From 94a3b6bb4dbff189f1a7fd2a413b8c5482f041a3 Mon Sep 17 00:00:00 2001
From: Ako <andrej@koelewijn.net>
Date: Mon, 28 Sep 2026 05:08:17 +0000
Subject: [PATCH 01/35] mdl: R2 brackets for integration documents (properties
 in ( ), children in { })

REST client operations and agent attachments take their properties in ( );
image collections and message definition collections put their children in
{ }. The old spellings keep parsing as registered deprecated aliases
MDL-DEPR070..073, recorded once per statement, with fmt --upgrade rewrites.
describe emits the canonical forms.

Part of #754.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 mdl/deprecation/deprecation.go            |  69 ++++++++
 mdl/executor/cmd_agenteditor_agents.go    |  18 +-
 mdl/executor/cmd_imagecollections.go      |  12 +-
 mdl/executor/cmd_messagedefinitions.go    |  27 ++-
 mdl/executor/cmd_misc.go                  |   3 +-
 mdl/executor/cmd_rest_clients.go          |   6 +-
 mdl/executor/r2_children_describe_test.go | 141 +++++++++++++++
 mdl/grammar/domains/MDLAgent.g4           |  23 ++-
 mdl/grammar/domains/MDLDomainModel.g4     |  50 ++++--
 mdl/grammar/domains/MDLService.g4         |   6 +-
 mdl/upgrade/r2_children_test.go           |  84 +++++++++
 mdl/visitor/r2_children_test.go           | 205 ++++++++++++++++++++++
 mdl/visitor/visitor_deprecations_test.go  |   2 +-
 mdl/visitor/visitor_imagecollection.go    |  44 ++++-
 mdl/visitor/visitor_messagedefinition.go  |  32 ++--
 mdl/visitor/visitor_r2_children.go        | 106 +++++++++++
 16 files changed, 751 insertions(+), 77 deletions(-)
 create mode 100644 mdl/executor/r2_children_describe_test.go
 create mode 100644 mdl/upgrade/r2_children_test.go
 create mode 100644 mdl/visitor/r2_children_test.go
 create mode 100644 mdl/visitor/visitor_r2_children.go

diff --git a/mdl/deprecation/deprecation.go b/mdl/deprecation/deprecation.go
index 36f7f253e2..c3be1bfcc1 100644
--- a/mdl/deprecation/deprecation.go
+++ b/mdl/deprecation/deprecation.go
@@ -157,6 +157,22 @@ const (
 	// on a text template: the placeholders bound by position (R4,
 	// ako/mxcli#751).
 	PositionalTemplateArguments = "MDL-DEPR009"
+
+	// Codes 070-079 are R2's integration documents (ako/mxcli#754): properties
+	// in ( ), declarative children in { }.
+
+	// RestOperationBraces is a consumed REST service's `operation X { … }`:
+	// the operation's properties in braces.
+	RestOperationBraces = "MDL-DEPR070"
+	// AgentAttachmentBraces is an agent's `tool X { … }`, `mcp service M.S
+	// { … }` or `knowledge base K { … }`: the attachment's properties in braces.
+	AgentAttachmentBraces = "MDL-DEPR071"
+	// ImageCollectionParens is an image collection's images in parentheses,
+	// each written `image X from file '…'`.
+	ImageCollectionParens = "MDL-DEPR072"
+	// MessageTreeParens is a message definition collection's definitions and
+	// member trees in parentheses.
+	MessageTreeParens = "MDL-DEPR073"
 )
 
 // entries is the registry. Append only: a code is never reused or renumbered,
@@ -374,6 +390,59 @@ var entries = []Entry{
 
 func init() {
 	entries = append(entries, r8Entries...)
+	entries = append(entries, r2Entries...)
+}
+
+// r2Entries are R2's integration-document brackets (ako/mxcli#754).
+var r2Entries = []Entry{
+	{
+		Code:      RestOperationBraces,
+		Old:       "operation X { Method: get, … }",
+		Canonical: "operation X ( Method: get, … )",
+		Rewrite:   Rewrite{Structural: "the operation's braces become parentheses"},
+		RemovedIn: 2,
+		Note: "An operation is a child of the service: its properties are in ( ) like every child's, " +
+			"and { } holds children (R2). A body or response mapping keeps its { } tree.",
+		Example: "create consumed rest service M.Api (BaseUrl: 'https://x', Authentication: none) " +
+			"{ operation GetUser { Method: get, Path: '/u', Response: none } };",
+		CanonicalExample: "create consumed rest service M.Api (BaseUrl: 'https://x', Authentication: none) " +
+			"{ operation GetUser ( Method: get, Path: '/u', Response: none ) };",
+	},
+	{
+		Code:      AgentAttachmentBraces,
+		Old:       "tool X { … } / mcp service M.S { … } / knowledge base K { … }",
+		Canonical: "tool X ( … ) / mcp service M.S ( … ) / knowledge base K ( … )",
+		Rewrite:   Rewrite{Structural: "the attachment's braces become parentheses"},
+		RemovedIn: 2,
+		Note:      "In create agent and in alter agent … add. An attachment is a child of the agent: its properties are in ( ) (R2).",
+		Example: "create agent M.A (UsageType: Task, Model: M.Gpt, SystemPrompt: 'x') " +
+			"{ tool Lookup { Description: 'Find', Enabled: true } };",
+		CanonicalExample: "create agent M.A (UsageType: Task, Model: M.Gpt, SystemPrompt: 'x') " +
+			"{ tool Lookup ( Description: 'Find', Enabled: true ) };",
+	},
+	{
+		Code:      ImageCollectionParens,
+		Old:       "image collection M.C ( image X from file '…', … )",
+		Canonical: "image collection M.C { image X ( File: '…' ) … }",
+		Rewrite: Rewrite{Structural: "the images move into { } without commas, and `from file '…'` " +
+			"becomes `( File: '…' )`"},
+		RemovedIn:        2,
+		Note:             "The images are the collection's children, so they are in { }, each with its properties in ( ) (R2).",
+		Example:          "create image collection M.Icons (image Logo from file 'logo.png', image Home from file 'home.png');",
+		CanonicalExample: "create image collection M.Icons {image Logo ( File: 'logo.png' ) image Home ( File: 'home.png' )};",
+	},
+	{
+		Code:      MessageTreeParens,
+		Old:       "message definition collection M.C ( definition D for M.E ( A, M.E_B/M.B ( C ) ) )",
+		Canonical: "message definition collection M.C { definition D for M.E { A, M.E_B/M.B { C } } }",
+		Rewrite:   Rewrite{Structural: "each parenthesised definition list and member tree moves into { }"},
+		RemovedIn: 2,
+		Note: "The definitions and members are children, so they are in { }, as in an import or export " +
+			"mapping (R2). Also in `alter message definition collection … add definition` and " +
+			"`alter message definition … add member`. One warning per statement.",
+		Example:          "create message definition collection M.Msgs (definition Order for M.Order (Number, M.Order_Line/M.Line (Sku)));",
+		CanonicalExample: "create message definition collection M.Msgs {definition Order for M.Order {Number, M.Order_Line/M.Line {Sku}}};",
+	},
 }
 
 // r8Entries are R8's spellings (ako/mxcli#752). Kept apart from the list above
diff --git a/mdl/executor/cmd_agenteditor_agents.go b/mdl/executor/cmd_agenteditor_agents.go
index c2766868c4..4ffe33a692 100644
--- a/mdl/executor/cmd_agenteditor_agents.go
+++ b/mdl/executor/cmd_agenteditor_agents.go
@@ -166,7 +166,8 @@ func describeAgentEditorAgent(ctx *ExecContext, name ast.QualifiedName) error {
 	return nil
 }
 
-// emitToolBlock writes one TOOL or MCP SERVICE block for the agent body.
+// emitToolBlock writes one tool or mcp service child of the agent body, its
+// properties in ( ) (R2).
 func emitToolBlock(ctx *ExecContext, t agenteditor.AgentTool) {
 	switch t.ToolType {
 	case "mcp":
@@ -174,7 +175,7 @@ func emitToolBlock(ctx *ExecContext, t agenteditor.AgentTool) {
 			// malformed — skip
 			return
 		}
-		fmt.Fprintf(ctx.Output, "  mcp service %s {\n", t.Document.QualifiedName)
+		fmt.Fprintf(ctx.Output, "  mcp service %s (\n", t.Document.QualifiedName)
 		// The comma belongs to Enabled when a Description follows it; without
 		// it the block was a parse error (ako/mxcli#707). Same shape as the
 		// generic tool block below.
@@ -185,14 +186,14 @@ func emitToolBlock(ctx *ExecContext, t agenteditor.AgentTool) {
 		} else {
 			fmt.Fprintln(ctx.Output)
 		}
-		fmt.Fprintln(ctx.Output, "  }")
+		fmt.Fprintln(ctx.Output, "  )")
 	default:
 		// Microflow or unknown tool type — emit generic TOOL block.
 		name := t.Name
 		if name == "" {
 			name = "Tool_" + strings.ReplaceAll(t.ID, "-", "")[:8]
 		}
-		fmt.Fprintf(ctx.Output, "  tool %s {\n", name)
+		fmt.Fprintf(ctx.Output, "  tool %s (\n", name)
 		if t.ToolType != "" {
 			fmt.Fprintf(ctx.Output, "    ToolType: %s,\n", t.ToolType)
 		}
@@ -206,17 +207,18 @@ func emitToolBlock(ctx *ExecContext, t agenteditor.AgentTool) {
 		} else {
 			fmt.Fprintln(ctx.Output)
 		}
-		fmt.Fprintln(ctx.Output, "  }")
+		fmt.Fprintln(ctx.Output, "  )")
 	}
 }
 
-// emitKBBlock writes one KNOWLEDGE BASE block for the agent body.
+// emitKBBlock writes one knowledge base child of the agent body, its
+// properties in ( ) (R2).
 func emitKBBlock(ctx *ExecContext, kb agenteditor.AgentKBTool) {
 	name := kb.Name
 	if name == "" {
 		name = "KB_" + strings.ReplaceAll(kb.ID, "-", "")[:8]
 	}
-	fmt.Fprintf(ctx.Output, "  knowledge base %s {\n", name)
+	fmt.Fprintf(ctx.Output, "  knowledge base %s (\n", name)
 	if kb.Document != nil && kb.Document.QualifiedName != "" {
 		fmt.Fprintf(ctx.Output, "    Source: %s,\n", kb.Document.QualifiedName)
 	}
@@ -230,7 +232,7 @@ func emitKBBlock(ctx *ExecContext, kb agenteditor.AgentKBTool) {
 		fmt.Fprintf(ctx.Output, "    Description: %s,\n", mdlQuoted(kb.Description))
 	}
 	fmt.Fprintf(ctx.Output, "    Enabled: %t\n", kb.Enabled)
-	fmt.Fprintln(ctx.Output, "  }")
+	fmt.Fprintln(ctx.Output, "  )")
 }
 
 // findAgentEditorAgent looks up an agent by module and name.
diff --git a/mdl/executor/cmd_imagecollections.go b/mdl/executor/cmd_imagecollections.go
index 4473689951..a723840ffc 100644
--- a/mdl/executor/cmd_imagecollections.go
+++ b/mdl/executor/cmd_imagecollections.go
@@ -164,9 +164,9 @@ func describeImageCollection(ctx *ExecContext, name ast.QualifiedName) error {
 	if exportLevel != "Hidden" {
 		fmt.Fprintf(ctx.Output, " export level '%s'", exportLevel)
 	}
-	fmt.Fprintln(ctx.Output, " (")
+	fmt.Fprintln(ctx.Output, " {")
 
-	for i, img := range ic.Images {
+	for _, img := range ic.Images {
 		ext := imageFormatToExt(img.Format)
 		filePath := filepath.Join(previewDir, img.Name+ext)
 		if len(img.Data) > 0 {
@@ -175,14 +175,10 @@ func describeImageCollection(ctx *ExecContext, name ast.QualifiedName) error {
 			}
 		}
 
-		comma := ","
-		if i == len(ic.Images)-1 {
-			comma = ""
-		}
-		fmt.Fprintf(ctx.Output, "    image %s from file '%s'%s\n", img.Name, filePath, comma)
+		fmt.Fprintf(ctx.Output, "  image %s ( File: '%s' )\n", img.Name, filePath)
 	}
 
-	fmt.Fprintln(ctx.Output, ");")
+	fmt.Fprintln(ctx.Output, "};")
 	return nil
 }
 
diff --git a/mdl/executor/cmd_messagedefinitions.go b/mdl/executor/cmd_messagedefinitions.go
index c1d0142f81..fb0040c79e 100644
--- a/mdl/executor/cmd_messagedefinitions.go
+++ b/mdl/executor/cmd_messagedefinitions.go
@@ -561,26 +561,25 @@ func execDescribeMessageDefinitionCollection(ctx *ExecContext, name ast.Qualifie
 			fmt.Fprintf(ctx.Output, "  folder '%s'\n", folder)
 		}
 	}
-	fmt.Fprintln(ctx.Output, "(")
-	for i, def := range c.Definitions {
-		sep := ","
-		if i == len(c.Definitions)-1 {
-			sep = ""
-		}
-		describeMessageDefinition(ctx, def, sep)
+	fmt.Fprintln(ctx.Output, "{")
+	for _, def := range c.Definitions {
+		describeMessageDefinition(ctx, def)
 	}
-	fmt.Fprintln(ctx.Output, ");")
+	fmt.Fprintln(ctx.Output, "};")
 	return nil
 }
 
-func describeMessageDefinition(ctx *ExecContext, def *model.MessageDefinition, sep string) {
+// describeMessageDefinition prints one definition. Definitions and member
+// trees are children, so they are in { } (R2); a definition ends in `}`, so the
+// definitions need no separator.
+func describeMessageDefinition(ctx *ExecContext, def *model.MessageDefinition) {
 	if def == nil || def.Root == nil {
 		return
 	}
-	fmt.Fprintf(ctx.Output, "  definition %s for %s%s (\n",
+	fmt.Fprintf(ctx.Output, "  definition %s for %s%s {\n",
 		def.Name, def.Root.Entity, exposedClause(def.Root, shortEntityName(def.Root.Entity)))
 	describeMessageMembers(ctx, def.Root.Children, "    ")
-	fmt.Fprintf(ctx.Output, "  )%s\n", sep)
+	fmt.Fprintln(ctx.Output, "  }")
 }
 
 func describeMessageMembers(ctx *ExecContext, members []*model.MessageDefinitionElement, indent string) {
@@ -594,13 +593,13 @@ func describeMessageMembers(ctx *ExecContext, members []*model.MessageDefinition
 			fmt.Fprintf(ctx.Output, "%s%s%s%s%s\n", indent, m.OriginalName,
 				exposedClause(m, m.OriginalName), exampleClause(m), sep)
 		case len(m.Children) == 0:
-			fmt.Fprintf(ctx.Output, "%s%s/%s%s ()%s\n", indent, m.Association, m.Entity,
+			fmt.Fprintf(ctx.Output, "%s%s/%s%s { }%s\n", indent, m.Association, m.Entity,
 				exposedClause(m, shortEntityName(m.Entity)), sep)
 		default:
-			fmt.Fprintf(ctx.Output, "%s%s/%s%s (\n", indent, m.Association, m.Entity,
+			fmt.Fprintf(ctx.Output, "%s%s/%s%s {\n", indent, m.Association, m.Entity,
 				exposedClause(m, shortEntityName(m.Entity)))
 			describeMessageMembers(ctx, m.Children, indent+"  ")
-			fmt.Fprintf(ctx.Output, "%s)%s\n", indent, sep)
+			fmt.Fprintf(ctx.Output, "%s}%s\n", indent, sep)
 		}
 	}
 }
diff --git a/mdl/executor/cmd_misc.go b/mdl/executor/cmd_misc.go
index 5bf1f1395e..a67ea623be 100644
--- a/mdl/executor/cmd_misc.go
+++ b/mdl/executor/cmd_misc.go
@@ -338,8 +338,7 @@ Image Collections:
   create image collection Module.Name
     [export level 'Hidden'|'Public']
     [comment 'description']
-    [(image Name from file 'path', ...)];
-  /
+    [{ image Name ( File: 'path' ) ... }];
 
   drop image collection Module.Name;
   show image collection [in Module];
diff --git a/mdl/executor/cmd_rest_clients.go b/mdl/executor/cmd_rest_clients.go
index 7d50dd84dc..5235d58e19 100644
--- a/mdl/executor/cmd_rest_clients.go
+++ b/mdl/executor/cmd_rest_clients.go
@@ -145,13 +145,13 @@ func outputConsumedRestServiceMDL(ctx *ExecContext, svc *model.ConsumedRestServi
 	return nil
 }
 
-// outputRestOperation writes a single operation in the new { Key: Value } format.
+// outputRestOperation writes a single operation, its properties in ( ) (R2).
 func outputRestOperation(w io.Writer, op *model.RestClientOperation) {
 	if op.Documentation != "" {
 		outputJavadocIndented(w, op.Documentation, "  ")
 	}
 
-	fmt.Fprintf(w, "  operation %s {\n", op.Name)
+	fmt.Fprintf(w, "  operation %s (\n", op.Name)
 	fmt.Fprintf(w, "    Method: %s,\n", strings.ToLower(op.HttpMethod))
 	fmt.Fprintf(w, "    Path: %s,\n", mdlQuoted(op.Path))
 
@@ -235,7 +235,7 @@ func outputRestOperation(w io.Writer, op *model.RestClientOperation) {
 		fmt.Fprintln(w, "    Response: none")
 	}
 
-	fmt.Fprintln(w, "  }")
+	fmt.Fprintln(w, "  )")
 }
 
 // restParamTypeOrDefault supplies the type describe prints for a REST parameter.
diff --git a/mdl/executor/r2_children_describe_test.go b/mdl/executor/r2_children_describe_test.go
new file mode 100644
index 0000000000..f982ac9d1f
--- /dev/null
+++ b/mdl/executor/r2_children_describe_test.go
@@ -0,0 +1,141 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package executor
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/backend/mock"
+	"github.com/mendixlabs/mxcli/mdl/types"
+	"github.com/mendixlabs/mxcli/model"
+	"github.com/mendixlabs/mxcli/sdk/agenteditor"
+)
+
+// R2 (ako/mxcli#754): describe prints the canonical brackets — properties in
+// ( ), children in { } — so its output re-parses without recording any
+// deprecated spelling (MDL-DEPR070..073).
+
+func assertCanonicalDescribe(t *testing.T, out string, wantInOutput ...string) {
+	t.Helper()
+	prog := reparse(t, out)
+	if len(prog.Deprecations) != 0 {
+		t.Errorf("describe output uses a deprecated spelling: %+v\n--- output ---\n%s", prog.Deprecations, out)
+	}
+	for _, w := range wantInOutput {
+		if !strings.Contains(out, w) {
+			t.Errorf("describe output lacks %q:\n%s", w, out)
+		}
+	}
+}
+
+func TestDescribeRestOperation_PropertiesInParens(t *testing.T) {
+	svc := &model.ConsumedRestService{
+		Name:    "Api",
+		BaseUrl: "https://api.example.com",
+		Operations: []*model.RestClientOperation{
+			{Name: "GetUser", HttpMethod: "GET", Path: "/users/{id}", ResponseType: "NONE",
+				Parameters: []*model.RestClientParameter{{Name: "id", DataType: "Integer"}}},
+			{Name: "Ping", HttpMethod: "GET", Path: "/ping", ResponseType: "NONE"},
+		},
+	}
+	ctx, buf := newMockCtx(t)
+	assertNoError(t, outputConsumedRestServiceMDL(ctx, svc, "M"))
+	assertCanonicalDescribe(t, buf.String(), "operation GetUser (", "operation Ping (")
+}
+
+func TestDescribeAgentAttachments_PropertiesInParens(t *testing.T) {
+	mod := mkModule("M")
+	a := &agenteditor.Agent{
+		BaseElement: model.BaseElement{ID: nextID("aea")},
+		ContainerID: mod.ID,
+		Name:        "Helper",
+		UsageType:   "Task",
+		Model:       &agenteditor.DocRef{QualifiedName: "M.GPT4"},
+		Tools: []agenteditor.AgentTool{
+			{Name: "Weather", ToolType: "mcp", Enabled: true, Document: &agenteditor.DocRef{QualifiedName: "M.WeatherMcp"}},
+			{Name: "Lookup", ToolType: "Microflow", Enabled: true, Description: "Find",
+				Document: &agenteditor.DocRef{QualifiedName: "M.Lookup"}},
+		},
+		KBTools: []agenteditor.AgentKBTool{
+			{Name: "Docs", Enabled: true, Document: &agenteditor.DocRef{QualifiedName: "M.KB"},
+				CollectionIdentifier: "docs", MaxResults: 3},
+		},
+	}
+	h := mkHierarchy(mod)
+	withContainer(h, a.ContainerID, mod.ID)
+	mb := &mock.MockBackend{
+		IsConnectedFunc:           func() bool { return true },
+		ListAgentEditorAgentsFunc: func() ([]*agenteditor.Agent, error) { return []*agenteditor.Agent{a}, nil },
+	}
+	ctx, buf := newMockCtx(t, withBackend(mb), withHierarchy(h))
+	assertNoError(t, describeAgentEditorAgent(ctx, ast.QualifiedName{Module: "M", Name: "Helper"}))
+	assertCanonicalDescribe(t, buf.String(), "mcp service M.WeatherMcp (", "tool Lookup (", "knowledge base Docs (")
+}
+
+func TestDescribeImageCollection_ImagesInBraces(t *testing.T) {
+	mod := mkModule("Icons")
+	ic := &types.ImageCollection{
+		BaseElement: model.BaseElement{ID: nextID("ic")},
+		ContainerID: mod.ID,
+		Name:        "AppIcons",
+		ExportLevel: "Public",
+		Images:      []types.Image{{Name: "Logo", Format: "Png"}, {Name: "Home", Format: "Svg"}},
+	}
+	h := mkHierarchy(mod)
+	withContainer(h, ic.ContainerID, mod.ID)
+	mb := &mock.MockBackend{
+		IsConnectedFunc:          func() bool { return true },
+		ListImageCollectionsFunc: func() ([]*types.ImageCollection, error) { return []*types.ImageCollection{ic}, nil },
+	}
+	ctx, buf := newMockCtx(t, withBackend(mb), withHierarchy(h))
+	assertNoError(t, describeImageCollection(ctx, ast.QualifiedName{Module: "Icons", Name: "AppIcons"}))
+	out := buf.String()
+	assertCanonicalDescribe(t, out, "export level 'Public' {", "image Logo ( File: ", "image Home ( File: ")
+	s := findStmt[*ast.CreateImageCollectionStmt](t, reparse(t, out), out)
+	if len(s.Images) != 2 || s.Images[0].Name != "Logo" || s.Images[1].Name != "Home" {
+		t.Errorf("images = %+v", s.Images)
+	}
+}
+
+func TestDescribeMessageDefinitionCollection_TreesInBraces(t *testing.T) {
+	mod := mkModule("Sales")
+	c := &model.MessageDefinitionCollection{
+		BaseElement: model.BaseElement{ID: nextID("mdc")},
+		ContainerID: mod.ID,
+		Name:        "MD_Order",
+		Definitions: []*model.MessageDefinition{
+			{Name: "Order", Root: &model.MessageDefinitionElement{Kind: "Entity", Entity: "Sales.Order", ExposedName: "Order",
+				Children: []*model.MessageDefinitionElement{
+					{Kind: "Attribute", Attribute: "OrderId", OriginalName: "OrderId", ExposedName: "OrderId"},
+					{Kind: "Entity", Association: "Sales.Order_Line", Entity: "Sales.Line", ExposedName: "Lines",
+						Children: []*model.MessageDefinitionElement{
+							{Kind: "Attribute", Attribute: "Sku", OriginalName: "Sku", ExposedName: "Sku"},
+						}},
+					{Kind: "Entity", Association: "Sales.Order_Customer", Entity: "Sales.Customer", ExposedName: "Customer"},
+				}}},
+			{Name: "Customer", Root: &model.MessageDefinitionElement{Kind: "Entity", Entity: "Sales.Customer", ExposedName: "Customer",
+				Children: []*model.MessageDefinitionElement{
+					{Kind: "Attribute", Attribute: "Name", OriginalName: "Name", ExposedName: "Name"},
+				}}},
+		},
+	}
+	h := mkHierarchy(mod)
+	withContainer(h, c.ContainerID, mod.ID)
+	mb := &mock.MockBackend{
+		IsConnectedFunc: func() bool { return true },
+		ListMessageDefinitionCollectionsFunc: func() ([]*model.MessageDefinitionCollection, error) {
+			return []*model.MessageDefinitionCollection{c}, nil
+		},
+	}
+	ctx, buf := newMockCtx(t, withBackend(mb), withHierarchy(h))
+	assertNoError(t, execDescribeMessageDefinitionCollection(ctx, ast.QualifiedName{Module: "Sales", Name: "MD_Order"}))
+	out := buf.String()
+	assertCanonicalDescribe(t, out, "definition Order for Sales.Order {", "Sales.Order_Line/Sales.Line as 'Lines' {",
+		"Sales.Order_Customer/Sales.Customer { }")
+	s := findStmt[*ast.CreateMessageDefinitionCollectionStmt](t, reparse(t, out), out)
+	if len(s.Definitions) != 2 || len(s.Definitions[0].Members) != 3 || len(s.Definitions[0].Members[1].Members) != 1 {
+		t.Errorf("definitions = %+v", s.Definitions)
+	}
+}
diff --git a/mdl/grammar/domains/MDLAgent.g4 b/mdl/grammar/domains/MDLAgent.g4
index fb3cfc61b8..ff39f295e3 100644
--- a/mdl/grammar/domains/MDLAgent.g4
+++ b/mdl/grammar/domains/MDLAgent.g4
@@ -75,7 +75,7 @@ createKnowledgeBaseStatement
 //   SystemPrompt: '...',
 //   ...
 // )
-// [ { TOOL ... | MCP SERVICE ... | KNOWLEDGE BASE ... } ]
+// [ { tool X ( ... ) | mcp service M.X ( ... ) | knowledge base KB ( ... ) } ]
 // ;
 createAgentStatement
     : AGENT qualifiedName
@@ -88,10 +88,21 @@ agentBody
     : LBRACE agentBodyBlock* RBRACE
     ;
 
