples above name the parameter `entity`, which is a reserved keyword, so the call quotes it: `show_page Module.Entity_NewEdit("entity": $currentObject)`. A non-reserved name (`$store`, `$Customer`) needs no quotes: `show_page Module.Store_NewEdit(store: $currentObject)`.
+- When calling the page via show page, pass the object by parameter name: `show page Module.PageName(ParamName = $value)`
+- **Reserved-word parameter names must be quoted in the show page args.** The generic examples above name the parameter `entity`, which is a reserved keyword, so the call quotes it: `show page Module.Entity_NewEdit("entity" = $currentObject)`. A non-reserved name (`$store`, `$Customer`) needs no quotes: `show page Module.Store_NewEdit(store = $currentObject)`.
 
 ### NewEdit Page Components
 
@@ -299,8 +299,8 @@ create snippet MdlTemplates.NavigationMenu
   layoutgrid navGrid {
     row {
       column (desktopwidth: 12) {
-        actionbutton btnStores (caption: 'Stores', action: show_page MdlTemplates.Store_Overview)
-        actionbutton btnCars (caption: 'Cars', action: show_page MdlTemplates.Car_Overview)
+        actionbutton btnStores (caption: 'Stores', action: show page MdlTemplates.Store_Overview)
+        actionbutton btnCars (caption: 'Cars', action: show page MdlTemplates.Car_Overview)
       }
     }
   }
@@ -368,8 +368,8 @@ create page MdlTemplates.Store_NewEdit
           textbox txtLocation (label: 'Location', attribute: Location)
 
           footer footer1 {
-            actionbutton btnSave (caption: 'Save', action: save_changes, buttonstyle: success)
-            actionbutton btnCancel (caption: 'Cancel', action: cancel_changes)
+            actionbutton btnSave (caption: 'Save', action: save changes, buttonstyle: success)
+            actionbutton btnCancel (caption: 'Cancel', action: cancel changes)
           }
         }
       }
@@ -425,8 +425,8 @@ create page MdlTemplates.Car_NewEdit
           radiobuttons rbType (label: 'Car type', attribute: CarType)
 
           footer footer1 {
-            actionbutton btnSave (caption: 'Save', action: save_changes, buttonstyle: success)
-            actionbutton btnCancel (caption: 'Cancel', action: cancel_changes)
+            actionbutton btnSave (caption: 'Save', action: save changes, buttonstyle: success)
+            actionbutton btnCancel (caption: 'Cancel', action: cancel changes)
           }
         }
       }
@@ -535,9 +535,9 @@ create snippet Module.Entity_Menu
 )
 {
   navigationlist EntityMenuNav {
-    item itemEdit (caption: 'Edit', action: show_page Module.Entity_NewEdit("entity": $EntityParameter))
+    item itemEdit (caption: 'Edit', action: show page Module.Entity_NewEdit("entity" = $EntityParameter))
     item itemDelete (caption: 'Delete', action: delete)
-    item itemBack (caption: 'Back', action: close_page)
+    item itemBack (caption: 'Back', action: close page)
   }
 }
 ```
@@ -551,18 +551,18 @@ navigationlist widgetName {
 ```
 
 **Supported Actions:**
-- `action: save_changes` - Save changes
-- `action: cancel_changes` - Cancel changes
-- `action: close_page` - Close current page
+- `action: save changes` - Save changes
+- `action: cancel changes` - Cancel changes
+- `action: close page` - Close current page
 - `action: delete` - Delete object
-- `action: microflow Module.MicroflowName` - Call microflow
-- `action: microflow Module.MicroflowName(Param: $value)` - Call microflow with parameters
-- `action: show_page Module.PageName` - Navigate to page
-- `action: show_page Module.PageName(Param: $value)` - Navigate with parameters
-- **A `show_page` argument must be the context object, and there has to BE one.**
+- `action: call microflow Module.MicroflowName` - Call microflow
+- `action: call microflow Module.MicroflowName(Param = $value)` - Call microflow with parameters
+- `action: show page Module.PageName` - Navigate to page
+- `action: show page Module.PageName(Param = $value)` - Navigate with parameters
+- **A `show page` argument must be the context object, and there has to BE one.**
   Mendix takes the page argument from the enclosing data widget, so the only
   spellings that mean anything are `$currentObject` or the name of the variable
-  that widget is bound to (`datasource: $Customer` → `(Customer: $Customer)` is
+  that widget is bound to (`datasource: $Customer` → `(Customer = $Customer)` is
   fine). Naming any other variable is refused as **MDL-PAGEARG01** — it used to be
   accepted and silently opened the page with the context object anyway.
 - **Outside a data widget the same rule leaves nothing at all**, so a button sitting
@@ -572,12 +572,12 @@ navigationlist widgetName {
   mxbuild reports **CE1571** per parameter of the target page, and a page whose
   parameters are optional would simply show the wrong data. MDL-PAGEARG01 refuses
   that too (mendixlabs/mxcli#1029). To open a parameterised page from such a
-  button, call a microflow that does `show page Module.Page(Param: $value)` —
+  button, call a microflow that does `show page Module.Page(Param = $value)` —
   that path wires the arguments properly.
 
 ## Handling Circular Dependencies
 
-When a navigation snippet references pages (via `show_page`) and those pages reference the snippet (via `snippetcall`), you have a circular dependency. Use the **placeholder pattern**:
+When a navigation snippet references pages (via `show page`) and those pages reference the snippet (via `snippetcall`), you have a circular dependency. Use the **placeholder pattern**:
 
 ### Creation Order
 
@@ -631,7 +631,7 @@ create or modify snippet Module.NavigationMenu
   layoutgrid navGrid {
     row {
       column (desktopwidth: 12) {
-        actionbutton btnCustomers (caption: 'Customers', action: show_page Module.Customer_Overview)
+        actionbutton btnCustomers (caption: 'Customers', action: show page Module.Customer_Overview)
       }
     }
   }
diff --git a/.claude/skills/mendix/patterns-crud/SKILL.md b/.claude/skills/mendix/patterns-crud/SKILL.md
index 40e5429d9f..b20fbd8aae 100644
--- a/.claude/skills/mendix/patterns-crud/SKILL.md
+++ b/.claude/skills/mendix/patterns-crud/SKILL.md
@@ -35,7 +35,7 @@ returns boolean
 begin
   -- Validate first
   declare $IsValid boolean = true;
-  $IsValid = call microflow Module.VAL_Customer_Save($Customer = $Customer);
+  $IsValid = call microflow Module.VAL_Customer_Save(Customer = $Customer);
 
   if $IsValid then
     commit $Customer;
@@ -153,7 +153,7 @@ begin
     CreatedDate = [%CurrentDateTime%]
   );
 
-  show page Module.Customer_NewEdit ($Customer = $NewCustomer);
+  show page Module.Customer_NewEdit (Customer = $NewCustomer);
   return true;
 end;
 /
@@ -198,7 +198,7 @@ create microflow Module.ACT_Customer_Edit (
 )
 returns boolean
 begin
-  show page Module.Customer_NewEdit ($Customer = $Customer);
+  show page Module.Customer_NewEdit (Customer = $Customer);
   return true;
 end;
 /
diff --git a/.claude/skills/mendix/regular-expressions/SKILL.md b/.claude/skills/mendix/regular-expressions/SKILL.md
index c115e28f4d..0f70dd8847 100644
--- a/.claude/skills/mendix/regular-expressions/SKILL.md
+++ b/.claude/skills/mendix/regular-expressions/SKILL.md
@@ -73,7 +73,7 @@ create regular expression Val.EmailAddress (
 
 create validation rule for Val.Person.Email
   regex Val.EmailAddress
-  feedback 'Enter a valid email address';
+  error message 'Enter a valid email address';
 ```
 
 Create the pattern first. The rule stores a **reference by qualified name**, so
@@ -84,9 +84,9 @@ Ranges use the same statement. Bounds are inclusive and either may be omitted;
 Mendix has no strict `<` or `>`, so there is no exclusive form:
 
 ```sql
-create validation rule for Val.Booking.Guests range from 1 to 100 feedback '…';
-create validation rule for Val.Product.Price  range from 0        feedback '…';
-create validation rule for Val.Order.Discount range to 100        feedback '…';
+create validation rule for Val.Booking.Guests range from 1 to 100 error message '…';
+create validation rule for Val.Product.Price  range from 0        error message '…';
+create validation rule for Val.Order.Discount range to 100        error message '…';
 ```
 
 Re-running a rule replaces the one of the **same type** on that attribute and
@@ -98,12 +98,12 @@ constraints:
 
 ```sql
 create entity Val.Person (
-  Email: String(200) not null error 'Email is required',
-  Code:  String(20)  unique error 'Code must be unique'
+  Email: String(200) not null error message 'Email is required',
+  Code:  String(20)  unique error message 'Code must be unique'
 );
 
 alter entity Val.Person modify attribute Email String(200)
-  not null error 'Email is required';
+  not null error message 'Email is required';
 ```
 
 ### What still cannot be authored
diff --git a/.claude/skills/mendix/resolve-forward-references/SKILL.md b/.claude/skills/mendix/resolve-forward-references/SKILL.md
index e72f1f00e4..a57a1111ec 100644
--- a/.claude/skills/mendix/resolve-forward-references/SKILL.md
+++ b/.claude/skills/mendix/resolve-forward-references/SKILL.md
@@ -22,7 +22,7 @@ This applies to the following reference types:
 | Reference | In | Fails when |
 |---|---|---|
 | `snippetcall` | page / snippet | snippet created after the page |
-| `show_page` in action | page / snippet | page created after the page that references it |
+| `show page` in action | page / snippet | page created after the page that references it |
 | `SHOW PAGE` | microflow | page created after the microflow |
 | `call microflow` | microflow | callee microflow created after the caller (in the same script, `exec` resolves the call against the project/backend, not later same-script definitions — so order the callee first) |
 
@@ -49,7 +49,7 @@ The standard workaround is a three-step sequence:
 
 ## Pattern 1 — Shared Navigation Snippet (most common)
 
-A navigation snippet contains `show_page` buttons (references pages) and pages include
+A navigation snippet contains `show page` buttons (references pages) and pages include
 the snippet via `snippetcall` (references the snippet). Both sides reference each other.
 
 ```sql
@@ -100,7 +100,7 @@ create page MyModule.Order_Overview
 }
 /
 
--- Step 3: fill in the snippet with real content (pages now exist → show_page resolves OK)
+-- Step 3: fill in the snippet with real content (pages now exist → show page resolves OK)
 -- Use CREATE OR MODIFY (preserves ID) or ALTER SNIPPET (in-place)
 create or modify snippet MyModule.NavMenu
 (
@@ -110,11 +110,11 @@ create or modify snippet MyModule.NavMenu
   layoutgrid g { row r { column c (desktopwidth: 12) {
     actionbutton btnCustomers (
       caption: 'Customers',
-      action: show_page MyModule.Customer_Overview
+      action: show page MyModule.Customer_Overview
     )
     actionbutton btnOrders (
       caption: 'Orders',
-      action: show_page MyModule.Order_Overview
+      action: show page MyModule.Order_Overview
     )
   }}}
 }
@@ -125,7 +125,7 @@ create or modify snippet MyModule.NavMenu
 
 ## Pattern 2 — Page References Another Page (new/edit from overview)
 
-An overview page has a New button that opens a NewEdit page via `show_page`. The NewEdit
+An overview page has a New button that opens a NewEdit page via `show page`. The NewEdit
 page must exist before the overview can reference it.
 
 ```sql
@@ -142,8 +142,8 @@ create page MyModule.Customer_NewEdit
     dataview dv (datasource: $Customer) {
       textbox txtName (label: 'Name', attribute: Name)
     }
-    actionbutton btnSave (caption: 'Save', action: save_changes)
-    actionbutton btnCancel (caption: 'Cancel', action: cancel_changes)
+    actionbutton btnSave (caption: 'Save', action: save changes)
+    actionbutton btnCancel (caption: 'Cancel', action: cancel changes)
   }}}
 }
 /
@@ -158,7 +158,7 @@ create page MyModule.Customer_Overview
   layoutgrid g { row { column (desktopwidth: 12) {
     actionbutton btnNew (
       caption: 'New',
-      action: microflow MyModule.ACT_Customer_New
+      action: call microflow MyModule.ACT_Customer_New
     )
     datagrid dg (datasource: database MyModule.Customer) {
       column (caption: 'Name', attribute: Name)
@@ -198,7 +198,7 @@ create page MyModule.Order_Detail
 create microflow MyModule.ACT_OpenOrder ($Order: MyModule.Order)
 begin
   @position(200,200)
-  show page MyModule.Order_Detail ($Order = $Order);
+  show page MyModule.Order_Detail (Order = $Order);
   @position(400,200) return;
 end;
 /
@@ -240,7 +240,7 @@ alter snippet MyModule.NavMenu
   replace activity loading
   with actionbutton btnCustomers (
     caption: 'Customers',
-    action: show_page MyModule.Customer_Overview
+    action: show page MyModule.Customer_Overview
   );
 ```
 
@@ -301,7 +301,7 @@ create or modify snippet MyModule.AppNav
   layoutgrid g { row r { column c (desktopwidth: 12) {
     actionbutton btnCustomers (
       caption: 'Customers',
-      action: show_page MyModule.Customer_Overview
+      action: show page MyModule.Customer_Overview
     )
   }}}
 }
@@ -313,7 +313,7 @@ begin
   @position(200,200)
   $c = create MyModule.Customer;
   @position(400,200)
-  show page MyModule.Customer_NewEdit ($Customer = $c);
+  show page MyModule.Customer_NewEdit (Customer = $c);
   @position(600,200) return;
 end;
 /
@@ -321,7 +321,7 @@ end;
 -- 6. Navigation (pages already exist)
 alter navigation Responsive
   insert menu item 'Customers'
-    action show_page MyModule.Customer_Overview;
+    action show page MyModule.Customer_Overview;
 ```
 
 ---
diff --git a/.claude/skills/mendix/system-module/SKILL.md b/.claude/skills/mendix/system-module/SKILL.md
index eee046dae9..206e524eeb 100644
--- a/.claude/skills/mendix/system-module/SKILL.md
+++ b/.claude/skills/mendix/system-module/SKILL.md
@@ -220,7 +220,7 @@ create persistent entity MyModule.Attachment extends System.FileDocument (
 
 create association MyModule.Order_Attachments
 from MyModule.Order to MyModule.Attachment
-type reference_set;
+type ReferenceSet;
 ```
 
 ### System.Image
@@ -475,7 +475,7 @@ create persistent entity MyModule.Attachment extends System.FileDocument (
 
 create association MyModule.Order_Attachments
 from MyModule.Order to MyModule.Attachment
-type reference_set;
+type ReferenceSet;
 ```
 
 ### Workflow Context Object
diff --git a/.claude/skills/mendix/test-app/SKILL.md b/.claude/skills/mendix/test-app/SKILL.md
index 149c3662a5..6bc3a7791c 100644
--- a/.claude/skills/mendix/test-app/SKILL.md
+++ b/.claude/skills/mendix/test-app/SKILL.md
@@ -105,7 +105,7 @@ Mendix renders each widget's `name` property as a CSS class on the DOM element:
 This maps directly to MDL widget names. When you generate a widget in MDL:
 
 ```sql
-actionbutton submitButton (caption: 'Submit', action: save_changes)
+actionbutton submitButton (caption: 'Submit', action: save changes)
 ```
 
 The stable CSS selector is `.mx-name-submitButton`. Use this with `eval` for reliable assertions:
@@ -379,7 +379,7 @@ playwright-cli show
 
 ```sql
 -- MDL: names you define become test hooks
-actionbutton btnDrivers (caption: 'Drivers', action: show_page Module.Drivers_Overview)
+actionbutton btnDrivers (caption: 'Drivers', action: show page Module.Drivers_Overview)
 datagrid dgOrders (datasource: database Module.Order) { ... }
 ```
 
diff --git a/.claude/skills/mendix/validation-microflows/SKILL.md b/.claude/skills/mendix/validation-microflows/SKILL.md
index 1f7e0181e7..acb6e1401a 100644
--- a/.claude/skills/mendix/validation-microflows/SKILL.md
+++ b/.claude/skills/mendix/validation-microflows/SKILL.md
@@ -42,7 +42,7 @@ validation feedback $VariableName/attributename message 'Error message';
 
 With template arguments (for dynamic messages):
 ```mdl
-validation feedback $VariableName/attributename message '{1}' objects [$MessageVariable];
+validation feedback $VariableName/attributename message '{1}' with ({1} = $MessageVariable);
 ```
 
 ### CLOSE PAGE Statement
@@ -131,7 +131,7 @@ returns boolean as $IsValid
 folder 'OverviewPages'
 begin
   -- Call validation microflow
-  $IsValid = call microflow MdlTemplates.VAL_Car_NewEdit($param = $Car);
+  $IsValid = call microflow MdlTemplates.VAL_Car_NewEdit(param = $Car);
 
   -- Only save if validation passed
   if $IsValid then
@@ -240,7 +240,7 @@ end if;
 
 if trim($ValidationMessage) != '' then
   set $IsValid = false;
-  validation feedback $entity/value message '{1}' objects [$ValidationMessage];
+  validation feedback $entity/value message '{1}' with ({1} = $ValidationMessage);
 end if;
 ```
 
@@ -292,4 +292,4 @@ This feature is implemented in:
 
 ## Validation rules (CREATE VALIDATION RULE)
 
-binds a **regex** or a **range** to one attribute — `create validation rule for Mod.Entity.Attr regex Mod.Pattern feedback '…'`. The rule is anonymous and entity-scoped, so the statement names the attribute; re-running it replaces the rule of the same type and leaves the attribute's others alone. Unlocked by a `STORAGE-NAME OVERRIDE` in `modelsdk/gen`: it bound `RegularExpression` where Studio Pro stores `RegExIdentifier`, and the control (same script, key reverted) fails **CE0135 "No regular expression specified"** while the fixed one is 0 errors on mxbuild 11.13 with `RegExIdentifier` on disk. Range bounds are inclusive and map to Mendix's only three kinds (`from X to Y`/`from X`/`to Y` → Between/GreaterThanOrEqualTo/SmallerThanOrEqualTo); there is no strict `<`/`>`, and the old grammar's forms for it — plus an EXPRESSION rule type Mendix does not have and an inline regex literal — were removed, having never had a visitor or handler. Required/Unique stay attribute constraints (`not null error '…'` / `unique error '…'`), not a second spelling here. Rewriting an entity carrying **MaxLength or EqualsTo** is **refused** on both engines rather than silently downgraded to Required; that round trip was lossy and `mx check` stayed green, because a Required rule is valid. Both engines carry each rule's payload on READ (`ruleInfoFromGen` / `parseValidationRuleInfo`), which is what makes the refusal narrow instead of covering all of RegEx and Range — and what lets a **range bounded by another attribute** survive a rewrite even though MDL cannot author one (`describe entity` marks it with a comment rather than rendering it wrong). A rule whose payload did not survive the read is refused as firmly as an unknown type: a bare RuleInfo of the right `$Type` constrains nothing, which is the same silent downgrade wearing the right name
+binds a **regex** or a **range** to one attribute — `create validation rule for Mod.Entity.Attr regex Mod.Pattern error message '…'`. The rule is anonymous and entity-scoped, so the statement names the attribute; re-running it replaces the rule of the same type and leaves the attribute's others alone. Unlocked by a `STORAGE-NAME OVERRIDE` in `modelsdk/gen`: it bound `RegularExpression` where Studio Pro stores `RegExIdentifier`, and the control (same script, key reverted) fails **CE0135 "No regular expression specified"** while the fixed one is 0 errors on mxbuild 11.13 with `RegExIdentifier` on disk. Range bounds are inclusive and map to Mendix's only three kinds (`from X to Y`/`from X`/`to Y` → Between/GreaterThanOrEqualTo/SmallerThanOrEqualTo); there is no strict `<`/`>`, and the old grammar's forms for it — plus an EXPRESSION rule type Mendix does not have and an inline regex literal — were removed, having never had a visitor or handler. Required/Unique stay attribute constraints (`not null error message '…'` / `unique error message '…'`), not a second spelling here. Rewriting an entity carrying **MaxLength or EqualsTo** is **refused** on both engines rather than silently downgraded to Required; that round trip was lossy and `mx check` stayed green, because a Required rule is valid. Both engines carry each rule's payload on READ (`ruleInfoFromGen` / `parseValidationRuleInfo`), which is what makes the refusal narrow instead of covering all of RegEx and Range — and what lets a **range bounded by another attribute** survive a rewrite even though MDL cannot author one (`describe entity` marks it with a comment rather than rendering it wrong). A rule whose payload did not survive the read is refused as firmly as an unknown type: a bare RuleInfo of the right `$Type` constrains nothing, which is the same silent downgrade wearing the right name
diff --git a/.claude/skills/mendix/write-microflows/SKILL.md b/.claude/skills/mendix/write-microflows/SKILL.md
index 2b31169d57..17e49f7c3b 100644
--- a/.claude/skills/mendix/write-microflows/SKILL.md
+++ b/.claude/skills/mendix/write-microflows/SKILL.md
@@ -524,14 +524,15 @@ When calling microflows, always check the target's parameter list. Use `describe
 ### SHOW PAGE
 
 ```mdl
--- Open page with parameter (canonical syntax)
-show page Module.EditPage($Product = $Product);
-
--- Widget-style syntax also accepted in microflows
-show page Module.EditPage(Product: $Product);
+-- Open page with parameter
+show page Module.EditPage(Product = $Product);
 ```
 
-Both `($Param = $value)` and `(Param: $value)` syntaxes are accepted in microflow SHOW PAGE statements. Similarly, widget Action: properties accept both `show_page Module.Page(Param: $value)` and `show_page Module.Page($Param = $value)`.
+Every call site binds an argument as `Param = expression`, with no `$` on the
+parameter name: `call microflow`, `show page`, and widget actions
+(`action: show page Module.Page(Param = $value)`) alike. `$Param = $value` and
+`Param: $value` still parse but are deprecated (MDL-DEPR006/007); `mxcli fmt
+--upgrade` rewrites them.
 
 ### CLOSE PAGE
 
@@ -646,8 +647,7 @@ the short `@annotation 'text'` form.
 
 ### Page Navigation Pattern
 ```mdl
-show page Module.Page($Param = $value);               -- Canonical
-show page Module.Page(Param: $value);                  -- Widget-style (also valid)
+show page Module.Page(Param = $value);
 close page;
 show home page;
 ```
@@ -656,24 +656,24 @@ show home page;
 ```mdl
 call microflow ... on error continue;                  -- Ignore error
 call microflow ... on error rollback;                  -- Rollback on error
-call microflow ... on error { log ...; return ...; };  -- Custom handler
-call microflow ... on error without rollback { ... };  -- No rollback
+call microflow ... on error begin log ...; return ...; end error;  -- Custom handler
+call microflow ... on error without rollback begin ... end error;  -- No rollback
 ```
 
 The clause goes on whichever activity may fail, not only on calls:
 
 ```mdl
-declare $Name String = 'default' on error { return 'could not initialise'; };
-$Name = $Other/Name on error { return 'lookup failed'; };
-change $Order (Status = Shipped) on error { log error 'could not ship'; return; };
-log info node 'App' 'starting' on error { return; };
-show message 'saved' on error { return; };
+declare $Name String = 'default' on error begin return 'could not initialise'; end error;
+$Name = $Other/Name on error begin return 'lookup failed'; end error;
+change $Order (Status = Shipped) on error begin log error 'could not ship'; return; end error;
+log info node 'App' 'starting' on error begin return; end error;
+show message 'saved' on error begin return; end error;
 
 -- BLOCKING halts the client until dismissed; after `objects`, before `on error`.
-show message 'Hello {1}' type Warning objects [$Name] blocking;
-validation feedback $Order/Total message 'must be positive' on error { return; };
-show page Module.Page on error { return; };
-close page on error { return; };
+show message 'Hello {1}' type Warning with ({1} = $Name) blocking;
+validation feedback $Order/Total message 'must be positive' on error begin return; end error;
+show page Module.Page on error begin return; end error;
+close page on error begin return; end error;
 ```
 
 **Two limits, both reported rather than silently ignored:**
diff --git a/.claude/skills/mendix/write-microflows/reference/control-flow.md b/.claude/skills/mendix/write-microflows/reference/control-flow.md
index 3ebf37138a..563de70482 100644
--- a/.claude/skills/mendix/write-microflows/reference/control-flow.md
+++ b/.claude/skills/mendix/write-microflows/reference/control-flow.md
@@ -333,17 +333,17 @@ call microflow Module.RiskyOperation() on error continue;
 -- ON ERROR ROLLBACK: Rollback transaction and propagate error
 commit $Order on error rollback;
 
--- ON ERROR { ... }: Custom error handler with rollback
-$Result = call microflow Module.ExternalService(data = $data) on error {
+-- ON ERROR BEGIN ... END ERROR: Custom error handler with rollback
+$Result = call microflow Module.ExternalService(data = $data) on error begin
   log error node 'ServiceError' 'External service failed';
   return $DefaultResult;
-};
+end error;
 
--- ON ERROR WITHOUT ROLLBACK { ... }: Custom handler, keep changes
-commit $Order on error without rollback {
+-- ON ERROR WITHOUT ROLLBACK BEGIN ... END ERROR: Custom handler, keep changes
+commit $Order on error without rollback begin
   log warning node 'CommitError' 'Commit failed, using fallback';
   change $Order (status = 'PENDING');
-};
+end error;
 ```
 
 ### Error Handling Semantics
@@ -352,23 +352,23 @@ commit $Order on error without rollback {
 |--------|----------|
 | `on error continue` | Catch error silently, continue normal flow |
 | `on error rollback` | Rollback database changes, propagate error |
-| `on error { ... }` | Execute handler block, then continue (with rollback) |
-| `on error without rollback { ... }` | Execute handler block, keep database changes |
+| `on error begin ... end error` | Execute handler block, then continue (with rollback) |
+| `on error without rollback begin ... end error` | Execute handler block, keep database changes |
 
 ### RAISE ERROR is handler-only
 
 `raise error;` builds Mendix's **error event**, which *re-raises the error
 currently being handled*. Mendix therefore allows one only where an error is in
-scope — that is, inside an `on error { ... }` block. Studio Pro will not even
+scope — that is, inside an `on error begin ... end error` block. Studio Pro will not even
 let you draw the connection from the normal flow to an error event.
 
 ```mdl
 -- ✅ inside a handler: an error IS in scope
 call microflow Module.RiskyOperation()
-on error {
+on error begin
   log error node 'Module' 'failed, re-raising';
   raise error;
-};
+end error;
 
 -- ❌ on the main flow: MDL084, and mxbuild rejects it with
 --    CE0710 "The main flow cannot join an error flow or end in an error event."
@@ -409,13 +409,13 @@ returns Module.Response as $response
 begin
   -- The call output establishes $response — objects are never declared
   $response = call microflow Module.CallExternalAPI(data = $RequestData)
-    on error without rollback {
+    on error without rollback begin
       log error node 'ExternalAPI' 'API call failed for: ' + $RequestData;
       -- Create error response
       $response = create Module.Response (
         success = false,
         message = 'External service unavailable');
-    };
+    end error;
 
   return $response;
 end;
@@ -431,9 +431,9 @@ knowing which one you are writing.
 | Form | Error path |
 |------|-----------|
 | `on error continue` | No error path at all |
-| `on error [without rollback] { … return/throw }` | Its own path, its own terminator |
-| `on error [without rollback] { }` | **Not a no-op** — falls through to whatever the *enclosing branch* does next |
-| `on error [without rollback] { … join L; }` | Rejoins the normal path at the merge labelled `L` |
+| `on error [without rollback] begin … return/throw end error` | Its own path, its own terminator |
+| `on error [without rollback] begin end error` | **Not a no-op** — falls through to whatever the *enclosing branch* does next |
+| `on error [without rollback] begin … join L; end error` | Rejoins the normal path at the merge labelled `L` |
 
 The empty form is the one that surprises people. It means "on error, do whatever
 the enclosing branch's continuation does" — which in a branch that returns
@@ -443,11 +443,11 @@ something else is a value nowhere in the text. Prefer `join` when you mean it.
 create microflow Module.Post (Payload: String) returns String
 begin
   declare $Status String = 'sent';
-  $r = call microflow Module.Send(Payload = $Payload) on error without rollback {
+  $r = call microflow Module.Send(Payload = $Payload) on error without rollback begin
     log warning node 'Module' 'send failed, degrading';
     set $Status = 'degraded';
     join recovered;
-  };
+  end error;
   join recovered;
 
   merge recovered;
@@ -465,10 +465,10 @@ activity:
 
 ```mdl
 merge attempt;
-$r = call microflow Module.Send(Payload = $Payload) on error without rollback {
+$r = call microflow Module.Send(Payload = $Payload) on error without rollback begin
   log warning node 'Module' 'retrying';
   join attempt;
-};
+end error;
 return $r;
 ```
 
diff --git a/.claude/skills/mendix/write-microflows/reference/integration.md b/.claude/skills/mendix/write-microflows/reference/integration.md
index b342c85232..c6295475e5 100644
--- a/.claude/skills/mendix/write-microflows/reference/integration.md
+++ b/.claude/skills/mendix/write-microflows/reference/integration.md
@@ -95,6 +95,10 @@ send rest request Module.ServiceName.OperationName;
 -- With output variable (RESPONSE JSON operation — maps to entity)
 $Result = send rest request Module.ServiceName.OperationName;
 
+-- With path/query parameters, bound as at every call site: `Param = expression`
+$Result = send rest request Module.ServiceName.GetItem
+    with (id = $ItemId, lang = 'en');
+
 -- With request body (POST/PUT operations)
 $Result = send rest request Module.ServiceName.CreateItem
     body $NewItem;
@@ -181,7 +185,7 @@ rest call delete 'https://api.example.com/items/{1}' with (
 
 **REST CALL response types:**
 - `returns string` — response body as string variable
-- `returns nothing` / `returns none` — ignore response
+- `returns nothing` — ignore response (`returns none` is the deprecated second spelling, MDL-DEPR024)
 - `returns response` — returns `System.HttpResponse` object
 - `returns mapping Module.ImportMapping as Module.Entity` — single object result
 - `returns mapping Module.ImportMapping as list of Module.Entity` — list result
diff --git a/.claude/skills/mendix/write-microflows/reference/pitfalls.md b/.claude/skills/mendix/write-microflows/reference/pitfalls.md
index 01e0dd4abb..615dfe0a09 100644
--- a/.claude/skills/mendix/write-microflows/reference/pitfalls.md
+++ b/.claude/skills/mendix/write-microflows/reference/pitfalls.md
@@ -443,9 +443,9 @@ CATCH
 end TRY;
 
 -- CORRECT: Use ON ERROR on specific activities
-commit $Order on error {
+commit $Order on error begin
   log error 'Commit failed';
-};
+end error;
 ```
 
 ### BREAK/CONTINUE in Loops
diff --git a/.claude/skills/mendix/write-nanoflows/SKILL.md b/.claude/skills/mendix/write-nanoflows/SKILL.md
index afcae59da4..7c1e73f173 100644
--- a/.claude/skills/mendix/write-nanoflows/SKILL.md
+++ b/.claude/skills/mendix/write-nanoflows/SKILL.md
@@ -121,7 +121,7 @@ $JsResult = CALL JAVASCRIPT ACTION NanoflowCommons.SignIn (userName = $Name, pas
 
 ### UI Activities
 ```mdl
-SHOW PAGE Sales.CartDetail ($Cart = $Cart);
+SHOW PAGE Sales.CartDetail (Cart = $Cart);
 CLOSE PAGE;
 SHOW MESSAGE WARNING 'Connection unavailable. Working offline.';
 VALIDATION FEEDBACK $Item/Quantity MESSAGE 'Quantity must be at least 1';
@@ -156,7 +156,7 @@ IF $Cart/ItemCount = 0 THEN
   VALIDATION FEEDBACK $Cart/ItemCount MESSAGE 'Cart is empty';
   RETURN false;
 ELSE
-  SHOW PAGE Sales.Checkout ($Cart = $Cart);
+  SHOW PAGE Sales.Checkout (Cart = $Cart);
   RETURN true;
 END IF;
 ```
@@ -217,11 +217,11 @@ CREATE OR MODIFY NANOFLOW Inventory.NAV_OpenProductDetail (
 )
 FOLDER 'Navigation'
 BEGIN
-  $IsValid = CALL NANOFLOW Inventory.NAV_ValidateProduct ($Product = $Product);
+  $IsValid = CALL NANOFLOW Inventory.NAV_ValidateProduct (Product = $Product);
   IF NOT ($IsValid) THEN
     RETURN;
   END IF;
-  SHOW PAGE Inventory.ProductDetail ($Product = $Product);
+  SHOW PAGE Inventory.ProductDetail (Product = $Product);
 END;
 ```
 
@@ -528,9 +528,9 @@ synchronize unsynchronized;      -- only objects with uncommitted offline change
 synchronize $Order, $Lines;      -- named objects/lists ("Specific" mode)
 
 synchronize all on error continue;
-synchronize all on error without rollback {
+synchronize all on error without rollback begin
   log error 'sync failed';
-};
+end error;
 ```
 
 The mode is always written out, including `all` — the statement says what it does
diff --git a/.claude/skills/mendix/write-workflows/SKILL.md b/.claude/skills/mendix/write-workflows/SKILL.md
index 57972e907c..a610601698 100644
--- a/.claude/skills/mendix/write-workflows/SKILL.md
+++ b/.claude/skills/mendix/write-workflows/SKILL.md
@@ -109,8 +109,7 @@ begin
     outcomes 'Done' { };
 
   -- Call a microflow (server logic); optional name, parameter mapping + outcomes
-  call microflow Module.ACT_Validate as callMicroflow1
-    with (Module.ACT_Validate.Item = '$WorkflowContext');
+  call microflow Module.ACT_Validate(Item = $WorkflowContext) as callMicroflow1;
 
   -- Decision: a boolean or enum exclusive split. The name is optional; give one
   -- when a `jump to` targets it.
@@ -466,11 +465,11 @@ values. The full list and the System **entities** are in `system-module`.
   users` is refused — each omitted clause would reset it.
 - **An AI agent task is `call agent microflow`** (Mendix 11.9+) — the call
   microflow statement stored as `Workflows$AIAgentTaskActivity`, with the same
-  `as`, `comment`, `with (…)`, `outcomes` and boundary events. The microflow is
+  argument list, `as`, `comment`, `outcomes` and boundary events. The microflow is
   where the agent is invoked. Measured on mxbuild 11.13 against the identical
   call microflow, one rule differs: **its microflow must take a parameter**
-  (`CE1590 "Missing parameter"`), usually the context object mapped with
-  `with (Param = '$WorkflowContext')`. Return Boolean or an enumeration to
+  (`CE1590 "Missing parameter"`), usually the context object passed as
+  `(Param = $WorkflowContext)`. Return Boolean or an enumeration to
   branch on the answer.
 - **Handler microflows have fixed signatures** (measured, mxbuild 11.13):
   - `on created microflow` takes exactly `System.WorkflowUserTask` and the context
@@ -525,9 +524,11 @@ values. The full list and the System **entities** are in `system-module`.
   `REPLACE ACTIVITY`. A **required (`not null`) attribute does not exempt it** —
   measured, the empty outcome is still required. Boolean (`true`/`false`)
   decisions do not take one.
-- **A `with (...)` parameter value is a quoted string**, not a bare variable:
-  `with (Request = '$WorkflowContext')`. The unquoted spelling used elsewhere in
-  MDL is a syntax error here (it used to crash the binary — ako/mxcli#1023).
+- **Arguments go right after the callee, as bare expressions**, like every other
+  call: `call microflow HR.Escalate(Request = $WorkflowContext) as callMicroflow1`.
+  The older `with (Request = '$WorkflowContext')`, the expression inside a
+  string, still parses with the same meaning but is deprecated (MDL-DEPR008);
+  `mxcli fmt --upgrade` rewrites it.
 - The context **Parameter entity must be persistent**.
 - Write the context variable as **`$WorkflowContext`**, matching the parameter
   name exactly. Mendix expressions are case-sensitive on 11.9+, so a lowercase
diff --git a/.claude/skills/packs/mendix-vega-charts/references/properties.md b/.claude/skills/packs/mendix-vega-charts/references/properties.md
index 36d3e2bb8b..0b5a9753d7 100644
--- a/.claude/skills/packs/mendix-vega-charts/references/properties.md
+++ b/.claude/skills/packs/mendix-vega-charts/references/properties.md
@@ -61,7 +61,7 @@ To let a click select something:
 