+// An attachment is a child of the agent, so its properties are in ( ) like
+// every other child's (R2, ako/mxcli#754). The brace form is the old spelling.
 agentBodyBlock
-    : MCP SERVICE qualifiedName LBRACE modelProperty (COMMA modelProperty)* RBRACE       // MCP SERVICE Mod.Name { ... }
-    | KNOWLEDGE BASE identifierOrKeyword LBRACE modelProperty (COMMA modelProperty)* RBRACE // KNOWLEDGE BASE MyKB { ... }
-    | TOOL identifierOrKeyword LBRACE modelProperty (COMMA modelProperty)* RBRACE        // TOOL ToolName { ... }
+    : MCP SERVICE qualifiedName
+      ( LPAREN modelProperty (COMMA modelProperty)* COMMA? RPAREN                       // mcp service Mod.Name ( ... )
+      | LBRACE /* @alias MDL-DEPR071 */ modelProperty (COMMA modelProperty)* COMMA? RBRACE
+      )
+    | KNOWLEDGE BASE identifierOrKeyword
+      ( LPAREN modelProperty (COMMA modelProperty)* COMMA? RPAREN                       // knowledge base MyKB ( ... )
+      | LBRACE /* @alias MDL-DEPR071 */ modelProperty (COMMA modelProperty)* COMMA? RBRACE
+      )
+    | TOOL identifierOrKeyword
+      ( LPAREN modelProperty (COMMA modelProperty)* COMMA? RPAREN                       // tool ToolName ( ... )
+      | LBRACE /* @alias MDL-DEPR071 */ modelProperty (COMMA modelProperty)* COMMA? RBRACE
+      )
     ;
 
 // =============================================================================
@@ -120,8 +131,8 @@ agentEditorAlterValue
 // ```mdl
 // ALTER AGENT MyModule.Helper
 //   SET SystemPrompt = 'New prompt', Temperature = 0.5
-//   ADD TOOL DoSomething { Description: '...', Enabled: true }
-//   ADD MCP SERVICE MyModule.Weather { Description: '...', Enabled: true }
+//   ADD TOOL DoSomething ( Description: '...', Enabled: true )
+//   ADD MCP SERVICE MyModule.Weather ( Description: '...', Enabled: true )
 //   DROP KNOWLEDGE BASE OldKB
 // ;
 // ```
diff --git a/mdl/grammar/domains/MDLDomainModel.g4 b/mdl/grammar/domains/MDLDomainModel.g4
index 65ae1ff81e..c5afc251b8 100644
--- a/mdl/grammar/domains/MDLDomainModel.g4
+++ b/mdl/grammar/domains/MDLDomainModel.g4
@@ -513,8 +513,23 @@ imageCollectionOption
     | COMMENT STRING_LITERAL
     ;
 
+// The images are the collection's children, so they are in { }, each with its
+// properties in ( ) (R2, ako/mxcli#754):
+//
+//   create image collection M.Icons { image Logo ( File: 'assets/logo.png' ) };
+//
+// The parenthesised list of `image X from file '…'` is the old spelling.
 imageCollectionBody
-    : LPAREN imageCollectionItem (COMMA imageCollectionItem)* RPAREN
+    : LBRACE imageCollectionChild* RBRACE
+    | LPAREN /* @alias MDL-DEPR072 */ imageCollectionItem (COMMA imageCollectionItem)* RPAREN
+    ;
+
+imageCollectionChild
+    : IMAGE imageName LPAREN imageProperty (COMMA imageProperty)* COMMA? RPAREN   // image Logo ( File: 'logo.png' )
+    ;
+
+imageProperty
+    : identifierOrKeyword COLON STRING_LITERAL
     ;
 
 imageCollectionItem
@@ -568,12 +583,12 @@ customNameMapping
 /**
  * CREATE [OR MODIFY] MESSAGE DEFINITION COLLECTION Module.Name
  *   FOLDER 'Private/Messages'
- * (
- *   definition Order for Sales.Order as 'Orders' (
+ * {
+ *   definition Order for Sales.Order as 'Orders' {
  *     OrderId,
- *     Sales.Order_Line/Sales.Line as 'Lines' ( Sku, Quantity )
- *   )
- * );
+ *     Sales.Order_Line/Sales.Line as 'Lines' { Sku, Quantity }
+ *   }
+ * };
  *
  * A message definition is a SELECTION OVER THE DOMAIN MODEL — every element
  * names an entity, an attribute or an association — which is what makes it
@@ -588,18 +603,27 @@ customNameMapping
 createMessageDefinitionCollectionStatement
     : MESSAGE DEFINITION COLLECTION qualifiedName
       (FOLDER STRING_LITERAL)?
-      LPAREN messageDefinitionDef (COMMA messageDefinitionDef)* COMMA? RPAREN
+      ( LBRACE messageDefinitionDef (COMMA? messageDefinitionDef)* COMMA? RBRACE
+      | LPAREN /* @alias MDL-DEPR073 */ messageDefinitionDef (COMMA messageDefinitionDef)* COMMA? RPAREN
+      )
     ;
 
 /**
- * `definition <Name> for <Module.Entity> [as '<ExposedName>'] ( members )`
+ * `definition <Name> for <Module.Entity> [as '<ExposedName>'] { members }`
  *
  * The definition's Name and its root element's exposed name are independent —
  * measured, 19 of 56 definitions are named something other than their entity.
  */
 messageDefinitionDef
-    : DEFINITION identifierOrKeyword FOR qualifiedName messageExposedName?
-      LPAREN messageMember (COMMA messageMember)* COMMA? RPAREN
+    : DEFINITION identifierOrKeyword FOR qualifiedName messageExposedName? messageMemberTree
+    ;
+
+// A member tree is children, so it is in { }, as in an import or export
+// mapping (R2, ako/mxcli#754). The parenthesised tree is the old spelling. An
+// association may select no member of its target.
+messageMemberTree
+    : LBRACE (messageMember (COMMA messageMember)* COMMA?)? RBRACE
+    | LPAREN /* @alias MDL-DEPR073 */ messageMember (COMMA messageMember)* COMMA? RPAREN
     ;
 
 /**
@@ -616,8 +640,7 @@ messageDefinitionDef
  * something a reader has to work out.
  */
 messageMember
-    : qualifiedName SLASH qualifiedName messageExposedName?
-      LPAREN messageMember (COMMA messageMember)* COMMA? RPAREN   // association
+    : qualifiedName SLASH qualifiedName messageExposedName? messageMemberTree   // association
     | identifierOrKeyword messageExposedName? messageExample?      // attribute
     ;
 
@@ -644,8 +667,7 @@ alterMessageDefinitionCollectionStatement
     ;
 
 alterMessageCollectionOperation
-    : ADD DEFINITION (IF NOT EXISTS)? identifierOrKeyword FOR qualifiedName messageExposedName?
-      LPAREN messageMember (COMMA messageMember)* COMMA? RPAREN
+    : ADD DEFINITION (IF NOT EXISTS)? identifierOrKeyword FOR qualifiedName messageExposedName? messageMemberTree
     | DROP DEFINITION (IF EXISTS)? identifierOrKeyword
     | RENAME DEFINITION identifierOrKeyword TO identifierOrKeyword
     ;
diff --git a/mdl/grammar/domains/MDLService.g4 b/mdl/grammar/domains/MDLService.g4
index a44bb27775..4fcd188592 100644
--- a/mdl/grammar/domains/MDLService.g4
+++ b/mdl/grammar/domains/MDLService.g4
@@ -63,10 +63,14 @@ restClientProperty
     | identifierOrKeyword COLON BASIC LPAREN restClientProperty (COMMA restClientProperty)* RPAREN
     ;
 
+// An operation is a child of the service, so its properties are in ( ) like
+// every other child's (R2, ako/mxcli#754). The brace form is the old spelling.
 restClientOperation
     : docComment?
       OPERATION (identifierOrKeyword | STRING_LITERAL)
-      LBRACE restClientOpProp (COMMA restClientOpProp)* RBRACE
+      ( LPAREN restClientOpProp (COMMA restClientOpProp)* COMMA? RPAREN
+      | LBRACE /* @alias MDL-DEPR070 */ restClientOpProp (COMMA restClientOpProp)* COMMA? RBRACE
+      )
     ;
 
 restClientOpProp
diff --git a/mdl/upgrade/r2_children_test.go b/mdl/upgrade/r2_children_test.go
new file mode 100644
index 0000000000..182cc14dd2
--- /dev/null
+++ b/mdl/upgrade/r2_children_test.go
@@ -0,0 +1,84 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package upgrade
+
+import (
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
+)
+
+// R2 (ako/mxcli#754): the integration documents' old brackets are rewritten to
+// properties in ( ) and children in { }, every pair in a statement at once,
+// with the body mappings, headers and comments left as written.
+func TestUpgrade_R2IntegrationDocumentBrackets(t *testing.T) {
+	src := `create consumed rest service M.Api (BaseUrl: 'https://x', Authentication: none)
+{
+  /** Fetch one user */
+  operation GetUser {
+    Method: get,
+    Path: '/u/{id}',
+    Headers: ('Accept' = 'application/json'),
+    Response: mapping M.User { Name = name }
+  }
+  operation Ping { Method: get, Path: '/ping', Response: none }
+};
+CREATE AGENT M.A (UsageType: Task, Model: M.Gpt, SystemPrompt: 'x') {
+  TOOL Lookup { Description: 'Find' } -- the lookup tool
+};
+alter agent M.A add knowledge base Docs { Source: M.KB };
+create image collection M.Icons export level 'Public' (
+  image Logo from file 'logo.png',
+  image Home from file 'home.png'
+);
+create message definition collection M.Msgs (
+  definition Order for M.Order (
+    Number,
+    M.Order_Line/M.Line as 'Lines' ( Sku )
+  )
+);
+alter message definition M.Msgs.Order add member M.Order_Tag/M.Tag ( Label );
+`
+	want := `create consumed rest service M.Api (BaseUrl: 'https://x', Authentication: none)
+{
+  /** Fetch one user */
+  operation GetUser (
+    Method: get,
+    Path: '/u/{id}',
+    Headers: ('Accept' = 'application/json'),
+    Response: mapping M.User { Name = name }
+  )
+  operation Ping ( Method: get, Path: '/ping', Response: none )
+};
+CREATE AGENT M.A (UsageType: Task, Model: M.Gpt, SystemPrompt: 'x') {
+  TOOL Lookup ( Description: 'Find' ) -- the lookup tool
+};
+alter agent M.A add knowledge base Docs ( Source: M.KB );
+create image collection M.Icons export level 'Public' {
+  image Logo ( File: 'logo.png' )
+  image Home ( File: 'home.png' )
+};
+create message definition collection M.Msgs {
+  definition Order for M.Order {
+    Number,
+    M.Order_Line/M.Line as 'Lines' { Sku }
+  }
+};
+alter message definition M.Msgs.Order add member M.Order_Tag/M.Tag { Label };
+`
+	res := mustUpgrade(t, src, Options{})
+	if res.Source != want {
+		t.Fatalf("got:\n%s\nwant:\n%s", res.Source, want)
+	}
+	for code, n := range map[string]int{
+		deprecation.RestOperationBraces: 1, deprecation.AgentAttachmentBraces: 2,
+		deprecation.ImageCollectionParens: 1, deprecation.MessageTreeParens: 2,
+	} {
+		if res.Rewritten[code] != n {
+			t.Errorf("Rewritten[%s] = %d, want %d (all: %v)", code, res.Rewritten[code], n, res.Rewritten)
+		}
+	}
+	if again := mustUpgrade(t, res.Source, Options{}); again.Changed() {
+		t.Errorf("second upgrade changed the script again: %v", again.Rewritten)
+	}
+}
diff --git a/mdl/visitor/r2_children_test.go b/mdl/visitor/r2_children_test.go
new file mode 100644
index 0000000000..c6f95b2475
--- /dev/null
+++ b/mdl/visitor/r2_children_test.go
@@ -0,0 +1,205 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package visitor
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
+)
+
+// R2 (ako/mxcli#754): properties in ( ), declarative children in { }. For each
+// integration document the canonical form must build without a warning under
+// both versions, and the old form must build the SAME statement, record its
+// code once, and carry a rewrite.
+
+type r2Case struct {
+	name      string
+	code      string
+	old       string
+	canonical string
+}
+
+var r2Cases = []r2Case{
+	{
+		name: "rest operation",
+		code: deprecation.RestOperationBraces,
+		old: `create consumed rest service M.Api (BaseUrl: 'https://x', Authentication: none) {
+  operation GetUser { Method: get, Path: '/u/{id}', Parameters: ($id: Integer), Headers: ('Accept' = 'application/json'), Response: none }
+  operation Ping { Method: get, Path: '/ping', Response: none }
+};`,
+		canonical: `create consumed rest service M.Api (BaseUrl: 'https://x', Authentication: none) {
+  operation GetUser ( Method: get, Path: '/u/{id}', Parameters: ($id: Integer), Headers: ('Accept' = 'application/json'), Response: none, )
+  operation Ping ( Method: get, Path: '/ping', Response: none )
+};`,
+	},
+	{
+		name: "agent attachments",
+		code: deprecation.AgentAttachmentBraces,
+		old: `create agent M.A (UsageType: Task, Model: M.Gpt, SystemPrompt: 'x') {
+  mcp service M.Weather { Enabled: true }
+  knowledge base Docs { Source: M.KB, Collection: 'docs', MaxResults: 3 }
+  tool Lookup { Description: 'Find', Enabled: true }
+};`,
+		canonical: `create agent M.A (UsageType: Task, Model: M.Gpt, SystemPrompt: 'x') {
+  mcp service M.Weather ( Enabled: true )
+  knowledge base Docs ( Source: M.KB, Collection: 'docs', MaxResults: 3, )
+  tool Lookup ( Description: 'Find', Enabled: true )
+};`,
+	},
+	{
+		name:      "alter agent add",
+		code:      deprecation.AgentAttachmentBraces,
+		old:       `alter agent M.A add tool Lookup { Description: 'Find' };`,
+		canonical: `alter agent M.A add tool Lookup ( Description: 'Find' );`,
+	},
+	{
+		name: "image collection",
+		code: deprecation.ImageCollectionParens,
+		old: `create image collection M.Icons export level 'Public' (
+  image Logo from file 'assets/logo.png',
+  image "Home" from file 'assets/home.png'
+);`,
+		canonical: `create image collection M.Icons export level 'Public' {
+  image Logo ( File: 'assets/logo.png' )
+  image "Home" ( File: 'assets/home.png', )
+};`,
+	},
+	{
+		name: "message definition collection",
+		code: deprecation.MessageTreeParens,
+		old: `create message definition collection M.Msgs folder 'Messages' (
+  definition Order for M.Order as 'Orders' (
+    Number,
+    M.Order_Line/M.Line as 'Lines' ( Sku, Quantity example '3' )
+  ),
+  definition Customer for M.Customer ( Name )
+);`,
+		canonical: `create message definition collection M.Msgs folder 'Messages' {
+  definition Order for M.Order as 'Orders' {
+    Number,
+    M.Order_Line/M.Line as 'Lines' { Sku, Quantity example '3' }
+  }
+  definition Customer for M.Customer { Name }
+};`,
+	},
+	{
+		name:      "add definition",
+		code:      deprecation.MessageTreeParens,
+		old:       `alter message definition collection M.Msgs add definition X for M.X as 'Xs' ( A, M.X_Y/M.Y ( B ) );`,
+		canonical: `alter message definition collection M.Msgs add definition X for M.X as 'Xs' { A, M.X_Y/M.Y { B } };`,
+	},
+	{
+		name:      "add member",
+		code:      deprecation.MessageTreeParens,
+		old:       `alter message definition M.Msgs.Order add member M.Order_Line/M.Line ( Sku );`,
+		canonical: `alter message definition M.Msgs.Order add member M.Order_Line/M.Line { Sku };`,
+	},
+}
+
+func buildNoErrors(t *testing.T, src string) *ast.Program {
+	t.Helper()
+	prog, errs := Build(src)
+	if len(errs) > 0 {
+		t.Fatalf("%q: unexpected errors: %v", src, errs)
+	}
+	return prog
+}
+
+func TestR2Children_CanonicalFormBuildsWithoutWarning(t *testing.T) {
+	for _, c := range r2Cases {
+		for _, header := range []string{"", "mdl 1;\n"} {
+			prog := buildNoErrors(t, header+c.canonical)
+			if len(prog.Statements) != 1 {
+				t.Errorf("%s, header %q: %d statements", c.name, header, len(prog.Statements))
+			}
+			if len(prog.Deprecations) != 0 {
+				t.Errorf("%s, header %q: the canonical form recorded %+v", c.name, header, prog.Deprecations)
+			}
+		}
+	}
+}
+
+func TestR2Children_OldFormIsADeprecatedAlias(t *testing.T) {
+	for _, c := range r2Cases {
+		for _, header := range []string{"", "mdl 1;\n"} {
+			old := buildNoErrors(t, header+c.old)
+			canon := buildNoErrors(t, header+c.canonical)
+			if n := countDeprecations(old, c.code); n != 1 {
+				t.Errorf("%s, header %q: recorded %s %d times, want once per statement (%+v)", c.name, header, c.code, n, old.Deprecations)
+			}
+			for _, d := range old.Deprecations {
+				if d.Code == c.code && (d.Fix == nil || len(d.Fix.Edits) == 0) {
+					t.Errorf("%s: %s carries no rewrite", c.name, c.code)
+				}
+			}
+			if !reflect.DeepEqual(old.Statements, canon.Statements) {
+				t.Errorf("%s, header %q: the two forms build different statements:\nold:   %#v\ncanon: %#v",
+					c.name, header, old.Statements[0], canon.Statements[0])
+			}
+		}
+	}
+}
+
+// The recorded rewrite, applied to the old form, gives a script that records
+// nothing and builds the same statement.
+func TestR2Children_RewriteReachesTheCanonicalForm(t *testing.T) {
+	for _, c := range r2Cases {
+		prog := buildNoErrors(t, c.old)
+		out := applyDeprecationFixes(t, c.old, prog, c.code)
+		again := buildNoErrors(t, out)
+		if len(again.Deprecations) != 0 {
+			t.Errorf("%s: the rewrite still records %+v:\n%s", c.name, again.Deprecations, out)
+		}
+		if !reflect.DeepEqual(prog.Statements, again.Statements) {
+			t.Errorf("%s: the rewrite changed the statement:\n%s", c.name, out)
+		}
+	}
+}
+
+func applyDeprecationFixes(t *testing.T, src string, prog *ast.Program, code string) string {
+	t.Helper()
+	runes := []rune(src)
+	var edits []ast.TextEdit
+	for _, d := range prog.Deprecations {
+		if d.Code == code && d.Fix != nil {
+			edits = append(edits, d.Fix.Edits...)
+		}
+	}
+	// Apply from the end so earlier offsets stay valid.
+	for i := 0; i < len(edits); i++ {
+		for j := i + 1; j < len(edits); j++ {
+			if edits[j].Start > edits[i].Start {
+				edits[i], edits[j] = edits[j], edits[i]
+			}
+		}
+	}
+	for _, e := range edits {
+		runes = append(runes[:e.Start], append([]rune(e.Text), runes[e.Stop:]...)...)
+	}
+	return string(runes)
+}
+
+func TestR2Children_ImageRejectsUnknownOrMissingFile(t *testing.T) {
+	for src, want := range map[string]string{
+		`create image collection M.I { image Logo ( Path: 'x.png' ) };`:              "unknown property 'Path'",
+		`create image collection M.I { image Logo ( File: 'x.png', Size: 'big' ) };`: "unknown property 'Size'",
+	} {
+		_, errs := Build(src)
+		if len(errs) == 0 || !strings.Contains(errs[0].Error(), want) {
+			t.Errorf("%q: errors %v, want one containing %q", src, errs, want)
+		}
+	}
+}
+
+func TestR2Children_EmptyAssociationTree(t *testing.T) {
+	prog := buildNoErrors(t, `create message definition collection M.Msgs { definition O for M.O { M.O_L/M.L { } } };`)
+	s := prog.Statements[0].(*ast.CreateMessageDefinitionCollectionStmt)
+	m := s.Definitions[0].Members[0]
+	if m.Entity.Name != "L" || len(m.Members) != 0 {
+		t.Errorf("member = %+v", m)
+	}
+}
diff --git a/mdl/visitor/visitor_deprecations_test.go b/mdl/visitor/visitor_deprecations_test.go
index 34aa6436c7..b70b23a4de 100644
--- a/mdl/visitor/visitor_deprecations_test.go
+++ b/mdl/visitor/visitor_deprecations_test.go
@@ -99,7 +99,7 @@ var createOrReplaceCases = map[string]string{
 	"scheduledevent":              "scheduled event M.NightlyCleanup (Microflow: M.SE_Cleanup, Repeat: Daily, HourOfDay: 4, MinuteOfHour: 0, TimeZone: Server, Enabled: true);",
 	"regularexpression":           "regular expression M.Email (Expression: '.+@.+');",
 	"jsonstructure":               "json structure M.JSON_Pet snippet '{\"id\": 1}';",
-	"messagedefinitioncollection": "message definition collection M.MD_Order (definition OrderMessage for M.Order as 'Orders' (OrderId));",
+	"messagedefinitioncollection": "message definition collection M.MD_Order {definition OrderMessage for M.Order as 'Orders' {OrderId}};",
 	"importmapping":               "import mapping M.IMM_Order with json structure M.JSON_Order { create M.Order { Id = id } };",
 	"exportmapping":               "export mapping M.EMM_Order with json structure M.JSON_Order { M.Order { orderId = OrderId } };",
 	"configuration":               "configuration 'Default';",
diff --git a/mdl/visitor/visitor_imagecollection.go b/mdl/visitor/visitor_imagecollection.go
index 59c5cd4582..2c9d3ce1b3 100644
--- a/mdl/visitor/visitor_imagecollection.go
+++ b/mdl/visitor/visitor_imagecollection.go
@@ -3,6 +3,9 @@
 package visitor
 
 import (
+	"fmt"
+	"strings"
+
 	"github.com/mendixlabs/mxcli/mdl/ast"
 	"github.com/mendixlabs/mxcli/mdl/grammar/parser"
 )
@@ -35,15 +38,34 @@ func (b *Builder) ExitCreateImageCollectionStatement(ctx *parser.CreateImageColl
 
 	if body := ctx.ImageCollectionBody(); body != nil {
 		bodyCtx := body.(*parser.ImageCollectionBodyContext)
+		// { image Name ( File: '…' ) } — the canonical form.
+		for _, child := range bodyCtx.AllImageCollectionChild() {
+			childCtx := child.(*parser.ImageCollectionChildContext)
+			name := imageNameText(childCtx.ImageName())
+			item := ast.ImageItem{Name: name}
+			hasFile := false
+			for _, p := range childCtx.AllImageProperty() {
+				pc := p.(*parser.ImagePropertyContext)
+				key := identifierOrKeywordText(pc.IdentifierOrKeyword())
+				if !strings.EqualFold(key, "File") {
+					b.addError(fmt.Errorf("line %d: unknown property '%s' on image %s: an image takes only File: '<path>'",
+						pc.GetStart().GetLine(), key, name))
+					continue
+				}
+				item.FilePath = unquoteStringLit(pc.STRING_LITERAL())
+				hasFile = true
+			}
+			if !hasFile {
+				b.addError(fmt.Errorf("line %d: image %s has no File: an image is `image %s ( File: '<path>' )`",
+					childCtx.GetStart().GetLine(), name, name))
+			}
+			stmt.Images = append(stmt.Images, item)
+		}
+		// ( image Name from file '…', … ) — the old spelling (MDL-DEPR072).
 		for _, item := range bodyCtx.AllImageCollectionItem() {
 			itemCtx := item.(*parser.ImageCollectionItemContext)
-			name := itemCtx.ImageName().GetText()
-			// Strip quotes from quoted identifiers ("Name" or `Name`)
-			if len(name) >= 2 && (name[0] == '"' || name[0] == '`') {
-				name = name[1 : len(name)-1]
-			}
 			stmt.Images = append(stmt.Images, ast.ImageItem{
-				Name:     name,
+				Name:     imageNameText(itemCtx.ImageName()),
 				FilePath: unquoteStringLit(itemCtx.GetPath()),
 			})
 		}
@@ -56,3 +78,13 @@ func (b *Builder) ExitCreateImageCollectionStatement(ctx *parser.CreateImageColl
 
 	b.statements = append(b.statements, stmt)
 }
+
+// imageNameText is an image's name, without the quotes of a quoted identifier
+// ("Name" or `Name`).
+func imageNameText(ctx parser.IImageNameContext) string {
+	name := ctx.GetText()
+	if len(name) >= 2 && (name[0] == '"' || name[0] == '`') {
+		name = name[1 : len(name)-1]
+	}
+	return name
+}
diff --git a/mdl/visitor/visitor_messagedefinition.go b/mdl/visitor/visitor_messagedefinition.go
index c10602e967..560d93e7b9 100644
--- a/mdl/visitor/visitor_messagedefinition.go
+++ b/mdl/visitor/visitor_messagedefinition.go
@@ -13,7 +13,7 @@ import (
 //
 //	CREATE [OR MODIFY] MESSAGE DEFINITION COLLECTION Module.Name
 //	  [FOLDER 'path']
-//	( definition Name for Module.Entity [as 'Exposed'] ( members ), ... );
+//	{ definition Name for Module.Entity [as 'Exposed'] { members } ... };
 func (b *Builder) ExitCreateMessageDefinitionCollectionStatement(ctx *parser.CreateMessageDefinitionCollectionStatementContext) {
 	stmt := &ast.CreateMessageDefinitionCollectionStmt{
 		Name: buildQualifiedName(ctx.QualifiedName()),
@@ -47,12 +47,24 @@ func (b *Builder) buildMessageDefinitionDef(c parser.IMessageDefinitionDefContex
 		Entity:      buildQualifiedName(ctx.QualifiedName()),
 		ExposedName: exposedNameOf(ctx.MessageExposedName()),
 	}
+	def.Members = b.buildMessageMemberTree(ctx.MessageMemberTree())
+	return def
+}
+
+// buildMessageMemberTree builds the members of a `{ … }` tree, or of the old
+// `( … )` one (MDL-DEPR073).
+func (b *Builder) buildMessageMemberTree(c parser.IMessageMemberTreeContext) []*ast.MessageMemberDef {
+	ctx, ok := c.(*parser.MessageMemberTreeContext)
+	if ctx == nil || !ok {
+		return nil
+	}
+	var out []*ast.MessageMemberDef
 	for _, m := range ctx.AllMessageMember() {
 		if mem := b.buildMessageMember(m); mem != nil {
-			def.Members = append(def.Members, mem)
+			out = append(out, mem)
 		}
 	}
-	return def
+	return out
 }
 
 // buildMessageMember builds an exposed attribute or an exposed association.
@@ -68,16 +80,12 @@ func (b *Builder) buildMessageMember(c parser.IMessageMemberContext) *ast.Messag
 	mem := &ast.MessageMemberDef{ExposedName: exposedNameOf(ctx.MessageExposedName())}
 
 	if qns := ctx.AllQualifiedName(); len(qns) == 2 {
-		// Association: Assoc/Module.Entity ( members ). The target entity is
+		// Association: Assoc/Module.Entity { members }. The target entity is
 		// spelled out because MaxOccurs tracks the DIRECTION of traversal, not
 		// the association's type — see the AST doc comment.
 		mem.Association = buildQualifiedName(qns[0])
 		mem.Entity = buildQualifiedName(qns[1])
-		for _, sub := range ctx.AllMessageMember() {
-			if child := b.buildMessageMember(sub); child != nil {
-				mem.Members = append(mem.Members, child)
-			}
-		}
+		mem.Members = b.buildMessageMemberTree(ctx.MessageMemberTree())
 		return mem
 	}
 
@@ -125,11 +133,7 @@ func (b *Builder) ExitAlterMessageDefinitionCollectionStatement(ctx *parser.Alte
 		if len(ids) > 0 {
 			def.Name = identifierOrKeywordText(ids[0])
 		}
-		for _, m := range op.AllMessageMember() {
-			if mem := b.buildMessageMember(m); mem != nil {
-				def.Members = append(def.Members, mem)
-			}
-		}
+		def.Members = b.buildMessageMemberTree(op.MessageMemberTree())
 		stmt.Definition = def
 	case op.RENAME() != nil:
 		stmt.Op = "RENAME"
diff --git a/mdl/visitor/visitor_r2_children.go b/mdl/visitor/visitor_r2_children.go
new file mode 100644
index 0000000000..1b7e505b01
--- /dev/null
+++ b/mdl/visitor/visitor_r2_children.go
@@ -0,0 +1,106 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package visitor
+
+import (
+	"github.com/antlr4-go/antlr/v4"
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
+	"github.com/mendixlabs/mxcli/mdl/grammar/parser"
+)
+
+// R2 (ADR-0010, ako/mxcli#754): `( Key: value, … )` holds an element's
+// properties and `{ … }` its declarative children, each shaped
+// `<kind> [Name] ( props ) [ { children } ]`. The integration documents had the
+// brackets the other way round:
+//
+//   - a REST client operation and an agent's tool, MCP service and knowledge
+//     base put their properties in braces (MDL-DEPR070, MDL-DEPR071);
+//   - an image collection put its images in parentheses, each written
+//     `image X from file '…'` (MDL-DEPR072);
+//   - a message definition collection put its definitions, and every member
+//     tree, in parentheses (MDL-DEPR073).
+//
+// Each old form is a respelling that builds the same statement, so it keeps
+// parsing under every language version, warns, and `fmt --upgrade` rewrites it.
+
+// EnterStatement records each of the four codes at most once per statement:
+// a service with twenty operations in braces is one warning, not twenty. The
+// rewrite of that one record respells every old bracket pair in the statement.
+func (b *Builder) EnterStatement(ctx *parser.StatementContext) {
+	uses := map[string]*r2Use{}
+	var order []string
+	use := func(code string, at antlr.Token) *r2Use {
+		u := uses[code]
+		if u == nil {
+			u = &r2Use{first: at}
+			uses[code] = u
+			order = append(order, code)
+		}
+		return u
+	}
+	var walk func(antlr.Tree)
+	walk = func(n antlr.Tree) {
+		switch x := n.(type) {
+		case *parser.RestClientOperationContext:
+			if x.LBRACE() != nil && x.RBRACE() != nil {
+				use(deprecation.RestOperationBraces, x.LBRACE().GetSymbol()).swap(x.LBRACE(), x.RBRACE(), "(", ")")
+			}
+		case *parser.AgentBodyBlockContext:
+			if x.LBRACE() != nil && x.RBRACE() != nil {
+				use(deprecation.AgentAttachmentBraces, x.LBRACE().GetSymbol()).swap(x.LBRACE(), x.RBRACE(), "(", ")")
+			}
+		case *parser.ImageCollectionBodyContext:
+			if x.LPAREN() != nil && x.RPAREN() != nil {
+				use(deprecation.ImageCollectionParens, x.LPAREN().GetSymbol()).imageItems(x)
+			}
+		case *parser.CreateMessageDefinitionCollectionStatementContext:
+			if x.LPAREN() != nil && x.RPAREN() != nil {
+				use(deprecation.MessageTreeParens, x.LPAREN().GetSymbol()).swap(x.LPAREN(), x.RPAREN(), "{", "}")
+			}
+		case *parser.MessageMemberTreeContext:
+			if x.LPAREN() != nil && x.RPAREN() != nil {
+				use(deprecation.MessageTreeParens, x.LPAREN().GetSymbol()).swap(x.LPAREN(), x.RPAREN(), "{", "}")
+			}
+		}
+		for _, c := range n.GetChildren() {
+			walk(c)
+		}
+	}
+	walk(ctx)
+	for _, code := range order {
+		u := uses[code]
+		b.recordDeprecation(code, u.first, "")
+		b.fixLastDeprecation(code, &ast.Fix{Edits: u.edits}, "")
+	}
+}
+
+// r2Use is the uses of one code in one statement: where the first is, and the
+// edits that rewrite all of them.
+type r2Use struct {
+	first antlr.Token
+	edits []ast.TextEdit
+}
+
+// swap respells the bracket pair open … closing as newOpen … newClose.
+func (u *r2Use) swap(open, closing antlr.TerminalNode, newOpen, newClose string) {
+	o, c := open.GetSymbol(), closing.GetSymbol()
+	u.edits = append(u.edits, replaceSpan(o, o, newOpen), replaceSpan(c, c, newClose))
+}
+
+// imageItems rewrites `( image X from file '…', … )` as
+// `{ image X ( File: '…' ) … }`.
+func (u *r2Use) imageItems(ctx *parser.ImageCollectionBodyContext) {
+	u.swap(ctx.LPAREN(), ctx.RPAREN(), "{", "}")
+	for _, c := range ctx.AllCOMMA() {
+		u.edits = append(u.edits, replaceSpan(c.GetSymbol(), c.GetSymbol(), ""))
+	}
+	for _, it := range ctx.AllImageCollectionItem() {
+		item, ok := it.(*parser.ImageCollectionItemContext)
+		if !ok || item.FROM() == nil || item.GetPath() == nil {
+			continue
+		}
+		path := item.GetPath()
+		u.edits = append(u.edits, replaceSpan(item.FROM().GetSymbol(), path, "( File: "+path.GetText()+" )"))
+	}
+}

From e03a05966d3245eed755354067f8207cfd930f9f Mon Sep 17 00:00:00 2001
From: Ako <andrej@koelewijn.net>
Date: Mon, 28 Sep 2026 05:23:27 +0000
Subject: [PATCH 02/35] =?UTF-8?q?mdl:=20alter=20microflow=20fragments=20ar?=
 =?UTF-8?q?e=20begin=20=E2=80=A6=20end=20(R2)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A fragment is imperative flow, written as the body of create microflow is,
so insert after/before and replace … with take begin … end. The brace
fragment keeps parsing as MDL-DEPR074 with an fmt --upgrade rewrite. BEGIN
now ends an alter target, as { does; describe's handles never contain it.

Part of #754.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 mdl/deprecation/deprecation.go     | 14 ++++++++++++++
 mdl/grammar/MDLParser.g4           | 26 +++++++++++++++++++-------
 mdl/upgrade/r2_children_test.go    | 13 +++++++++++++
 mdl/visitor/r2_children_test.go    | 16 ++++++++++++++++
 mdl/visitor/visitor_alter_flow.go  |  6 ++++--
 mdl/visitor/visitor_r2_children.go | 14 +++++++++++++-
 6 files changed, 79 insertions(+), 10 deletions(-)

diff --git a/mdl/deprecation/deprecation.go b/mdl/deprecation/deprecation.go
index c3be1bfcc1..0316633214 100644
--- a/mdl/deprecation/deprecation.go
+++ b/mdl/deprecation/deprecation.go
@@ -173,6 +173,9 @@ const (
 	// MessageTreeParens is a message definition collection's definitions and
 	// member trees in parentheses.
 	MessageTreeParens = "MDL-DEPR073"
+	// AlterFlowFragmentBraces is an `alter microflow` / `alter nanoflow`
+	// fragment in braces: `insert after $X { … }`, `replace … with { … }`.
+	AlterFlowFragmentBraces = "MDL-DEPR074"
 )
 
 // entries is the registry. Append only: a code is never reused or renumbered,
@@ -443,6 +446,17 @@ var r2Entries = []Entry{
 		Example:          "create message definition collection M.Msgs (definition Order for M.Order (Number, M.Order_Line/M.Line (Sku)));",
 		CanonicalExample: "create message definition collection M.Msgs {definition Order for M.Order {Number, M.Order_Line/M.Line {Sku}}};",
 	},
+	{
+		Code:      AlterFlowFragmentBraces,
+		Old:       "alter microflow M.F { insert after $X { … } }",
+		Canonical: "alter microflow M.F { insert after $X begin … end; }",
+		Rewrite:   Rewrite{Structural: "the fragment's `{` becomes `begin` and its `}` becomes `end`"},
+		RemovedIn: 2,
+		Note: "A fragment is imperative flow, written exactly as the body of `create microflow`, so it is " +
+			"`begin … end` (R2). The operations around it are the alter's children and stay in its { }.",
+		Example:          "alter microflow M.F { insert after $X { log info 'x'; } };",
+		CanonicalExample: "alter microflow M.F { insert after $X begin log info 'x'; end };",
+	},
 }
 
 // r8Entries are R8's spellings (ako/mxcli#752). Kept apart from the list above
diff --git a/mdl/grammar/MDLParser.g4 b/mdl/grammar/MDLParser.g4
index 28fe0f0230..c98f720ff5 100644
--- a/mdl/grammar/MDLParser.g4
+++ b/mdl/grammar/MDLParser.g4
@@ -334,9 +334,9 @@ alterTarget
  *
  * ```mdl
  * alter microflow FeedbackModule.VAL_Feedback {
- *   insert after $IsValidEmail { log info node 'Feedback' 'Email checked'; }
- *   insert before 'Email is Valid?' { … }
- *   replace commit $Order with { commit $Order with events; }
+ *   insert after $IsValidEmail begin log info node 'Feedback' 'Email checked'; end;
+ *   insert before 'Email is Valid?' begin … end;
+ *   replace commit $Order with begin commit $Order with events; end;
  *   drop log * node 'Debug' *;
  * }
  * ```
@@ -345,17 +345,29 @@ alterTarget
  * microflow`. A target is a content address, resolved by mfmutator: `$Var`
  * (the activity that outputs it), `'Caption'`, or a statement pattern with `*`
  * wildcards, each optionally followed by `@n`. A pattern is any run of tokens,
- * so the target is taken as raw text up to the `{`, `with` or `;` that ends it;
+ * so the target is taken as raw text up to the `begin`, `{`, `with` or `;` that ends it;
  * that is why `drop` needs its semicolon.
  */
 alterFlowOperation
-    : INSERT (AFTER | BEFORE) alterFlowTarget LBRACE microflowBody RBRACE SEMICOLON?
-    | REPLACE alterFlowTarget WITH LBRACE microflowBody RBRACE SEMICOLON?
+    : INSERT (AFTER | BEFORE) alterFlowTarget alterFlowFragment SEMICOLON?
+    | REPLACE alterFlowTarget WITH alterFlowFragment SEMICOLON?
     | DROP alterFlowTarget SEMICOLON
     ;
 
+// A fragment is imperative flow, so it is `begin … end` like the body of the
+// `create microflow` it is copied from (R2, ako/mxcli#754). The operations
+// around it are the alter's declarative children and stay in the alter's { }.
+// The brace fragment is the old spelling.
+alterFlowFragment
+    : BEGIN microflowBody END
+    | LBRACE /* @alias MDL-DEPR074 */ microflowBody RBRACE
+    ;
+
+// BEGIN ends a target as `{` does. describe's handles never contain it: a loop
+// prints `begin` on a line of its own, and an error handler's `begin` is
+// stripped from its activity's handle.
 alterFlowTarget
-    : ~(LBRACE | RBRACE | SEMICOLON | WITH)+
+    : ~(LBRACE | RBRACE | SEMICOLON | WITH | BEGIN)+
     ;
 
 // ALTER PAGES [IN <module>] SET LAYOUT = Module.Layout [MAP (...)] [WHERE LAYOUT = Module.Old]
diff --git a/mdl/upgrade/r2_children_test.go b/mdl/upgrade/r2_children_test.go
index 182cc14dd2..b629f902c2 100644
--- a/mdl/upgrade/r2_children_test.go
+++ b/mdl/upgrade/r2_children_test.go
@@ -38,6 +38,12 @@ create message definition collection M.Msgs (
   )
 );
 alter message definition M.Msgs.Order add member M.Order_Tag/M.Tag ( Label );
+ALTER NANOFLOW M.N {
+  INSERT AFTER $X { LOG INFO 'x'; }
+  replace commit $O with {
+    commit $O with events;
+  };
+};
 `
 	want := `create consumed rest service M.Api (BaseUrl: 'https://x', Authentication: none)
 {
@@ -65,6 +71,12 @@ create message definition collection M.Msgs {
   }
 };
 alter message definition M.Msgs.Order add member M.Order_Tag/M.Tag { Label };
+ALTER NANOFLOW M.N {
+  INSERT AFTER $X BEGIN LOG INFO 'x'; END
+  replace commit $O with begin
+    commit $O with events;
+  end;
+};
 `
 	res := mustUpgrade(t, src, Options{})
 	if res.Source != want {
@@ -73,6 +85,7 @@ alter message definition M.Msgs.Order add member M.Order_Tag/M.Tag { Label };
 	for code, n := range map[string]int{
 		deprecation.RestOperationBraces: 1, deprecation.AgentAttachmentBraces: 2,
 		deprecation.ImageCollectionParens: 1, deprecation.MessageTreeParens: 2,
+		deprecation.AlterFlowFragmentBraces: 1,
 	} {
 		if res.Rewritten[code] != n {
 			t.Errorf("Rewritten[%s] = %d, want %d (all: %v)", code, res.Rewritten[code], n, res.Rewritten)
diff --git a/mdl/visitor/r2_children_test.go b/mdl/visitor/r2_children_test.go
index c6f95b2475..821b02f24f 100644
--- a/mdl/visitor/r2_children_test.go
+++ b/mdl/visitor/r2_children_test.go
@@ -92,6 +92,22 @@ var r2Cases = []r2Case{
 		old:       `alter message definition collection M.Msgs add definition X for M.X as 'Xs' ( A, M.X_Y/M.Y ( B ) );`,
 		canonical: `alter message definition collection M.Msgs add definition X for M.X as 'Xs' { A, M.X_Y/M.Y { B } };`,
 	},
+	{
+		name: "alter microflow fragments",
+		code: deprecation.AlterFlowFragmentBraces,
+		old: `alter microflow M.F {
+  insert after $IsValid { log info node 'F' 'checked'; }
+  insert before 'Save order' { if $X then log info 'y'; end if; };
+  replace commit $Order with { commit $Order with events; }
+  drop log * node 'Debug' *;
+};`,
+		canonical: `alter microflow M.F {
+  insert after $IsValid begin log info node 'F' 'checked'; end
+  insert before 'Save order' begin if $X then log info 'y'; end if; end;
+  replace commit $Order with begin commit $Order with events; end;
+  drop log * node 'Debug' *;
+};`,
+	},
 	{
 		name:      "add member",
 		code:      deprecation.MessageTreeParens,
diff --git a/mdl/visitor/visitor_alter_flow.go b/mdl/visitor/visitor_alter_flow.go
index 784848fdaf..181a6a2eb5 100644
--- a/mdl/visitor/visitor_alter_flow.go
+++ b/mdl/visitor/visitor_alter_flow.go
@@ -29,8 +29,10 @@ func (b *Builder) exitAlterFlowStatement(ctx *parser.AlterStatementContext) {
 		default:
 			o.Op = ast.AlterFlowDrop
 		}
-		if body := op.MicroflowBody(); body != nil {
-			o.Body = buildMicroflowBody(body)
+		if frag, ok := op.AlterFlowFragment().(*parser.AlterFlowFragmentContext); ok && frag != nil {
+			if body := frag.MicroflowBody(); body != nil {
+				o.Body = buildMicroflowBody(body)
+			}
 		}
 		stmt.Operations = append(stmt.Operations, o)
 	}
diff --git a/mdl/visitor/visitor_r2_children.go b/mdl/visitor/visitor_r2_children.go
index 1b7e505b01..25a317e85a 100644
--- a/mdl/visitor/visitor_r2_children.go
+++ b/mdl/visitor/visitor_r2_children.go
@@ -19,7 +19,9 @@ import (
 //   - an image collection put its images in parentheses, each written
 //     `image X from file '…'` (MDL-DEPR072);
 //   - a message definition collection put its definitions, and every member
-//     tree, in parentheses (MDL-DEPR073).
+//     tree, in parentheses (MDL-DEPR073);
+//   - an `alter microflow` fragment, which is imperative flow, was in braces
+//     rather than `begin … end` (MDL-DEPR074).
 //
 // Each old form is a respelling that builds the same statement, so it keeps
 // parsing under every language version, warns, and `fmt --upgrade` rewrites it.
@@ -58,6 +60,16 @@ func (b *Builder) EnterStatement(ctx *parser.StatementContext) {
 			if x.LPAREN() != nil && x.RPAREN() != nil {
 				use(deprecation.MessageTreeParens, x.LPAREN().GetSymbol()).swap(x.LPAREN(), x.RPAREN(), "{", "}")
 			}
+		case *parser.AlterFlowFragmentContext:
+			if x.LBRACE() != nil && x.RBRACE() != nil {
+				// In the case of the operation's verb: `INSERT … BEGIN … END`.
+				like := "insert"
+				if op, ok := x.GetParent().(antlr.ParserRuleContext); ok && op.GetStart() != nil {
+					like = op.GetStart().GetText()
+				}
+				use(deprecation.AlterFlowFragmentBraces, x.LBRACE().GetSymbol()).swap(x.LBRACE(), x.RBRACE(),
+					keywordLike(like, "begin"), keywordLike(like, "end"))
+			}
 		case *parser.MessageMemberTreeContext:
 			if x.LPAREN() != nil && x.RPAREN() != nil {
 				use(deprecation.MessageTreeParens, x.LPAREN().GetSymbol()).swap(x.LPAREN(), x.RPAREN(), "{", "}")

From ab9c5ebadc9bf876a7c3b12a5e280e1abeca2492 Mon Sep 17 00:00:00 2001
From: Ako <andrej@koelewijn.net>
Date: Mon, 28 Sep 2026 05:23:29 +0000
Subject: [PATCH 03/35] docs: move skills, docs, examples and syntax help to
 the R2 brackets

Converted with the visitor's own MDL-DEPR070..074 rewrites (no other
spelling touched), plus the syntax-pattern blocks by hand. Records the
alter-fragment decision in the beta syntax proposal.