 ```
 selection: SelectedPoint,
-onClick: microflow MyModule.ACT_SelectPoint(Context: $currentObject)
+onClick: microflow MyModule.ACT_SelectPoint(Context = $currentObject)
 ```
 
 `selection` receives the clicked datum as JSON, reduced to its own scalar fields — Vega's
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 40236a6316..702afeaf7e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ### Changed
 
+- **A microflow error handler is `on error [without rollback] begin … end error`; `while` takes `begin … end while` like `loop`** (ako/mxcli#754, R2) — braces hold declarative children and imperative flow is `begin … end <keyword>`, and the error handler was the only brace block inside a microflow. `describe microflow` / `describe nanoflow` now print `commit $O on error begin … end error;` (an empty handler `… on error without rollback begin end error;`), and so do the generated test flows of `mxcli test`. Under the `mdl 1;` preview header a `while` without `begin`, or ending in a bare `end`, is an error; without the header it keeps parsing and warns **MDL-V1-WHILE**, and `mxcli fmt --upgrade --header` inserts the missing words. Measured on the Studio Pro-authored PedApp and TestApp fixtures: the round-trip harness stays green. **Migrating a script:** nothing breaks — `on error { … }` still parses, builds the identical handler, and `check` / `exec` warn **MDL-DEPR540**; `mxcli fmt --upgrade` rewrites it.
+- **One argument form at every call site: `Param = expression`; one text-template form: `with ({1} = …)`** (ako/mxcli#751, R3/R4) — `call microflow`/`nanoflow`/`java action`/…, `execute database query`, `send rest request`, `show page`, and page/button actions and microflow/nanoflow data sources all bind an argument as `Order = $Order`, with no `$` on the parameter name and `=` rather than `:`. A workflow's `call microflow` / `call workflow` takes its arguments the same way, right after the callee, as bare expressions: `call microflow Shop.ACT_Process(Order = $WorkflowContext) as act1 comment 'Process'`. `show message` and `validation feedback` take `with ({1} = $a, {2} = $b)`, like `log` and the REST templates. `describe` writes these forms; it also writes a validation feedback's template arguments, which it used to drop, so describe → exec lost them. Measured on a copy of the Studio Pro-authored TestApp (Mendix 11.14.0): a script in the new forms and the same script in the old forms describe identically, and `mx check` reports 0 errors. **Migrating a script:** nothing breaks — `$Param = e` (**MDL-DEPR006**), `Param: e` (**MDL-DEPR007**), a workflow's `with (Param = '<expression>')` (**MDL-DEPR008**, same meaning: the string's content is the expression) and `objects [..]` / `parameters [..]` (**MDL-DEPR009**) still parse and build the same model, `check` / `exec` warn, and `mxcli fmt --upgrade` rewrites them. A workflow string whose content does not read back as the same bare expression is left in place and reported, and `describe` keeps the string form for such a stored expression.
 - **`describe page` no longer invents names Mendix does not store; `alter page` addresses a DataGrid 2 column by what it shows** (ako/mxcli#749, R12) — a layout grid's rows and columns, a data grid's columns and control bar, a gallery's template and filter, a chart's series and other object-list items have no Name in the model, and describe used to print one it made up (`row row1`, `column col3`, `controlbar controlBar1`, and a data-grid column named after its attribute, so two columns over `FullName` were both `column FullName`). They now print without one — `row { column (DesktopWidth: 6) { … } }`, `column (Attribute: FullName, Caption: 'Full name')` — and the widget name is optional in the grammar for exactly those elements. A column is addressed as `grid column(Attr)`, written as describe writes the attribute (`Owner/Name` over an association), or `grid column('Caption')`; an address two columns share is refused, listing the matches, unless `@n` picks one (`drop dg column(FullName)@2`). A widget Mendix does store a name for still needs one: `check` reports a missing one as **MDL-WIDGET35** and the page builder refuses it. Measured on the Studio Pro-authored PedApp fixture: the round-trip harness stays green, and `mx check` 11.13 shows no new error after `alter page … column(…)` edits and a create with nameless rows, grid columns and gallery slots. **Migrating a script:** nothing breaks — a name written on one of those elements still parses, is ignored as before, and `check` / `exec` warn **MDL-DEPR005**; `mxcli fmt --upgrade` removes it. The older `grid.Column` address keeps working. The info-level MDL-WIDGET16 note about dropped column names is gone, replaced by that warning.
 - **`describe microflow` / `describe nanoflow` leave out layout the engine derives** (ako/mxcli#748, R12) — `@position`, `@merge`, `@anchor` and `@curve` now follow the rule `@start` has followed since #951: an annotation is printed only when re-executing the description without it would put the node, or route the flow, somewhere else. That is decided by building the flow again from the description exactly as `create or modify` would (nothing is written) and comparing it node by node with the stored flow, pinning the first misplaced node of each run and repeating until nothing moves — so a statement placed after a hand-placed one needs no annotation of its own. A flow authored with no annotations describes with none; a Studio Pro-drawn flow keeps its layout. Measured on the Studio Pro-authored PedApp fixture: re-executing the new description lands every node, anchor and curve where the old one did (all 16 microflows, and all 224 microflows of a second Studio Pro project that re-execute at all); there the output barely shrinks (433 layout lines to 430), as it should, while after `mxcli layout flows` the 24 flows it could lay out go from 163 layout lines to 3. **Migrating a script:** nothing to do — every annotation still parses and means the same, and committed describe output re-executes as before; only a fresh `describe` is shorter.
 
diff --git a/cmd/mxcli/cmd_fmt.go b/cmd/mxcli/cmd_fmt.go
index 1bf949c83e..cb11464594 100644
--- a/cmd/mxcli/cmd_fmt.go
+++ b/cmd/mxcli/cmd_fmt.go
@@ -21,7 +21,12 @@ var fmtCmd = &cobra.Command{
 	Use:   "fmt [file.mdl | -]",
 	Short: "Format an MDL file",
 	Long: `Format an MDL script file with consistent styling:
-  - Uppercase MDL keywords
+  - Lowercase MDL keywords, the canonical case. Only words the parse tree shows
+    are keywords change: a name spelled like a keyword (Issue64.User, an
+    attribute Title), a property key (Folder:) and a CamelCase value
+    (ButtonStyle: Success) keep their case, and so do expressions, XPath, OQL
+    and SQL, which are stored as written. Formatting never changes what a
+    script builds.
   - Normalize indentation (2-space units)
   - Remove trailing whitespace
   - Normalize blank lines
diff --git a/cmd/mxcli/lsp_completions_gen.go b/cmd/mxcli/lsp_completions_gen.go
index 19568e7d73..0b72282c2e 100644
--- a/cmd/mxcli/lsp_completions_gen.go
+++ b/cmd/mxcli/lsp_completions_gen.go
@@ -15,7 +15,7 @@ var mdlGeneratedKeywords = []protocol.CompletionItem{
 	{Label: "SORT BY", Kind: protocol.CompletionItemKindKeyword, Detail: "Multi-word keyword"},
 	{Label: "SEARCH BY", Kind: protocol.CompletionItemKindKeyword, Detail: "Multi-word keyword"},
 	{Label: "NON-PERSISTENT", Kind: protocol.CompletionItemKindKeyword, Detail: "Multi-word keyword"},
-	{Label: "REFERENCE_SET", Kind: protocol.CompletionItemKindKeyword, Detail: "Multi-word keyword"},
+	{Label: "REFERENCESET", Kind: protocol.CompletionItemKindKeyword, Detail: "Multi-word keyword"},
 	{Label: "LIST OF", Kind: protocol.CompletionItemKindKeyword, Detail: "Multi-word keyword"},
 	{Label: "DELETE AND REFERENCES", Kind: protocol.CompletionItemKindKeyword, Detail: "Multi-word keyword"},
 	{Label: "DELETE BUT KEEP REFERENCES", Kind: protocol.CompletionItemKindKeyword, Detail: "Multi-word keyword"},
@@ -314,8 +314,8 @@ var mdlGeneratedKeywords = []protocol.CompletionItem{
 	{Label: "GROUPBOX", Kind: protocol.CompletionItemKindKeyword, Detail: "Widget keyword"},
 	{Label: "VISIBLE", Kind: protocol.CompletionItemKindKeyword, Detail: "Widget keyword"},
 	{Label: "SAVECHANGES", Kind: protocol.CompletionItemKindKeyword, Detail: "Widget keyword"},
-	{Label: "SAVE_CHANGES", Kind: protocol.CompletionItemKindKeyword, Detail: "Widget keyword"},
-	{Label: "CANCEL_CHANGES", Kind: protocol.CompletionItemKindKeyword, Detail: "Widget keyword"},
+	{Label: "SAVE CHANGES", Kind: protocol.CompletionItemKindKeyword, Detail: "Widget keyword"},
+	{Label: "CANCEL CHANGES", Kind: protocol.CompletionItemKindKeyword, Detail: "Widget keyword"},
 	{Label: "CLOSE_PAGE", Kind: protocol.CompletionItemKindKeyword, Detail: "Widget keyword"},
 	{Label: "SHOW_PAGE", Kind: protocol.CompletionItemKindKeyword, Detail: "Widget keyword"},
 	{Label: "DELETE_ACTION", Kind: protocol.CompletionItemKindKeyword, Detail: "Widget keyword"},
@@ -324,7 +324,7 @@ var mdlGeneratedKeywords = []protocol.CompletionItem{
 	{Label: "CALL_MICROFLOW", Kind: protocol.CompletionItemKindKeyword, Detail: "Widget keyword"},
 	{Label: "CALL_NANOFLOW", Kind: protocol.CompletionItemKindKeyword, Detail: "Widget keyword"},
 	{Label: "OPEN_LINK", Kind: protocol.CompletionItemKindKeyword, Detail: "Widget keyword"},
-	{Label: "SIGN_OUT", Kind: protocol.CompletionItemKindKeyword, Detail: "Widget keyword"},
+	{Label: "SIGN OUT", Kind: protocol.CompletionItemKindKeyword, Detail: "Widget keyword"},
 	{Label: "CANCEL", Kind: protocol.CompletionItemKindKeyword, Detail: "Widget keyword"},
 	{Label: "PRIMARY", Kind: protocol.CompletionItemKindKeyword, Detail: "Widget keyword"},
 	{Label: "SUCCESS", Kind: protocol.CompletionItemKindKeyword, Detail: "Widget keyword"},
@@ -663,7 +663,7 @@ var mdlGeneratedKeywords = []protocol.CompletionItem{
 	{Label: "UNLOCK", Kind: protocol.CompletionItemKindKeyword, Detail: "Keyword"},
 	{Label: "REASON", Kind: protocol.CompletionItemKindKeyword, Detail: "Keyword"},
 	{Label: "OPEN", Kind: protocol.CompletionItemKindKeyword, Detail: "Keyword"},
-	{Label: "COMPLETE_TASK", Kind: protocol.CompletionItemKindKeyword, Detail: "Keyword"},
+	{Label: "COMPLETE TASK", Kind: protocol.CompletionItemKindKeyword, Detail: "Keyword"},
 
 	// Operator
 	{Label: "MOD", Kind: protocol.CompletionItemKindKeyword, Detail: "Operator"},
diff --git a/cmd/mxcli/syntax/features_domain_model.go b/cmd/mxcli/syntax/features_domain_model.go
index c16b2a2edd..8f094e8420 100644
--- a/cmd/mxcli/syntax/features_domain_model.go
+++ b/cmd/mxcli/syntax/features_domain_model.go
@@ -69,7 +69,7 @@ func init() {
 			"generalization", "extends", "event handler", "attribute",
 		},
 		Syntax:  "CREATE PERSISTENT ENTITY Module.Name (\n  Attr: Type [constraints],\n  ...\n) [INDEX (attr1)];\n\n-- Documentation is the /** … */ doc comment before the statement.\n-- (A `COMMENT 'text'` option existed, set nothing, and has been removed.)\n\nCREATE NON-PERSISTENT ENTITY Module.Name (...);\n\nCREATE PERSISTENT ENTITY Module.Name EXTENDS Module.Parent (...);",
-		Example: "/** Stores customer information. */\nCREATE PERSISTENT ENTITY MyModule.Customer (\n  Name: String(100) NOT NULL ERROR 'Name is required',\n  Email: String(200) UNIQUE,\n  Balance: Decimal DEFAULT 0,\n  IsActive: Boolean DEFAULT true,\n  Status: Enumeration(MyModule.CustomerType)\n)\nINDEX (Email);",
+		Example: "/** Stores customer information. */\nCREATE PERSISTENT ENTITY MyModule.Customer (\n  Name: String(100) NOT NULL ERROR MESSAGE 'Name is required',\n  Email: String(200) UNIQUE,\n  Balance: Decimal DEFAULT 0,\n  IsActive: Boolean DEFAULT true,\n  Status: Enumeration(MyModule.CustomerType)\n)\nINDEX (Email);",
 		SeeAlso: []string{"domain-model.entity.create", "domain-model.entity.alter", "domain-model.entity.attributes"},
 	})
 
@@ -287,8 +287,8 @@ func init() {
 			"many-to-one", "many-to-many", "foreign key",
 			"owner", "delete behavior",
 		},
-		Syntax:  "[@anchor(from: (x, y), to: (x, y))]\nCREATE [OR MODIFY] ASSOCIATION Module.Name\n  FROM Module.FromEntity TO Module.ToEntity\n  TYPE Reference|ReferenceSet\n  [OWNER Default|Both]\n  [DELETE_BEHAVIOR behavior]\n  [COMMENT 'text'];\nALTER ASSOCIATION Module.Name SET ANCHOR FROM (x, y) TO (x, y);\nDROP ASSOCIATION Module.Name;\n\nOR MODIFY: updates type/owner/delete behavior in-place, preserves UUID.\n\n@anchor sets the LINE ANCHORS — where the connector attaches to each entity box\nin the domain model editor — as a PERCENTAGE of the box (0..100, whole numbers).\n`from` is the FROM entity's box, `to` the TO entity's: (0, 50) is the middle of\nthe left edge, (100, 50) the right, (50, 100) the bottom centre. Omitting an end\nPRESERVES what is stored, so a CREATE OR MODIFY about something else never\nflattens a hand-tuned line. Cross-module associations have no anchors.\n\nDROP reconciles the entity access rules that named the association, and is\nREFUSED while a message definition still exposes it (that one cannot be\nreconciled -- removing the member would change a published contract). The\nrefusal prints the `alter message definition ... drop member` statement for\neach definition, ready to run.",
-		Example: "-- Many-to-one\nCREATE ASSOCIATION Shop.Order_Customer\n  FROM Shop.Order TO Shop.Customer\n  TYPE Reference\n  OWNER Default\n  DELETE_BEHAVIOR DELETE_BUT_KEEP_REFERENCES;\n\n-- Many-to-many\nCREATE ASSOCIATION Shop.Product_Tag\n  FROM Shop.Product TO Shop.Tag\n  TYPE ReferenceSet\n  OWNER Both;\n\n-- Line leaving the bottom of Order and entering the top of Customer\n@anchor(from: (50, 100), to: (50, 0))\nCREATE ASSOCIATION Shop.Order_Customer\n  FROM Shop.Order TO Shop.Customer;\n\n-- Retune the line without restating the association\nALTER ASSOCIATION Shop.Order_Customer SET ANCHOR FROM (0, 54) TO (100, 54);",
+		Syntax:  "[@anchor(from: (x, y), to: (x, y))]\nCREATE [OR MODIFY] ASSOCIATION Module.Name\n  FROM Module.FromEntity TO Module.ToEntity\n  TYPE Reference|ReferenceSet\n  [OWNER Default|Both]\n  [ON DELETE CASCADE|RESTRICT|SET NULL [ERROR MESSAGE 'text']]\n  [COMMENT 'text'];\nALTER ASSOCIATION Module.Name SET ANCHOR FROM (x, y) TO (x, y);\nDROP ASSOCIATION Module.Name;\n\nOR MODIFY: updates type/owner/delete behavior in-place, preserves UUID.\n\n@anchor sets the LINE ANCHORS — where the connector attaches to each entity box\nin the domain model editor — as a PERCENTAGE of the box (0..100, whole numbers).\n`from` is the FROM entity's box, `to` the TO entity's: (0, 50) is the middle of\nthe left edge, (100, 50) the right, (50, 100) the bottom centre. Omitting an end\nPRESERVES what is stored, so a CREATE OR MODIFY about something else never\nflattens a hand-tuned line. Cross-module associations have no anchors.\n\nDROP reconciles the entity access rules that named the association, and is\nREFUSED while a message definition still exposes it (that one cannot be\nreconciled -- removing the member would change a published contract). The\nrefusal prints the `alter message definition ... drop member` statement for\neach definition, ready to run.",
+		Example: "-- Many-to-one\nCREATE ASSOCIATION Shop.Order_Customer\n  FROM Shop.Order TO Shop.Customer\n  TYPE Reference\n  OWNER Default\n  ON DELETE SET NULL;\n\n-- Many-to-many\nCREATE ASSOCIATION Shop.Product_Tag\n  FROM Shop.Product TO Shop.Tag\n  TYPE ReferenceSet\n  OWNER Both;\n\n-- Line leaving the bottom of Order and entering the top of Customer\n@anchor(from: (50, 100), to: (50, 0))\nCREATE ASSOCIATION Shop.Order_Customer\n  FROM Shop.Order TO Shop.Customer;\n\n-- Retune the line without restating the association\nALTER ASSOCIATION Shop.Order_Customer SET ANCHOR FROM (0, 54) TO (100, 54);",
 		SeeAlso: []string{"domain-model.association.create", "domain-model.association.anchor", "domain-model.association.delete-behavior"},
 	})
 
@@ -300,8 +300,8 @@ func init() {
 			"reference set", "junction table", "foreign key",
 			"owner default", "owner both", "storage column", "storage table",
 		},
-		Syntax:  "CREATE [OR MODIFY] ASSOCIATION Module.AssociationName\n  FROM Module.FromEntity TO Module.ToEntity\n  TYPE Reference|ReferenceSet\n  [OWNER Default|Both]\n  [STORAGE COLUMN|TABLE]\n  [DELETE_BEHAVIOR behavior]\n  [COMMENT 'text'];\n\nDirection:\n  FROM = entity holding the FK (the \"many\" side)\n  TO   = entity being referenced (the \"one\" side)\n\nTypes:\n  Reference    = Many-to-one (FK column on FROM table)\n  ReferenceSet = Many-to-many (junction table)\n\nOR MODIFY: updates in-place, preserves UUID. Safe to re-run.",
-		Example: "-- Many-to-one with delete behavior\nCREATE ASSOCIATION Shop.Order_Customer\n  FROM Shop.Order TO Shop.Customer\n  TYPE Reference\n  OWNER Default\n  DELETE_BEHAVIOR PREVENT;\n\n-- Many-to-many\nCREATE ASSOCIATION Shop.Product_Tag\n  FROM Shop.Product TO Shop.Tag\n  TYPE ReferenceSet\n  OWNER Both;\n\n-- Idempotent update\nCREATE OR MODIFY ASSOCIATION Shop.Order_Customer\n  FROM Shop.Order TO Shop.Customer\n  TYPE Reference\n  OWNER Default\n  DELETE_BEHAVIOR CASCADE;",
+		Syntax:  "CREATE [OR MODIFY] ASSOCIATION Module.AssociationName\n  FROM Module.FromEntity TO Module.ToEntity\n  TYPE Reference|ReferenceSet\n  [OWNER Default|Both]\n  [STORAGE COLUMN|TABLE]\n  [ON DELETE CASCADE|RESTRICT|SET NULL [ERROR MESSAGE 'text']]\n  [COMMENT 'text'];\n\nDirection:\n  FROM = entity holding the FK (the \"many\" side)\n  TO   = entity being referenced (the \"one\" side)\n\nTypes:\n  Reference    = Many-to-one (FK column on FROM table)\n  ReferenceSet = Many-to-many (junction table)\n\nOR MODIFY: updates in-place, preserves UUID. Safe to re-run.",
+		Example: "-- Many-to-one with delete behavior\nCREATE ASSOCIATION Shop.Order_Customer\n  FROM Shop.Order TO Shop.Customer\n  TYPE Reference\n  OWNER Default\n  ON DELETE RESTRICT;\n\n-- Many-to-many\nCREATE ASSOCIATION Shop.Product_Tag\n  FROM Shop.Product TO Shop.Tag\n  TYPE ReferenceSet\n  OWNER Both;\n\n-- Idempotent update\nCREATE OR MODIFY ASSOCIATION Shop.Order_Customer\n  FROM Shop.Order TO Shop.Customer\n  TYPE Reference\n  OWNER Default\n  ON DELETE CASCADE;",
 		SeeAlso: []string{"domain-model.association.delete-behavior", "domain-model.entity.create"},
 	})
 
@@ -327,7 +327,7 @@ func init() {
 			"A fractional coordinate is refused: Mendix stores two integers and its\n" +
 			"loader will not OPEN a project whose anchor is fractional.\n" +
 			"Cross-module associations have no anchors — Mendix stores none for them.",
-		Example: "-- Line leaving the bottom of Order, entering the top of Customer\n@anchor(from: (50, 100), to: (50, 0))\nCREATE ASSOCIATION Shop.Order_Customer\n  FROM Shop.Order TO Shop.Customer\n  TYPE Reference;\n\n-- Retune the line without restating the association\nALTER ASSOCIATION Shop.Order_Customer SET ANCHOR FROM (0, 54) TO (100, 54);\n\n-- Says nothing about anchors: whatever the line was dragged to survives\nCREATE OR MODIFY ASSOCIATION Shop.Order_Customer\n  FROM Shop.Order TO Shop.Customer\n  DELETE_BEHAVIOR CASCADE;",
+		Example: "-- Line leaving the bottom of Order, entering the top of Customer\n@anchor(from: (50, 100), to: (50, 0))\nCREATE ASSOCIATION Shop.Order_Customer\n  FROM Shop.Order TO Shop.Customer\n  TYPE Reference;\n\n-- Retune the line without restating the association\nALTER ASSOCIATION Shop.Order_Customer SET ANCHOR FROM (0, 54) TO (100, 54);\n\n-- Says nothing about anchors: whatever the line was dragged to survives\nCREATE OR MODIFY ASSOCIATION Shop.Order_Customer\n  FROM Shop.Order TO Shop.Customer\n  ON DELETE CASCADE;",
 		SeeAlso: []string{"domain-model.association.create", "domain-model.entity"},
 	})
 
@@ -340,7 +340,7 @@ func init() {
 			"delete and references", "delete but keep references",
 			"delete if no references", "referential integrity",
 		},
-		Syntax: "ON DELETE <action> [ERROR_MESSAGE '<text>']\n" +
+		Syntax: "ON DELETE <action> [ERROR MESSAGE '<text>']\n" +
 			"  ON DELETE SET NULL   Keep the referencing objects, clear the reference (default)\n" +
 			"  ON DELETE CASCADE    Delete the referencing objects too\n" +
 			"  ON DELETE RESTRICT   Refuse the delete while references exist\n\n" +
@@ -349,19 +349,18 @@ func init() {
 			"key, TO is referenced -- so `FROM Order TO Customer ON DELETE RESTRICT` means\n" +
 			"deleting a CUSTOMER is refused while Orders reference it, the same way it would\n" +
 			"in CREATE TABLE.\n\n" +
-			"ERROR_MESSAGE is what the user sees when a RESTRICT delete is refused (Studio\n" +
+			"ERROR MESSAGE is what the user sees when a RESTRICT delete is refused (Studio\n" +
 			"Pro's \"Error message if 'X' object cannot be deleted\"). SQL has no equivalent;\n" +
 			"this is a Mendix extension. Omitting it stores an empty message.\n\n" +
-			"The older spelling still works and means the same thing:\n" +
-			"  DELETE_BEHAVIOR DELETE_BUT_KEEP_REFERENCES | DELETE_AND_REFERENCES\n" +
-			"                | DELETE_IF_NO_REFERENCES | CASCADE | PREVENT\n" +
-			"                [ERROR_MESSAGE '<text>']\n" +
-			"DESCRIBE emits the ON DELETE form, because it says which side is governed.",
+			"The older DELETE_BEHAVIOR clause (DELETE_AND_REFERENCES | CASCADE,\n" +
+			"DELETE_IF_NO_REFERENCES | PREVENT, DELETE_BUT_KEEP_REFERENCES) still parses and\n" +
+			"means the same thing, but is deprecated (MDL-DEPR022); `mxcli fmt --upgrade`\n" +
+			"rewrites it. DESCRIBE emits the ON DELETE form, because it says which side is governed.",
 		Example: "CREATE ASSOCIATION Shop.Order_Customer\n" +
 			"  FROM Shop.Order TO Shop.Customer\n" +
 			"  TYPE Reference\n" +
 			"  ON DELETE RESTRICT\n" +
-			"    ERROR_MESSAGE 'A customer with orders cannot be deleted';\n\n" +
+			"    ERROR MESSAGE 'A customer with orders cannot be deleted';\n\n" +
 			"CREATE ASSOCIATION Shop.Order_Lines\n" +
 			"  FROM Shop.OrderLine TO Shop.Order\n" +
 			"  TYPE Reference\n" +
diff --git a/cmd/mxcli/syntax/features_integration.go b/cmd/mxcli/syntax/features_integration.go
index cb98e9b715..48e1093fbf 100644
--- a/cmd/mxcli/syntax/features_integration.go
+++ b/cmd/mxcli/syntax/features_integration.go
@@ -148,7 +148,7 @@ func init() {
 			"-- Take a $Request: System.HttpRequest parameter to see the query string.\n" +
 			"-- MDL-ODATA02 and MDL-ODATA03 flag a read microflow that takes none.",
 		Example: "create persistent entity Shop.Customer (\n" +
-			"  Email: string(200) unique error 'unique' required error 'required',\n" +
+			"  Email: string(200) unique error message 'unique' required error message 'required',\n" +
 			"  Name:  string(200)\n" +
 			");\n" +
 			"\n" +
@@ -218,7 +218,7 @@ func init() {
 			"RETURNS Module.MyFile                   -- store the body in a file document\n" +
 			"RETURNS MAPPING Module.IMM AS Module.E  -- apply an import mapping (single object)\n" +
 			"RETURNS MAPPING Module.IMM AS LIST OF Module.E\n" +
-			"RETURNS NONE | NOTHING                  -- ignore the response\n\n" +
+			"RETURNS NOTHING                         -- ignore the response\n\n" +
 			"-- The file document form takes a SPECIALIZATION of System.FileDocument.\n" +
 			"-- Mendix rejects the base type as a return type (CE0362), and MDL064\n" +
 			"-- reports that before the write. There is no matching form for an\n" +
diff --git a/cmd/mxcli/syntax/features_microflow.go b/cmd/mxcli/syntax/features_microflow.go
index 74d1d3af0e..660db845fc 100644
--- a/cmd/mxcli/syntax/features_microflow.go
+++ b/cmd/mxcli/syntax/features_microflow.go
@@ -23,7 +23,7 @@ func init() {
 			"offline first", "nanoflow",
 		},
 		Syntax:  "SYNCHRONIZE ALL [ON ERROR ...];\nSYNCHRONIZE UNSYNCHRONIZED [ON ERROR ...];   -- Mendix 9.4+\nSYNCHRONIZE $Var[, $Var...] [ON ERROR ...];\n\nNanoflow only: in a microflow this is MDL057 / CE0009.",
-		Example: "CREATE NANOFLOW MyModule.NF_Sync ($Order: MyModule.Order)\nBEGIN\n  SYNCHRONIZE ALL;\n  SYNCHRONIZE UNSYNCHRONIZED;\n  SYNCHRONIZE $Order;\n  SYNCHRONIZE ALL ON ERROR WITHOUT ROLLBACK {\n    LOG ERROR 'sync failed';\n  };\nEND;",
+		Example: "CREATE NANOFLOW MyModule.NF_Sync ($Order: MyModule.Order)\nBEGIN\n  SYNCHRONIZE ALL;\n  SYNCHRONIZE UNSYNCHRONIZED;\n  SYNCHRONIZE $Order;\n  SYNCHRONIZE ALL ON ERROR WITHOUT ROLLBACK BEGIN\n    LOG ERROR 'sync failed';\n  END ERROR;\nEND;",
 		SeeAlso: []string{"microflow.nanoflow", "microflow.error-handling"},
 	})
 
@@ -117,7 +117,10 @@ func init() {
 			"loop", "while", "break", "continue", "return",
 			"conditional", "branch", "iterate",
 		},
-		Syntax:  "IF condition THEN\n  ...\nELSIF condition THEN\n  ...\nELSE\n  ...\nEND IF;\n\nLOOP $Item IN $List BEGIN ... END LOOP;\nWHILE condition BEGIN ... END WHILE;\nRETURN $Value;\nRETURN empty;",
+		Syntax: "IF condition THEN\n  ...\nELSIF condition THEN\n  ...\nELSE\n  ...\nEND IF;\n\nLOOP $Item IN $List BEGIN ... END LOOP;\nWHILE condition BEGIN ... END WHILE;\nRETURN $Value;\nRETURN empty;\n\n" +
+			"-- WHILE takes BEGIN and END WHILE like LOOP. Without the `mdl 1;` header both\n" +
+			"-- may still be left out, with a warning (MDL-V1-WHILE); under `mdl 1;` that\n" +
+			"-- is an error. `mxcli fmt --upgrade --header` inserts them.",
 		Example: "IF $Customer = empty THEN\n  LOG ERROR NODE 'Svc' 'Not found';\n  RETURN empty;\nELSIF $Customer/Active = false THEN\n  LOG WARNING 'Inactive customer';\nELSE\n  CHANGE $Customer (LastAccess = [%CurrentDateTime%]);\nEND IF;\n\nLOOP $Item IN $OrderLines BEGIN\n  COMMIT $Item;\nEND LOOP;",
 		SeeAlso: []string{"microflow.variables", "microflow.error-handling", "microflow.splits"},
 	})
@@ -160,7 +163,11 @@ func init() {
 			"rollback", "throw", "exception", "try", "catch",
 		},
 		Syntax: "COMMIT $Obj ON ERROR CONTINUE;\nCOMMIT $Obj ON ERROR ROLLBACK;\n" +
-			"COMMIT $Obj ON ERROR { <statements> };\nCOMMIT $Obj ON ERROR WITHOUT ROLLBACK { <statements> };\n\n" +
+			"COMMIT $Obj ON ERROR BEGIN <statements> END ERROR;\nCOMMIT $Obj ON ERROR WITHOUT ROLLBACK BEGIN <statements> END ERROR;\n\n" +
+			"-- The handler is flow, so it is BEGIN ... END ERROR like IF, LOOP and WHILE.\n" +
+			"-- The brace form `ON ERROR { ... }` still parses and warns MDL-DEPR540;\n" +
+			"-- `mxcli fmt --upgrade` rewrites it.\n" +
+			"--\n" +
 			"-- The clause goes on the ACTIVITY that may fail. Most statements take it:\n" +
 			"-- DECLARE, SET, CREATE, CHANGE, COMMIT, DELETE, RETRIEVE, every CALL,\n" +
 			"-- LOG, SHOW PAGE, CLOSE PAGE, SHOW MESSAGE, VALIDATION FEEDBACK,\n" +
@@ -189,7 +196,7 @@ func init() {
 			"-- flow, so a variable created after the merge is out of scope on the error\n" +
 			"-- path (CE0108). End the handler, or expect that.\n" +
 			"--\n" +
-			"-- An EMPTY handler `{ }` is not a no-op: it means \"on error, do whatever\n" +
+			"-- An EMPTY handler `BEGIN END ERROR` is not a no-op: it means \"on error, do whatever\n" +
 			"-- the enclosing branch does next\". Say where the path goes with JOIN.\n" +
 			"--\n" +
 			"-- RAISE ERROR re-raises the error being handled, so it belongs INSIDE an\n" +
@@ -198,9 +205,9 @@ func init() {
 			"-- the shape, and mxbuild rejects it with CE0710 \"The main flow cannot\n" +
 			"-- join an error flow or end in an error event.\". To fail deliberately\n" +
 			"-- from the main flow, call a Java action that throws.",
-		Example: "COMMIT $Order ON ERROR {\n  LOG ERROR 'Failed to save order';\n  RAISE ERROR;\n};\n\n" +
-			"COMMIT $Batch ON ERROR WITHOUT ROLLBACK {\n  LOG WARNING 'Batch save failed, continuing';\n};\n\n" +
-			"DECLARE $Name String = 'default' ON ERROR {\n  RETURN 'could not initialise';\n};",
+		Example: "COMMIT $Order ON ERROR BEGIN\n  LOG ERROR 'Failed to save order';\n  RAISE ERROR;\nEND ERROR;\n\n" +
+			"COMMIT $Batch ON ERROR WITHOUT ROLLBACK BEGIN\n  LOG WARNING 'Batch save failed, continuing';\nEND ERROR;\n\n" +
+			"DECLARE $Name String = 'default' ON ERROR BEGIN\n  RETURN 'could not initialise';\nEND ERROR;",
 		SeeAlso: []string{"microflow.control-flow"},
 	})
 
@@ -295,14 +302,14 @@ func init() {
 			"-- Forward and backward references both resolve, so declaration order is\n" +
 			"-- free. A backward one is how a retry loop is written:\n" +
 			"--   MERGE attempt;\n" +
-			"--   $r = CALL MICROFLOW M.Post() ON ERROR WITHOUT ROLLBACK { JOIN attempt; };\n" +
+			"--   $r = CALL MICROFLOW M.Post() ON ERROR WITHOUT ROLLBACK BEGIN JOIN attempt; END ERROR;\n" +
 			"--\n" +
 			"-- What this is FOR. Nested IF can only describe a graph whose branches\n" +
 			"-- pair up. Two cases do not:\n" +
 			"--   1. An ERROR path that rejoins the normal one somewhere other than the\n" +
 			"--      enclosing branch's own continuation. Without JOIN the only\n" +
 			"--      spellings are \"terminate\" and \"fall through\", and DESCRIBE used to\n" +
-			"--      emit an empty `{ }` for anything else — MDL that re-executes to a\n" +
+			"--      emit an empty handler for anything else — MDL that re-executes to a\n" +
 			"--      DIFFERENT graph, with no warning.\n" +
 			"--   2. Crossed branches: an inner split's branch landing where an outer\n" +
 			"--      split's branch lands. No nesting of IF reproduces that.\n" +
@@ -326,11 +333,11 @@ func init() {
 		Example: "CREATE MICROFLOW M.Post (Payload: String) RETURNS String\n" +
 			"BEGIN\n" +
 			"  DECLARE $Status String = 'sent';\n" +
-			"  $r = CALL MICROFLOW M.Send(Payload = $Payload) ON ERROR WITHOUT ROLLBACK {\n" +
+			"  $r = CALL MICROFLOW M.Send(Payload = $Payload) ON ERROR WITHOUT ROLLBACK BEGIN\n" +
 			"    LOG WARNING NODE 'M' 'send failed, degrading';\n" +
 			"    SET $Status = 'degraded';\n" +
 			"    JOIN recovered;\n" +
-			"  };\n" +
+			"  END ERROR;\n" +
 			"  JOIN recovered;\n" +
 			"  MERGE recovered;\n" +
 			"  RETURN $Status;\n" +
@@ -501,8 +508,8 @@ func init() {
 			"show page", "open page", "close page", "display page",
 			"navigate", "page action",
 		},
-		Syntax:  "SHOW PAGE Module.Page;\nSHOW PAGE Module.Page ($Param = $value);\nCLOSE PAGE;",
-		Example: "SHOW PAGE MyModule.OrderDetail ($Order = $NewOrder);\nCLOSE PAGE;",
+		Syntax:  "SHOW PAGE Module.Page;\nSHOW PAGE Module.Page (Param = $value);\nCLOSE PAGE;",
+		Example: "SHOW PAGE MyModule.OrderDetail (Order = $NewOrder);\nCLOSE PAGE;",
 		SeeAlso: []string{"page"},
 	})
 
@@ -592,8 +599,8 @@ func init() {
 			"validation", "feedback", "validation feedback",
 			"error message", "field error", "form validation",
 		},
-		Syntax:  "VALIDATION FEEDBACK $Obj/Attr MESSAGE 'error text';\nVALIDATION FEEDBACK $Obj/Attr MESSAGE '{1} is invalid'\n  OBJECTS [$Value];",
-		Example: "VALIDATION FEEDBACK $Order/Quantity MESSAGE 'Quantity must be positive';\nVALIDATION FEEDBACK $Customer/Email MESSAGE '{1} is not valid'\n  OBJECTS [$Customer/Email];",
+		Syntax:  "VALIDATION FEEDBACK $Obj/Attr MESSAGE 'error text';\nVALIDATION FEEDBACK $Obj/Attr MESSAGE '{1} is invalid'\n  WITH ({1} = $Value);",
+		Example: "VALIDATION FEEDBACK $Order/Quantity MESSAGE 'Quantity must be positive';\nVALIDATION FEEDBACK $Customer/Email MESSAGE '{1} is not valid'\n  WITH ({1} = $Customer/Email);",
 		SeeAlso: []string{"microflow.error-handling"},
 	})
 
diff --git a/cmd/mxcli/syntax/features_misc.go b/cmd/mxcli/syntax/features_misc.go
index 2334c55fa4..dcf2255adf 100644
--- a/cmd/mxcli/syntax/features_misc.go
+++ b/cmd/mxcli/syntax/features_misc.go
@@ -695,11 +695,11 @@ SHOW REFERENCES TO Val.EmailAddress;`,
 		},
 		Syntax: `CREATE VALIDATION RULE FOR Module.Entity.Attribute
   REGEX Module.PatternName
-  FEEDBACK '<message>';
+  ERROR MESSAGE '<message>';
 
 CREATE VALIDATION RULE FOR Module.Entity.Attribute
   RANGE FROM <literal> TO <literal>
-  FEEDBACK '<message>';
+  ERROR MESSAGE '<message>';
 
 The bounds are inclusive and either may be omitted:
   RANGE FROM 1 TO 100   between 1 and 100
@@ -720,24 +720,24 @@ CE0135 "No regular expression specified" at build time.
 REQUIRED and UNIQUE rules are written as attribute constraints instead, on
 CREATE ENTITY or ALTER ENTITY:
   ALTER ENTITY Shop.Product MODIFY ATTRIBUTE Email string(200)
-    NOT NULL ERROR 'Email is required';
+    NOT NULL ERROR MESSAGE 'Email is required';
   ALTER ENTITY Shop.Product MODIFY ATTRIBUTE Code string(20)
-    UNIQUE ERROR 'Code must be unique';`,
+    UNIQUE ERROR MESSAGE 'Code must be unique';`,
 		Example: `CREATE REGULAR EXPRESSION Shop.EmailPattern (
   Expression: '^[^@\s]+@[^@\s]+\.[^@\s]+$'
 );
 
 CREATE VALIDATION RULE FOR Shop.Customer.Email
   REGEX Shop.EmailPattern
-  FEEDBACK 'Enter a valid email address';
+  ERROR MESSAGE 'Enter a valid email address';
 
 CREATE VALIDATION RULE FOR Shop.Booking.Guests
   RANGE FROM 1 TO 100
-  FEEDBACK 'Between 1 and 100 guests are allowed';
+  ERROR MESSAGE 'Between 1 and 100 guests are allowed';
 
 CREATE VALIDATION RULE FOR Shop.Product.Price
   RANGE FROM 0
-  FEEDBACK 'Price cannot be negative';`,
+  ERROR MESSAGE 'Price cannot be negative';`,
 	})
 
 	// ── Scheduled events ────────────────────────────────────────────────
diff --git a/cmd/mxcli/syntax/features_page.go b/cmd/mxcli/syntax/features_page.go
index c8952bf9a9..81e6b357bd 100644
--- a/cmd/mxcli/syntax/features_page.go
+++ b/cmd/mxcli/syntax/features_page.go
@@ -13,7 +13,7 @@ func init() {
 			"widget", "layout", "screen",
 		},
 		Syntax:  "CREATE PAGE Module.Name\n  (\n    Title: 'Page Title',\n    Layout: Module.LayoutName\n    [, Params: { $Param: Module.Entity }]\n    [, Url: 'page-url']\n    [, Folder: 'FolderPath']\n    [, Variables: { $var: Boolean = 'true' }]\n    [, PopupWidth: 800, PopupHeight: 480, PopupResizable: true]\n    [, PopupCloseAction: cancelButton1]\n    [, Class: 'css-class', Style: 'css: rule']\n  )\n  {\n    -- widgets\n  }",
-		Example: "CREATE PAGE MyModule.EditCustomer\n  (\n    Params: { $Customer: MyModule.Customer },\n    Title: 'Edit Customer',\n    Layout: Atlas_Core.PopupLayout,\n    Class: 'container-fluid'\n  )\n  {\n    DATAVIEW dvCustomer (DataSource: $Customer) {\n      TEXTBOX txtName (Label: 'Name', Attribute: Name)\n      FOOTER footer1 {\n        ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE_CHANGES, ButtonStyle: Primary)\n        ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL_CHANGES)\n      }\n    }\n  }",
+		Example: "CREATE PAGE MyModule.EditCustomer\n  (\n    Params: { $Customer: MyModule.Customer },\n    Title: 'Edit Customer',\n    Layout: Atlas_Core.PopupLayout,\n    Class: 'container-fluid'\n  )\n  {\n    DATAVIEW dvCustomer (DataSource: $Customer) {\n      TEXTBOX txtName (Label: 'Name', Attribute: Name)\n      FOOTER footer1 {\n        ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE CHANGES, ButtonStyle: Primary)\n        ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL CHANGES)\n      }\n    }\n  }",
 		SeeAlso: []string{"page.create", "page.widgets", "page.alter", "snippet"},
 	})
 
@@ -122,7 +122,7 @@ CREATE PAGE Sales.Detail (Title: 'Detail', Layout: Atlas_Core.Atlas_Default) {
 			"statictext", "staticimage", "dynamicimage", "dropdown", "referenceselector",
 			"legacydatagrid",
 		},
-		Syntax: "-- Containers\nLAYOUTGRID name { ROW r { COLUMN c (DesktopWidth: 6) { ... } } }\nCONTAINER name (Class: 'cls') { ... }\nCONTAINER name (OnClick: MICROFLOW Module.MF) { ... }   -- clickable container\nCUSTOMCONTAINER name (Class: 'cls') { ... }\nGROUPBOX name (Caption: 'C') { ... }\nTABCONTAINER name { TABPAGE tp (Caption: 'One') { ... } TABPAGE tp2 (Caption: 'Two') { ... } }\n\n" +
+		Syntax: "-- Containers\nLAYOUTGRID name { ROW r { COLUMN c (DesktopWidth: 6) { ... } } }\nCONTAINER name (Class: 'cls') { ... }\nCONTAINER name (OnClick: CALL MICROFLOW Module.MF) { ... }   -- clickable container\nCUSTOMCONTAINER name (Class: 'cls') { ... }\nGROUPBOX name (Caption: 'C') { ... }\nTABCONTAINER name { TABPAGE tp (Caption: 'One') { ... } TABPAGE tp2 (Caption: 'Two') { ... } }\n\n" +
 			"-- Data widgets\nDATAVIEW name (DataSource: $Param) { ... FOOTER f { ... } }\nDATAGRID name (DataSource: DATABASE Module.Entity) { COLUMN c (Attribute: A) }\nGALLERY name (DataSource: DATABASE Module.Entity, DesktopColumns: 3) { ... }\nLISTVIEW name (DataSource: DATABASE Module.Entity) { ... }\nLISTVIEW name (...) { ... TEMPLATE FOR Module.Specialization { ... } }\n\n" +
 			"-- Data grid 2 column filters go INSIDE the column's own braces\nDATAGRID dg (...) { COLUMN c (Attribute: A) { TEXTFILTER tf (Attribute: A) } }\nTEXTFILTER | NUMBERFILTER | DATEFILTER | DROPDOWNFILTER | DROPDOWNSORT\n" +
 			"--   Match the filter to the column's type, or MxBuild refuses it: String ->\n" +
@@ -144,7 +144,7 @@ CREATE PAGE Sales.Detail (Title: 'Detail', Layout: Atlas_Core.Atlas_Default) {
 			"--   container the grid declares — it used to be dropped on write with no\n" +
 			"--   diagnostic, and is now refused (MDL-WIDGET30).\n\n" +
 			"-- Inputs\nTEXTBOX name (Label: 'L', Attribute: Attr)\nTEXTAREA | DATEPICKER | COMBOBOX | CHECKBOX | RADIOBUTTONS\n\n" +
-			"-- Actions\nACTIONBUTTON name (Caption: 'C', Action: SAVE_CHANGES, ButtonStyle: Primary)\nLINKBUTTON name (Caption: 'C', Action: ...)\n\n" +
+			"-- Actions\nACTIONBUTTON name (Caption: 'C', Action: SAVE CHANGES, ButtonStyle: Primary)\nLINKBUTTON name (Caption: 'C', Action: ...)\n\n" +
 			"-- Display\nDYNAMICTEXT name (Content: 'Hello, {1}!', ContentParams: [{1} = Name])\nTITLE name (Content: 'Heading')\nIMAGE name (Image: 'Module.Collection.ImageName')\nIMAGE name (ImageType: imageUrl, ImageUrl: 'https://…')\n" +
 			"--   IMAGE needs a source. Its default, `ImageType: image`, shows an entry from an\n" +
 			"--   image collection, named as three parts: Module.Collection.ImageName.\n" +
@@ -187,7 +187,7 @@ CREATE PAGE Sales.Detail (Title: 'Detail', Layout: Atlas_Core.Atlas_Default) {
 			"--                       Use DYNAMICTEXT with a literal Content.)\n" +
 			"--   REFERENCESELECTOR  (unsupported widget type)\n" +
 			"--   LEGACYDATAGRID     (use DATAGRID for the pluggable equivalent on Mendix 11+)",
-		Example: "DATAVIEW dvCustomer (DataSource: $Customer) {\n  TEXTBOX txtName (Label: 'Name', Attribute: Name)\n  COMBOBOX cbStatus (Label: 'Status', Attribute: Status)\n  FOOTER footer1 {\n    ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE_CHANGES, ButtonStyle: Primary)\n    ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL_CHANGES)\n  }\n}",
+		Example: "DATAVIEW dvCustomer (DataSource: $Customer) {\n  TEXTBOX txtName (Label: 'Name', Attribute: Name)\n  COMBOBOX cbStatus (Label: 'Status', Attribute: Status)\n  FOOTER footer1 {\n    ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE CHANGES, ButtonStyle: Primary)\n    ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL CHANGES)\n  }\n}",
 		SeeAlso: []string{"page.create", "page.datasource"},
 	})
 
@@ -244,7 +244,7 @@ CREATE PAGE Sales.Detail (Title: 'Detail', Layout: Atlas_Core.Atlas_Default) {
 			"datasource", "data source", "database", "microflow",
 			"selection", "variable", "binding", "binds", "association", "data from context",
 		},
-		Syntax:  "DataSource: $Variable                    -- Parameter/variable binding\nDataSource: DATABASE Module.Entity        -- Database query\nDataSource: DATABASE Module.Entity WHERE [Attr != ''] SORT BY Attr ASC\n                                          --   ...optionally constrained and sorted\nDataSource: DATABASE Module.Entity SORT BY Module.Assoc/Attr ASC\n                                          --   ...sorted over an association. Name the\n                                          --   hop when two reach the same entity —\n                                          --   the wrong one builds cleanly and sorts\n                                          --   by the wrong thing.\nDataSource: DATABASE Module.Entity SEARCH BY Attr, Attr2\n                                          --   LIST VIEW only: the attributes its\n                                          --   search bar filters on. Mirrors SORT BY,\n                                          --   but takes no direction.\nDataSource: MICROFLOW Module.MF           -- Microflow datasource, no parameters\nDataSource: MICROFLOW Module.MF(Param: $P) -- ...one argument per PARAMETER, required,\n                                          --   and NAMED: the positional form\n                                          --   MF($P) is a parse error. Mendix does\n                                          --   NOT auto-map an object in scope, not\n                                          --   even one of the exact type, so a\n                                          --   missing argument is CE1571\nDataSource: SELECTION widgetName          -- Selection from another widget\nDataSource: $currentObject/Module.Assoc   -- Over an association (\"data from context\")\n                                          --   list widget → to-many collection\n                                          --   nested DATAVIEW → the to-one referenced object\nAttribute: AttributeName                  -- Attribute binding (inputs)",
+		Syntax:  "DataSource: $Variable                    -- Parameter/variable binding\nDataSource: DATABASE Module.Entity        -- Database query\nDataSource: DATABASE Module.Entity WHERE [Attr != ''] SORT BY Attr ASC\n                                          --   ...optionally constrained and sorted\nDataSource: DATABASE Module.Entity SORT BY Module.Assoc/Attr ASC\n                                          --   ...sorted over an association. Name the\n                                          --   hop when two reach the same entity —\n                                          --   the wrong one builds cleanly and sorts\n                                          --   by the wrong thing.\nDataSource: DATABASE Module.Entity SEARCH BY Attr, Attr2\n                                          --   LIST VIEW only: the attributes its\n                                          --   search bar filters on. Mirrors SORT BY,\n                                          --   but takes no direction.\nDataSource: MICROFLOW Module.MF           -- Microflow datasource, no parameters\nDataSource: MICROFLOW Module.MF(Param = $P) -- ...one argument per PARAMETER, required,\n                                          --   and NAMED: the positional form\n                                          --   MF($P) is a parse error. Mendix does\n                                          --   NOT auto-map an object in scope, not\n                                          --   even one of the exact type, so a\n                                          --   missing argument is CE1571\nDataSource: SELECTION widgetName          -- Selection from another widget\nDataSource: $currentObject/Module.Assoc   -- Over an association (\"data from context\")\n                                          --   list widget → to-many collection\n                                          --   nested DATAVIEW → the to-one referenced object\nAttribute: AttributeName                  -- Attribute binding (inputs)",
 		Example: "-- Database datasource with grid\nDATAGRID grid (DataSource: DATABASE Module.Customer) {\n  COLUMN colName (Attribute: Name, Caption: 'Name')\n}\n\n-- Microflow datasource\nDATAVIEW dv (DataSource: MICROFLOW Module.GetData) {\n  TEXTBOX txtName (Label: 'Name', Attribute: Name)\n}\n\n-- Over an association: a nested DataView shows the referenced (to-one) object\nDATAVIEW dvOrder (DataSource: $Order) {\n  DATAVIEW dvCustomer (DataSource: $currentObject/Order_Customer) {\n    TEXTBOX txtCustName (Label: 'Name', Attribute: Name)\n  }\n}\n\n-- Over an association: a list widget shows the (to-many) collection\nLISTVIEW lvLines (DataSource: $currentObject/Order_OrderLine) {\n  DYNAMICTEXT dtLine (Content: 'Line')\n}",
 		SeeAlso: []string{"page.widgets", "page.create"},
 	})
@@ -259,8 +259,8 @@ CREATE PAGE Sales.Detail (Title: 'Detail', Layout: Atlas_Core.Atlas_Default) {
 			"icon", "linkbutton", "link button",
 			"nothing", "no action", "inert", "dead button",
 		},
-		Syntax:  "Action: NOTHING                      -- deliberately no action (Forms$NoAction)\nAction: SAVE_CHANGES\nAction: SAVE_CHANGES CLOSE_PAGE      -- save, then close the pop-up\nAction: CANCEL_CHANGES\nAction: CANCEL_CHANGES CLOSE_PAGE\nAction: CLOSE_PAGE\nAction: DELETE\nAction: DELETE CLOSE_PAGE\nAction: DELETE_OBJECT\nAction: NANOFLOW Module.NF\nAction: NANOFLOW Module.NF(Param: $val)\nAction: OPEN_LINK 'https://example.com'\nAction: OPEN_LINK $currentObject/URL  -- address read from an attribute\nAction: SIGN_OUT\nAction: COMPLETE_TASK 'OutcomeName'\nAction: SHOW_PAGE Module.Page\nAction: SHOW_PAGE Module.Page(Param: $currentObject)\nAction: MICROFLOW Module.MF\nAction: MICROFLOW Module.MF(Param: $val)\nAction: CREATE_OBJECT Module.Entity THEN SHOW_PAGE Module.Page\n\nThe list above is exhaustive. Anything else in an action slot is an\nERROR (MDL-WIDGET28), including a real keyword short its argument --\n`Action: OPEN_LINK` without a URL, `Action: SHOW_PAGE` without a page.\nSuch a widget used to be written with NO action at all and rendered as a\ndead control, with check, exec and mxbuild all clean, because a\nno-action widget is legal Mendix (mendixlabs/mxcli#1062). Write NOTHING\nwhen a control really is meant to be inert.\n\nThe same forms serve `OnClick:` (an alias of `Action:`) and `OnChange:`.\n\nA microflow or nanoflow action is a CALL: it needs an argument for every\nparameter the flow declares, or Mendix rejects the page with CE1571. The\nargument list is the same on every widget that takes an action -- a\nCONTAINER (which is clickable) as much as an ACTIONBUTTON. An enclosing\ndata container of the right type supplies it without an argument; a data\ngrid's CONTROL BAR does not, because it is not row-scoped -- pass the\ngrid's selection there (`$dgOrders`).\n\nA SHOW_PAGE argument must be the enclosing widget's context object --\neither $currentObject or the name of the variable the enclosing data\nwidget is bound to. Mendix infers it from that widget, so naming any\nother variable is refused (MDL-PAGEARG01); call a microflow instead.\nOutside any data widget there is no context object to infer, so such a\nbutton takes NO argument at all -- not a page parameter, not\n$currentObject, not a literal. mxcli used to drop it in silence and\nmxbuild then reported CE1571 per parameter of the target page\n(mendixlabs/mxcli#1029). Route that navigation through a microflow.\n\nOPEN_LINK takes a web address, stored as a Forms$StaticOrDynamicString:\neither a literal, or $currentObject/Attr to read it from an attribute of\nthe enclosing data container's object at runtime (Studio Pro's \"Address:\nattribute\"). An address over an association path is not supported yet.\n\nButton styles: Default, Primary, Success, Info, Warning, Danger\n\nMendix has THREE icon elements and the keyword picks which one:\n\nIcon: 'Atlas_Core.Atlas_Filled.pencil'   -- an icon collection\nIcon: image MyModule.Images.logo         -- an IMAGE collection\nIcon: glyph 57377                        -- a font code point\n\nThe bare form is the icon-collection icon and any collection in the\nproject works, third-party ones included. The image form points into a\ndifferent document, and is spelled the same way apart from the keyword\n-- write it without `image` and mxcli stores a custom-icon reference,\nwhich fails the build with CE1613 (mendixlabs/mxcli#1059).\n`mxcli check -p … --references` resolves each kind against its own\ncollection and names the remedy when the kind is wrong.\n\nA glyph carries a code and no name. Codes are sparse, and an undefined\none fails only at `mxbuild --target=deploy`, naming the PAGE rather\nthan the icon -- so MDL078 checks it against the font's own table.\nList them with `show glyphs`.\n\nA name may be quoted or bare; a hyphenated segment is double-quoted on\nits own: Atlas_Core.Atlas.\"align-center\".\n\nUse `linkbutton` instead of `actionbutton` for link render mode (same properties).",
-		Example: "ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE_CHANGES, ButtonStyle: Primary)\nACTIONBUTTON btnEdit (Caption: 'Edit',\n  Action: SHOW_PAGE Module.EditPage(Item: $currentObject))\nLINKBUTTON btnDelete (Caption: 'Delete', Action: DELETE,\n  Icon: 'Atlas_Core.Atlas_Filled.pencil')\n\n-- A clickable CONTAINER in a data grid's control bar, calling a nanoflow\n-- with the grid's selection as its argument.\nDATAGRID dgOrders (DataSource: DATABASE FROM Sales.Order, Selection: Single) {\n  COLUMN colNr (Attribute: Number, Caption: 'Order #')\n  CONTROLBAR cb {\n    CONTAINER cShip (Class: 'command',\n      Action: NANOFLOW Sales.ACT_Ship($Order = $dgOrders)) {\n      ACTIONBUTTON btnShip (Caption: 'Ship')\n    }\n  }\n}",
+		Syntax:  "Action: NOTHING                      -- deliberately no action (Forms$NoAction)\nAction: SAVE CHANGES\nAction: SAVE CHANGES CLOSE PAGE      -- save, then close the pop-up\nAction: CANCEL CHANGES\nAction: CANCEL CHANGES CLOSE PAGE\nAction: CLOSE PAGE\nAction: DELETE\nAction: DELETE CLOSE PAGE\nAction: CALL NANOFLOW Module.NF\nAction: CALL NANOFLOW Module.NF(Param = $val)\nAction: OPEN LINK 'https://example.com'\nAction: OPEN LINK $currentObject/URL  -- address read from an attribute\nAction: SIGN OUT\nAction: COMPLETE TASK 'OutcomeName'\nAction: SHOW PAGE Module.Page\nAction: SHOW PAGE Module.Page(Param = $currentObject)\nAction: CALL MICROFLOW Module.MF\nAction: CALL MICROFLOW Module.MF(Param = $val)\nAction: CREATE OBJECT Module.Entity THEN SHOW PAGE Module.Page\n\nThe list above is exhaustive. Anything else in an action slot is an\nERROR: `Action: OPEN LINK` without a URL or `Action: SHOW PAGE` without a\npage is a syntax error, and a value that is not an action at all\n(or a snake-case keyword short its argument) is MDL-WIDGET28.\nSuch a widget used to be written with NO action at all and rendered as a\ndead control, with check, exec and mxbuild all clean, because a\nno-action widget is legal Mendix (mendixlabs/mxcli#1062). Write NOTHING\nwhen a control really is meant to be inert.\n\nThe actions are the words a microflow uses (R8). The snake-case spellings\n(SAVE_CHANGES, SHOW_PAGE, CLOSE_PAGE, DELETE_OBJECT, OPEN_LINK, SIGN_OUT, ...)\nand a flow call without CALL still parse, but are deprecated (MDL-DEPR020);\n`mxcli fmt --upgrade` rewrites them.\n\nThe same forms serve `OnClick:` (an alias of `Action:`) and `OnChange:`.\n\nA microflow or nanoflow action is a CALL: it needs an argument for every\nparameter the flow declares, or Mendix rejects the page with CE1571. The\nargument list is the same on every widget that takes an action -- a\nCONTAINER (which is clickable) as much as an ACTIONBUTTON. An enclosing\ndata container of the right type supplies it without an argument; a data\ngrid's CONTROL BAR does not, because it is not row-scoped -- pass the\ngrid's selection there (`$dgOrders`).\n\nA SHOW PAGE argument must be the enclosing widget's context object --\neither $currentObject or the name of the variable the enclosing data\nwidget is bound to. Mendix infers it from that widget, so naming any\nother variable is refused (MDL-PAGEARG01); call a microflow instead.\nOutside any data widget there is no context object to infer, so such a\nbutton takes NO argument at all -- not a page parameter, not\n$currentObject, not a literal. mxcli used to drop it in silence and\nmxbuild then reported CE1571 per parameter of the target page\n(mendixlabs/mxcli#1029). Route that navigation through a microflow.\n\nOPEN LINK takes a web address, stored as a Forms$StaticOrDynamicString:\neither a literal, or $currentObject/Attr to read it from an attribute of\nthe enclosing data container's object at runtime (Studio Pro's \"Address:\nattribute\"). An address over an association path is not supported yet.\n\nButton styles: Default, Primary, Success, Info, Warning, Danger\n\nMendix has THREE icon elements and the keyword picks which one:\n\nIcon: 'Atlas_Core.Atlas_Filled.pencil'   -- an icon collection\nIcon: image MyModule.Images.logo         -- an IMAGE collection\nIcon: glyph 57377                        -- a font code point\n\nThe bare form is the icon-collection icon and any collection in the\nproject works, third-party ones included. The image form points into a\ndifferent document, and is spelled the same way apart from the keyword\n-- write it without `image` and mxcli stores a custom-icon reference,\nwhich fails the build with CE1613 (mendixlabs/mxcli#1059).\n`mxcli check -p … --references` resolves each kind against its own\ncollection and names the remedy when the kind is wrong.\n\nA glyph carries a code and no name. Codes are sparse, and an undefined\none fails only at `mxbuild --target=deploy`, naming the PAGE rather\nthan the icon -- so MDL078 checks it against the font's own table.\nList them with `show glyphs`.\n\nA name may be quoted or bare; a hyphenated segment is double-quoted on\nits own: Atlas_Core.Atlas.\"align-center\".\n\nUse `linkbutton` instead of `actionbutton` for link render mode (same properties).",
+		Example: "ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE CHANGES, ButtonStyle: Primary)\nACTIONBUTTON btnEdit (Caption: 'Edit',\n  Action: SHOW PAGE Module.EditPage(Item = $currentObject))\nLINKBUTTON btnDelete (Caption: 'Delete', Action: DELETE,\n  Icon: 'Atlas_Core.Atlas_Filled.pencil')\n\n-- A clickable CONTAINER in a data grid's control bar, calling a nanoflow\n-- with the grid's selection as its argument.\nDATAGRID dgOrders (DataSource: DATABASE FROM Sales.Order, Selection: Single) {\n  COLUMN colNr (Attribute: Number, Caption: 'Order #')\n  CONTROLBAR cb {\n    CONTAINER cShip (Class: 'command',\n      Action: CALL NANOFLOW Sales.ACT_Ship(Order = $dgOrders)) {\n      ACTIONBUTTON btnShip (Caption: 'Ship')\n    }\n  }\n}",
 		SeeAlso: []string{"page.widgets"},
 	})
 
@@ -284,7 +284,7 @@ CREATE PAGE Sales.Detail (Title: 'Detail', Layout: Atlas_Core.Atlas_Default) {
 			"popup width", "popup height", "popup resizable",
 			"drop template", "insert template", "list view template",
 		},
-		Syntax:  "ALTER PAGE Module.Name {       -- the generic ALTER: set / insert / replace / drop\n  SET (property: value) ON widgetName;  -- widget property names: any casing\n  SET ('Row size': 'Small') ON lvOrders;  -- an Atlas DESIGN property of that widget's\n                                         --   type; quoted and case-sensitive.\n                                         --   `show design properties for <type>` lists\n                                         --   them. ON/OFF for a toggle, where OFF\n                                         --   REMOVES the entry.\n                                         --   A multi-select ('Hide on') or compound\n                                         --   ('Spacing') one needs the inline\n                                         --   DesignProperties: [...] form, because a\n                                         --   SET assignment carries one value.\n  SET (Action: MICROFLOW Module.MF) ON btnSave;   -- any CREATE PAGE action form\n  SET ('createFileAction': MICROFLOW Module.MF) ON fileUploader1;\n                                         -- a pluggable widget's NAMED action slot,\n                                         --   by the widget's own key; refused on a\n                                         --   key that is not action-typed\n  SET (DataSource: $Param) ON dvOrder;  -- parameter/microflow/nanoflow/selection;\n                                        --   DATABASE and association are REPLACE-only,\n                                        --   and a data view takes no database source\n  SET (prop1: val1, prop2: val2) ON widgetName;\n  SET (Title: 'New Title');  -- page-level (case-sensitive): no ON\n  SET (Documentation: 'What this page is for.');\n  SET (Class: 'css-class');  -- page-level CSS class / style\n  SET (Style: 'css: rule');\n  SET (PopupWidth: 800, PopupHeight: 480, PopupResizable: true);  -- page-level pop-up\n  INSERT AFTER widgetName { <widgets> };\n  INSERT BEFORE widgetName { <widgets> };\n  INSERT INTO containerName { <widgets> };\n  DROP name1, name2;\n  DROP TEMPLATE FOR Module.Specialization IN listViewName;\n  REPLACE widgetName WITH { <widgets> };\n};\n-- A target is a widget name, or a DataGrid 2 column by what it shows:\n-- grid column(Attr), grid column('Caption'), @n when two match. The old spellings `SET p = v`,\n-- `SET p: v` (no parentheses) and `DROP WIDGET a` still run and warn\n-- (MDL-DEPR101..103).\n\n-- The BULK form: one design property on every widget of a TYPE.\nALTER PAGES [IN Module]\n  SET 'Compact' = ON, 'Striped' = ON\n  WHERE WIDGETTYPE = datagrid            -- the MDL keyword, which resolves to\n                                         --   exactly one widget id. A full id in\n                                         --   quotes works too. NOT a name: a widget\n                                         --   name is unique only within its page.\n  [DRY RUN];                             -- run this FIRST. It reports the matches\n                                         --   against a discardable copy and writes\n                                         --   nothing.",
+		Syntax:  "ALTER PAGE Module.Name {       -- the generic ALTER: set / insert / replace / drop\n  SET (property: value) ON widgetName;  -- widget property names: any casing\n  SET ('Row size': 'Small') ON lvOrders;  -- an Atlas DESIGN property of that widget's\n                                         --   type; quoted and case-sensitive.\n                                         --   `show design properties for <type>` lists\n                                         --   them. ON/OFF for a toggle, where OFF\n                                         --   REMOVES the entry.\n                                         --   A multi-select ('Hide on') or compound\n                                         --   ('Spacing') one needs the inline\n                                         --   DesignProperties: [...] form, because a\n                                         --   SET assignment carries one value.\n  SET (Action: CALL MICROFLOW Module.MF) ON btnSave;   -- any CREATE PAGE action form\n  SET ('createFileAction': CALL MICROFLOW Module.MF) ON fileUploader1;\n                                         -- a pluggable widget's NAMED action slot,\n                                         --   by the widget's own key; refused on a\n                                         --   key that is not action-typed\n  SET (DataSource: $Param) ON dvOrder;  -- parameter/microflow/nanoflow/selection;\n                                        --   DATABASE and association are REPLACE-only,\n                                        --   and a data view takes no database source\n  SET (prop1: val1, prop2: val2) ON widgetName;\n  SET (Title: 'New Title');  -- page-level (case-sensitive): no ON\n  SET (Documentation: 'What this page is for.');\n  SET (Class: 'css-class');  -- page-level CSS class / style\n  SET (Style: 'css: rule');\n  SET (PopupWidth: 800, PopupHeight: 480, PopupResizable: true);  -- page-level pop-up\n  INSERT AFTER widgetName { <widgets> };\n  INSERT BEFORE widgetName { <widgets> };\n  INSERT INTO containerName { <widgets> };\n  DROP name1, name2;\n  DROP TEMPLATE FOR Module.Specialization IN listViewName;\n  REPLACE widgetName WITH { <widgets> };\n};\n-- A target is a widget name, or a DataGrid 2 column by what it shows:\n-- grid column(Attr), grid column('Caption'), @n when two match. The old spellings `SET p = v`,\n-- `SET p: v` (no parentheses) and `DROP WIDGET a` still run and warn\n-- (MDL-DEPR101..103).\n\n-- The BULK form: one design property on every widget of a TYPE.\nALTER PAGES [IN Module]\n  SET 'Compact' = ON, 'Striped' = ON\n  WHERE WIDGETTYPE = datagrid            -- the MDL keyword, which resolves to\n                                         --   exactly one widget id. A full id in\n                                         --   quotes works too. NOT a name: a widget\n                                         --   name is unique only within its page.\n  [DRY RUN];                             -- run this FIRST. It reports the matches\n                                         --   against a discardable copy and writes\n                                         --   nothing.",
 		Example: "ALTER PAGE Module.EditPage {\n  SET (Caption: 'Save & Close', ButtonStyle: Success) ON btnSave;\n  INSERT AFTER txtName {\n    TEXTBOX txtMiddleName (Label: 'Middle Name', Attribute: MiddleName)\n  };\n  DROP txtUnused;\n};",
 		SeeAlso: []string{"page.create", "page.show", "snippet.alter"},
 	})
@@ -413,7 +413,7 @@ CREATE PAGE Sales.Detail (Title: 'Detail', Layout: Atlas_Core.Atlas_Default) {
 		// the reporter of mendixlabs/mxcli#1028 reached the bug by following
 		// this line. A primitive is now refused as MDL087.
 		Syntax:  "CREATE SNIPPET Module.Name\n  [( Params: { $P: Module.Entity } )]   -- entities only; a primitive is CE0046\n  [( Variables: { $isEditable: Boolean = 'true' } )]\n  [( Folder: 'Snippets/Common' )]\n  {\n    -- widgets\n  }\n\n-- To parameterise a snippet on a primitive, keep the primitive on the\n-- calling PAGE and pass an object, or read the value off an entity member.",
-		Example: "CREATE SNIPPET MyModule.NavigationMenu\n{\n  NAVIGATIONLIST navMenu {\n    ITEM itemCustomers (Action: SHOW_PAGE MyModule.CustomerOverview) {\n      DYNAMICTEXT txtCustomers (Content: 'Customers')\n    }\n  }\n}",
+		Example: "CREATE SNIPPET MyModule.NavigationMenu\n{\n  NAVIGATIONLIST navMenu {\n    ITEM itemCustomers (Action: SHOW PAGE MyModule.CustomerOverview) {\n      DYNAMICTEXT txtCustomers (Content: 'Customers')\n    }\n  }\n}",
 		SeeAlso: []string{"snippet", "snippet.alter", "page.widgets"},
 	})
 
@@ -424,7 +424,7 @@ CREATE PAGE Sales.Detail (Title: 'Detail', Layout: Atlas_Core.Atlas_Default) {
 			"alter snippet", "modify snippet", "update snippet",
 		},
 		Syntax:  "ALTER SNIPPET Module.Name {\n  SET (property: value) ON widgetName;\n  INSERT AFTER widgetName { <widgets> };\n  INSERT BEFORE widgetName { <widgets> };\n  INSERT INTO containerName { <widgets> };\n  DROP name1, name2;\n  REPLACE widgetName WITH { <widgets> };\n};",
-		Example: "ALTER SNIPPET Module.NavSnippet {\n  REPLACE navItem1 WITH {\n    ACTIONBUTTON btnHome (Caption: 'Home', Action: SHOW_PAGE Module.HomePage)\n  };\n  DROP txtOldField;\n  INSERT AFTER txtName {\n    TEXTBOX txtNewField (Label: 'New Field', Attribute: NewAttr)\n  };\n};",
+		Example: "ALTER SNIPPET Module.NavSnippet {\n  REPLACE navItem1 WITH {\n    ACTIONBUTTON btnHome (Caption: 'Home', Action: SHOW PAGE Module.HomePage)\n  };\n  DROP txtOldField;\n  INSERT AFTER txtName {\n    TEXTBOX txtNewField (Label: 'New Field', Attribute: NewAttr)\n  };\n};",
 		SeeAlso: []string{"snippet", "page.alter"},
 	})
 
@@ -619,7 +619,7 @@ CREATE PAGE Sales.Detail (Title: 'Detail', Layout: Atlas_Core.Atlas_Default) {
 			"menu", "menus", "menu document", "menu item",
 		},
 		Syntax: "CREATE [OR MODIFY] MENU Module.Name [FOLDER 'path'] (\n" +
-			"  MENU ITEM '<caption>' [PAGE Module.Page | MICROFLOW Module.Flow | SIGN_OUT] [ICON Module.Collection.name];\n" +
+			"  MENU ITEM '<caption>' [PAGE Module.Page | MICROFLOW Module.Flow | SIGN OUT] [ICON Module.Collection.name];\n" +
 			"  MENU '<caption>' [ICON Module.Collection.name] ( <nested items> );\n" +
 			");\n" +
 			"DESCRIBE MENU Module.Name;\n" +
@@ -638,7 +638,7 @@ CREATE PAGE Sales.Detail (Title: 'Detail', Layout: Atlas_Core.Atlas_Default) {
 			"--     SHOW NAVIGATION MENU and ALTER NAVIGATION. Both use these same items.\n" +
 			"--   * OR MODIFY replaces the item list wholesale; an omitted item is removed.\n" +
 			"--     The document's identity and export level are preserved.\n" +
-			"--   * SIGN_OUT is the log-out menu item. It needs no target and stores the\n" +
+			"--   * SIGN OUT is the log-out menu item. It needs no target and stores the\n" +
 			"--     same Forms$SignOutClientAction a sign-out BUTTON carries. Works both\n" +
 			"--     here and in a navigation profile's menu.\n" +
 			"--   * ICON names an icon collection entry. A glyph or image icon cannot be\n" +
@@ -658,7 +658,7 @@ CREATE PAGE Sales.Detail (Title: 'Detail', Layout: Atlas_Core.Atlas_Default) {
 			"use fragment", "template", "script scope",
 		},
 		Syntax:  "DEFINE FRAGMENT Name AS { <widgets> };\nDEFINE FRAGMENT Name AS { <widgets> SLOT [name] <widgets> };\nDEFINE FRAGMENT Name ($d: datasource, $a: action) AS { <widgets> };\nUSE FRAGMENT Name [(args)] [AS prefix_];\nUSE FRAGMENT Name [(args)] [AS prefix_] { <payload widgets> };\nSHOW FRAGMENTS;\nDESCRIBE FRAGMENT Name;\nDESCRIBE FRAGMENT FROM PAGE Module.Page WIDGET widgetName;",
-		Example: "DEFINE FRAGMENT SaveCancelFooter AS {\n  FOOTER footer1 {\n    ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE_CHANGES, ButtonStyle: Primary)\n    ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL_CHANGES)\n  }\n};\n\nCREATE PAGE Module.EditPage (Params: { $Param: Module.Customer }, Title: 'Edit', Layout: 'Atlas_Core.Atlas_Default') {\n  DATAVIEW dv (DataSource: $Param) {\n    TEXTBOX txtName (Label: 'Name', Attribute: Name)\n    USE FRAGMENT SaveCancelFooter\n  }\n};",
+		Example: "DEFINE FRAGMENT SaveCancelFooter AS {\n  FOOTER footer1 {\n    ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE CHANGES, ButtonStyle: Primary)\n    ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL CHANGES)\n  }\n};\n\nCREATE PAGE Module.EditPage (Params: { $Param: Module.Customer }, Title: 'Edit', Layout: 'Atlas_Core.Atlas_Default') {\n  DATAVIEW dv (DataSource: $Param) {\n    TEXTBOX txtName (Label: 'Name', Attribute: Name)\n    USE FRAGMENT SaveCancelFooter\n  }\n};",
 		SeeAlso: []string{"fragment.define", "fragment.use", "fragment.slot", "fragment.params", "snippet"},
 	})
 
@@ -693,7 +693,7 @@ CREATE PAGE Sales.Detail (Title: 'Detail', Layout: Atlas_Core.Atlas_Default) {
 			"binding", "rebind", "building block override", "reusable component",
 		},
 		Syntax:  "-- Declare typed params, reference with $name in a datasource/action slot:\nDEFINE FRAGMENT Name ($data: datasource, $onEdit: action) AS { … };\n-- Supply values at the use site:\nUSE FRAGMENT Name ($data: <datasource>, $onEdit: <action>) [{ payload }]\n-- Building blocks: rebind the outermost datasource / first button:\nUSE BUILDING BLOCK Module.Block (datasource: <ds>, action: <action>) [AS prefix_]",
-		Example: "DEFINE FRAGMENT DataPanel ($data: datasource, $onEdit: action) AS {\n  CONTAINER panel (Class: 'card') {\n    LISTVIEW lv (DataSource: $data) {\n      SLOT content\n      ACTIONBUTTON edit (Caption: 'Edit', Action: $onEdit, ButtonStyle: Primary)\n    }\n  }\n};\n\nCREATE PAGE Module.Orders (Title: 'Orders', Layout: Atlas_Core.Atlas_Default) {\n  USE FRAGMENT DataPanel ($data: DATABASE Sales.Order, $onEdit: MICROFLOW Sales.Edit) {\n    DYNAMICTEXT heading (Content: 'Orders', RenderMode: H4)\n  }\n};\n\n-- Rebind a building block's datasource and primary button:\nUSE BUILDING BLOCK Atlas_Web_Content.List_Cards (datasource: DATABASE Sales.Order, action: MICROFLOW Sales.Open) AS orders_\n\n-- Notes:\n--   * Param kinds: datasource | action. Every declared param must be supplied.\n--   * A microflow value parses as a datasource and is reinterpreted for an action param.\n--   * BB binding-point rule: datasource → first datasource widget; action → first button.",
+		Example: "DEFINE FRAGMENT DataPanel ($data: datasource, $onEdit: action) AS {\n  CONTAINER panel (Class: 'card') {\n    LISTVIEW lv (DataSource: $data) {\n      SLOT content\n      ACTIONBUTTON edit (Caption: 'Edit', Action: $onEdit, ButtonStyle: Primary)\n    }\n  }\n};\n\nCREATE PAGE Module.Orders (Title: 'Orders', Layout: Atlas_Core.Atlas_Default) {\n  USE FRAGMENT DataPanel ($data: DATABASE Sales.Order, $onEdit: MICROFLOW Sales.Edit) {\n    DYNAMICTEXT heading (Content: 'Orders', RenderMode: H4)\n  }\n};\n\n-- Rebind a building block's datasource and primary button:\nUSE BUILDING BLOCK Atlas_Web_Content.List_Cards (datasource: DATABASE Sales.Order, action: CALL MICROFLOW Sales.Open) AS orders_\n\n-- Notes:\n--   * Param kinds: datasource | action. Every declared param must be supplied.\n--   * A microflow value parses as a datasource and is reinterpreted for an action param.\n--   * BB binding-point rule: datasource → first datasource widget; action → first button.",
 		SeeAlso: []string{"fragment", "fragment.slot", "fragment.use"},
 	})
 
diff --git a/cmd/mxcli/syntax/features_workflow.go b/cmd/mxcli/syntax/features_workflow.go
index 14223800cc..d14dbb25a0 100644
--- a/cmd/mxcli/syntax/features_workflow.go
+++ b/cmd/mxcli/syntax/features_workflow.go
@@ -262,11 +262,14 @@ func init() {
 			"call microflow", "microflow task", "automated step",
 			"system task",
 		},
-		// The WITH values are QUOTED — the grammar takes a string literal there,
-		// not a bare variable. Omitting the clause from this entry is how an
-		// author ends up writing the unquoted form (ako/mxcli#1023).
-		Syntax:  "CALL MICROFLOW Module.MF [AS <name>] [COMMENT '<text>']\n  [WITH (<Param> = '<expression>', ...)]\n  [OUTCOMES '<outcome>' -> { <activities> } ...];",
-		Example: "CALL MICROFLOW HR.SendNotification\n  COMMENT 'Notify manager';\n\n-- Parameter values are quoted, and named by their BARE parameter name:\nCALL MICROFLOW HR.Escalate AS callMicroflow1\n  WITH (Request = '$WorkflowContext');",
+		// R4 (ako/mxcli#751): arguments are bound as at every call site, right
+		// after the callee, the expression bare. The older `WITH (P = '<expr>')`
+		// after the comment is the deprecated alias MDL-DEPR008.
+		Syntax: "CALL MICROFLOW Module.MF[(<Param> = <expression>, ...)] [AS <name>] [COMMENT '<text>']\n" +
+			"  [OUTCOMES '<outcome>' -> { <activities> } ...];\n\n" +
+			"-- WITH (<Param> = '<expression>'), the expression in a string, is the\n" +
+			"-- deprecated spelling of the argument list (MDL-DEPR008).",
+		Example: "CALL MICROFLOW HR.SendNotification\n  COMMENT 'Notify manager';\n\n-- Arguments are named by their BARE parameter name:\nCALL MICROFLOW HR.Escalate(Request = $WorkflowContext) AS callMicroflow1;",
 		SeeAlso: []string{"workflow.create", "workflow.call-workflow", "workflow.ai-agent-task"},
 	})
 
@@ -280,8 +283,7 @@ func init() {
 		// Measured on mxbuild 11.13.0 against the same activity written as a call
 		// microflow: the only difference in what builds is CE1590 for a microflow
 		// with no parameters.
-		Syntax: "CALL AGENT MICROFLOW Module.MF [AS <name>] [COMMENT '<text>']\n" +
-			"  [WITH (<Param> = '<expression>', ...)]\n" +
+		Syntax: "CALL AGENT MICROFLOW Module.MF[(<Param> = <expression>, ...)] [AS <name>] [COMMENT '<text>']\n" +
 			"  [OUTCOMES <true|false|'Module.Enum.Value'|''> -> { <activities> } ...]\n" +
 			"  [BOUNDARY EVENT ...];\n\n" +
 			"-- The same statement as CALL MICROFLOW, stored as an AI agent task. The microflow\n" +
@@ -290,8 +292,8 @@ func init() {
 			"-- branch on the agent's answer with OUTCOMES. Needs Mendix 11.9+.",
 		Example: "CREATE MICROFLOW HR.ACT_ClassifyRequest ($Request: HR.LeaveRequest)\n" +
 			"RETURNS Boolean AS $Urgent\nBEGIN\n  -- call the agent here\n  RETURN false;\nEND;\n\n" +
-			"CALL AGENT MICROFLOW HR.ACT_ClassifyRequest AS aiAgentTask1 COMMENT 'Classify the request'\n" +
-			"  WITH (Request = '$WorkflowContext')\n" +
+			"CALL AGENT MICROFLOW HR.ACT_ClassifyRequest(Request = $WorkflowContext) AS aiAgentTask1\n" +
+			"  COMMENT 'Classify the request'\n" +
 			"  OUTCOMES true -> { USER TASK Expedite 'Expedite' PAGE HR.TaskPage OUTCOMES 'Done' { }; }\n" +
 			"           false -> { };",
 		SeeAlso: []string{"workflow.call-microflow", "agents"},
@@ -303,8 +305,8 @@ func init() {
 		Keywords: []string{
 			"call workflow", "sub-workflow", "nested workflow",
 		},
-		Syntax:  "CALL WORKFLOW Module.WF [AS <name>] [COMMENT '<text>']\n  [WITH (<Param> = '<expression>', ...)];",
-		Example: "CALL WORKFLOW HR.SubApproval COMMENT 'Delegate to sub-process';\n\n-- Parameter values are quoted:\nCALL WORKFLOW HR.SubApproval AS callWf1\n  WITH (Request = '$WorkflowContext');",
+		Syntax:  "CALL WORKFLOW Module.WF[(<Param> = <expression>, ...)] [AS <name>] [COMMENT '<text>'];",
+		Example: "CALL WORKFLOW HR.SubApproval COMMENT 'Delegate to sub-process';\n\nCALL WORKFLOW HR.SubApproval(Request = $WorkflowContext) AS callWf1;",
 		SeeAlso: []string{"workflow.create", "workflow.call-microflow"},
 	})
 
diff --git a/cmd/mxcli/testrunner/generator.go b/cmd/mxcli/testrunner/generator.go
index 53770c897f..7bf25c2bfc 100644
--- a/cmd/mxcli/testrunner/generator.go
+++ b/cmd/mxcli/testrunner/generator.go
@@ -103,13 +103,13 @@ func writeTestBlock(b *strings.Builder, tc TestCase, index int) {
 // the reasons the endpoint runner exists.
 func writeSetupBlock(b *strings.Builder, tc TestCase) {
 	for _, flow := range tc.Setups {
-		fmt.Fprintf(b, "  CALL MICROFLOW %s() ON ERROR {\n", flow)
+		fmt.Fprintf(b, "  CALL MICROFLOW %s() ON ERROR BEGIN\n", flow)
 		fmt.Fprintf(b, "    LOG ERROR NODE 'MXTEST' 'MXTEST:ERROR:%s:Setup failed: %s';\n",
 			escapeMDLString(tc.ID), escapeMDLString(flow))
 		b.WriteString("    SET $TestFailed = true;\n")
 		b.WriteString("    SET $AllPassed = false;\n")
 		b.WriteString("    RETURN $AllPassed;\n")
-		b.WriteString("  };\n")
+		b.WriteString("  END ERROR;\n")
 	}
 }
 
@@ -262,14 +262,14 @@ func rewriteWithErrorHandling(lines []string, testID string) []string {
 
 		if containsCallMicroflow(trimmed) && strings.HasSuffix(trimmed, ";") {
 			withoutSemicolon := strings.TrimSuffix(trimmed, ";")
-			result = append(result, withoutSemicolon+" ON ERROR {")
+			result = append(result, withoutSemicolon+" ON ERROR BEGIN")
 			result = append(result, fmt.Sprintf(
 				"  LOG ERROR NODE 'MXTEST' 'MXTEST:FAIL:%s:Exception during execution';",
 				escapeMDLString(testID)))
 			result = append(result, "  SET $TestFailed = true;")
 			result = append(result, "  SET $AllPassed = false;")
 			result = append(result, "  RETURN $AllPassed;")
-			result = append(result, "};")
+			result = append(result, "END ERROR;")
 		} else if containsCallMicroflow(trimmed) && !strings.HasSuffix(trimmed, ";") {
 			var callLines []string
 			callLines = append(callLines, line)
@@ -284,14 +284,14 @@ func rewriteWithErrorHandling(lines []string, testID string) []string {
 			joined := strings.Join(callLines, "\n")
 			joined = strings.TrimSpace(joined)
 			joined = strings.TrimSuffix(joined, ";")
-			result = append(result, joined+" ON ERROR {")
+			result = append(result, joined+" ON ERROR BEGIN")
 			result = append(result, fmt.Sprintf(
 				"  LOG ERROR NODE 'MXTEST' 'MXTEST:FAIL:%s:Exception during execution';",
 				escapeMDLString(testID)))
 			result = append(result, "  SET $TestFailed = true;")
 			result = append(result, "  SET $AllPassed = false;")
 			result = append(result, "  RETURN $AllPassed;")
-			result = append(result, "};")
+			result = append(result, "END ERROR;")
 		} else {
 			result = append(result, line)
 		}
@@ -315,9 +315,9 @@ func rewriteForThrowsTest(lines []string, didThrowVar string, want string) []str
 
 		if containsCallMicroflow(trimmed) && strings.HasSuffix(trimmed, ";") {
 			withoutSemicolon := strings.TrimSuffix(trimmed, ";")
-			result = append(result, withoutSemicolon+" ON ERROR {")
+			result = append(result, withoutSemicolon+" ON ERROR BEGIN")
 			result = append(result, throwsFlagHandler(didThrowVar, want)...)
-			result = append(result, "};")
+			result = append(result, "END ERROR;")
 		} else if containsCallMicroflow(trimmed) && !strings.HasSuffix(trimmed, ";") {
 			var callLines []string
 			callLines = append(callLines, line)
@@ -332,9 +332,9 @@ func rewriteForThrowsTest(lines []string, didThrowVar string, want string) []str
 			joined := strings.Join(callLines, "\n")
 			joined = strings.TrimSpace(joined)
 			joined = strings.TrimSuffix(joined, ";")
-			result = append(result, joined+" ON ERROR {")
+			result = append(result, joined+" ON ERROR BEGIN")
 			result = append(result, throwsFlagHandler(didThrowVar, want)...)
-			result = append(result, "};")
+			result = append(result, "END ERROR;")
 		} else {
 			result = append(result, line)
 		}
diff --git a/cmd/mxcli/testrunner/generator_endpoint.go b/cmd/mxcli/testrunner/generator_endpoint.go
index 9f4633239c..a49357ffaa 100644
--- a/cmd/mxcli/testrunner/generator_endpoint.go
+++ b/cmd/mxcli/testrunner/generator_endpoint.go
@@ -82,11 +82,11 @@ func writeTestFlow(b *strings.Builder, tc TestCase) {
 // produces an assertion failure that says nothing about the code under test.
 func writeSetupCalls(b *strings.Builder, tc TestCase) {
 	for _, flow := range tc.Setups {
-		fmt.Fprintf(b, "  CALL MICROFLOW %s() ON ERROR {\n", flow)
+		fmt.Fprintf(b, "  CALL MICROFLOW %s() ON ERROR BEGIN\n", flow)
 		fmt.Fprintf(b, "    SET $Verdict = '%s';\n",
 			escapeMDLString(verdictSetupPrefix+flow))
 		b.WriteString("    RETURN $Verdict;\n")
-		b.WriteString("  };\n")
+		b.WriteString("  END ERROR;\n")
 	}
 }
 
@@ -228,7 +228,7 @@ func quoteForMessage(s string) string {
 	return "'" + s + "'"
 }
 
-// attachOnError appends `ON ERROR { ... }` to each CALL statement in the body,
+// attachOnError appends `ON ERROR BEGIN ... END ERROR` to each CALL statement in the body,
 // joining a statement that spans several lines first.
 func attachOnError(lines, handler []string) []string {
 	var out []string
@@ -246,9 +246,9 @@ func attachOnError(lines, handler []string) []string {
 		}
 		stmt = strings.TrimSuffix(strings.TrimSpace(stmt), ";")
 
-		out = append(out, stmt+" ON ERROR {")
+		out = append(out, stmt+" ON ERROR BEGIN")
 		out = append(out, handler...)
-		out = append(out, "};")
+		out = append(out, "END ERROR;")
 	}
 	return out
 }
diff --git a/cmd/mxcli/testrunner/generator_endpoint_test.go b/cmd/mxcli/testrunner/generator_endpoint_test.go
index 3bbbbbc74f..cfaa930bda 100644
--- a/cmd/mxcli/testrunner/generator_endpoint_test.go
+++ b/cmd/mxcli/testrunner/generator_endpoint_test.go
@@ -94,7 +94,7 @@ func TestGenerateTestFlowsWrapsCallsWithErrorHandling(t *testing.T) {
 	}}}
 	mdl := GenerateTestFlows(suite)
 
-	if !strings.Contains(mdl, "ON ERROR {") {
+	if !strings.Contains(mdl, "ON ERROR BEGIN") {
 		t.Errorf("the CALL was not wrapped in ON ERROR:\n%s", mdl)
 	}
 	if !strings.Contains(mdl, verdictFailPrefix+"exception during execution") {
@@ -113,7 +113,7 @@ func TestGenerateTestFlowsThrowsTestStartsFailed(t *testing.T) {
 	mdl := GenerateTestFlows(suite)
 
 	failIdx := strings.Index(mdl, verdictFailPrefix+"expected an exception")
-	handlerIdx := strings.Index(mdl, "ON ERROR {")
+	handlerIdx := strings.Index(mdl, "ON ERROR BEGIN")
 	if failIdx < 0 {
 		t.Fatalf("no pre-set failure verdict:\n%s", mdl)
 	}
@@ -135,10 +135,10 @@ func TestGenerateTestFlowsMultiLineCall(t *testing.T) {
 	}}}
 	mdl := GenerateTestFlows(suite)
 
-	if !strings.Contains(mdl, ") ON ERROR {") {
+	if !strings.Contains(mdl, ") ON ERROR BEGIN") {
 		t.Errorf("a statement spanning lines was not joined before ON ERROR was attached:\n%s", mdl)
 	}
-	if strings.Count(mdl, "ON ERROR {") != 1 {
+	if strings.Count(mdl, "ON ERROR BEGIN") != 1 {
 		t.Errorf("expected exactly one handler for one call:\n%s", mdl)
 	}
 }
diff --git a/cmd/mxcli/testrunner/generator_test.go b/cmd/mxcli/testrunner/generator_test.go
index 4622a06762..2b0a434ec9 100644
--- a/cmd/mxcli/testrunner/generator_test.go
+++ b/cmd/mxcli/testrunner/generator_test.go
@@ -101,3 +101,27 @@ func TestGenerateTestRunner_RenamesAllAssignmentsInTestBlock(t *testing.T) {
 		}
 	}
 }
+
+// The generated test flows are MDL mxcli executes itself, so their error
+// handlers use the canonical `on error begin … end error` and record no
+// deprecated spelling (MDL-DEPR540, ako/mxcli#754).
+func TestGeneratedErrorHandlersAreCanonical(t *testing.T) {
+	suite := &TestSuite{Tests: []TestCase{
+		{ID: "t1", Name: "call", MDL: "$r = CALL MICROFLOW Mod.A();", Setups: []string{"Mod.Setup"}},
+		{ID: "t2", Name: "multi", MDL: "$r = CALL MICROFLOW Mod.A(\n  X = 1\n);"},
+	}}
+	for name, src := range map[string]string{
+		"endpoint": GenerateTestFlows(suite),
+		"legacy":   GenerateTestRunner(suite),
+	} {
+		prog, errs := visitor.Build(src)
+		if len(errs) > 0 {
+			t.Fatalf("%s: generated MDL does not parse: %v\n%s", name, errs[0], src)
+		}
+		for _, d := range prog.Deprecations {
+			if d.Code == "MDL-DEPR540" {
+				t.Errorf("%s: line %d uses the brace error handler:\n%s", name, d.Line, src)
+			}
+		}
+	}
+}
diff --git a/docs-site/src/appendixes/common-mistakes.md b/docs-site/src/appendixes/common-mistakes.md
index 945330d480..7d70bd926b 100644
--- a/docs-site/src/appendixes/common-mistakes.md
+++ b/docs-site/src/appendixes/common-mistakes.md
@@ -126,7 +126,7 @@ These constructs will cause parse errors:
 | Unsupported | Use Instead |
 |-------------|-------------|
 | `CASE ... WHEN 'String' ... ELSE ...` | Bare enum values, one branch per value including `(empty)` — `CASE` itself IS supported for enum splits |
-| `TRY ... CATCH ... END TRY` | `ON ERROR { ... }` blocks on specific activities |
+| `TRY ... CATCH ... END TRY` | `ON ERROR BEGIN ... END ERROR` blocks on specific activities |
 
 ## Boolean Attributes Must Have Defaults
 
diff --git a/docs-site/src/appendixes/data-type-mapping.md b/docs-site/src/appendixes/data-type-mapping.md
index 5129b59b2c..9ccb3bacc8 100644
--- a/docs-site/src/appendixes/data-type-mapping.md
+++ b/docs-site/src/appendixes/data-type-mapping.md
@@ -67,9 +67,9 @@ Comprehensive mapping between MDL data types, Mendix internal types, and backend
 | Constraint | Syntax | Description |
 |------------|--------|-------------|
 | Not Null | `NOT NULL` | Value is required |
-| Not Null with Error | `NOT NULL ERROR 'message'` | Required with custom error |
+| Not Null with Error | `NOT NULL ERROR MESSAGE 'message'` | Required with custom error |
 | Unique | `UNIQUE` | Value must be unique |
-| Unique with Error | `UNIQUE ERROR 'message'` | Unique with custom error |
+| Unique with Error | `UNIQUE ERROR MESSAGE 'message'` | Unique with custom error |
 
 Constraints must appear in this order:
 1. `NOT NULL [ERROR '...']`
diff --git a/docs-site/src/appendixes/quick-reference.md b/docs-site/src/appendixes/quick-reference.md
index 5747f21e2c..36e678720d 100644
--- a/docs-site/src/appendixes/quick-reference.md
+++ b/docs-site/src/appendixes/quick-reference.md
@@ -32,7 +32,7 @@ CREATE PERSISTENT ENTITY Module.Photo (
 | List entities | `LIST ENTITIES [IN Module];` | List all or filter by module |
 | Create enumeration | `CREATE [OR MODIFY] ENUMERATION Module.Name (Value1 'Caption', ...);` | |
 | Drop enumeration | `DROP ENUMERATION Module.Name;` | |
-| Create association | `CREATE ASSOCIATION Module.Name FROM Parent TO Child TYPE Reference\|ReferenceSet [OWNER Default\|Both] [DELETE_BEHAVIOR ...];` | |
+| Create association | `CREATE ASSOCIATION Module.Name FROM Parent TO Child TYPE Reference\|ReferenceSet [OWNER Default\|Both] [ON DELETE CASCADE\|RESTRICT\|SET NULL];` | |
 | Drop association | `DROP ASSOCIATION Module.Name;` | |
 
 ## ALTER ENTITY
@@ -156,7 +156,7 @@ AUTHENTICATION Basic, Session
 | Retrieve (Assoc) | `RETRIEVE $List FROM $Parent/Module.AssocName;` | Retrieve by association |
 | Call microflow | `$Result = CALL MICROFLOW Module.Name (Param = $value);` | |
 | Call nanoflow | `$Result = CALL NANOFLOW Module.Name (Param = $value);` | |
-| Show page | `LIST PAGE Module.PageName ($Param = $value);` | Also accepts `(Param: $value)` |
+| Show page | `SHOW PAGE Module.PageName (Param = $value);` | `($Param = …)` and `(Param: …)` are deprecated |
 | Close page | `CLOSE PAGE;` | |
 | Validation | `VALIDATION FEEDBACK $Entity/Attribute MESSAGE 'message';` | Requires attribute path + MESSAGE |
 | Log | `LOG INFO\|WARNING\|ERROR [NODE 'name'] 'message';` | |
@@ -170,14 +170,14 @@ AUTHENTICATION Basic, Session
 | WHILE | `WHILE condition BEGIN ... END WHILE;` | Condition-based loop |
 | Return | `RETURN $value;` | Required at end of every flow path |
 | Execute DB query | `$Result = EXECUTE DATABASE QUERY Module.Conn.Query;` | 3-part name; supports DYNAMIC, params, CONNECTION override |
-| Error handling | `... ON ERROR CONTINUE\|ROLLBACK\|{ handler };` | Not supported on EXECUTE DATABASE QUERY |
+| Error handling | `... ON ERROR CONTINUE\|ROLLBACK\|[WITHOUT ROLLBACK] BEGIN handler END ERROR;` | Not supported on EXECUTE DATABASE QUERY |
 
 ## Microflows - NOT Supported (Will Cause Parse Errors)
 
 | Unsupported | Use Instead | Notes |
 |-------------|-------------|-------|
 | `CASE ... WHEN 'String' ... ELSE ...` | Bare enum values, one branch per value | `CASE` itself IS supported for **enum splits**; what fails is quoted/qualified values, an `ELSE` branch (MDL008), and an `AS` alias |
-| `TRY ... CATCH ... END TRY` | `ON ERROR { ... }` blocks | Use error handlers on specific activities |
+| `TRY ... CATCH ... END TRY` | `ON ERROR BEGIN ... END ERROR` blocks | Use error handlers on specific activities |
 
 **Notes:**
 - `RETRIEVE ... FIRST` returns a single entity; `RETRIEVE ... LIMIT n [OFFSET n]` returns a list. A bare `LIMIT 1` is a list of one under `mdl 1;`, and without the header the single entity, with warning `MDL-V1-LIMIT1`.
@@ -353,8 +353,8 @@ MDL uses explicit property declarations for pages:
 | Widget name | Required after type | `TEXTBOX txtName (...)` |
 | Attribute binding | `Attribute: AttrName` | `TEXTBOX txt (Label: 'Name', Attribute: Name)` |
 | Variable binding | `DataSource: $Var` | `DATAVIEW dv (DataSource: $Product) { ... }` |
-| Action binding | `Action: TYPE` | `ACTIONBUTTON btn (Caption: 'Save', Action: SAVE_CHANGES)` |
-| Microflow action | `Action: MICROFLOW Name(Param: val)` | `Action: MICROFLOW Mod.ACT_Process(Order: $Order)` |
+| Action binding | `Action: TYPE` | `ACTIONBUTTON btn (Caption: 'Save', Action: save changes)` |
+| Microflow action | `Action: MICROFLOW Name(Param = val)` | `Action: MICROFLOW Mod.ACT_Process(Order = $Order)` |
 | Database source | `DataSource: DATABASE Entity` | `DATAGRID dg (DataSource: DATABASE Module.Entity)` |
 | Selection binding | `DataSource: SELECTION widget` | `DATAVIEW dv (DataSource: SELECTION galleryList)` |
 | CSS class | `Class: 'classes'` | `CONTAINER c (Class: 'card mx-spacing-top-large')` |
@@ -401,8 +401,8 @@ CREATE PAGE MyModule.Customer_Edit
     COMBOBOX cbStatus (Label: 'Status', Attribute: Status)
 
     FOOTER footer1 {
-      ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE_CHANGES, ButtonStyle: Primary)
-      ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL_CHANGES)
+      ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE CHANGES, ButtonStyle: Primary)
+      ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL CHANGES)
     }
   }
 }
diff --git a/docs-site/src/examples/alter-page.md b/docs-site/src/examples/alter-page.md
index af4461984c..2afd6c931d 100644
--- a/docs-site/src/examples/alter-page.md
+++ b/docs-site/src/examples/alter-page.md
@@ -46,9 +46,9 @@ ALTER PAGE CRM.Customer_Edit {
 ALTER PAGE CRM.Customer_Edit {
   REPLACE footer1 WITH {
     FOOTER newFooter {
-      ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE_CHANGES, ButtonStyle: Success)
+      ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE CHANGES, ButtonStyle: Success)
       ACTIONBUTTON btnDelete (Caption: 'Delete', Action: DELETE, ButtonStyle: Danger)
-      ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL_CHANGES)
+      ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL CHANGES)
     }
   }
 };
@@ -127,7 +127,7 @@ ALTER SNIPPET CRM.NavigationMenu {
   INSERT AFTER btnHome {
     ACTIONBUTTON btnReports (
       Caption: 'Reports',
-      Action: SHOW_PAGE CRM.Reports_Overview
+      Action: SHOW PAGE CRM.Reports_Overview
     )
   }
 };
diff --git a/docs-site/src/examples/crm-module.md b/docs-site/src/examples/crm-module.md
index ca5980c00a..1d9d453b42 100644
--- a/docs-site/src/examples/crm-module.md
+++ b/docs-site/src/examples/crm-module.md
@@ -25,9 +25,9 @@ CREATE PERSISTENT ENTITY CRM.Customer (
   /** Auto-generated unique identifier */
   CustomerId: AutoNumber NOT NULL UNIQUE DEFAULT 1,
   /** Full legal name */
-  Name: String(200) NOT NULL ERROR 'Customer name is required',
+  Name: String(200) NOT NULL ERROR MESSAGE 'Customer name is required',
   /** Primary contact email */
-  Email: String(200) UNIQUE ERROR 'Email already exists',
+  Email: String(200) UNIQUE ERROR MESSAGE 'Email already exists',
   /** Phone number in international format */
   Phone: String(50),
   /** Current account balance */
@@ -51,7 +51,7 @@ CREATE PERSISTENT ENTITY CRM.ContactLog (
   /** Type of interaction */
   Type: Enumeration(CRM.ContactType) DEFAULT 'Email',
   /** Summary of what was discussed */
-  Summary: String(2000) NOT NULL ERROR 'Summary is required',
+  Summary: String(2000) NOT NULL ERROR MESSAGE 'Summary is required',
   /** Follow-up needed? */
   FollowUpRequired: Boolean DEFAULT FALSE
 );
@@ -96,7 +96,7 @@ END;
 CREATE MICROFLOW CRM.ACT_Customer_Save ($Customer: CRM.Customer)
 RETURNS Boolean AS $IsValid
 BEGIN
-  $IsValid = CALL MICROFLOW CRM.VAL_Customer($param = $Customer);
+  $IsValid = CALL MICROFLOW CRM.VAL_Customer(param = $Customer);
 
   IF $IsValid THEN
     COMMIT $Customer;
@@ -123,7 +123,7 @@ CREATE PAGE CRM.Customer_Overview (
     COLUMN colStatus (Attribute: Status, Caption: 'Status')
     COLUMN colActive (Attribute: IsActive, Caption: 'Active')
     CONTROLBAR cb1 {
-      ACTIONBUTTON btnNew (Caption: 'New', Action: SHOW_PAGE CRM.Customer_NewEdit, ButtonStyle: Primary)
+      ACTIONBUTTON btnNew (Caption: 'New', Action: SHOW PAGE CRM.Customer_NewEdit, ButtonStyle: Primary)
     }
   }
 };
@@ -146,10 +146,10 @@ CREATE PAGE CRM.Customer_NewEdit (
           FOOTER footer1 {
             ACTIONBUTTON btnSave (
               Caption: 'Save',
-              Action: MICROFLOW CRM.ACT_Customer_Save,
+              Action: CALL MICROFLOW CRM.ACT_Customer_Save,
               ButtonStyle: Success
             )
-            ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL_CHANGES)
+            ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL CHANGES)
           }
         }
       }
diff --git a/docs-site/src/examples/master-detail.md b/docs-site/src/examples/master-detail.md
index cb52a25c76..f6e7cda13a 100644
--- a/docs-site/src/examples/master-detail.md
+++ b/docs-site/src/examples/master-detail.md
@@ -38,10 +38,10 @@ CREATE PAGE CRM.Customer_MasterDetail (
           FOOTER footer1 {
             ACTIONBUTTON btnSave (
               Caption: 'Save',
-              Action: SAVE_CHANGES,
+              Action: SAVE CHANGES,
               ButtonStyle: Success
             )
-            ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL_CHANGES)
+            ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL CHANGES)
           }
         }
       }
diff --git a/docs-site/src/examples/rest-integration.md b/docs-site/src/examples/rest-integration.md
index 49afe92195..de482eac7c 100644
--- a/docs-site/src/examples/rest-integration.md
+++ b/docs-site/src/examples/rest-integration.md
@@ -130,10 +130,10 @@ BEGIN
     HEADER Accept = 'application/json'
     TIMEOUT 30
     RETURNS String
-    ON ERROR WITHOUT ROLLBACK {
+    ON ERROR WITHOUT ROLLBACK BEGIN
       LOG ERROR NODE 'Integration' 'API call failed: ' + $Url;
       RETURN false;
-    };
+    END ERROR;
 
   SET $Success = true;
   RETURN $Success;
diff --git a/docs-site/src/examples/validation.md b/docs-site/src/examples/validation.md
index 91f952aa0c..18af118bef 100644
--- a/docs-site/src/examples/validation.md
+++ b/docs-site/src/examples/validation.md
@@ -54,7 +54,7 @@ The action microflow calls validation, and only saves if it passes:
 CREATE MICROFLOW Sales.ACT_Order_Save ($Order: Sales.Order)
 RETURNS Boolean AS $IsValid
 BEGIN
-  $IsValid = CALL MICROFLOW Sales.VAL_Order($param = $Order);
+  $IsValid = CALL MICROFLOW Sales.VAL_Order(param = $Order);
 
   IF $IsValid THEN
     COMMIT $Order;
@@ -87,10 +87,10 @@ CREATE PAGE Sales.Order_Edit (
           FOOTER footer1 {
             ACTIONBUTTON btnSave (
               Caption: 'Save',
-              Action: MICROFLOW Sales.ACT_Order_Save,
+              Action: CALL MICROFLOW Sales.ACT_Order_Save,
               ButtonStyle: Success
             )
-            ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL_CHANGES)
+            ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL CHANGES)
           }
         }
       }
diff --git a/docs-site/src/internals/reference-tracking.md b/docs-site/src/internals/reference-tracking.md
index bd8a6c7064..f1088fba24 100644
--- a/docs-site/src/internals/reference-tracking.md
+++ b/docs-site/src/internals/reference-tracking.md
@@ -10,7 +10,7 @@ During a full catalog refresh, every document is analyzed for outgoing reference
 |--------------|-------------------|
 | **Microflows** | CALL MICROFLOW actions, RETRIEVE data sources, entity parameters, SHOW PAGE actions, association traversals |
 | **Nanoflows** | Same as microflows (client-side) |
-| **Pages** | Data source entities, microflow data sources, SHOW_PAGE actions, association paths, snippet calls |
+| **Pages** | Data source entities, microflow data sources, SHOW PAGE actions, association paths, snippet calls |
 | **Snippets** | Same as pages |
 | **Domain Models** | Generalization references, association endpoints |
 
diff --git a/docs-site/src/language/activity-types.md b/docs-site/src/language/activity-types.md
index 9ea237b1d7..73cc4695b3 100644
--- a/docs-site/src/language/activity-types.md
+++ b/docs-site/src/language/activity-types.md
@@ -171,23 +171,20 @@ Java action parameters follow the same `Name = value` syntax.
 Opens a page, passing parameters:
 