Part of #754.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .claude/skills/design-mdl-syntax.md           |   2 +-
 .claude/skills/mendix/agents/SKILL.md         |  18 +-
 .../json-structures-and-mappings/SKILL.md     |  10 +-
 .../reference/message-definitions.md          |  14 +-
 .claude/skills/mendix/rest-client/SKILL.md    |  12 +-
 CHANGELOG.md                                  |   1 +
 cmd/mxcli/syntax/features_integration.go      |  26 +--
 cmd/mxcli/syntax/features_microflow.go        |  14 +-
 docs-site/src/examples/rest-integration.md    |  12 +-
 docs-site/src/language/image-collections.md   |  28 +--
 docs-site/src/reference/agent/create-agent.md |  19 +-
 .../create-image-collection.md                |  30 +--
 .../create-message-definition-collection.md   |  20 +-
 docs/01-project/MDL_QUICK_REFERENCE.md        |  26 +--
 .../PROPOSAL_mdl_beta_syntax_freeze.md        |   1 +
 .../bug-tests/1059-widget-icon-elements.mdl   |   6 +-
 .../bug-tests/200-basic-auth-rest-client.mdl  |   4 +-
 .../bug-tests/464-alter-agent-editor.mdl      |   4 +-
 .../556-reexec-identity-stability.mdl         |   4 +-
 ...843-rest-response-mapping-no-body.fail.mdl |   4 +-
 .../bug-tests/843-rest-response-mapping.mdl   |   4 +-
 .../messagedef-referenceset-cardinality.mdl   |  24 +--
 .../bug-tests/rest-file-request-body.fail.mdl |   4 +-
 .../bug-tests/rest-inline-mapping-paths.mdl   |   8 +-
 .../doctype-tests/06-rest-client-examples.mdl | 172 +++++++++---------
 .../19-image-collection-examples.mdl          |  16 +-
 .../28-agent-editor-examples.mdl              |  12 +-
 .../40-message-definition-examples.mdl        |  34 ++--
 .../use-cases/ai-agent-platform-demo.mdl      |   8 +-
 29 files changed, 275 insertions(+), 262 deletions(-)

diff --git a/.claude/skills/design-mdl-syntax.md b/.claude/skills/design-mdl-syntax.md
index 7a7f3259af..4e702f797a 100644
--- a/.claude/skills/design-mdl-syntax.md
+++ b/.claude/skills/design-mdl-syntax.md
@@ -73,7 +73,7 @@ Does an existing pattern cover this? If yes, extend it. Don't invent new syntax.
 ```
 New feature: "image collections"
 Existing pattern: create/alter/drop/list/describe
-design: create image collection Module.Name (...)
+design: create image collection Module.Name { image X ( File: '…' ) }
         describe image collection Module.Name
         list image COLLECTIONS [in module]
 ```
diff --git a/.claude/skills/mendix/agents/SKILL.md b/.claude/skills/mendix/agents/SKILL.md
index 218f74ea3d..1d8e070975 100644
--- a/.claude/skills/mendix/agents/SKILL.md
+++ b/.claude/skills/mendix/agents/SKILL.md
@@ -96,22 +96,22 @@ prompt here.$$,
   UserPrompt: 'Single line prompt.'
 )
 {
-  mcp service Module.WebSearch {
+  mcp service Module.WebSearch (
     Enabled: true
-  }
+  )
 
-  knowledge base KBAlias {
+  knowledge base KBAlias (
     source: Module.ProductDocs,
     collection: 'product-docs',
     MaxResults: 5,
     description: 'Product docs',
     Enabled: true
-  }
+  )
 
-  tool MyMicroflowTool {
+  tool MyMicroflowTool (
     description: 'Fetch customer data',
     Enabled: true
-  }
+  )
 };
 ```
 
@@ -131,9 +131,9 @@ alter consumed mcp service Module.MyMCP
 -- Agent: SET for scalars, ADD/DROP for tools, MCP services, knowledge bases
 alter agent Module.MyAgent
     set SystemPrompt = 'New prompt', Temperature = 0.7, MaxTokens = 4096
-    add tool MyMicroflow { Description: '...', Enabled: true }
-    add mcp service Module.WeatherSvc { Description: '...', Enabled: true }
-    add knowledge base Docs { Source: Module.MyKB, Collection: 'docs', MaxResults: 5 }
+    add tool MyMicroflow ( Description: '...', Enabled: true )
+    add mcp service Module.WeatherSvc ( Description: '...', Enabled: true )
+    add knowledge base Docs ( Source: Module.MyKB, Collection: 'docs', MaxResults: 5 )
     drop tool OldTool
     drop mcp service Module.OldSvc
     drop knowledge base OldKB;
diff --git a/.claude/skills/mendix/json-structures-and-mappings/SKILL.md b/.claude/skills/mendix/json-structures-and-mappings/SKILL.md
index ca84f5b6c8..e2304071ed 100644
--- a/.claude/skills/mendix/json-structures-and-mappings/SKILL.md
+++ b/.claude/skills/mendix/json-structures-and-mappings/SKILL.md
@@ -163,12 +163,12 @@ in the demo corpus (22.6%), and the only non-JSON source MDL can create. It
 holds nothing external: it is a **selection over the domain model**.
 
 ```sql
-create message definition collection Sales.MD_Order (
-  definition OrderMessage for Sales.Order as 'Orders' (
+create message definition collection Sales.MD_Order {
+  definition OrderMessage for Sales.Order as 'Orders' {
     OrderId,
-    Sales.Order_Customer/Sales.Customer ( FirstName )
-  )
-);
+    Sales.Order_Customer/Sales.Customer { FirstName }
+  }
+};
 ```
 
 A bare name is an attribute; `Assoc/Module.Entity` is an association. **Name the
diff --git a/.claude/skills/mendix/json-structures-and-mappings/reference/message-definitions.md b/.claude/skills/mendix/json-structures-and-mappings/reference/message-definitions.md
index 7db5877958..8a9fc07095 100644
--- a/.claude/skills/mendix/json-structures-and-mappings/reference/message-definitions.md
+++ b/.claude/skills/mendix/json-structures-and-mappings/reference/message-definitions.md
@@ -10,14 +10,14 @@ external: it is a **selection over the domain model**.
 ```sql
 create message definition collection Sales.MD_Order
   folder 'Messages'
-(
-  definition OrderMessage for Sales.Order as 'Orders' (
+{
+  definition OrderMessage for Sales.Order as 'Orders' {
     OrderId,
     Total as 'GrandTotal',
-    Sales.OrderLine_Order/Sales.OrderLine as 'Lines' ( Sku, Quantity ),
-    Sales.Order_Customer/Sales.Customer ( FirstName, Address example 'Kerstraat 5' )
-  )
-);
+    Sales.OrderLine_Order/Sales.OrderLine as 'Lines' { Sku, Quantity },
+    Sales.Order_Customer/Sales.Customer { FirstName, Address example 'Kerstraat 5' }
+  }
+};
 ```
 
 A **bare name is an attribute**; `Assoc/Module.Entity` is an **association** with
@@ -62,7 +62,7 @@ alter message definition Sales.MD_Order.OrderMessage add member LastName in Cust
 alter message definition Sales.MD_Order.OrderMessage set member Total as 'GrandTotal';
 alter message definition Sales.MD_Order.OrderMessage drop member Sku in Lines;
 
-alter message definition collection Sales.MD_Order add definition Line for Sales.Line ( Sku );
+alter message definition collection Sales.MD_Order add definition Line for Sales.Line { Sku };
 alter message definition collection Sales.MD_Order rename definition Line to OrderLine;
 alter message definition collection Sales.MD_Order drop definition if exists OrderLine;
 ```
diff --git a/.claude/skills/mendix/rest-client/SKILL.md b/.claude/skills/mendix/rest-client/SKILL.md
index 8e3658de8f..9d86f8315d 100644
--- a/.claude/skills/mendix/rest-client/SKILL.md
+++ b/.claude/skills/mendix/rest-client/SKILL.md
@@ -81,22 +81,22 @@ create consumed rest service Module.OpenMeteoAPI (
   authentication: none
 )
 {
-  operation GetForecast {
+  operation GetForecast (
     method: get,
     path: '/forecast',
     query: ($latitude: decimal, $longitude: decimal, $current: string),
     headers: ('Accept' = 'application/json'),
     timeout: 30,
     response: json as $WeatherJson
-  }
+  )
 
-  operation PostData {
+  operation PostData (
     method: post,
     path: '/submit',
     headers: ('Content-Type' = 'application/json'),
     body: json from $JsonPayload,
     response: none
-  }
+  )
 };
 ```
 
@@ -417,13 +417,13 @@ create consumed rest service Module.WeatherAPI (
   authentication: none
 )
 {
-  operation GetCurrent {
+  operation GetCurrent (
     method: get,
     path: '/forecast',
     query: ($latitude: decimal, $longitude: decimal, $current: string),
     headers: ('Accept' = 'application/json'),
     response: json as $Result
-  }
+  )
 };
 
 -- 5. Microflow (REST Client → Transform → Import)
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3c0e773a25..791a8f4c77 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 - **Document types are named as Studio Pro names them** (ako/mxcli#755, R10) — `consumed rest service` (was `rest client`), `consumed odata service` (was `odata client`), `published odata service` (was `odata service`), `task queue` (was `queue`), `alter app security` (was `alter project security`) and `alter settings runtime` (was `alter settings model`), in every statement that names the type: create, alter, drop, describe, list, move, grant/revoke on a published OData service, and an external entity's `from consumed odata service`. `describe` writes the new names. **Migrating a script:** nothing breaks — the old names still parse and build the identical statement, `check` / `exec` warn **MDL-DEPR550** to **MDL-DEPR555**, and `mxcli fmt --upgrade` rewrites them. `call microflow … in queue M.Q` is a call option, not the type name, and is unchanged.
 
+- **Integration documents put properties in `( )` and children in `{ }`; an `alter microflow` fragment is `begin … end`** (ako/mxcli#754, R2) — a consumed REST service's operations are `operation GetUser ( Method: get, Path: '/u/{id}', Response: none )`; an agent's attachments are `tool X ( … )`, `mcp service M.S ( … )` and `knowledge base K ( … )`, in `create agent` and `alter agent … add`; an image collection is `create image collection M.Icons { image Logo ( File: 'logo.png' ) }`; a message definition collection is `{ definition D for M.E { A, M.E_B/M.B { C } } }`, and an association may select no member (`M.E_B/M.B { }`, which describe already printed as the unparseable `()`); and `alter microflow` / `alter nanoflow` take `insert after <target> begin … end;` and `replace <target> with begin … end;`, the fragment written as the body of `create microflow` is. `describe` prints the new forms. **Migrating a script:** nothing breaks — the old brackets still parse and build the identical statement, `check` / `exec` warn **MDL-DEPR070** (operation), **MDL-DEPR071** (agent attachment), **MDL-DEPR072** (image collection), **MDL-DEPR073** (message definitions) and **MDL-DEPR074** (alter fragment), once per statement, and `mxcli fmt --upgrade` rewrites them.
 - **An entity grant names the rights first, and every XPath is written in `[ ]`** (ako/mxcli#753, R5) — `grant read *, write (Email), create on entity Shop.Order to Shop.User where [Status = 'Open'];` takes the word order of every other grant, and the constraint is bracketed like a datasource or retrieve `where`, so the quotes inside it are written once instead of doubled. A workflow user task's targeting is the same: `targeting users xpath [System.UserRoles = '[%UserRole_Manager%]']`, and `alter workflow … set activity … targeting xpath [ … ]`. Sibling predicate groups (`[a][b]`) are one constraint, kept as written. `describe entity` and `describe workflow` print the new forms; a stored constraint the bracketed grammar does not read (none in the Studio Pro-authored PedApp and TestApp fixtures) is printed in the old quoted form so the output stays re-executable. **Migrating a script:** nothing breaks — `grant Shop.User on Shop.Order (read *) where '[…]'` and `targeting xpath '[…]'` still parse and build the same rule, and `check` / `exec` warn **MDL-DEPR030** and **MDL-DEPR031**; `mxcli fmt --upgrade` rewrites both. A quoted value that is not a bracketed XPath is left in place and reported. `revoke` keeps its current form for now.
 - **A microflow error handler is `on error [without rollback] begin … end error`; `while` takes `begin … end while` like `loop`** (ako/mxcli#754, R2) — braces hold declarative children and imperative flow is `begin … end <keyword>`, and the error handler was the only brace block inside a microflow. `describe microflow` / `describe nanoflow` now print `commit $O on error begin … end error;` (an empty handler `… on error without rollback begin end error;`), and so do the generated test flows of `mxcli test`. Under the `mdl 1;` preview header a `while` without `begin`, or ending in a bare `end`, is an error; without the header it keeps parsing and warns **MDL-V1-WHILE**, and `mxcli fmt --upgrade --header` inserts the missing words. Measured on the Studio Pro-authored PedApp and TestApp fixtures: the round-trip harness stays green. **Migrating a script:** nothing breaks — `on error { … }` still parses, builds the identical handler, and `check` / `exec` warn **MDL-DEPR540**; `mxcli fmt --upgrade` rewrites it.
 - **One argument form at every call site: `Param = expression`; one text-template form: `with ({1} = …)`** (ako/mxcli#751, R3/R4) — `call microflow`/`nanoflow`/`java action`/…, `execute database query`, `send rest request`, `show page`, and page/button actions and microflow/nanoflow data sources all bind an argument as `Order = $Order`, with no `$` on the parameter name and `=` rather than `:`. A workflow's `call microflow` / `call workflow` takes its arguments the same way, right after the callee, as bare expressions: `call microflow Shop.ACT_Process(Order = $WorkflowContext) as act1 comment 'Process'`. `show message` and `validation feedback` take `with ({1} = $a, {2} = $b)`, like `log` and the REST templates. `describe` writes these forms; it also writes a validation feedback's template arguments, which it used to drop, so describe → exec lost them. Measured on a copy of the Studio Pro-authored TestApp (Mendix 11.14.0): a script in the new forms and the same script in the old forms describe identically, and `mx check` reports 0 errors. **Migrating a script:** nothing breaks — `$Param = e` (**MDL-DEPR006**), `Param: e` (**MDL-DEPR007**), a workflow's `with (Param = '<expression>')` (**MDL-DEPR008**, same meaning: the string's content is the expression) and `objects [..]` / `parameters [..]` (**MDL-DEPR009**) still parse and build the same model, `check` / `exec` warn, and `mxcli fmt --upgrade` rewrites them. A workflow string whose content does not read back as the same bare expression is left in place and reported, and `describe` keeps the string form for such a stored expression.
diff --git a/cmd/mxcli/syntax/features_integration.go b/cmd/mxcli/syntax/features_integration.go
index e1a662c6ec..82cbb12ca8 100644
--- a/cmd/mxcli/syntax/features_integration.go
+++ b/cmd/mxcli/syntax/features_integration.go
@@ -299,8 +299,8 @@ func init() {
 			"body", "response", "mapping", "authentication",
 			"json structure", "import mapping", "export mapping",
 		},
-		Syntax:  "CREATE [OR MODIFY] CONSUMED REST SERVICE Module.Name (\n  BaseUrl: 'https://...',\n  Authentication: NONE | BASIC (...)\n)\n{\n  OPERATION Name {\n    Method: GET|POST|PUT|DELETE|PATCH,\n    Path: '/path/{param}',\n    Parameters: ($param: Type),\n    Query: ($param: Type),\n    Headers: ('Key' = 'Value'),\n    Timeout: 30,\n    Body: JSON FROM $var | MAPPING Entity { jsonField = Attribute, ... },\n    Response: JSON AS $var | MAPPING Entity { Attribute = jsonField, ... }\n  }\n};\n\n-- MAPPING takes a target ENTITY plus a body listing the JSON fields; Mendix\n-- stores it inline on the operation. An existing import/export mapping\n-- document cannot be referenced here (rejected as MDL-REST01).\n-- There is no FILE request body: Mendix's consumed operation stores one of\n-- Rest$JsonBody, Rest$StringBody or Rest$ImplicitMappingBody, so a file\n-- document has nowhere to go. `Body: FILE FROM $Doc` is rejected as\n-- MDL-REST02 rather than sent as the literal text \"$Doc\" (it used to be,\n-- returning 200 with a 4-byte payload). Binary POST lives on the\n-- microflow activity: `rest call post '<url>' body binary $Doc/Contents`.\n-- `Response: FILE AS $Doc` is unaffected — downloads work.",
-		Example: "CREATE CONSUMED REST SERVICE Module.PetStore (\n  BaseUrl: 'https://petstore.example.com/api',\n  Authentication: NONE\n)\n{\n  OPERATION GetPet {\n    Method: GET,\n    Path: '/pets/{id}',\n    Parameters: ($id: String),\n    Query: ($verbose: String),\n    Response: MAPPING Module.Pet {\n      Name = name,\n      Status = status\n    }\n  }\n};",
+		Syntax:  "CREATE [OR MODIFY] CONSUMED REST SERVICE Module.Name (\n  BaseUrl: 'https://...',\n  Authentication: NONE | BASIC (...)\n)\n{\n  OPERATION Name (\n    Method: GET|POST|PUT|DELETE|PATCH,\n    Path: '/path/{param}',\n    Parameters: ($param: Type),\n    Query: ($param: Type),\n    Headers: ('Key' = 'Value'),\n    Timeout: 30,\n    Body: JSON FROM $var | MAPPING Entity { jsonField = Attribute, ... },\n    Response: JSON AS $var | MAPPING Entity { Attribute = jsonField, ... }\n  )\n};\n\n-- An operation is a child of the service, so its properties are in ( ).\n-- `OPERATION Name { ... }` is the deprecated spelling (MDL-DEPR070).\n\n-- MAPPING takes a target ENTITY plus a body listing the JSON fields; Mendix\n-- stores it inline on the operation. An existing import/export mapping\n-- document cannot be referenced here (rejected as MDL-REST01).\n-- There is no FILE request body: Mendix's consumed operation stores one of\n-- Rest$JsonBody, Rest$StringBody or Rest$ImplicitMappingBody, so a file\n-- document has nowhere to go. `Body: FILE FROM $Doc` is rejected as\n-- MDL-REST02 rather than sent as the literal text \"$Doc\" (it used to be,\n-- returning 200 with a 4-byte payload). Binary POST lives on the\n-- microflow activity: `rest call post '<url>' body binary $Doc/Contents`.\n-- `Response: FILE AS $Doc` is unaffected — downloads work.",
+		Example: "CREATE CONSUMED REST SERVICE Module.PetStore (\n  BaseUrl: 'https://petstore.example.com/api',\n  Authentication: NONE\n)\n{\n  OPERATION GetPet (\n    Method: GET,\n    Path: '/pets/{id}',\n    Parameters: ($id: String),\n    Query: ($verbose: String),\n    Response: MAPPING Module.Pet {\n      Name = name,\n      Status = status\n    }\n  )\n};",
 		SeeAlso: []string{"rest", "rest.published"},
 	})
 
@@ -602,9 +602,9 @@ DESCRIBE DATABASE CONNECTION Ops.Erp;`,
 			"message definition", "message definition collection", "create message definition",
 			"exposed entity", "exposed attribute", "exposed association",
 		},
-		Syntax: "SHOW MESSAGE DEFINITION COLLECTIONS [IN Module];\nDESCRIBE MESSAGE DEFINITION COLLECTION Module.Name;\nCREATE [OR MODIFY] MESSAGE DEFINITION COLLECTION Module.Name [FOLDER 'path']\n(\n  DEFINITION Name FOR Module.Entity [AS 'Exposed'] (\n    AttributeName [AS 'Exposed'] [EXAMPLE 'text'],\n    Module.Assoc/Module.TargetEntity [AS 'Exposed'] ( ... )\n  )\n);\nDROP MESSAGE DEFINITION COLLECTION Module.Name;\n\n" +
+		Syntax: "SHOW MESSAGE DEFINITION COLLECTIONS [IN Module];\nDESCRIBE MESSAGE DEFINITION COLLECTION Module.Name;\nCREATE [OR MODIFY] MESSAGE DEFINITION COLLECTION Module.Name [FOLDER 'path']\n{\n  DEFINITION Name FOR Module.Entity [AS 'Exposed'] {\n    AttributeName [AS 'Exposed'] [EXAMPLE 'text'],\n    Module.Assoc/Module.TargetEntity [AS 'Exposed'] { ... }\n  }\n};\nDROP MESSAGE DEFINITION COLLECTION Module.Name;\n\n" +
 			"ALTER MESSAGE DEFINITION COLLECTION Module.Name\n" +
-			"  ADD DEFINITION [IF NOT EXISTS] Name FOR Module.Entity [AS 'X'] ( ... )\n" +
+			"  ADD DEFINITION [IF NOT EXISTS] Name FOR Module.Entity [AS 'X'] { ... }\n" +
 			"  | DROP DEFINITION [IF EXISTS] Name\n" +
 			"  | RENAME DEFINITION Old TO New;\n\n" +
 			"ALTER MESSAGE DEFINITION Module.Collection.Definition\n" +
@@ -626,8 +626,10 @@ DESCRIBE DATABASE CONNECTION Ops.Erp;`,
 			"pluralises a repeating element's exposed name; mxcli defaults to the\n" +
 			"entity's own name and lets AS say otherwise.\n\n" +
 			"IN <path> reaches a nested member, in exposed names. SET changes only the\n" +
-			"exposed name — it is not a model rename. Authoring is modelsdk-only.",
-		Example: "CREATE MESSAGE DEFINITION COLLECTION Sales.MD_Order\n(\n  DEFINITION OrderMessage FOR Sales.Order AS 'Orders' (\n    OrderId,\n    Sales.OrderLine_Order/Sales.OrderLine AS 'Lines' ( Sku, Quantity ),\n    Sales.Order_Customer/Sales.Customer ( FirstName )\n  )\n);\n\nALTER MESSAGE DEFINITION Sales.MD_Order.OrderMessage ADD MEMBER LastName IN Customer;\n\nCREATE IMPORT MAPPING Sales.IMM_Order\n  WITH MESSAGE DEFINITION Sales.MD_Order.OrderMessage\n{ create Sales.Order { OrderId = OrderId } };",
+			"exposed name — it is not a model rename. Authoring is modelsdk-only.\n\n" +
+			"Definitions and member trees are children, so they are in { } (R2); the\n" +
+			"parenthesised form is the deprecated spelling MDL-DEPR073.",
+		Example: "CREATE MESSAGE DEFINITION COLLECTION Sales.MD_Order\n{\n  DEFINITION OrderMessage FOR Sales.Order AS 'Orders' {\n    OrderId,\n    Sales.OrderLine_Order/Sales.OrderLine AS 'Lines' { Sku, Quantity },\n    Sales.Order_Customer/Sales.Customer { FirstName }\n  }\n};\n\nALTER MESSAGE DEFINITION Sales.MD_Order.OrderMessage ADD MEMBER LastName IN Customer;\n\nCREATE IMPORT MAPPING Sales.IMM_Order\n  WITH MESSAGE DEFINITION Sales.MD_Order.OrderMessage\n{ create Sales.Order { OrderId = OrderId } };",
 	})
 
 	Register(SyntaxFeature{
@@ -657,8 +659,8 @@ DESCRIBE DATABASE CONNECTION Ops.Erp;`,
 			"image collection", "create image collection", "drop image collection",
 			"export level", "image", "icon", "logo",
 		},
-		Syntax:  "SHOW IMAGE COLLECTION [IN Module];\nDESCRIBE IMAGE COLLECTION Module.Name;\nCREATE IMAGE COLLECTION Module.Name [FOLDER 'path']\n  [EXPORT LEVEL 'Hidden'|'Public']\n  [COMMENT 'text']\n  [(IMAGE name FROM FILE 'path', ...)];\nCREATE OR MODIFY IMAGE COLLECTION Module.Name [...];\nDROP IMAGE COLLECTION Module.Name;",
-		Example: "CREATE OR MODIFY IMAGE COLLECTION MyModule.AppIcons\n  EXPORT LEVEL 'Public'\n  COMMENT 'Application icons' (\n  IMAGE logo FROM FILE 'assets/logo.png',\n  IMAGE \"favicon\" FROM FILE 'assets/favicon.ico'\n);\n\nDESCRIBE IMAGE COLLECTION MyModule.AppIcons;",
+		Syntax:  "SHOW IMAGE COLLECTION [IN Module];\nDESCRIBE IMAGE COLLECTION Module.Name;\nCREATE IMAGE COLLECTION Module.Name [FOLDER 'path']\n  [EXPORT LEVEL 'Hidden'|'Public']\n  [COMMENT 'text']\n  [{ IMAGE name ( File: 'path' ) ... }];\nCREATE OR MODIFY IMAGE COLLECTION Module.Name [...];\nDROP IMAGE COLLECTION Module.Name;\n\n-- The images are the collection's children, so they are in { }, each with\n-- its properties in ( ). `( IMAGE name FROM FILE 'path', ... )` is the\n-- deprecated spelling (MDL-DEPR072).",
+		Example: "CREATE OR MODIFY IMAGE COLLECTION MyModule.AppIcons\n  EXPORT LEVEL 'Public'\n  COMMENT 'Application icons' {\n  IMAGE logo ( File: 'assets/logo.png' )\n  IMAGE \"favicon\" ( File: 'assets/favicon.ico' )\n};\n\nDESCRIBE IMAGE COLLECTION MyModule.AppIcons;",
 		SeeAlso: []string{"integration", "icon-collection"},
 	})
 
@@ -868,11 +870,11 @@ DESCRIBE DATABASE CONNECTION Ops.Erp;`,
   [UserPrompt: 'prompt']
 )
 {
-  [MCP SERVICE Module.ServiceName { Enabled: true }]
-  [KNOWLEDGE BASE AliaName { Source: Module.KB, Collection: 'col', MaxResults: 5, Enabled: true }]
-  [TOOL MicroflowName { Description: 'desc', Enabled: true }]
+  [MCP SERVICE Module.ServiceName ( Enabled: true )]
+  [KNOWLEDGE BASE AliaName ( Source: Module.KB, Collection: 'col', MaxResults: 5, Enabled: true )]
+  [TOOL MicroflowName ( Description: 'desc', Enabled: true )]
 };`,
-		Example: "create agent MyModule.Assistant (\n  UsageType: Chat,\n  Model: MyModule.GPT4,\n  SystemPrompt: $$You are a helpful assistant.$$,\n  UserPrompt: 'Ask me anything.'\n)\n{\n  MCP SERVICE MyModule.WebSearch { Enabled: true }\n};",
+		Example: "create agent MyModule.Assistant (\n  UsageType: Chat,\n  Model: MyModule.GPT4,\n  SystemPrompt: $$You are a helpful assistant.$$,\n  UserPrompt: 'Ask me anything.'\n)\n{\n  MCP SERVICE MyModule.WebSearch ( Enabled: true )\n};",
 		SeeAlso: []string{"agents", "agents.model", "agents.knowledge-base", "agents.mcp-service"},
 	})
 }
diff --git a/cmd/mxcli/syntax/features_microflow.go b/cmd/mxcli/syntax/features_microflow.go
index 660db845fc..5a723477c7 100644
--- a/cmd/mxcli/syntax/features_microflow.go
+++ b/cmd/mxcli/syntax/features_microflow.go
@@ -474,8 +474,8 @@ func init() {
 			"replace", "drop activity", "patch microflow", "splice", "handle",
 		},
 		Syntax: "ALTER MICROFLOW|NANOFLOW Module.Name {\n" +
-			"  INSERT AFTER|BEFORE <target> { <statements> }\n" +
-			"  REPLACE <target> WITH { <statements> }\n" +
+			"  INSERT AFTER|BEFORE <target> BEGIN <statements> END;\n" +
+			"  REPLACE <target> WITH BEGIN <statements> END;\n" +
 			"  DROP <target>;\n" +
 			"};\n\n" +
 			"-- <target> addresses one activity by content, as `describe microflow ... with handles` prints it:\n" +
@@ -489,13 +489,15 @@ func init() {
 			"-- Refused: insert after a decision, insert before an activity several flows enter,\n" +
 			"-- drop/replace of a decision or of an activity with an error handler, anything inside\n" +
 			"-- a loop body, a fragment that returns, and a fragment variable that clashes with one\n" +
-			"-- the flow has or reads one not declared on the path. Over --mcp only insert is supported.",
+			"-- the flow has or reads one not declared on the path. Over --mcp only insert is supported.\n" +
+			"-- A fragment is imperative flow, written as the body of `create microflow` is: BEGIN … END.\n" +
+			"-- The brace fragment `{ <statements> }` is the deprecated spelling MDL-DEPR074.",
 		Example: "alter microflow FeedbackModule.VAL_Feedback {\n" +
-			"  insert after $IsValidEmail { log info node 'Feedback' 'Email checked'; }\n" +
-			"  replace set $ValidFeedback = false @3 with {\n" +
+			"  insert after $IsValidEmail begin log info node 'Feedback' 'Email checked'; end;\n" +
+			"  replace set $ValidFeedback = false @3 with begin\n" +
 			"    set $ValidFeedback = false;\n" +
 			"    log warning node 'Feedback' 'Email rejected';\n" +
-			"  }\n" +
+			"  end;\n" +
 			"  drop log debug node 'Feedback' *;\n" +
 			"};",
 		SeeAlso: []string{"microflow"},
diff --git a/docs-site/src/examples/rest-integration.md b/docs-site/src/examples/rest-integration.md
index 80eaee30cc..95bd08604e 100644
--- a/docs-site/src/examples/rest-integration.md
+++ b/docs-site/src/examples/rest-integration.md
@@ -251,16 +251,16 @@ CREATE CONSUMED REST SERVICE Integration.OrdersApi (
   Authentication: NONE
 )
 {
-  OPERATION GetOrder {
+  OPERATION GetOrder (
     Method: GET,
     Path: '/orders/{id}',
     Parameters: ($id: String),
     Headers: ('Accept' = 'application/json'),
     Timeout: 30,
     Response: JSON AS $Result
-  }
+  )
 
-  OPERATION CreateOrder {
+  OPERATION CreateOrder (
     Method: POST,
     Path: '/orders',
     Headers: ('Content-Type' = 'application/json'),
@@ -274,7 +274,7 @@ CREATE CONSUMED REST SERVICE Integration.OrdersApi (
       Status = status,
       CreatedAt = createdAt,
     }
-  }
+  )
 };
 ```
 