 ```sql
-SHOW PAGE Sales.Order_Edit ($Order = $Order);
+SHOW PAGE Sales.Order_Edit (Order = $Order);
 ```
 
-The parameter syntax uses `$PageParam = $MicroflowVar`. Multiple parameters are comma-separated:
+The parameter syntax is `PageParam = $MicroflowVar`, with no `$` on the page's parameter name. Multiple parameters are comma-separated:
 
 ```sql
 SHOW PAGE Sales.OrderDetail (
-  $Order = $Order,
-  $Customer = $Customer
+  Order = $Order,
+  Customer = $Customer
 );
 ```
 
-An alternate syntax using colon notation is also supported:
-
-```sql
-SHOW PAGE Sales.Order_Edit (Order: $Order);
-```
+The older spellings `($Order = $Order)` and `(Order: $Order)` still parse but are
+deprecated (MDL-DEPR006, MDL-DEPR007); `mxcli fmt --upgrade` rewrites them.
 
 ### CLOSE PAGE
 
@@ -246,8 +243,7 @@ $Result = EXECUTE DATABASE QUERY MyModule.MyConn.SearchQuery
   DYNAMIC 'SELECT * FROM customers WHERE name LIKE ?';
 
 -- With parameters
-$Result = EXECUTE DATABASE QUERY MyModule.MyConn.GetByEmail
-  PARAMETERS ($EmailParam = $Email);
+$Result = EXECUTE DATABASE QUERY MyModule.MyConn.GetByEmail (EmailParam = $Email);
 
 -- With runtime connection override
 $Result = EXECUTE DATABASE QUERY MyModule.MyConn.GetData
@@ -272,7 +268,7 @@ The query name follows a three-part naming convention: `Module.ConnectionName.Qu
 | Call microflow | `$Var = CALL MICROFLOW Module.Name (Param = $val);` | Any type |
 | Call nanoflow | `$Var = CALL NANOFLOW Module.Name (Param = $val);` | Any type |
 | Call Java action | `$Var = CALL JAVA ACTION Module.Name (Param = val);` | Any type |
-| Show page | `SHOW PAGE Module.Page ($Param = $val);` | -- |
+| Show page | `SHOW PAGE Module.Page (Param = $val);` | -- |
 | Close page | `CLOSE PAGE;` | -- |
 | Validation | `VALIDATION FEEDBACK $Var/Attr MESSAGE 'msg';` | -- |
 | Log | `LOG INFO\|WARNING\|ERROR [NODE 'name'] 'msg';` | -- |
diff --git a/docs-site/src/language/alter-page.md b/docs-site/src/language/alter-page.md
index af598a9b9c..1875473064 100644
--- a/docs-site/src/language/alter-page.md
+++ b/docs-site/src/language/alter-page.md
@@ -113,7 +113,7 @@ ALTER PAGE Module.EditPage {
 -- Insert before a widget
 ALTER PAGE Module.EditPage {
   INSERT BEFORE btnSave {
-    ACTIONBUTTON btnPreview (Caption: 'Preview', Action: MICROFLOW Module.ACT_Preview)
+    ACTIONBUTTON btnPreview (Caption: 'Preview', Action: CALL MICROFLOW Module.ACT_Preview)
   }
 };
 
diff --git a/docs-site/src/language/associations.md b/docs-site/src/language/associations.md
index a39486b724..c1f108033f 100644
--- a/docs-site/src/language/associations.md
+++ b/docs-site/src/language/associations.md
@@ -18,7 +18,7 @@ CREATE ASSOCIATION <Module>.<Name>
   TO <ChildEntity>
   TYPE <Reference|ReferenceSet>
   [OWNER <Default|Both|Parent|Child>]
-  [DELETE_BEHAVIOR <behavior>]
+  [ON DELETE <CASCADE|RESTRICT|SET NULL> [ERROR MESSAGE '<text>']]
 ```
 
 ### Reference (Many-to-One)
@@ -32,7 +32,7 @@ CREATE ASSOCIATION Sales.Order_Customer
   TO Sales.Order
   TYPE Reference
   OWNER Default
-  DELETE_BEHAVIOR DELETE_BUT_KEEP_REFERENCES;
+  ON DELETE SET NULL;
 ```
 
 ### ReferenceSet (Many-to-Many)
@@ -65,8 +65,11 @@ Controls what happens when an associated object is deleted.
 
 | Behavior | MDL Keyword | Description |
 |----------|-------------|-------------|
-| Keep references | `DELETE_BUT_KEEP_REFERENCES` | Delete the object, set references to null |
-| Cascade | `DELETE_AND_REFERENCES` | Delete associated objects as well |
+| Keep references | `ON DELETE SET NULL` | Delete the object, set references to null (the default) |
+| Cascade | `ON DELETE CASCADE` | Delete associated objects as well |
+| Restrict | `ON DELETE RESTRICT [ERROR MESSAGE '…']` | Refuse the delete while references exist |
+
+The older `DELETE_BEHAVIOR <behavior>` clause still parses with the same meaning, but is deprecated (MDL-DEPR022).
 
 ```sql
 /** Invoice must be deleted with Order */
@@ -74,7 +77,7 @@ CREATE ASSOCIATION Sales.Order_Invoice
   FROM Sales.Order
   TO Sales.Invoice
   TYPE Reference
-  DELETE_BEHAVIOR DELETE_AND_REFERENCES;
+  ON DELETE CASCADE;
 ```
 
 ## Naming Convention
diff --git a/docs-site/src/language/attributes.md b/docs-site/src/language/attributes.md
index 398e2ae5f2..a83ebc5b52 100644
--- a/docs-site/src/language/attributes.md
+++ b/docs-site/src/language/attributes.md
@@ -37,9 +37,9 @@ Validation rules are expressed as attribute constraints. When validation fails,
 | Validation | MDL Syntax | Description |
 |------------|------------|-------------|
 | Required | `NOT NULL` | Attribute must have a value |
-| Required with message | `NOT NULL ERROR 'message'` | Custom error message on empty |
+| Required with message | `NOT NULL ERROR MESSAGE 'message'` | Custom error message on empty |
 | Unique | `UNIQUE` | Value must be unique across all objects |
-| Unique with message | `UNIQUE ERROR 'message'` | Custom error message on duplicate |
+| Unique with message | `UNIQUE ERROR MESSAGE 'message'` | Custom error message on duplicate |
 
 ### Example with Validation
 
@@ -49,14 +49,14 @@ CREATE PERSISTENT ENTITY Sales.Product (
   Name: String(200) NOT NULL,
 
   -- Required with custom error
-  SKU: String(50) NOT NULL ERROR 'SKU is required for all products',
+  SKU: String(50) NOT NULL ERROR MESSAGE 'SKU is required for all products',
 
   -- Unique only
   Barcode: String(50) UNIQUE,
 
   -- Required and unique with custom errors
-  ProductCode: String(20) NOT NULL ERROR 'Product code required'
-                          UNIQUE ERROR 'Product code must be unique',
+  ProductCode: String(20) NOT NULL ERROR MESSAGE 'Product code required'
+                          UNIQUE ERROR MESSAGE 'Product code must be unique',
 
   -- Optional field (no validation)
   Description: String(unlimited)
diff --git a/docs-site/src/language/basics.md b/docs-site/src/language/basics.md
index b33d43e2ea..e109b8f5db 100644
--- a/docs-site/src/language/basics.md
+++ b/docs-site/src/language/basics.md
@@ -36,6 +36,22 @@ Under `mdl 1;` a missing `;` is an error, and so is the Oracle SQL*Plus-style `/
 
 A trailing comma is allowed in every bracketed list — attributes, enumeration values, parameters, property lists, `{ … }` blocks — under every language version. `()` is the only way to write an empty list: `(,)` and `(a,,)` are errors.
 
+## Keyword Case
+
+Keywords are case-insensitive, and lowercase is canonical: `describe` writes them in lowercase and `mxcli fmt` normalizes them to it. Names are not keywords, even when they are spelled like one — a module member `User`, an attribute `Title` or a property key `Folder:` keeps its case, and so does a CamelCase value such as `ButtonStyle: Success` or a type name such as `String(200)`. Expressions, XPath, OQL and SQL are stored as written, so `fmt` leaves their text alone.
+
+## One Spelling per Keyword
+
+Each keyword has one spelling, and a page action uses the words a microflow uses. The older spellings still parse with the same meaning, warn with the code shown, and are rewritten by `mxcli fmt --upgrade`:
+
+| Canonical | Deprecated | Code |
+|---|---|---|
+| `show page`, `save changes`, `cancel changes`, `close page`, `create object`, `delete`, `open link`, `sign out`, `complete task`, `call microflow M.F`, `call nanoflow M.F` | `show_page`, `save_changes`, `cancel_changes`, `close_page`, `create_object`, `delete_object`, `open_link`, `sign_out`, `complete_task`, `microflow M.F`, `nanoflow M.F` | `MDL-DEPR020` |
+| `not null error message '…'` (also after `unique`, `required`), validation rule `error message '…'`, `on delete restrict error message '…'` | `not null error '…'`, `feedback '…'`, `error_message '…'`, `errormessage '…'` | `MDL-DEPR021` |
+| `on delete cascade` / `restrict` / `set null` | `delete_behavior cascade` / `prevent` / `delete_and_references` / `delete_if_no_references` / `delete_but_keep_references` | `MDL-DEPR022` |
+| `type ReferenceSet` | `type reference_set` | `MDL-DEPR023` |
+| `returns nothing` (REST call) | `returns none` | `MDL-DEPR024` |
+
 ## Language Version Header
 
 A script may start with a header that names the MDL language version it is written in:
@@ -61,10 +77,11 @@ What `mdl 1` makes strict (each is a warning without the header, with the code s
 | A `/` terminator line is an error. | Accepted; `MDL-V1-SLASH`. |
 | `''` is the only string escape; a backslash is an ordinary character, so `'C:\temp'` is that path. | `\n`, `\r`, `\t`, `\\` and `\'` are escapes; `MDL-V1-ESCAPE` for each literal whose value would change. |
 | In a REST client, published REST service, business event service, model, knowledge base, consumed MCP service or agent, an unknown property key is an error that names the key it most likely meant, and so is a value its key does not take (`Response: json from $X`). | The property is ignored, or read by its shape as before; `MDL-V1-PROP` / `MDL-V1-PROPVALUE`. |
+| A `while` loop is `while <condition> begin … end while;`; leaving out `begin`, or the `while` after `end`, is an error. | Accepted; `MDL-V1-WHILE`. |
 
 ### Upgrading a script: `mxcli fmt --upgrade`
 
-`mxcli fmt --upgrade` rewrites every deprecated spelling (the `MDL-DEPRnnn` warnings) to its canonical form — `create or replace` becomes `create or modify`, `show entities` becomes `list entities` — and changes nothing else: comments, layout and keyword case are kept. A deprecated use with no mechanical rewrite is reported and left in place.
+`mxcli fmt --upgrade` rewrites every deprecated spelling (the `MDL-DEPRnnn` warnings) to its canonical form — `create or replace` becomes `create or modify`, `show entities` becomes `list entities`, `on error { … }` becomes `on error begin … end error` — and changes nothing else: comments, layout and keyword case are kept. A deprecated use with no mechanical rewrite is reported and left in place.
 
 ```bash
 mxcli fmt --upgrade script.mdl            # print the upgraded script
@@ -83,6 +100,7 @@ mxcli fmt --upgrade --header -w script.mdl  # also add `mdl 1;`
 | `MDL-V1-SET` | `$x = …` becomes `set $x = …` |
 | `MDL-V1-LIST`, `MDL-DEPR003`, `MDL-DEPR004` | a list operation or aggregate call becomes its statement form (`$x = filter($L, …)` → `$x = filter $L where …`); `find`/`contains` on a declared String keeps the call and gains `set` |
 | `MDL-V1-REPLACE02` | `create or replace user role` / `demo user` becomes a plain `create` |
+| `MDL-V1-WHILE` | inserts the missing `begin` after a `while` condition and `while` after its `end` |
 
 A construct with no mechanical rewrite is reported with the reason, and `fmt` refuses to add the header rather than change the script's meaning: an unknown or mis-shaped property (`MDL-V1-PROP`, `MDL-V1-PROPVALUE`), `create or replace view entity` (`MDL-V1-REPLACE01`), a nested list operation such as `count(filter(…))`, `find`/`contains` on a variable whose type the script does not state, and an escaped line break (`\n`) inside an expression. While `mdl 1` is a preview, the header is added only when asked. Running `fmt --upgrade` on its own output changes nothing.
 
diff --git a/docs-site/src/language/constraints.md b/docs-site/src/language/constraints.md
index 287fa3351f..d61e91ad29 100644
--- a/docs-site/src/language/constraints.md
+++ b/docs-site/src/language/constraints.md
@@ -25,7 +25,7 @@ Name: String(200) NOT NULL
 With a custom error message displayed to the user:
 
 ```sql
-Name: String(200) NOT NULL ERROR 'Name is required'
+Name: String(200) NOT NULL ERROR MESSAGE 'Name is required'
 ```
 
 ## UNIQUE
@@ -39,7 +39,7 @@ Email: String(200) UNIQUE
 With a custom error message:
 
 ```sql
-Email: String(200) UNIQUE ERROR 'Email already exists'
+Email: String(200) UNIQUE ERROR MESSAGE 'Email already exists'
 ```
 
 ## DEFAULT
@@ -76,8 +76,8 @@ OptionalField: String(200)
 All three constraints can be used together:
 
 ```sql
-Email: String(200) NOT NULL ERROR 'Email is required'
-                   UNIQUE ERROR 'Email already exists'
+Email: String(200) NOT NULL ERROR MESSAGE 'Email is required'
+                   UNIQUE ERROR MESSAGE 'Email already exists'
                    DEFAULT ''
 ```
 
@@ -89,14 +89,14 @@ CREATE PERSISTENT ENTITY Sales.Product (
   Name: String(200) NOT NULL,
 
   -- Required with custom error
-  SKU: String(50) NOT NULL ERROR 'SKU is required for all products',
+  SKU: String(50) NOT NULL ERROR MESSAGE 'SKU is required for all products',
 
   -- Unique only
   Barcode: String(50) UNIQUE,
 
   -- Required and unique with custom errors
-  ProductCode: String(20) NOT NULL ERROR 'Product code required'
-                          UNIQUE ERROR 'Product code must be unique',
+  ProductCode: String(20) NOT NULL ERROR MESSAGE 'Product code required'
+                          UNIQUE ERROR MESSAGE 'Product code must be unique',
 
   -- Default only
   Quantity: Integer DEFAULT 0,
diff --git a/docs-site/src/language/control-flow.md b/docs-site/src/language/control-flow.md
index 06201caa58..f87ac5f4c0 100644
--- a/docs-site/src/language/control-flow.md
+++ b/docs-site/src/language/control-flow.md
@@ -170,6 +170,8 @@ END WHILE;
 
 > **Caution:** Ensure the condition will eventually become false to avoid infinite loops.
 
+`BEGIN` and `END WHILE` are required under the `mdl 1;` header, as they are for `LOOP`. A script without the header may still leave either out, and `check` warns `MDL-V1-WHILE`.
+
 ## Error Handling
 
 ### ON ERROR Suffix
@@ -197,14 +199,16 @@ DELETE $Order ON ERROR ROLLBACK;
 Executes a custom error handling block when the activity fails:
 
 ```sql
-COMMIT $Order ON ERROR {
+COMMIT $Order ON ERROR BEGIN
   LOG ERROR 'Failed to commit order: ' + $Order/OrderNumber;
   ROLLBACK $Order;
-};
+END ERROR;
 ```
 
 The handler block can contain any activities -- logging, rollback, showing validation messages, etc.
 
+The handler is flow, so it is written `BEGIN … END ERROR` like every other flow block; add `WITHOUT ROLLBACK` before `BEGIN` to keep the database changes made so far. The older brace form, `ON ERROR { … }`, still parses and builds the same handler, with warning `MDL-DEPR540`; `mxcli fmt --upgrade` rewrites it.
+
 A handler that does not end in `RETURN` or `RAISE ERROR` falls through: after it
 runs, the microflow continues with the statement after the activity, through a
 merge placed where the two paths meet. `DESCRIBE` writes the merge's position as
@@ -221,10 +225,10 @@ RETRIEVE $Config FROM Admin.SystemConfig LIMIT 1 ON ERROR CONTINUE;
 -- Custom error handler for external call
 $Response = CALL MICROFLOW Integration.CallExternalAPI (
   Payload = $RequestBody
-) ON ERROR {
+) ON ERROR BEGIN
   LOG ERROR NODE 'Integration' 'External API call failed';
   SET $Response = empty;
-};
+END ERROR;
 
 -- Rollback on commit failure
 COMMIT $Order ON ERROR ROLLBACK;
@@ -236,13 +240,13 @@ COMMIT $Order ON ERROR ROLLBACK;
 
 `RAISE ERROR` builds Mendix's **error event**, which re-raises the error currently
 being handled. Mendix allows one only where an error is in scope, so it belongs
-inside an `ON ERROR { ... }` block:
+inside an `ON ERROR BEGIN ... END ERROR` block:
 
 ```sql
-CALL MICROFLOW Integration.CallExternalAPI (Payload = $Body) ON ERROR {
+CALL MICROFLOW Integration.CallExternalAPI (Payload = $Body) ON ERROR BEGIN
   LOG ERROR NODE 'Integration' 'API call failed, re-raising';
   RAISE ERROR;
-};
+END ERROR;
 ```
 
 On the **main flow** it is refused as **MDL084**, at any nesting depth — inside an
@@ -331,7 +335,7 @@ The following constructs are **not** supported in MDL and will cause parse error
 | Unsupported | Use Instead |
 |-------------|-------------|
 | `CASE ... WHEN 'String' ... ELSE ...` | Bare enum values and a branch per value — see [CASE (Enum Split)](#case-enum-split); `CASE` itself is supported |
-| `TRY ... CATCH ... END TRY` | `ON ERROR { ... }` blocks on individual activities |
+| `TRY ... CATCH ... END TRY` | `ON ERROR BEGIN ... END ERROR` blocks on individual activities |
 
 ## Complete Example
 
@@ -356,11 +360,11 @@ BEGIN
     @caption 'Process order'
     CALL MICROFLOW Sales.SUB_ProcessSingleOrder (
       Order = $Order
-    ) ON ERROR {
+    ) ON ERROR BEGIN
       LOG ERROR 'Failed to process order: ' + $Order/OrderNumber;
       SET $ErrorCount = $ErrorCount + 1;
       CONTINUE;
-    };
+    END ERROR;
 
     SET $SuccessCount = $SuccessCount + 1;
   END LOOP;
diff --git a/docs-site/src/language/data-binding.md b/docs-site/src/language/data-binding.md
index cb24095636..2200aaa89a 100644
--- a/docs-site/src/language/data-binding.md
+++ b/docs-site/src/language/data-binding.md
@@ -144,7 +144,7 @@ Action buttons can pass the current data context to microflows and pages:
 DATAVIEW dvOrder (DataSource: $Order) {
   ACTIONBUTTON btnProcess (
     Caption: 'Process Order',
-    Action: MICROFLOW Sales.ACT_ProcessOrder(Order: $Order),
+    Action: MICROFLOW Sales.ACT_ProcessOrder(Order = $Order),
     ButtonStyle: Primary
   )
 
diff --git a/docs-site/src/language/domain-model.md b/docs-site/src/language/domain-model.md
index 38b70fa63d..2649b3861b 100644
--- a/docs-site/src/language/domain-model.md
+++ b/docs-site/src/language/domain-model.md
@@ -43,8 +43,8 @@ CREATE ENUMERATION Sales.OrderStatus (
 @Position(100, 100)
 CREATE PERSISTENT ENTITY Sales.Customer (
   CustomerId: AutoNumber NOT NULL UNIQUE DEFAULT 1,
-  Name: String(200) NOT NULL ERROR 'Customer name is required',
-  Email: String(200) UNIQUE ERROR 'Email already registered',
+  Name: String(200) NOT NULL ERROR MESSAGE 'Customer name is required',
+  Email: String(200) UNIQUE ERROR MESSAGE 'Email already registered',
   Phone: String(50),
   IsActive: Boolean DEFAULT TRUE,
   CreatedAt: DateTime
@@ -72,7 +72,7 @@ CREATE ASSOCIATION Sales.Order_Customer
   TO Sales.Order
   TYPE Reference
   OWNER Default
-  DELETE_BEHAVIOR DELETE_BUT_KEEP_REFERENCES;
+  ON DELETE SET NULL;
 ```
 
 ## Further Reading
diff --git a/docs-site/src/language/entities.md b/docs-site/src/language/entities.md
index e5886bde16..f945111ce2 100644
--- a/docs-site/src/language/entities.md
+++ b/docs-site/src/language/entities.md
@@ -35,9 +35,9 @@ CREATE PERSISTENT ENTITY Sales.Customer (
   /** Auto-incrementing unique identifier */
   CustomerId: AutoNumber NOT NULL UNIQUE DEFAULT 1,
   /** Full legal name of the customer */
-  Name: String(200) NOT NULL ERROR 'Name is required',
+  Name: String(200) NOT NULL ERROR MESSAGE 'Name is required',
   /** Primary contact email address */
-  Email: String(200) UNIQUE ERROR 'Email must be unique',
+  Email: String(200) UNIQUE ERROR MESSAGE 'Email must be unique',
   /** Current account balance */
   Balance: Decimal DEFAULT 0,
   /** Whether the account is active */
@@ -170,10 +170,10 @@ CREATE PERSISTENT ENTITY Sales.Customer (
   CustomerId: AutoNumber NOT NULL UNIQUE DEFAULT 1,
 
   /** Full legal name of the customer */
-  Name: String(200) NOT NULL ERROR 'Name is required',
+  Name: String(200) NOT NULL ERROR MESSAGE 'Name is required',
 
   /** Primary contact email address */
-  Email: String(200) UNIQUE ERROR 'Email must be unique',
+  Email: String(200) UNIQUE ERROR MESSAGE 'Email must be unique',
 
   /** Current account balance in the base currency */
   Balance: Decimal DEFAULT 0,
diff --git a/docs-site/src/language/microflow-patterns.md b/docs-site/src/language/microflow-patterns.md
index 469041b489..b2daff6f7f 100644
--- a/docs-site/src/language/microflow-patterns.md
+++ b/docs-site/src/language/microflow-patterns.md
@@ -22,7 +22,7 @@ BEGIN
   );
   COMMIT $Customer;
 
-  SHOW PAGE Sales.Customer_Edit ($Customer = $Customer);
+  SHOW PAGE Sales.Customer_Edit (Customer = $Customer);
   RETURN $Customer;
 END;
 ```
@@ -135,11 +135,11 @@ BEGIN
   BEGIN
     CALL MICROFLOW Sales.SUB_ProcessOrder (
       Order = $Order
-    ) ON ERROR {
+    ) ON ERROR BEGIN
       LOG ERROR NODE 'BatchProcess' 'Failed to process order: ' + $Order/OrderNumber;
       SET $ErrorCount = $ErrorCount + 1;
       CONTINUE;
-    };
+    END ERROR;
 
     SET $SuccessCount = $SuccessCount + 1;
   END LOOP;
@@ -266,19 +266,19 @@ BEGIN
   @caption 'Call external API'
   $Response = CALL MICROFLOW Integration.SUB_CallExternalAPI (
     Config = $Config
-  ) ON ERROR {
+  ) ON ERROR BEGIN
     LOG ERROR NODE 'Integration' 'External API call failed';
     RETURN false;
-  };
+  END ERROR;
 
   IF $Response != empty THEN
     @caption 'Process response'
     CALL MICROFLOW Integration.SUB_ProcessResponse (
       Response = $Response
-    ) ON ERROR {
+    ) ON ERROR BEGIN
       LOG ERROR NODE 'Integration' 'Failed to process response';
       RETURN false;
-    };
+    END ERROR;
     SET $Success = true;
   END IF;
 
diff --git a/docs-site/src/language/microflows.md b/docs-site/src/language/microflows.md
index 8e516f9b3b..347dacb028 100644
--- a/docs-site/src/language/microflows.md
+++ b/docs-site/src/language/microflows.md
@@ -171,7 +171,7 @@ BEGIN
     Status = 'Draft'
   );
   COMMIT $Order;
-  SHOW PAGE Sales.Order_Edit ($Order = $Order);
+  SHOW PAGE Sales.Order_Edit (Order = $Order);
   RETURN $Order;
 END;
 ```
diff --git a/docs-site/src/language/nanoflows.md b/docs-site/src/language/nanoflows.md
index 672e88fa18..4dfa53c9ad 100644
--- a/docs-site/src/language/nanoflows.md
+++ b/docs-site/src/language/nanoflows.md
@@ -79,7 +79,7 @@ $HasNetwork = CALL JAVASCRIPT ACTION NanoflowCommons.HasConnectivity();
 
 ```sql
 -- Show a page
-SHOW PAGE Sales.CartDetail ($Cart = $Cart);
+SHOW PAGE Sales.CartDetail (Cart = $Cart);
 
 -- Close the current page
 CLOSE PAGE;
@@ -104,7 +104,7 @@ IF $Cart/ItemCount = 0 THEN
   VALIDATION FEEDBACK $Cart/ItemCount MESSAGE 'Cart is empty';
   RETURN false;
 ELSE
-  SHOW PAGE Sales.Checkout ($Cart = $Cart);
+  SHOW PAGE Sales.Checkout (Cart = $Cart);
   RETURN true;
 END IF;
 ```
@@ -184,7 +184,7 @@ CREATE NANOFLOW Sales.NAV_GoToOrderDetail
 BEGIN
   DECLARE $Order Sales.Order;
 
-  SHOW PAGE Sales.Order_Detail ($Order = $Order);
+  SHOW PAGE Sales.Order_Detail (Order = $Order);
 END;
 ```
 
diff --git a/docs-site/src/language/page-patterns.md b/docs-site/src/language/page-patterns.md
index 89be951553..92a6caaad3 100644
--- a/docs-site/src/language/page-patterns.md
+++ b/docs-site/src/language/page-patterns.md
@@ -22,10 +22,10 @@ CREATE PAGE MyModule.Customer_Overview
     CONTROLBAR bar1 {
       ACTIONBUTTON btnNew (
         Caption: 'New Customer',
-        Action: MICROFLOW MyModule.ACT_Customer_New,
+        Action: CALL MICROFLOW MyModule.ACT_Customer_New,
         ButtonStyle: Primary
       )
-      ACTIONBUTTON btnEdit (Caption: 'Edit', Action: SHOW_PAGE MyModule.Customer_Edit)
+      ACTIONBUTTON btnEdit (Caption: 'Edit', Action: SHOW PAGE MyModule.Customer_Edit)
       ACTIONBUTTON btnDelete (Caption: 'Delete', Action: DELETE, ButtonStyle: Danger)
     }
   }
@@ -41,7 +41,7 @@ BEGIN
   $Customer = CREATE MyModule.Customer (
     IsActive = true
   );
-  SHOW PAGE MyModule.Customer_Edit ($Customer = $Customer);
+  SHOW PAGE MyModule.Customer_Edit (Customer = $Customer);
   RETURN $Customer;
 END;
 ```
@@ -66,8 +66,8 @@ CREATE PAGE MyModule.Customer_Edit
     COMBOBOX cbStatus (Label: 'Status', Attribute: Status)
     CHECKBOX cbActive (Label: 'Active', Attribute: IsActive)
     FOOTER footer1 {
-      ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE_CHANGES, ButtonStyle: Primary)
-      ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL_CHANGES)
+      ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE CHANGES, ButtonStyle: Primary)
+      ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL CHANGES)
     }
   }
 }
@@ -107,10 +107,10 @@ CREATE PAGE MyModule.Customer_Detail
     FOOTER footer1 {
       ACTIONBUTTON btnEdit (
         Caption: 'Edit',
-        Action: SHOW_PAGE MyModule.Customer_Edit,
+        Action: SHOW PAGE MyModule.Customer_Edit,
         ButtonStyle: Primary
       )
-      ACTIONBUTTON btnBack (Caption: 'Back', Action: CLOSE_PAGE)
+      ACTIONBUTTON btnBack (Caption: 'Back', Action: CLOSE PAGE)
     }
   }
 }
@@ -140,7 +140,7 @@ CREATE PAGE MyModule.Product_MasterDetail
           CONTROLBAR bar1 {
             ACTIONBUTTON btnNew (
               Caption: 'New',
-              Action: MICROFLOW MyModule.ACT_Product_New,
+              Action: CALL MICROFLOW MyModule.ACT_Product_New,
               ButtonStyle: Primary
             )
           }
@@ -153,7 +153,7 @@ CREATE PAGE MyModule.Product_MasterDetail
           TEXTBOX txtPrice (Label: 'Price', Attribute: Price)
           COMBOBOX cbCategory (Label: 'Category', Attribute: Category)
           FOOTER footer1 {
-            ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE_CHANGES, ButtonStyle: Primary)
+            ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE CHANGES, ButtonStyle: Primary)
           }
         }
       }
@@ -199,7 +199,7 @@ CREATE PAGE MyModule.Order_MasterDetail
           FOOTER footer1 {
             ACTIONBUTTON btnEdit (
               Caption: 'Edit Order',
-              Action: SHOW_PAGE MyModule.Order_Edit,
+              Action: SHOW PAGE MyModule.Order_Edit,
               ButtonStyle: Primary
             )
           }
@@ -236,10 +236,10 @@ CREATE PAGE HR.Employee_Overview
     CONTROLBAR bar1 {
       ACTIONBUTTON btnNew (
         Caption: 'New Employee',
-        Action: MICROFLOW HR.ACT_Employee_New,
+        Action: CALL MICROFLOW HR.ACT_Employee_New,
         ButtonStyle: Primary
       )
-      ACTIONBUTTON btnEdit (Caption: 'Edit', Action: SHOW_PAGE HR.Employee_Edit)
+      ACTIONBUTTON btnEdit (Caption: 'Edit', Action: SHOW PAGE HR.Employee_Edit)
       ACTIONBUTTON btnDelete (Caption: 'Delete', Action: DELETE, ButtonStyle: Danger)
     }
   }
@@ -260,8 +260,8 @@ CREATE PAGE HR.Employee_Edit
     DATEPICKER dpHireDate (Label: 'Hire Date', Attribute: HireDate)
     TEXTBOX txtEmail (Label: 'Email', Attribute: Email)
     FOOTER footer1 {
-      ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE_CHANGES, ButtonStyle: Primary)
-      ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL_CHANGES)
+      ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE CHANGES, ButtonStyle: Primary)
+      ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL CHANGES)
     }
   }
 }
@@ -273,7 +273,7 @@ BEGIN
   $Employee = CREATE HR.Employee (
     HireDate = [%CurrentDateTime%]
   );
-  SHOW PAGE HR.Employee_Edit ($Employee = $Employee);
+  SHOW PAGE HR.Employee_Edit (Employee = $Employee);
   RETURN $Employee;
 END;
 ```
diff --git a/docs-site/src/language/page-structure.md b/docs-site/src/language/page-structure.md
index 615dea2f42..c19c54f8ae 100644
--- a/docs-site/src/language/page-structure.md
+++ b/docs-site/src/language/page-structure.md
@@ -50,8 +50,8 @@ CREATE PAGE MyModule.Customer_Edit
   DATAVIEW dvCustomer (DataSource: $Customer) {
     TEXTBOX txtName (Label: 'Name', Attribute: Name)
     FOOTER footer1 {
-      ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE_CHANGES, ButtonStyle: Primary)
-      ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL_CHANGES)
+      ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE CHANGES, ButtonStyle: Primary)
+      ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL CHANGES)
     }
   }
 }
diff --git a/docs-site/src/language/pages.md b/docs-site/src/language/pages.md
index 83f15e8164..05b8715dd1 100644
--- a/docs-site/src/language/pages.md
+++ b/docs-site/src/language/pages.md
@@ -60,8 +60,8 @@ CREATE PAGE MyModule.Customer_Edit
     TEXTBOX txtName (Label: 'Name', Attribute: Name)
     TEXTBOX txtEmail (Label: 'Email', Attribute: Email)
     FOOTER footer1 {
-      ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE_CHANGES, ButtonStyle: Primary)
-      ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL_CHANGES)
+      ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE CHANGES, ButtonStyle: Primary)
+      ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL CHANGES)
     }
   }
 }
diff --git a/docs-site/src/language/qualified-names.md b/docs-site/src/language/qualified-names.md
index 326f2fe56c..29f633749e 100644
--- a/docs-site/src/language/qualified-names.md
+++ b/docs-site/src/language/qualified-names.md
@@ -83,7 +83,7 @@ CREATE ASSOCIATION Sales.Order_Customer
 Status: Enumeration(Sales.OrderStatus) DEFAULT 'Active'
 
 -- Microflow call
-$Result = CALL MICROFLOW Sales.ACT_ProcessOrder ($Order = $Order);
+$Result = CALL MICROFLOW Sales.ACT_ProcessOrder (Order = $Order);
 ```
 
 ## See Also
diff --git a/docs-site/src/language/snippets.md b/docs-site/src/language/snippets.md
index 04fb1c5339..8469362269 100644
--- a/docs-site/src/language/snippets.md
+++ b/docs-site/src/language/snippets.md
@@ -47,7 +47,7 @@ CREATE SNIPPET MyModule.CustomerCard
       DYNAMICTEXT txtEmail (Content: '{1}', Attribute: Email)
       ACTIONBUTTON btnEdit (
         Caption: 'Edit',
-        Action: SHOW_PAGE MyModule.Customer_Edit,
+        Action: SHOW PAGE MyModule.Customer_Edit,
         ButtonStyle: Primary
       )
     }
diff --git a/docs-site/src/language/widget-types.md b/docs-site/src/language/widget-types.md
index 8e13a2248e..d503360e8c 100644
--- a/docs-site/src/language/widget-types.md
+++ b/docs-site/src/language/widget-types.md
@@ -88,8 +88,8 @@ DATAVIEW dvCustomer (DataSource: $Customer) {
   TEXTBOX txtEmail (Label: 'Email', Attribute: Email)
   COMBOBOX cbStatus (Label: 'Status', Attribute: Status)
   FOOTER footer1 {
-    ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE_CHANGES, ButtonStyle: Primary)
-    ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL_CHANGES)
+    ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE CHANGES, ButtonStyle: Primary)
+    ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL CHANGES)
   }
 }
 ```
@@ -112,7 +112,7 @@ DATAGRID dgOrders (DataSource: DATABASE Sales.Order, PageSize: 20) {
   COLUMN colAmount (Attribute: Amount, Caption: 'Amount', Alignment: right)
   COLUMN colStatus (Attribute: Status, Caption: 'Status')
   CONTROLBAR bar1 {
-    ACTIONBUTTON btnNew (Caption: 'New', Action: MICROFLOW Sales.ACT_CreateOrder, ButtonStyle: Primary)
+    ACTIONBUTTON btnNew (Caption: 'New', Action: CALL MICROFLOW Sales.ACT_CreateOrder, ButtonStyle: Primary)
   }
 }
 ```
@@ -331,8 +331,8 @@ IMAGE imgBanner (Width: 800, Height: 200)
 A button that triggers an action. The primary interactive element:
 
 ```sql
-ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE_CHANGES, ButtonStyle: Primary)
-ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL_CHANGES)
+ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE CHANGES, ButtonStyle: Primary)
+ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL CHANGES)
 ACTIONBUTTON btnDelete (Caption: 'Delete', Action: DELETE, ButtonStyle: Danger)
 ```
 
@@ -340,13 +340,19 @@ ACTIONBUTTON btnDelete (Caption: 'Delete', Action: DELETE, ButtonStyle: Danger)
 
 | Action | Description |
 |--------|-------------|
-| `SAVE_CHANGES` | Commit and close the page |
-| `CANCEL_CHANGES` | Roll back and close the page |
+| `SAVE CHANGES` | Commit and close the page |
+| `CANCEL CHANGES` | Roll back and close the page |
 | `DELETE` | Delete the current object |
-| `CLOSE_PAGE` | Close the page without saving |
-| `MICROFLOW Module.MF_Name` | Call a microflow |
-| `NANOFLOW Module.NF_Name` | Call a nanoflow |
-| `PAGE Module.PageName` | Open a page |
+| `CLOSE PAGE` | Close the page without saving |
+| `CALL MICROFLOW Module.MF_Name` | Call a microflow |
+| `CALL NANOFLOW Module.NF_Name` | Call a nanoflow |
+| `SHOW PAGE Module.PageName` | Open a page |
+| `CREATE OBJECT Module.Entity THEN SHOW PAGE Module.PageName` | Create an object and open a page for it |
+| `OPEN LINK 'https://…'` | Open a web address |
+| `SIGN OUT` | Sign the user out |
+| `COMPLETE TASK 'Outcome'` | Complete a workflow user task |
+
+The snake-case spellings (`SAVE_CHANGES`, `SHOW_PAGE`, …) and `MICROFLOW …` without `CALL` are deprecated aliases (MDL-DEPR020).
 
 **Button styles:**
 
@@ -364,7 +370,7 @@ ACTIONBUTTON btnDelete (Caption: 'Delete', Action: DELETE, ButtonStyle: Danger)
 ```sql
 ACTIONBUTTON btnProcess (
   Caption: 'Process',
-  Action: MICROFLOW Sales.ACT_ProcessOrder(Order: $Order),
+  Action: MICROFLOW Sales.ACT_ProcessOrder(Order = $Order),
   ButtonStyle: Primary
 )
 ```
@@ -410,8 +416,8 @@ Footer section of a DataView. Typically contains save/cancel buttons:
 
 ```sql
 FOOTER footer1 {
-  ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE_CHANGES, ButtonStyle: Primary)
-  ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL_CHANGES)
+  ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE CHANGES, ButtonStyle: Primary)
+  ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL CHANGES)
 }
 ```
 
@@ -421,7 +427,7 @@ Control bar for DataGrid widgets. Contains action buttons for the grid:
 
 ```sql
 CONTROLBAR bar1 {
-  ACTIONBUTTON btnNew (Caption: 'New', Action: MICROFLOW Module.ACT_Create, ButtonStyle: Primary)
+  ACTIONBUTTON btnNew (Caption: 'New', Action: CALL MICROFLOW Module.ACT_Create, ButtonStyle: Primary)
   ACTIONBUTTON btnEdit (Caption: 'Edit', Action: PAGE Module.Entity_Edit)
   ACTIONBUTTON btnDelete (Caption: 'Delete', Action: DELETE, ButtonStyle: Danger)
 }
diff --git a/docs-site/src/language/workflow-activities.md b/docs-site/src/language/workflow-activities.md
index bc5b3f30f8..bc2e58e63b 100644
--- a/docs-site/src/language/workflow-activities.md
+++ b/docs-site/src/language/workflow-activities.md
@@ -83,7 +83,7 @@ builds and never completes.
 Execute a microflow as part of the workflow. Optionally specify a comment and outcomes:
 
 ```sql
-CALL MICROFLOW <Module>.<Name> [COMMENT '<text>']
+CALL MICROFLOW <Module>.<Name> [(<Param> = <expression>, ...)] [COMMENT '<text>']
   [OUTCOMES '<outcome>' { <activities> } ...];
 ```
 
@@ -91,8 +91,15 @@ Example:
 
 ```sql
 CALL MICROFLOW HR.ACT_SendNotification COMMENT 'Notify the applicant';
+CALL MICROFLOW HR.ACT_Escalate(Request = $WorkflowContext) COMMENT 'Escalate';
 ```
 
+Arguments are bound like every other call in MDL: `Param = expression` right
+after the callee, the expression written bare. The older spelling after the
+comment, `WITH (Param = '<expression>')` with the expression inside a string,
+still parses with the same meaning but is deprecated (MDL-DEPR008);
+`mxcli fmt --upgrade` rewrites it.
+
 ## AI Agent Task
 
 A step that runs an AI agent (Mendix 11.9 or later). It is written like `CALL
@@ -101,16 +108,15 @@ mappings, outcomes and boundary events. The microflow is where the agent is
 invoked — build agents with the Studio Pro Agent Editor, or `CREATE AGENT`.
 
 ```sql
-CALL AGENT MICROFLOW <Module>.<Name> [AS <name>] [COMMENT '<text>']
-  [WITH (<Param> = '<expression>', ...)]
+CALL AGENT MICROFLOW <Module>.<Name> [(<Param> = <expression>, ...)] [AS <name>] [COMMENT '<text>']
   [OUTCOMES <true|false|'Module.Enum.Value'|''> -> { <activities> } ...];
 ```
 
 Example — branch on the agent's answer:
 
 ```sql
-CALL AGENT MICROFLOW HR.ACT_ClassifyRequest AS aiAgentTask1 COMMENT 'Classify the request'
-  WITH (Request = '$WorkflowContext')
+CALL AGENT MICROFLOW HR.ACT_ClassifyRequest(Request = $WorkflowContext) AS aiAgentTask1
+  COMMENT 'Classify the request'
   OUTCOMES true -> {
     USER TASK Expedite 'Expedite the request' PAGE HR.TaskPage OUTCOMES 'Done' { };
   } false -> { };
@@ -125,7 +131,7 @@ branch with `OUTCOMES`; return nothing for a single path.
 Start a sub-workflow:
 
 ```sql
-CALL WORKFLOW <Module>.<Name> [COMMENT '<text>'];
+CALL WORKFLOW <Module>.<Name> [(<Param> = <expression>, ...)] [COMMENT '<text>'];
 ```
 
 Example:
diff --git a/docs-site/src/migration/generation.md b/docs-site/src/migration/generation.md
index 7d52f148fd..1cf0860300 100644
--- a/docs-site/src/migration/generation.md
+++ b/docs-site/src/migration/generation.md
@@ -46,8 +46,8 @@ CREATE ENUMERATION Sales.OrderStatus (
 /** Customer master data */
 @Position(100, 100)
 CREATE PERSISTENT ENTITY CRM.Customer (
-  Name: String(200) NOT NULL ERROR 'Customer name is required',
-  Email: String(200) UNIQUE ERROR 'Email already exists',
+  Name: String(200) NOT NULL ERROR MESSAGE 'Customer name is required',
+  Email: String(200) UNIQUE ERROR MESSAGE 'Email already exists',
   Phone: String(50),
   IsActive: Boolean DEFAULT TRUE
 )
@@ -106,7 +106,7 @@ CREATE PAGE CRM.Customer_Overview (
     COLUMN colPhone (Attribute: Phone, Caption: 'Phone')
     COLUMN colActive (Attribute: IsActive, Caption: 'Active')
     CONTROLBAR cb1 {
-      ACTIONBUTTON btnNew (Caption: 'New', Action: SHOW_PAGE CRM.Customer_NewEdit, ButtonStyle: Primary)
+      ACTIONBUTTON btnNew (Caption: 'New', Action: SHOW PAGE CRM.Customer_NewEdit, ButtonStyle: Primary)
     }
   }
 };
diff --git a/docs-site/src/migration/validation.md b/docs-site/src/migration/validation.md
index 0c173d2ac8..efeddfae87 100644
--- a/docs-site/src/migration/validation.md
+++ b/docs-site/src/migration/validation.md
@@ -65,7 +65,7 @@ $Line = CREATE Sales.OrderLine (Price = 10.00, Quantity = 3);
 CHANGE $Line (Sales.OrderLine_Order = $Order);
 COMMIT $Line;
 
-CALL MICROFLOW Sales.ACT_Order_CalculateTotal ($Order = $Order);
+CALL MICROFLOW Sales.ACT_Order_CalculateTotal (Order = $Order);
 
 -- @assert: $Order/TotalAmount = 30.00
 ```
diff --git a/docs-site/src/reference/domain-model/create-association.md b/docs-site/src/reference/domain-model/create-association.md
index 0835677ccb..73f203f85f 100644
--- a/docs-site/src/reference/domain-model/create-association.md
+++ b/docs-site/src/reference/domain-model/create-association.md
@@ -7,7 +7,7 @@
         TO to_module.to_entity
         TYPE { Reference | ReferenceSet }
         [ OWNER { Default | Both | Parent | Child } ]
-        [ DELETE_BEHAVIOR { DELETE_BUT_KEEP_REFERENCES | DELETE_AND_REFERENCES | DELETE_IF_NO_REFERENCES | CASCADE | PREVENT } ]
+        [ ON DELETE { SET NULL | CASCADE | RESTRICT } [ ERROR MESSAGE 'text' ] ]
 
 ## Description
 
@@ -29,15 +29,15 @@ The `OWNER` clause controls which side of the association can modify the relatio
 | `Parent` | Only the FROM side can modify the association |
 | `Child` | Only the TO side can modify the association |
 
-The `DELETE_BEHAVIOR` clause controls what happens when an object on the FROM side is deleted:
+The `ON DELETE` clause controls what happens when an object on the FROM side is deleted:
 
-| Behavior | Description |
+| Action | Description |
 |----------|-------------|
-| `DELETE_BUT_KEEP_REFERENCES` | Delete the object and set references to null (the default) |
-| `DELETE_AND_REFERENCES` | Delete the object and all associated objects on the TO side |
-| `CASCADE` | Alias for `DELETE_AND_REFERENCES` |
-| `DELETE_IF_NO_REFERENCES` | Refuse the delete while anything still references the object |
-| `PREVENT` | Alias for `DELETE_IF_NO_REFERENCES` |
+| `SET NULL` | Delete the object and set references to null (the default) |
+| `CASCADE` | Delete the object and all associated objects on the TO side |
+| `RESTRICT` | Refuse the delete while anything still references the object; `ERROR MESSAGE '…'` is the text the user sees |
+
+The older `DELETE_BEHAVIOR` clause (`DELETE_BUT_KEEP_REFERENCES`, `DELETE_AND_REFERENCES` / `CASCADE`, `DELETE_IF_NO_REFERENCES` / `PREVENT`) still parses with the same meaning, but is deprecated (MDL-DEPR022); `mxcli fmt --upgrade` rewrites it.
 
 If `OR MODIFY` is specified, the statement is idempotent: if the association already exists, it is updated to match the new definition.
 
@@ -63,7 +63,7 @@ A documentation comment (`/** ... */`) placed before the statement is preserved
 **OWNER**
 : Which side can modify the association. Defaults to `Default` if omitted.
 
-**DELETE_BEHAVIOR**
+**ON DELETE**
 : What happens to associated objects when a FROM-side object is deleted. If omitted, references are kept (the default Mendix behavior).
 
 ## Examples
@@ -76,7 +76,7 @@ CREATE ASSOCIATION Sales.Order_Customer
     TO Sales.Order
     TYPE Reference
     OWNER Default
-    DELETE_BEHAVIOR DELETE_BUT_KEEP_REFERENCES;
+    ON DELETE SET NULL;
 ```
 
 ### Many-to-many: Order has Products
@@ -97,7 +97,7 @@ CREATE ASSOCIATION Sales.Order_Invoice
     FROM Sales.Order
     TO Sales.Invoice
     TYPE Reference
-    DELETE_BEHAVIOR DELETE_AND_REFERENCES;
+    ON DELETE CASCADE;
 ```
 
 ### Idempotent with OR MODIFY
diff --git a/docs-site/src/reference/domain-model/create-entity.md b/docs-site/src/reference/domain-model/create-entity.md
index 0207c6d921..ca613bdd2c 100644
--- a/docs-site/src/reference/domain-model/create-entity.md
+++ b/docs-site/src/reference/domain-model/create-entity.md
@@ -116,9 +116,9 @@ CREATE PERSISTENT ENTITY Sales.Customer (
     CustomerId: AutoNumber NOT NULL UNIQUE DEFAULT 1,
 
     /** Customer full name */
-    Name: String(200) NOT NULL ERROR 'Name is required',
+    Name: String(200) NOT NULL ERROR MESSAGE 'Name is required',
 
-    Email: String(200) UNIQUE ERROR 'Email must be unique',
+    Email: String(200) UNIQUE ERROR MESSAGE 'Email must be unique',
 
     Balance: Decimal DEFAULT 0,
 
diff --git a/docs-site/src/reference/microflow/create-microflow.md b/docs-site/src/reference/microflow/create-microflow.md
index 24d4e4be43..dc59012fa2 100644
--- a/docs-site/src/reference/microflow/create-microflow.md
+++ b/docs-site/src/reference/microflow/create-microflow.md
@@ -86,7 +86,7 @@ Call another microflow, nanoflow, or Java action. Parameters are passed by name.
 **UI Actions**
 
 ```sql
-SHOW PAGE Module.PageName ( $Param = $value );
+SHOW PAGE Module.PageName ( Param = $value );
 CLOSE PAGE;
 ```
 
@@ -137,12 +137,12 @@ RETURN $value;
 -- Suffix on any activity (except EXECUTE DATABASE QUERY)
 activity ON ERROR CONTINUE;
 activity ON ERROR ROLLBACK;
-activity ON ERROR {
+activity ON ERROR BEGIN
     handler_statements
-};
+END ERROR;
 ```
 
-Error handling is attached as a suffix to an individual activity. `ON ERROR CONTINUE` suppresses the error and continues. `ON ERROR ROLLBACK` rolls back the current transaction. `ON ERROR { ... }` executes custom error-handling logic.
+Error handling is attached as a suffix to an individual activity. `ON ERROR CONTINUE` suppresses the error and continues. `ON ERROR ROLLBACK` rolls back the current transaction. `ON ERROR BEGIN ... END ERROR` executes custom error-handling logic.
 
 ### Annotations
 
@@ -199,7 +199,7 @@ BEGIN
         Status = 'Draft'
     );
     COMMIT $Order;
-    SHOW PAGE Sales.Order_Edit ($Order = $Order);
+    SHOW PAGE Sales.Order_Edit (Order = $Order);
     RETURN $Order;
 END;
 ```
@@ -257,11 +257,11 @@ BEGIN
 
     $Result = CALL MICROFLOW Integration.SUB_FetchExternalData (
         SyncResult = $Result
-    ) ON ERROR {
+    ) ON ERROR BEGIN
         CHANGE $Result (Status = 'Failed');
         COMMIT $Result;
         LOG ERROR NODE 'Integration' 'Sync failed';
-    };
+    END ERROR;
 
     CHANGE $Result (
         Status = 'Completed',
diff --git a/docs-site/src/reference/microflow/create-nanoflow.md b/docs-site/src/reference/microflow/create-nanoflow.md
index 99d5666fc9..e92d8a0333 100644
--- a/docs-site/src/reference/microflow/create-nanoflow.md
+++ b/docs-site/src/reference/microflow/create-nanoflow.md
@@ -101,7 +101,7 @@ CREATE NANOFLOW Sales.NAV_SubmitOrder
 BEGIN
     CHANGE $Order (Status = 'Submitted');
     $Result = CALL MICROFLOW Sales.ACT_ProcessOrder (Order = $Order);
-    SHOW PAGE Sales.Order_Confirmation ($Order = $Order);
+    SHOW PAGE Sales.Order_Confirmation (Order = $Order);
 END;
 ```
 
diff --git a/docs-site/src/reference/page/create-page.md b/docs-site/src/reference/page/create-page.md
index 6c27500945..925df9d77c 100644
--- a/docs-site/src/reference/page/create-page.md
+++ b/docs-site/src/reference/page/create-page.md
@@ -119,18 +119,18 @@ values, including the argument list.
 
 | Action | Syntax | Description |
 |--------|--------|-------------|
-| Save | `Action: SAVE_CHANGES` | Commits and closes |
-| Cancel | `Action: CANCEL_CHANGES` | Rolls back and closes |
-| Microflow | `Action: MICROFLOW Module.Name(Param: val)` | Calls a microflow |
-| Nanoflow | `Action: NANOFLOW Module.Name(Param: val)` | Calls a nanoflow |
+| Save | `Action: save changes` | Commits and closes |
+| Cancel | `Action: cancel changes` | Rolls back and closes |
+| Microflow | `Action: MICROFLOW Module.Name(Param = val)` | Calls a microflow |
+| Nanoflow | `Action: NANOFLOW Module.Name(Param = val)` | Calls a nanoflow |
 | Page | `Action: PAGE Module.PageName` | Opens a page |
-| Close | `Action: CLOSE_PAGE` | Closes the current page |
+| Close | `Action: CLOSE PAGE` | Closes the current page |
 | Delete | `Action: DELETE` | Deletes the context object |
 | Nothing | `Action: NOTHING` | Deliberately no action — a decorative button, a card that is not clickable |
 
 The set is closed. Anything else in an action slot is an error
 (**MDL-WIDGET28**), and that includes a real action keyword **missing its
-argument** — `Action: OPEN_LINK` with no URL, `Action: SHOW_PAGE` with no page.
+argument** — `Action: OPEN LINK` with no URL, `Action: SHOW PAGE` with no page.
 Such a widget used to be written with no action at all: it rendered, carried its
 caption, and did nothing, while `mxcli check`, `exec` and mxbuild all reported
 success, because a no-action widget is perfectly legal Mendix. Write `NOTHING`
@@ -150,7 +150,7 @@ DATAGRID dgOrders (DataSource: DATABASE FROM Sales.Order, Selection: Single) {
   COLUMN colNr (Attribute: Number, Caption: 'Order #')
   CONTROLBAR cb {
     CONTAINER cShip (Class: 'command',
-      Action: NANOFLOW Sales.ACT_Ship($Order = $dgOrders)) {
+      Action: NANOFLOW Sales.ACT_Ship(Order = $dgOrders)) {
       ACTIONBUTTON btnShip (Caption: 'Ship')
     }
   }
@@ -233,8 +233,8 @@ CREATE PAGE MyModule.Customer_Edit
         COMBOBOX cbStatus (Label: 'Status', Attribute: Status)
 
         FOOTER footer1 {
-            ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE_CHANGES, ButtonStyle: Primary)
-            ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL_CHANGES)
+            ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE CHANGES, ButtonStyle: Primary)
+            ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL CHANGES)
         }
     }
 };
@@ -256,7 +256,7 @@ CREATE PAGE Sales.Order_Overview
         COLUMN colStatus (Attribute: Status, Caption: 'Status')
         COLUMN colAmount (Attribute: TotalAmount, Caption: 'Amount', Alignment: right)
         CONTROLBAR cb1 {
-            ACTIONBUTTON btnNew (Caption: 'New Order', Action: SHOW_PAGE Sales.Order_Edit, ButtonStyle: Primary)
+            ACTIONBUTTON btnNew (Caption: 'New Order', Action: SHOW PAGE Sales.Order_Edit, ButtonStyle: Primary)
         }
     }
 };
@@ -349,13 +349,13 @@ CREATE PAGE MyModule.AdvancedForm
 {
     DATAVIEW dvItem (DataSource: $Item) {
         TEXTBOX txtName (Label: 'Name', Attribute: Name)
-        ACTIONBUTTON btnToggle (Caption: 'Show Advanced', Action: NANOFLOW MyModule.NAV_Toggle)
+        ACTIONBUTTON btnToggle (Caption: 'Show Advanced', Action: CALL NANOFLOW MyModule.NAV_Toggle)
         CONTAINER cntAdvanced (Visible: '$showAdvanced') {
             TEXTAREA taNotes (Label: 'Notes', Attribute: Notes)
         }
         FOOTER footer1 {
-            ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE_CHANGES, ButtonStyle: Primary)
-            ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL_CHANGES)
+            ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE CHANGES, ButtonStyle: Primary)
+            ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL CHANGES)
         }
     }
 };
diff --git a/docs-site/src/reference/page/create-snippet.md b/docs-site/src/reference/page/create-snippet.md
index 72dbe5229d..2dce807b13 100644
--- a/docs-site/src/reference/page/create-snippet.md
+++ b/docs-site/src/reference/page/create-snippet.md
@@ -104,7 +104,7 @@ CREATE PAGE MyModule.Customer_Edit
     DATAVIEW dvCustomer (DataSource: $Customer) {
         SNIPPETCALL snpAddress (Snippet: MyModule.AddressFields)
         FOOTER footer1 {
-            ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE_CHANGES, ButtonStyle: Primary)
+            ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE CHANGES, ButtonStyle: Primary)
         }
     }
 };
diff --git a/docs-site/src/reference/query/describe-association.md b/docs-site/src/reference/query/describe-association.md
index 62a53145f1..bdaf5415c6 100644
--- a/docs-site/src/reference/query/describe-association.md
+++ b/docs-site/src/reference/query/describe-association.md
@@ -32,7 +32,7 @@ CREATE ASSOCIATION Sales.Order_Customer
   TO Sales.Order
   TYPE Reference
   OWNER Default
-  DELETE_BEHAVIOR DELETE_BUT_KEEP_REFERENCES;
+  ON DELETE SET NULL;
 ```
 
 Describe a many-to-many association:
diff --git a/docs-site/src/reference/query/describe-microflow.md b/docs-site/src/reference/query/describe-microflow.md
index 955e7c663c..75b72d2e61 100644
--- a/docs-site/src/reference/query/describe-microflow.md
+++ b/docs-site/src/reference/query/describe-microflow.md
@@ -37,7 +37,7 @@ BEGIN
     Status = 'Draft'
   );
   COMMIT $Order;
-  SHOW PAGE Sales.Order_Edit ($Order = $Order);
+  SHOW PAGE Sales.Order_Edit (Order = $Order);
   RETURN $Order;
 END;
 ```
diff --git a/docs-site/src/reference/query/describe-page.md b/docs-site/src/reference/query/describe-page.md
index 8fc6657771..183914a47a 100644
--- a/docs-site/src/reference/query/describe-page.md
+++ b/docs-site/src/reference/query/describe-page.md
@@ -39,8 +39,8 @@ CREATE PAGE Sales.Customer_Edit
     TEXTBOX txtName (Label: 'Name', Attribute: Name)
     TEXTBOX txtEmail (Label: 'Email', Attribute: Email)
     FOOTER footer1 {
-      ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE_CHANGES, ButtonStyle: Primary)
-      ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL_CHANGES)
+      ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE CHANGES, ButtonStyle: Primary)
+      ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL CHANGES)
     }
   }
 }
diff --git a/docs-site/src/tools/theme.md b/docs-site/src/tools/theme.md
index 6636339a2e..eee26b5ed0 100644
--- a/docs-site/src/tools/theme.md
+++ b/docs-site/src/tools/theme.md
@@ -87,7 +87,7 @@ the set that is actually installed — so a cycle button can never offer a theme
 whose CSS is not in the page.
 
 ```sql
-actionbutton btnSkin (caption: 'Theme', action: nanoflow MyFirstModule.ACT_CycleSkin)
+actionbutton btnSkin (caption: 'Theme', action: call nanoflow MyFirstModule.ACT_CycleSkin)
 ```
 
 The same reload caveat as the light/dark toggle applies: the choice is remembered
@@ -149,7 +149,7 @@ to run script before first paint. It creates three JavaScript actions
 wire a button:
 
 ```sql
-actionbutton btnTheme (caption: 'Theme', action: nanoflow MyFirstModule.ACT_ToggleTheme)
+actionbutton btnTheme (caption: 'Theme', action: call nanoflow MyFirstModule.ACT_ToggleTheme)
 ```
 
 A click flips the palette and remembers the choice in `localStorage`. The class
diff --git a/docs-site/src/tutorial/create-entity.md b/docs-site/src/tutorial/create-entity.md
index 65eed3e1c8..f870022491 100644
--- a/docs-site/src/tutorial/create-entity.md
+++ b/docs-site/src/tutorial/create-entity.md
@@ -76,7 +76,7 @@ You can specify what happens when the "to" entity is deleted:
 CREATE ASSOCIATION MyModule.Order_Product
     FROM MyModule.Order TO MyModule.Product
     TYPE Reference
-    DELETE_BEHAVIOR PREVENT;
+    ON DELETE RESTRICT;
 ```
 
 Options: `PREVENT` (block deletion if referenced), `CASCADE` (delete the associated objects too), or leave it out for the default behavior — delete the object and null out the references.
diff --git a/docs-site/src/tutorial/create-microflow.md b/docs-site/src/tutorial/create-microflow.md
index 56bbec0380..7921d6d889 100644
--- a/docs-site/src/tutorial/create-microflow.md
+++ b/docs-site/src/tutorial/create-microflow.md
@@ -162,10 +162,10 @@ COMMIT $Product ON ERROR CONTINUE;
 Options are `CONTINUE` (ignore the error and proceed), `ROLLBACK` (roll back the transaction and continue), or an inline error handler block:
 
 ```sql
-COMMIT $Product ON ERROR {
+COMMIT $Product ON ERROR BEGIN
     LOG ERROR 'Failed to commit product';
     RETURN false;
-};
+END ERROR;
 ```
 
 ## Organizing with folders
diff --git a/docs-site/src/tutorial/create-page.md b/docs-site/src/tutorial/create-page.md
index ced0ca6078..706f26a98f 100644
--- a/docs-site/src/tutorial/create-page.md
+++ b/docs-site/src/tutorial/create-page.md
@@ -85,8 +85,8 @@ CREATE PAGE MyModule.Product_Edit
         CHECKBOX cbActive (Label: 'Active', Attribute: IsActive)
 
         FOOTER footer1 {
-            ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE_CHANGES, ButtonStyle: Primary)
-            ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL_CHANGES)
+            ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE CHANGES, ButtonStyle: Primary)
+            ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL CHANGES)
         }
     }
 };
@@ -101,8 +101,8 @@ Key differences from the overview page:
 | `DATAVIEW dvProduct (DataSource: $Product)` | Binds to the page parameter |
 | `TEXTBOX`, `CHECKBOX` | Input widgets bound to entity attributes |
 | `FOOTER` | A section at the bottom of the DataView for action buttons |
-| `Action: SAVE_CHANGES` | Built-in action that commits the object and closes the page |
-| `Action: CANCEL_CHANGES` | Built-in action that rolls back changes and closes the page |
+| `Action: SAVE CHANGES` | Built-in action that commits the object and closes the page |
+| `Action: CANCEL CHANGES` | Built-in action that rolls back changes and closes the page |
 
 Notice the two different page syntaxes: the overview page uses the **compact syntax** (`LAYOUT` and `TITLE` as keywords before parentheses), while the edit page uses the **property syntax** (properties inside a `(Key: value)` block followed by a `{ widget tree }` block). Both are valid -- use whichever fits better.
 
@@ -130,10 +130,10 @@ DYNAMICTEXT dynName (Attribute: Name)
 ### Action buttons
 
 ```sql
-ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE_CHANGES, ButtonStyle: Primary)
-ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL_CHANGES)
+ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE CHANGES, ButtonStyle: Primary)
+ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL CHANGES)
 ACTIONBUTTON btnDelete (Caption: 'Delete', Action: DELETE, ButtonStyle: Danger)
-ACTIONBUTTON btnProcess (Caption: 'Process', Action: MICROFLOW MyModule.ACT_ProcessProduct(Product: $Product))
+ACTIONBUTTON btnProcess (Caption: 'Process', Action: MICROFLOW MyModule.ACT_ProcessProduct(Product = $Product))
 ```
 
 ### Layout widgets
diff --git a/docs-site/src/tutorial/describe-search.md b/docs-site/src/tutorial/describe-search.md
index 8856cdf731..76ad32622f 100644
--- a/docs-site/src/tutorial/describe-search.md
+++ b/docs-site/src/tutorial/describe-search.md
@@ -42,7 +42,7 @@ CREATE ASSOCIATION MyFirstModule.Order_Customer
   FROM MyFirstModule.Order TO MyFirstModule.Customer
   TYPE Reference
   OWNER Default
-  DELETE_BEHAVIOR DELETE_BUT_KEEP_REFERENCES;
+  ON DELETE SET NULL;
 ```
 
 ## DESCRIBE MICROFLOW
@@ -96,8 +96,8 @@ CREATE PAGE MyFirstModule.Customer_Edit
     TEXTBOX txtPhone (Label: 'Phone', Attribute: Phone)
 
     FOOTER footer1 {
-      ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE_CHANGES, ButtonStyle: Primary)
-      ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL_CHANGES)
+      ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE CHANGES, ButtonStyle: Primary)
+      ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL CHANGES)
     }
   }
 };
@@ -132,7 +132,7 @@ CREATE ASSOCIATION MyFirstModule.Order_Customer
   FROM MyFirstModule.Order TO MyFirstModule.Customer
   TYPE Reference
   OWNER Default
-  DELETE_BEHAVIOR DELETE_BUT_KEEP_REFERENCES;
+  ON DELETE SET NULL;
 ```
 
 ## DESCRIBE MODULE
diff --git a/docs/01-project/MDL_QUICK_REFERENCE.md b/docs/01-project/MDL_QUICK_REFERENCE.md
index f9add0af03..6135dcace9 100644
--- a/docs/01-project/MDL_QUICK_REFERENCE.md
+++ b/docs/01-project/MDL_QUICK_REFERENCE.md
@@ -89,7 +89,7 @@ create persistent entity Module.Photo (
 | Create enumeration | `create [or modify] enumeration Module.Name (Value1 'caption', ...);` | |
 | Alter enumeration values | `alter enumeration Module.Name add value [if not exists] X [caption '..'] \| rename value X to Y \| modify value X caption '..' \| drop value [if exists] X;` | `modify value … caption` re-captions in place (works while referenced). `if not exists` / `if exists` make the script re-runnable — the bare forms error and stop the run |
 | Drop enumeration | `drop enumeration [if exists] Module.Name;` | Refused for `System.*` (read-only platform module) |
-| Create association | `create [or modify] association Module.Name from Parent to Child type reference\|ReferenceSet [owner default\|both] [delete_behavior ...];` | OR MODIFY updates existing association in-place. **The FROM entity must live in `Module`** — Mendix stores an association in its FROM entity's module, so a remote FROM writes a dangling pointer and the project stops OPENING (**MDL070**). The TO entity may be remote; that direction is stored BY NAME |
+| Create association | `create [or modify] association Module.Name from Parent to Child type reference\|ReferenceSet [owner default\|both] [on delete cascade\|restrict\|set null [error message '...']];` | OR MODIFY updates existing association in-place. **The FROM entity must live in `Module`** — Mendix stores an association in its FROM entity's module, so a remote FROM writes a dangling pointer and the project stops OPENING (**MDL070**). The TO entity may be remote; that direction is stored BY NAME |
 | Drop association | `drop association [if exists] Module.Name;` | |
 | Association line anchors | `@anchor(from: (0, 54), to: (100, 54))` above `create association …` | Where the connector attaches to each entity box, as a **percentage** of the box (0..100, whole numbers). `from` = the FROM entity's box, `to` = the TO entity's. Omitting an end preserves what is stored, so a `create or modify` about something else never flattens a hand-tuned line. Cross-module associations have no anchors — Mendix stores none |
 | Retune anchors in place | `alter association Module.Name set anchor from (50, 100) to (50, 0);` | `(0, 50)` left-middle, `(100, 50)` right-middle, `(50, 100)` bottom-centre. `describe association` re-emits a non-default pair as the same `@anchor(...)`, so describe → edit → exec round-trips |
@@ -236,8 +236,8 @@ the statement names the **attribute**, not the rule.
 
 | Statement | Syntax | Notes |
 |-----------|--------|-------|
-| Create regex rule | `create validation rule for Module.Entity.Attribute regex Module.Pattern feedback '<msg>';` | Pattern must already exist |
-| Create range rule | `create validation rule for Module.Entity.Attribute range from <lit> to <lit> feedback '<msg>';` | Bounds inclusive |
+| Create regex rule | `create validation rule for Module.Entity.Attribute regex Module.Pattern error message '<msg>';` | Pattern must already exist |
+| Create range rule | `create validation rule for Module.Entity.Attribute range from <lit> to <lit> error message '<msg>';` | Bounds inclusive |
 | Lower bound only | `... range from <lit> ...` | Mendix `GreaterThanOrEqualTo` |
 | Upper bound only | `... range to <lit> ...` | Mendix `SmallerThanOrEqualTo` |
 
@@ -255,8 +255,8 @@ expression specified".
 **Required and Unique are attribute constraints, not this statement:**
 
 ```sql
-create entity Shop.Product ( Email: String(200) not null error 'Required' );
-alter entity Shop.Product modify attribute Code String(20) unique error 'Unique';
+create entity Shop.Product ( Email: String(200) not null error message 'Required' );
+alter entity Shop.Product modify attribute Code String(20) unique error message 'Unique';
 ```
 
 A range bounded by another *attribute* cannot be authored in MDL, but survives a
@@ -556,13 +556,13 @@ it is for pages.
 | REST call (mapping single) | `$Var = rest call get '<url>' returns mapping Module.IMM as Module.Entity;` | Single object — Studio Pro emits `ForceSingleOccurrence=true` |
 | REST call (mapping list) | `$Var = rest call get '<url>' returns mapping Module.IMM as list of Module.Entity;` | List result |
 | REST call (none) | `rest call get '<url>' returns nothing;` | Discard response |
-| Show page | `show page Module.PageName ($Param = $value);` | Also accepts `(Param: $value)` |
+| Show page | `show page Module.PageName (Param = $value);` | `Param = expression`, as at every call site. `($Param = …)` and `(Param: …)` are deprecated (MDL-DEPR006/007) |
 | Close page | `close page;` | |
 | Download file | `download file $FileDocument [show in browser];` | Streams a `System.FileDocument` |
-| Show message | `show message 'text' [type Information\|Warning\|Error] [objects [$a, $b]] [blocking];` | `blocking` halts the client until the user dismisses it — Studio Pro's checkbox. It goes after `objects` and before `on error`. Without it, a describe → exec round trip turned a blocking message into a non-blocking one (16 microflows measured) |
+| Show message | `show message 'text' [type Information\|Warning\|Error] [with ({1} = $a, {2} = $b)] [blocking];` | `blocking` halts the client until the user dismisses it — Studio Pro's checkbox. It goes after the `with` list and before `on error`. `with ({1} = $a, {2} = $b)` is the deprecated spelling of the list (MDL-DEPR009). Without it, a describe → exec round trip turned a blocking message into a non-blocking one (16 microflows measured) |
 | Database connection credentials | `connection string @Mod.Const`, `username @Mod.Const`, `password @Mod.Const` | Constant **references** only. A literal writes an unopenable project — MDL058 |
 | Synchronize (nanoflow only) | `synchronize all;` / `synchronize unsynchronized;` / `synchronize $Obj, $List;` | Offline sync. `unsynchronized` needs Mendix 9.4+. In a microflow this is MDL057 / CE0009 |
-| Validation | `validation feedback $entity/attribute message 'message';` | Requires attribute path + MESSAGE |
+| Validation | `validation feedback $entity/attribute message 'message {1}' [with ({1} = $a)];` | Requires attribute path + MESSAGE |
 | Log | `log info\|warning\|error [node 'name'] 'message';` | |
 | Apply entity access | `@applyentityaccess` / `@applyentityaccess(false)` before `create microflow` or `create rule` | Runs the flow under the **current user's** entity access rules instead of with full access. A **security** setting and only ever narrowing, so an ABSENT annotation **preserves** what is stored rather than clearing it — the same rule as `@excluded`. Not available on a nanoflow: it runs in the client and Mendix stores no such property |
 | Position | `@position(x, y)` | Canvas position (before activity) |
@@ -589,9 +589,9 @@ it is for pages.
 | Execute DB query | `$Result = execute database query Module.Conn.Query;` | 3-part name; supports DYNAMIC, params, CONNECTION override |
 | Import mapping | `[$Var =] import from mapping Module.IMM($SourceVar) [all\|first\|limit <e> [offset <e>]];` | Apply import mapping to string variable. Trailing clause is Studio Pro's Range; omitted = infer from the mapping's root. `first` binds one OBJECT (`limit 1` is a one-element LIST). Mendix rejects `offset` on a non-list mapping (CE6100) |
 | Export mapping | `$Var = export to mapping Module.EMM($EntityVar);` | Apply export mapping to entity, returns string |
-| Error handling | `... on error continue\|rollback\|{ handler }\|without rollback { handler };` | Goes on the activity that may fail — including `declare`, `set`, `change`, `log`, `show page`, `close page`, `show message` and `validation feedback`, which gained it in mendixlabs/mxcli#1078 so a Studio Pro handler survives DESCRIBE. `on error continue` is refused (MDL076) where Mendix raises CE6035: create, change, commit, log, show page, close page, show message, validation feedback — a custom `{ handler }` is accepted on all of them. The list-operation and aggregate forms of `set` have no error handling at all (MDL077). Not supported on EXECUTE DATABASE QUERY. **In a nanoflow** only `declare` and `set` take a clause at all — `change`, `log`, `show page`, `close page`, `show message` and `validation feedback` are CE6035 there in every form, and are refused. A handler that does not end in `return`/`raise error` merges back into the main flow, so a later variable is out of scope on the error path (CE0108) |
-| Re-raise the error | `raise error;` | **Inside an `on error { … }` handler only.** The error event re-raises the error being handled, so Mendix needs one in scope; Studio Pro will not draw the shape and mxbuild rejects it with **CE0710** "The main flow cannot join an error flow or end in an error event". On the main flow — at any nesting depth, and in a rule too — it is **MDL084**. Mendix has no main-flow "throw": call a Java action that throws |
-| Named join point | `merge <label>;` / `join <label>;` | Declares an ExclusiveMerge and sends a path to it. The label is MDL-only — a Mendix merge stores no name, so it is resolved at build and at describe time and never written to the model. Forward and backward references both resolve, so `merge attempt; … on error { join attempt; }` is a retry loop. This is how an **error path that rejoins the normal one** is written: without it the only spellings are "terminate" and "fall through to the enclosing branch's continuation", and DESCRIBE emitted an empty `{ }` for anything else — MDL that re-executes to a different graph with nothing reporting it. Also covers **crossed branches**, where an inner split's branch lands where an outer split's branch lands. Refused inside a `loop`/`while` body (MDL-FLOW04): a LoopedActivity owns its own object collection and a sequence flow cannot leave it. An unresolved or unjoined label is MDL-FLOW02; a duplicate declaration MDL-FLOW03. A path that already ended does not fall through into a following `merge` |
+| Error handling | `... on error continue\|rollback\|[without rollback] begin handler end error;` | Goes on the activity that may fail — including `declare`, `set`, `change`, `log`, `show page`, `close page`, `show message` and `validation feedback`, which gained it in mendixlabs/mxcli#1078 so a Studio Pro handler survives DESCRIBE. `on error continue` is refused (MDL076) where Mendix raises CE6035: create, change, commit, log, show page, close page, show message, validation feedback — a custom `begin handler end error` is accepted on all of them. The list-operation and aggregate forms of `set` have no error handling at all (MDL077). Not supported on EXECUTE DATABASE QUERY. **In a nanoflow** only `declare` and `set` take a clause at all — `change`, `log`, `show page`, `close page`, `show message` and `validation feedback` are CE6035 there in every form, and are refused. A handler that does not end in `return`/`raise error` merges back into the main flow, so a later variable is out of scope on the error path (CE0108) |
+| Re-raise the error | `raise error;` | **Inside an `on error begin … end error` handler only.** The error event re-raises the error being handled, so Mendix needs one in scope; Studio Pro will not draw the shape and mxbuild rejects it with **CE0710** "The main flow cannot join an error flow or end in an error event". On the main flow — at any nesting depth, and in a rule too — it is **MDL084**. Mendix has no main-flow "throw": call a Java action that throws |
+| Named join point | `merge <label>;` / `join <label>;` | Declares an ExclusiveMerge and sends a path to it. The label is MDL-only — a Mendix merge stores no name, so it is resolved at build and at describe time and never written to the model. Forward and backward references both resolve, so `merge attempt; … on error begin join attempt; end error` is a retry loop. This is how an **error path that rejoins the normal one** is written: without it the only spellings are "terminate" and "fall through to the enclosing branch's continuation", and DESCRIBE emitted an empty handler for anything else — MDL that re-executes to a different graph with nothing reporting it. Also covers **crossed branches**, where an inner split's branch lands where an outer split's branch lands. Refused inside a `loop`/`while` body (MDL-FLOW04): a LoopedActivity owns its own object collection and a sequence flow cannot leave it. An unresolved or unjoined label is MDL-FLOW02; a duplicate declaration MDL-FLOW03. A path that already ended does not fall through into a following `merge` |
 
 **Activity defaults.** An omitted modifier always means Mendix's own default, so a
 bare MDL statement produces the same activity as dragging a fresh one onto the
@@ -616,7 +616,7 @@ and `mxbuild` were all clean. Only the running app showed it.
 | Unsupported | Use Instead | Notes |
 |-------------|-------------|-------|
 | `case ... when 'String' ... else ...` | Bare enum values, one branch per value | `case` itself IS supported for **enum splits** (see above); what fails is quoted/qualified values, an `else` branch, and an `AS` alias |
-| `TRY ... CATCH ... end TRY` | `on error { ... }` blocks | Use error handlers on specific activities |
+| `TRY ... CATCH ... end TRY` | `on error begin ... end error` blocks | Use error handlers on specific activities |
 
 **Notes:**
 - `retrieve ... first` binds a single OBJECT: Mendix's "First object" range. `retrieve ... limit n
@@ -714,9 +714,9 @@ mandatory and a misplaced clause failed with a token error
   - A **targeting microflow** takes exactly `System.Workflow` + the context entity (or a generalization of it), in either order — anything else is CE6677. Users targeting returns a list of `System.User`, groups a list of `System.WorkflowGroup`.
   - An **on-created microflow** takes exactly `System.WorkflowUserTask` + the context entity, in either order (CE6683), and returns nothing (CE5012).
   - `check --references` reports these before anything is written; `exec` refuses the workflow statement itself (Mendix 11+).
-- `call microflow Mod.MF [as <name>] [comment '<text>'] [with (<Param> = '<expr>', ...)] [outcomes '<out>' -> { } ...];`
+- `call microflow Mod.MF[(<Param> = <expr>, ...)] [as <name>] [comment '<text>'] [outcomes '<out>' -> { } ...];`
 - `call agent microflow Mod.MF [as <name>] [comment '<text>'] [with (<Param> = '<expr>', ...)] [outcomes … -> { } ...];` — an **AI agent task** (Mendix 11.9+): the call-microflow statement stored as `Workflows$AIAgentTaskActivity`. Its microflow must take at least one parameter (CE1590).
-- `call workflow Mod.WF [as <name>] [comment '<text>'] [with (<Param> = '<expr>', ...)];`
+- `call workflow Mod.WF[(<Param> = <expr>, ...)] [as <name>] [comment '<text>'];`
 - `decision [<name>] ['<expression>'] outcomes <true|false|'Module.Enum.Value'> -> { } ...;`
 - `parallel split [<name>] path 1 { } path 2 { };`
 - `jump to <activity-name>;`
@@ -766,8 +766,10 @@ the build fails `CE6686`). Anything shorter is refused as `MDL-WF03`, and by
 module — is not a build error but a `StorageLoadException` that leaves the
 project unopenable in Studio Pro and mxbuild.
 
-**Parameter values in `with (...)` are quoted strings**, not bare variables:
-`call microflow Mod.MF with (Request = '$WorkflowContext')`.
+**Arguments go right after the callee**, bound as at every call site with a bare
+expression: `call microflow Mod.MF(Request = $WorkflowContext)`. The older
+`with (Request = '$WorkflowContext')`, the expression in a string, is a deprecated
+alias with the same meaning (MDL-DEPR008).
 
 **An enumeration decision also needs an empty outcome.** Mendix generates one
 outcome per enumeration value **plus one for the empty value**, and MxBuild
@@ -1453,13 +1455,13 @@ MDL uses explicit property declarations for pages:
 | Password field | `Password: true` on a textbox | `textbox tbPw (attribute: Secret, Password: true)` — omitted when false. Without it a describe → exec round trip turns a password field into a plaintext one |
 | Widget validation | `Validation: '<expression>'`, `ValidationMessage: '<text>'` | `Validation: 'length(toString($value)) > 0'` — a Mendix expression over `$value`, QUOTED not bracketed (`[...]` is the XPath spelling and parses as an array) |
 | Variable binding | `datasource: $Var` | `dataview dv (datasource: $Product) { ... }` |
-| Action binding | `action: type` | `actionbutton btn (caption: 'Save', action: save_changes)` — the forms are a closed set (`mxcli syntax page.action`); anything else is **MDL-WIDGET28** |
-| No action | `action: nothing` | `actionbutton btn (caption: 'Decorative', action: nothing)` — an explicitly inert control. Write it deliberately: an action keyword **short its argument** (`action: open_link` with no URL) is now an error rather than a widget silently written with no action at all |
-| Microflow action | `action: microflow Name(Param: val)` | `action: microflow Mod.ACT_Process(Order: $Order)` |
+| Action binding | `action: type` | `actionbutton btn (caption: 'Save', action: save changes)` — the forms are a closed set (`mxcli syntax page.action`); anything else is **MDL-WIDGET28** |
+| No action | `action: nothing` | `actionbutton btn (caption: 'Decorative', action: nothing)` — an explicitly inert control. Write it deliberately: an action keyword **short its argument** (`action: open link` with no URL) is now an error rather than a widget silently written with no action at all |
+| Microflow action | `action: call microflow Name(Param = val)` | `action: call microflow Mod.ACT_Process(Order = $Order)` |
 | Button icon | `icon: 'Module.IconCollection.IconName'` | `linkbutton btn (caption: 'Edit', action: nothing, icon: 'Atlas_Core.Atlas_Filled.pencil')` — the **icon-collection** icon; MxBuild rejects an unknown name (CE1613) |
 | Image icon | `icon: image Module.ImageCollection.Name` | `actionbutton btn (caption: 'Logo', action: nothing, icon: image MyMod.Images.logo)` — an **image** collection is a different document from an icon collection, and the names are spelled the same, so the keyword is what separates them. Written without `image` it is stored as a custom-icon reference and the build fails **CE1613** |
 | Glyph icon | `icon: glyph <code>` | `actionbutton btn (caption: 'Home', action: nothing, icon: glyph 57377)` — a font code point with no name. Codes are sparse; an undefined one fails only at `mxbuild --target=deploy`, naming the **page**, so **MDL078** checks it. Browse with `show glyphs` |
-| Clickable container | `onclick: action` (alias of `action:`) | `container card (onclick: microflow Mod.ACT_Open) { ... }` — takes an argument list like a button: `action: nanoflow Mod.ACT_Ship($Order = $dgOrders)` |
+| Clickable container | `onclick: action` (alias of `action:`) | `container card (onclick: call microflow Mod.ACT_Open) { ... }` — takes an argument list like a button: `action: call nanoflow Mod.ACT_Ship(Order = $dgOrders)` |
 | Action arguments | every parameter needs one | A flow action with an unfilled parameter is **CE1571**. An enclosing data container of its type supplies it; a data grid's **control bar** does not (not row-scoped) — pass the grid's selection, `$dgOrders` |
 | Database source | `datasource: database entity` | `datagrid dg (datasource: database Module.Entity)` |
 | Database source, constrained and sorted | `datasource: database entity where [...] sort by Attr asc` | `listview lv (datasource: database from Mod.Vehicle where [Brand != ''] sort by Brand asc)` |
@@ -1552,8 +1554,8 @@ create page MyModule.Customer_Edit
     combobox cbStatus (label: 'Status', attribute: status)
 
     footer footer1 {
-      actionbutton btnSave (caption: 'Save', action: save_changes, buttonstyle: primary)
-      actionbutton btnCancel (caption: 'Cancel', action: cancel_changes)
+      actionbutton btnSave (caption: 'Save', action: save changes, buttonstyle: primary)
+      actionbutton btnCancel (caption: 'Cancel', action: cancel changes)
     }
   }
 }
@@ -1667,7 +1669,7 @@ This is the generic ALTER — `alter <type> Module.Name { set (Key: value) on <t
 | Drop widgets | `drop name1, name2` | Remove widgets by name |
 | Replace widget | `replace widgetName with { widgets }` | Replace widget subtree |
 | Pluggable prop | `set ('showLabel': false) on cbStatus` | Quoted name for pluggable widgets |
-| Named action slot | `set ('createFileAction': microflow M.ACT_Create) on fileUploader1` | A pluggable widget's action-typed property, by its own key; any `create page` action form. Refused on a key that is not action-typed |
+| Named action slot | `set ('createFileAction': call microflow M.ACT_Create) on fileUploader1` | A pluggable widget's action-typed property, by its own key; any `create page` action form. Refused on a key that is not action-typed |
 | Set column prop | `set (caption: 'New') on dgGrid column(Attr)` | A DataGrid 2 column by its attribute, or `column('Caption')`; `@n` when two columns match. The older `dgGrid.colName` (a derived name) still works |
 | Drop column | `drop dgGrid column(Attr)` | Remove a DataGrid column |
 | Insert column | `insert after dgGrid column(Attr) { column (…) }` | Add column to DataGrid; a column takes no name |
diff --git a/mdl-examples/bug-tests/1100-loop-variable-typing.mdl b/mdl-examples/bug-tests/1100-loop-variable-typing.mdl
index 72115f757f..c1e4751ec9 100644
--- a/mdl-examples/bug-tests/1100-loop-variable-typing.mdl
+++ b/mdl-examples/bug-tests/1100-loop-variable-typing.mdl
@@ -117,8 +117,8 @@ returns String
 begin
   declare $out String = '';
   retrieve $reqs from Probe.Request
-    on error {
+    on error begin
       $out = $out + 'retrieve failed';
-    };
+    end error;
   return $out;
 end;
diff --git a/mdl-examples/bug-tests/349-custom-error-handler-routing.mdl b/mdl-examples/bug-tests/349-custom-error-handler-routing.mdl
index 2acc97b1bf..3d7687d6ac 100644
--- a/mdl-examples/bug-tests/349-custom-error-handler-routing.mdl
+++ b/mdl-examples/bug-tests/349-custom-error-handler-routing.mdl
@@ -55,9 +55,9 @@ create microflow BugTest349.MF_Caller (
 )
 begin
   call microflow BugTest349.MF_RefreshData (Token = $Token)
-  on error without rollback {
+  on error without rollback begin
     log error node 'BugTest349' 'refresh failed';
-  };
+  end error;
 
   call microflow BugTest349.MF_NextBatch ();
 end;
diff --git a/mdl-examples/bug-tests/863-execute-database-query-describe.mdl b/mdl-examples/bug-tests/863-execute-database-query-describe.mdl
index edde53fbe4..87ee2d77d9 100644
--- a/mdl-examples/bug-tests/863-execute-database-query-describe.mdl
+++ b/mdl-examples/bug-tests/863-execute-database-query-describe.mdl
@@ -8,9 +8,9 @@
 -- read back with a nil Action:
 --
 --   -- Unsupported action: DatabaseConnector$ExecuteDatabaseQueryAction
---   -- on error without rollback {
+--   -- on error without rollback begin
 --   --   log error node 'Application' 'query failed';
---   -- };
+--   -- end error;
 --
 -- (That output is itself the #863 fix working — before it, the same activity
 -- said "-- Empty action" and the error handler was gone entirely.)
@@ -56,7 +56,7 @@ end;
 
 create microflow DbQ863.MF_Query ($Status: String)
 begin
-  $Rows = execute database query DbQ863.Conn.GetRows (Status = $Status) on error without rollback {
+  $Rows = execute database query DbQ863.Conn.GetRows (Status = $Status) on error without rollback begin
     log error 'query failed';
-  };
+  end error;
 end;
diff --git a/mdl-examples/bug-tests/863-synchronize-and-unsupported-actions.mdl b/mdl-examples/bug-tests/863-synchronize-and-unsupported-actions.mdl
index 0fde075bb6..ab16578025 100644
--- a/mdl-examples/bug-tests/863-synchronize-and-unsupported-actions.mdl
+++ b/mdl-examples/bug-tests/863-synchronize-and-unsupported-actions.mdl
@@ -44,7 +44,7 @@ begin
   synchronize unsynchronized;          -- Mendix 9.4+ (version-gated)
   synchronize $Order;                  -- Specific mode
   synchronize all on error continue;
-  synchronize all on error without rollback {
+  synchronize all on error without rollback begin
     log error 'sync failed';
-  };
+  end error;
 end;
diff --git a/mdl-examples/bug-tests/error-handling-continue.mdl b/mdl-examples/bug-tests/error-handling-continue.mdl
index beba7f08a1..0b4221058b 100644
--- a/mdl-examples/bug-tests/error-handling-continue.mdl
+++ b/mdl-examples/bug-tests/error-handling-continue.mdl
@@ -119,11 +119,11 @@ end;
 -- and a custom handler is the fix MDL076 suggests.
 create or modify microflow ErrH.ACT_CustomHandler ()
 begin
-  $T = CREATE ErrH.Thing ( Code = 'a' ) ON ERROR {
+  $T = CREATE ErrH.Thing ( Code = 'a' ) ON ERROR BEGIN
     LOG ERROR 'create failed';
-  };
-  COMMIT $T ON ERROR {
+  END ERROR;
+  COMMIT $T ON ERROR BEGIN
     LOG ERROR 'commit failed';
-  };
+  END ERROR;
 end;
 /
diff --git a/mdl-examples/bug-tests/microflow-1030-raise-error-main-flow.mdl b/mdl-examples/bug-tests/microflow-1030-raise-error-main-flow.mdl
index f5ef011651..5b61f21404 100644
--- a/mdl-examples/bug-tests/microflow-1030-raise-error-main-flow.mdl
+++ b/mdl-examples/bug-tests/microflow-1030-raise-error-main-flow.mdl
@@ -22,10 +22,10 @@ end;
 create or replace microflow RaiseProbe.MF_Handled ()
 begin
   call microflow RaiseProbe.MF_Inner ()
-  on error {
+  on error begin
     log error node 'RaiseProbe' 'failed';
     raise error;
-  };
+  end error;
 end;
 /
 
@@ -33,12 +33,12 @@ end;
 create or replace microflow RaiseProbe.MF_HandledIf ($Retry: Boolean)
 begin
   call microflow RaiseProbe.MF_Inner ()
-  on error {
+  on error begin
     if $Retry then
       log warning node 'RaiseProbe' 'retrying';
     else
       raise error;
     end if;
-  };
+  end error;
 end;
 /
diff --git a/mdl-examples/bug-tests/microflow-1077-annotation-sharing.mdl b/mdl-examples/bug-tests/microflow-1077-annotation-sharing.mdl
index aa3e02af8d..d182c4bcc0 100644
--- a/mdl-examples/bug-tests/microflow-1077-annotation-sharing.mdl
+++ b/mdl-examples/bug-tests/microflow-1077-annotation-sharing.mdl
@@ -113,11 +113,11 @@ end;
 -- sequence flows only — so the note arrived detached, floating on the canvas.
 create or modify microflow MyFirstModule.ACT_1077_InHandler () returns String
 begin
-  declare $name String = 'value' on error {
+  declare $name String = 'value' on error begin
     @annotation 'this is where it goes wrong'
     log error node 'Bug1077' 'boom';
     return 'failed';
-  };
+  end error;
   return $name;
 end;
 
diff --git a/mdl-examples/bug-tests/microflow-1078-error-handler-roundtrip.mdl b/mdl-examples/bug-tests/microflow-1078-error-handler-roundtrip.mdl
index 4e69224c5f..2d9906a662 100644
--- a/mdl-examples/bug-tests/microflow-1078-error-handler-roundtrip.mdl
+++ b/mdl-examples/bug-tests/microflow-1078-error-handler-roundtrip.mdl
@@ -25,7 +25,7 @@
 --    hand-maintained switch that had drifted to 17 of the 38 action types that
 --    store ErrorHandlingType. emitActivityStatement walks an activity's error
 --    branch only when hasCustomErrorHandler() agrees, so each of the 21 missing
---    types lost its ENTIRE `on error { … }` block — not just the suffix.
+--    types lost its ENTIRE `on error begin … end error` block — not just the suffix.
 --    Create-object and change-object were among them, i.e. most of what a real
 --    microflow is made of. Replaced with a reflection lookup, so a new action
 --    type is covered the moment it exists.
@@ -41,7 +41,7 @@
 -- Eight statement forms had no `onErrorClause` in the grammar — including
 -- `declare`, the reporter's own activity. With only fix #1, DESCRIBE emitted
 --
---   declare $name String = 'NameValue' on error { … };
+--   declare $name String = 'NameValue' on error begin … end error;
 --
 -- which does not parse:
 --   line 3:37 mismatched input 'on' expecting ';'
@@ -105,9 +105,9 @@
 -- with the `on error` block and the `return` inside it both gone.
 create or modify microflow MyFirstModule.ACT_1078_Declare () returns String
 begin
-  declare $name String = 'NameValue' on error {
+  declare $name String = 'NameValue' on error begin
     return 'declare failed';
-  };
+  end error;
   return $name;
 end;
 
@@ -115,30 +115,30 @@ end;
 -- so the whole microflow builds at 0 errors.
 create or modify microflow MyFirstModule.ACT_1078_All () returns String
 begin
-  declare $name String = 'NameValue' on error {
+  declare $name String = 'NameValue' on error begin
     return 'declare failed';
-  };
-  $name = 'changed' on error {
+  end error;
+  $name = 'changed' on error begin
     return 'set failed';
-  };
-  $Car = create MyFirstModule.Car (Brand = 'Ford') on error {
+  end error;
+  $Car = create MyFirstModule.Car (Brand = 'Ford') on error begin
     return 'create failed';
-  };
-  change $Car (Brand = 'Opel') on error {
+  end error;
+  change $Car (Brand = 'Opel') on error begin
     return 'change failed';
-  };
-  log info node 'Bug1078' 'hello' on error {
+  end error;
+  log info node 'Bug1078' 'hello' on error begin
     return 'log failed';
-  };
-  validation feedback $Car/Brand message 'bad brand' on error {
+  end error;
+  validation feedback $Car/Brand message 'bad brand' on error begin
     return 'validation failed';
-  };
-  show message 'hi' on error {
+  end error;
+  show message 'hi' on error begin
     return 'message failed';
-  };
-  close page on error {
+  end error;
+  close page on error begin
     return 'close failed';
-  };
+  end error;
   return $name;
 end;
 
@@ -146,9 +146,9 @@ end;
 -- the plain custom handler — the two differ at runtime.
 create or modify microflow MyFirstModule.ACT_1078_WithoutRollback () returns String
 begin
-  declare $name String = 'NameValue' on error without rollback {
+  declare $name String = 'NameValue' on error without rollback begin
     return 'declare failed';
-  };
+  end error;
   return $name;
 end;
 
diff --git a/mdl-examples/bug-tests/microflow-empty-error-handler-end-event.mdl b/mdl-examples/bug-tests/microflow-empty-error-handler-end-event.mdl
index aceda8e8e4..3b477b80d5 100644
--- a/mdl-examples/bug-tests/microflow-empty-error-handler-end-event.mdl
+++ b/mdl-examples/bug-tests/microflow-empty-error-handler-end-event.mdl
@@ -1,4 +1,4 @@
--- An empty `on error … { }` gave an end event two incoming flows (CE0709).
+-- An empty `on error … begin end error` gave an end event two incoming flows (CE0709).
 --
 -- In Mendix an end event accepts exactly ONE incoming sequence flow — joining
 -- two paths is what a merge is for. The shape below produced two: the THEN
@@ -37,7 +37,7 @@ end;
 create or replace microflow EhProbe.EmptyHandler () returns String
 begin
   if 1 = 1 then
-    $r = call microflow EhProbe.Helper() on error without rollback { };
+    $r = call microflow EhProbe.Helper() on error without rollback begin end error;
     return $r;
   else
     return 'no';
@@ -52,7 +52,7 @@ end;
 create or replace microflow EhProbe.FilledHandler () returns String
 begin
   if 1 = 1 then
-    $r = call microflow EhProbe.Helper() on error without rollback { return 'err'; };
+    $r = call microflow EhProbe.Helper() on error without rollback begin return 'err'; end error;
     return $r;
   else
     return 'no';
diff --git a/mdl-examples/doctype-tests/02-microflow-examples.mdl b/mdl-examples/doctype-tests/02-microflow-examples.mdl
index 69df8091e1..74c6a5f562 100644
--- a/mdl-examples/doctype-tests/02-microflow-examples.mdl
+++ b/mdl-examples/doctype-tests/02-microflow-examples.mdl
@@ -1875,8 +1875,8 @@ end;
 -- Options:
 --   - ON ERROR CONTINUE - Ignore error and continue execution
 --   - ON ERROR ROLLBACK - Rollback transaction and abort
---   - ON ERROR { ... } - Execute custom error handler statements
---   - ON ERROR WITHOUT ROLLBACK { ... } - Custom handler without rollback
+--   - ON ERROR BEGIN ... END ERROR - Execute custom error handler statements
+--   - ON ERROR WITHOUT ROLLBACK BEGIN ... END ERROR - Custom handler without rollback
 
 /**
  * Example 13.1: Continue on error
@@ -1951,10 +1951,10 @@ begin
     $Result = call microflow MfTest.M012_CreateEntity(
       Name = $Product/Name,
       Code = $ProductCode
-    ) on error without rollback {
+    ) on error without rollback begin
       log error node 'ErrorHandling' 'Failed to create entity for: ' + $ProductCode;
       return empty;
-    };
+    end error;
     return $Result;
   else
     return $Product;
@@ -2006,12 +2006,12 @@ begin
 
   -- Step 2: Update status with custom error handler
   change $Order (status = 'VALIDATED');
-  commit $Order on error without rollback {
+  commit $Order on error without rollback begin
     log error node 'OrderService' 'Failed to update order status';
     change $Order (status = 'ERROR');
     commit $Order;
     raise error;
-  };
+  end error;
 
   set $success = true;
   return $success;
@@ -2032,10 +2032,10 @@ begin
   declare $success boolean = false;
 
   -- Commit with error handler that raises an error
-  commit $Order on error without rollback {
+  commit $Order on error without rollback begin
     log error node 'OrderService' 'Failed to commit order - raising error';
     raise error;  -- Terminates with ErrorEvent
-  };
+  end error;
 
   -- This only executes if commit succeeds
   set $success = true;
@@ -2195,10 +2195,10 @@ begin
     header Accept = 'application/json'
     timeout 30
     returns string
-    on error without rollback {
+    on error without rollback begin
       log error node 'RestService' 'Failed to fetch: ' + $url;
       return false;
-    };
+    end error;
 
   set $success = true;
   return $success;
diff --git a/mdl-examples/doctype-tests/02c-complex-layout-examples.mdl b/mdl-examples/doctype-tests/02c-complex-layout-examples.mdl
index 84f357e522..5777ebf591 100644
--- a/mdl-examples/doctype-tests/02c-complex-layout-examples.mdl
+++ b/mdl-examples/doctype-tests/02c-complex-layout-examples.mdl
@@ -416,10 +416,10 @@ begin
         ClientSecret = $ClientSecret,
         RedirectUri  = $RedirectUri,
         UseBasicAuth = false
-      ) on error without rollback {
+      ) on error without rollback begin
         log error node 'Auth' 'Token exchange failed (client_secret_post): ' + $ClientId;
         return false;
-      };
+      end error;
 
       if $PostResponse = empty then
         log error node 'Auth' 'Empty token response (client_secret_post): ' + $ClientId;
@@ -458,10 +458,10 @@ begin
         ClientSecret = $ClientSecret,
         RedirectUri  = $RedirectUri,
         UseBasicAuth = true
-      ) on error without rollback {
+      ) on error without rollback begin
         log error node 'Auth' 'Token exchange failed (client_secret_basic): ' + $ClientId;
         return false;
-      };
+      end error;
 
       if $BasicResponse = empty then
         log error node 'Auth' 'Empty token response (client_secret_basic): ' + $ClientId;
@@ -739,7 +739,7 @@ begin
     ClientSecret = 'telemetry-secret',
     RedirectUri  = 'https://telemetry.example.com/callback',
     UseBasicAuth = false
-  ) on error without rollback {
+  ) on error without rollback begin
     log warning node 'Telemetry' 'Telemetry call failed for ' + $Factory/Name
       + ' (attempt ' + toString($Attempts) + ')';
     if $Attempts < $MaxAttempts then
@@ -749,7 +749,7 @@ begin
         + ' after ' + toString($Attempts) + ' attempts';
       join degraded;
     end if;
-  };
+  end error;
 
   -- The main flow reaches `degraded` as well, for a call that returned nothing.
   if $RawResponse = empty then
@@ -764,10 +764,10 @@ begin
     IssuedAt    = [%CurrentDateTime%]
   );
 
-  commit $Token with events on error {
+  commit $Token with events on error begin
     log error node 'Telemetry' 'Could not store the telemetry token';
     join degraded;
-  };
+  end error;
 
   -- ---- crossed branches: two splits, three arms, two landing points -----
   if $Factory/Availability > 80 then
@@ -800,9 +800,9 @@ begin
   merge degraded;
   set $Outcome = 'degraded';
   change $Factory (Status = CxLayout.FactoryStatus.Offline);
-  commit $Factory with events on error {
+  commit $Factory with events on error begin
     log error node 'Telemetry' 'Degraded write failed for ' + $Factory/Name;
-  };
+  end error;
   join finish;
 
   merge finish;
diff --git a/mdl-examples/doctype-tests/38-import-mapping-usage-examples.mdl b/mdl-examples/doctype-tests/38-import-mapping-usage-examples.mdl
index d51ab22c99..7c430e86f3 100644
--- a/mdl-examples/doctype-tests/38-import-mapping-usage-examples.mdl
+++ b/mdl-examples/doctype-tests/38-import-mapping-usage-examples.mdl
@@ -249,10 +249,10 @@ begin
   declare $out string = 'EMPTY';
   declare $Json string = '{"id": 1, "name": "Fido", "status": "available"}';
   $Pet = import from mapping MapUse.IMM_Pet($Json)
-    on error {
+    on error begin
       set $out = 'import failed';
       return $out;
-    };
+    end error;
   if $Pet != empty then
     set $out = $Pet/Name;
   end if;
diff --git a/mdl-examples/doctype-tests/41-microflow-error-handling-examples.mdl b/mdl-examples/doctype-tests/41-microflow-error-handling-examples.mdl
index 954c3b6d14..4d57360eee 100644
--- a/mdl-examples/doctype-tests/41-microflow-error-handling-examples.mdl
+++ b/mdl-examples/doctype-tests/41-microflow-error-handling-examples.mdl
@@ -9,10 +9,10 @@
 --
 -- Covered:
 --   on error continue          — no error path at all
---   on error [without rollback] { <body> }   — handler with its own path
---   on error [without rollback] { }          — EMPTY: joins the enclosing
---                                              branch's continuation
---   on error [without rollback] { join L; }  — rejoins a NAMED merge
+--   on error [without rollback] begin <body> end error    — handler with its own path
+--   on error [without rollback] begin end error           — EMPTY: joins the enclosing
+--                                                           branch's continuation
+--   on error [without rollback] begin join L; end error   — rejoins a NAMED merge
 --
 -- The last one is the reason `merge` / `join` exist. Without them an error path
 -- can only terminate on its own or fall through to whatever the enclosing branch
@@ -61,10 +61,10 @@ end;
 
 create or replace microflow EhDoc.Form2_OwnPath (Payload: String) returns String
 begin
-  $r = call microflow EhDoc.SUB_Post(Payload = $Payload) on error without rollback {
+  $r = call microflow EhDoc.SUB_Post(Payload = $Payload) on error without rollback begin
     log error node 'EhDoc' 'post failed';
     return 'failed';
-  };
+  end error;
   return $r;
 end;
 /
@@ -93,7 +93,7 @@ end;
 create or replace microflow EhDoc.Form3_EmptyHandler (Payload: String) returns String
 begin
   if $Payload != '' then
-    $r = call microflow EhDoc.SUB_Post(Payload = $Payload) on error without rollback { };
+    $r = call microflow EhDoc.SUB_Post(Payload = $Payload) on error without rollback begin end error;
     return $r;
   else
     return 'empty';
@@ -117,11 +117,11 @@ end;
 create or replace microflow EhDoc.Form4_JoinNamedMerge (Payload: String) returns String
 begin
   declare $Status String = 'sent';
-  $r = call microflow EhDoc.SUB_Post(Payload = $Payload) on error without rollback {
+  $r = call microflow EhDoc.SUB_Post(Payload = $Payload) on error without rollback begin
     log warning node 'EhDoc' 'post failed, degrading';
     set $Status = 'degraded';
     join recovered;
-  };
+  end error;
   join recovered;
 
   merge recovered;
@@ -170,10 +170,10 @@ end;
 create or replace microflow EhDoc.Backward_Retry (Payload: String) returns String
 begin
   merge attempt;
-  $r = call microflow EhDoc.SUB_Post(Payload = $Payload) on error without rollback {
+  $r = call microflow EhDoc.SUB_Post(Payload = $Payload) on error without rollback begin
     log warning node 'EhDoc' 'retrying';
     join attempt;
-  };
+  end error;
   return $r;
 end;
 /
diff --git a/mdl/deprecation/deprecation.go b/mdl/deprecation/deprecation.go
index 7ae080b8bd..1c5d96fbad 100644
--- a/mdl/deprecation/deprecation.go
+++ b/mdl/deprecation/deprecation.go
@@ -99,6 +99,48 @@ const (
 	// name for: a layout grid's rows and columns, a data grid's columns and
 	// control bar, a gallery's template and filter (R12, ako/mxcli#749).
 	UnstoredWidgetName = "MDL-DEPR005"
+
+	// Codes 020–029 are R8's (ako/mxcli#752, PROPOSAL_mdl_beta_syntax_freeze.md
+	// §3 R8): words, not SCREAMING_SNAKE, and one spelling per keyword. They
+	// start at 020 rather than 006 because the other phase-3 issues add entries
+	// in parallel; a gap in the numbering means nothing.
+
+	// PageActionWord is a page action written as one snake-case token —
+	// `show_page`, `save_changes`, `close_page`, `create_object`,
+	// `delete_object`, `open_link`, `sign_out`, `complete_task`,
+	// `cancel_changes` — or a flow call without `call` (`microflow M.F`).
+	PageActionWord = "MDL-DEPR020"
+	// ErrorMessageKeyword is the user-facing message of a validation, spelled
+	// anything but `error message`: `not null error '…'` (also after unique
+	// and required), a validation rule's `feedback '…'`, and `error_message` /
+	// `errormessage`.
+	ErrorMessageKeyword = "MDL-DEPR021"
+	// DeleteBehaviorClause is an association's `delete_behavior <behaviour>`
+	// clause, in any of its spellings; `on delete …` says the same thing.
+	DeleteBehaviorClause = "MDL-DEPR022"
+	// ReferenceSetUnderscore is `reference_set` for the `ReferenceSet` type.
+	ReferenceSetUnderscore = "MDL-DEPR023"
+	// ReturnsNone is a REST call's `returns none`, the second spelling of
+	// `returns nothing`.
+	ReturnsNone = "MDL-DEPR024"
+	// OnErrorBraces is a custom error handler written `on error { … }`: the
+	// only brace block inside a microflow, where flow is `begin … end <keyword>`
+	// (R2, ako/mxcli#754).
+	OnErrorBraces = "MDL-DEPR540"
+	// DollarArgumentName is `$Param = expr` at a call site: the parameter
+	// named with the `$` of a variable (R4, ako/mxcli#751).
+	DollarArgumentName = "MDL-DEPR006"
+	// ColonArgument is `Param: expr` at a call site (`show page`, a page
+	// action or data source): `:` sets a model property, `=` binds a value
+	// (R3/R4, ako/mxcli#751).
+	ColonArgument = "MDL-DEPR007"
+	// WorkflowStringArgument is a workflow call's `with (Param = '<expr>')`:
+	// the argument expression written inside a string (R4, ako/mxcli#751).
+	WorkflowStringArgument = "MDL-DEPR008"
+	// PositionalTemplateArguments is `objects [a, b]` / `parameters [a, b]`
+	// on a text template: the placeholders bound by position (R4,
+	// ako/mxcli#751).
+	PositionalTemplateArguments = "MDL-DEPR009"
 )
 