@@ -286,14 +286,14 @@ CREATE OR MODIFY CONSUMED REST SERVICE Integration.OrdersApi (
   Authentication: BASIC (Username: 'apiuser', Password: 'secret')
 )
 {
-  OPERATION GetOrder {
+  OPERATION GetOrder (
     Method: GET,
     Path: '/orders/{id}',
     Parameters: ($id: String),
     Headers: ('Accept' = 'application/json'),
     Timeout: 60,
     Response: JSON AS $Result
-  }
+  )
 };
 ```
 
diff --git a/docs-site/src/language/image-collections.md b/docs-site/src/language/image-collections.md
index 8ffe7fb4a5..6ab04ebc1c 100644
--- a/docs-site/src/language/image-collections.md
+++ b/docs-site/src/language/image-collections.md
@@ -15,7 +15,7 @@ SHOW IMAGE COLLECTION IN MyModule;
 DESCRIBE IMAGE COLLECTION MyModule.AppIcons;
 ```
 
-The `DESCRIBE` output includes the full `CREATE` statement. If the collection contains images, they are shown with `IMAGE 'name' FROM FILE 'path'` syntax that can be copied and re-executed. In the TUI, images are rendered inline when the terminal supports it (Kitty, iTerm2, Sixel).
+The `DESCRIBE` output includes the full `CREATE` statement. If the collection contains images, they are shown as `image Name ( File: 'path' )` children that can be copied and re-executed. In the TUI, images are rendered inline when the terminal supports it (Kitty, iTerm2, Sixel).
 
 ## CREATE IMAGE COLLECTION
 
@@ -23,17 +23,19 @@ The `DESCRIBE` output includes the full `CREATE` statement. If the collection co
 CREATE IMAGE COLLECTION <Module>.<Name>
   [EXPORT LEVEL 'Hidden'|'Public']
   [COMMENT '<description>']
-  [(
-    IMAGE <Name> FROM FILE '<path>',
+  [{
+    IMAGE <Name> ( File: '<path>' )
     ...
-  )];
+  }];
 ```
 
 | Option | Description | Default |
 |--------|-------------|---------|
 | `EXPORT LEVEL` | `'Hidden'` (internal to module) or `'Public'` (accessible from other modules) | `'Hidden'` |
 | `COMMENT` | Documentation for the collection | (none) |
-| `IMAGE Name FROM FILE` | Load an image from the filesystem into the collection | (none) |
+| `IMAGE Name ( File: '…' )` | Load an image from the filesystem into the collection | (none) |
+
+The images are the collection's children, so they are in `{ }`, each with its properties in `( )`. The older form `( IMAGE Name FROM FILE '<path>', … )` still parses but warns (MDL-DEPR072); `mxcli fmt --upgrade` rewrites it.
 
 The image format is detected automatically from the file extension. Relative paths are resolved from the current working directory. Supported formats: PNG, SVG, GIF, JPEG, BMP, WebP.
 
@@ -51,18 +53,18 @@ CREATE IMAGE COLLECTION MyModule.StatusIcons
   COMMENT 'Icons for order and task status indicators';
 
 -- With images from files
-CREATE IMAGE COLLECTION MyModule.NavigationIcons (
-  IMAGE home FROM FILE 'assets/home.png',
-  IMAGE settings FROM FILE 'assets/settings.svg'
-);
+CREATE IMAGE COLLECTION MyModule.NavigationIcons {
+  IMAGE home ( File: 'assets/home.png' )
+  IMAGE settings ( File: 'assets/settings.svg' )
+};
 
 -- All options combined
 CREATE IMAGE COLLECTION MyModule.BrandAssets
   EXPORT LEVEL 'Public'
-  COMMENT 'Company branding assets' (
-  IMAGE logo_dark FROM FILE 'assets/logo-dark.png',
-  IMAGE logo_light FROM FILE 'assets/logo-light.png'
-);
+  COMMENT 'Company branding assets' {
+  IMAGE logo_dark ( File: 'assets/logo-dark.png' )
+  IMAGE logo_light ( File: 'assets/logo-light.png' )
+};
 ```
 
 ## DROP IMAGE COLLECTION
diff --git a/docs-site/src/reference/agent/create-agent.md b/docs-site/src/reference/agent/create-agent.md
index 3b67fe9549..b5be74921f 100644
--- a/docs-site/src/reference/agent/create-agent.md
+++ b/docs-site/src/reference/agent/create-agent.md
@@ -15,16 +15,16 @@ CREATE [ OR MODIFY ] AGENT module.Name (
     [, ToolChoice: { Auto | None | Required } ]
 )
 [ {
-    [ MCP SERVICE module.McpServiceName {
+    [ MCP SERVICE module.McpServiceName (
         Enabled: true
-    } ]
-    [ KNOWLEDGE BASE alias {
+    ) ]
+    [ KNOWLEDGE BASE alias (
         source: module.KBName,
         collection: 'collection-name',
         MaxResults: 5,
         description: 'description',
         Enabled: true
-    } ]
+    ) ]
 } ]
 ;
 
@@ -63,6 +63,9 @@ The optional body block (inside `{ }`) attaches tools and knowledge bases to the
 
 - **MCP SERVICE** — attaches a consumed MCP service by its qualified name
 - **KNOWLEDGE BASE** — attaches a knowledge base with retrieval settings
+- **TOOL** — attaches a tool
+
+Each attachment is a child of the agent, so its properties are in `( )`. The older brace form (`TOOL Name { … }`) still parses but warns (MDL-DEPR071); `mxcli fmt --upgrade` rewrites it.
 
 ### OR MODIFY
 
@@ -161,17 +164,17 @@ CREATE AGENT MyModule."ResearchAssistant" (
     UserPrompt: 'Find information about quantum computing.'
 )
 {
-    MCP SERVICE MyModule.WebSearch {
+    MCP SERVICE MyModule.WebSearch (
         Enabled: true
-    }
+    )
 
-    KNOWLEDGE BASE ProductKB {
+    KNOWLEDGE BASE ProductKB (
         source: MyModule.ProductDocs,
         collection: 'product-docs',
         MaxResults: 5,
         description: 'Product documentation',
         Enabled: true
-    }
+    )
 };
 /
 ```
diff --git a/docs-site/src/reference/image-collection/create-image-collection.md b/docs-site/src/reference/image-collection/create-image-collection.md
index f4ea3f697c..ab9f17ff76 100644
--- a/docs-site/src/reference/image-collection/create-image-collection.md
+++ b/docs-site/src/reference/image-collection/create-image-collection.md
@@ -5,10 +5,10 @@
     CREATE [OR MODIFY] IMAGE COLLECTION module.name
         [EXPORT LEVEL 'Hidden' | 'Public']
         [COMMENT 'description']
-        [(
-            IMAGE 'image_name' FROM FILE 'path',
+        [{
+            IMAGE image_name ( File: 'path' )
             ...
-        )];
+        }];
 
 ## Description
 
@@ -25,8 +25,10 @@ Creates a new image collection in the specified module. `OR MODIFY` updates an e
 **COMMENT**
 : Documentation text for the collection.
 
-**IMAGE 'name' FROM FILE 'path'**
-: Loads an image from a file on disk. The path is relative to the current working directory. Supported formats: PNG, SVG, GIF, JPEG, BMP, WebP.
+**IMAGE name ( File: 'path' )**
+: Loads an image from a file on disk. The path is relative to the current working directory. Supported formats: PNG, SVG, GIF, JPEG, BMP, WebP. A name that is not a plain identifier is written as a quoted identifier (`"logo-dark"`).
+
+The images are the collection's children, so they are in `{ }`, each with its properties in `( )`. The older form `( IMAGE name FROM FILE 'path', … )` still parses but warns (MDL-DEPR072); `mxcli fmt --upgrade` rewrites it.
 
 ## Examples
 
@@ -47,11 +49,11 @@ CREATE IMAGE COLLECTION MyModule.SharedIcons
 ### Collection with images
 
 ```sql
-CREATE IMAGE COLLECTION MyModule.NavigationIcons (
-    IMAGE 'home' FROM FILE 'assets/home.png',
-    IMAGE 'settings' FROM FILE 'assets/settings.svg',
-    IMAGE 'profile' FROM FILE 'assets/profile.png'
-);
+CREATE IMAGE COLLECTION MyModule.NavigationIcons {
+    IMAGE home ( File: 'assets/home.png' )
+    IMAGE settings ( File: 'assets/settings.svg' )
+    IMAGE profile ( File: 'assets/profile.png' )
+};
 ```
 
 ### All options combined
@@ -59,10 +61,10 @@ CREATE IMAGE COLLECTION MyModule.NavigationIcons (
 ```sql
 CREATE IMAGE COLLECTION MyModule.BrandAssets
     EXPORT LEVEL 'Public'
-    COMMENT 'Company branding assets' (
-    IMAGE 'logo-dark' FROM FILE 'assets/logo-dark.png',
-    IMAGE 'logo-light' FROM FILE 'assets/logo-light.png'
-);
+    COMMENT 'Company branding assets' {
+    IMAGE "logo-dark" ( File: 'assets/logo-dark.png' )
+    IMAGE "logo-light" ( File: 'assets/logo-light.png' )
+};
 ```
 
 ## See Also
diff --git a/docs-site/src/reference/integration/create-message-definition-collection.md b/docs-site/src/reference/integration/create-message-definition-collection.md
index 11d8d840a6..43527eba7f 100644
--- a/docs-site/src/reference/integration/create-message-definition-collection.md
+++ b/docs-site/src/reference/integration/create-message-definition-collection.md
@@ -76,18 +76,18 @@ guesses.
 ```sql
 CREATE MESSAGE DEFINITION COLLECTION Sales.MD_Order
     FOLDER 'Messages'
-(
-    DEFINITION OrderMessage FOR Sales.Order AS 'Orders' (
+{
+    DEFINITION OrderMessage FOR Sales.Order AS 'Orders' {
         OrderId,
         TotalAmount AS 'Total',
-        Sales.OrderLine_Order/Sales.OrderLine AS 'Lines' ( Sku, Quantity ),
-        Sales.Order_Customer/Sales.Customer ( FirstName, LastName )
-    ),
-    DEFINITION CustomerOrders FOR Sales.Customer AS 'Customers' (
+        Sales.OrderLine_Order/Sales.OrderLine AS 'Lines' { Sku, Quantity },
+        Sales.Order_Customer/Sales.Customer { FirstName, LastName }
+    },
+    DEFINITION CustomerOrders FOR Sales.Customer AS 'Customers' {
         FirstName,
-        Sales.Order_Customer/Sales.Order AS 'Orders' ( OrderId )
-    )
-);
+        Sales.Order_Customer/Sales.Order AS 'Orders' { OrderId }
+    }
+};
 
 CREATE IMPORT MAPPING Sales.IMM_Order
     WITH MESSAGE DEFINITION Sales.MD_Order.OrderMessage
@@ -105,7 +105,7 @@ ALTER MESSAGE DEFINITION Sales.MD_Order.OrderMessage ADD MEMBER LastName IN Cust
 ALTER MESSAGE DEFINITION Sales.MD_Order.OrderMessage SET MEMBER TotalAmount AS 'GrandTotal';
 ALTER MESSAGE DEFINITION Sales.MD_Order.OrderMessage DROP MEMBER Sku IN Lines;
 
-ALTER MESSAGE DEFINITION COLLECTION Sales.MD_Order ADD DEFINITION Line FOR Sales.Line ( Sku );
+ALTER MESSAGE DEFINITION COLLECTION Sales.MD_Order ADD DEFINITION Line FOR Sales.Line { Sku };
 ALTER MESSAGE DEFINITION COLLECTION Sales.MD_Order RENAME DEFINITION Line TO OrderLine;
 ALTER MESSAGE DEFINITION COLLECTION Sales.MD_Order DROP DEFINITION IF EXISTS OrderLine;
 ```
diff --git a/docs/01-project/MDL_QUICK_REFERENCE.md b/docs/01-project/MDL_QUICK_REFERENCE.md
index fad6388442..6fa0220aa4 100644
--- a/docs/01-project/MDL_QUICK_REFERENCE.md
+++ b/docs/01-project/MDL_QUICK_REFERENCE.md
@@ -483,8 +483,8 @@ rather than updating the first.
 | Describe microflow | `describe microflow Module.Name;` | Full MDL with activities |
 | Describe microflow (normalized) | `describe microflow Module.Name normalized;` | Folds crossed branches into one condition instead of flattening them. Opt-in: the output re-executes to an equivalent graph with fewer nodes and a different layout |
 | Describe microflow (with handles) | `describe microflow Module.Name with handles;` | Prints `-- handle: <target>` above each activity: its content address for `alter microflow` — output `$Var`, `'Caption'`, or a statement pattern with `*` wildcards (anchored at both ends), plus `@n` when several match. Comments only; cannot be combined with `normalized` |
-| Insert into a stored microflow | `alter microflow Module.Name { insert after <target> { <statements> } };` | Also `insert before`, and `alter nanoflow`. A graph splice into the stored flow, not a rebuild: only the new activities, the two rewired flows and the objects moved to make room change; every other element keeps its `$ID`, position and curve. `<target>` is a handle from `describe … with handles`, resolved before any operation runs. Refused: after a decision, before an activity several flows enter, inside a loop body, a fragment that returns, a variable the flow already has or one not declared on the path |
-| Replace or drop an activity | `alter microflow Module.Name { replace <target> with { <statements> } drop <target>; };` | Flows into the activity are re-pointed at the replacement (or at its successor, for `drop`). Refused for a decision, an end event, an activity with an error handler, and an activity whose output variable is still read. Over `--mcp` only `insert` is supported |
+| Insert into a stored microflow | `alter microflow Module.Name { insert after <target> begin <statements> end; };` | Also `insert before`, and `alter nanoflow`. A graph splice into the stored flow, not a rebuild: only the new activities, the two rewired flows and the objects moved to make room change; every other element keeps its `$ID`, position and curve. `<target>` is a handle from `describe … with handles`, resolved before any operation runs. Refused: after a decision, before an activity several flows enter, inside a loop body, a fragment that returns, a variable the flow already has or one not declared on the path. The fragment is `begin … end` like a microflow body; `{ … }` is the deprecated spelling MDL-DEPR074 |
+| Replace or drop an activity | `alter microflow Module.Name { replace <target> with begin <statements> end; drop <target>; };` | Flows into the activity are re-pointed at the replacement (or at its successor, for `drop`). Refused for a decision, an end event, an activity with an error handler, and an activity whose output variable is still read. Over `--mcp` only `insert` is supported |
 | Describe nanoflow | `describe nanoflow Module.Name;` | Full MDL with activities |
 | Rename microflow | `rename microflow Module.Old to New;` | Updates all references |
 | Rename nanoflow | `rename nanoflow Module.Old to New;` | Updates all references |
@@ -1061,22 +1061,22 @@ Respond in {{Language}}.$$,
   UserPrompt: 'Ask me anything.'
 )
 {
-  mcp service Module.WebSearch {
+  mcp service Module.WebSearch (
     Enabled: true
-  }
+  )
 
-  knowledge base KBAlias {
+  knowledge base KBAlias (
     source: Module.ProductDocs,
     collection: 'product-docs',
     MaxResults: 5,
     description: 'Product documentation',
     Enabled: true
-  }
+  )
 
-  tool MyMicroflowTool {
+  tool MyMicroflowTool (
     description: 'Fetch customer data',
     Enabled: true
-  }
+  )
 };
 ```
 