 // entries is the registry. Append only: a code is never reused or renumbered,
@@ -168,6 +210,132 @@ var entries = []Entry{
 		Example:          "create page M.P (Title: 'P', Layout: Atlas_Core.Atlas_Default) { datagrid dg (DataSource: database from M.E) { column Name (Attribute: Name) } };",
 		CanonicalExample: "create page M.P (Title: 'P', Layout: Atlas_Core.Atlas_Default) { datagrid dg (DataSource: database from M.E) { column (Attribute: Name) } };",
 	},
+	{
+		Code:      OnErrorBraces,
+		Old:       "on error [without rollback] { … }",
+		Canonical: "on error [without rollback] begin … end error",
+		Rewrite:   Rewrite{Structural: "`{` becomes `begin` and the closing `}` becomes `end error`"},
+		RemovedIn: 2,
+		Note: "Braces hold declarative children (widgets, operations, menu items); imperative flow is " +
+			"`begin … end <keyword>`, as for `if`, `loop` and `while` (R2).",
+		Example:          "create microflow M.F ($O: M.E) begin commit $O on error without rollback { log warning 'x'; }; end;",
+		CanonicalExample: "create microflow M.F ($O: M.E) begin commit $O on error without rollback begin log warning 'x'; end error; end;",
+	},
+	{
+		Code:      DollarArgumentName,
+		Old:       "call microflow M.F($Param = expr)",
+		Canonical: "call microflow M.F(Param = expr)",
+		Rewrite:   Rewrite{Structural: "parameter name without its `$` (quoted when it is not an identifier or keyword)"},
+		RemovedIn: 2,
+		Note: "Every call site binds an argument as `Param = expression` (R4): call microflow, nanoflow, java " +
+			"action, javascript action, external action, web service operation, execute database query, " +
+			"send rest request, show page, and page/button actions and data sources.",
+		Example:          "create microflow M.F ($O: M.E) begin call microflow M.G($Order = $O); end;",
+		CanonicalExample: "create microflow M.F ($O: M.E) begin call microflow M.G(Order = $O); end;",
+	},
+	{
+		Code:      ColonArgument,
+		Old:       "show page M.P(Param: expr)",
+		Canonical: "show page M.P(Param = expr)",
+		Rewrite:   Rewrite{Structural: "colon as `=`: `Param: expr` -> `Param = expr`"},
+		RemovedIn: 2,
+		Note: "`:` sets a model property and `=` binds a runtime value (R3). An argument binds a value, so " +
+			"it takes `=` wherever the call appears: show page, and page/button actions and data sources " +
+			"(`Action: microflow M.F(Param = expr)`).",
+		Example:          "create microflow M.F ($O: M.E) begin show page M.P(Order: $O); end;",
+		CanonicalExample: "create microflow M.F ($O: M.E) begin show page M.P(Order = $O); end;",
+	},
+	{
+		Code:      WorkflowStringArgument,
+		Old:       "call microflow M.F with (Param = '<expression>')",
+		Canonical: "call microflow M.F(Param = <expression>)",
+		Rewrite:   Rewrite{Structural: "string list as a list after the callee, each string's content written as the bare expression"},
+		RemovedIn: 2,
+		Note: "In a workflow. The string form keeps its meaning — its content is the expression — so it is an alias, not a " +
+			"change of meaning. A string whose content does not parse as an MDL expression is left in place " +
+			"and reported by fmt --upgrade.",
+		Example: "create workflow M.W parameter $WorkflowContext: M.E begin " +
+			"call microflow M.F with (Order = '$WorkflowContext'); end workflow;",
+		CanonicalExample: "create workflow M.W parameter $WorkflowContext: M.E begin " +
+			"call microflow M.F(Order = $WorkflowContext); end workflow;",
+	},
+	{
+		Code:      PositionalTemplateArguments,
+		Old:       "objects [$a, $b] / parameters ['a', 'b']",
+		Canonical: "with ({1} = $a, {2} = $b)",
+		Rewrite:   Rewrite{Structural: "positional list as numbered placeholders: `objects [a, b]` -> `with ({1} = a, {2} = b)`"},
+		RemovedIn: 2,
+		Note: "One text-template form everywhere: show message, validation feedback, log, and REST " +
+			"url and body templates.",
+		Example:          "create microflow M.F ($N: String) begin show message 'Hi {1}' type Information objects [$N]; end;",
+		CanonicalExample: "create microflow M.F ($N: String) begin show message 'Hi {1}' type Information with ({1} = $N); end;",
+	},
+}
+
+func init() {
+	entries = append(entries, r8Entries...)
+}
+
+// r8Entries are R8's spellings (ako/mxcli#752). Kept apart from the list above
+// only so the parallel phase-3 changes do not all edit its last lines.
+var r8Entries = []Entry{
+	{
+		Code:      PageActionWord,
+		Old:       "show_page, save_changes, close_page, microflow M.F, …",
+		Canonical: "show page, save changes, close page, call microflow M.F, …",
+		Rewrite: Rewrite{Structural: "page action as words: the underscore becomes a space (`show_page` -> " +
+			"`show page`, also `save_changes`, `cancel_changes`, `close_page`, `create_object`, `open_link`, " +
+			"`sign_out`, `complete_task`); `delete_object` -> `delete`; `microflow M.F` / `nanoflow M.F` -> " +
+			"`call microflow M.F` / `call nanoflow M.F`"},
+		RemovedIn: 2,
+		Note: "The words are the ones a microflow uses for the same activity. A navigation menu's " +
+			"`sign_out` is the same keyword. Arguments are unchanged.",
+		Example:          "create page M.P (Title: 'P', Layout: Atlas_Core.Atlas_Default) { actionbutton b (Caption: 'Save', Action: sign_out) };",
+		CanonicalExample: "create page M.P (Title: 'P', Layout: Atlas_Core.Atlas_Default) { actionbutton b (Caption: 'Save', Action: sign out) };",
+	},
+	{
+		Code:      ErrorMessageKeyword,
+		Old:       "error '…' / feedback '…' / error_message '…'",
+		Canonical: "error message '…'",
+		Rewrite: Rewrite{Structural: "message keyword as `error message`: `not null error '…'` (and after " +
+			"`unique` or `required`), a validation rule's `feedback '…'`, and `error_message` / `errormessage`"},
+		RemovedIn:        2,
+		Note:             "One keyword for the text a user sees when a rule refuses a change.",
+		Example:          "create entity M.E (Name: String(100) not null error 'Name is required');",
+		CanonicalExample: "create entity M.E (Name: String(100) not null error message 'Name is required');",
+	},
+	{
+		Code:      DeleteBehaviorClause,
+		Old:       "delete_behavior …",
+		Canonical: "on delete cascade|restrict|set null",
+		Rewrite: Rewrite{Structural: "delete behaviour as the SQL referential action: " +
+			"`delete_behavior cascade` / `delete_and_references` -> `on delete cascade`; " +
+			"`prevent` / `delete_if_no_references` -> `on delete restrict`; " +
+			"`delete_but_keep_references` -> `on delete set null`"},
+		RemovedIn: 2,
+		Note: "Also in `alter association … set delete_behavior …`. The three compound behaviour keywords " +
+			"had three spellings each; the SQL referential actions have one.",
+		Example:          "create association M.Order_Customer from M.Order to M.Customer type Reference delete_behavior prevent;",
+		CanonicalExample: "create association M.Order_Customer from M.Order to M.Customer type Reference on delete restrict;",
+	},
+	{
+		Code:             ReferenceSetUnderscore,
+		Old:              "type reference_set",
+		Canonical:        "type ReferenceSet",
+		Rewrite:          Rewrite{Structural: "type name as Mendix writes it: `reference_set` -> `ReferenceSet`"},
+		RemovedIn:        2,
+		Example:          "create association M.Order_Tag from M.Order to M.Tag type reference_set;",
+		CanonicalExample: "create association M.Order_Tag from M.Order to M.Tag type ReferenceSet;",
+	},
+	{
+		Code:             ReturnsNone,
+		Old:              "rest call … returns none",
+		Canonical:        "rest call … returns nothing",
+		Rewrite:          Rewrite{Token: "none", Replacement: "nothing"},
+		RemovedIn:        2,
+		Example:          "create microflow M.F () begin rest call get 'https://example.com' returns none; end;",
+		CanonicalExample: "create microflow M.F () begin rest call get 'https://example.com' returns nothing; end;",
+	},
 }
 
 // All returns every registered entry, in code order.
diff --git a/mdl/executor/cmd_associations.go b/mdl/executor/cmd_associations.go
index 4a245ae8dc..cc3c8b16e6 100644
--- a/mdl/executor/cmd_associations.go
+++ b/mdl/executor/cmd_associations.go
@@ -768,7 +768,7 @@ func describeDeleteClause(db *domainmodel.DeleteBehavior) string {
 		}
 	}
 	if db != nil && db.ErrorMessage != "" {
-		return action + " error_message " + mdlQuote(db.ErrorMessage)
+		return action + " error message " + mdlQuote(db.ErrorMessage)
 	}
 	return action
 }
diff --git a/mdl/executor/cmd_diff_mdl.go b/mdl/executor/cmd_diff_mdl.go
index 77b1f2d549..cec30ca6c4 100644
--- a/mdl/executor/cmd_diff_mdl.go
+++ b/mdl/executor/cmd_diff_mdl.go
@@ -52,13 +52,13 @@ func entityStmtToMDL(ctx *ExecContext, s *ast.CreateEntityStmt) string {
 		if attr.NotNull {
 			constraints += " not null"
 			if attr.NotNullError != "" {
-				constraints += fmt.Sprintf(" error '%s'", attr.NotNullError)
+				constraints += fmt.Sprintf(" error message '%s'", attr.NotNullError)
 			}
 		}
 		if attr.Unique {
 			constraints += " unique"
 			if attr.UniqueError != "" {
-				constraints += fmt.Sprintf(" error '%s'", attr.UniqueError)
+				constraints += fmt.Sprintf(" error message '%s'", attr.UniqueError)
 			}
 		}
 		if attr.HasDefault {
@@ -181,14 +181,14 @@ func associationStmtToMDL(ctx *ExecContext, s *ast.CreateAssociationStmt) string
 	}
 	lines = append(lines, fmt.Sprintf("owner %s", owner))
 
-	deleteBehavior := "DELETE_BUT_KEEP_REFERENCES"
+	deleteBehavior := "set null"
 	switch s.DeleteBehavior {
 	case ast.DeleteCascade:
-		deleteBehavior = "DELETE_AND_REFERENCES"
+		deleteBehavior = "cascade"
 	case ast.DeleteIfNoReferences:
-		deleteBehavior = "DELETE_IF_NO_REFERENCES"
+		deleteBehavior = "restrict"
 	}
-	lines = append(lines, fmt.Sprintf("delete_behavior %s;", deleteBehavior))
+	lines = append(lines, fmt.Sprintf("on delete %s;", deleteBehavior))
 
 	return strings.Join(lines, "\n")
 }
@@ -252,13 +252,13 @@ func entityToMDL(ctx *ExecContext, moduleName string, entity *domainmodel.Entity
 			if vr.Type == "Required" {
 				constraints.WriteString(" not null")
 				if errMsg := pickTextTranslation(vr.ErrorMessage, lang); errMsg != "" {
-					constraints.WriteString(fmt.Sprintf(" error '%s'", errMsg))
+					constraints.WriteString(fmt.Sprintf(" error message '%s'", errMsg))
 				}
 			}
 			if vr.Type == "Unique" {
 				constraints.WriteString(" unique")
 				if errMsg := pickTextTranslation(vr.ErrorMessage, lang); errMsg != "" {
-					constraints.WriteString(fmt.Sprintf(" error '%s'", errMsg))
+					constraints.WriteString(fmt.Sprintf(" error message '%s'", errMsg))
 				}
 			}
 		}
@@ -405,16 +405,16 @@ func associationToMDL(ctx *ExecContext, moduleName string, assoc *domainmodel.As
 	}
 	lines = append(lines, fmt.Sprintf("owner %s", owner))
 
-	deleteBehavior := "DELETE_BUT_KEEP_REFERENCES"
+	deleteBehavior := "set null"
 	if assoc.ChildDeleteBehavior != nil {
 		switch assoc.ChildDeleteBehavior.Type {
 		case domainmodel.DeleteBehaviorTypeDeleteMeAndReferences:
-			deleteBehavior = "DELETE_AND_REFERENCES"
+			deleteBehavior = "cascade"
 		case domainmodel.DeleteBehaviorTypeDeleteMeIfNoReferences:
-			deleteBehavior = "DELETE_IF_NO_REFERENCES"
+			deleteBehavior = "restrict"
 		}
 	}
-	lines = append(lines, fmt.Sprintf("delete_behavior %s;", deleteBehavior))
+	lines = append(lines, fmt.Sprintf("on delete %s;", deleteBehavior))
 
 	return strings.Join(lines, "\n")
 }
diff --git a/mdl/executor/cmd_entities_describe.go b/mdl/executor/cmd_entities_describe.go
index 2a0f977881..431223da15 100644
--- a/mdl/executor/cmd_entities_describe.go
+++ b/mdl/executor/cmd_entities_describe.go
@@ -293,13 +293,13 @@ func describeEntity(ctx *ExecContext, name ast.QualifiedName) error {
 					if vr.Type == "Required" {
 						constraints.WriteString(" not null")
 						if errMsg := pickTextTranslation(vr.ErrorMessage, lang); errMsg != "" {
-							constraints.WriteString(" error " + mdlQuoted(errMsg))
+							constraints.WriteString(" error message " + mdlQuoted(errMsg))
 						}
 					}
 					if vr.Type == "Unique" {
 						constraints.WriteString(" unique")
 						if errMsg := pickTextTranslation(vr.ErrorMessage, lang); errMsg != "" {
-							constraints.WriteString(" error " + mdlQuoted(errMsg))
+							constraints.WriteString(" error message " + mdlQuoted(errMsg))
 						}
 					}
 				}
diff --git a/mdl/executor/cmd_enumerations.go b/mdl/executor/cmd_enumerations.go
index 0a803a7f9e..a3e02f782d 100644
--- a/mdl/executor/cmd_enumerations.go
+++ b/mdl/executor/cmd_enumerations.go
@@ -451,7 +451,7 @@ func describeEnumeration(ctx *ExecContext, name ast.QualifiedName) error {
 			// folder path when the enum lives in a folder.
 			folderClause := ""
 			if fp := h.BuildFolderPath(enum.ContainerID); fp != "" && fp != modName {
-				folderClause = fmt.Sprintf(" FOLDER '%s'", fp)
+				folderClause = fmt.Sprintf(" folder '%s'", fp)
 			}
 			fmt.Fprintf(ctx.Output, ")%s;\n", folderClause)
 			return nil
diff --git a/mdl/executor/cmd_enumerations_caption_language_test.go b/mdl/executor/cmd_enumerations_caption_language_test.go
index 86f7967ee1..242f661bd9 100644
--- a/mdl/executor/cmd_enumerations_caption_language_test.go
+++ b/mdl/executor/cmd_enumerations_caption_language_test.go
@@ -185,7 +185,7 @@ func TestDescribeEntity_ValidationMessageFollowsProjectLanguage_Issue1113(t *tes
 	assertNoError(t, describeEntity(ctx, ast.QualifiedName{Module: "Sales", Name: "Order"}))
 
 	out := buf.String()
-	if !strings.Contains(out, "not null error 'Referentie is verplicht'") {
+	if !strings.Contains(out, "not null error message 'Referentie is verplicht'") {
 		t.Errorf("validation feedback lost to the en_US lookup (issue #1113):\n%s", out)
 	}
 }
diff --git a/mdl/executor/cmd_fragments.go b/mdl/executor/cmd_fragments.go
index 7f50781fb6..88861a055d 100644
--- a/mdl/executor/cmd_fragments.go
+++ b/mdl/executor/cmd_fragments.go
@@ -273,28 +273,31 @@ func formatActionV3(a *ast.ActionV3) string {
 		return "nothing"
 	case "save":
 		if a.ClosePage {
-			return "save_changes close_page"
+			return "save changes close page"
 		}
-		return "save_changes"
+		return "save changes"
 	case "cancel":
 		if a.ClosePage {
-			return "cancel_changes close_page"
+			return "cancel changes close page"
 		}
-		return "cancel_changes"
+		return "cancel changes"
 	case "close":
-		return "close_page"
+		return "close page"
 	case "delete":
-		return "delete_object"
+		if a.ClosePage {
+			return "delete close page"
+		}
+		return "delete"
 	case "showPage":
-		return "show_page " + a.Target
+		return "show page " + a.Target
 	case "microflow":
-		return "microflow " + a.Target
+		return "call microflow " + a.Target
 	case "nanoflow":
-		return "nanoflow " + a.Target
+		return "call nanoflow " + a.Target
 	case "signOut":
-		return "sign_out"
+		return "sign out"
 	case "completeTask":
-		return "complete_task '" + strings.ReplaceAll(a.OutcomeValue, "'", "''") + "'"
+		return "complete task '" + strings.ReplaceAll(a.OutcomeValue, "'", "''") + "'"
 	default:
 		return a.Type
 	}
diff --git a/mdl/executor/cmd_microflows_builder_flows.go b/mdl/executor/cmd_microflows_builder_flows.go
index 9305588039..dceddcb133 100644
--- a/mdl/executor/cmd_microflows_builder_flows.go
+++ b/mdl/executor/cmd_microflows_builder_flows.go
@@ -804,7 +804,7 @@ func (fb *flowBuilder) addErrorHandlerFlow(sourceActivityID model.ID, sourceX in
 	// Append error handler objects and flows to the main builder.
 	//
 	// annotationFlows and errors are part of that: without them a note written
-	// inside `on error { … }` arrived as an Annotation with no edge — a
+	// inside `on error begin … end error` arrived as an Annotation with no edge — a
 	// free-floating sticky note instead of one attached to the activity — and a
 	// refusal raised in the handler body never reached the caller (#1077).
 	fb.objects = append(fb.objects, errBuilder.objects...)
@@ -1087,11 +1087,11 @@ func containsTerminalStmt(stmts []ast.MicroflowStatement) bool {
 // still opens, which is how this survived a describe → exec round trip of a
 // whole project with everything else green.
 //
-// The shape that produced it is an empty `on error … { }` handler inside a
+// The shape that produced it is an empty `on error … begin end error` handler inside a
 // branch whose sibling also returns:
 //
 //	if … then
-//	  $r = call microflow M.Sub() on error without rollback { };
+//	  $r = call microflow M.Sub() on error without rollback begin end error;
 //	  return $r;          -- the normal path reaches the end event
 //	else
 //	  return 'no';        -- and so does this one
diff --git a/mdl/executor/cmd_microflows_builder_merge.go b/mdl/executor/cmd_microflows_builder_merge.go
index 9c556a0e3f..7dc6194c1b 100644
--- a/mdl/executor/cmd_microflows_builder_merge.go
+++ b/mdl/executor/cmd_microflows_builder_merge.go
@@ -15,7 +15,7 @@ package executor
 // a free graph of SequenceFlows, so it can express joins no nesting reproduces —
 // two branches landing on one point from different depths — and the commonest
 // real instance is an ERROR path rejoining the normal one. Before this, DESCRIBE
-// rendered such a graph as an empty `on error … { }` block and a describe → exec
+// rendered such a graph as an empty `on error … begin end error` block and a describe → exec
 // round trip silently rewrote it (measured: an error edge repointed from the
 // tail merge to an upstream one produced byte-identical MDL, and executing that
 // MDL reproduced the tail-merge graph). See
diff --git a/mdl/executor/cmd_microflows_describe_fold_test.go b/mdl/executor/cmd_microflows_describe_fold_test.go
index 438f314d70..7548ca5666 100644
--- a/mdl/executor/cmd_microflows_describe_fold_test.go
+++ b/mdl/executor/cmd_microflows_describe_fold_test.go
@@ -122,7 +122,7 @@ func TestDescribeFold_FallThroughHandlerHasNoLabels(t *testing.T) {
 	if strings.Contains(out, "join ") || strings.Contains(out, "merge ") {
 		t.Errorf("a fall-through handler came back as join/merge labels:\n%s", out)
 	}
-	if !regexp.MustCompile(`log error node 'X' 'failed';\n\s*};`).MatchString(out) {
+	if !regexp.MustCompile(`log error node 'X' 'failed';\n\s*end error;`).MatchString(out) {
 		t.Errorf("the handler body is not closed right after its statement:\n%s", out)
 	}
 	assertFoldRoundTrips(t, out, oc)
diff --git a/mdl/executor/cmd_microflows_format_action.go b/mdl/executor/cmd_microflows_format_action.go
index b7600d7e35..ea5d53803b 100644
--- a/mdl/executor/cmd_microflows_format_action.go
+++ b/mdl/executor/cmd_microflows_format_action.go
@@ -777,7 +777,7 @@ func formatAction(
 			// Extract just the parameter name from the qualified name
 			parts := strings.Split(pm.Parameter, ".")
 			paramName := parts[len(parts)-1]
-			params = append(params, fmt.Sprintf("$%s = %s", paramName, describeExpr(pm.Argument)))
+			params = append(params, fmt.Sprintf("%s = %s", paramName, describeExpr(pm.Argument)))
 		}
 
 		// Build the statement
@@ -807,11 +807,7 @@ func formatAction(
 		}
 		result := fmt.Sprintf("show message %s type %s", message, msgType)
 		if len(a.TemplateParameters) > 0 {
-			objs := make([]string, len(a.TemplateParameters))
-			for i, p := range a.TemplateParameters {
-				objs[i] = describeExpr(p)
-			}
-			result += " objects [" + strings.Join(objs, ", ") + "]"
+			result += templateArgsClause(a.TemplateParameters)
 		}
 		// Without this, a describe -> exec round trip turned a BLOCKING message
 		// box into a non-blocking one. The model carried Blocking on both
@@ -856,7 +852,7 @@ func formatAction(
 		} else if a.AssociationName != "" {
 			attrPath = varName + "/" + a.AssociationName
 		}
-		return fmt.Sprintf("validation feedback %s message %s;", attrPath, msgText)
+		return fmt.Sprintf("validation feedback %s message %s%s;", attrPath, msgText, templateArgsClause(a.TemplateParameters))
 
 	case *microflows.RestCallAction:
 		return formatRestCallAction(ctx, a)
@@ -1412,7 +1408,7 @@ func formatRestCallAction(ctx *ExecContext, a *microflows.RestCallAction) string
 			// reported nothing.
 			sb.WriteString(rh.EntityRef)
 		case *microflows.ResultHandlingNone:
-			sb.WriteString("Nothing")
+			sb.WriteString("nothing")
 		default:
 			// Refuse rather than guess. The previous "String" fallback here and
 			// below is what turned an unread result handling into a silent
@@ -1466,7 +1462,6 @@ func formatRestOperationCallAction(ctx *ExecContext, a *microflows.RestOperation
 			if i > 0 {
 				sb.WriteString(", ")
 			}
-			sb.WriteString("$")
 			sb.WriteString(p.name)
 			sb.WriteString(" = ")
 			sb.WriteString(p.value)
@@ -2061,3 +2056,17 @@ func mdlAggregateKeyword(fn microflows.AggregateFunction) (string, bool) {
 		return "", false
 	}
 }
+
+// templateArgsClause renders a text template's arguments as ` with ({1} = a,
+// {2} = b)` — R4's one text-template form (ako/mxcli#751) — or "" when there
+// are none.
+func templateArgsClause(args []string) string {
+	if len(args) == 0 {
+		return ""
+	}
+	parts := make([]string, len(args))
+	for i, a := range args {
+		parts[i] = fmt.Sprintf("{%d} = %s", i+1, describeExpr(a))
+	}
+	return " with (" + strings.Join(parts, ", ") + ")"
+}
diff --git a/mdl/executor/cmd_microflows_format_action_test.go b/mdl/executor/cmd_microflows_format_action_test.go
index 792db3f71c..7a4d457718 100644
--- a/mdl/executor/cmd_microflows_format_action_test.go
+++ b/mdl/executor/cmd_microflows_format_action_test.go
@@ -525,7 +525,7 @@ func TestFormatAction_ShowPage_WithParams(t *testing.T) {
 		},
 	}
 	got := e.formatAction(action, nil, nil)
-	want := "show page MyModule.OrderDetail($Order = $Order);"
+	want := "show page MyModule.OrderDetail(Order = $Order);"
 	if got != want {
 		t.Errorf("got %q, want %q", got, want)
 	}
diff --git a/mdl/executor/cmd_microflows_format_restcall_test.go b/mdl/executor/cmd_microflows_format_restcall_test.go
index a772f5b25b..5e77efb4aa 100644
--- a/mdl/executor/cmd_microflows_format_restcall_test.go
+++ b/mdl/executor/cmd_microflows_format_restcall_test.go
@@ -61,7 +61,7 @@ func TestFormatRestCallAction_POST_CustomBody(t *testing.T) {
 	got := e.formatRestCallAction(action)
 	assertContains(t, got, "rest call post")
 	assertContains(t, got, "body '{\"name\": \"test\"}'")
-	assertContains(t, got, "returns Nothing")
+	assertContains(t, got, "returns nothing")
 }
 
 func TestFormatRestCallAction_WithHeaders(t *testing.T) {
diff --git a/mdl/executor/cmd_microflows_handles.go b/mdl/executor/cmd_microflows_handles.go
index 1c871e2415..3c32bd2098 100644
--- a/mdl/executor/cmd_microflows_handles.go
+++ b/mdl/executor/cmd_microflows_handles.go
@@ -62,7 +62,7 @@ func microflowTargets(
 // the statement itself: the annotation and comment lines before it are
 // skipped, and the statement runs to the line that ends it, continuation
 // lines included — describe breaks a long condition without indenting the
-// rest. An `if` ends at `then`; an action at `;` (or the `{` of an error
+// rest. An `if` ends at `then`; an action at `;` (or the `begin` of an error
 // handler block); a loop, an enumeration `case` and a `split type` open a
 // block on the next line, so they are their first line.
 //
@@ -88,14 +88,18 @@ func printedStatement(obj microflows.MicroflowObject, body []string, r elkSource
 				return strings.Join(parts, " ")
 			}
 		default:
+			// The `begin` that opens an error handler block, and an empty
+			// handler's whole `begin end error`, are not part of the statement:
+			// a handle is written as an alter target, which names the activity
+			// and ends before any fragment.
+			if strings.HasSuffix(line, " begin end error;") {
+				return strings.TrimSpace(strings.TrimSuffix(strings.Join(parts, " "), " begin end error;"))
+			}
 			if strings.HasSuffix(line, ";") {
 				return strings.Join(parts, " ")
 			}
-			if strings.HasSuffix(line, "{") {
-				// The `{` opens the error handler block. It is not part of
-				// the statement: a handle is written as an alter target, and a
-				// target ends where a fragment's `{` begins.
-				return strings.TrimSpace(strings.TrimSuffix(strings.Join(parts, " "), "{"))
+			if strings.HasSuffix(line, " begin") {
+				return strings.TrimSpace(strings.TrimSuffix(strings.Join(parts, " "), " begin"))
 			}
 		}
 		if len(parts) >= 50 {
diff --git a/mdl/executor/cmd_microflows_handles_test.go b/mdl/executor/cmd_microflows_handles_test.go
index 10ae2ce01c..9f5997a333 100644
--- a/mdl/executor/cmd_microflows_handles_test.go
+++ b/mdl/executor/cmd_microflows_handles_test.go
@@ -212,7 +212,7 @@ func TestMicroflowTargets_NegatedIfMatchesBothForms(t *testing.T) {
 
 // errorHandlerFixture is a flow whose custom error handler holds a statement
 // that also occurs after the handled activity. Describe prints the handler's
-// copy first, inside the `on error { … }` block.
+// copy first, inside the `on error begin … end error` block.
 func errorHandlerFixture() *microflows.Microflow {
 	act := func(id string, x, y int, a microflows.MicroflowAction) *microflows.ActionActivity {
 		return &microflows.ActionActivity{
@@ -258,7 +258,7 @@ func errorHandlerFixture() *microflows.Microflow {
 	return &microflows.Microflow{ObjectCollection: oc}
 }
 
-// An activity inside an `on error { … }` block is printed, so it gets a handle
+// An activity inside an `on error begin … end error` block is printed, so it gets a handle
 // directly above it, and ordinals count it where it is printed: before the
 // main-path copy that follows the block. Ranking handler bodies after
 // everything else would make `@1` pick the activity a reader counts second.
@@ -273,7 +273,7 @@ func TestDescribeWithHandles_ErrorHandlerBody(t *testing.T) {
 			setLines = append(setLines, i)
 		}
 	}
-	if len(setLines) != 2 || !strings.Contains(got, "on error without rollback {") {
+	if len(setLines) != 2 || !strings.Contains(got, "on error without rollback begin") {
 		t.Fatalf("fixture should print the handler's set inside the block, then the main one:\n%s", got)
 	}
 
@@ -310,16 +310,21 @@ func TestDescribeWithHandles_ErrorHandlerBody(t *testing.T) {
 }
 
 // A handle has to be writable as an `alter microflow` target, and a target
-// ends at the `{` that opens a fragment. So the `{` describe prints after an
-// activity with a custom error handler is not part of its statement.
+// names the activity and ends before any fragment. So the `begin` describe
+// prints after an activity with a custom error handler, and an empty handler's
+// whole `begin end error`, are not part of its statement.
 func TestPrintedStatement_ErrorHandlerBlockOpenerIsNotPartOfTheStatement(t *testing.T) {
-	body := []string{"  commit $Order on error {", "    return false;", "  };"}
-	obj := &microflows.ActionActivity{}
-	got := printedStatement(obj, body, elkSourceRange{StartLine: 0, EndLine: 2})
-	if got != "commit $Order on error" {
-		t.Errorf("printed statement %q, want %q", got, "commit $Order on error")
-	}
-	if _, err := mfmutator.ParseTarget(got); err != nil {
-		t.Errorf("the handle does not parse as a target: %v", err)
+	for _, body := range [][]string{
+		{"  commit $Order on error begin", "    return false;", "  end error;"},
+		{"  commit $Order on error begin end error;"},
+	} {
+		obj := &microflows.ActionActivity{}
+		got := printedStatement(obj, body, elkSourceRange{StartLine: 0, EndLine: len(body) - 1})
+		if got != "commit $Order on error" {
+			t.Errorf("%q: printed statement %q, want %q", body[0], got, "commit $Order on error")
+		}
+		if _, err := mfmutator.ParseTarget(got); err != nil {
+			t.Errorf("the handle does not parse as a target: %v", err)
+		}
 	}
 }
diff --git a/mdl/executor/cmd_microflows_show_helpers.go b/mdl/executor/cmd_microflows_show_helpers.go
index edde96b8fc..72a3ae5c75 100644
--- a/mdl/executor/cmd_microflows_show_helpers.go
+++ b/mdl/executor/cmd_microflows_show_helpers.go
@@ -863,7 +863,7 @@ func emitActivityStatement(
 		// The early return above used to end the function, which also skipped the
 		// error-handler traversal further down — so an activity the describer
 		// could not render lost its entire error branch without a word (#863).
-		// The branch cannot be emitted as live MDL (an `on error { … }` block has
+		// The branch cannot be emitted as live MDL (an `on error begin … end error` block has
 		// no statement to attach to here), but it must not disappear either:
 		// render it commented-out, so the artifact still shows what the model
 		// holds. Guard-don't-drop, in a path that cannot round-trip.
@@ -903,14 +903,14 @@ func emitActivityStatement(
 		}
 
 		if len(errStmts) == 0 {
-			*lines = append(*lines, indentStr+stmtWithoutSemi+errorSuffix+" { };")
+			*lines = append(*lines, indentStr+stmtWithoutSemi+errorSuffix+" begin end error;")
 		} else {
-			*lines = append(*lines, indentStr+stmtWithoutSemi+errorSuffix+" {")
+			*lines = append(*lines, indentStr+stmtWithoutSemi+errorSuffix+" begin")
 			recordErrorHandlerSpans(sourceMap, errSpans, len(*lines)+headerLineCount)
 			for _, errStmt := range errStmts {
 				*lines = append(*lines, indentStr+"  "+errStmt)
 			}
-			*lines = append(*lines, indentStr+"};")
+			*lines = append(*lines, indentStr+"end error;")
 		}
 	} else if suffix != "" {
 		stmtWithoutSemi := strings.TrimSuffix(strings.TrimSpace(stmt), ";")
@@ -922,7 +922,7 @@ func emitActivityStatement(
 
 // emitCommentedErrorHandler renders an activity's error branch as MDL line
 // comments. It is the fallback for activities the describer can only emit as a
-// comment: the branch has no live statement to hang an `on error { … }` block
+// comment: the branch has no live statement to hang an `on error begin … end error` block
 // off, so the choice is between showing it commented-out and losing it.
 //
 // Commenting is load-bearing, not cosmetic. Emitting these statements as live
@@ -960,15 +960,15 @@ func emitCommentedErrorHandler(
 	errStmts, errSpans := collectErrorHandlerStatementSpans(
 		ctx, errorHandlerFlow.DestinationID, activityMap, flowsByOrigin, entityNames, microflowNames, annotationsByTarget, labels)
 	if len(errStmts) == 0 {
-		*lines = append(*lines, indentStr+"-- "+suffix+" { };")
+		*lines = append(*lines, indentStr+"-- "+suffix+" begin end error;")
 		return
 	}
-	*lines = append(*lines, indentStr+"-- "+suffix+" {")
+	*lines = append(*lines, indentStr+"-- "+suffix+" begin")
 	recordErrorHandlerSpans(sourceMap, errSpans, len(*lines)+headerLineCount)
 	for _, errStmt := range errStmts {
 		*lines = append(*lines, indentStr+"--   "+strings.TrimSpace(errStmt))
 	}
-	*lines = append(*lines, indentStr+"-- };")
+	*lines = append(*lines, indentStr+"-- end error;")
 }
 
 // activity narrows a MicroflowObject to *ActionActivity, or nil.
@@ -2302,7 +2302,7 @@ func hasCustomErrorHandler(errType microflows.ErrorHandlingType) bool {
 //
 // This gates far more than a suffix. emitActivityStatement only walks an
 // activity's error branch when hasCustomErrorHandler() agrees, so an action whose
-// type is not reported here loses its ENTIRE `on error { … }` block from DESCRIBE
+// type is not reported here loses its ENTIRE `on error begin … end error` block from DESCRIBE
 // — silently, and in valid-looking MDL, so a describe→edit→exec round-trip
 // deletes the handler from the model (mendixlabs/mxcli#1078).
 func getActionErrorHandlingType(activity *microflows.ActionActivity) microflows.ErrorHandlingType {
@@ -2407,7 +2407,7 @@ func collectErrorHandlerStatementSpans(
 
 	// A note on a handler-body activity is emitted here or nowhere: this
 	// traversal is a second, smaller describer and the main one never reaches
-	// inside an `on error { … }` block. Without it the write path attaches the
+	// inside an `on error begin … end error` block. Without it the write path attaches the
 	// note and the read path drops it, which is the same round-trip loss #1077
 	// is about, one nesting level down.
 	notes := func(obj microflows.MicroflowObject, indentStr string) {
diff --git a/mdl/executor/cmd_microflows_show_merge.go b/mdl/executor/cmd_microflows_show_merge.go
index 7613666a9e..4ac083a010 100644
--- a/mdl/executor/cmd_microflows_show_merge.go
+++ b/mdl/executor/cmd_microflows_show_merge.go
@@ -10,7 +10,7 @@ package executor
 //
 // The case this exists for is an ERROR path that rejoins the normal one. Before
 // it, `collectErrorHandlerStatements` stopped dead at the merge and emitted an
-// empty `on error … { }` block — MDL that re-executes to a DIFFERENT graph, with
+// empty `on error … begin end error` block — MDL that re-executes to a DIFFERENT graph, with
 // no warning. Measured: repointing SUB_Feedback_SendToServer's error edge from
 // the tail merge to an upstream one produced byte-identical MDL, and executing
 // it reproduced the tail-merge graph.
@@ -326,7 +326,7 @@ func droppedMergeWarnings(ctx *ExecContext, oc *microflows.MicroflowObjectCollec
 
 // fallThroughRejoinMerge returns the merge where the custom error handler of
 // source rejoins the normal path when that rejoin is a FALL-THROUGH — the shape
-// `on error { … };` with no `join` builds — and "" otherwise.
+// `on error begin … end error;` with no `join` builds — and "" otherwise.
 //
 // A fall-through is exactly this, and anything looser is a goto the labels must
 // keep spelling:
diff --git a/mdl/executor/cmd_misc.go b/mdl/executor/cmd_misc.go
index 5b0cf3e152..6a4cc2c123 100644
--- a/mdl/executor/cmd_misc.go
+++ b/mdl/executor/cmd_misc.go
@@ -121,7 +121,7 @@ Domain Model - Associations:
     to Module.Child
     type Reference|ReferenceSet
     [owner Default|Both|Parent|Child]
-    [delete_behavior DELETE_BUT_KEEP_REFERENCES|DELETE_AND_REFERENCES|DELETE_IF_NO_REFERENCES];
+    [on delete set null|cascade|restrict [error message '...']];
   /
 
   drop association Module.Name;
@@ -146,8 +146,8 @@ Microflows:
     change $Object (attr = value);
     commit $Object [with events] [refresh];
     retrieve $List from Module.Entity where condition;
-    $Var = call microflow Module.Name($param = value);
-    $Var = call java action Module.Name($param = value);
+    $Var = call microflow Module.Name(param = value);
+    $Var = call java action Module.Name(param = value);
     validation feedback $Var/Attr message 'Error';  -- Show validation error
     close page [n];                      -- Close page(s)
     log info|warning|error [node 'name'] 'message';
diff --git a/mdl/executor/cmd_navigation.go b/mdl/executor/cmd_navigation.go
index 02f929b008..632c6f353b 100644
--- a/mdl/executor/cmd_navigation.go
+++ b/mdl/executor/cmd_navigation.go
@@ -435,7 +435,7 @@ func printMenuMDL(w io.Writer, items []*types.NavMenuItem, depth int, reproducer
 		} else if item.Microflow != "" {
 			fmt.Fprintf(w, "%smenu item '%s' microflow %s%s;\n", indent, item.Caption, item.Microflow, icon)
 		} else if item.ActionType == "SignOutAction" {
-			fmt.Fprintf(w, "%smenu item '%s' sign_out%s;\n", indent, item.Caption, icon)
+			fmt.Fprintf(w, "%smenu item '%s' sign out%s;\n", indent, item.Caption, icon)
 		} else {
 			fmt.Fprintf(w, "%smenu item '%s'%s;\n", indent, item.Caption, icon)
 		}
diff --git a/mdl/executor/cmd_pages_builder_v3.go b/mdl/executor/cmd_pages_builder_v3.go
index 23f8e0342d..5684370c68 100644
--- a/mdl/executor/cmd_pages_builder_v3.go
+++ b/mdl/executor/cmd_pages_builder_v3.go
@@ -1665,17 +1665,17 @@ func (pb *pageBuilder) buildClientActionV3(action *ast.ActionV3) (pages.ClientAc
 			// the only variable Studio Pro's "Address: attribute" choice binds.
 			if !strings.EqualFold(action.LinkVariable, "$currentObject") {
 				return nil, mdlerrors.NewValidationf(
-					"open_link %s/%s: a dynamic link address is read from $currentObject — write `open_link $currentObject/%s` inside the data container that holds it",
+					"open link %s/%s: a dynamic link address is read from $currentObject — write `open link $currentObject/%s` inside the data container that holds it",
 					action.LinkVariable, action.LinkAttribute, action.LinkAttribute)
 			}
 			if strings.Contains(action.LinkAttribute, "/") {
 				return nil, mdlerrors.NewValidationf(
-					"open_link $currentObject/%s: an address over an association path is not supported yet — bind an attribute of the data container's own entity",
+					"open link $currentObject/%s: an address over an association path is not supported yet — bind an attribute of the data container's own entity",
 					action.LinkAttribute)
 			}
 			if pb.entityContext == "" {
 				return nil, mdlerrors.NewValidationf(
-					"open_link $currentObject/%s: a dynamic link address needs an object to read it from — place the button inside a data container",
+					"open link $currentObject/%s: a dynamic link address needs an object to read it from — place the button inside a data container",
 					action.LinkAttribute)
 			}
 			addressAttr = pb.resolveAttributePath(action.LinkAttribute)
@@ -2511,7 +2511,7 @@ func substituteFragmentParams(fragName string, params []ast.FragmentParam, rawAr
 			}
 			if act == nil {
 				return mdlerrors.NewValidation(fmt.Sprintf(
-					"fragment %q: parameter $%s expects an action (e.g. a microflow, show_page, save)", fragName, p.Name))
+					"fragment %q: parameter $%s expects an action (e.g. call microflow, show page, save changes)", fragName, p.Name))
 			}
 			actSubst[p.Name] = act
 		}
diff --git a/mdl/executor/cmd_pages_describe_container_test.go b/mdl/executor/cmd_pages_describe_container_test.go
index c613c87fb8..de37b1d23f 100644
--- a/mdl/executor/cmd_pages_describe_container_test.go
+++ b/mdl/executor/cmd_pages_describe_container_test.go
@@ -243,7 +243,7 @@ func TestParseRawWidget_DivContainerExtractsOnClickAction(t *testing.T) {
 	if len(got) != 1 {
 		t.Fatalf("expected 1 widget, got %d", len(got))
 	}
-	if want := "microflow MyFirstModule.MyFirstLogic"; got[0].Action != want {
+	if want := "call microflow MyFirstModule.MyFirstLogic"; got[0].Action != want {
 		t.Errorf("Action: got %q, want %q", got[0].Action, want)
 	}
 	if len(got[0].Children) != 1 || got[0].Children[0].Name != "t" {
@@ -276,7 +276,7 @@ func TestOutputWidgetMDLV3_DivContainerEmitsAction(t *testing.T) {
 	box := rawWidget{
 		Type:   "Forms$DivContainer",
 		Name:   "box",
-		Action: "microflow MyFirstModule.MyFirstLogic",
+		Action: "call microflow MyFirstModule.MyFirstLogic",
 		Children: []rawWidget{
 			{Type: "Forms$DynamicText", Name: "t"},
 		},
@@ -286,7 +286,7 @@ func TestOutputWidgetMDLV3_DivContainerEmitsAction(t *testing.T) {
 	out := buf.String()
 	for _, want := range []string{
 		"container box",
-		"Action: microflow MyFirstModule.MyFirstLogic",
+		"Action: call microflow MyFirstModule.MyFirstLogic",
 	} {
 		if !strings.Contains(out, want) {
 			t.Errorf("output missing %q\nfull output:\n%s", want, out)
diff --git a/mdl/executor/cmd_pages_describe_datasource.go b/mdl/executor/cmd_pages_describe_datasource.go
index 63bb53f33b..a80c95339d 100644
--- a/mdl/executor/cmd_pages_describe_datasource.go
+++ b/mdl/executor/cmd_pages_describe_datasource.go
@@ -302,7 +302,7 @@ func dataSourceExpr(ds *rawDataSource) string {
 		if len(ds.Args) > 0 {
 			parts := make([]string, 0, len(ds.Args))
 			for _, arg := range ds.Args {
-				parts = append(parts, arg.Name+": "+arg.Value)
+				parts = append(parts, visitor.ParameterNameSpelling(arg.Name)+" = "+arg.Value)
 			}
 			expr += "(" + strings.Join(parts, ", ") + ")"
 		}
diff --git a/mdl/executor/cmd_pages_describe_datasource_test.go b/mdl/executor/cmd_pages_describe_datasource_test.go
index bc0f7cdab4..99f83a2d50 100644
--- a/mdl/executor/cmd_pages_describe_datasource_test.go
+++ b/mdl/executor/cmd_pages_describe_datasource_test.go
@@ -299,7 +299,7 @@ func TestDataSourceArgsRoundTrip(t *testing.T) {
 		t.Errorf("second arg = %+v, want {Limit 10}", got.Args[1])
 	}
 
-	want := "microflow Mod.DS_Filtered(Term: $Term, Limit: 10)"
+	want := "microflow Mod.DS_Filtered(Term = $Term, Limit = 10)"
 	if expr := dataSourceExpr(got); expr != want {
 		t.Errorf("rendered %q, want %q", expr, want)
 	}
@@ -345,7 +345,7 @@ func TestDataSourceArgsNanoflowFlat(t *testing.T) {
 	if got == nil {
 		t.Fatal("nanoflow datasource not read")
 	}
-	want := "nanoflow Mod.NF_Rows(Ctx: $currentObject)"
+	want := "nanoflow Mod.NF_Rows(Ctx = $currentObject)"
 	if expr := dataSourceExpr(got); expr != want {
 		t.Errorf("rendered %q, want %q", expr, want)
 	}
@@ -369,7 +369,7 @@ func TestDataSourceArgsNanoflow(t *testing.T) {
 	if got == nil {
 		t.Fatal("nanoflow datasource not read")
 	}
-	want := "nanoflow Mod.NF_Rows(Ctx: $currentObject)"
+	want := "nanoflow Mod.NF_Rows(Ctx = $currentObject)"
 	if expr := dataSourceExpr(got); expr != want {
 		t.Errorf("rendered %q, want %q", expr, want)
 	}
diff --git a/mdl/executor/cmd_pages_describe_flow_args_test.go b/mdl/executor/cmd_pages_describe_flow_args_test.go
index ec18170e04..015508847e 100644
--- a/mdl/executor/cmd_pages_describe_flow_args_test.go
+++ b/mdl/executor/cmd_pages_describe_flow_args_test.go
@@ -85,17 +85,17 @@ func TestDataSourceArgsReadPageVariableBinding(t *testing.T) {
 				"Parameter": "Mod.DS.Order",
 				"Variable":  map[string]any{"$Type": "Forms$PageVariable", "PageParameter": "Order"},
 			},
-			"microflow Mod.DS(Order: $Order)",
+			"microflow Mod.DS(Order = $Order)",
 		},
 		{
 			"expression binding still read",
 			map[string]any{"Parameter": "Mod.DS.Order", "Expression": "$Order"},
-			"microflow Mod.DS(Order: $Order)",
+			"microflow Mod.DS(Order = $Order)",
 		},
 		{
 			"bare string in Variable still read",
 			map[string]any{"Parameter": "Mod.DS.Order", "Variable": "$Order"},
-			"microflow Mod.DS(Order: $Order)",
+			"microflow Mod.DS(Order = $Order)",
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
diff --git a/mdl/executor/cmd_pages_describe_output.go b/mdl/executor/cmd_pages_describe_output.go
index 7d3da40143..86bbe9296d 100644
--- a/mdl/executor/cmd_pages_describe_output.go
+++ b/mdl/executor/cmd_pages_describe_output.go
@@ -5,6 +5,7 @@ package executor
 import (
 	"context"
 	"fmt"
+	"github.com/mendixlabs/mxcli/mdl/visitor"
 	"io"
 	"regexp"
 	"strconv"
@@ -1353,7 +1354,7 @@ func actionMapForKey(w map[string]any, key string) map[string]any {
 }
 
 // renderClientActionMDL renders a client-action map (a Forms$*ClientAction) back
-// to its MDL form (microflow/nanoflow/show_page/save_changes/…). Returns "" for a
+// to its MDL form (call microflow/call nanoflow/show page/save changes/…). Returns "" for a
 // nil action or a NoClientAction.
 func renderClientActionMDL(ctx *ExecContext, action map[string]any) string {
 	if action == nil {
@@ -1362,27 +1363,27 @@ func renderClientActionMDL(ctx *ExecContext, action map[string]any) string {
 	typeName, _ := action["$Type"].(string)
 	switch typeName {
 	case "Forms$SaveChangesClientAction", "Pages$SaveChangesClientAction":
-		result := "save_changes"
+		result := "save changes"
 		if closePage, ok := action["ClosePage"].(bool); ok && closePage {
-			result += " close_page"
+			result += " close page"
 		}
 		return result
 	case "Forms$CancelChangesClientAction", "Pages$CancelChangesClientAction":
-		result := "cancel_changes"
+		result := "cancel changes"
 		if closePage, ok := action["ClosePage"].(bool); ok && closePage {
-			result += " close_page"
+			result += " close page"
 		}
 		return result
 	case "Forms$ClosePageClientAction", "Pages$ClosePageClientAction":
-		return "close_page"
+		return "close page"
 	case "Forms$DeleteClientAction", "Pages$DeleteClientAction":
-		result := "delete_object"
+		result := "delete"
 		if closePage, ok := action["ClosePage"].(bool); ok && closePage {
-			result += " close_page"
+			result += " close page"
 		}
 		return result
 	case "Forms$CreateObjectClientAction", "Pages$CreateObjectClientAction":
-		result := "create_object"
+		result := "create object"
 		// Extract entity reference
 		if entityRef, ok := action["EntityRef"].(map[string]any); ok {
 			if entityName, ok := entityRef["Entity"].(string); ok && entityName != "" {
@@ -1393,7 +1394,7 @@ func renderClientActionMDL(ctx *ExecContext, action map[string]any) string {
 		if pageSettings, ok := action["PageSettings"].(map[string]any); ok {
 			// The page is stored in "Form" field as a qualified name string (BY_NAME_REFERENCE)
 			if pageName, ok := pageSettings["Form"].(string); ok && pageName != "" {
-				pageAction := "show_page " + pageName
+				pageAction := "show page " + pageName
 				// Extract page parameters
 				params := extractPageParameters(ctx, pageSettings)
 				if params != "" {
@@ -1408,7 +1409,7 @@ func renderClientActionMDL(ctx *ExecContext, action map[string]any) string {
 		// or PageSettings.Form, or Page field (binary ID for legacy)
 		if formSettings, ok := action["FormSettings"].(map[string]any); ok {
 			if pageName, ok := formSettings["Form"].(string); ok && pageName != "" {
-				result := "show_page " + pageName
+				result := "show page " + pageName
 				params := pageActionParameters(ctx, formSettings, pageName)
 				if params != "" {
 					result += "(" + params + ")"
@@ -1418,7 +1419,7 @@ func renderClientActionMDL(ctx *ExecContext, action map[string]any) string {
 		}
 		if pageSettings, ok := action["PageSettings"].(map[string]any); ok {
 			if pageName, ok := pageSettings["Form"].(string); ok && pageName != "" {
-				result := "show_page " + pageName
+				result := "show page " + pageName
 				params := pageActionParameters(ctx, pageSettings, pageName)
 				if params != "" {
 					result += "(" + params + ")"
@@ -1430,15 +1431,15 @@ func renderClientActionMDL(ctx *ExecContext, action map[string]any) string {
 		if pageID := extractBinaryID(action["Page"]); pageID != "" {
 			pageName := getPageQualifiedName(ctx, model.ID(pageID))
 			if pageName != "" {
-				return "show_page " + pageName
+				return "show page " + pageName
 			}
 		}
-		return "show_page"
+		return "show page"
 	case "Forms$MicroflowAction", "Pages$MicroflowClientAction":
 		// Extract microflow reference from MicroflowSettings
 		if settings, ok := action["MicroflowSettings"].(map[string]any); ok {
 			if mfName, ok := settings["Microflow"].(string); ok && mfName != "" {
-				result := "microflow " + mfName
+				result := "call microflow " + mfName
 				// Extract parameter mappings
 				params := extractMicroflowParameters(ctx, settings)
 				if params != "" {
@@ -1447,10 +1448,10 @@ func renderClientActionMDL(ctx *ExecContext, action map[string]any) string {
 				return result
 			}
 		}
-		return "microflow"
+		return "call microflow"
 	case "Forms$CallNanoflowClientAction", "Pages$CallNanoflowClientAction":
 		if nfName, ok := action["Nanoflow"].(string); ok && nfName != "" {
-			result := "nanoflow " + nfName
+			result := "call nanoflow " + nfName
 			// Extract parameter mappings (directly in the action)
 			params := extractNanoflowParameters(ctx, action)
 			if params != "" {
@@ -1458,21 +1459,21 @@ func renderClientActionMDL(ctx *ExecContext, action map[string]any) string {
 			}
 			return result
 		}
-		return "nanoflow"
+		return "call nanoflow"
 	case "Forms$SetTaskOutcomeClientAction", "Pages$SetTaskOutcomeClientAction":
 		outcomeValue, _ := action["OutcomeValue"].(string)
-		return "complete_task '" + strings.ReplaceAll(outcomeValue, "'", "''") + "'"
+		return "complete task '" + strings.ReplaceAll(outcomeValue, "'", "''") + "'"
 	case "Forms$SignOutClientAction", "Pages$SignOutClientAction":
-		return "sign_out"
+		return "sign out"
 	case "Forms$OpenLinkClientAction", "Pages$OpenLinkClientAction":
 		// The address is a nested Forms$StaticOrDynamicString: a literal, or —
 		// DYNAMIC, 6 of the 31 Studio Pro references — an attribute read at
-		// runtime, spelled `open_link $currentObject/Attr`. It used to render
+		// runtime, spelled `open link $currentObject/Attr`. It used to render
 		// as an inline `--` note, which left `Action:` without a value and made
 		// the describe output unparseable.
 		addr := actionMapForKey(action, "Address")
 		if addr == nil {
-			return "open_link ''"
+			return "open link ''"
 		}
 		if isDynamic, _ := addr["IsDynamic"].(bool); isDynamic {
 			attr := ""
@@ -1482,16 +1483,16 @@ func renderClientActionMDL(ctx *ExecContext, action map[string]any) string {
 				overAssociation = actionMapForKey(ref, "EntityRef") != nil
 			}
 			if attr != "" && !overAssociation {
-				return "open_link $currentObject/" + shortAttributeName(attr)
+				return "open link $currentObject/" + shortAttributeName(attr)
 			}
 			// No MDL spelling: a note, which actionProp puts on its own line.
 			// CREATE OR REPLACE PAGE rebuilds the page, so say plainly that
 			// re-running drops the action rather than implying it survives.
-			return "-- NOT re-executable: open_link with a dynamic address over an association (" +
+			return "-- NOT re-executable: open link with a dynamic address over an association (" +
 				attr + ") — re-running this script would drop the button's action"
 		}
 		value, _ := addr["Value"].(string)
-		return "open_link '" + strings.ReplaceAll(value, "'", "''") + "'"
+		return "open link '" + strings.ReplaceAll(value, "'", "''") + "'"
 	case "Forms$NoClientAction", "Pages$NoClientAction":
 		return ""
 	default:
@@ -1546,7 +1547,7 @@ func pageActionParameters(ctx *ExecContext, settings map[string]any, pageName st
 	// bound to the row object the enclosing widget supplies.
 	var params []string
 	for _, name := range targetPageParameterNames(ctx, pageName) {
-		params = append(params, mdlIdent(name)+": $currentObject")
+		params = append(params, visitor.ParameterNameSpelling(name)+" = $currentObject")
 	}
 	return strings.Join(params, ", ")
 }
@@ -1586,7 +1587,7 @@ func targetPageParameterNames(ctx *ExecContext, qualifiedName string) []string {
 }
 
 // extractPageParameters extracts page parameter mappings from a FormSettings/PageSettings object.
-// Returns formatted string like "Product: $currentObject" or empty string if no params.
+// Returns formatted string like "Product = $currentObject" or empty string if no params.
 func extractPageParameters(ctx *ExecContext, settings map[string]any) string {
 	mappings := getBsonArrayElements(settings["ParameterMappings"])
 	if len(mappings) == 0 {
@@ -1636,7 +1637,7 @@ func extractPageParameters(ctx *ExecContext, settings map[string]any) string {
 		}
 
 		if value != "" {
-			params = append(params, mdlIdent(paramName)+": "+value)
+			params = append(params, visitor.ParameterNameSpelling(paramName)+" = "+value)
 		}
 	}
 
@@ -1695,7 +1696,7 @@ func extractMicroflowParameters(ctx *ExecContext, settings map[string]any) strin
 		if value != "" {
 			// Canonical microflowArgV3 form is `Param: $value` (IDENTIFIER COLON expr);
 			// emitting `Param = $value` is IDENTIFIER EQUALS, which doesn't re-parse (#640).
-			params = append(params, mdlIdent(paramName)+": "+value)
+			params = append(params, visitor.ParameterNameSpelling(paramName)+" = "+value)
 		}
 	}
 
@@ -1754,7 +1755,7 @@ func extractNanoflowParameters(ctx *ExecContext, action map[string]any) string {
 		if value != "" {
 			// Canonical microflowArgV3 form is `Param: $value` (IDENTIFIER COLON expr);
 			// emitting `Param = $value` is IDENTIFIER EQUALS, which doesn't re-parse (#640).
-			params = append(params, mdlIdent(paramName)+": "+value)
+			params = append(params, visitor.ParameterNameSpelling(paramName)+" = "+value)
 		}
 	}
 
diff --git a/mdl/executor/cmd_pages_describe_pageparams_test.go b/mdl/executor/cmd_pages_describe_pageparams_test.go
index e9c38459dc..d47d34825e 100644
--- a/mdl/executor/cmd_pages_describe_pageparams_test.go
+++ b/mdl/executor/cmd_pages_describe_pageparams_test.go
@@ -56,7 +56,7 @@ func showPageAction(page string, mappings []any) map[string]any {
 	}
 }
 