@@ -1092,7 +1092,7 @@ Respond in {{Language}}.$$,
 |-----------|--------|-------|
 | Show collections | `show image collection [in module];` | List all or filter by module |
 | Describe collection | `describe image collection Module.Name;` | Full MDL output with embedded images |
-| Create collection | `create image collection Module.Name [folder 'path'] [export level 'Hidden'\|'Public'] [comment 'text'] [(image Name from file 'path', ...)];` | With or without images |
+| Create collection | `create image collection Module.Name [folder 'path'] [export level 'Hidden'\|'Public'] [comment 'text'] [{ image Name ( File: 'path' ) ... }];` | With or without images |
 | Create or modify | `create or modify image collection Module.Name [...];` | Preserves UUID — preferred for AI agents |
 | Drop collection | `drop image collection [if exists] Module.Name;` | Removes collection and all embedded images |
 | Show an image on a page | `image imgLogo (Image: 'Module.Collection.ImageName');` | Three-part name, like an icon reference. `describe image collection` lists the names |
@@ -1153,7 +1153,7 @@ create consumed rest service Module.Api (
   authentication: none
 )
 {
-  operation GetItems {
+  operation GetItems (
     method: get,
     path: '/items/{id}',
     parameters: ($id: string),
@@ -1161,9 +1161,9 @@ create consumed rest service Module.Api (
     headers: ('Accept' = 'application/json'),
     timeout: 30,
     response: json as $Result
-  }
+  )
 