-// mxcli-formula1 §39: `SHOW_PAGE P(Race: $currentObject)` described back as
+// mxcli-formula1 §39: `SHOW_PAGE P(Race = $currentObject)` described back as
 // `show_page P`. The mapping was never in the model — mxcli stores it implicitly
 // on purpose — but DESCRIBE had no compensating recovery, so its output read as
 // a diagnosis ("the mapping was dropped, that is why the page gets an empty
@@ -66,7 +66,7 @@ func TestRenderShowPageAction_RecoversTheImplicitParameter(t *testing.T) {
 	ctx := pageParamFixture(t, "Race")
 
 	got := renderClientActionMDL(ctx, showPageAction("Formula1Frontend.Race_Weekend", nil))
-	want := "show_page Formula1Frontend.Race_Weekend(Race: $currentObject)"
+	want := "show page Formula1Frontend.Race_Weekend(Race = $currentObject)"
 	if got != want {
 		t.Errorf("DESCRIBE lost the page parameter:\n got: %s\nwant: %s", got, want)
 	}
@@ -77,7 +77,7 @@ func TestRenderShowPageAction_RecoversEveryParameter(t *testing.T) {
 	ctx := pageParamFixture(t, "Race", "Season")
 
 	got := renderClientActionMDL(ctx, showPageAction("Formula1Frontend.Race_Weekend", nil))
-	want := "show_page Formula1Frontend.Race_Weekend(Race: $currentObject, Season: $currentObject)"
+	want := "show page Formula1Frontend.Race_Weekend(Race = $currentObject, Season = $currentObject)"
 	if got != want {
 		t.Errorf("got:  %s\nwant: %s", got, want)
 	}
@@ -88,7 +88,7 @@ func TestRenderShowPageAction_NoParametersStaysBare(t *testing.T) {
 	ctx := pageParamFixture(t)
 
 	got := renderClientActionMDL(ctx, showPageAction("Formula1Frontend.Race_Weekend", nil))
-	if want := "show_page Formula1Frontend.Race_Weekend"; got != want {
+	if want := "show page Formula1Frontend.Race_Weekend"; got != want {
 		t.Errorf("got:  %s\nwant: %s", got, want)
 	}
 }
@@ -100,7 +100,7 @@ func TestRenderShowPageAction_UnknownPageInventsNothing(t *testing.T) {
 	ctx := pageParamFixture(t, "Race")
 
 	got := renderClientActionMDL(ctx, showPageAction("OtherModule.Gone", nil))
-	if want := "show_page OtherModule.Gone"; got != want {
+	if want := "show page OtherModule.Gone"; got != want {
 		t.Errorf("got:  %s\nwant: %s", got, want)
 	}
 }
@@ -119,7 +119,7 @@ func TestRenderShowPageAction_ExplicitMappingWins(t *testing.T) {
 		},
 	}
 	got := renderClientActionMDL(ctx, showPageAction("Formula1Frontend.Race_Weekend", mappings))
-	want := "show_page Formula1Frontend.Race_Weekend(Race: $SelectedRace)"
+	want := "show page Formula1Frontend.Race_Weekend(Race = $SelectedRace)"
 	if got != want {
 		t.Errorf("an explicit mapping was overwritten:\n got: %s\nwant: %s", got, want)
 	}
diff --git a/mdl/executor/cmd_pages_describe_pluggable.go b/mdl/executor/cmd_pages_describe_pluggable.go
index 78626d4354..ec5e5898bb 100644
--- a/mdl/executor/cmd_pages_describe_pluggable.go
+++ b/mdl/executor/cmd_pages_describe_pluggable.go
@@ -1360,7 +1360,7 @@ func customWidgetActionForSource(ctx *ExecContext, w map[string]any, source stri
 }
 
 // extractCustomWidgetPropertyAction extracts an action description from a CustomWidget property.
-// Returns a formatted string like "CALL_MICROFLOW Module.Flow" or "SHOW_PAGE Module.Page".
+// Returns a formatted string like "call microflow Module.Flow" or "show page Module.Page".
 func extractCustomWidgetPropertyAction(ctx *ExecContext, w map[string]any, propertyKey string) string {
 	obj, ok := w["Object"].(map[string]any)
 	if !ok {
@@ -1393,19 +1393,19 @@ func extractCustomWidgetPropertyAction(ctx *ExecContext, w map[string]any, prope
 		case "Forms$MicroflowAction", "Pages$MicroflowClientAction":
 			if settings, ok := action["MicroflowSettings"].(map[string]any); ok {
 				if mf := extractString(settings["Microflow"]); mf != "" {
-					return "microflow " + mf
+					return "call microflow " + mf
 				}
 			}
 		case "Forms$CallNanoflowClientAction", "Pages$CallNanoflowClientAction":
 			if settings, ok := action["NanoflowSettings"].(map[string]any); ok {
 				if nf := extractString(settings["Nanoflow"]); nf != "" {
-					return "nanoflow " + nf
+					return "call nanoflow " + nf
 				}
 			}
 		case "Forms$FormAction", "Pages$FormAction":
 			if settings, ok := action["PageSettings"].(map[string]any); ok {
 				if page := extractString(settings["Page"]); page != "" {
-					return "show_page " + page
+					return "show page " + page
 				}
 			}
 		case "Forms$NoAction", "Pages$NoAction":
diff --git a/mdl/executor/cmd_pages_open_link_dynamic_test.go b/mdl/executor/cmd_pages_open_link_dynamic_test.go
index 95a887b30c..167f28fb79 100644
--- a/mdl/executor/cmd_pages_open_link_dynamic_test.go
+++ b/mdl/executor/cmd_pages_open_link_dynamic_test.go
@@ -73,7 +73,7 @@ func TestRenderClientActionMDL_OpenLinkDynamicAddress(t *testing.T) {
 		},
 		"LinkType": "Web",
 	}
-	if got, want := renderClientActionMDL(ctx, action), "open_link $currentObject/URL"; got != want {
+	if got, want := renderClientActionMDL(ctx, action), "open link $currentObject/URL"; got != want {
 		t.Errorf("renderClientActionMDL = %q, want %q", got, want)
 	}
 
diff --git a/mdl/executor/cmd_pages_showpage_args.go b/mdl/executor/cmd_pages_showpage_args.go
index 847825d507..38f59a2361 100644
--- a/mdl/executor/cmd_pages_showpage_args.go
+++ b/mdl/executor/cmd_pages_showpage_args.go
@@ -236,7 +236,7 @@ func refuseShowPageArgument(widgetName, target, argName, argValue string, c page
 	}
 	if !c.present {
 		return fmt.Sprintf(
-			"show_page %s: argument %s: %s cannot be stored — %s is not inside a data view, list view or grid row, "+
+			"show page %s: argument %s: %s cannot be stored — %s is not inside a data view, list view or grid row, "+
 				"so there is no context object at all, and a widget's page argument is always that object. "+
 				"The page would be opened with no argument, which mxbuild reports as CE1571 \"No argument has been "+
 				"selected for parameter '%s'\". Put the button inside a data widget bound to the object, or call a "+
@@ -244,7 +244,7 @@ func refuseShowPageArgument(widgetName, target, argName, argValue string, c page
 			target, argName, argValue, where, argName)
 	}
 	return fmt.Sprintf(
-		"show_page %s: argument %s: %s cannot be stored — a widget's page argument is always the enclosing context "+
+		"show page %s: argument %s: %s cannot be stored — a widget's page argument is always the enclosing context "+
 			"object, which mxcli records by leaving the mapping empty (an explicit one is rejected as CE0115). "+
 			"Writing %s here would silently open the page with %s instead. Use $currentObject%s, or call a microflow "+
 			"that shows the page with the object you want",
diff --git a/mdl/executor/cmd_published_rest.go b/mdl/executor/cmd_published_rest.go
index 59e561ce5b..ef85174087 100644
--- a/mdl/executor/cmd_published_rest.go
+++ b/mdl/executor/cmd_published_rest.go
@@ -135,7 +135,7 @@ func describePublishedRestService(ctx *ExecContext, name ast.QualifiedName) erro
 						opPath = " " + mdlQuoted(op.Path)
 					}
 					fmt.Fprintf(ctx.Output, "    %s%s%s%s;%s\n",
-						strings.ToUpper(op.HTTPMethod), opPath, mf, deprecated, summary)
+						strings.ToLower(op.HTTPMethod), opPath, mf, deprecated, summary)
 				}
 				fmt.Fprintln(ctx.Output, "  }")
 			}
diff --git a/mdl/executor/cmd_validationrules.go b/mdl/executor/cmd_validationrules.go
index d41573b39c..7a7f1fd310 100644
--- a/mdl/executor/cmd_validationrules.go
+++ b/mdl/executor/cmd_validationrules.go
@@ -165,7 +165,7 @@ func outputEntityValidationRules(ctx *ExecContext, entity *domainmodel.Entity, m
 		}
 
 		feedback := pickTextTranslation(vr.ErrorMessage, lang)
-		fmt.Fprintf(ctx.Output, "\ncreate or modify validation rule for %s\n    %s\n    feedback '%s';\n",
+		fmt.Fprintf(ctx.Output, "\ncreate or modify validation rule for %s\n    %s\n    error message '%s';\n",
 			target, constraint, escapeMDLString(feedback))
 	}
 }
diff --git a/mdl/executor/cmd_workflows.go b/mdl/executor/cmd_workflows.go
index 80b18d9f8f..906e13a835 100644
--- a/mdl/executor/cmd_workflows.go
+++ b/mdl/executor/cmd_workflows.go
@@ -10,6 +10,7 @@ import (
 
 	"github.com/mendixlabs/mxcli/mdl/ast"
 	mdlerrors "github.com/mendixlabs/mxcli/mdl/errors"
+	"github.com/mendixlabs/mxcli/mdl/visitor"
 	"github.com/mendixlabs/mxcli/sdk/workflows"
 )
 
@@ -789,20 +790,8 @@ func formatCallMicroflowTask(a *workflows.CallMicroflowTask, indent string) []st
 		asAndComment += " comment " + mdlQuoted(a.Caption)
 		trailing = ""
 	}
-	if len(a.ParameterMappings) > 0 {
-		var params []string
-		for _, pm := range a.ParameterMappings {
-			paramName := pm.Parameter
-			if idx := strings.LastIndex(paramName, "."); idx >= 0 {
-				paramName = paramName[idx+1:]
-			}
-			params = append(params, fmt.Sprintf("%s = %s", paramName, mdlQuoted(pm.Expression)))
-		}
-		lines = append(lines, fmt.Sprintf("%s%s %s%s with (%s)%s", indent, verb, mf,
-			asAndComment, strings.Join(params, ", "), trailing))
-	} else {
-		lines = append(lines, fmt.Sprintf("%s%s %s%s%s", indent, verb, mf, asAndComment, trailing))
-	}
+	args, legacy := workflowCallArguments(a.ParameterMappings)
+	lines = append(lines, fmt.Sprintf("%s%s %s%s%s%s%s", indent, verb, mf, args, asAndComment, legacy, trailing))
 
 	// Outcomes, then boundary events — the order the grammar requires
 	// (workflowCallMicroflowStmt: … OUTCOMES? BOUNDARY EVENT?). Emitting them
@@ -860,21 +849,9 @@ func formatCallWorkflowActivity(a *workflows.CallWorkflowActivity, indent string
 		wf = "?"
 	}
 
-	if len(a.ParameterMappings) > 0 {
-		var params []string
-		for _, pm := range a.ParameterMappings {
-			paramName := pm.Parameter
-			if idx := strings.LastIndex(paramName, "."); idx >= 0 {
-				paramName = paramName[idx+1:]
-			}
-			params = append(params, fmt.Sprintf("%s = %s", paramName, mdlQuoted(pm.Expression)))
-		}
-		lines = append(lines, fmt.Sprintf("%scall workflow %s%s comment %s with (%s)", indent, wf,
-			workflowActivityAsClause(a.Name, shortDocName(wf)), mdlQuoted(caption), strings.Join(params, ", ")))
-	} else {
-		lines = append(lines, fmt.Sprintf("%scall workflow %s%s comment %s", indent, wf,
-			workflowActivityAsClause(a.Name, shortDocName(wf)), mdlQuoted(caption)))
-	}
+	args, legacy := workflowCallArguments(a.ParameterMappings)
+	lines = append(lines, fmt.Sprintf("%scall workflow %s%s%s comment %s%s", indent, wf, args,
+		workflowActivityAsClause(a.Name, shortDocName(wf)), mdlQuoted(caption), legacy))
 
 	// BoundaryEvents
 	lines = append(lines, formatBoundaryEvents(a.BoundaryEvents, indent+"  ")...)
@@ -992,6 +969,9 @@ func formatConditionOutcomes(outcomes []workflows.ConditionOutcome, indent strin
 	lines = append(lines, fmt.Sprintf("%s  outcomes", indent))
 	for _, outcome := range outcomes {
 		name := outcome.GetName()
+		if _, ok := outcome.(*workflows.VoidConditionOutcome); ok {
+			name = "default" // a keyword: lowercase is canonical (R8)
+		}
 		flow := outcome.GetFlow()
 		if flow != nil && len(flow.Activities) > 0 {
 			lines = append(lines, fmt.Sprintf("%s    %s -> {", indent, name))
@@ -1005,3 +985,42 @@ func formatConditionOutcomes(outcomes []workflows.ConditionOutcome, indent strin
 
 	return lines
 }
+
+// workflowCallArguments renders a workflow call's parameter mappings in R4's
+// argument form, `(Param = expression)` right after the callee
+// (ako/mxcli#751).
+//
+// A stored expression that does not read back as itself when written bare —
+// one with surrounding whitespace, or text the MDL expression grammar cannot
+// parse — is rendered in the deprecated string form instead, returned as
+// legacy (` with (Param = '<expression>')`, written after the comment): the
+// string carries it byte for byte, and describe must never alter a stored
+// expression. All mappings take the same form, since a call has one list.
+func workflowCallArguments(mappings []*workflows.ParameterMapping) (args, legacy string) {
+	if len(mappings) == 0 {
+		return "", ""
+	}
+	bare := true
+	for _, pm := range mappings {
+		if !visitor.BareExpression(pm.Expression) {
+			bare = false
+			break
+		}
+	}
+	parts := make([]string, 0, len(mappings))
+	for _, pm := range mappings {
+		name := pm.Parameter
+		if idx := strings.LastIndex(name, "."); idx >= 0 {
+			name = name[idx+1:]
+		}
+		if bare {
+			parts = append(parts, visitor.ParameterNameSpelling(name)+" = "+pm.Expression)
+		} else {
+			parts = append(parts, name+" = "+mdlQuoted(pm.Expression))
+		}
+	}
+	if bare {
+		return "(" + strings.Join(parts, ", ") + ")", ""
+	}
+	return "", " with (" + strings.Join(parts, ", ") + ")"
+}
diff --git a/mdl/executor/describe_argument_binding_test.go b/mdl/executor/describe_argument_binding_test.go
new file mode 100644
index 0000000000..233097c261
--- /dev/null
+++ b/mdl/executor/describe_argument_binding_test.go
@@ -0,0 +1,119 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package executor
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/visitor"
+	"github.com/mendixlabs/mxcli/model"
+	"github.com/mendixlabs/mxcli/sdk/microflows"
+	"github.com/mendixlabs/mxcli/sdk/workflows"
+)
+
+// ako/mxcli#751 (R4): describe binds every argument as `Param = expression`
+// and every text-template parameter as `with ({n} = expression)`. Each line
+// must also parse back with no deprecation recorded.
+
+func assertCanonicalMicroflowLine(t *testing.T, line string) {
+	t.Helper()
+	prog, errs := visitor.Build("create microflow M.F ($O: M.E, $N: String) begin " + line + " end;")
+	if len(errs) > 0 {
+		t.Fatalf("%q does not parse: %v", line, errs[0])
+	}
+	if len(prog.Deprecations) > 0 {
+		t.Errorf("%q records %s", line, prog.Deprecations[0].Code)
+	}
+}
+
+func TestDescribe_ShowMessageTemplateArguments(t *testing.T) {
+	e := newTestExecutor()
+	action := &microflows.ShowMessageAction{
+		Type:               microflows.MessageTypeWarning,
+		Template:           &model.Text{Translations: map[string]string{"en_US": "Hi {1} {2}"}},
+		TemplateParameters: []string{"$N", "$O/Name"},
+		Blocking:           true,
+	}
+	got := e.formatAction(action, nil, nil)
+	want := "show message 'Hi {1} {2}' type Warning with ({1} = $N, {2} = $O/Name) blocking;"
+	if got != want {
+		t.Errorf("got %q, want %q", got, want)
+	}
+	assertCanonicalMicroflowLine(t, got)
+}
+
+// Describe used to drop a validation feedback's template arguments altogether,
+// so describe -> exec lost them.
+func TestDescribe_ValidationFeedbackTemplateArguments(t *testing.T) {
+	e := newTestExecutor()
+	action := &microflows.ValidationFeedbackAction{
+		ObjectVariable:     "O",
+		AttributeName:      "M.E.Name",
+		Template:           &model.Text{Translations: map[string]string{"en_US": "{1} is wrong"}},
+		TemplateParameters: []string{"$N"},
+	}
+	got := e.formatAction(action, nil, nil)
+	want := "validation feedback $O/Name message '{1} is wrong' with ({1} = $N);"
+	if got != want {
+		t.Errorf("got %q, want %q", got, want)
+	}
+	assertCanonicalMicroflowLine(t, got)
+}
+
+func TestDescribe_SendRestRequestArguments(t *testing.T) {
+	action := &microflows.RestOperationCallAction{
+		Operation:         "M.C.Get",
+		ParameterMappings: []*microflows.RestParameterMapping{{Parameter: "M.C.Get.id", Value: "$N"}},
+	}
+	got := formatRestOperationCallAction(nil, action)
+	if !strings.Contains(got, "with (id = $N)") {
+		t.Errorf("got %q, want the argument as `id = $N`", got)
+	}
+	assertCanonicalMicroflowLine(t, strings.ReplaceAll(got, "\n", " "))
+}
+
+func TestDescribe_WorkflowCallArguments(t *testing.T) {
+	bare := &workflows.CallMicroflowTask{
+		Microflow:         "M.G",
+		ParameterMappings: []*workflows.ParameterMapping{{Parameter: "M.G.Order", Expression: "$WorkflowContext"}},
+	}
+	bare.Name = "act1"
+	bare.Caption = "Go"
+	got := strings.Join(formatSingleActivity(bare, "  "), "\n")
+	if !strings.Contains(got, "call microflow M.G(Order = $WorkflowContext) as act1 comment 'Go'") {
+		t.Errorf("describe = %q", got)
+	}
+	assertCanonicalWorkflowLine(t, got, false)
+
+	// A stored expression the MDL grammar cannot write bare keeps the string
+	// form, which carries it byte for byte.
+	odd := &workflows.CallWorkflowActivity{
+		Workflow:          "M.Sub",
+		ParameterMappings: []*workflows.ParameterMapping{{Parameter: "M.Sub.Order", Expression: "$WorkflowContext\n"}},
+	}
+	odd.Name = "callWorkflow1"
+	odd.Caption = "Sub"
+	got = strings.Join(formatSingleActivity(odd, "  "), "\n")
+	if !strings.Contains(got, "comment 'Sub' with (Order = '") {
+		t.Errorf("describe = %q", got)
+	}
+	prog := assertCanonicalWorkflowLine(t, got, true)
+	cw := prog.Statements[0].(*ast.CreateWorkflowStmt).Activities[0].(*ast.WorkflowCallWorkflowNode)
+	if len(cw.ParameterMappings) != 1 || cw.ParameterMappings[0].Expression != "$WorkflowContext\n" {
+		t.Errorf("re-parsed mappings = %+v, want the stored expression unchanged", cw.ParameterMappings)
+	}
+}
+
+func assertCanonicalWorkflowLine(t *testing.T, line string, legacy bool) *ast.Program {
+	t.Helper()
+	prog, errs := visitor.Build("create workflow M.W parameter $WorkflowContext: M.E begin\n" + line + "\nend workflow;")
+	if len(errs) > 0 {
+		t.Fatalf("%q does not parse: %v", line, errs[0])
+	}
+	if got := len(prog.Deprecations) > 0; got != legacy {
+		t.Errorf("%q: records a deprecation = %v, want %v", line, got, legacy)
+	}
+	return prog
+}
diff --git a/mdl/executor/member_path_after_operator_test.go b/mdl/executor/member_path_after_operator_test.go
new file mode 100644
index 0000000000..abd190d6ea
--- /dev/null
+++ b/mdl/executor/member_path_after_operator_test.go
@@ -0,0 +1,103 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package executor
+
+import (
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/visitor"
+	"github.com/mendixlabs/mxcli/sdk/microflows"
+)
+
+// A member path after a multiplicative operator (`$a/X * $b/Y`) must be stored
+// exactly as written. `/` sits at the same precedence as `*` in the MDL grammar,
+// so the left-associative chain used to become `($a/X * $b) / Y`: the serializer
+// then printed `$b / Y` as division, and a filter's iterator qualification read
+// the stranded `Y` as a bare attribute and wrote `$b / $currentObject/Y`. The
+// build and mx check stayed green; Mendix evaluates a different expression.
+func TestMemberPathAfterMultiplicativeOperatorIsStoredAsWritten(t *testing.T) {
+	const src = `create microflow MyFirstModule.Agg0 ($Feedbacks: List of FeedbackModule.Feedback, $One: FeedbackModule.Feedback)
+returns Integer
+begin
+  $Area = sum($Feedbacks, $currentObject/ScreenWidth * $currentObject/ScreenHeight);
+  $W = filter($Feedbacks, $currentObject/ScreenWidth * $currentObject/ScreenHeight > 3);
+  declare $X Integer = $One/ScreenWidth * $One/ScreenHeight;
+  declare $D Decimal = $One/ScreenWidth div $One/ScreenHeight * $One/Rating;
+  declare $N Integer = 2 * -$One/ScreenWidth;
+  return $Area;
+end;`
+	got := storedExpressions(t, src)
+
+	for _, want := range []string{
+		"sum: $currentObject/ScreenWidth * $currentObject/ScreenHeight",
+		"filter: $currentObject/ScreenWidth * $currentObject/ScreenHeight > 3",
+		"declare X: $One/ScreenWidth * $One/ScreenHeight",
+		// div binds like *; the member path after it is navigation too.
+		"declare D: $One/ScreenWidth div $One/ScreenHeight * $One/Rating",
+		// A unary minus in front of the path keeps the path whole (already
+		// correct before the fix; guards against a regression).
+		"declare N: 2 * -$One/ScreenWidth",
+	} {
+		if !containsString(got, want) {
+			t.Errorf("stored expression %q missing; stored: %q", want, got)
+		}
+	}
+}
+
+// Control: division by a parenthesised expression or a variable is not member
+// navigation and must not be re-associated.
+func TestSlashAfterNonPathIsNotMadeAMemberPath(t *testing.T) {
+	const src = `create microflow MyFirstModule.Agg1 ($One: FeedbackModule.Feedback)
+returns Integer
+begin
+  declare $P Decimal = $One/ScreenWidth * ($One/ScreenHeight) div 2;
+  return 1;
+end;`
+	got := storedExpressions(t, src)
+	want := "declare P: $One/ScreenWidth * ($One/ScreenHeight) div 2"
+	if !containsString(got, want) {
+		t.Errorf("stored expression %q missing; stored: %q", want, got)
+	}
+}
+
+// storedExpressions builds each statement of a microflow through the flow
+// builder and returns the expression strings the actions would store.
+func storedExpressions(t *testing.T, src string) []string {
+	t.Helper()
+	prog, errs := visitor.Build(src)
+	if len(errs) > 0 {
+		t.Fatalf("parse: %v", errs)
+	}
+	mf, ok := prog.Statements[0].(*ast.CreateMicroflowStmt)
+	if !ok {
+		t.Fatalf("expected a CreateMicroflowStmt, got %T", prog.Statements[0])
+	}
+	fb := &flowBuilder{
+		posX: 100, posY: 100, spacing: HorizontalSpacing,
+		varTypes:     map[string]string{"Feedbacks": "List of FeedbackModule.Feedback", "One": "FeedbackModule.Feedback"},
+		declaredVars: map[string]string{},
+		measurer:     &layoutMeasurer{varTypes: map[string]string{"Feedbacks": "List of FeedbackModule.Feedback"}},
+	}
+	for _, stmt := range mf.Body {
+		fb.addStatement(stmt)
+	}
+	var got []string
+	for _, obj := range fb.objects {
+		act, ok := obj.(*microflows.ActionActivity)
+		if !ok {
+			continue
+		}
+		switch a := act.Action.(type) {
+		case *microflows.AggregateListAction:
+			got = append(got, "sum: "+a.Expression)
+		case *microflows.ListOperationAction:
+			if f, ok := a.Operation.(*microflows.FilterOperation); ok {
+				got = append(got, "filter: "+f.Expression)
+			}
+		case *microflows.CreateVariableAction:
+			got = append(got, "declare "+a.VariableName+": "+a.InitialValue)
+		}
+	}
+	return got
+}
diff --git a/mdl/executor/menu_signout_test.go b/mdl/executor/menu_signout_test.go
index 06fc80c948..24bfa1cf78 100644
--- a/mdl/executor/menu_signout_test.go
+++ b/mdl/executor/menu_signout_test.go
@@ -103,11 +103,11 @@ func TestPrintMenuMDL_RendersSignOut(t *testing.T) {
 	}, 0, "CREATE NAVIGATION")
 
 	out := b.String()
-	if !strings.Contains(out, "menu item 'Sign out' sign_out;") {
+	if !strings.Contains(out, "menu item 'Sign out' sign out;") {
 		t.Errorf("describe output does not round-trip the sign-out item:\n%s", out)
 	}
 	// CONTROL: a plain item must not gain an action.
-	if strings.Contains(out, "'Plain' sign_out") {
+	if strings.Contains(out, "'Plain' sign out") {
 		t.Errorf("a plain item was rendered as sign-out:\n%s", out)
 	}
 }
diff --git a/mdl/executor/nanoflow_validation.go b/mdl/executor/nanoflow_validation.go
index 9b80ef7a09..bfee0f9599 100644
--- a/mdl/executor/nanoflow_validation.go
+++ b/mdl/executor/nanoflow_validation.go
@@ -119,7 +119,7 @@ func getErrorHandling(stmt ast.MicroflowStatement) *ast.ErrorHandlingClause {
 	// The eight statements mendixlabs/mxcli#1078 gave an onErrorClause. None is
 	// on the denylist above, so all eight are reachable in a nanoflow — and
 	// without them here their handler BODIES are never walked, so a Java action
-	// or REST call nested inside `declare … on error { … }` would go unreported.
+	// or REST call nested inside `declare … on error begin … end error` would go unreported.
 	case *ast.DeclareStmt:
 		return s.ErrorHandling
 	case *ast.MfSetStmt:
diff --git a/mdl/executor/roundtrip_page_test.go b/mdl/executor/roundtrip_page_test.go
index 720f68c853..601b785f87 100644
--- a/mdl/executor/roundtrip_page_test.go
+++ b/mdl/executor/roundtrip_page_test.go
@@ -597,7 +597,7 @@ func TestRoundtripPage_MicroflowButtonWithParams(t *testing.T) {
 	) {
 		dataview dv (DataSource: $Product) {
 			textbox txt (Label: 'Name', Attribute: Name)
-			actionbutton btnProcess (Caption: 'Process', Action: microflow ` + mfName + `(Product: $Product))
+			actionbutton btnProcess (Caption: 'Process', Action: microflow ` + mfName + `(Product = $Product))
 		}
 	}`
 
@@ -619,8 +619,8 @@ func TestRoundtripPage_MicroflowButtonWithParams(t *testing.T) {
 	if !strings.Contains(output, mfName) {
 		t.Errorf("Expected microflow name '%s' in describe output.\nOutput:\n%s", mfName, output)
 	}
-	if !strings.Contains(output, "Product: $Product") {
-		t.Errorf("Expected 'Product: $Product' parameter mapping in describe output.\nOutput:\n%s", output)
+	if !strings.Contains(output, "Product = $Product") {
+		t.Errorf("Expected 'Product = $Product' parameter mapping in describe output.\nOutput:\n%s", output)
 	}
 
 	t.Logf("Microflow button with params roundtrip successful:\n%s", output)
@@ -670,7 +670,7 @@ func TestRoundtripPage_MicroflowButtonWithCurrentObject(t *testing.T) {
 		datagrid dg (DataSource: database ` + entityName + `) {
 			column colName (Attribute: Name, Caption: 'Name')
 			column colActions (Attribute: Name, Caption: 'Actions', ShowContentAs: customContent) {
-				actionbutton btnProcess (Caption: 'Process', Action: microflow ` + mfName + `(Target: $currentObject))
+				actionbutton btnProcess (Caption: 'Process', Action: microflow ` + mfName + `(Target = $currentObject))
 			}
 		}
 	}`
@@ -702,9 +702,9 @@ func TestRoundtripPage_MicroflowButtonWithCurrentObject(t *testing.T) {
 	// Both forms re-parse here (TARGET is non-reserved, so the unquoted spelling
 	// this test's own input uses is still accepted); what the assertion is for is
 	// the MAPPING surviving the roundtrip, which is independent of the quoting.
-	if !strings.Contains(output, "Target: $currentObject") &&
-		!strings.Contains(output, `"Target": $currentObject`) {
-		t.Errorf("Expected a 'Target: $currentObject' parameter mapping (quoted or not) "+
+	if !strings.Contains(output, "Target = $currentObject") &&
+		!strings.Contains(output, `"Target" = $currentObject`) {
+		t.Errorf("Expected a 'Target = $currentObject' parameter mapping (quoted or not) "+
 			"in describe output.\nOutput:\n%s", output)
 	}
 
diff --git a/mdl/executor/roundtrip_workflow_test.go b/mdl/executor/roundtrip_workflow_test.go
index 85e54ff595..7805430388 100644
--- a/mdl/executor/roundtrip_workflow_test.go
+++ b/mdl/executor/roundtrip_workflow_test.go
@@ -189,7 +189,7 @@ end workflow;`
 		{"boundary interrupting", "boundary event interrupting timer '${PT24H}'"},
 		{"boundary non interrupting", "boundary event non interrupting timer '${PT1H}'"},
 		{"multi user task", "multi user task MultiReviewTask"},
-		{"call microflow with", "call microflow " + mod + ".ScoreCalc with (Score ="},
+		{"call microflow args", "call microflow " + mod + ".ScoreCalc(Score = $WorkflowContext/Score)"},
 		{"outcomes true", "true ->"},
 		{"outcomes false", "false ->"},
 		{"decision", "decision '$WorkflowContext/IsApproved'"},
@@ -420,7 +420,7 @@ end workflow;`
 		t.Fatalf("Failed to describe workflow: %v", err)
 	}
 
-	if !strings.Contains(output, "with (") {
-		t.Errorf("Expected describe output to contain 'with (', got:\n%s", output)
+	if !strings.Contains(output, "SomeMicroflow(Amount = $WorkflowContext/Amount)") {
+		t.Errorf("Expected describe output to bind the argument in R4's form, got:\n%s", output)
 	}
 }
diff --git a/mdl/executor/validate_microflow_error_handling.go b/mdl/executor/validate_microflow_error_handling.go
index 5a59b86855..f63c0b10c5 100644
--- a/mdl/executor/validate_microflow_error_handling.go
+++ b/mdl/executor/validate_microflow_error_handling.go
@@ -89,7 +89,7 @@ func (v *microflowValidator) checkErrorHandlingContinueSupported(stmt ast.Microf
 		fmt.Sprintf("`%s ... on error continue` is not supported — Mendix rejects Continue error handling "+
 			"on a %s with CE6035 \"Error handling type is not supported\"", keyword, activity),
 		fmt.Sprintf("Drop the clause to keep Mendix's default (rollback and abort), or wrap the statement in a "+
-			"custom handler, which %s does accept: `%s ... on error { ... }`. Continue IS supported on "+
+			"custom handler, which %s does accept: `%s ... on error begin ... end error`. Continue IS supported on "+
 			"`retrieve`, `delete` and `call microflow` — measured on 11.14.0.", activity, keyword))
 }
 
diff --git a/mdl/executor/validate_microflow_merge_join.go b/mdl/executor/validate_microflow_merge_join.go
index cb40babfd8..b60cfea061 100644
--- a/mdl/executor/validate_microflow_merge_join.go
+++ b/mdl/executor/validate_microflow_merge_join.go
@@ -81,7 +81,7 @@ func (v *microflowValidator) checkMergeJoinLabels(body []ast.MicroflowStatement)
 			case *ast.WhileStmt:
 				walkInLoop(n.Body)
 			}
-			// An `on error { … }` block is an ordinary body for labels: joining
+			// An `on error begin … end error` block is an ordinary body for labels: joining
 			// out of it into the main path is the case merge/join exists for.
 			if eh := getErrorHandlerBody(s); len(eh) > 0 {
 				walkTop(eh)
diff --git a/mdl/executor/validate_microflow_raise_error.go b/mdl/executor/validate_microflow_raise_error.go
index e99b2a6c5c..0bf2f0c9b9 100644
--- a/mdl/executor/validate_microflow_raise_error.go
+++ b/mdl/executor/validate_microflow_raise_error.go
@@ -38,7 +38,7 @@ import (
 
 // mainFlowRaiseErrors counts the `raise error;` statements reachable on a flow's
 // MAIN path — every RaiseErrorStmt in the body, in branches, splits and loop
-// bodies, but NOT inside an `on error … { … }` handler, where an error event is
+// bodies, but NOT inside an `on error … begin … end error` handler, where an error event is
 // legal and expected.
 //
 // Skipping handler bodies is the whole content of the rule, so the walk cannot
@@ -89,7 +89,7 @@ func (v *microflowValidator) checkRaiseErrorOutsideHandler(body []ast.MicroflowS
 			"one is only legal where an error is in scope. mxbuild rejects it with CE0710 \"The "+
 			"main flow cannot join an error flow or end in an error event\", and Studio Pro will "+
 			"not draw the shape at all.",
-		"Put the `raise error;` inside the `on error { … }` handler of the activity whose failure "+
+		"Put the `raise error;` inside the `on error begin … end error` handler of the activity whose failure "+
 			"you are re-raising. To fail deliberately from the main flow, call a Java action that "+
 			"throws — Mendix has no main-flow \"throw\" activity.")
 }
diff --git a/mdl/executor/validate_page_button_context.go b/mdl/executor/validate_page_button_context.go
index 2c302a3fb7..5e1df31e16 100644
--- a/mdl/executor/validate_page_button_context.go
+++ b/mdl/executor/validate_page_button_context.go
@@ -94,7 +94,7 @@ func controlBarSuggestion(controlBarOf string) string {
 		return "Move the button into a grid column (row-scoped) so it has a current row, or pass a page parameter instead of $currentObject."
 	}
 	return fmt.Sprintf(
-		"Pass the selection of `%s` instead — `Action: microflow M.F($Param = $%s)`, with `Selection:` set on the widget. "+
+		"Pass the selection of `%s` instead — `Action: microflow M.F(Param = $%s)`, with `Selection:` set on the widget. "+
 			"Or move the button into a grid column (row-scoped) so it has a current row, or pass a page parameter.",
 		controlBarOf, controlBarOf)
 }
diff --git a/mdl/executor/validate_widget_action_slot.go b/mdl/executor/validate_widget_action_slot.go
index f20166172b..e355df433c 100644
--- a/mdl/executor/validate_widget_action_slot.go
+++ b/mdl/executor/validate_widget_action_slot.go
@@ -55,12 +55,13 @@ var actionSlotKeys = []string{"Action", "OnClick", "OnChange"}
 // can name the one token the author left out rather than printing the whole
 // grammar. Keyed lowercase; looked up case-insensitively.
 var underSpecified = map[string]string{
-	"open_link":     "a URL — `Action: OPEN_LINK 'https://example.com'`, or an attribute holding one — `Action: OPEN_LINK $currentObject/URL`",
-	"complete_task": "an outcome name — `Action: COMPLETE_TASK 'Approved'`",
-	"show_page":     "a page — `Action: SHOW_PAGE Module.Page`",
-	"create_object": "an entity — `Action: CREATE_OBJECT Module.Entity`",
-	"microflow":     "a microflow — `Action: MICROFLOW Module.Flow`",
-	"nanoflow":      "a nanoflow — `Action: NANOFLOW Module.Flow`",
+	"open_link":     "a URL — `Action: open link 'https://example.com'`, or an attribute holding one — `Action: open link $currentObject/URL`",
+	"complete_task": "an outcome name — `Action: complete task 'Approved'`",
+	"complete task": "an outcome name — `Action: complete task 'Approved'`",
+	"show_page":     "a page — `Action: show page Module.Page`",
+	"create_object": "an entity — `Action: create object Module.Entity`",
+	"microflow":     "a microflow — `Action: call microflow Module.Flow`",
+	"nanoflow":      "a nanoflow — `Action: call nanoflow Module.Flow`",
 }
 
 // validateWidgetActionSlot reports (MDL-WIDGET28) an action slot whose value is
@@ -120,12 +121,12 @@ func renderActionSlotValue(raw any) string {
 // page.action`" buries the answer they were one token away from.
 func actionSlotSuggestion(raw any) string {
 	if s, ok := raw.(string); ok {
-		if missing, known := underSpecified[strings.ToLower(strings.TrimSpace(s))]; known {
+		if missing, known := underSpecified[strings.ToLower(strings.Join(strings.Fields(s), " "))]; known {
 			return fmt.Sprintf("`%s` is a real action but takes %s.", s, missing)
 		}
 	}
-	return "Use an action expression — SAVE_CHANGES, CANCEL_CHANGES, CLOSE_PAGE, DELETE_OBJECT, " +
-		"SIGN_OUT, SHOW_PAGE Module.Page, MICROFLOW Module.Flow, NANOFLOW Module.Flow, " +
-		"OPEN_LINK 'url', COMPLETE_TASK 'Outcome', CREATE_OBJECT Module.Entity — " +
+	return "Use an action expression — save changes, cancel changes, close page, delete, " +
+		"sign out, show page Module.Page, call microflow Module.Flow, call nanoflow Module.Flow, " +
+		"open link 'url', complete task 'Outcome', create object Module.Entity — " +
 		"or `NOTHING` if the widget is meant to do nothing. See `mxcli syntax page.action`."
 }
diff --git a/mdl/executor/validate_widget_action_slot_test.go b/mdl/executor/validate_widget_action_slot_test.go
index fad28a94cf..21d8090f3c 100644
--- a/mdl/executor/validate_widget_action_slot_test.go
+++ b/mdl/executor/validate_widget_action_slot_test.go
@@ -129,12 +129,15 @@ func TestActionSlot_RealActionsStayClean(t *testing.T) {
 // table because the map behind it is the kind of list that rots silently.
 func TestActionSlot_EachKeywordNamesWhatItIsMissing(t *testing.T) {
 	for _, tt := range []struct{ value, want string }{
-		{"OPEN_LINK", "https://example.com"},
-		{"COMPLETE_TASK", "COMPLETE_TASK 'Approved'"},
-		{"SHOW_PAGE", "SHOW_PAGE Module.Page"},
-		{"CREATE_OBJECT", "CREATE_OBJECT Module.Entity"},
-		{"microflow", "MICROFLOW Module.Flow"},
-		{"nanoflow", "NANOFLOW Module.Flow"},
+		// The suggestion teaches the canonical words (R8, ako/mxcli#752), not
+		// the deprecated snake-case spelling the author happened to write.
+		{"OPEN_LINK", "open link 'https://example.com'"},
+		{"COMPLETE_TASK", "complete task 'Approved'"},
+		{"complete task", "complete task 'Approved'"},
+		{"SHOW_PAGE", "show page Module.Page"},
+		{"CREATE_OBJECT", "create object Module.Entity"},
+		{"microflow", "call microflow Module.Flow"},
+		{"nanoflow", "call nanoflow Module.Flow"},
 	} {
 		got := widget28(t, page28(fmt.Sprintf(`actionbutton b (Caption: 'x', Action: %s)`, tt.value)))
 		if len(got) != 1 {
@@ -228,3 +231,22 @@ func TestActionSlot_NoActionPropertyIsSilent(t *testing.T) {
 		t.Errorf("got %d violations on a widget with no action slot: %+v", len(got), got)
 	}
 }
+
+// The vocabulary an invented value is pointed at is the canonical one: no
+// deprecated snake-case spelling (R8, ako/mxcli#752).
+func TestActionSlot_VocabularyUsesCanonicalWords(t *testing.T) {
+	got := widget28(t, page28(`actionbutton b (Caption: 'x', Action: TOTALLY_MADE_UP)`))
+	if len(got) != 1 {
+		t.Fatalf("got %d violations, want 1: %+v", len(got), got)
+	}
+	for _, old := range []string{"SAVE_CHANGES", "SHOW_PAGE", "OPEN_LINK", "SIGN_OUT", "CREATE_OBJECT", "DELETE_OBJECT", "COMPLETE_TASK", "CLOSE_PAGE"} {
+		if strings.Contains(strings.ToUpper(got[0].Suggestion), old) {
+			t.Errorf("suggestion teaches the deprecated %s:\n%s", old, got[0].Suggestion)
+		}
+	}
+	for _, want := range []string{"save changes", "show page Module.Page", "call microflow Module.Flow"} {
+		if !strings.Contains(got[0].Suggestion, want) {
+			t.Errorf("suggestion must contain %q:\n%s", want, got[0].Suggestion)
+		}
+	}
+}
diff --git a/mdl/executor/validate_workflow_agent_test.go b/mdl/executor/validate_workflow_agent_test.go
index 29212425eb..4dd88be41f 100644
--- a/mdl/executor/validate_workflow_agent_test.go
+++ b/mdl/executor/validate_workflow_agent_test.go
@@ -77,7 +77,7 @@ func TestWorkflowAgentTask_DescribeRoundTrips(t *testing.T) {
 	out := strings.Join(formatSingleActivity(task, "  "), "\n")
 	// The caption is authored (not the microflow's name), so it is described as a
 	// comment clause, which re-executes into the caption.
-	if !strings.Contains(out, "call agent microflow workflow.InvokeAgent as aiAgentTask1 comment 'AI Agent Task' with (workfow1context = '$WorkflowContext')") {
+	if !strings.Contains(out, "call agent microflow workflow.InvokeAgent(workfow1context = $WorkflowContext) as aiAgentTask1 comment 'AI Agent Task'") {
 		t.Fatalf("describe = %q", out)
 	}
 	stmt := parseWorkflowStmt(t, "create workflow M.W\nbegin\n"+out+"\nend workflow;")
diff --git a/mdl/executor/widget_named_action_slot.go b/mdl/executor/widget_named_action_slot.go
index f23aef9333..0ef165e955 100644
--- a/mdl/executor/widget_named_action_slot.go
+++ b/mdl/executor/widget_named_action_slot.go
@@ -65,7 +65,7 @@ func actionFromFlowDataSource(ds *ast.DataSourceV3, propertyKey string) (*ast.Ac
 		return nil, mdlerrors.NewValidationf(
 			"property %q is an action slot and cannot hold a %s data source — "+
 				"write a microflow, nanoflow or one of the client actions "+
-				"(show_page, save_changes, close_page, …)",
+				"(show page, save changes, close page, …)",
 			propertyKey, ds.Type)
 	}
 }
diff --git a/mdl/exprcheck/hints/registry.go b/mdl/exprcheck/hints/registry.go
index 9f4ff6ece9..00639e7654 100644
--- a/mdl/exprcheck/hints/registry.go
+++ b/mdl/exprcheck/hints/registry.go
@@ -60,8 +60,8 @@ var Registry = &registry{byCode: map[string]Entry{
 				Note:  "IF condition",
 			},
 			{
-				Wrong: "CALL Mf($Status = 'Validated')",
-				Right: "CALL Mf($Status = FraudDetection.AlertStatus.Validated)",
+				Wrong: "CALL Mf(Status = 'Validated')",
+				Right: "CALL Mf(Status = FraudDetection.AlertStatus.Validated)",
 				Note:  "CALL parameter",
 			},
 		},
diff --git a/mdl/formatter/format.go b/mdl/formatter/format.go
index dda52fca05..e7828cbda5 100644
--- a/mdl/formatter/format.go
+++ b/mdl/formatter/format.go
@@ -1,69 +1,55 @@
 // SPDX-License-Identifier: Apache-2.0
 
-// Package formatter provides heuristic MDL code formatting.
+// Package formatter provides MDL code formatting.
 package formatter
 
 import (
+	"sort"
 	"strings"
-)
-
-// mdlKeywords are MDL/SQL keywords that should be uppercased.
-var mdlKeywords = []string{
-	"CREATE", "OR", "MODIFY", "REPLACE", "DROP", "ALTER", "SHOW", "DESCRIBE",
-	"ENTITY", "ASSOCIATION", "ENUMERATION", "CONSTANT", "MODULE", "MICROFLOW",
-	"NANOFLOW", "PAGE", "SNIPPET", "LAYOUT", "WORKFLOW", "INDEX",
-	"ATTRIBUTE", "FROM", "TO", "TYPE", "DEFAULT", "OWNER",
-	"PERSISTENT", "NON_PERSISTENT", "SYSTEM_MEMBER", "STORED_VALUE", "CALCULATED",
-	"REQUIRED", "UNIQUE", "INDEXED",
-	"BEGIN", "END", "IF", "THEN", "ELSE", "LOOP", "IN", "RETURN",
-	"RETRIEVE", "WHERE", "LIMIT", "FIRST", "LIST", "OF",
-	"CHANGE", "DELETE", "COMMIT", "ROLLBACK", "DOWNLOAD", "BROWSER",
-	"SHOW_PAGE", "CLOSE_PAGE", "SHOW_MESSAGE",
-	"PARAMETER", "PARAMETERS", "VARIABLE", "DECLARE",
-	"JAVA_ACTION", "CALL", "CALL_MICROFLOW", "CALL_NANOFLOW",
-	"LOG_MESSAGE", "LEVEL", "MESSAGE", "NODE",
-	"ONE_TO_MANY", "MANY_TO_MANY", "ONE_TO_ONE", "REFERENCE", "REFERENCE_SET",
-	"EXPOSED", "CLIENT", "COMMENT", "FOLDER",
-	"ON_DELETE", "PREVENT", "CASCADE",
-	"GRANT", "REVOKE", "ACCESS", "ALLOW", "DENY",
-	"NOT", "AND", "NULL", "EMPTY", "TRUE", "FALSE",
-	"SET", "INSERT", "BEFORE", "AFTER", "REPLACE",
-	"BOOLEAN", "INTEGER", "LONG", "DECIMAL", "STRING", "DATETIME", "BINARY",
-	"AUTO_NUMBER", "HASHED_STRING",
-	"WIDGET", "COLUMN", "ROW", "CONTAINER", "DATAVIEW", "LISTVIEW",
-	"BUTTON", "TEXT", "LABEL", "TITLE", "INPUT", "DROPDOWN", "CHECKBOX",
-	"ENUMERATION_SELECTOR", "REFERENCE_SELECTOR", "DATE_PICKER",
-	"DATA_SOURCE", "DIRECT", "XPATH",
-	"NAVIGATION", "HOME", "MENU", "ITEM",
-	"ROLE", "ROLES", "USER", "SECURITY", "PASSWORD",
-	"REFRESH", "CATALOG",
-	"SELECT", "AS", "TABLE", "TABLES",
-	"SQL", "CONNECT", "QUERY", "IMPORT", "INTO", "MAP",
-	"MOVE", "IMAGE", "COLLECTION",
-}
 
-// keywordSet for O(1) lookup.
-var keywordSet map[string]string
+	"github.com/mendixlabs/mxcli/mdl/visitor"
+)
 
-func init() {
-	keywordSet = make(map[string]string, len(mdlKeywords))
-	for _, kw := range mdlKeywords {
-		keywordSet[strings.ToUpper(kw)] = kw
+// Format formats MDL source code:
+//   - Lowercase MDL keywords, the canonical case (R8, ako/mxcli#752). Only the
+//     words the parse tree shows are keywords change: a name spelled like a
+//     keyword (`Issue64.User`, an attribute `Title`), a property key
+//     (`Folder:`) and a CamelCase value (`ButtonStyle: Success`) keep the
+//     author's case.
+//   - Normalize indentation to 2 spaces.
+//   - Remove trailing whitespace.
+//   - Normalize blank lines (max 1 consecutive).
+//
+// Text the model stores as written — expressions, XPath, OQL, queries, and
+// string literals or code blocks that span lines — keeps its case and layout,
+// so formatting never changes what a script builds. A script that does not
+// parse keeps its case and is only re-indented.
+func Format(input string) string {
+	spans, ok := visitor.FormatSpans(input)
+	if ok {
+		input = visitor.LowercaseKeywords(input, spans.Keywords)
 	}
-}
+	inside := verbatimIndex(spans.Verbatim)
 
-// Format applies heuristic formatting to MDL source code:
-// - Uppercase MDL keywords
-// - Normalize indentation to 2 spaces
-// - Remove trailing whitespace
-// - Normalize blank lines (max 1 consecutive)
-func Format(input string) string {
 	lines := strings.Split(input, "\n")
 	var result []string
 	prevBlank := false
+	offset := 0 // rune offset of the current line's start
 
 	for _, line := range lines {
-		trimmed := strings.TrimRight(line, " \t\r")
+		start, end := offset, offset+len([]rune(line)) // end: the '\n' after the line
+		offset = end + 1
+
+		// A line that starts inside verbatim text is part of that text.
+		if inside(start) {
+			result = append(result, line)
+			prevBlank = false
+			continue
+		}
+		trimmed := line
+		if !inside(end) {
+			trimmed = strings.TrimRight(line, " \t\r")
+		}
 
 		// Collapse multiple blank lines
 		if trimmed == "" {
@@ -80,23 +66,17 @@ func Format(input string) string {
 		// Count effective indent (tabs = 2 spaces)
 		indent := 0
 		for _, ch := range trimmed {
-			switch ch {
-			case ' ':
+			if ch == ' ' {
 				indent++
-			case '\t':
+			} else if ch == '\t' {
 				indent += 2
-			default:
-				goto indentDone
+			} else {
+				break
 			}
 		}
-	indentDone:
 		// Round to nearest 2-space unit
-		indentLevel := indent / 2
-		normalizedIndent := strings.Repeat("  ", indentLevel)
-
-		// Uppercase keywords (but not inside quoted strings)
-		formatted := uppercaseKeywords(stripped)
-		result = append(result, normalizedIndent+formatted)
+		normalizedIndent := strings.Repeat("  ", indent/2)
+		result = append(result, normalizedIndent+stripped)
 	}
 
 	// Remove trailing blank line
@@ -107,77 +87,20 @@ func Format(input string) string {
 	return strings.Join(result, "\n") + "\n"
 }
 
-// uppercaseKeywords uppercases MDL keywords while preserving quoted strings.
-func uppercaseKeywords(line string) string {
-	// Track whether we're inside a string literal
-	var result strings.Builder
-	inString := false
-	i := 0
-	runes := []rune(line)
-
-	for i < len(runes) {
-		ch := runes[i]
-
-		if ch == '\'' {
-			// Toggle string mode, handle escaped quotes ('')
-			result.WriteRune(ch)
-			i++
-			inString = !inString
-			continue
-		}
-
-		if inString {
-			result.WriteRune(ch)
-			i++
-			continue
-		}
-
-		// Check for line comment (--)
-		if ch == '-' && i+1 < len(runes) && runes[i+1] == '-' {
-			// Rest of line is comment, write as-is
-			for i < len(runes) {
-				result.WriteRune(runes[i])
-				i++
-			}
-			continue
-		}
-
-		// Check for block comment start
-		if ch == '/' && i+1 < len(runes) && runes[i+1] == '*' {
-			// Write rest as-is (simplification: assume comment ends on same line or later)
-			for i < len(runes) {
-				result.WriteRune(runes[i])
-				i++
-			}
-			continue
-		}
-
-		// Try to match a word
-		if isWordStart(ch) {
-			wordStart := i
-			for i < len(runes) && isWordChar(runes[i]) {
-				i++
+// verbatimIndex returns whether a rune offset lies strictly inside one of the
+// spans: after its first rune and before its end.
+func verbatimIndex(spans [][2]int) func(int) bool {
+	sorted := append([][2]int(nil), spans...)
+	sort.Slice(sorted, func(i, j int) bool { return sorted[i][0] < sorted[j][0] })
+	return func(off int) bool {
+		for _, s := range sorted {
+			if s[0] >= off {
+				return false
 			}
-			word := string(runes[wordStart:i])
-			if _, ok := keywordSet[strings.ToUpper(word)]; ok {
-				result.WriteString(strings.ToUpper(word))
-			} else {
-				result.WriteString(word)
+			if off < s[1] {
+				return true
 			}
-			continue
 		}
-
-		result.WriteRune(ch)
-		i++
+		return false
 	}
-
-	return result.String()
-}
-
-func isWordStart(ch rune) bool {
-	return (ch >= 'a' && ch <= 'z') || (ch >= 'A' && ch <= 'Z') || ch == '_'
-}
-
-func isWordChar(ch rune) bool {
-	return isWordStart(ch) || (ch >= '0' && ch <= '9')
 }
diff --git a/mdl/grammar/MDLLexer.g4 b/mdl/grammar/MDLLexer.g4
index e28cccad7e..26b7ac6c36 100644
--- a/mdl/grammar/MDLLexer.g4
+++ b/mdl/grammar/MDLLexer.g4
@@ -98,7 +98,10 @@ SORT_BY: S O R T WS+ B Y;
 // deliberately: same position, same comma list, so one example teaches both.
 SEARCH_BY: S E A R C H WS+ B Y;
 NON_PERSISTENT: N O N '-' P E R S I S T E N T;
-REFERENCE_SET: R E F E R E N C E '_'? S E T;
+// `ReferenceSet`, the Mendix type name describe writes; `reference_set` is the
+// old second spelling (R8, ako/mxcli#752).
+REFERENCE_SET: R E F E R E N C E S E T
+             | R E F E R E N C E '_' S E T /* @alias MDL-DEPR023 */;
 LIST_OF: L I S T WS+ O F;
 
 // Delete behavior compound keywords
@@ -188,9 +191,12 @@ DELETE_BEHAVIOR: D E L E T E '_'? B E H A V I O R;
 // deleted"). SQL's RESTRICT has no custom message, so this clause is a Mendix
 // extension rather than something borrowed.
 RESTRICT: R E S T R I C T;
+//
+// `error message` is the one spelling (R8, ako/mxcli#752); the other two are
+// aliases, and so are `error`, `feedback` where a rule takes a message.
 ERROR_MESSAGE: E R R O R WS+ M E S S A G E
-             | E R R O R '_' M E S S A G E
-             | E R R O R M E S S A G E;
+             | E R R O R '_' M E S S A G E /* @alias MDL-DEPR021 */
+             | E R R O R M E S S A G E /* @alias MDL-DEPR021 */;
 CASCADE: C A S C A D E;
 PREVENT: P R E V E N T;
 
@@ -506,8 +512,15 @@ TABPAGE: T A B P A G E;
 GROUPBOX: G R O U P B O X;
 VISIBLE: V I S I B L E;
 SAVECHANGES: S A V E C H A N G E S;
-SAVE_CHANGES: S A V E '_' C H A N G E S;
-CANCEL_CHANGES: C A N C E L '_' C H A N G E S;
+// Page actions are the words a microflow uses (R8, ako/mxcli#752). The
+// two-word actions whose words are not tokens of their own are one token that
+// admits both spellings; the snake-case one is the deprecated alias, told
+// apart by its underscore. The rest (show page, close page, create object,
+// open link, call microflow) are token sequences in actionExprV3.
+SAVE_CHANGES: S A V E WS+ C H A N G E S
+            | S A V E '_' C H A N G E S /* @alias MDL-DEPR020 */;
+CANCEL_CHANGES: C A N C E L WS+ C H A N G E S
+              | C A N C E L '_' C H A N G E S /* @alias MDL-DEPR020 */;
 CLOSE_PAGE: C L O S E '_' P A G E;
 SHOW_PAGE: S H O W '_' P A G E;
 DELETE_ACTION: D E L E T E '_' A C T I O N;
@@ -516,7 +529,8 @@ CREATE_OBJECT: C R E A T E '_' O B J E C T;
 CALL_MICROFLOW: C A L L '_' M I C R O F L O W;
 CALL_NANOFLOW: C A L L '_' N A N O F L O W;
 OPEN_LINK: O P E N '_' L I N K;
-SIGN_OUT: S I G N '_' O U T;
+SIGN_OUT: S I G N WS+ O U T
+        | S I G N '_' O U T /* @alias MDL-DEPR020 */;
 CANCEL: C A N C E L;
 
 // Button styles
@@ -908,7 +922,8 @@ LOCK: L O C K;
 UNLOCK: U N L O C K;
 REASON: R E A S O N;
 OPEN: O P E N;
-COMPLETE_TASK: C O M P L E T E '_' T A S K;
+COMPLETE_TASK: C O M P L E T E WS+ T A S K
+             | C O M P L E T E '_' T A S K /* @alias MDL-DEPR020 */;
 
 // =============================================================================
 // COMPARISON OPERATORS (multi-char before single-char)
diff --git a/mdl/grammar/domains/MDLDomainModel.g4 b/mdl/grammar/domains/MDLDomainModel.g4
index 501bae4602..acc7f2f78d 100644
--- a/mdl/grammar/domains/MDLDomainModel.g4
+++ b/mdl/grammar/domains/MDLDomainModel.g4
@@ -79,15 +79,22 @@ attributeName
     ;
 
 attributeConstraint
-    : NOT_NULL (ERROR STRING_LITERAL)?
-    | NOT NULL (ERROR STRING_LITERAL)?
+    : NOT_NULL (constraintErrorKeyword STRING_LITERAL)?
+    | NOT NULL (constraintErrorKeyword STRING_LITERAL)?
     | NULLABLE                              // explicit: clear NOT NULL (MODIFY ATTRIBUTE, Bug 12a)
-    | UNIQUE (ERROR STRING_LITERAL)?
+    | UNIQUE (constraintErrorKeyword STRING_LITERAL)?
     | DEFAULT (literal | expression)
-    | REQUIRED (ERROR STRING_LITERAL)?
+    | REQUIRED (constraintErrorKeyword STRING_LITERAL)?
     | CALCULATED (BY? qualifiedName)?
     ;
 
+// `error message '…'` is the one spelling of a rule's user-facing message
+// (R8, ako/mxcli#752); a bare `error` is the old one.
+constraintErrorKeyword
+    : ERROR_MESSAGE
+    | ERROR /* @alias MDL-DEPR021 */
+    ;
+
 /**
  * Specifies the data type for an attribute.
  */
@@ -185,7 +192,7 @@ associationOption
     : TYPE COLON? (REFERENCE | REFERENCE_SET)
     | OWNER COLON? (DEFAULT | BOTH)
     | STORAGE COLON? (COLUMN | TABLE)
-    | DELETE_BEHAVIOR deleteBehavior errorMessageClause?
+    | DELETE_BEHAVIOR /* @alias MDL-DEPR022 */ deleteBehavior errorMessageClause?
     | onDeleteClause
     | COMMENT STRING_LITERAL
     ;
@@ -297,7 +304,7 @@ ifExists
     ;
 
 alterAssociationAction
-    : SET DELETE_BEHAVIOR deleteBehavior errorMessageClause?
+    : SET DELETE_BEHAVIOR /* @alias MDL-DEPR022 */ deleteBehavior errorMessageClause?
     | SET onDeleteClause
     | SET OWNER (DEFAULT | BOTH)
     | SET STORAGE (COLUMN | TABLE)
@@ -908,7 +915,7 @@ exportMappingChild
 createValidationRuleStatement
     : VALIDATION RULE FOR qualifiedName
       validationRuleConstraint
-      FEEDBACK STRING_LITERAL
+      (ERROR_MESSAGE | FEEDBACK /* @alias MDL-DEPR021 */) STRING_LITERAL
     ;
 
 validationRuleConstraint
diff --git a/mdl/grammar/domains/MDLMicroflow.g4 b/mdl/grammar/domains/MDLMicroflow.g4
index ff5a0c63a7..88f5d00f45 100644
--- a/mdl/grammar/domains/MDLMicroflow.g4
+++ b/mdl/grammar/domains/MDLMicroflow.g4
@@ -209,7 +209,8 @@ microflowConcurrencyClause
 
 // ERROR_MESSAGE is one token, not ERROR + MESSAGE — it already exists for an
 // association's delete behaviour, and re-splitting it here would make the lexer
-// ambiguous. It accepts `error message`, `error_message` and `errormessage`.
+// ambiguous. `error message` is its spelling; `error_message` and
+// `errormessage` still lex as deprecated aliases (MDL-DEPR021).
 microflowConcurrencyError
     : ERROR_MESSAGE STRING_LITERAL
     | ERROR MICROFLOW qualifiedName
@@ -444,12 +445,16 @@ retrieveSource
     | DATABASE STRING_LITERAL                // External DB
     ;
 
-// ON ERROR clause for microflow error handling
+// ON ERROR clause for microflow error handling.
+//
+// A custom handler is imperative flow, so it is `begin … end error` like every
+// other flow block (R2, ako/mxcli#754). The brace form is its deprecated
+// spelling: braces hold declarative children.
 onErrorClause
     : ON ERROR CONTINUE                                    // Ignore error, continue
     | ON ERROR ROLLBACK                                    // Rollback and abort (default)
-    | ON ERROR LBRACE microflowBody RBRACE                 // Custom error handler with rollback
-    | ON ERROR WITHOUT ROLLBACK LBRACE microflowBody RBRACE // Custom error handler without rollback
+    | ON ERROR (WITHOUT ROLLBACK)? BEGIN microflowBody END ERROR // Custom error handler
+    | ON ERROR (WITHOUT ROLLBACK)? LBRACE microflowBody RBRACE /* @alias MDL-DEPR540 */
     ;
 
 // IF ... THEN ... END IF;
@@ -471,6 +476,10 @@ loopStatement
       BEGIN microflowBody END LOOP
     ;
 
+// WHILE condition BEGIN ... END WHILE;
+//
+// `begin` and the `while` after `end` stay optional here so a headerless script
+// parses as before; under `mdl 1` the visitor requires both (MDL-V1-WHILE).
 whileStatement
     : WHILE expression
       BEGIN? microflowBody END WHILE?
@@ -526,7 +535,7 @@ logLevel
 // Template parameters: WITH ({1} = expr, {2} = expr) or PARAMETERS [expr, expr]
 templateParams
     : WITH LPAREN templateParam (COMMA templateParam)* RPAREN    // WITH ({1} = $var)
-    | PARAMETERS arrayLiteral                                     // PARAMETERS ['val'] (deprecated)
+    | PARAMETERS /* @alias MDL-DEPR009 */ arrayLiteral            // PARAMETERS ['val'] (deprecated)
     ;
 
 templateParam
@@ -686,9 +695,11 @@ callArgumentList
     : callArgument (COMMA callArgument)*
     ;
 
-// Named arguments: $FirstName = 'Hello' or Level = 'INFO' or OqlStatement = '...'
+// Named arguments: FirstName = 'Hello' or Level = 'INFO' or OqlStatement = '...'
+// (R4: `Param = expression`, no `$` on the parameter name). `$FirstName = …` is
+// the deprecated spelling of the same argument.
 callArgument
-    : (VARIABLE | parameterName) EQUALS expression
+    : (VARIABLE /* @alias MDL-DEPR006 */ | parameterName) EQUALS expression
     ;
 
 showPageStatement
@@ -699,9 +710,12 @@ showPageArgList
     : showPageArg (COMMA showPageArg)*
     ;
 
+// R4: `Param = expression`, the argument form of every call site. `$Param = …`
+// and `Param: …` are deprecated spellings of the same argument.
 showPageArg
-    : VARIABLE EQUALS (VARIABLE | expression)       // $Param = $value (canonical)
-    | identifierOrKeyword COLON expression           // Param: $value (widget-style, also accepted)
+    : parameterName EQUALS expression                                  // Param = $value (canonical)
+    | VARIABLE /* @alias MDL-DEPR006 */ EQUALS (VARIABLE | expression) // $Param = $value
+    | identifierOrKeyword COLON /* @alias MDL-DEPR007 */ expression    // Param: $value
     ;
 
 closePageStatement
@@ -712,15 +726,18 @@ showHomePageStatement
     : SHOW HOME PAGE
     ;
 
-// SHOW MESSAGE 'Hello {1}' TYPE Information OBJECTS [$Name];
+// SHOW MESSAGE 'Hello {1}' TYPE Information WITH ({1} = $Name);
+// `OBJECTS [$Name]` is the deprecated positional spelling of the same list.
 showMessageStatement
-    : SHOW MESSAGE expression (TYPE identifierOrKeyword)? (OBJECTS LBRACKET expressionList RBRACKET)? BLOCKING? onErrorClause?
+    : SHOW MESSAGE expression (TYPE identifierOrKeyword)?
+      (OBJECTS /* @alias MDL-DEPR009 */ LBRACKET expressionList RBRACKET | templateParams)?
+      BLOCKING? onErrorClause?
     ;
 
 // SYNCHRONIZE ALL;
 // SYNCHRONIZE UNSYNCHRONIZED;
 // SYNCHRONIZE $Order, $Lines;              -- Specific mode
-// SYNCHRONIZE ALL ON ERROR WITHOUT ROLLBACK { ... };
+// SYNCHRONIZE ALL ON ERROR WITHOUT ROLLBACK BEGIN ... END ERROR;
 //
 // Nanoflow-only: Mendix rejects a synchronize in a microflow, which is
 // server-side. The bare `SYNCHRONIZE;` form is deliberately absent — the mode is
@@ -740,7 +757,8 @@ throwStatement
 
 // VALIDATION FEEDBACK $Product/Code MESSAGE 'Product code cannot be empty';
 validationFeedbackStatement
-    : VALIDATION FEEDBACK (attributePath | VARIABLE) MESSAGE expression (OBJECTS LBRACKET expressionList RBRACKET)? onErrorClause?
+    : VALIDATION FEEDBACK (attributePath | VARIABLE) MESSAGE expression
+      (OBJECTS /* @alias MDL-DEPR009 */ LBRACKET expressionList RBRACKET | templateParams)? onErrorClause?
     ;
 
 // =============================================================================
@@ -808,8 +826,8 @@ restCallReturnsClause
     | RETURNS RESPONSE                                          // Return HttpResponse object
     | RETURNS MAPPING qualifiedName AS LIST_OF qualifiedName    // Import mapping → list result
     | RETURNS MAPPING qualifiedName AS qualifiedName            // Import mapping → single object
-    | RETURNS NONE                                              // Ignore response
-    | RETURNS NOTHING                                           // Ignore response (alias)
+    | RETURNS NOTHING                                           // Ignore response
+    | RETURNS NONE /* @alias MDL-DEPR024 */                     // Ignore response (old second spelling)
     | RETURNS qualifiedName                                     // Store in file document (a System.FileDocument specialization)
     ;
 
@@ -828,7 +846,7 @@ sendRestRequestWithClause
     ;
 
 sendRestRequestParam
-    : VARIABLE EQUALS expression
+    : (VARIABLE /* @alias MDL-DEPR006 */ | parameterName) EQUALS expression
     ;
 
 sendRestRequestBodyClause
diff --git a/mdl/grammar/domains/MDLPage.g4 b/mdl/grammar/domains/MDLPage.g4
index 3052d578b9..e22901c397 100644
--- a/mdl/grammar/domains/MDLPage.g4
+++ b/mdl/grammar/domains/MDLPage.g4
@@ -652,31 +652,52 @@ associationPathV3
 actionExprV3
     : VARIABLE                                        // $handler — a fragment action parameter (see fragmentParam)
     | NOTHING                                         // NOTHING — an explicitly inert widget (Forms$NoAction)
-    | SAVE_CHANGES (CLOSE_PAGE)?                      // SAVE_CHANGES or SAVE_CHANGES CLOSE_PAGE
-    | CANCEL_CHANGES (CLOSE_PAGE)?                    // CANCEL_CHANGES
-    | CLOSE_PAGE                                      // CLOSE_PAGE
-    | DELETE_OBJECT                                   // DELETE_OBJECT
-    | DELETE (CLOSE_PAGE)?                            // DELETE (legacy)
-    | CREATE_OBJECT qualifiedName (THEN actionExprV3)? // CREATE_OBJECT Entity THEN SHOW_PAGE ...
-    | SHOW_PAGE qualifiedName microflowArgsV3?        // SHOW_PAGE Module.Page (Param: val)
-    | MICROFLOW qualifiedName microflowArgsV3?        // MICROFLOW Module.Flow
-    | NANOFLOW qualifiedName microflowArgsV3?         // NANOFLOW Module.Flow
-    | OPEN_LINK STRING_LITERAL                        // OPEN_LINK 'https://...'
-    | OPEN_LINK VARIABLE SLASH attributePathV3        // OPEN_LINK $currentObject/URL (address read from an attribute)
-    | SIGN_OUT                                        // SIGN_OUT
-    | COMPLETE_TASK STRING_LITERAL                    // COMPLETE_TASK 'OutcomeName'
-    ;
-
-// V3 Microflow arguments: (Param: value, ...)
+    | SAVE_CHANGES closePageV3?                       // save changes [close page]
+    | CANCEL_CHANGES closePageV3?                     // cancel changes [close page]
+    | closePageV3                                     // close page
+    | DELETE closePageV3?                             // delete [close page]
+    | DELETE_OBJECT /* @alias MDL-DEPR020 */ closePageV3?
+    | CREATE OBJECT qualifiedName (THEN actionExprV3)? // create object Entity then show page ...
+    | CREATE_OBJECT /* @alias MDL-DEPR020 */ qualifiedName (THEN actionExprV3)?
+    | SHOW PAGE qualifiedName microflowArgsV3?        // show page Module.Page (Param: val)
+    | SHOW_PAGE /* @alias MDL-DEPR020 */ qualifiedName microflowArgsV3?
+    | CALL MICROFLOW qualifiedName microflowArgsV3?   // call microflow Module.Flow
+    | MICROFLOW /* @alias MDL-DEPR020 */ qualifiedName microflowArgsV3?
+    | CALL NANOFLOW qualifiedName microflowArgsV3?    // call nanoflow Module.Flow
+    | NANOFLOW /* @alias MDL-DEPR020 */ qualifiedName microflowArgsV3?
+    | openLinkV3 STRING_LITERAL                       // open link 'https://...'
+    | openLinkV3 VARIABLE SLASH attributePathV3       // open link $currentObject/URL (address read from an attribute)
+    | SIGN_OUT                                        // sign out
+    | COMPLETE_TASK STRING_LITERAL                    // complete task 'OutcomeName'
+    ;
+
+// The page actions are the words a microflow uses (R8, ako/mxcli#752):
+// `show page`, `close page`, `create object`, `call microflow`, `open link`.
+// The snake-case tokens are the deprecated second spellings; `save changes`,
+// `cancel changes`, `sign out` and `complete task` are single lexer tokens that
+// admit both (MDLLexer.g4).
+closePageV3
+    : CLOSE PAGE
+    | CLOSE_PAGE /* @alias MDL-DEPR020 */
+    ;
+
+openLinkV3
+    : OPEN LINK
+    | OPEN_LINK /* @alias MDL-DEPR020 */
+    ;
+
+// V3 Microflow arguments: (Param = value, ...) — R4, the argument form of every
+// call site. `Param: value` and `$Param = value` are deprecated spellings.
 microflowArgsV3
     : LPAREN microflowArgV3 (COMMA microflowArgV3)* RPAREN
     ;
 
 microflowArgV3
-    : identifierOrKeyword COLON expression            // Param: $value (identifierOrKeyword so a param
-                                                      // named after a keyword — View/Source/Item/Page/
-                                                      // Entity — works unquoted, matching callArgument)
-    | VARIABLE EQUALS expression                     // $Param = $value (microflow-style, also accepted)
+    : parameterName EQUALS expression                 // Param = $value (parameterName so a param named
+                                                      // after a keyword — View/Source/Item/Page/Entity —
+                                                      // works unquoted, matching callArgument)
+    | identifierOrKeyword COLON /* @alias MDL-DEPR007 */ expression // Param: $value
+    | VARIABLE /* @alias MDL-DEPR006 */ EQUALS expression           // $Param = $value
     ;
 
 // A value in `Visible: Attr in (…)`: an enumeration value name, true/false,
diff --git a/mdl/grammar/domains/MDLWorkflow.g4 b/mdl/grammar/domains/MDLWorkflow.g4
index a03f3e8336..26706d8060 100644
--- a/mdl/grammar/domains/MDLWorkflow.g4
+++ b/mdl/grammar/domains/MDLWorkflow.g4
@@ -237,19 +237,31 @@ workflowUserTaskOutcome
  * invoked.
  */
 workflowCallMicroflowStmt
-    : CALL AGENT? MICROFLOW qualifiedName (AS workflowActivityName)? (COMMENT STRING_LITERAL)?
-      (WITH LPAREN workflowParameterMapping (COMMA workflowParameterMapping)* RPAREN)?
+    : CALL AGENT? MICROFLOW qualifiedName workflowCallArguments? (AS workflowActivityName)? (COMMENT STRING_LITERAL)?
+      (WITH /* @alias MDL-DEPR008 */ LPAREN workflowParameterMapping (COMMA workflowParameterMapping)* RPAREN)?
       (OUTCOMES workflowConditionOutcome+)?
       (BOUNDARY EVENT workflowBoundaryEventClause ((BOUNDARY EVENT)? workflowBoundaryEventClause)*)?
     ;
 
+// R4: a workflow call binds its arguments like every other call site,
+// `(Param = expression)` right after the callee, the expression bare.
+// `with (Param = '<expression>')`, the expression in a string, is the
+// deprecated spelling of the same mapping.
+workflowCallArguments
+    : LPAREN (workflowCallArgument (COMMA workflowCallArgument)*)? RPAREN
+    ;
+
+workflowCallArgument
+    : parameterName EQUALS expression
+    ;
+
 workflowParameterMapping
     : qualifiedName EQUALS STRING_LITERAL
     ;
 
 workflowCallWorkflowStmt
-    : CALL WORKFLOW qualifiedName (AS workflowActivityName)? (COMMENT STRING_LITERAL)?
-      (WITH LPAREN workflowParameterMapping (COMMA workflowParameterMapping)* RPAREN)?
+    : CALL WORKFLOW qualifiedName workflowCallArguments? (AS workflowActivityName)? (COMMENT STRING_LITERAL)?
+      (WITH /* @alias MDL-DEPR008 */ LPAREN workflowParameterMapping (COMMA workflowParameterMapping)* RPAREN)?
     ;
 
 workflowDecisionStmt
diff --git a/mdl/roundtrip/describe_canonical_spelling_test.go b/mdl/roundtrip/describe_canonical_spelling_test.go
new file mode 100644
index 0000000000..b284a3b0b9
--- /dev/null
+++ b/mdl/roundtrip/describe_canonical_spelling_test.go
@@ -0,0 +1,82 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//go:build integration
+
+package roundtrip
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
+	"github.com/mendixlabs/mxcli/mdl/visitor"
+)
+
+// TestPedAppDescribeUsesCanonicalSpellings holds describe to R8 (#752) and
+// R12: it never emits a registered deprecated spelling (`show_page`,
+// `error_message`, `delete_behavior`, …), and every keyword it writes is
+// already lowercase — `mxcli fmt` over describe output changes no letter.
+func TestPedAppDescribeUsesCanonicalSpellings(t *testing.T) {
+	describeUsesCanonicalSpellings(t, pedApp)
+}
+
+// TestTestAppDescribeUsesCanonicalSpellings is the same over TestApp, whose
+// pages carry every page action (#759).
+func TestTestAppDescribeUsesCanonicalSpellings(t *testing.T) {
+	describeUsesCanonicalSpellings(t, testApp)
+}
+
+func describeUsesCanonicalSpellings(t *testing.T, fx fixture) {
+	h := newFixtureHarness(t, fx)
+	defer h.close()
+
+	checked := 0
+	for _, target := range describeTargets(h) {
+		t.Run(target, func(t *testing.T) {
+			out, err := h.describe(target)
+			if err != nil || strings.TrimSpace(out) == "" {
+				t.Skipf("describe %s: err=%v (judged by TestPedAppRoundTrip)", target, err)
+			}
+			prog, errs := visitor.Build(out)
+			if len(errs) > 0 {
+				t.Skipf("does not parse (judged by TestPedAppDescribeIsValidMdl1): %v", errs[0])
+			}
+			checked++
+			for _, d := range prog.Deprecations {
+				if !r8Codes[d.Code] {
+					continue // the list-operation call forms are #737's (describe keeps them under mdl 0)
+				}
+				t.Errorf("line %d: describe emits the deprecated spelling %s\n--- describe output ---\n%s", d.Line, d.Code, out)
+			}
+			spans, ok := visitor.FormatSpans(out)
+			if !ok {
+				t.Fatalf("FormatSpans refused output that parses")
+			}
+			if lower := visitor.LowercaseKeywords(out, spans.Keywords); lower != out {
+				t.Errorf("describe emits an upper-case keyword:\n%s", firstDifferentLine(out, lower))
+			}
+		})
+	}
+	if checked == 0 {
+		t.Fatal("no describe output was checked — the test proves nothing")
+	}
+}
+
+// r8Codes are the registry codes R8 (#752) owns.
+var r8Codes = map[string]bool{
+	deprecation.PageActionWord:         true,
+	deprecation.ErrorMessageKeyword:    true,
+	deprecation.DeleteBehaviorClause:   true,
+	deprecation.ReferenceSetUnderscore: true,
+	deprecation.ReturnsNone:            true,
+}
+
+func firstDifferentLine(a, b string) string {
+	al, bl := strings.Split(a, "\n"), strings.Split(b, "\n")
+	for i := range al {
+		if i < len(bl) && al[i] != bl[i] {
+			return "  describe: " + al[i] + "\n  canonical: " + bl[i]
+		}
+	}
+	return ""
+}
diff --git a/mdl/roundtrip/describe_terminators_test.go b/mdl/roundtrip/describe_terminators_test.go
index ceb279d3ac..b3ada16635 100644
--- a/mdl/roundtrip/describe_terminators_test.go
+++ b/mdl/roundtrip/describe_terminators_test.go
@@ -37,13 +37,19 @@ func TestPedAppDescribeIsValidMdl1(t *testing.T) {
 			if err != nil || strings.TrimSpace(out) == "" {
 				t.Skipf("describe %s: err=%v (judged by TestPedAppRoundTrip)", target, err)
 			}
-			if _, errs := visitor.Build(out); len(errs) > 0 {
+			prog, errs := visitor.Build(out)
+			if len(errs) > 0 {
 				if hasKnownLaw(target, lawParse) {
 					t.Skipf("does not parse under mdl 0 either (allowlisted): %v", errs[0])
 				}
 				t.Fatalf("describe output does not parse: %v\n%s", errs[0], out)
 			}
 			checked++
+			// describe never emits a deprecated spelling (proposal §6.1).
+			for _, d := range prog.Deprecations {
+				t.Errorf("describe output uses a deprecated spelling, %s at line %d\n--- describe output ---\n%s",
+					d.Code, d.Line, out)
+			}
 			for _, problem := range terminatorProblems(out) {
 				t.Errorf("%s\n--- describe output ---\n%s", problem, out)
 			}
diff --git a/mdl/upgrade/argument_binding_test.go b/mdl/upgrade/argument_binding_test.go
new file mode 100644
index 0000000000..a28683f5fb
--- /dev/null
+++ b/mdl/upgrade/argument_binding_test.go
@@ -0,0 +1,82 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package upgrade
+
+import (
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
+)
+
+// ako/mxcli#751 (R4): fmt --upgrade rewrites every argument to `Param =
+// expression` and every positional text-template list to `with ({n} = …)`,
+// touching nothing else — comments, layout, keyword case and the arguments'
+// own text survive.
+func TestUpgrade_ArgumentBinding(t *testing.T) {
+	src := `create microflow M.F ($O: M.E, $N: String) begin
+  call microflow M.G($Order = $O, Force = false); -- keep me
+  show page M.P(Order: $O);
+  SHOW MESSAGE 'Hi {1} {2}' TYPE Warning OBJECTS [$N, $O/Name] BLOCKING;
+  validation feedback $O/Name message '{1}' objects [ $N ];
+  log info 'x {1}' parameters ['a'];
+  $R = send rest request M.C.Get with ($id = $N);
+end;
+create page M.Q (Title: 'Q', Layout: Atlas_Core.Atlas_Default) {
+  dataview dv (DataSource: $O) {
+    actionbutton b (Caption: 'Go', Action: microflow M.G(Order:$currentObject))
+  }
+};
+create workflow M.W parameter $WorkflowContext: M.E begin
+  call microflow M.G as act1 comment 'Go'
+    with (M.G.Order = '$WorkflowContext');
+end workflow;
+`
+	want := `create microflow M.F ($O: M.E, $N: String) begin
+  call microflow M.G(Order = $O, Force = false); -- keep me
+  show page M.P(Order = $O);
+  SHOW MESSAGE 'Hi {1} {2}' TYPE Warning WITH ({1} = $N, {2} = $O/Name) BLOCKING;
+  validation feedback $O/Name message '{1}' with ( {1} = $N );
+  log info 'x {1}' with ({1} = 'a');
+  $R = send rest request M.C.Get with (id = $N);
+end;
+create page M.Q (Title: 'Q', Layout: Atlas_Core.Atlas_Default) {
+  dataview dv (DataSource: $O) {
+    actionbutton b (Caption: 'Go', Action: call microflow M.G(Order = $currentObject))
+  }
+};
+create workflow M.W parameter $WorkflowContext: M.E begin
+  call microflow M.G(Order = $WorkflowContext) as act1 comment 'Go';
+end workflow;
+`
+	res := mustUpgrade(t, src, Options{})
+	if res.Source != want {
+		t.Fatalf("got:\n%s\nwant:\n%s", res.Source, want)
+	}
+	for code, n := range map[string]int{
+		deprecation.DollarArgumentName:          2,
+		deprecation.ColonArgument:               2,
+		deprecation.WorkflowStringArgument:      1,
+		deprecation.PositionalTemplateArguments: 3,
+	} {
+		if res.Rewritten[code] != n {
+			t.Errorf("Rewritten[%s] = %d, want %d (all: %v)", code, res.Rewritten[code], n, res.Rewritten)
+		}
+	}
+	if again := mustUpgrade(t, res.Source, Options{}); again.Changed() {
+		t.Errorf("a second upgrade changed the script again:\n%s", again.Source)
+	}
+}
+
+// A workflow string argument that does not read back as the same bare
+// expression is left as it is and reported, never guessed at.
+func TestUpgrade_WorkflowStringArgumentWithoutBareForm(t *testing.T) {
+	src := "create workflow M.W parameter $WorkflowContext: M.E begin\n" +
+		"  call microflow M.G with (Order = ' $WorkflowContext');\nend workflow;\n"
+	res := mustUpgrade(t, src, Options{})
+	if res.Source != src {
+		t.Errorf("the script changed:\n%s", res.Source)
+	}
+	if len(res.Unrewritten) != 1 || res.Unrewritten[0].Code != deprecation.WorkflowStringArgument {
+		t.Errorf("Unrewritten = %+v, want the one MDL-DEPR008 use", res.Unrewritten)
+	}
+}
diff --git a/mdl/upgrade/examples_test.go b/mdl/upgrade/examples_test.go
index 6187a4afab..7aff1a46e5 100644
--- a/mdl/upgrade/examples_test.go
+++ b/mdl/upgrade/examples_test.go
@@ -46,21 +46,20 @@ func exampleScripts(t *testing.T) []string {
 }
 
 // fmtUpgrade is what `mxcli fmt --upgrade` writes: the upgrade rewrites and
-// nothing else. It deliberately does not run formatter.Format, whose keyword
-// upper-casing changes identifiers (see TestFormatterChangesMeaning).
+// nothing else. It does not run formatter.Format, whose line normalisation is
+// a separate choice (`fmt` without --upgrade).
 func fmtUpgrade(src string, opts Options) (string, Result, error) {
 	res, err := Upgrade(src, opts)
 	return res.Source, res, err
 }
 
-// TestFormatterChangesMeaning records why `fmt --upgrade` does not compose with
-// the heuristic formatter: formatter.Format upper-cases every word on its
-// keyword list, identifiers included (`Issue64.User` becomes `Issue64.USER`),
-// so it changes what a script builds. Plan item 3.2 (lowercase canonical)
-// replaces it. When this test starts failing, the formatter is safe and
-// fmt --upgrade may format as well.
-func TestFormatterChangesMeaning(t *testing.T) {
-	changed := 0
+// TestFormatterKeepsMeaning: formatter.Format must build exactly what the
+// script built. It used to upper-case every word on a keyword list, names
+// included (`Issue64.User` became `Issue64.USER`), and changed what 50-odd
+// example scripts built; lowercase-canonical keywords from the parse tree
+// (R8, ako/mxcli#752) change only the case of syntax.
+func TestFormatterKeepsMeaning(t *testing.T) {
+	checked := 0
 	for _, path := range exampleScripts(t) {
 		b, err := os.ReadFile(path)
 		if err != nil {
@@ -70,14 +69,23 @@ func TestFormatterChangesMeaning(t *testing.T) {
 		if len(errs) > 0 {
 			continue
 		}
-		got, errs := visitor.Build(formatter.Format(string(b)))
-		if len(errs) > 0 || !reflect.DeepEqual(want.Statements, got.Statements) {
-			changed++
+		checked++
+		formatted := formatter.Format(string(b))
+		got, errs := visitor.Build(formatted)
+		if len(errs) > 0 {
+			t.Errorf("%s: formatted script does not parse: %v", path, errs[0])
+			continue
+		}
+		if !reflect.DeepEqual(want.Statements, got.Statements) {
+			t.Errorf("%s: formatter.Format changes what the script builds", path)
+			continue
+		}
+		if again := formatter.Format(formatted); again != formatted {
+			t.Errorf("%s: formatter.Format is not idempotent", path)
 		}
 	}
-	t.Logf("formatter.Format changes what %d example scripts build", changed)
-	if changed == 0 {
-		t.Error("formatter.Format no longer changes any example's statements: let fmt --upgrade format too, and drop this test")
+	if checked < 100 {
+		t.Fatalf("checked only %d scripts", checked)
 	}
 }
 
diff --git a/mdl/upgrade/gated.go b/mdl/upgrade/gated.go
index 9d58b9ff05..7bb63d8421 100644
--- a/mdl/upgrade/gated.go
+++ b/mdl/upgrade/gated.go
@@ -33,6 +33,7 @@ var gatedRewriters = map[string]GatedRewriter{
 	"MDL-V1-SET":       visitorFix, // `$x = e` -> `set $x = e`
 	"MDL-V1-LIST":      visitorFix, // call form -> statement form, or `set` for the string function
 	"MDL-V1-REPLACE02": visitorFix, // `create or replace user role` (a plain create) -> `create user role`
+	"MDL-V1-WHILE":     visitorFix, // insert the missing `begin` and `while` after `end`
 }
 
 // unrewritable lists the changes with no mechanical rewrite at all, and why.
diff --git a/mdl/upgrade/gated_test.go b/mdl/upgrade/gated_test.go
index 017862f61e..0d676f1897 100644
--- a/mdl/upgrade/gated_test.go
+++ b/mdl/upgrade/gated_test.go
@@ -77,6 +77,12 @@ func TestUpgrade_GatedRewrites(t *testing.T) {
 			mf + "  declare $b Boolean = false;\n  set $b = contains($S, $S);\nend;\n", false},
 		{"create or replace user role is a plain create", "create or replace user role R (M.Admin);\n",
 			"create user role R (M.Admin);\n", true},
+		{"while without begin", mf + "  while $S = 'a'\n    log info 'x';\n  end while;\nend;\n",
+			mf + "  while $S = 'a' begin\n    log info 'x';\n  end while;\nend;\n", true},
+		{"while ending in a bare end", mf + "  while $S = 'a' begin\n    log info 'x';\n  end; -- note\nend;\n",
+			mf + "  while $S = 'a' begin\n    log info 'x';\n  end while; -- note\nend;\n", true},
+		{"WHILE without either, upper case", mf + "  WHILE true\n    LOG INFO 'x';\n  END;\nend;\n",
+			mf + "  WHILE true BEGIN\n    LOG INFO 'x';\n  END WHILE;\nend;\n", true},
 	} {
 		t.Run(c.name, func(t *testing.T) {
 			res, err := Upgrade(c.src, Options{AddHeader: true})
diff --git a/mdl/upgrade/r8_spellings_test.go b/mdl/upgrade/r8_spellings_test.go
new file mode 100644
index 0000000000..03dbe6c1dc
--- /dev/null
+++ b/mdl/upgrade/r8_spellings_test.go
@@ -0,0 +1,54 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package upgrade
+
+import (
+	"testing"
+)
+
+// R8 (ako/mxcli#752): every old spelling upgrades to exactly its canonical
+// form, keeping the letter case it was written in. The visitor test
+// (mdl/visitor/r8_spellings_test.go) proves each pair builds the same
+// statements; this one proves the rewrite produces that pair.
+func TestUpgrade_R8Spellings(t *testing.T) {
+	page := func(action string) string {
+		return "create page M.P (Title: 'P', Layout: Atlas_Core.Atlas_Default) {\n" +
+			"  actionbutton b (Caption: 'Go', Action: " + action + ")\n};\n"
+	}
+	cases := []struct{ old, want string }{
+		{page("save_changes close_page"), page("save changes close page")},
+		{page("SAVE_CHANGES CLOSE_PAGE"), page("SAVE CHANGES CLOSE PAGE")},
+		{page("cancel_changes"), page("cancel changes")},
+		{page("delete_object close_page"), page("delete close page")},
+		{page("DELETE_OBJECT"), page("DELETE")},
+		{page("create_object M.E then show_page M.Edit(Item: $currentObject)"), page("create object M.E then show page M.Edit(Item = $currentObject)")},
+		{page("microflow M.ACT(X: 1)"), page("call microflow M.ACT(X = 1)")},
+		{page("NANOFLOW M.NF"), page("CALL NANOFLOW M.NF")},
+		{page("open_link $currentObject/Url"), page("open link $currentObject/Url")},
+		{page("sign_out"), page("sign out")},
+		{page("complete_task 'Approve'"), page("complete task 'Approve'")},
+		{"create navigation Responsive home page M.Home menu (menu item 'Out' sign_out;);\n",
+			"create navigation Responsive home page M.Home menu (menu item 'Out' sign out;);\n"},
+		{"create entity M.E (\n  Name: String(100) not null error 'Required',\n  Code: String(9) UNIQUE ERROR 'Taken'\n);\n",
+			"create entity M.E (\n  Name: String(100) not null error message 'Required',\n  Code: String(9) UNIQUE ERROR MESSAGE 'Taken'\n);\n"},
+		{"create validation rule for M.E.Email regex M.Pattern\n  feedback 'Bad';\n",
+			"create validation rule for M.E.Email regex M.Pattern\n  error message 'Bad';\n"},
+		{"create association M.A_B from M.A to M.B type reference_set on delete restrict error_message 'In use';\n",
+			"create association M.A_B from M.A to M.B type ReferenceSet on delete restrict error message 'In use';\n"},
+		{"create association M.A_B from M.A to M.B DELETE_BEHAVIOR DELETE_AND_REFERENCES;\n",
+			"create association M.A_B from M.A to M.B ON DELETE CASCADE;\n"},
+		{"alter association M.A_B set delete_behavior delete but keep references error_message 'x';\n",
+			"alter association M.A_B set on delete set null error message 'x';\n"},
+		{"create microflow M.F () begin rest call get 'https://x.org' returns none; end;\n",
+			"create microflow M.F () begin rest call get 'https://x.org' returns nothing; end;\n"},
+	}
+	for _, c := range cases {
+		res := mustUpgrade(t, c.old, Options{})
+		if res.Source != c.want {
+			t.Errorf("upgrade of\n%s got:\n%s want:\n%s", c.old, res.Source, c.want)
+		}
+		if again := mustUpgrade(t, res.Source, Options{}); again.Changed() {
+			t.Errorf("upgrade is not idempotent on\n%s", res.Source)
+		}
+	}
+}
diff --git a/mdl/upgrade/upgrade_test.go b/mdl/upgrade/upgrade_test.go
index 2a99fd148c..1def31b41e 100644
--- a/mdl/upgrade/upgrade_test.go
+++ b/mdl/upgrade/upgrade_test.go
@@ -226,3 +226,28 @@ func TestUpgrade_GatedConstructs(t *testing.T) {
 		t.Fatalf("got %q (%v), want %q", res.Source, res.GatedRewritten, want)
 	}
 }
+
+// A brace error handler (MDL-DEPR540) becomes `begin … end error`, nested ones
+// included, keeping the body, comments and layout; it needs no header.
+func TestUpgrade_OnErrorBracesToBeginEndError(t *testing.T) {
+	for _, c := range [][2]string{
+		{mf + "  commit $o on error {\n    log warning 'x'; -- keep\n  };\nend;\n",
+			mf + "  commit $o on error begin\n    log warning 'x'; -- keep\n  end error;\nend;\n"},
+		{mf + "  commit $o on error without rollback { };\nend;\n",
+			mf + "  commit $o on error without rollback begin end error;\nend;\n"},
+		{mf + "  COMMIT $o ON ERROR WITHOUT ROLLBACK {\n    COMMIT $o ON ERROR { LOG INFO 'inner'; };\n  };\nend;\n",
+			mf + "  COMMIT $o ON ERROR WITHOUT ROLLBACK BEGIN\n    COMMIT $o ON ERROR BEGIN LOG INFO 'inner'; END ERROR;\n  END ERROR;\nend;\n"},
+	} {
+		res, err := Upgrade(c[0], Options{})
+		if err != nil {
+			t.Fatal(err)
+		}
+		if res.Source != c[1] {
+			t.Errorf("got:\n%s\nwant:\n%s", res.Source, c[1])
+		}
+		if res.Rewritten["MDL-DEPR540"] == 0 {
+			t.Errorf("no MDL-DEPR540 rewrite recorded: %+v", res.Rewritten)
+		}
+		sameStatements(t, c[0], res.Source)
+	}
+}
diff --git a/mdl/visitor/flow_blocks_test.go b/mdl/visitor/flow_blocks_test.go
new file mode 100644
index 0000000000..4424fb0354
--- /dev/null
+++ b/mdl/visitor/flow_blocks_test.go
@@ -0,0 +1,183 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package visitor
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
+)
+
+// R2 (ako/mxcli#754): inside a microflow, flow is `begin … end <keyword>`.
+// An error handler is `on error [without rollback] begin … end error;`, and the
+// brace form is its deprecated spelling (MDL-DEPR540). `while` takes `begin` and
+// `end while` like `loop`: both are required under mdl 1 (MDL-V1-WHILE), and a
+// headerless script keeps parsing without them and warns.
+
+func mfBodyOf(t *testing.T, src string) ([]ast.MicroflowStatement, *ast.Program) {
+	t.Helper()
+	prog, errs := Build(src)
+	if len(errs) > 0 {
+		t.Fatalf("%q: unexpected errors: %v", src, errs)
+	}
+	for _, s := range prog.Statements {
+		if m, ok := s.(*ast.CreateMicroflowStmt); ok {
+			return m.Body, prog
+		}
+	}
+	t.Fatalf("%q: no microflow", src)
+	return nil, nil
+}
+
+func errorHandlerMicroflow(clause string) string {
+	return "create microflow M.F ($O: M.E) begin\n  commit $O " + clause + ";\nend;"
+}
+
+func countDeprecations(prog *ast.Program, code string) int {
+	n := 0
+	for _, d := range prog.Deprecations {
+		if d.Code == code {
+			n++
+		}
+	}
+	return n
+}
+
+func TestOnErrorBeginEndError_BuildsTheHandler(t *testing.T) {
+	for _, c := range []struct {
+		clause string
+		want   ast.ErrorHandlingType
+	}{
+		{"on error begin\n    log warning 'x';\n  end error", ast.ErrorHandlingCustom},
+		{"on error without rollback begin\n    log warning 'x';\n  end error", ast.ErrorHandlingCustomWithoutRollback},
+		{"ON ERROR WITHOUT ROLLBACK BEGIN LOG WARNING 'x'; END ERROR", ast.ErrorHandlingCustomWithoutRollback},
+	} {
+		for _, header := range []string{"", "mdl 1;\n"} {
+			body, prog := mfBodyOf(t, header+errorHandlerMicroflow(c.clause))
+			commit, ok := body[0].(*ast.MfCommitStmt)
+			if !ok {
+				t.Fatalf("%q: body[0] = %T", c.clause, body[0])
+			}
+			eh := commit.ErrorHandling
+			if eh == nil || eh.Type != c.want || len(eh.Body) != 1 {
+				t.Errorf("header %q, %q: handler = %+v; want %v with one statement", header, c.clause, eh, c.want)
+			}
+			if len(prog.Deprecations) != 0 || len(prog.LanguageNotes) != 0 {
+				t.Errorf("header %q, %q: the canonical form warned: %+v %+v", header, c.clause, prog.Deprecations, prog.LanguageNotes)
+			}
+		}
+	}
+}
+
+func TestOnErrorBeginEndError_EmptyHandler(t *testing.T) {
+	body, _ := mfBodyOf(t, errorHandlerMicroflow("on error without rollback begin end error"))
+	eh := body[0].(*ast.MfCommitStmt).ErrorHandling
+	if eh == nil || eh.Type != ast.ErrorHandlingCustomWithoutRollback || len(eh.Body) != 0 {
+		t.Errorf("empty handler = %+v", eh)
+	}
+}
+
+// The brace form is a respelling: it keeps parsing under both versions, warns
+// MDL-DEPR540 once per handler, and builds what `begin … end error` builds.
+func TestOnErrorBraces_IsADeprecatedAlias(t *testing.T) {
+	for _, header := range []string{"", "mdl 1;\n"} {
+		for _, pair := range [][2]string{
+			{"on error { log warning 'x'; }", "on error begin log warning 'x'; end error"},
+			{"on error without rollback {\n    log warning 'x';\n  }", "on error without rollback begin\n    log warning 'x';\n  end error"},
+			{"on error without rollback { }", "on error without rollback begin end error"},
+		} {
+			oldBody, oldProg := mfBodyOf(t, header+errorHandlerMicroflow(pair[0]))
+			newBody, _ := mfBodyOf(t, header+errorHandlerMicroflow(pair[1]))
+			if !reflect.DeepEqual(oldBody, newBody) {
+				t.Errorf("header %q: %q and %q build different statements", header, pair[0], pair[1])
+			}
+			if n := countDeprecations(oldProg, deprecation.OnErrorBraces); n != 1 {
+				t.Errorf("header %q, %q: %d %s records, want 1", header, pair[0], n, deprecation.OnErrorBraces)
+			}
+		}
+	}
+}
+
+// Nested handlers are one use each, and each carries its own rewrite.
+func TestOnErrorBraces_NestedHandlersEachRecorded(t *testing.T) {
+	src := errorHandlerMicroflow("on error {\n    commit $O on error { log info 'inner'; };\n  }")
+	_, prog := mfBodyOf(t, src)
+	if n := countDeprecations(prog, deprecation.OnErrorBraces); n != 2 {
+		t.Fatalf("got %d %s records, want 2", n, deprecation.OnErrorBraces)
+	}
+	for _, d := range prog.Deprecations {
+		if d.Fix == nil || len(d.Fix.Edits) != 2 {
+			t.Errorf("line %d: want a two-edit rewrite ({ -> begin, } -> end error), got %+v (%s)", d.Line, d.Fix, d.NoFix)
+		}
+	}
+}
+
+func whileMicroflow(loop string) string {
+	return "create microflow M.F () begin\n  declare $n Integer = 0;\n" + loop + "\nend;"
+}
+
+func whileNotes(prog *ast.Program) []ast.LanguageNote {
+	var out []ast.LanguageNote
+	for _, n := range prog.LanguageNotes {
+		if n.Code == "MDL-V1-WHILE" {
+			out = append(out, n)
+		}
+	}
+	return out
+}
+
+var whileForms = []string{
+	"  while $n < 3\n    set $n = $n + 1;\n  end while;", // no begin
+	"  while $n < 3 begin\n    set $n = $n + 1;\n  end;", // no `while` after end
+	"  while $n < 3\n    set $n = $n + 1;\n  end;",       // neither
+	"  WHILE $n < 3\n    SET $n = $n + 1;\n  END;",       // upper case
+}
+
+func TestWhileBeginEndWhile_CanonicalUnderBothVersions(t *testing.T) {
+	canon := "  while $n < 3 begin\n    set $n = $n + 1;\n  end while;"
+	for _, header := range []string{"", "mdl 1;\n"} {
+		body, prog := mfBodyOf(t, header+whileMicroflow(canon))
+		if _, ok := body[1].(*ast.WhileStmt); !ok {
+			t.Fatalf("body[1] = %T", body[1])
+		}
+		if n := whileNotes(prog); len(n) != 0 {
+			t.Errorf("header %q: the canonical form warned: %+v", header, n)
+		}
+	}
+}
+
+func TestWhileWithoutBeginOrEndWhile_Mdl0WarnsAndBuildsTheSameLoop(t *testing.T) {
+	canonBody, _ := mfBodyOf(t, whileMicroflow("  while $n < 3 begin\n    set $n = $n + 1;\n  end while;"))
+	for _, form := range whileForms {
+		body, prog := mfBodyOf(t, whileMicroflow(form))
+		if !reflect.DeepEqual(body, canonBody) {
+			t.Errorf("%q builds a different loop from the canonical form", form)
+		}
+		notes := whileNotes(prog)
+		if len(notes) != 1 {
+			t.Fatalf("%q: got %d MDL-V1-WHILE notes, want 1", form, len(notes))
+		}
+		if notes[0].Fix == nil || len(notes[0].Fix.Edits) == 0 {
+			t.Errorf("%q: the note carries no rewrite (%s)", form, notes[0].NoFix)
+		}
+		if !strings.Contains(notes[0].Message, "end while") {
+			t.Errorf("%q: the warning should name the required form: %s", form, notes[0].Message)
+		}
+	}
+}
+
+func TestWhileWithoutBeginOrEndWhile_Mdl1IsAnError(t *testing.T) {
+	for _, form := range whileForms {
+		_, errs := Build("mdl 1;\n" + whileMicroflow(form))
+		if len(errs) == 0 {
+			t.Errorf("%q: accepted under mdl 1", form)
+			continue
+		}
+		if msg := errs[0].Error(); !strings.Contains(msg, "end while") || !strings.Contains(msg, "begin") {
+			t.Errorf("%q: the error should name `begin … end while`: %s", form, msg)
+		}
+	}
+}
diff --git a/mdl/visitor/keyword_case.go b/mdl/visitor/keyword_case.go
new file mode 100644
index 0000000000..157df7e4c3
--- /dev/null
+++ b/mdl/visitor/keyword_case.go
@@ -0,0 +1,189 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package visitor
+
+import (
+	"strings"
+
+	"github.com/antlr4-go/antlr/v4"
+	"github.com/mendixlabs/mxcli/mdl/grammar/parser"
+)
+
+// Lowercase keywords are canonical (R8, ako/mxcli#752): describe writes them
+// and `mxcli fmt` normalises to them. What makes that safe is telling a
+// keyword apart from a NAME that happens to be spelled like one. The lexer
+// cannot: `Title`, `Folder` and `User` are keyword tokens wherever they occur,
+// and the old formatter upper-cased them all, turning `Issue64.User` into
+// `Issue64.USER` — a different module member. Only the parse tree knows, so
+// the spans come from it.
+
+// nameRules are the rules through which a keyword token is used as a name, or
+// whose text is carried into the model verbatim (an expression, XPath or OQL
+// is stored as its source text, so its letter case is the author's). A data
+// type (`String(200)`) is a Mendix type name, not a keyword.
+var nameRules = map[string]bool{
+	"keyword":             true,
+	"identifierOrKeyword": true,
+	"qualifiedName":       true,
+	"dataType":            true,
+}
+
+// verbatimRules are the rules whose source text the visitor stores as written
+// (extractOriginalText and friends): letter case AND layout are the author's.
+var verbatimRules = map[string]bool{
+	"expression":         true,
+	"catalogSelectQuery": true,
+	"sqlPassthrough":     true,
+	// A template parameter keeps the whitespace after its expression
+	// (appendTemplateParamTrailingWhitespace), so the whole list is kept.
+	"templateParams": true,
+}
+
+// verbatimRulePrefixes are rule-name prefixes whose text is kept verbatim (an
+// annotation, `@Position(…)`, is a name too).
+var verbatimRulePrefixes = []string{"xpath", "oql", "annotation"}
+
+// Spans is what the formatter needs from the parse tree.
+type Spans struct {
+	// Keywords are the rune spans [start, stop) of every keyword that is
+	// syntax: not a name, not inside an expression, XPath or OQL, not a
+	// property key (a keyword directly followed by `:` or `=` is a key, and
+	// keys are case-preserved identifiers), and not a value written the way
+	// Mendix writes names and enumeration values — in CamelCase
+	// (`ReferenceSet`, `ButtonStyle: Success`) or with a digit
+	// (`RenderMode: H2`). An all-caps or all-lower word is a keyword however
+	// it is used.
+	Keywords [][2]int
+	// Verbatim are the rune spans of text stored as written — expressions,
+	// XPath, OQL, catalog and SQL queries, and every token that spans lines
+	// (a string literal, a code block) — whose layout must not change either.
+	Verbatim [][2]int
+}
+
+// FormatSpans parses src and returns its Spans. ok is false when src does not
+// parse; the caller must then leave it alone.
+func FormatSpans(src string) (spans Spans, ok bool) {
+	errs := newErrorListener()
+	lexer := parser.NewMDLLexer(newScriptStream(src))
+	lexer.RemoveErrorListeners()
+	lexer.AddErrorListener(errs)
+	stream := antlr.NewCommonTokenStream(lexer, antlr.TokenDefaultChannel)
+	p := parser.NewMDLParser(stream)
+	p.RemoveErrorListeners()
+	p.AddErrorListener(errs)
+	tree := p.Program()
+	if len(errs.errors) > 0 {
+		return Spans{}, false
+	}
+	ruleNames := p.GetRuleNames()
+	isVerbatimRule := func(name string) bool {
+		if verbatimRules[name] {
+			return true
+		}
+		for _, pre := range verbatimRulePrefixes {
+			if strings.HasPrefix(name, pre) {
+				return true
+			}
+		}
+		return false
+	}
+	isKey := func(tok antlr.Token) bool {
+		i := tok.GetTokenIndex() + 1
+		if i >= stream.Size() {
+			return false
+		}
+		switch stream.Get(i).GetTokenType() {
+		case parser.MDLLexerCOLON, parser.MDLLexerEQUALS:
+			return true
+		}
+		return false
+	}
+	// walk visits t; kept says a rule above t keeps its text as written.
+	var walk func(t antlr.Tree, kept bool)
+	walk = func(t antlr.Tree, kept bool) {
+		switch n := t.(type) {
+		case antlr.TerminalNode:
+			tok := n.GetSymbol()
+			if tok.GetTokenType() == antlr.TokenEOF {
+				return
+			}
+			if strings.ContainsAny(tok.GetText(), "\n\r") {
+				spans.Verbatim = append(spans.Verbatim, [2]int{tok.GetStart(), tok.GetStop() + 1})
+			}
+			if kept || !isKeywordToken(tok) || isKey(tok) || writtenAsAName(tok.GetText()) {
+				return
+			}
+			spans.Keywords = append(spans.Keywords, [2]int{tok.GetStart(), tok.GetStop() + 1})
+		case antlr.ParserRuleContext:
+			name := ruleNames[n.GetRuleIndex()]
+			if !kept && isVerbatimRule(name) {
+				if start, stop := n.GetStart(), n.GetStop(); start != nil && stop != nil && stop.GetStop() >= start.GetStart() {
+					spans.Verbatim = append(spans.Verbatim, [2]int{start.GetStart(), stop.GetStop() + 1})
+				}
+				kept = true
+			}
+			kept = kept || nameRules[name]
+			for i := 0; i < n.GetChildCount(); i++ {
+				walk(n.GetChild(i), kept)
+			}
+		}
+	}
+	walk(tree, false)
+	return spans, true
+}
+
+// isKeywordToken reports whether tok is a keyword: a token other than an
+// identifier whose text is a word (or words, for the multi-word tokens).
+func isKeywordToken(tok antlr.Token) bool {
+	switch tok.GetTokenType() {
+	case antlr.TokenEOF, parser.MDLLexerIDENTIFIER, parser.MDLLexerQUOTED_IDENTIFIER:
+		return false
+	}
+	text := tok.GetText()
+	if text == "" || !(text[0] >= 'a' && text[0] <= 'z' || text[0] >= 'A' && text[0] <= 'Z') {
+		return false
+	}
+	for _, r := range text {
+		switch {
+		case r >= 'a' && r <= 'z', r >= 'A' && r <= 'Z', r >= '0' && r <= '9', r == '_',
+			r == ' ', r == '\t', r == '\r', r == '\n':
+		default:
+			return false
+		}
+	}
+	return true
+}
+
+// writtenAsAName reports whether a keyword token is spelled like a Mendix name
+// or enumeration value: mixed case, or containing a digit.
+func writtenAsAName(text string) bool {
+	var upper, lower bool
+	for _, r := range text {
+		switch {
+		case r >= '0' && r <= '9':
+			return true
+		case r >= 'A' && r <= 'Z':
+			upper = true
+		case r >= 'a' && r <= 'z':
+			lower = true
+		}
+	}
+	return upper && lower
+}
+
+// LowercaseKeywords returns src with every syntax keyword (Spans.Keywords) in
+// lower case and everything else untouched.
+func LowercaseKeywords(src string, keywords [][2]int) string {
+	if len(keywords) == 0 {
+		return src
+	}
+	runes := []rune(src)
+	for _, s := range keywords {
+		for i := s[0]; i < s[1] && i < len(runes); i++ {
+			if r := runes[i]; r >= 'A' && r <= 'Z' {
+				runes[i] = r + ('a' - 'A')
+			}
+		}
+	}
+	return string(runes)
+}
diff --git a/mdl/visitor/r8_spellings_test.go b/mdl/visitor/r8_spellings_test.go
new file mode 100644
index 0000000000..612bb81d2e
--- /dev/null
+++ b/mdl/visitor/r8_spellings_test.go
@@ -0,0 +1,131 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package visitor
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
+)
+
+// r8Pair is one old spelling and its canonical form (R8, ako/mxcli#752). Both
+// must parse, build the same statements, and only the old one may record code.
+type r8Pair struct {
+	name, old, canon, code string
+}
+
+func pageWith(action string) string {
+	return "create page M.P (Title: 'P', Layout: Atlas_Core.Atlas_Default) { actionbutton b (Caption: 'Go', Action: " + action + ") };"
+}
+
+var r8Pairs = []r8Pair{
+	{"save", pageWith("save_changes"), pageWith("save changes"), deprecation.PageActionWord},
+	{"save close", pageWith("save_changes close_page"), pageWith("save changes close page"), deprecation.PageActionWord},
+	{"save close upper", pageWith("SAVE_CHANGES CLOSE_PAGE"), pageWith("SAVE CHANGES CLOSE PAGE"), deprecation.PageActionWord},
+	{"cancel close", pageWith("cancel_changes close_page"), pageWith("cancel changes close page"), deprecation.PageActionWord},
+	{"close", pageWith("close_page"), pageWith("close page"), deprecation.PageActionWord},
+	{"delete", pageWith("delete_object"), pageWith("delete"), deprecation.PageActionWord},
+	{"delete close", pageWith("delete_object close_page"), pageWith("delete close page"), deprecation.PageActionWord},
+	{"create then show", pageWith("create_object M.E then show_page M.Edit"), pageWith("create object M.E then show page M.Edit"), deprecation.PageActionWord},
+	{"show page args", pageWith("show_page M.Edit(Item = $currentObject)"), pageWith("show page M.Edit(Item = $currentObject)"), deprecation.PageActionWord},
+	{"microflow", pageWith("microflow M.ACT(X = 1)"), pageWith("call microflow M.ACT(X = 1)"), deprecation.PageActionWord},
+	{"nanoflow", pageWith("nanoflow M.NF"), pageWith("call nanoflow M.NF"), deprecation.PageActionWord},
+	{"open link", pageWith("open_link 'https://x.org'"), pageWith("open link 'https://x.org'"), deprecation.PageActionWord},
+	{"open link attr", pageWith("open_link $currentObject/Url"), pageWith("open link $currentObject/Url"), deprecation.PageActionWord},
+	{"sign out", pageWith("sign_out"), pageWith("sign out"), deprecation.PageActionWord},
+	{"complete task", pageWith("complete_task 'Approve'"), pageWith("complete task 'Approve'"), deprecation.PageActionWord},
+	{"menu sign out", "create navigation Responsive home page M.Home menu (menu item 'Out' sign_out;);",
+		"create navigation Responsive home page M.Home menu (menu item 'Out' sign out;);", deprecation.PageActionWord},
+	{"alter page set action", "alter page M.P { set Action = show_page M.Q on b };",
+		"alter page M.P { set Action = show page M.Q on b };", deprecation.PageActionWord},
+
+	{"not null error", "create entity M.E (Name: String(100) not null error 'Required');",
+		"create entity M.E (Name: String(100) not null error message 'Required');", deprecation.ErrorMessageKeyword},
+	{"unique error", "create entity M.E (Code: String(10) unique error 'Taken');",
+		"create entity M.E (Code: String(10) unique error message 'Taken');", deprecation.ErrorMessageKeyword},
+	{"validation feedback", "create validation rule for M.E.Email regex M.Pattern feedback 'Bad';",
+		"create validation rule for M.E.Email regex M.Pattern error message 'Bad';", deprecation.ErrorMessageKeyword},
+	{"association error_message", "create association M.A_B from M.A to M.B on delete restrict error_message 'In use';",
+		"create association M.A_B from M.A to M.B on delete restrict error message 'In use';", deprecation.ErrorMessageKeyword},
+	{"association errormessage", "create association M.A_B from M.A to M.B on delete restrict errormessage 'In use';",
+		"create association M.A_B from M.A to M.B on delete restrict error message 'In use';", deprecation.ErrorMessageKeyword},
+
+	{"delete_behavior cascade", "create association M.A_B from M.A to M.B delete_behavior cascade;",
+		"create association M.A_B from M.A to M.B on delete cascade;", deprecation.DeleteBehaviorClause},
+	{"delete_behavior delete_and_references", "create association M.A_B from M.A to M.B delete_behavior delete_and_references;",
+		"create association M.A_B from M.A to M.B on delete cascade;", deprecation.DeleteBehaviorClause},
+	{"deletebehavior deleteandreferences", "create association M.A_B from M.A to M.B DELETEBEHAVIOR DELETEANDREFERENCES;",
+		"create association M.A_B from M.A to M.B ON DELETE CASCADE;", deprecation.DeleteBehaviorClause},
+	{"delete_behavior delete but keep", "create association M.A_B from M.A to M.B delete_behavior delete but keep references;",
+		"create association M.A_B from M.A to M.B on delete set null;", deprecation.DeleteBehaviorClause},
+	{"delete_behavior if no refs", "create association M.A_B from M.A to M.B delete_behavior delete_if_no_references;",
+		"create association M.A_B from M.A to M.B on delete restrict;", deprecation.DeleteBehaviorClause},
+	{"alter set delete_behavior", "alter association M.A_B set delete_behavior prevent;",
+		"alter association M.A_B set on delete restrict;", deprecation.DeleteBehaviorClause},
+
+	{"reference_set", "create association M.A_B from M.A to M.B type reference_set;",
+		"create association M.A_B from M.A to M.B type ReferenceSet;", deprecation.ReferenceSetUnderscore},
+
+	{"returns none", "create microflow M.F () begin rest call get 'https://x.org' returns none; end;",
+		"create microflow M.F () begin rest call get 'https://x.org' returns nothing; end;", deprecation.ReturnsNone},
+}
+
+func TestR8OldSpellingsAreAliases(t *testing.T) {
+	for _, p := range r8Pairs {
+		t.Run(p.name, func(t *testing.T) {
+			old := mustBuild(t, p.old)
+			canon := mustBuild(t, p.canon)
+			if got := deprecationCodes(canon); len(got) != 0 {
+				t.Errorf("canonical %q recorded %v, want none", p.canon, got)
+			}
+			got := deprecationCodes(old)
+			if len(got) == 0 {
+				t.Fatalf("old %q recorded nothing, want %s", p.old, p.code)
+			}
+			for _, c := range got {
+				if c != p.code {
+					t.Errorf("old %q recorded %v, want only %s", p.old, got, p.code)
+				}
+			}
+			for _, d := range old.Deprecations {
+				if d.Code == p.code && d.Fix == nil && d.Code != deprecation.ReturnsNone {
+					t.Errorf("old %q: %s recorded without a rewrite (%s)", p.old, d.Code, d.NoFix)
+				}
+			}
+			if !reflect.DeepEqual(old.Statements, canon.Statements) {
+				t.Errorf("old and canonical build different statements:\n old:   %#v\n canon: %#v", old.Statements, canon.Statements)
+			}
+		})
+	}
+}
+
+// The words are not a new meaning: every canonical page action builds the
+// action its snake-case spelling always built.
+func TestR8PageActionWordsBuildTheirAction(t *testing.T) {
+	cases := map[string]ast.ActionV3{
+		"save changes close page":   {Type: "save", ClosePage: true},
+		"cancel changes":            {Type: "cancel"},
+		"close page":                {Type: "close"},
+		"delete close page":         {Type: "delete", ClosePage: true},
+		"sign out":                  {Type: "signOut"},
+		"complete task 'Approve'":   {Type: "completeTask", OutcomeValue: "Approve"},
+		"open link 'https://x.org'": {Type: "openLink", LinkURL: "https://x.org"},
+		"call microflow M.ACT":      {Type: "microflow", Target: "M.ACT"},
+		"call nanoflow M.NF":        {Type: "nanoflow", Target: "M.NF"},
+		"show page M.Edit":          {Type: "showPage", Target: "M.Edit"},
+	}
+	for src, want := range cases {
+		prog := mustBuild(t, pageWith(src))
+		stmt := prog.Statements[0].(*ast.CreatePageStmtV3)
+		got, ok := stmt.Widgets[0].Properties["Action"].(*ast.ActionV3)
+		if !ok {
+			t.Errorf("%s: Action is %T, want *ast.ActionV3", src, stmt.Widgets[0].Properties["Action"])
+			continue
+		}
+		if !reflect.DeepEqual(*got, want) {
+			t.Errorf("%s: built %+v, want %+v", src, *got, want)
+		}
+	}
+}
diff --git a/mdl/visitor/visitor_argument_binding.go b/mdl/visitor/visitor_argument_binding.go
new file mode 100644
index 0000000000..1b74d0f83d
--- /dev/null
+++ b/mdl/visitor/visitor_argument_binding.go
@@ -0,0 +1,388 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package visitor
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+
+	"github.com/antlr4-go/antlr/v4"
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
+	"github.com/mendixlabs/mxcli/mdl/grammar/parser"
+)
+
+// R4 (PROPOSAL_mdl_beta_syntax_freeze.md §3; ako/mxcli#751): every call site
+// binds an argument as `Param = expression`, and every text template as
+// `with ({1} = expression)`. The spellings below build exactly what the
+// canonical form builds, so each is a registered alias (mdl/deprecation) whose
+// use is recorded here, where its tokens are still at hand, together with the
+// rewrite `fmt --upgrade` applies:
+//
+//   - MDL-DEPR006 `$Param = e` — the `$` of a variable on a parameter name;
+//   - MDL-DEPR007 `Param: e`   — `:` sets a model property, `=` binds a value;
+//   - MDL-DEPR008 a workflow call's `with (Param = '<expression>')`;
+//   - MDL-DEPR009 `objects [a, b]` / `parameters [a, b]`.
+
+// ExitCallArgument records `$Param = e` in call microflow/nanoflow/java
+// action/javascript action/external action/web service/execute database query.
+func (b *Builder) ExitCallArgument(ctx *parser.CallArgumentContext) {
+	b.recordDollarArgument(ctx.VARIABLE())
+}
+
+// ExitSendRestRequestParam records `$Param = e` in send rest request.
+func (b *Builder) ExitSendRestRequestParam(ctx *parser.SendRestRequestParamContext) {
+	b.recordDollarArgument(ctx.VARIABLE())
+}
+
+// ExitShowPageArg records the two deprecated argument spellings of show page.
+func (b *Builder) ExitShowPageArg(ctx *parser.ShowPageArgContext) {
+	if ctx.ParameterName() != nil {
+		return
+	}
+	if iok := ctx.IdentifierOrKeyword(); iok != nil {
+		b.recordColonArgument(iok, ctx.COLON(), ctx.Expression())
+		return
+	}
+	if vars := ctx.AllVARIABLE(); len(vars) > 0 {
+		b.recordDollarArgument(vars[0])
+	}
+}
+
+// ExitMicroflowArgV3 records the two deprecated argument spellings of a page
+// action or a microflow/nanoflow data source.
+func (b *Builder) ExitMicroflowArgV3(ctx *parser.MicroflowArgV3Context) {
+	if ctx.ParameterName() != nil {
+		return
+	}
+	if iok := ctx.IdentifierOrKeyword(); iok != nil {
+		b.recordColonArgument(iok, ctx.COLON(), ctx.Expression())
+		return
+	}
+	b.recordDollarArgument(ctx.VARIABLE())
+}
+
+// recordDollarArgument records MDL-DEPR006 for the parameter-name token v, with
+// the rewrite that drops its `$`.
+func (b *Builder) recordDollarArgument(v antlr.TerminalNode) {
+	if v == nil {
+		return
+	}
+	tok := v.GetSymbol()
+	name := strings.TrimPrefix(tok.GetText(), "$")
+	b.recordDeprecation(deprecation.DollarArgumentName, tok, "argument")
+	edit := ast.TextEdit{Start: tok.GetStart(), Stop: tok.GetStop() + 1, Text: ParameterNameSpelling(name)}
+	b.fixLastDeprecation(deprecation.DollarArgumentName, &ast.Fix{Edits: []ast.TextEdit{edit}}, "")
+}
+
+// recordColonArgument records MDL-DEPR007 for `Param: e`, with the rewrite
+// `Param = e`: the colon and the space around it become ` = `.
+func (b *Builder) recordColonArgument(name parser.IIdentifierOrKeywordContext, colon antlr.TerminalNode, expr parser.IExpressionContext) {
+	if colon == nil {
+		return
+	}
+	b.recordDeprecation(deprecation.ColonArgument, colon.GetSymbol(), "argument")
+	nameStop := name.GetStop()
+	if nameStop == nil || expr == nil || expr.GetStart() == nil {
+		b.fixLastDeprecation(deprecation.ColonArgument, nil, "the argument is incomplete")
+		return
+	}
+	edit := replaceGap(nameStop.GetStop(), expr.GetStart().GetStart(), " = ")
+	b.fixLastDeprecation(deprecation.ColonArgument, &ast.Fix{Edits: []ast.TextEdit{edit}}, "")
+}
+
+// ParameterNameSpelling spells a parameter name as parameterName accepts it:
+// bare when it parses as one (an identifier or a keyword), quoted otherwise.
+func ParameterNameSpelling(name string) string {
+	if parsesFully(name, func(p *parser.MDLParser) antlr.ParserRuleContext { return p.ParameterName() }) {
+		return name
+	}
+	return `"` + name + `"`
+}
+
+// parsesFully reports whether text is exactly one rule, as rule parses it,
+// with no syntax error and nothing left over.
+func parsesFully(text string, rule func(*parser.MDLParser) antlr.ParserRuleContext) bool {
+	_, ok := parseRule(text, rule)
+	return ok
+}
+
+func parseRule(text string, rule func(*parser.MDLParser) antlr.ParserRuleContext) (antlr.ParserRuleContext, bool) {
+	errs := newErrorListener()
+	lexer := parser.NewMDLLexer(newScriptStream(text))
+	lexer.RemoveErrorListeners()
+	lexer.AddErrorListener(errs)
+	stream := antlr.NewCommonTokenStream(lexer, antlr.TokenDefaultChannel)
+	p := parser.NewMDLParser(stream)
+	p.RemoveErrorListeners()
+	p.AddErrorListener(errs)
+	ctx := rule(p)
+	if len(errs.errors) > 0 || ctx == nil || stream.LA(1) != antlr.TokenEOF {
+		return nil, false
+	}
+	return ctx, true
+}
+
+// BareExpression reports whether a stored expression can be written as a bare
+// MDL expression that the visitor reads back as exactly that text. describe
+// asks it before writing a workflow argument without quotes; fmt --upgrade
+// asks it before unquoting one.
+func BareExpression(expr string) bool {
+	if strings.TrimSpace(expr) != expr || expr == "" {
+		return false
+	}
+	ctx, ok := parseRule(expr, func(p *parser.MDLParser) antlr.ParserRuleContext { return p.Expression() })
+	if !ok {
+		return false
+	}
+	return bareArgumentText(ctx.(parser.IExpressionContext)) == expr
+}
+
+// bareArgumentText is the expression a bare workflow argument stores: its
+// source text, as the Mendix expression editor would hold it.
+func bareArgumentText(expr parser.IExpressionContext) string {
+	if se, ok := buildSourceExpression(expr).(*ast.SourceExpr); ok {
+		return se.Source
+	}
+	return stripExpressionIdentifierQuotes(expressionSourceText(expr))
+}
+
+// buildWorkflowCallArguments builds the canonical `(Param = expression)` list
+// of a workflow call.
+func buildWorkflowCallArguments(ctx parser.IWorkflowCallArgumentsContext) []ast.WorkflowParameterMappingNode {
+	if ctx == nil {
+		return nil
+	}
+	var out []ast.WorkflowParameterMappingNode
+	for _, a := range ctx.(*parser.WorkflowCallArgumentsContext).AllWorkflowCallArgument() {
+		arg := a.(*parser.WorkflowCallArgumentContext)
+		if arg.ParameterName() == nil || arg.Expression() == nil {
+			continue
+		}
+		out = append(out, ast.WorkflowParameterMappingNode{
+			Parameter:  parameterNameText(arg.ParameterName()),
+			Expression: bareArgumentText(arg.Expression()),
+		})
+	}
+	return out
+}
+
+// workflowCallCtx is what the two workflow call statements have in common.
+type workflowCallCtx interface {
+	antlr.ParserRuleContext
+	QualifiedName() parser.IQualifiedNameContext
+	WorkflowCallArguments() parser.IWorkflowCallArgumentsContext
+	WITH() antlr.TerminalNode
+	RPAREN() antlr.TerminalNode
+	AllWorkflowParameterMapping() []parser.IWorkflowParameterMappingContext
+}
+
+// ExitWorkflowCallMicroflowStmt records MDL-DEPR008 on a workflow's call
+// microflow activity.
+func (b *Builder) ExitWorkflowCallMicroflowStmt(ctx *parser.WorkflowCallMicroflowStmtContext) {
+	b.recordWorkflowStringArguments(ctx)
+}
+
+// ExitWorkflowCallWorkflowStmt records MDL-DEPR008 on a workflow's call
+// workflow activity.
+func (b *Builder) ExitWorkflowCallWorkflowStmt(ctx *parser.WorkflowCallWorkflowStmtContext) {
+	b.recordWorkflowStringArguments(ctx)
+}
+
+func (b *Builder) recordWorkflowStringArguments(ctx workflowCallCtx) {
+	with := ctx.WITH()
+	if with == nil {
+		return
+	}
+	if ctx.WorkflowCallArguments() != nil {
+		b.addError(fmt.Errorf("line %d: a workflow call has two argument lists; write the arguments once, "+
+			"as `(Param = expression)` after the callee", with.GetSymbol().GetLine()))
+		return
+	}
+	b.recordDeprecation(deprecation.WorkflowStringArgument, with.GetSymbol(), "workflow call")
+	fix, why := workflowStringArgumentsFix(ctx)
+	b.fixLastDeprecation(deprecation.WorkflowStringArgument, fix, why)
+}
+
+// workflowStringArgumentsFix moves `with (P = 'e', …)` to `(P = e, …)` after
+// the callee. A string whose content is not a bare expression that reads back
+// as itself has no rewrite: unquoting it would change the stored expression.
+func workflowStringArgumentsFix(ctx workflowCallCtx) (*ast.Fix, string) {
+	qn, rparen := ctx.QualifiedName(), ctx.RPAREN()
+	if qn == nil || qn.GetStop() == nil || rparen == nil {
+		return nil, "the argument list is incomplete"
+	}
+	var args []string
+	for _, m := range ctx.AllWorkflowParameterMapping() {
+		pm := m.(*parser.WorkflowParameterMappingContext)
+		if pm.QualifiedName() == nil || pm.STRING_LITERAL() == nil {
+			return nil, "the argument list is incomplete"
+		}
+		expr := unquoteStringLit(pm.STRING_LITERAL())
+		if !BareExpression(expr) {
+			return nil, fmt.Sprintf("the string %s does not read back as the same bare expression; "+
+				"write the argument as `(Param = expression)` by hand", pm.STRING_LITERAL().GetText())
+		}
+		name := bareWorkflowParameterName(pm.QualifiedName().GetText())
+		args = append(args, ParameterNameSpelling(name)+" = "+expr)
+	}
+	// Delete ` with (…)` from the end of the token before WITH, and write the
+	// list after the callee.
+	withTok := ctx.WITH().GetSymbol()
+	prevStop := -1
+	for i := 0; i < ctx.GetChildCount(); i++ {
+		if t, ok := ctx.GetChild(i).(antlr.TerminalNode); ok && t.GetSymbol() == withTok {
+			break
+		}
+		if _, stop := nodeSpan(ctx.GetChild(i)); stop >= 0 {
+			prevStop = stop
+		}
+	}
+	if prevStop < 0 {
+		return nil, "the argument list is incomplete"
+	}
+	return &ast.Fix{Edits: []ast.TextEdit{
+		insertAt(qn.GetStop().GetStop()+1, "("+strings.Join(args, ", ")+")"),
+		{Start: prevStop + 1, Stop: rparen.GetSymbol().GetStop() + 1, Text: ""},
+	}}, ""
+}
+
+// ExitShowMessageStatement records MDL-DEPR009 for `objects [..]` and checks
+// the numbering of `with ({n} = …)`.
+func (b *Builder) ExitShowMessageStatement(ctx *parser.ShowMessageStatementContext) {
+	b.recordObjectsList(ctx.OBJECTS(), ctx.LBRACKET(), ctx.ExpressionList(), ctx.RBRACKET())
+	b.checkTemplateNumbering(ctx.TemplateParams())
+}
+
+// ExitValidationFeedbackStatement is ExitShowMessageStatement for validation
+// feedback.
+func (b *Builder) ExitValidationFeedbackStatement(ctx *parser.ValidationFeedbackStatementContext) {
+	b.recordObjectsList(ctx.OBJECTS(), ctx.LBRACKET(), ctx.ExpressionList(), ctx.RBRACKET())
+	b.checkTemplateNumbering(ctx.TemplateParams())
+}
+
+func (b *Builder) recordObjectsList(objects, lbracket antlr.TerminalNode, list parser.IExpressionListContext, rbracket antlr.TerminalNode) {
+	if objects == nil {
+		return
+	}
+	b.recordDeprecation(deprecation.PositionalTemplateArguments, objects.GetSymbol(), "text template")
+	if lbracket == nil || rbracket == nil || list == nil {
+		b.fixLastDeprecation(deprecation.PositionalTemplateArguments, nil, "the list is incomplete")
+		return
+	}
+	var items []antlr.ParserRuleContext
+	for _, e := range list.(*parser.ExpressionListContext).AllExpression() {
+		items = append(items, e)
+	}
+	b.fixLastDeprecation(deprecation.PositionalTemplateArguments,
+		numberedListFix(objects.GetSymbol(), lbracket.GetSymbol(), items, rbracket.GetSymbol()), "")
+}
+
+// numberedListFix rewrites `kw [a, b]` as `with ({1} = a, {2} = b)`: the
+// keyword and bracket become `with (`, each item gets its number, and the
+// closing bracket becomes `)`. The items themselves are not touched.
+func numberedListFix(kw, lbracket antlr.Token, items []antlr.ParserRuleContext, rbracket antlr.Token) *ast.Fix {
+	edits := []ast.TextEdit{replaceSpan(kw, lbracket, keywordLike(kw.GetText(), "with")+" (")}
+	for i, it := range items {
+		if it.GetStart() == nil {
+			return nil
+		}
+		edits = append(edits, insertAt(it.GetStart().GetStart(), fmt.Sprintf("{%d} = ", i+1)))
+	}
+	edits = append(edits, replaceSpan(rbracket, rbracket, ")"))
+	return &ast.Fix{Edits: edits}
+}
+
+// ExitTemplateParams records MDL-DEPR009 for `parameters [..]`.
+func (b *Builder) ExitTemplateParams(ctx *parser.TemplateParamsContext) {
+	kw := ctx.PARAMETERS()
+	if kw == nil {
+		return
+	}
+	b.recordDeprecation(deprecation.PositionalTemplateArguments, kw.GetSymbol(), "text template")
+	arr, ok := ctx.ArrayLiteral().(*parser.ArrayLiteralContext)
+	if !ok || arr == nil || arr.LBRACKET() == nil || arr.RBRACKET() == nil {
+		b.fixLastDeprecation(deprecation.PositionalTemplateArguments, nil, "the list is incomplete")
+		return
+	}
+	var items []antlr.ParserRuleContext
+	for _, l := range arr.AllLiteral() {
+		items = append(items, l)
+	}
+	if len(items) == 0 {
+		// `parameters []` binds nothing: the clause goes, with the space before it.
+		if prev := previousTokenStop(ctx); prev >= 0 {
+			edit := ast.TextEdit{Start: prev + 1, Stop: arr.RBRACKET().GetSymbol().GetStop() + 1}
+			b.fixLastDeprecation(deprecation.PositionalTemplateArguments, &ast.Fix{Edits: []ast.TextEdit{edit}}, "")
+		}
+		return
+	}
+	b.fixLastDeprecation(deprecation.PositionalTemplateArguments,
+		numberedListFix(kw.GetSymbol(), arr.LBRACKET().GetSymbol(), items, arr.RBRACKET().GetSymbol()), "")
+}
+
+// previousTokenStop is the rune offset of the last rune before ctx's first
+// token that is not hidden, or -1.
+func previousTokenStop(ctx antlr.ParserRuleContext) int {
+	start := ctx.GetStart()
+	if start == nil || start.GetInputStream() == nil {
+		return -1
+	}
+	return start.GetStart() - 1 - leadingSpace(start)
+}
+
+// leadingSpace counts the whitespace runes right before tok.
+func leadingSpace(tok antlr.Token) int {
+	in := tok.GetInputStream()
+	n := 0
+	for i := tok.GetStart() - 1; i >= 0; i-- {
+		r := in.GetText(i, i)
+		if r != " " && r != "\t" && r != "\n" && r != "\r" {
+			break
+		}
+		n++
+	}
+	return n
+}
+
+// checkTemplateNumbering refuses a `with ({n} = …)` list on a show message or
+// validation feedback whose numbers are not 1..N, each once: the model holds
+// the arguments as a list, so `{3}` with no `{2}` has no place to go.
+func (b *Builder) checkTemplateNumbering(ctx parser.ITemplateParamsContext) {
+	if ctx == nil {
+		return
+	}
+	tp := ctx.(*parser.TemplateParamsContext)
+	if tp.WITH() == nil {
+		return
+	}
+	var nums []int
+	for _, p := range tp.AllTemplateParam() {
+		if n := p.(*parser.TemplateParamContext).NUMBER_LITERAL(); n != nil {
+			var v int
+			fmt.Sscanf(n.GetText(), "%d", &v)
+			nums = append(nums, v)
+		}
+	}
+	sort.Ints(nums)
+	for i, n := range nums {
+		if n != i+1 {
+			b.addError(fmt.Errorf("line %d: the placeholders of a text template are numbered {1} to {%d}, "+
+				"each once; got %v", tp.GetStart().GetLine(), len(nums), nums))
+			return
+		}
+	}
+}
+
+// templateArgsByNumber orders a `with ({n} = …)` list by its numbers, the
+// positional list a show message or validation feedback stores.
+func templateArgsByNumber(params []ast.TemplateParam) []ast.Expression {
+	sorted := append([]ast.TemplateParam(nil), params...)
+	sort.SliceStable(sorted, func(i, j int) bool { return sorted[i].Index < sorted[j].Index })
+	out := make([]ast.Expression, 0, len(sorted))
+	for _, p := range sorted {
+		out = append(out, p.Value)
+	}
+	return out
+}
diff --git a/mdl/visitor/visitor_argument_binding_test.go b/mdl/visitor/visitor_argument_binding_test.go
new file mode 100644
index 0000000000..d5bea24706
--- /dev/null
+++ b/mdl/visitor/visitor_argument_binding_test.go
@@ -0,0 +1,178 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package visitor
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
+)
+
+// R4 (ako/mxcli#751): every call site binds an argument as `Param =
+// expression`, and every text template as `with ({1} = expression)`. Each old
+// spelling must record its code, and build exactly the statement its canonical
+// form builds — the proof that it is an alias and not a change of meaning.
+func TestArgumentBindingAliases(t *testing.T) {
+	const page = "create page M.P (Title: 'P', Layout: Atlas_Core.Atlas_Default) { dataview dv (DataSource: $O) { %s } };"
+	mf := func(body string) string {
+		return "create microflow M.F ($O: M.E, $N: String) begin " + body + " end;"
+	}
+	wf := func(body string) string {
+		return "create workflow M.W parameter $WorkflowContext: M.E begin " + body + " end workflow;"
+	}
+	pg := func(widget string) string { return strings.Replace(page, "%s", widget, 1) }
+	cases := []struct {
+		name, old, canonical string
+		codes                []string
+	}{
+		{"call microflow", mf("call microflow M.G($Order = $O, Force = false);"),
+			mf("call microflow M.G(Order = $O, Force = false);"), []string{deprecation.DollarArgumentName}},
+		{"call nanoflow", mf("$R = call nanoflow M.G($Order = $O);"),
+			mf("$R = call nanoflow M.G(Order = $O);"), []string{deprecation.DollarArgumentName}},
+		{"call java action", mf("$R = call java action M.J($Amount = 1);"),
+			mf("$R = call java action M.J(Amount = 1);"), []string{deprecation.DollarArgumentName}},
+		{"keyword-named parameter is quoted only when it must be", mf("call microflow M.G($Page = $O);"),
+			mf("call microflow M.G(Page = $O);"), []string{deprecation.DollarArgumentName}},
+		{"send rest request", mf("$R = send rest request M.C.Get with ($id = $N);"),
+			mf("$R = send rest request M.C.Get with (id = $N);"), []string{deprecation.DollarArgumentName}},
+		{"show page dollar", mf("show page M.P($Order = $O);"),
+			mf("show page M.P(Order = $O);"), []string{deprecation.DollarArgumentName}},
+		{"show page colon", mf("show page M.P(Order: $O);"),
+			mf("show page M.P(Order = $O);"), []string{deprecation.ColonArgument}},
+		{"button action colon", pg("actionbutton b (Caption: 'Go', Action: call microflow M.G(Order: $currentObject))"),
+			pg("actionbutton b (Caption: 'Go', Action: call microflow M.G(Order = $currentObject))"), []string{deprecation.ColonArgument}},
+		{"button action dollar", pg("actionbutton b (Caption: 'Go', Action: call nanoflow M.G($Order = $currentObject))"),
+			pg("actionbutton b (Caption: 'Go', Action: call nanoflow M.G(Order = $currentObject))"), []string{deprecation.DollarArgumentName}},
+		{"show_page action colon", pg("actionbutton b (Caption: 'Go', Action: show page M.Q(Order: $currentObject))"),
+			pg("actionbutton b (Caption: 'Go', Action: show page M.Q(Order = $currentObject))"), []string{deprecation.ColonArgument}},
+		{"data source colon", pg("listview lv (DataSource: microflow M.DS(Order: $O, Limit: 10)) { }"),
+			pg("listview lv (DataSource: microflow M.DS(Order = $O, Limit = 10)) { }"),
+			[]string{deprecation.ColonArgument, deprecation.ColonArgument}},
+		{"workflow call microflow", wf("call microflow M.G as act1 comment 'Go' with (M.G.Order = '$WorkflowContext');"),
+			wf("call microflow M.G(Order = $WorkflowContext) as act1 comment 'Go';"), []string{deprecation.WorkflowStringArgument}},
+		{"workflow call workflow", wf("call workflow M.Sub comment 'Sub' with (Order = '$WorkflowContext/M.E_Other');"),
+			wf("call workflow M.Sub(Order = $WorkflowContext/M.E_Other) comment 'Sub';"), []string{deprecation.WorkflowStringArgument}},
+		{"workflow expression with a string inside", wf("call microflow M.G with (Label = 'if $WorkflowContext/Name = ''x'' then ''a'' else ''b''');"),
+			wf("call microflow M.G(Label = if $WorkflowContext/Name = 'x' then 'a' else 'b');"), []string{deprecation.WorkflowStringArgument}},
+		{"show message objects", mf("show message 'Hi {1} {2}' type Warning objects [$N, $O/Name] blocking;"),
+			mf("show message 'Hi {1} {2}' type Warning with ({1} = $N, {2} = $O/Name) blocking;"), []string{deprecation.PositionalTemplateArguments}},
+		{"validation feedback objects", mf("validation feedback $O/Name message '{1} is wrong' objects [$N];"),
+			mf("validation feedback $O/Name message '{1} is wrong' with ({1} = $N);"), []string{deprecation.PositionalTemplateArguments}},
+		{"log parameters", mf("log info 'a {1} {2}' parameters ['x', 2];"),
+			mf("log info 'a {1} {2}' with ({1} = 'x', {2} = 2);"), []string{deprecation.PositionalTemplateArguments}},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			old := mustBuild(t, c.old)
+			if got := deprecationCodes(old); !reflect.DeepEqual(got, c.codes) {
+				t.Errorf("old form recorded %v, want %v", got, c.codes)
+			}
+			for _, d := range old.Deprecations {
+				if d.Fix == nil {
+					t.Errorf("%s at line %d has no rewrite: %s", d.Code, d.Line, d.NoFix)
+				}
+			}
+			canon := mustBuild(t, c.canonical)
+			if got := deprecationCodes(canon); len(got) != 0 {
+				t.Errorf("canonical form recorded %v, want none", got)
+			}
+			if !reflect.DeepEqual(old.Statements, canon.Statements) {
+				t.Errorf("the two forms build different statements:\n old:   %#v\n canon: %#v", old.Statements, canon.Statements)
+			}
+		})
+	}
+}
+
+// The canonical workflow argument stores the bare expression's text, exactly
+// what the string form stored.
+func TestWorkflowCallArgumentStoresTheExpression(t *testing.T) {
+	prog := mustBuild(t, "create workflow M.W parameter $WorkflowContext: M.E begin "+
+		"call microflow M.G(Order = $WorkflowContext, Count = 1 + 2); end workflow;")
+	wf := prog.Statements[0].(*ast.CreateWorkflowStmt)
+	cm := wf.Activities[0].(*ast.WorkflowCallMicroflowNode)
+	want := []ast.WorkflowParameterMappingNode{
+		{Parameter: "Order", Expression: "$WorkflowContext"},
+		{Parameter: "Count", Expression: "1 + 2"},
+	}
+	if !reflect.DeepEqual(cm.ParameterMappings, want) {
+		t.Errorf("ParameterMappings = %+v, want %+v", cm.ParameterMappings, want)
+	}
+}
+
+// A workflow string argument whose content is not an expression that reads
+// back as itself keeps its string: the upgrade reports it rather than
+// changing the stored expression.
+func TestWorkflowStringArgumentWithoutBareFormHasNoRewrite(t *testing.T) {
+	for _, arg := range []string{"' $WorkflowContext'", "''", "'$WorkflowContext +'"} {
+		prog := mustBuild(t, "create workflow M.W parameter $WorkflowContext: M.E begin "+
+			"call microflow M.G with (Order = "+arg+"); end workflow;")
+		if len(prog.Deprecations) != 1 || prog.Deprecations[0].Fix != nil || prog.Deprecations[0].NoFix == "" {
+			t.Errorf("%s: deprecations = %+v, want one with no rewrite and a reason", arg, prog.Deprecations)
+		}
+	}
+}
+
+func TestWorkflowCallWithBothArgumentListsIsAnError(t *testing.T) {
+	_, errs := Build("create workflow M.W parameter $WorkflowContext: M.E begin " +
+		"call microflow M.G(Order = $WorkflowContext) with (Order = '$WorkflowContext'); end workflow;")
+	if len(errs) == 0 || !strings.Contains(errs[0].Error(), "two argument lists") {
+		t.Errorf("errs = %v, want the two-lists error", errs)
+	}
+}
+
+// with ({n} = …) on a show message is stored by number, and the numbers must
+// be 1..N: the model holds a list, so a gap has nowhere to go.
+func TestTemplateArgumentsByNumber(t *testing.T) {
+	prog := mustBuild(t, "create microflow M.F ($A: String, $B: String) begin "+
+		"show message '{1} {2}' with ({2} = $B, {1} = $A); end;")
+	sm := prog.Statements[0].(*ast.CreateMicroflowStmt).Body[0].(*ast.ShowMessageStmt)
+	if len(sm.TemplateArgs) != 2 || !strings.Contains(fmtExpr(sm.TemplateArgs[0]), "A") {
+		t.Errorf("TemplateArgs = %#v, want $A then $B", sm.TemplateArgs)
+	}
+	for _, bad := range []string{"with ({1} = $A, {3} = $B)", "with ({1} = $A, {1} = $B)", "with ({2} = $A)"} {
+		_, errs := Build("create microflow M.F ($A: String, $B: String) begin show message 'x' " + bad + "; end;")
+		if len(errs) == 0 || !strings.Contains(errs[0].Error(), "numbered {1}") {
+			t.Errorf("%s: errs = %v, want the numbering error", bad, errs)
+		}
+	}
+}
+
+func fmtExpr(e ast.Expression) string {
+	if v, ok := e.(*ast.VariableExpr); ok {
+		return v.Name
+	}
+	return reflect.ValueOf(e).String()
+}
+
+func TestBareExpression(t *testing.T) {
+	for expr, want := range map[string]bool{
+		"$WorkflowContext":          true,
+		"$WorkflowContext/M.A/Name": true,
+		"1 + 2":                     true,
+		"'a''b'":                    true,
+		"":                          false,
+		" $WorkflowContext":         false,
+		"$WorkflowContext +":        false,
+		"$WorkflowContext; drop x":  false,
+	} {
+		if got := BareExpression(expr); got != want {
+			t.Errorf("BareExpression(%q) = %v, want %v", expr, got, want)
+		}
+	}
+}
+
+func TestParameterNameSpelling(t *testing.T) {
+	for name, want := range map[string]string{
+		"Order": "Order",
+		"Page":  "Page",
+		"with":  "with",
+		"a b":   `"a b"`,
+	} {
+		if got := ParameterNameSpelling(name); got != want {
+			t.Errorf("ParameterNameSpelling(%q) = %q, want %q", name, got, want)
+		}
+	}
+}
diff --git a/mdl/visitor/visitor_association.go b/mdl/visitor/visitor_association.go
index d059f06ad4..a009a72f5b 100644
--- a/mdl/visitor/visitor_association.go
+++ b/mdl/visitor/visitor_association.go
@@ -195,6 +195,7 @@ func anchorCoord(text string) (int, bool) {
 