-  operation CreateItem {
+  operation CreateItem (
     method: post,
     path: '/items',
     headers: ('Content-Type' = 'application/json'),
@@ -1175,7 +1175,7 @@ create consumed rest service Module.Api (
       Id = id,
       status = status,
     }
-  }
+  )
 };
 ```
 
diff --git a/docs/11-proposals/PROPOSAL_mdl_beta_syntax_freeze.md b/docs/11-proposals/PROPOSAL_mdl_beta_syntax_freeze.md
index 0277686199..d17f698abc 100644
--- a/docs/11-proposals/PROPOSAL_mdl_beta_syntax_freeze.md
+++ b/docs/11-proposals/PROPOSAL_mdl_beta_syntax_freeze.md
@@ -150,6 +150,7 @@ What would change:
 - `on error { … }` is the only brace block inside a microflow. It becomes `on error [without rollback] begin … end error;`.
 - `while` makes both `begin` and `end while` optional. Make both required, the same as `loop`.
 - The `split type` body becomes mandatory.
+- *Decided in ako/mxcli#754:* an `alter microflow` / `alter nanoflow` fragment is imperative content, so it is `begin … end`, not `{ … }`: `insert after $X begin … end;`, `replace <target> with begin … end;`. The fragment is written exactly as the body of `create microflow` is (ADR-0012). The operations around it are the alter's declarative children and stay in the alter's `{ }`. The brace fragment is a deprecated alias (MDL-DEPR074).
 
 **Before** — properties in braces, children in parentheses, menu items separated by `;`, braces inside a microflow:
 
diff --git a/mdl-examples/bug-tests/1059-widget-icon-elements.mdl b/mdl-examples/bug-tests/1059-widget-icon-elements.mdl
index 81bad527d6..0c22fee7e2 100644
--- a/mdl-examples/bug-tests/1059-widget-icon-elements.mdl
+++ b/mdl-examples/bug-tests/1059-widget-icon-elements.mdl
@@ -26,9 +26,9 @@
 
 -- MARK: Setup
 
-create or modify image collection IconProbe.Images (
-  image marker from file '../../docs/images/mxcli-cli.png'
-);
+create or modify image collection IconProbe.Images {
+  image marker ( File: '../../docs/images/mxcli-cli.png' )
+};
 
 -- MARK: The three icon elements
 
diff --git a/mdl-examples/bug-tests/200-basic-auth-rest-client.mdl b/mdl-examples/bug-tests/200-basic-auth-rest-client.mdl
index c41e95582d..46535c4f3f 100644
--- a/mdl-examples/bug-tests/200-basic-auth-rest-client.mdl
+++ b/mdl-examples/bug-tests/200-basic-auth-rest-client.mdl
@@ -46,13 +46,13 @@ create rest client AuthTest.HttpBinAuthAPI (
 )
 {
   /** Calls /basic-auth/testuser/testpass123! — returns 200 if auth header sent */
-  operation CheckAuth {
+  operation CheckAuth (
     method: get,
     path: '/basic-auth/testuser/testpass123!',
     headers: ('Accept' = 'application/json'),
     timeout: 30,
     response: none
-  }
+  )
 };
 
 -- ############################################################################
diff --git a/mdl-examples/bug-tests/464-alter-agent-editor.mdl b/mdl-examples/bug-tests/464-alter-agent-editor.mdl
index 43d3d55475..3a2f26acc5 100644
--- a/mdl-examples/bug-tests/464-alter-agent-editor.mdl
+++ b/mdl-examples/bug-tests/464-alter-agent-editor.mdl
@@ -64,5 +64,5 @@ ALTER CONSUMED MCP SERVICE Bug464.MyMCP SET ConnectionTimeoutSeconds = 60, Versi
 -- ALTER AGENT — combines SET, ADD, and DROP in one statement.
 ALTER AGENT Bug464.MyAgent
     SET SystemPrompt = 'updated prompt', Temperature = 0.7, MaxTokens = 4096
-    ADD KNOWLEDGE BASE Docs { Source: Bug464.MyKB, Collection: 'docs', MaxResults: 5 }
-    ADD MCP SERVICE Bug464.MyMCP { Description: 'weather', Enabled: true };
+    ADD KNOWLEDGE BASE Docs ( Source: Bug464.MyKB, Collection: 'docs', MaxResults: 5 )
+    ADD MCP SERVICE Bug464.MyMCP ( Description: 'weather', Enabled: true );
diff --git a/mdl-examples/bug-tests/556-reexec-identity-stability.mdl b/mdl-examples/bug-tests/556-reexec-identity-stability.mdl
index 2e43100498..91295aa965 100644
--- a/mdl-examples/bug-tests/556-reexec-identity-stability.mdl
+++ b/mdl-examples/bug-tests/556-reexec-identity-stability.mdl
@@ -53,9 +53,9 @@ CREATE OR MODIFY REST CLIENT BugReexecIdentity.PartsAvailabilityAPI (
   Authentication: NONE
 )
 {
-  OPERATION GetPart {
+  OPERATION GetPart (
     Method: GET,
     Path: '/parts/{id}',
     Parameters: ($id: String)
-  }
+  )
 };
diff --git a/mdl-examples/bug-tests/843-rest-response-mapping-no-body.fail.mdl b/mdl-examples/bug-tests/843-rest-response-mapping-no-body.fail.mdl
index c797a52c97..ddb253b58e 100644
--- a/mdl-examples/bug-tests/843-rest-response-mapping-no-body.fail.mdl
+++ b/mdl-examples/bug-tests/843-rest-response-mapping-no-body.fail.mdl
@@ -41,11 +41,11 @@ create rest client ZZB."MESSlice" (
   Authentication: none
 )
 {
-  operation "SearchRoutes" {
+  operation "SearchRoutes" (
     Method: get,
     Path: '/routes',
     Query: ($page: String, $pageSize: String),
     Timeout: 300,
     Response: mapping ZZB."IMM_R10"
-  }
+  )
 };
diff --git a/mdl-examples/bug-tests/843-rest-response-mapping.mdl b/mdl-examples/bug-tests/843-rest-response-mapping.mdl
index a6f587f8b2..c1d0bdb048 100644
--- a/mdl-examples/bug-tests/843-rest-response-mapping.mdl
+++ b/mdl-examples/bug-tests/843-rest-response-mapping.mdl
@@ -41,7 +41,7 @@ create rest client ZZB."MESSlice" (
   Authentication: none
 )
 {
-  operation "SearchRoutes" {
+  operation "SearchRoutes" (
     Method: get,
     Path: '/routes/{id}',
     Parameters: ($id: String),
@@ -55,5 +55,5 @@ create rest client ZZB."MESSlice" (
       RoutingCode = routing_code,
       RoutingName = routing_name
     }
-  }
+  )
 };
diff --git a/mdl-examples/bug-tests/messagedef-referenceset-cardinality.mdl b/mdl-examples/bug-tests/messagedef-referenceset-cardinality.mdl
index 98bfb66c13..d74d05c0a4 100644
--- a/mdl-examples/bug-tests/messagedef-referenceset-cardinality.mdl
+++ b/mdl-examples/bug-tests/messagedef-referenceset-cardinality.mdl
@@ -65,26 +65,26 @@ create or modify association MsgCard.Order_Tag
 /
 
 create or modify message definition collection MsgCard.MD_Orders
-(
+{
   -- The forward traversal of each. Before the fix both stored MaxOccurs 1;
   -- only Tags was wrong.
-  definition "OrderMsg" for MsgCard.Order as 'Order' (
+  definition "OrderMsg" for MsgCard.Order as 'Order' {
     "OrderNo",
-    MsgCard.Order_Customer/MsgCard.Customer as 'Customer' (
+    MsgCard.Order_Customer/MsgCard.Customer as 'Customer' {
       "Name"
-    ),
-    MsgCard.Order_Tag/MsgCard.Tag as 'Tags' (
+    },
+    MsgCard.Order_Tag/MsgCard.Tag as 'Tags' {
       "Label"
-    )
-  ),
+    }
+  },
   -- The reverse of the set, which was already right and must stay right.
-  definition "TagMsg" for MsgCard.Tag as 'Tag' (
+  definition "TagMsg" for MsgCard.Tag as 'Tag' {
     "Label",
-    MsgCard.Order_Tag/MsgCard.Order as 'Orders' (
+    MsgCard.Order_Tag/MsgCard.Order as 'Orders' {
       "OrderNo"
-    )
-  )
-);
+    }
+  }
+};
 /
 
 -- The mapping is where CE0295 lands: an object mapping element bound to an
diff --git a/mdl-examples/bug-tests/rest-file-request-body.fail.mdl b/mdl-examples/bug-tests/rest-file-request-body.fail.mdl
index 514799603d..2c35c3853e 100644
--- a/mdl-examples/bug-tests/rest-file-request-body.fail.mdl
+++ b/mdl-examples/bug-tests/rest-file-request-body.fail.mdl
@@ -36,9 +36,9 @@ create rest client FileBody.RC_Upload (
   Authentication: NONE
 )
 {
-  OPERATION PostFile {
+  OPERATION PostFile (
     Method: POST,
     Path: '/post',
     Body: FILE FROM $Doc
-  }
+  )
 };
diff --git a/mdl-examples/bug-tests/rest-inline-mapping-paths.mdl b/mdl-examples/bug-tests/rest-inline-mapping-paths.mdl
index 2b83875f80..c7d3a8621a 100644
--- a/mdl-examples/bug-tests/rest-inline-mapping-paths.mdl
+++ b/mdl-examples/bug-tests/rest-inline-mapping-paths.mdl
@@ -76,7 +76,7 @@ create or modify rest client RestInline.RC_Probe (
 {
   -- #36: the nested member must reach (Object)|fields|Title, not
   -- (Object)|fields/Title.
-  OPERATION GetItem {
+  OPERATION GetItem (
     Method: GET,
     Path: '/items/{id}',
     Parameters: ($id: String),
@@ -84,11 +84,11 @@ create or modify rest client RestInline.RC_Probe (
       ItemId = "id",
       Title  = "fields/Title"
     }
-  }
+  )
 
   -- #37: the nested element here is an EXPORT object element, so it must not
   -- be ObjectHandling "Create".
-  OPERATION PostTask {
+  OPERATION PostTask (
     Method: POST,
     Path: '/tasks',
     Body: MAPPING RestInline.Task {
@@ -96,5 +96,5 @@ create or modify rest client RestInline.RC_Probe (
         "Title" = Title
       }
     }
-  }
+  )
 };
diff --git a/mdl-examples/doctype-tests/06-rest-client-examples.mdl b/mdl-examples/doctype-tests/06-rest-client-examples.mdl
index e4069092d1..3edea9948a 100644
--- a/mdl-examples/doctype-tests/06-rest-client-examples.mdl
+++ b/mdl-examples/doctype-tests/06-rest-client-examples.mdl
@@ -59,12 +59,12 @@ create rest client RestTest.RC001_SimpleAPI (
   authentication: none
 )
 {
-  operation GetStatus {
+  operation GetStatus (
     method: get,
     path: '/echo',
     headers: ('Accept' = '*/*'),
     response: none
-  }
+  )
 };
 
 -- ============================================================================
@@ -78,12 +78,12 @@ create rest client RestTest.RC002_JsonAPI (
   authentication: none
 )
 {
-  operation GetPosts {
+  operation GetPosts (
     method: get,
     path: '/posts',
     headers: ('Accept' = 'application/json'),
     response: json as $Posts
-  }
+  )
 };
 
 -- ============================================================================
@@ -97,13 +97,13 @@ create rest client RestTest.RC003_UserAPI (
   authentication: none
 )
 {
-  operation GetUser {
+  operation GetUser (
     method: get,
     path: '/users/{userId}',
     parameters: ($userId: integer),
     headers: ('Accept' = 'application/json'),
     response: json as $user
-  }
+  )
 };
 
 -- ############################################################################
@@ -124,46 +124,46 @@ create rest client RestTest.RC004_CrudAPI (
 )
 {
   /** Retrieve all resources */
-  operation GetAll {
+  operation GetAll (
     method: get,
     path: '/get',
     headers: ('Accept' = 'application/json'),
     response: json as $Resources
-  }
+  )
 
   /** Create a new resource */
-  operation CreateResource {
+  operation CreateResource (
     method: post,
     path: '/post',
     headers: ('Accept' = 'application/json'),
     body: json from $NewResource,
     response: json as $CreatedResource
-  }
+  )
 
   /** Fully update an existing resource */
-  operation UpdateResource {
+  operation UpdateResource (
     method: put,
     path: '/put',
     headers: ('Accept' = 'application/json'),
     body: json from $UpdatedResource,
     response: json as $resource
-  }
+  )
 
   /** Partially update an existing resource */
-  operation "PatchResource" {
+  operation "PatchResource" (
     method: patch,
     path: '/patch',
     headers: ('Accept' = 'application/json'),
     body: json from $PatchData,
     response: json as $resource
-  }
+  )
 
   /** Delete a resource */
-  operation "DeleteResource" {
+  operation "DeleteResource" (
     method: delete,
     path: '/delete',
     response: none
-  }
+  )
 };
 
 -- ############################################################################
@@ -181,12 +181,12 @@ create rest client RestTest.RC005_SearchAPI (
   authentication: none
 )
 {
-  operation search {
+  operation search (
     method: get,
     path: '/anything/search',
     query: ($q: string),
     response: json as $Results
-  }
+  )
 };
 
 -- ============================================================================
@@ -201,12 +201,12 @@ create rest client RestTest.RC006_PaginatedAPI (
 )
 {
   /** Search with pagination */
-  operation SearchPaginated {
+  operation SearchPaginated (
     method: get,
     path: '/anything/items',
     query: ($search: string, $page: integer, $limit: integer, $sortBy: string, $ascending: boolean),
     response: json as $Items
-  }
+  )
 };
 
 -- ============================================================================
@@ -219,13 +219,13 @@ create rest client RestTest.RC007_FilteredAPI (
 )
 {
   /** Get items in a category with filters */
-  operation GetCategoryItems {
+  operation GetCategoryItems (
     method: get,
     path: '/anything/categories/{categoryId}/items',
     parameters: ($categoryId: integer),
     query: ($status: string, $minPrice: decimal, $maxPrice: decimal),
     response: json as $Items
-  }
+  )
 };
 
 -- ############################################################################
@@ -245,12 +245,12 @@ create rest client RestTest.RC008_HeaderAPI (
   authentication: none
 )
 {
-  operation GetData {
+  operation GetData (
     method: get,
     path: '/headers',
     headers: ('Accept' = 'application/json', 'X-API-Version' = '2.0', 'X-Client-ID' = 'mendix-repl'),
     response: json as $data
-  }
+  )
 };
 
 -- ============================================================================
@@ -264,12 +264,12 @@ create rest client RestTest.RC009_AuthHeaderAPI (
   authentication: none
 )
 {
-  operation GetSecureData {
+  operation GetSecureData (
     method: get,
     path: '/headers',
     headers: ('Accept' = 'application/json', 'Authorization' = 'Bearer my-api-token', 'X-Request-ID' = 'request-001'),
     response: json as $data
-  }
+  )
 };
 
 -- ============================================================================
@@ -281,13 +281,13 @@ create rest client RestTest.RC010_ContentTypeAPI (
   authentication: none
 )
 {
-  operation PostJson {
+  operation PostJson (
     method: post,
     path: '/post',
     headers: ('Content-Type' = 'application/json', 'Accept' = 'application/json'),
     body: json from $Payload,
     response: json as $Result
-  }
+  )
 };
 
 -- ############################################################################
@@ -305,11 +305,11 @@ create rest client RestTest.RC011_PublicAPI (
   authentication: none
 )
 {
-  operation GetPublicData {
+  operation GetPublicData (
     method: get,
     path: '/get',
     response: json as $data
-  }
+  )
 };
 
 -- ============================================================================
@@ -321,11 +321,11 @@ create rest client RestTest.RC012_BasicAuthAPI (
   authentication: basic (username: 'api_user', password: 'api_secret')
 )
 {
-  operation GetProtectedData {
+  operation GetProtectedData (
     method: get,
     path: '/basic-auth/api_user/api_secret',
     response: json as $data
-  }
+  )
 };
 
 -- ============================================================================
@@ -339,12 +339,12 @@ create rest client RestTest.RC013_SecureAuthAPI (
   authentication: basic (username: 'testuser', password: 'testpass')
 )
 {
-  operation GetSecureData {
+  operation GetSecureData (
     method: get,
     path: '/hidden-basic-auth/testuser/testpass',
     headers: ('Accept' = 'application/json'),
     response: json as $data
-  }
+  )
 };
 
 -- ############################################################################
@@ -362,13 +362,13 @@ create rest client RestTest.RC014_JsonBodyAPI (
   authentication: none
 )
 {
-  operation AddItem {
+  operation AddItem (
     method: post,
     path: '/post',
     headers: ('Content-Type' = 'application/json'),
     body: json from $ItemData,
     response: json as $CreatedItem
-  }
+  )
 };
 
 -- ============================================================================
@@ -392,11 +392,11 @@ create rest client RestTest.RC015_FileDownloadAPI (
   authentication: none
 )
 {
-  operation DownloadFile {
+  operation DownloadFile (
     method: get,
     path: '/image/png',
     response: file as $Downloaded
-  }
+  )
 };
 
 -- ############################################################################
@@ -417,40 +417,40 @@ create rest client RestTest.RC016_ResponseTypesAPI (
 )
 {
   /** JSON response mapped to entity */
-  operation GetJson {
+  operation GetJson (
     method: get,
     path: '/json',
     response: json as $JsonData
-  }
+  )
 
   /** Raw string response */
-  operation GetString {
+  operation GetString (
     method: get,
     path: '/robots.txt',
     response: string as $TextContent
-  }
+  )
 
   /** Binary file download */
-  operation DownloadFile {
+  operation DownloadFile (
     method: get,
     path: '/bytes/{fileId}',
     parameters: ($fileId: string),
     response: file as $FileDocument
-  }
+  )
 
   /** HTTP status code only */
-  operation CheckStatus {
+  operation CheckStatus (
     method: get,
     path: '/status/200',
     response: status as $StatusCode
-  }
+  )
 
   /** No response expected */
-  operation Ping {
+  operation Ping (
     method: get,
     path: '/status/204',
     response: none
-  }
+  )
 };
 
 -- ############################################################################
@@ -471,21 +471,21 @@ create rest client RestTest.RC017_LongRunningAPI (
 )
 {
   /** Quick health check with short timeout */
-  operation HealthCheck {
+  operation HealthCheck (
     method: get,
     path: '/status/200',
     timeout: 5,
     response: status as $status
-  }
+  )
 
   /** Report generation with extended timeout (delay/10 waits 10 seconds) */
-  operation GenerateReport {
+  operation GenerateReport (
     method: post,
     path: '/delay/10',
     body: json from $ReportParams,
     timeout: 600,
     response: json as $ReportResult
-  }
+  )
 };
 
 -- ############################################################################
@@ -513,63 +513,63 @@ create rest client RestTest.RC018_PetStoreAPI (
    * @param status Filter by pet status (available, pending, sold)
    * @param limit Maximum number of pets to return
    */
-  operation ListPets {
+  operation ListPets (
     method: get,
     path: '/pet/findByStatus',
     query: ($status: string),
     headers: ('Accept' = 'application/json'),
     timeout: 30,
     response: json as $PetList
-  }
+  )
 
   /**
    * Get a single pet by ID
    * @param petId The unique identifier of the pet
    */
-  operation GetPet {
+  operation GetPet (
     method: get,
     path: '/pet/{petId}',
     parameters: ($petId: integer),
     headers: ('Accept' = 'application/json'),
     response: json as $Pet
-  }
+  )
 
   /**
    * Create a new pet
    * Adds a new pet to the store inventory.
    */
-  operation AddPet {
+  operation AddPet (
     method: post,
     path: '/pet',
     headers: ('Content-Type' = 'application/json', 'Accept' = 'application/json'),
     body: json from $NewPet,
     response: json as $CreatedPet
-  }
+  )
 
   /**
    * Update an existing pet
    * Modifies all fields of an existing pet record.
    */
-  operation ModifyPet {
+  operation ModifyPet (
     method: put,
     path: '/pet',
     headers: ('Content-Type' = 'application/json', 'Accept' = 'application/json'),
     body: json from $UpdatedPet,
     response: json as $Pet
-  }
+  )
 
   /**
    * Delete a pet
    * Removes a pet from the store inventory.
    * @param petId The unique identifier of the pet to delete
    */
-  operation RemovePet {
+  operation RemovePet (
     method: delete,
     path: '/pet/{petId}',
     parameters: ($petId: integer),
     headers: ('api_key' = 'special-key'),
     response: none
-  }
+  )
 
   -- Upload pet image: not expressible HERE. `body: file from $ImageFile` is
   -- refused as MDL-REST02 — a consumed operation has no binary request body.
@@ -590,41 +590,41 @@ create rest client RestTest.RC019_GitHubAPI (
 )
 {
   /** Get repository information */
-  operation GetRepository {
+  operation GetRepository (
     method: get,
     path: '/repos/{owner}/{repo}',
     parameters: ($owner: string, $repo: string),
     headers: ('Accept' = 'application/vnd.github.v3+json', 'User-Agent' = 'Mendix-REPL'),
     response: json as $Repository
-  }
+  )
 
   /** List repository issues */
-  operation ListIssues {
+  operation ListIssues (
     method: get,
     path: '/repos/{owner}/{repo}/issues',
     parameters: ($owner: string, $repo: string),
     query: ($state: string, $labels: string, $page: integer, $per_page: integer),
     headers: ('Accept' = 'application/vnd.github.v3+json', 'User-Agent' = 'Mendix-REPL'),
     response: json as $Issues
-  }
+  )
 
   /** Create an issue (requires authentication) */
-  operation AddIssue {
+  operation AddIssue (
     method: post,
     path: '/repos/{owner}/{repo}/issues',
     parameters: ($owner: string, $repo: string),
     headers: ('Accept' = 'application/vnd.github.v3+json', 'User-Agent' = 'Mendix-REPL', 'Authorization' = 'token ghp_exampletoken123'),
     body: json from $IssueData,
     response: json as $CreatedIssue
-  }
+  )
 
   /** Get authenticated user */
-  operation GetAuthenticatedUser {
+  operation GetAuthenticatedUser (
     method: get,
     path: '/user',
     headers: ('Accept' = 'application/vnd.github.v3+json', 'User-Agent' = 'Mendix-REPL', 'Authorization' = 'token ghp_exampletoken123'),
     response: json as $user
-  }
+  )
 };
 
 -- ============================================================================
@@ -641,31 +641,31 @@ create rest client RestTest.RC020_WeatherAPI (
 )
 {
   /** Get current weather for a city */
-  operation GetCurrentWeather {
+  operation GetCurrentWeather (
     method: get,
     path: '/weather',
     query: ($q: string, $appid: string, $units: string),
     headers: ('Accept' = 'application/json'),
     response: json as $Weather
-  }
+  )
 
   /** Get 5-day forecast */
-  operation GetForecast {
+  operation GetForecast (
     method: get,
     path: '/forecast',
     query: ($q: string, $appid: string, $units: string, $cnt: integer),
     headers: ('Accept' = 'application/json'),
     response: json as $Forecast
-  }
+  )
 
   /** Get weather by coordinates */
-  operation GetWeatherByCoords {
+  operation GetWeatherByCoords (
     method: get,
     path: '/weather',
     query: ($lat: decimal, $lon: decimal, $appid: string, $units: string),
     headers: ('Accept' = 'application/json'),
     response: json as $Weather
-  }
+  )
 };
 
 -- ============================================================================
@@ -682,48 +682,48 @@ create rest client RestTest.RC021_PaymentAPI (
 )
 {
   /** Create a payment intent */
-  operation InitiatePayment {
+  operation InitiatePayment (
     method: post,
     path: '/payment_intents',
     headers: ('Content-Type' = 'application/json', 'Accept' = 'application/json', 'Idempotency-Key' = 'idem-key-001'),
     body: json from $PaymentData,
     timeout: 30,
     response: json as $PaymentIntent
-  }
+  )
 
   /** Retrieve a payment intent */
-  operation GetPaymentIntent {
+  operation GetPaymentIntent (
     method: get,
     path: '/payment_intents/{paymentIntentId}',
     parameters: ($paymentIntentId: string),
     response: json as $PaymentIntent
-  }
+  )
 
   /** Confirm a payment */
-  operation ConfirmPayment {
+  operation ConfirmPayment (
     method: post,
     path: '/payment_intents/{paymentIntentId}/confirm',
     parameters: ($paymentIntentId: string),
     headers: ('Content-Type' = 'application/json'),
     body: json from $ConfirmData,
     response: json as $PaymentIntent
-  }
+  )
 
   /** Cancel a payment */
-  operation CancelPayment {
+  operation CancelPayment (
     method: post,
     path: '/payment_intents/{paymentIntentId}/cancel',
     parameters: ($paymentIntentId: string),
     response: json as $PaymentIntent
-  }
+  )
 
   /** List all payments */
-  operation ListPayments {
+  operation ListPayments (
     method: get,
     path: '/payment_intents',
     query: ($limit: integer, $starting_after: string, $created: integer),
     response: json as $PaymentList
-  }
+  )
 };
 
 -- ############################################################################
diff --git a/mdl-examples/doctype-tests/19-image-collection-examples.mdl b/mdl-examples/doctype-tests/19-image-collection-examples.mdl
index a916549f3c..f55536cf21 100644
--- a/mdl-examples/doctype-tests/19-image-collection-examples.mdl
+++ b/mdl-examples/doctype-tests/19-image-collection-examples.mdl
@@ -73,10 +73,10 @@ create image collection ImgTest.BrandAssets
  *
  * Supported formats: PNG, SVG, GIF, JPEG, BMP, WebP
  */
-create image collection ImgTest.NavigationIcons (
-  image cli_screenshot from file '../../docs/images/mxcli-cli.png',
-  image repl_screenshot from file '../../docs/images/mxcli-repl.png'
-);
+create image collection ImgTest.NavigationIcons {
+  image cli_screenshot ( File: '../../docs/images/mxcli-cli.png' )
+  image repl_screenshot ( File: '../../docs/images/mxcli-repl.png' )
+};
 /
 
 /**
@@ -84,10 +84,10 @@ create image collection ImgTest.NavigationIcons (
  */
 create image collection ImgTest.AppLogos
   export level 'Public'
-  comment 'Application logos for branding' (
-  image vscode_ext from file '../../docs/images/mxcli-vscode-ext.png',
-  image catalog_view from file '../../docs/images/mxcli-catalog.png'
-);
+  comment 'Application logos for branding' {
+  image vscode_ext ( File: '../../docs/images/mxcli-vscode-ext.png' )
+  image catalog_view ( File: '../../docs/images/mxcli-catalog.png' )
+};
 /
 
 -- MARK: Show
diff --git a/mdl-examples/doctype-tests/28-agent-editor-examples.mdl b/mdl-examples/doctype-tests/28-agent-editor-examples.mdl
index a83629ea4a..d0c66d1df5 100644
--- a/mdl-examples/doctype-tests/28-agent-editor-examples.mdl
+++ b/mdl-examples/doctype-tests/28-agent-editor-examples.mdl
@@ -132,17 +132,17 @@ create agent AgentTest."ResearchAssistant" (
   UserPrompt: 'Find information about quantum computing.'
 )
 {
-  mcp service AgentTest.WebSearch {
+  mcp service AgentTest.WebSearch (
     Enabled: true
-  }
+  )
 
-  knowledge base ProductKB {
+  knowledge base ProductKB (
     source: AgentTest.ProductDocs,
     collection: 'product-docs',
     MaxResults: 5,
     description: 'Product documentation',
     Enabled: true
-  }
+  )
 };
 /
 
@@ -224,8 +224,8 @@ alter consumed mcp service AgentTest.WebSearch
 -- Add a TOOL (Microflow), MCP SERVICE, and KNOWLEDGE BASE in one statement.
 alter agent AgentTest.ResearchAssistant
     set SystemPrompt = 'Updated assistant prompt.', Temperature = 0.7, MaxTokens = 4096
-    add knowledge base ExtraDocs { Source: AgentTest.ProductDocs, Collection: 'extra', MaxResults: 3 }
-    add mcp service AgentTest.WebSearch { Description: 'web search', Enabled: true };
+    add knowledge base ExtraDocs ( Source: AgentTest.ProductDocs, Collection: 'extra', MaxResults: 3 )
+    add mcp service AgentTest.WebSearch ( Description: 'web search', Enabled: true );
 
 -- ALTER AGENT: drop collection entries (TOOL by name, MCP SERVICE by
 -- qualified name, KNOWLEDGE BASE by per-agent name).
diff --git a/mdl-examples/doctype-tests/40-message-definition-examples.mdl b/mdl-examples/doctype-tests/40-message-definition-examples.mdl
index 8e22aef60a..99dac979e0 100644
--- a/mdl-examples/doctype-tests/40-message-definition-examples.mdl
+++ b/mdl-examples/doctype-tests/40-message-definition-examples.mdl
@@ -57,22 +57,22 @@ create association MsgTest.OrderLine_Order from MsgTest.OrderLine to MsgTest.Ord
 
 create message definition collection MsgTest.MD_Order
   folder 'Messages'
-(
-  definition OrderMessage for MsgTest.Order as 'Orders' (
+{
+  definition OrderMessage for MsgTest.Order as 'Orders' {
     OrderId,
     OrderDate,
     TotalAmount as 'Total',
-    MsgTest.OrderLine_Order/MsgTest.OrderLine as 'Lines' (
+    MsgTest.OrderLine_Order/MsgTest.OrderLine as 'Lines' {
       Sku,
       Quantity
-    ),
-    MsgTest.Order_Customer/MsgTest.Customer (
+    },
+    MsgTest.Order_Customer/MsgTest.Customer {
       FirstName,
       LastName,
       Address example 'Kerstraat 5, Leiden, Netherlands'
-    )
-  )
-);
+    }
+  }
+};
 
 -- ============================================================================
 -- Level 2: several definitions, and the same association both ways
@@ -84,16 +84,16 @@ create message definition collection MsgTest.MD_Order
 
 create or modify message definition collection MsgTest.MD_Order
   folder 'Messages'
-(
-  definition OrderMessage for MsgTest.Order as 'Orders' (
+{
+  definition OrderMessage for MsgTest.Order as 'Orders' {
     OrderId,
-    MsgTest.Order_Customer/MsgTest.Customer ( FirstName )
-  ),
-  definition CustomerOrders for MsgTest.Customer as 'Customers' (
+    MsgTest.Order_Customer/MsgTest.Customer { FirstName }
+  },
+  definition CustomerOrders for MsgTest.Customer as 'Customers' {
     FirstName,
-    MsgTest.Order_Customer/MsgTest.Order as 'Orders' ( OrderId, OrderDate )
-  )
-);
+    MsgTest.Order_Customer/MsgTest.Order as 'Orders' { OrderId, OrderDate }
+  }
+};
 
 -- ============================================================================
 -- Level 3: targeted edits
@@ -118,7 +118,7 @@ alter message definition MsgTest.MD_Order.OrderMessage drop member LastName in C
 
 -- Definitions within the collection.
 alter message definition collection MsgTest.MD_Order
-  add definition LineMessage for MsgTest.OrderLine ( Sku, Quantity );
+  add definition LineMessage for MsgTest.OrderLine { Sku, Quantity };
 alter message definition collection MsgTest.MD_Order rename definition LineMessage to Lines;
 alter message definition collection MsgTest.MD_Order drop definition if exists Lines;
 
diff --git a/mdl-examples/use-cases/ai-agent-platform-demo.mdl b/mdl-examples/use-cases/ai-agent-platform-demo.mdl
index 528c8a20c1..2d5e70b6fa 100644
--- a/mdl-examples/use-cases/ai-agent-platform-demo.mdl
+++ b/mdl-examples/use-cases/ai-agent-platform-demo.mdl
@@ -377,17 +377,17 @@ Guidelines:
   UserPrompt: 'What is the customer''s issue and how can I help?'
 )
 {
-  knowledge base SupportKB {
+  knowledge base SupportKB (
     source:      AICustSupport.SupportKnowledgeBase,
     collection:  'support-docs',
     MaxResults:  5,
     description: 'Internal knowledge base: product docs, known issues, runbooks',
     Enabled:     true
-  }
+  )
 
-  mcp service AICustSupport.WebSearchMCP {
+  mcp service AICustSupport.WebSearchMCP (
     Enabled: true
-  }
+  )
 };
 
 -- Guardrail agent: validates AI responses for safety and policy compliance

From c380d6126e001f827bc759a128d929a6bf0279b1 Mon Sep 17 00:00:00 2001
From: Ako <andrej@koelewijn.net>
Date: Mon, 28 Sep 2026 05:44:53 +0000
Subject: [PATCH 04/35] mdl: alter sets properties in create's ( Key: value )
 list; colons where R3 puts them (#751)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

R3 of the beta syntax freeze: `:` sets a model property, so every `alter`
takes the same `( Key: value, … )` list its `create` does, and a colon is
written in a property list or an attribute definition and nowhere else.

Canonical forms, parsed under mdl 0 and mdl 1; the old spellings keep
parsing as registered aliases that warn and that `fmt --upgrade` rewrites:

- MDL-DEPR060 alter settings <section> / configuration 'X' and
  create configuration: `Key = v, …` -> `( Key: v, … )`
- MDL-DEPR061 alter consumed|published odata service X set Key = v
  -> set ( Key: v, … ), exactly create's property list
- MDL-DEPR062 alter styling … set Class = 'x', 'P' = on -> set ( … )
- MDL-DEPR063 alter entity … set allow_create_change_locally = v
  -> set ( AllowCreateChangeLocally: v )
- MDL-DEPR064 association `type: Reference` / owner: / storage: -> no colon
- MDL-DEPR065 modify attribute A T -> modify attribute A: T
- MDL-DEPR101..103, the generic alter page/snippet/layout aliases, move
  from the executor's provisional table into the registry, with rewrites.

describe settings now writes the canonical lists, and the MDL mxcli
generates (testrunner, new-project hints) uses them. Docs, skills,
`mxcli syntax` and the quick reference follow.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .claude/skills/mendix/bootstrap-app/SKILL.md  |   5 +-
 .claude/skills/mendix/create-page/SKILL.md    |   6 +-
 .claude/skills/mendix/demo-data/SKILL.md      |  15 +-
 .../mendix/migrate-design-prototype/SKILL.md  |   2 +-
 .../reference/walkthroughs.md                 |   4 +-
 .../skills/mendix/project-settings/SKILL.md   | 104 +++---
 .../mendix/regular-expressions/SKILL.md       |   2 +-
 .claude/skills/mendix/write-layouts/SKILL.md  |   4 +-
 cmd/mxcli/cmd_new.go                          |   2 +-
 cmd/mxcli/cmd_new_java.go                     |   4 +-
 cmd/mxcli/docker/detect.go                    |   2 +-
 cmd/mxcli/syntax/features_domain_model.go     |   4 +-
 cmd/mxcli/syntax/features_integration.go      |   7 +-
 cmd/mxcli/syntax/features_misc.go             |  44 +--
 cmd/mxcli/syntax/features_page.go             |  10 +-
 .../testrunner/generator_endpoint_test.go     |   8 +-
 cmd/mxcli/testrunner/host.go                  |   2 +-
 cmd/mxcli/testrunner/runner.go                |   6 +-
 cmd/mxcli/testrunner/runner_cleanup_test.go   |  10 +-
 cmd/mxcli/testrunner/runner_endpoint.go       |   4 +-
 docs-site/src/appendixes/quick-reference.md   |  26 +-
 docs-site/src/examples/alter-page.md          |  16 +-
 docs-site/src/language/alter-entity.md        |   4 +-
 docs-site/src/language/project-settings.md    |  22 +-
 docs-site/src/language/snippets.md            |   2 +-
 docs-site/src/reference/page/alter-layout.md  |   8 +-
 .../src/reference/settings/alter-settings.md  |  33 +-
 docs-site/src/tools/docker-run.md             |   4 +-
 docs/01-project/MDL_QUICK_REFERENCE.md        |  20 +-
 mdl/ast/ast_alter_page.go                     |  17 -
 mdl/deprecation/deprecation.go                | 137 +++++++-
 mdl/executor/alter_aliases.go                 | 149 ---------
 mdl/executor/cmd_settings.go                  |  66 ++--
 .../cmd_settings_configuration_test.go        |   2 +-
 .../cmd_settings_describe_canonical_test.go   |  67 ++++
 mdl/executor/cmd_settings_languages.go        |   2 +-
 mdl/executor/validate_alter_page_addresses.go |  47 +++
 ... => validate_alter_page_addresses_test.go} |  52 +--
 mdl/executor/validate_program.go              |   3 -
 mdl/grammar/MDLParser.g4                      |  30 +-
 mdl/grammar/domains/MDLDomainModel.g4         |  16 +-
 mdl/grammar/domains/MDLService.g4             |  15 +-
 mdl/grammar/domains/MDLSettings.g4            |  22 +-
 mdl/upgrade/document_names_test.go            |   4 +-
 mdl/upgrade/r3_property_lists_test.go         |  60 ++++
 mdl/visitor/r3_property_lists_test.go         | 140 ++++++++
 mdl/visitor/r8_spellings_test.go              |   4 +-
 mdl/visitor/visitor_alter.go                  |  26 +-
 .../visitor_alter_alias_equivalence_test.go   |  40 +--
 mdl/visitor/visitor_alter_generic_test.go     |  58 ++--
 mdl/visitor/visitor_alter_page.go             |  18 +-
 mdl/visitor/visitor_document_names_test.go    |  10 +-
 mdl/visitor/visitor_entity.go                 |   3 +
 mdl/visitor/visitor_odata_expression.go       |   6 +
 mdl/visitor/visitor_r3_property_lists.go      | 300 ++++++++++++++++++
 mdl/visitor/visitor_r8_spellings.go           |   1 +
 mdl/visitor/visitor_settings.go               |  81 +++--
 57 files changed, 1158 insertions(+), 598 deletions(-)
 delete mode 100644 mdl/executor/alter_aliases.go
 create mode 100644 mdl/executor/cmd_settings_describe_canonical_test.go
 create mode 100644 mdl/executor/validate_alter_page_addresses.go
 rename mdl/executor/{alter_aliases_test.go => validate_alter_page_addresses_test.go} (63%)
 create mode 100644 mdl/upgrade/r3_property_lists_test.go
 create mode 100644 mdl/visitor/r3_property_lists_test.go
 create mode 100644 mdl/visitor/visitor_r3_property_lists.go

diff --git a/.claude/skills/mendix/bootstrap-app/SKILL.md b/.claude/skills/mendix/bootstrap-app/SKILL.md
index 683b8e0e81..a2a4fca33e 100644
--- a/.claude/skills/mendix/bootstrap-app/SKILL.md
+++ b/.claude/skills/mendix/bootstrap-app/SKILL.md
@@ -253,8 +253,9 @@ with these deltas:
   against the host name rather than the listen address:
 
   ```sql
-  alter settings configuration 'Default'
-    ApplicationRootUrl = 'http://backend.local:8080/';
+  alter settings configuration 'Default' (
+    ApplicationRootUrl: 'http://backend.local:8080/'
+  );
   ```
 
   `run --local` picks that up at boot and prints which configuration it came from.
diff --git a/.claude/skills/mendix/create-page/SKILL.md b/.claude/skills/mendix/create-page/SKILL.md
index 3f944f0807..65dd872670 100644
--- a/.claude/skills/mendix/create-page/SKILL.md
+++ b/.claude/skills/mendix/create-page/SKILL.md
@@ -47,11 +47,11 @@ create [or replace] page Module.PageName
 page is opened in a pop-up. They are optional — omitting them uses the Mendix defaults
 (600 × 600, not resizable). Unlike the other header keywords, these property names are
 **case-sensitive** and must be written exactly as shown. They can also be changed later
-with `alter page … { set PopupWidth = …; }` (see the alter-page skill).
+with `alter page … { set (PopupWidth: …); }` (see the alter-page skill).
 
 **Page CSS class / style** (`Class` / `Style`) set the page's Appearance — a CSS class
 and inline style applied to the whole page (e.g. `Class: 'container-fluid bg-light'`).
-Both are optional and can be changed later with `alter page … { set Class = '…'; }`.
+Both are optional and can be changed later with `alter page … { set (Class: '…'); }`.
 
 **Page Variables**: Local variables at the page level for use in expressions (e.g., column visibility).
 - DataType: `boolean`, `string`, `integer`, `decimal`, `datetime`
@@ -243,7 +243,7 @@ To make targeted changes to an existing page (change a label, add a field, remov
 ```sql
 -- Change a button caption and add a field
 alter page Module.Customer_Edit {
-  set caption = 'Save & Close' on btnSave;
+  set (caption: 'Save & Close') on btnSave;
   insert after txtEmail {
     textbox txtPhone (label: 'Phone', attribute: Phone)
   }
diff --git a/.claude/skills/mendix/demo-data/SKILL.md b/.claude/skills/mendix/demo-data/SKILL.md
index faead4d4bf..74975483ba 100644
--- a/.claude/skills/mendix/demo-data/SKILL.md
+++ b/.claude/skills/mendix/demo-data/SKILL.md
@@ -41,13 +41,14 @@ For full credentials (username, password):
 
 Example output:
 ```sql
-alter settings configuration 'Default'
-  DatabaseType = 'PostgreSql',
-  DatabaseUrl = 'localhost:5434',
-  DatabaseName = 'mxcli2-dev',
-  DatabaseUserName = 'mendix',
-  DatabasePassword = 'mendix',
-  HttpPortNumber = 8080;
+alter settings configuration 'Default' (
+  DatabaseType: 'PostgreSql',
+  DatabaseUrl: 'localhost:5434',
+  DatabaseName: 'mxcli2-dev',
+  DatabaseUserName: 'mendix',
+  DatabasePassword: 'mendix',
+  HttpPortNumber: 8080
+);
 ```
 
 ---
diff --git a/.claude/skills/mendix/migrate-design-prototype/SKILL.md b/.claude/skills/mendix/migrate-design-prototype/SKILL.md
index 423769afbd..d270f7a2ed 100644
--- a/.claude/skills/mendix/migrate-design-prototype/SKILL.md
+++ b/.claude/skills/mendix/migrate-design-prototype/SKILL.md
@@ -538,7 +538,7 @@ Use `alter page` to attach a class without rewriting the page (see `alter-page`)
 
 ```sql
 alter page ResourceScheduling.Approvals {
-  set Class = 'ss-appr-card ss-appr-card--conflict' on queueCard;
+  set (Class: 'ss-appr-card ss-appr-card--conflict') on queueCard;
 }
 ```
 
diff --git a/.claude/skills/mendix/odata-data-sharing/reference/walkthroughs.md b/.claude/skills/mendix/odata-data-sharing/reference/walkthroughs.md
index 54b37a4edd..661a110a20 100644
--- a/.claude/skills/mendix/odata-data-sharing/reference/walkthroughs.md
+++ b/.claude/skills/mendix/odata-data-sharing/reference/walkthroughs.md
@@ -309,8 +309,8 @@ from consumed odata service ShopClient.ShopApiClient
 );
 
 -- Toggle the flag without recreating the entity.
-alter entity ShopClient.Product set allow_create_change_locally = true;
-alter entity ShopClient.Product set allow_create_change_locally = false;
+alter entity ShopClient.Product set ( AllowCreateChangeLocally: true );
+alter entity ShopClient.Product set ( AllowCreateChangeLocally: false );
 ```
 ## Publishing a Non-Persistable Entity (no copy of the data)
 
diff --git a/.claude/skills/mendix/project-settings/SKILL.md b/.claude/skills/mendix/project-settings/SKILL.md
index bcf305d913..529d8486ab 100644
--- a/.claude/skills/mendix/project-settings/SKILL.md
+++ b/.claude/skills/mendix/project-settings/SKILL.md
@@ -30,22 +30,22 @@ describe settings;
 ### Modify Model Settings
 
 ```sql
-alter settings runtime AfterStartupMicroflow = 'Module.MF_Startup';  -- must return Boolean (CE0142)
-alter settings runtime BeforeShutdownMicroflow = 'Module.MF_Shutdown';
-alter settings runtime HealthCheckMicroflow = 'Module.MF_HealthCheck';
-alter settings runtime HashAlgorithm = 'BCrypt';
-alter settings runtime BcryptCost = 12;
-alter settings runtime JavaVersion = 'Java21';  -- or '21'; see note below
-alter settings runtime RoundingMode = 'HalfUp';
-alter settings runtime AllowUserMultipleSessions = true;
-alter settings runtime ScheduledEventTimeZoneCode = 'Etc/UTC';
-alter settings runtime DefaultTimeZoneCode = 'Europe/Amsterdam';
-alter settings runtime FirstDayOfWeek = 'Monday';       -- Default, Monday..Sunday
-alter settings runtime DecimalScale = 8;
-alter settings runtime EnableDataStorageOptimisticLocking = true;
-alter settings runtime UseDatabaseForeignKeyConstraints = true;
-alter settings runtime UseOQLVersion2 = true;
-alter settings runtime SslCertificateAlgorithm = 'PKIX';   -- PKIX or SunX509
+alter settings runtime ( AfterStartupMicroflow: 'Module.MF_Startup' );  -- must return Boolean (CE0142)
+alter settings runtime ( BeforeShutdownMicroflow: 'Module.MF_Shutdown' );
+alter settings runtime ( HealthCheckMicroflow: 'Module.MF_HealthCheck' );
+alter settings runtime ( HashAlgorithm: 'BCrypt' );
+alter settings runtime ( BcryptCost: 12 );
+alter settings runtime ( JavaVersion: 'Java21' );  -- or '21'; see note below
+alter settings runtime ( RoundingMode: 'HalfUp' );
+alter settings runtime ( AllowUserMultipleSessions: true );
+alter settings runtime ( ScheduledEventTimeZoneCode: 'Etc/UTC' );
+alter settings runtime ( DefaultTimeZoneCode: 'Europe/Amsterdam' );
+alter settings runtime ( FirstDayOfWeek: 'Monday' );       -- Default, Monday..Sunday
+alter settings runtime ( DecimalScale: 8 );
+alter settings runtime ( EnableDataStorageOptimisticLocking: true );
+alter settings runtime ( UseDatabaseForeignKeyConstraints: true );
+alter settings runtime ( UseOQLVersion2: true );
+alter settings runtime ( SslCertificateAlgorithm: 'PKIX' );   -- PKIX or SunX509
 ```
 
 **Not every project stores every setting.** Mendix adds model settings over time —
@@ -97,18 +97,20 @@ configuration, add `DatabasePassword = '…'` yourself.
 