 // ExitAlterAssociationAction handles ALTER ASSOCIATION ... SET ... actions.
 func (b *Builder) ExitAlterAssociationAction(ctx *parser.AlterAssociationActionContext) {
+	b.recordDeleteBehavior(ctx.DELETE_BEHAVIOR(), ctx.DeleteBehavior())
 	// Walk up to the parent AlterStatement to get the association's qualified name
 	parent := ctx.GetParent()
 	for parent != nil {
diff --git a/mdl/visitor/visitor_deprecations_test.go b/mdl/visitor/visitor_deprecations_test.go
index a75e35ce08..a45260bd32 100644
--- a/mdl/visitor/visitor_deprecations_test.go
+++ b/mdl/visitor/visitor_deprecations_test.go
@@ -79,7 +79,7 @@ var createOrReplaceCases = map[string]string{
 	"layout":                      "layout M.App_Default (layouttype: 'Responsive') { placeholder Main }",
 	"snippet":                     "snippet M.CustomerInfo { dynamictext t (Content: 'x') }",
 	"enumeration":                 "enumeration M.Color (Red 'Red');",
-	"validationrule":              "validation rule for M.Customer.Email regex M.EmailPattern feedback 'Invalid';",
+	"validationrule":              "validation rule for M.Customer.Email regex M.EmailPattern error message 'Invalid';",
 	"databaseconnection":          "database connection M.Erp type 'PostgreSQL' connection string @M.DbUrl username @M.DbUser password @M.DbPass;",
 	"constant":                    "constant M.ApiBaseUrl type String default 'https://api.example.com';",
 	"restclient":                  "rest client M.PetStore (BaseUrl: 'https://petstore.example.com', Authentication: NONE) { };",
diff --git a/mdl/visitor/visitor_entity.go b/mdl/visitor/visitor_entity.go
index 98f23d61ac..6c9b9fcccf 100644
--- a/mdl/visitor/visitor_entity.go
+++ b/mdl/visitor/visitor_entity.go
@@ -675,12 +675,12 @@ func (b *Builder) ExitAlterEntityAction(ctx *parser.AlterEntityActionContext) {
 						stmt.ModifyNotNull = &false_
 					case c.NOT_NULL() != nil || (c.NOT() != nil && c.NULL() != nil) || c.REQUIRED() != nil:
 						stmt.ModifyNotNull = &true_
-						if c.ERROR() != nil && c.STRING_LITERAL() != nil {
+						if c.ConstraintErrorKeyword() != nil && c.STRING_LITERAL() != nil {
 							stmt.ModifyNotNullError = unquoteStringLit(c.STRING_LITERAL())
 						}
 					case c.UNIQUE() != nil:
 						stmt.ModifyUnique = &true_
-						if c.ERROR() != nil && c.STRING_LITERAL() != nil {
+						if c.ConstraintErrorKeyword() != nil && c.STRING_LITERAL() != nil {
 							stmt.ModifyUniqueError = unquoteStringLit(c.STRING_LITERAL())
 						}
 					case c.DEFAULT() != nil:
diff --git a/mdl/visitor/visitor_flow_blocks.go b/mdl/visitor/visitor_flow_blocks.go
new file mode 100644
index 0000000000..5678760c56
--- /dev/null
+++ b/mdl/visitor/visitor_flow_blocks.go
@@ -0,0 +1,83 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package visitor
+
+import (
+	"fmt"
+
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
+	"github.com/mendixlabs/mxcli/mdl/grammar/parser"
+	"github.com/mendixlabs/mxcli/mdl/langver"
+)
+
+// R2 (ADR-0010, ako/mxcli#754): brackets have one meaning each. `( … )` holds
+// an element's properties, `{ … }` its declarative children, and imperative
+// flow is `begin … end <keyword>`. Two microflow blocks broke the rule:
+//
+//   - a custom error handler was the only brace block inside a microflow. Its
+//     canonical form is `on error [without rollback] begin … end error`, and the
+//     brace form is a respelling (MDL-DEPR540) that builds the same handler;
+//   - `while` made `begin` and the `while` after `end` optional, where `loop`
+//     requires both. That is a change of what parses, so it is gated: under
+//     mdl 1 both are required, and a headerless script keeps the old grammar
+//     and warns (MDL-V1-WHILE).
+
+// whileBlockRequired is the new rejection of a `while` without `begin` or
+// without `end while`.
+var whileBlockRequired = langver.Change{
+	Code:  "MDL-V1-WHILE",
+	Since: langver.V1,
+	Old:   "`while <condition>` accepts a body without `begin` and an `end` without `while`",
+	New:   "an error: a while loop is `while <condition> begin … end while;`, like `loop … begin … end loop;`",
+}
+
+// ExitOnErrorClause records MDL-DEPR540 for a custom handler written in braces,
+// with the rewrite to `begin … end error`.
+func (b *Builder) ExitOnErrorClause(ctx *parser.OnErrorClauseContext) {
+	if ctx == nil || ctx.LBRACE() == nil || ctx.RBRACE() == nil {
+		return
+	}
+	lbrace, rbrace := ctx.LBRACE().GetSymbol(), ctx.RBRACE().GetSymbol()
+	b.recordDeprecation(deprecation.OnErrorBraces, lbrace, "")
+	like := ctx.ERROR(0).GetText()
+	b.fixLastDeprecation(deprecation.OnErrorBraces, &ast.Fix{Edits: []ast.TextEdit{
+		{Start: lbrace.GetStart(), Stop: lbrace.GetStop() + 1, Text: keywordLike(like, "begin")},
+		{Start: rbrace.GetStart(), Stop: rbrace.GetStop() + 1, Text: keywordLike(like, "end error")},
+	}}, "")
+}
+
+// ExitWhileStatement applies whileBlockRequired.
+func (b *Builder) ExitWhileStatement(ctx *parser.WhileStatementContext) {
+	if ctx == nil || ctx.END() == nil || ctx.Expression() == nil {
+		return // a syntax error has already been reported
+	}
+	missingBegin, missingWhile := ctx.BEGIN() == nil, len(ctx.AllWHILE()) < 2
+	if !missingBegin && !missingWhile {
+		return
+	}
+	if b.gate(whileBlockRequired, ctx) {
+		var missing string
+		switch {
+		case missingBegin && missingWhile:
+			missing = "`begin` after the condition and `while` after `end`"
+		case missingBegin:
+			missing = "`begin` after the condition"
+		default:
+			missing = "`while` after `end`"
+		}
+		b.addError(fmt.Errorf("line %d: this while loop has no %s: under %s a while loop is "+
+			"`while <condition> begin … end while;`", ctx.GetStart().GetLine(), missing, b.langVersion))
+		return
+	}
+	like := ctx.WHILE(0).GetText()
+	var edits []ast.TextEdit
+	if missingBegin {
+		_, stop := nodeSpan(ctx.Expression())
+		edits = append(edits, insertAt(stop+1, " "+keywordLike(like, "begin")))
+	}
+	if missingWhile {
+		edits = append(edits, insertAt(ctx.END().GetSymbol().GetStop()+1, " "+keywordLike(like, "while")))
+	}
+	b.fixLastNote(whileBlockRequired.Code, &ast.Fix{Edits: edits}, "")
+}
diff --git a/mdl/visitor/visitor_helpers.go b/mdl/visitor/visitor_helpers.go
index 4a3a52f571..4ef945f201 100644
--- a/mdl/visitor/visitor_helpers.go
+++ b/mdl/visitor/visitor_helpers.go
@@ -191,14 +191,14 @@ func buildAttributes(ctx parser.IAttributeDefinitionListContext, b *Builder) []a
 			if c.NOT() != nil && c.NULL() != nil || c.NOT_NULL() != nil {
 				attr.NotNull = true
 				// Extract error message if present
-				if c.ERROR() != nil && c.STRING_LITERAL() != nil {
+				if c.ConstraintErrorKeyword() != nil && c.STRING_LITERAL() != nil {
 					attr.NotNullError = unquoteStringLit(c.STRING_LITERAL())
 				}
 			}
 			if c.UNIQUE() != nil {
 				attr.Unique = true
 				// Extract error message if present
-				if c.ERROR() != nil && c.STRING_LITERAL() != nil {
+				if c.ConstraintErrorKeyword() != nil && c.STRING_LITERAL() != nil {
 					attr.UniqueError = unquoteStringLit(c.STRING_LITERAL())
 				}
 			}
@@ -214,7 +214,7 @@ func buildAttributes(ctx parser.IAttributeDefinitionListContext, b *Builder) []a
 			if c.REQUIRED() != nil {
 				attr.NotNull = true
 				// Extract error message if present
-				if c.ERROR() != nil && c.STRING_LITERAL() != nil {
+				if c.ConstraintErrorKeyword() != nil && c.STRING_LITERAL() != nil {
 					attr.NotNullError = unquoteStringLit(c.STRING_LITERAL())
 				}
 			}
@@ -252,13 +252,13 @@ func buildSingleAttribute(a *parser.AttributeDefinitionContext) *ast.Attribute {
 		c := constraintCtx.(*parser.AttributeConstraintContext)
 		if c.NOT() != nil && c.NULL() != nil || c.NOT_NULL() != nil {
 			attr.NotNull = true
-			if c.ERROR() != nil && c.STRING_LITERAL() != nil {
+			if c.ConstraintErrorKeyword() != nil && c.STRING_LITERAL() != nil {
 				attr.NotNullError = unquoteStringLit(c.STRING_LITERAL())
 			}
 		}
 		if c.UNIQUE() != nil {
 			attr.Unique = true
-			if c.ERROR() != nil && c.STRING_LITERAL() != nil {
+			if c.ConstraintErrorKeyword() != nil && c.STRING_LITERAL() != nil {
 				attr.UniqueError = unquoteStringLit(c.STRING_LITERAL())
 			}
 		}
@@ -272,7 +272,7 @@ func buildSingleAttribute(a *parser.AttributeDefinitionContext) *ast.Attribute {
 		}
 		if c.REQUIRED() != nil {
 			attr.NotNull = true
-			if c.ERROR() != nil && c.STRING_LITERAL() != nil {
+			if c.ConstraintErrorKeyword() != nil && c.STRING_LITERAL() != nil {
 				attr.NotNullError = unquoteStringLit(c.STRING_LITERAL())
 			}
 		}
diff --git a/mdl/visitor/visitor_microflow_actions.go b/mdl/visitor/visitor_microflow_actions.go
index 6c3559f464..7b3cc39ea0 100644
--- a/mdl/visitor/visitor_microflow_actions.go
+++ b/mdl/visitor/visitor_microflow_actions.go
@@ -1241,14 +1241,20 @@ func buildShowPageArgList(ctx parser.IShowPageArgListContext) []ast.ShowPageArg
 		arg := argCtx.(*parser.ShowPageArgContext)
 		spa := ast.ShowPageArg{}
 
-		if iok := arg.IdentifierOrKeyword(); iok != nil {
-			// Widget-style: Param: $value
+		if pn := arg.ParameterName(); pn != nil {
+			// Canonical (R4): Param = $value
+			spa.ParamName = parameterNameText(pn)
+			if expr := arg.Expression(); expr != nil {
+				spa.Value = buildSourceExpression(expr)
+			}
+		} else if iok := arg.IdentifierOrKeyword(); iok != nil {
+			// Deprecated (MDL-DEPR007): Param: $value
 			spa.ParamName = identifierOrKeywordText(iok)
 			if expr := arg.Expression(); expr != nil {
 				spa.Value = buildSourceExpression(expr)
 			}
 		} else {
-			// Canonical: $Param = $value
+			// Deprecated (MDL-DEPR006): $Param = $value
 			vars := arg.AllVARIABLE()
 			if len(vars) >= 1 {
 				spa.ParamName = strings.TrimPrefix(vars[0].GetText(), "$")
@@ -1286,7 +1292,11 @@ func buildShowMessageStatement(ctx parser.IShowMessageStatementContext) *ast.Sho
 		stmt.Type = id.GetText()
 	}
 
-	// Build template arguments (optional)
+	// Build template arguments (optional): `with ({1} = e)`, or the deprecated
+	// positional `objects [e]` (MDL-DEPR009).
+	if tp := smCtx.TemplateParams(); tp != nil {
+		stmt.TemplateArgs = templateArgsByNumber(buildTemplateParams(tp))
+	}
 	if exprList := smCtx.ExpressionList(); exprList != nil {
 		listCtx := exprList.(*parser.ExpressionListContext)
 		allExprs := listCtx.AllExpression()
@@ -1380,7 +1390,11 @@ func buildValidationFeedbackStatement(ctx parser.IValidationFeedbackStatementCon
 		stmt.Message = buildSourceExpression(msgExpr)
 	}
 
-	// Build template arguments (optional)
+	// Build template arguments (optional): `with ({1} = e)`, or the deprecated
+	// positional `objects [e]` (MDL-DEPR009).
+	if tp := vfCtx.TemplateParams(); tp != nil {
+		stmt.TemplateArgs = templateArgsByNumber(buildTemplateParams(tp))
+	}
 	if exprList := vfCtx.ExpressionList(); exprList != nil {
 		listCtx := exprList.(*parser.ExpressionListContext)
 		allExprs := listCtx.AllExpression()
@@ -1678,6 +1692,8 @@ func buildSendRestRequestStatement(ctx parser.ISendRestRequestStatementContext)
 			param := ast.SendRestParamDef{}
 			if v := pc.VARIABLE(); v != nil {
 				param.Name = strings.TrimPrefix(v.GetText(), "$")
+			} else if pn := pc.ParameterName(); pn != nil {
+				param.Name = parameterNameText(pn)
 			}
 			if expr := pc.Expression(); expr != nil {
 				param.Expression = expressionSourceText(expr)
diff --git a/mdl/visitor/visitor_microflow_expression.go b/mdl/visitor/visitor_microflow_expression.go
index 3d32c4efde..b032c8a38a 100644
--- a/mdl/visitor/visitor_microflow_expression.go
+++ b/mdl/visitor/visitor_microflow_expression.go
@@ -256,6 +256,9 @@ func buildMultiplicativeExpression(ctx parser.IMultiplicativeExpressionContext)
 				result = pathExpr
 				continue
 			}
+			if attachPathToLastOperand(result, right) {
+				continue
+			}
 		}
 
 		result = &ast.BinaryExpr{
@@ -268,6 +271,32 @@ func buildMultiplicativeExpression(ctx parser.IMultiplicativeExpressionContext)
 	return result
 }
 
+// attachPathToLastOperand makes `/ Member` a member step of the operand it
+// belongs to when a multiplicative operator came first. `/` shares a precedence
+// level with `*`, `div` and `mod`, so `$a/X * $b/Y` is parsed left to right as
+// `(($a/X) * $b) / Y`: by the time the `/` is seen, `$b` is already the right
+// operand of the product, and tryBuildAttributePath (which looks at the whole left
+// side) cannot reach it. Mendix has no `/` division — it is always navigation
+// when a member name follows — so the step moves onto `$b`, giving
+// `$a/X * ($b/Y)`, the tree the source means. Reports whether the step was
+// attached.
+func attachPathToLastOperand(left ast.Expression, right ast.Expression) bool {
+	bin, ok := left.(*ast.BinaryExpr)
+	if !ok {
+		return false
+	}
+	switch bin.Operator {
+	case "*", "div", "mod", "%", ":":
+	default:
+		return false
+	}
+	if pathExpr := tryBuildAttributePath(bin.Right, right); pathExpr != nil {
+		bin.Right = pathExpr
+		return true
+	}
+	return false
+}
+
 // tryBuildAttributePath attempts to build an AttributePathExpr from a left expression
 // and a right identifier. Returns nil if not an XPath-style path.
 func tryBuildAttributePath(left ast.Expression, right ast.Expression) *ast.AttributePathExpr {
diff --git a/mdl/visitor/visitor_microflow_statements.go b/mdl/visitor/visitor_microflow_statements.go
index 93177a2ced..aaa2b61a0c 100644
--- a/mdl/visitor/visitor_microflow_statements.go
+++ b/mdl/visitor/visitor_microflow_statements.go
@@ -648,10 +648,13 @@ func buildOnErrorClause(ctx parser.IOnErrorClauseContext) *ast.ErrorHandlingClau
 	if errCtx.CONTINUE() != nil {
 		return &ast.ErrorHandlingClause{Type: ast.ErrorHandlingContinue}
 	}
-	if errCtx.ROLLBACK() != nil && errCtx.LBRACE() == nil {
+	custom := errCtx.BEGIN() != nil || errCtx.LBRACE() != nil
+	if errCtx.ROLLBACK() != nil && !custom {
 		return &ast.ErrorHandlingClause{Type: ast.ErrorHandlingRollback}
 	}
-	if errCtx.LBRACE() != nil {
+	// `begin … end error` and its deprecated brace spelling (MDL-DEPR540,
+	// recorded by ExitOnErrorClause) build the same handler.
+	if custom {
 		body := buildMicroflowBody(errCtx.MicroflowBody())
 		if errCtx.WITHOUT() != nil {
 			return &ast.ErrorHandlingClause{Type: ast.ErrorHandlingCustomWithoutRollback, Body: body}
diff --git a/mdl/visitor/visitor_page_v3.go b/mdl/visitor/visitor_page_v3.go
index 99815096e2..9baa27d7f5 100644
--- a/mdl/visitor/visitor_page_v3.go
+++ b/mdl/visitor/visitor_page_v3.go
@@ -1089,9 +1089,13 @@ func buildActionV3(ctx parser.IActionExprV3Context) *ast.ActionV3 {
 	actCtx := ctx.(*parser.ActionExprV3Context)
 	action := &ast.ActionV3{}
 
-	if v := actCtx.VARIABLE(); v != nil && actCtx.OPEN_LINK() == nil {
+	// Each page action has a canonical spelling in words and a deprecated
+	// snake-case one (R8, ako/mxcli#752); both build the same action, and
+	// ExitActionExprV3 reports the old one.
+	closePage := actCtx.ClosePageV3() != nil
+	if v := actCtx.VARIABLE(); v != nil && actCtx.OpenLinkV3() == nil {
 		// $handler — a fragment action parameter; resolved at expansion.
-		// (OPEN_LINK $currentObject/Attr also carries a VARIABLE.)
+		// (open link $currentObject/Attr also carries a VARIABLE.)
 		action.Type = "param"
 		action.Target = strings.TrimPrefix(v.GetText(), "$")
 	} else if actCtx.NOTHING() != nil {
@@ -1103,18 +1107,16 @@ func buildActionV3(ctx parser.IActionExprV3Context) *ast.ActionV3 {
 		action.Type = "none"
 	} else if actCtx.SAVE_CHANGES() != nil {
 		action.Type = "save"
-		action.ClosePage = actCtx.CLOSE_PAGE() != nil
+		action.ClosePage = closePage
 	} else if actCtx.CANCEL_CHANGES() != nil {
 		action.Type = "cancel"
-		action.ClosePage = actCtx.CLOSE_PAGE() != nil
-	} else if actCtx.CLOSE_PAGE() != nil && actCtx.SAVE_CHANGES() == nil && actCtx.CANCEL_CHANGES() == nil {
-		action.Type = "close"
-	} else if actCtx.DELETE_OBJECT() != nil {
-		action.Type = "delete"
-	} else if actCtx.DELETE() != nil {
+		action.ClosePage = closePage
+	} else if actCtx.DELETE_OBJECT() != nil || actCtx.DELETE() != nil {
 		action.Type = "delete"
-		action.ClosePage = actCtx.CLOSE_PAGE() != nil
-	} else if actCtx.CREATE_OBJECT() != nil {
+		action.ClosePage = closePage
+	} else if closePage {
+		action.Type = "close"
+	} else if actCtx.CREATE_OBJECT() != nil || actCtx.CREATE() != nil {
 		action.Type = "create"
 		if qn := actCtx.QualifiedName(); qn != nil {
 			action.Target = getQualifiedNameText(qn)
@@ -1123,7 +1125,7 @@ func buildActionV3(ctx parser.IActionExprV3Context) *ast.ActionV3 {
 		if thenCtx := actCtx.ActionExprV3(); thenCtx != nil {
 			action.ThenAction = buildActionV3(thenCtx)
 		}
-	} else if actCtx.SHOW_PAGE() != nil {
+	} else if actCtx.SHOW_PAGE() != nil || actCtx.SHOW() != nil {
 		action.Type = "showPage"
 		if qn := actCtx.QualifiedName(); qn != nil {
 			action.Target = getQualifiedNameText(qn)
@@ -1147,12 +1149,12 @@ func buildActionV3(ctx parser.IActionExprV3Context) *ast.ActionV3 {
 		if argsCtx := actCtx.MicroflowArgsV3(); argsCtx != nil {
 			action.Args = buildMicroflowArgsV3(argsCtx)
 		}
-	} else if actCtx.OPEN_LINK() != nil {
+	} else if actCtx.OpenLinkV3() != nil {
 		action.Type = "openLink"
 		if str := actCtx.STRING_LITERAL(); str != nil {
 			action.LinkURL = unquoteStringLit(str)
 		}
-		// A dynamic address: `open_link $currentObject/URL`.
+		// A dynamic address: `open link $currentObject/URL`.
 		if v := actCtx.VARIABLE(); v != nil {
 			action.LinkVariable = v.GetText()
 			if pathCtx := actCtx.AttributePathV3(); pathCtx != nil {
@@ -1192,11 +1194,14 @@ func buildMicroflowArgV3(ctx parser.IMicroflowArgV3Context) ast.FlowArgV3 {
 	argCtx := ctx.(*parser.MicroflowArgV3Context)
 	arg := ast.FlowArgV3{}
 
-	if v := argCtx.VARIABLE(); v != nil {
-		// Microflow-style: $Param = $value
+	if pn := argCtx.ParameterName(); pn != nil {
+		// Canonical (R4): Param = $value
+		arg.Name = parameterNameText(pn)
+	} else if v := argCtx.VARIABLE(); v != nil {
+		// Deprecated (MDL-DEPR006): $Param = $value
 		arg.Name = strings.TrimPrefix(v.GetText(), "$")
 	} else if iok := argCtx.IdentifierOrKeyword(); iok != nil {
-		// Widget-style: Param: $value. identifierOrKeyword accepts a bare
+		// Deprecated (MDL-DEPR007): Param: $value. identifierOrKeyword accepts a bare
 		// keyword (View/Source/Item/Page/Entity) or a "quoted" name;
 		// identifierOrKeywordText unquotes as needed.
 		arg.Name = identifierOrKeywordText(iok)
diff --git a/mdl/visitor/visitor_r8_spellings.go b/mdl/visitor/visitor_r8_spellings.go
new file mode 100644
index 0000000000..21b9b44ffb
--- /dev/null
+++ b/mdl/visitor/visitor_r8_spellings.go
@@ -0,0 +1,180 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package visitor
+
+import (
+	"strings"
+
+	"github.com/antlr4-go/antlr/v4"
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
+	"github.com/mendixlabs/mxcli/mdl/grammar/parser"
+)
+
+// R8 (PROPOSAL_mdl_beta_syntax_freeze.md §3, ako/mxcli#752): words, not
+// SCREAMING_SNAKE, and one spelling per keyword. Every old spelling here is a
+// respelling — the grammar builds the same statement from both — so each use
+// is recorded as a deprecation with the edit that rewrites it, and nothing is
+// gated on the language version.
+
+// recordRespelling records code at tok with a fix that replaces tok's text.
+// The subject names the use and its rewrite (`show_page -> show page`), since
+// the registry entry covers a family of spellings.
+func (b *Builder) recordRespelling(code string, tok antlr.Token, text string) {
+	if tok == nil {
+		return
+	}
+	b.recordDeprecation(code, tok, tok.GetText()+" -> "+text)
+	b.fixLastDeprecation(code, &ast.Fix{Edits: []ast.TextEdit{{Start: tok.GetStart(), Stop: tok.GetStop() + 1, Text: text}}}, "")
+}
+
+// recordSnakeWord records a page-action token spelled with an underscore
+// (`save_changes`), whose canonical spelling is the same words with a space.
+// The lexer tokens that admit both spellings are told apart by the underscore.
+func (b *Builder) recordSnakeWord(n antlr.TerminalNode) {
+	if n == nil {
+		return
+	}
+	tok := n.GetSymbol()
+	if text := tok.GetText(); strings.Contains(text, "_") {
+		b.recordRespelling(deprecation.PageActionWord, tok, strings.ReplaceAll(text, "_", " "))
+	}
+}
+
+// ExitActionExprV3 reports a page action written in its snake-case spelling,
+// or a flow call written without `call`.
+func (b *Builder) ExitActionExprV3(ctx *parser.ActionExprV3Context) {
+	for _, n := range []antlr.TerminalNode{ctx.SAVE_CHANGES(), ctx.CANCEL_CHANGES(), ctx.SHOW_PAGE(),
+		ctx.CREATE_OBJECT(), ctx.SIGN_OUT(), ctx.COMPLETE_TASK()} {
+		b.recordSnakeWord(n)
+	}
+	if n := ctx.DELETE_OBJECT(); n != nil {
+		tok := n.GetSymbol()
+		b.recordRespelling(deprecation.PageActionWord, tok, keywordLike(tok.GetText(), "delete"))
+	}
+	if ctx.CALL() == nil {
+		for _, n := range []antlr.TerminalNode{ctx.MICROFLOW(), ctx.NANOFLOW()} {
+			if n == nil {
+				continue
+			}
+			tok := n.GetSymbol()
+			b.recordDeprecation(deprecation.PageActionWord, tok, tok.GetText()+" -> "+keywordLike(tok.GetText(), "call")+" "+tok.GetText())
+			b.fixLastDeprecation(deprecation.PageActionWord,
+				&ast.Fix{Edits: []ast.TextEdit{insertAt(tok.GetStart(), keywordLike(tok.GetText(), "call")+" ")}}, "")
+		}
+	}
+}
+
+// ExitClosePageV3 reports `close_page`.
+func (b *Builder) ExitClosePageV3(ctx *parser.ClosePageV3Context) {
+	b.recordSnakeWord(ctx.CLOSE_PAGE())
+}
+
+// ExitOpenLinkV3 reports `open_link`.
+func (b *Builder) ExitOpenLinkV3(ctx *parser.OpenLinkV3Context) { b.recordSnakeWord(ctx.OPEN_LINK()) }
+
+// ExitNavMenuItemDef reports a menu item's `sign_out`: menus use the page
+// action vocabulary.
+func (b *Builder) ExitNavMenuItemDef(ctx *parser.NavMenuItemDefContext) {
+	b.recordSnakeWord(ctx.SIGN_OUT())
+}
+
+// errorMessageWord is the canonical spelling of the message keyword, in the
+// letter case of the spelling it replaces.
+func errorMessageWord(like string) string { return keywordLike(like, "error message") }
+
+// recordErrorMessageToken reports an ERROR_MESSAGE token spelled `error_message`
+// or `errormessage`. Only where the token is the message keyword: an attribute
+// or key named ErrorMessage lexes as the same token.
+func (b *Builder) recordErrorMessageToken(n antlr.TerminalNode, subject string) {
+	if n == nil {
+		return
+	}
+	tok := n.GetSymbol()
+	if text := tok.GetText(); !strings.ContainsAny(text, " \t\r\n") {
+		b.recordRespelling(deprecation.ErrorMessageKeyword, tok, errorMessageWord(text))
+	}
+}
+
+// ExitConstraintErrorKeyword reports `not null error '…'` (and after unique
+// and required).
+func (b *Builder) ExitConstraintErrorKeyword(ctx *parser.ConstraintErrorKeywordContext) {
+	if n := ctx.ERROR(); n != nil {
+		tok := n.GetSymbol()
+		b.recordRespelling(deprecation.ErrorMessageKeyword, tok, errorMessageWord(tok.GetText()))
+		return
+	}
+	b.recordErrorMessageToken(ctx.ERROR_MESSAGE(), "attribute constraint")
+}
+
+// ExitErrorMessageClause reports an association's `error_message '…'`.
+func (b *Builder) ExitErrorMessageClause(ctx *parser.ErrorMessageClauseContext) {
+	b.recordErrorMessageToken(ctx.ERROR_MESSAGE(), "association")
+}
+
+// ExitMicroflowConcurrencyError reports `disallow concurrent execution
+// error_message '…'`.
+func (b *Builder) ExitMicroflowConcurrencyError(ctx *parser.MicroflowConcurrencyErrorContext) {
+	b.recordErrorMessageToken(ctx.ERROR_MESSAGE(), "microflow")
+}
+
+// recordValidationRuleFeedback reports a validation rule's `feedback '…'`.
+func (b *Builder) recordValidationRuleFeedback(ctx *parser.CreateValidationRuleStatementContext) {
+	if n := ctx.FEEDBACK(); n != nil {
+		tok := n.GetSymbol()
+		b.recordRespelling(deprecation.ErrorMessageKeyword, tok, errorMessageWord(tok.GetText()))
+		return
+	}
+	b.recordErrorMessageToken(ctx.ERROR_MESSAGE(), "validation rule")
+}
+
+// onDeleteFor is the `on delete` action a delete_behavior behaviour means; the
+// mapping is buildDeleteBehavior's, read against buildReferentialAction.
+func onDeleteFor(ctx parser.IDeleteBehaviorContext) string {
+	db, ok := ctx.(*parser.DeleteBehaviorContext)
+	if !ok {
+		return ""
+	}
+	switch {
+	case db.CASCADE() != nil, db.DELETE_AND_REFERENCES() != nil:
+		return "on delete cascade"
+	case db.PREVENT() != nil, db.DELETE_IF_NO_REFERENCES() != nil:
+		return "on delete restrict"
+	case db.DELETE_BUT_KEEP_REFERENCES() != nil:
+		return "on delete set null"
+	}
+	return ""
+}
+
+// recordDeleteBehavior reports `delete_behavior <behaviour>`, rewritten to the
+// `on delete` action that means the same.
+func (b *Builder) recordDeleteBehavior(kw antlr.TerminalNode, behaviour parser.IDeleteBehaviorContext) {
+	if kw == nil || behaviour == nil {
+		return
+	}
+	tok := kw.GetSymbol()
+	action := onDeleteFor(behaviour)
+	b.recordDeprecation(deprecation.DeleteBehaviorClause, tok, "-> "+action)
+	if action == "" || behaviour.GetStop() == nil {
+		b.fixLastDeprecation(deprecation.DeleteBehaviorClause, nil, "unrecognised delete behaviour")
+		return
+	}
+	edit := replaceSpan(tok, behaviour.GetStop(), keywordLike(tok.GetText(), action))
+	b.fixLastDeprecation(deprecation.DeleteBehaviorClause, &ast.Fix{Edits: []ast.TextEdit{edit}}, "")
+}
+
+// ExitAssociationOption reports `delete_behavior …` and `reference_set`.
+func (b *Builder) ExitAssociationOption(ctx *parser.AssociationOptionContext) {
+	b.recordDeleteBehavior(ctx.DELETE_BEHAVIOR(), ctx.DeleteBehavior())
+	if n := ctx.REFERENCE_SET(); n != nil && strings.Contains(n.GetText(), "_") {
+		b.recordRespelling(deprecation.ReferenceSetUnderscore, n.GetSymbol(), "ReferenceSet")
+	}
+}
+
+// ExitRestCallReturnsClause reports `returns none`. The registry entry is a
+// keyword swap, so no per-use fix is attached.
+func (b *Builder) ExitRestCallReturnsClause(ctx *parser.RestCallReturnsClauseContext) {
+	if n := ctx.NONE(); n != nil {
+		b.recordDeprecation(deprecation.ReturnsNone, n.GetSymbol(), "rest call")
+	}
+}
diff --git a/mdl/visitor/visitor_settings.go b/mdl/visitor/visitor_settings.go
index 708e26a267..94044d58e4 100644
--- a/mdl/visitor/visitor_settings.go
+++ b/mdl/visitor/visitor_settings.go
@@ -4,6 +4,7 @@ package visitor
 
 import (
 	"strconv"
+	"strings"
 
 	"github.com/mendixlabs/mxcli/mdl/ast"
 	"github.com/mendixlabs/mxcli/mdl/grammar/parser"
@@ -69,7 +70,7 @@ func (b *Builder) ExitAlterSettingsClause(ctx *parser.AlterSettingsClauseContext
 		// ALTER SETTINGS WORKFLOWS ADD [OR MODIFY] GROUP 'Approvers' [( Description: '…' )]
 		// ALTER SETTINGS WORKFLOWS MODIFY          GROUP 'Approvers'  ( Description: '…' )
 		// ALTER SETTINGS WORKFLOWS REMOVE          GROUP 'Approvers'
-		stmt.Section = ctx.SettingsSection().GetText()
+		stmt.Section = strings.ToLower(ctx.SettingsSection().GetText())
 		stmt.UpsertGroup = ctx.ADD() != nil && ctx.OR() != nil && ctx.MODIFY() != nil
 		stmt.AddGroup = ctx.ADD() != nil && !stmt.UpsertGroup
 		stmt.ModifyGroup = ctx.MODIFY() != nil && !stmt.UpsertGroup
@@ -82,7 +83,7 @@ func (b *Builder) ExitAlterSettingsClause(ctx *parser.AlterSettingsClauseContext
 		// ALTER SETTINGS LANGUAGE ADD    'ar_SD' [( key: value, … )]
 		// ALTER SETTINGS LANGUAGE MODIFY 'ar_SD'  ( key: value, … )
 		// ALTER SETTINGS LANGUAGE REMOVE 'ar_SD'
-		stmt.Section = ctx.SettingsSection().GetText()
+		stmt.Section = strings.ToLower(ctx.SettingsSection().GetText())
 		stmt.UpsertLanguage = ctx.ADD() != nil && ctx.OR() != nil && ctx.MODIFY() != nil
 		stmt.AddLanguage = ctx.ADD() != nil && !stmt.UpsertLanguage
 		stmt.ModifyLanguage = ctx.MODIFY() != nil && !stmt.UpsertLanguage
@@ -93,7 +94,7 @@ func (b *Builder) ExitAlterSettingsClause(ctx *parser.AlterSettingsClauseContext
 		collectSettingsItemOptions(ctx.SettingsItemOptions(), stmt.Properties)
 	} else if ctx.SettingsSection() != nil {
 		// ALTER SETTINGS MODEL|LANGUAGE|WORKFLOWS Key = Value, ...
-		stmt.Section = ctx.SettingsSection().GetText()
+		stmt.Section = strings.ToLower(ctx.SettingsSection().GetText())
 		for _, assignCtx := range ctx.AllSettingsAssignment() {
 			assign, ok := assignCtx.(*parser.SettingsAssignmentContext)
 			if !ok || assign == nil {
diff --git a/mdl/visitor/visitor_settings_test.go b/mdl/visitor/visitor_settings_test.go
index 071c4f3ddc..bb5b7e98ce 100644
--- a/mdl/visitor/visitor_settings_test.go
+++ b/mdl/visitor/visitor_settings_test.go
@@ -38,7 +38,7 @@ func TestAlterSettings_Model(t *testing.T) {
 	if !ok {
 		t.Fatalf("Expected AlterSettingsStmt, got %T", prog.Statements[0])
 	}
-	if stmt.Section != "MODEL" {
+	if stmt.Section != "model" {
 		t.Errorf("Got Section %q", stmt.Section)
 	}
 	if stmt.Properties["DefaultLanguage"] != "en_US" {
diff --git a/mdl/visitor/visitor_silent_drops.go b/mdl/visitor/visitor_silent_drops.go
index 5342b2e6de..b948723e32 100644
--- a/mdl/visitor/visitor_silent_drops.go
+++ b/mdl/visitor/visitor_silent_drops.go
@@ -34,7 +34,7 @@ func ctxPos(ctx antlr.ParserRuleContext) string {
 func (b *Builder) ExitThrowStatement(ctx *parser.ThrowStatementContext) {
 	b.addError(fmt.Errorf("%s: `throw` is not a Mendix action and was never written to the microflow — "+
 		"it was parsed and dropped.\n"+
-		"  Inside an `on error { … }` handler, re-raise the error being handled:\n"+
+		"  Inside an `on error begin … end error` handler, re-raise the error being handled:\n"+
 		"    raise error;\n"+
 		"  On the main flow Mendix has no throw: call a Java action that throws, or\n"+
 		"  report the problem with `validation feedback` / `log error` and return.", ctxPos(ctx)))
diff --git a/mdl/visitor/visitor_upgrade_fixes.go b/mdl/visitor/visitor_upgrade_fixes.go
index 1f590647c1..e1dd49e9de 100644
--- a/mdl/visitor/visitor_upgrade_fixes.go
+++ b/mdl/visitor/visitor_upgrade_fixes.go
@@ -30,7 +30,7 @@ import (
 func LanguageChanges() []langver.Change {
 	return []langver.Change{
 		semicolonRequired, slashIsNotATerminator, backslashIsLiteral, limitOneIsAList,
-		listCallForm, setIsMandatory, viewEntityReplaceIsModify, roleReplaceIsModify,
+		listCallForm, setIsMandatory, viewEntityReplaceIsModify, roleReplaceIsModify, whileBlockRequired,
 		unknownPropertyKey, misshapedPropertyValue,
 	}
 }
diff --git a/mdl/visitor/visitor_validationrule.go b/mdl/visitor/visitor_validationrule.go
index 0a34b03a5f..ba39ec9bae 100644
--- a/mdl/visitor/visitor_validationrule.go
+++ b/mdl/visitor/visitor_validationrule.go
@@ -8,8 +8,9 @@ import (
 )
 
 // ExitCreateValidationRuleStatement builds a CreateValidationRuleStmt from
-// CREATE VALIDATION RULE FOR Module.Entity.Attribute <constraint> FEEDBACK '...'.
+// CREATE VALIDATION RULE FOR Module.Entity.Attribute <constraint> error message '...' (`feedback '...'` is the deprecated spelling).
 func (b *Builder) ExitCreateValidationRuleStatement(ctx *parser.CreateValidationRuleStatementContext) {
+	b.recordValidationRuleFeedback(ctx)
 	stmt := &ast.CreateValidationRuleStmt{
 		Attribute: buildQualifiedName(ctx.QualifiedName()),
 	}
diff --git a/mdl/visitor/visitor_workflow.go b/mdl/visitor/visitor_workflow.go
index f236c3397e..595c4ca161 100644
--- a/mdl/visitor/visitor_workflow.go
+++ b/mdl/visitor/visitor_workflow.go
@@ -677,7 +677,10 @@ func buildWorkflowCallMicroflow(ctx parser.IWorkflowCallMicroflowStmtContext) *a
 	}
 
 	// Parameter mappings (Issue #10)
-	node.ParameterMappings = buildWorkflowParameterMappings(cmCtx.AllWorkflowParameterMapping())
+	node.ParameterMappings = buildWorkflowCallArguments(cmCtx.WorkflowCallArguments())
+	if len(node.ParameterMappings) == 0 {
+		node.ParameterMappings = buildWorkflowParameterMappings(cmCtx.AllWorkflowParameterMapping())
+	}
 
 	// BoundaryEvents (Issue #7)
 	for _, beCtx := range cmCtx.AllWorkflowBoundaryEventClause() {
@@ -743,7 +746,10 @@ func buildWorkflowCallWorkflow(ctx parser.IWorkflowCallWorkflowStmtContext) *ast
 	}
 
 	// Parameter mappings
-	node.ParameterMappings = buildWorkflowParameterMappings(cwCtx.AllWorkflowParameterMapping())
+	node.ParameterMappings = buildWorkflowCallArguments(cwCtx.WorkflowCallArguments())
+	if len(node.ParameterMappings) == 0 {
+		node.ParameterMappings = buildWorkflowParameterMappings(cwCtx.AllWorkflowParameterMapping())
+	}
 
 	return node
 }