 ```sql
 -- Full database configuration
-alter settings configuration 'Default'
-  DatabaseType = 'PostgreSql',
-  DatabaseUrl = 'localhost:5432',
-  DatabaseName = 'mydb',
-  DatabaseUserName = 'mendix',
-  DatabasePassword = 'mendix',
-  HttpPortNumber = 8080,
-  ServerPortNumber = 8090;
+alter settings configuration 'Default' (
+  DatabaseType: 'PostgreSql',
+  DatabaseUrl: 'localhost:5432',
+  DatabaseName: 'mydb',
+  DatabaseUserName: 'mendix',
+  DatabasePassword: 'mendix',
+  HttpPortNumber: 8080,
+  ServerPortNumber: 8090
+);
 
 -- Update a single field
-alter settings configuration 'Default'
-  DatabaseUrl = 'newhost:5432';
+alter settings configuration 'Default' (
+  DatabaseUrl: 'newhost:5432'
+);
 ```
 
 `HttpPortNumber`, `ServerPortNumber`, `BcryptCost`, `DefaultTaskParallelism` and
@@ -169,10 +171,11 @@ on shared values only:
 create configuration 'Staging';
 
 -- Create with properties
-create configuration 'Production'
-  DatabaseType = 'PostgreSql',
-  DatabaseUrl = 'prod-db:5432',
-  HttpPortNumber = 8080;
+create configuration 'Production' (
+  DatabaseType: 'PostgreSql',
+  DatabaseUrl: 'prod-db:5432',
+  HttpPortNumber: 8080
+);
 
 -- Drop a configuration
 drop configuration 'Staging';
@@ -197,7 +200,7 @@ alter settings LANGUAGE modify 'de_DE' (CheckCompleteness: true);
 alter settings LANGUAGE remove 'de_DE';
 
 -- the default must already be enabled
-alter settings LANGUAGE DefaultLanguageCode = 'en_US';
+alter settings LANGUAGE ( DefaultLanguageCode: 'en_US' );
 ```
 
 A language is identified by its **code** — "Arabic, Sudan" is derived from
@@ -213,7 +216,7 @@ A language is identified by its **code** — "Arabic, Sudan" is derived from
 
 **Set the default language BEFORE authoring content.** The default is not only a
 fallback — it is the language a new caption is stored under, because Mendix has no
-language-neutral text. `alter settings LANGUAGE DefaultLanguageCode = 'nl_NL'`
+language-neutral text. `alter settings LANGUAGE (DefaultLanguageCode: 'nl_NL')`
 *after* creating a page leaves that page's texts in the old language, and nothing
 reports it: `mx check` is 0 errors either way and the symptom shows up only in
 Studio Pro, as the empty-caption placeholder plus a "no translation" warning.
@@ -231,9 +234,10 @@ list.
 
 ```sql
 
-alter settings workflows
-  UserEntity = 'System.User',
-  DefaultTaskParallelism = 3;
+alter settings workflows (
+  UserEntity: 'System.User',
+  DefaultTaskParallelism: 3
+);
 ```
 
 ### Workflow Groups (Mendix 11.2+)
@@ -281,24 +285,26 @@ Four things worth knowing:
 
 ### PostgreSQL Configuration
 ```sql
-alter settings configuration 'Default'
-  DatabaseType = 'PostgreSql',
-  DatabaseUrl = 'localhost:5432',
-  DatabaseName = 'myapp',
-  DatabaseUserName = 'mendix',
-  DatabasePassword = 'mendix',
-  HttpPortNumber = 8080;
+alter settings configuration 'Default' (
+  DatabaseType: 'PostgreSql',
+  DatabaseUrl: 'localhost:5432',
+  DatabaseName: 'myapp',
+  DatabaseUserName: 'mendix',
+  DatabasePassword: 'mendix',
+  HttpPortNumber: 8080
+);
 ```
 
 ### SQL Server Configuration
 ```sql
-alter settings configuration 'Default'
-  DatabaseType = 'SqlServer',
-  DatabaseUrl = 'localhost:1433',
-  DatabaseName = 'myapp',
-  DatabaseUserName = 'sa',
-  DatabasePassword = 'MyPassword',
-  HttpPortNumber = 8080;
+alter settings configuration 'Default' (
+  DatabaseType: 'SqlServer',
+  DatabaseUrl: 'localhost:1433',
+  DatabaseName: 'myapp',
+  DatabaseUserName: 'sa',
+  DatabasePassword: 'MyPassword',
+  HttpPortNumber: 8080
+);
 ```
 
 ## Checklist
diff --git a/.claude/skills/mendix/regular-expressions/SKILL.md b/.claude/skills/mendix/regular-expressions/SKILL.md
index 0f70dd8847..9ce048de96 100644
--- a/.claude/skills/mendix/regular-expressions/SKILL.md
+++ b/.claude/skills/mendix/regular-expressions/SKILL.md
@@ -102,7 +102,7 @@ create entity Val.Person (
   Code:  String(20)  unique error message 'Code must be unique'
 );
 
-alter entity Val.Person modify attribute Email String(200)
+alter entity Val.Person modify attribute Email: String(200)
   not null error message 'Email is required';
 ```
 
diff --git a/.claude/skills/mendix/write-layouts/SKILL.md b/.claude/skills/mendix/write-layouts/SKILL.md
index 8a9055d5f1..2e17bccd5a 100644
--- a/.claude/skills/mendix/write-layouts/SKILL.md
+++ b/.claude/skills/mendix/write-layouts/SKILL.md
@@ -96,8 +96,8 @@ survive. Same operations as `ALTER PAGE`:
 ```sql
 alter layout MyModule.App_Default {
   insert into layoutContainer.top { snippetcall bar (snippet: MyModule.SNIPPET_ThemeBar) };
-  set Content = 'My App' on brandText;
-  drop widget oldBanner;
+  set (Content: 'My App') on brandText;
+  drop oldBanner;
 };
 ```
 
diff --git a/cmd/mxcli/cmd_new.go b/cmd/mxcli/cmd_new.go
index 0304d1bb37..62b88cf40a 100644
--- a/cmd/mxcli/cmd_new.go
+++ b/cmd/mxcli/cmd_new.go
@@ -266,7 +266,7 @@ Examples:
 		if lowered, err := alignJavaVersion(mprPath, os.Stdout); err != nil {
 			fmt.Fprintf(os.Stderr, "  Warning: could not align the project's Java version: %v\n", err)
 			fmt.Fprintln(os.Stderr, "  If the first build fails with 'release version NN not supported',")
-			fmt.Fprintln(os.Stderr, "  run: mxcli -p <project>.mpr -c \"alter settings runtime JavaVersion = '21'\"")
+			fmt.Fprintln(os.Stderr, "  run: mxcli -p <project>.mpr -c \"alter settings runtime ( JavaVersion: '21' )\"")
 		} else if lowered {
 			fmt.Println()
 		}
diff --git a/cmd/mxcli/cmd_new_java.go b/cmd/mxcli/cmd_new_java.go
index 608ac3efad..19ad99fce9 100644
--- a/cmd/mxcli/cmd_new_java.go
+++ b/cmd/mxcli/cmd_new_java.go
@@ -56,13 +56,13 @@ func alignJavaVersion(projectPath string, out io.Writer) (bool, error) {
 		return false, nil
 	}
 
-	script := fmt.Sprintf("alter settings runtime JavaVersion = '%d';\n", fallback)
+	script := fmt.Sprintf("alter settings runtime ( JavaVersion: '%d' );\n", fallback)
 	if err := runMDL(projectPath, script, io.Discard); err != nil {
 		return false, fmt.Errorf("lowering JavaVersion from %d to %d: %w", major, fallback, err)
 	}
 	fmt.Fprintf(out, "  Java %d → %d: no JDK %d on this machine, and the project would not build.\n",
 		major, fallback, major)
 	fmt.Fprintf(out, "  Install a JDK %d and set JavaVersion back to %d to build for it:\n", major, major)
-	fmt.Fprintf(out, "    mxcli -p <project>.mpr -c \"alter settings runtime JavaVersion = '%d'\"\n", major)
+	fmt.Fprintf(out, "    mxcli -p <project>.mpr -c \"alter settings runtime ( JavaVersion: '%d' )\"\n", major)
 	return true, nil
 }
diff --git a/cmd/mxcli/docker/detect.go b/cmd/mxcli/docker/detect.go
index 723be44742..9bba775481 100644
--- a/cmd/mxcli/docker/detect.go
+++ b/cmd/mxcli/docker/detect.go
@@ -350,7 +350,7 @@ func resolveJDK(major int) (string, error) {
 	// be noise.
 	if major != DefaultJavaMajor {
 		msg += fmt.Sprintf("\n  This is the project's own Settings > Model > JavaVersion. To build for a"+
-			"\n  release you already have instead: mxcli -p <project>.mpr -c \"alter settings runtime JavaVersion = '%d'\"", DefaultJavaMajor)
+			"\n  release you already have instead: mxcli -p <project>.mpr -c \"alter settings runtime ( JavaVersion: '%d' )\"", DefaultJavaMajor)
 	}
 	return "", fmt.Errorf("%s", msg)
 }
diff --git a/cmd/mxcli/syntax/features_domain_model.go b/cmd/mxcli/syntax/features_domain_model.go
index 8f094e8420..aac434a206 100644
--- a/cmd/mxcli/syntax/features_domain_model.go
+++ b/cmd/mxcli/syntax/features_domain_model.go
@@ -96,8 +96,8 @@ func init() {
 			"if not exists", "if exists", "idempotent",
 			"alter entities", "bulk", "every entity", "all entities", "where persistent",
 		},
-		Syntax:  "ALTER ENTITY Module.Name ADD ATTRIBUTE [IF NOT EXISTS] AttrName: Type [constraints];\nALTER ENTITY Module.Name DROP ATTRIBUTE [IF EXISTS] AttrName;\nALTER ENTITY Module.Name RENAME ATTRIBUTE OldName TO NewName;\nALTER ENTITY Module.Name MODIFY ATTRIBUTE AttrName Type [DEFAULT val];\nALTER ENTITY Module.Name DROP DEFAULT ON ATTRIBUTE AttrName;\nALTER ENTITY Module.Name ADD INDEX [name] [ON] (attr1, attr2);\nALTER ENTITY Module.Name SET DOCUMENTATION 'text';\nALTER ENTITY Module.Name SET POSITION (x, y);\nALTER ENTITY Module.Name ADD EVENT HANDLER ON BEFORE COMMIT CALL Module.MF RAISE ERROR;\nALTER ENTITIES [IN Module] ADD ATTRIBUTE [IF NOT EXISTS] AttrName: Type [, ...]\n  [WHERE PERSISTENT | WHERE NON-PERSISTENT];\n\nALTER ENTITIES is the bulk form: one statement applied to every entity in a\nmodule instead of one statement per entity. Only ADD ATTRIBUTE is offered --\nDROP and RENAME aimed at a set are destructive by a typo, and SET POSITION on\nevery entity is meaningless. Pair it with IF NOT EXISTS so the script re-runs.\n\nWHERE filters by persistence, using the same words CREATE ENTITY uses. A VIEW\nentity matches NEITHER: its rows come from an OQL query, so it is not the\npersistent/non-persistent distinction this filter means.\n\nWITHOUT IN, the sweep covers the whole project but SKIPS System and every\nMarketplace module, reporting which -- an upgrade replaces those modules and\nwould take the attribute with it. Naming a module with IN is taken as meaning\nit, so a deliberate edit there is still possible.\n\nSET POSITION places the entity in the domain-model editor, and CREATE ENTITY\ntakes the same thing as an @Position(x, y) annotation. Both are the box's\nCENTRE, not its top-left corner. An entity created without one takes the next\nslot in a wrapping grid, which is a default rather than a layout: to arrange a\nwhole module from its association graph, run 'mxcli layout -p app.mpr'\n(--dry-run first; it replaces positions you set by hand).\n\nMODIFY ATTRIBUTE always takes a type — restate it even when you are only\nchanging the default. There is no 'MODIFY ATTRIBUTE X SET DEFAULT v' form:\nSET would be read as the type name. Use DROP DEFAULT to clear one.\n\nIF NOT EXISTS / IF EXISTS make the add/drop a no-op (skipped, not an error)\nwhen the attribute is already present / already gone — so a domain script\nre-runs cleanly. For a whole script, 'mxcli exec --continue-on-error' reports\neach failed statement and keeps going instead of halting at the first.\n\nRENAME ATTRIBUTE also rewrites every reference to the attribute: the stored\nqualified names (microflow create/change members, page widgets, the entity's own\nvalidation and access rules) AND the bare steps inside XPath constraints, which\nare resolved to their owning entity first so another entity's identically-named\nattribute is left alone. A constraint that cannot be resolved is reported and\nleft unchanged, never guessed at. Uses inside microflow expressions ($obj/Attr)\nare free text and are NOT rewritten; mxbuild reports those as CE0117.",
-		Example: "ALTER ENTITY Shop.Customer ADD ATTRIBUTE Phone: String(20);\nALTER ENTITY Shop.Customer ADD ATTRIBUTE IF NOT EXISTS Phone: String(20);  -- re-runnable\nALTER ENTITY Shop.Customer DROP ATTRIBUTE IF EXISTS OldField;              -- re-runnable\nALTER ENTITY Shop.Customer RENAME ATTRIBUTE Email TO EmailAddress;\nALTER ENTITY Shop.Customer MODIFY ATTRIBUTE Phone String(30) DEFAULT '';  -- type restated\nALTER ENTITY Shop.Customer DROP DEFAULT ON ATTRIBUTE Phone;               -- clear a default\nALTER ENTITY Shop.Customer ADD INDEX ON (EmailAddress);\nALTER ENTITY Shop.Customer\n  ADD EVENT HANDLER ON BEFORE COMMIT CALL Shop.Validate($currentObject) RAISE ERROR;\n\n-- give every persistent entity in a module an audit trail, in one statement\nALTER ENTITIES IN Shop\n  ADD ATTRIBUTE IF NOT EXISTS CreatedDate: AutoCreatedDate,\n  ADD ATTRIBUTE IF NOT EXISTS ChangedDate: AutoChangedDate\n  WHERE PERSISTENT;",
+		Syntax:  "ALTER ENTITY Module.Name ADD ATTRIBUTE [IF NOT EXISTS] AttrName: Type [constraints];\nALTER ENTITY Module.Name DROP ATTRIBUTE [IF EXISTS] AttrName;\nALTER ENTITY Module.Name RENAME ATTRIBUTE OldName TO NewName;\nALTER ENTITY Module.Name MODIFY ATTRIBUTE AttrName: Type [DEFAULT val];\nALTER ENTITY Module.Name DROP DEFAULT ON ATTRIBUTE AttrName;\nALTER ENTITY Module.Name ADD INDEX [name] [ON] (attr1, attr2);\nALTER ENTITY Module.Name SET DOCUMENTATION 'text';\nALTER ENTITY Module.Name SET POSITION (x, y);\nALTER ENTITY Module.Name SET (AllowCreateChangeLocally: true|false);  -- external entity\nALTER ENTITY Module.Name ADD EVENT HANDLER ON BEFORE COMMIT CALL Module.MF RAISE ERROR;\nALTER ENTITIES [IN Module] ADD ATTRIBUTE [IF NOT EXISTS] AttrName: Type [, ...]\n  [WHERE PERSISTENT | WHERE NON-PERSISTENT];\n\nALTER ENTITIES is the bulk form: one statement applied to every entity in a\nmodule instead of one statement per entity. Only ADD ATTRIBUTE is offered --\nDROP and RENAME aimed at a set are destructive by a typo, and SET POSITION on\nevery entity is meaningless. Pair it with IF NOT EXISTS so the script re-runs.\n\nWHERE filters by persistence, using the same words CREATE ENTITY uses. A VIEW\nentity matches NEITHER: its rows come from an OQL query, so it is not the\npersistent/non-persistent distinction this filter means.\n\nWITHOUT IN, the sweep covers the whole project but SKIPS System and every\nMarketplace module, reporting which -- an upgrade replaces those modules and\nwould take the attribute with it. Naming a module with IN is taken as meaning\nit, so a deliberate edit there is still possible.\n\nSET POSITION places the entity in the domain-model editor, and CREATE ENTITY\ntakes the same thing as an @Position(x, y) annotation. Both are the box's\nCENTRE, not its top-left corner. An entity created without one takes the next\nslot in a wrapping grid, which is a default rather than a layout: to arrange a\nwhole module from its association graph, run 'mxcli layout -p app.mpr'\n(--dry-run first; it replaces positions you set by hand).\n\nMODIFY ATTRIBUTE always takes a type — restate it even when you are only\nchanging the default. There is no 'MODIFY ATTRIBUTE X SET DEFAULT v' form:\nSET would be read as the type name. Use DROP DEFAULT to clear one.\n\nIF NOT EXISTS / IF EXISTS make the add/drop a no-op (skipped, not an error)\nwhen the attribute is already present / already gone — so a domain script\nre-runs cleanly. For a whole script, 'mxcli exec --continue-on-error' reports\neach failed statement and keeps going instead of halting at the first.\n\nRENAME ATTRIBUTE also rewrites every reference to the attribute: the stored\nqualified names (microflow create/change members, page widgets, the entity's own\nvalidation and access rules) AND the bare steps inside XPath constraints, which\nare resolved to their owning entity first so another entity's identically-named\nattribute is left alone. A constraint that cannot be resolved is reported and\nleft unchanged, never guessed at. Uses inside microflow expressions ($obj/Attr)\nare free text and are NOT rewritten; mxbuild reports those as CE0117.",
+		Example: "ALTER ENTITY Shop.Customer ADD ATTRIBUTE Phone: String(20);\nALTER ENTITY Shop.Customer ADD ATTRIBUTE IF NOT EXISTS Phone: String(20);  -- re-runnable\nALTER ENTITY Shop.Customer DROP ATTRIBUTE IF EXISTS OldField;              -- re-runnable\nALTER ENTITY Shop.Customer RENAME ATTRIBUTE Email TO EmailAddress;\nALTER ENTITY Shop.Customer MODIFY ATTRIBUTE Phone: String(30) DEFAULT '';  -- type restated\nALTER ENTITY Shop.Customer DROP DEFAULT ON ATTRIBUTE Phone;               -- clear a default\nALTER ENTITY Shop.Customer ADD INDEX ON (EmailAddress);\nALTER ENTITY Shop.Customer\n  ADD EVENT HANDLER ON BEFORE COMMIT CALL Shop.Validate($currentObject) RAISE ERROR;\n\n-- give every persistent entity in a module an audit trail, in one statement\nALTER ENTITIES IN Shop\n  ADD ATTRIBUTE IF NOT EXISTS CreatedDate: AutoCreatedDate,\n  ADD ATTRIBUTE IF NOT EXISTS ChangedDate: AutoChangedDate\n  WHERE PERSISTENT;",
 		SeeAlso: []string{"domain-model.entity.create", "domain-model.entity.attributes"},
 	})
 
diff --git a/cmd/mxcli/syntax/features_integration.go b/cmd/mxcli/syntax/features_integration.go
index e1a662c6ec..7830d1ff95 100644
--- a/cmd/mxcli/syntax/features_integration.go
+++ b/cmd/mxcli/syntax/features_integration.go
@@ -55,12 +55,17 @@ func init() {
 			"  ErrorHandlingMicroflow: microflow Module.HandleError\n" +
 			")\n" +
 			"[HEADERS ('Key': 'Value')];\n\n" +
+			"ALTER CONSUMED ODATA SERVICE Module.Name SET (Key: value, ...);  -- CREATE's keys\n" +
+			"ALTER PUBLISHED ODATA SERVICE Module.Name SET (Key: value, ...);\n\n" +
 			"CREATE EXTERNAL ENTITY Module.Name\n" +
 			"  FROM CONSUMED ODATA SERVICE Module.Client\n" +
 			"  (EntitySet: 'Name', RemoteName: 'Name')\n" +
 			"  (Attr: Type, ...);\n\n" +
 			"CREATE EXTERNAL ENTITIES FROM Module.Client\n" +
-			"  [INTO Module] [ENTITIES (Name1, Name2)];",
+			"  [INTO Module] [ENTITIES (Name1, Name2)];\n\n" +
+			"ALTER ENTITY Module.Name SET (AllowCreateChangeLocally: true);\n\n" +
+			"-- `SET Key = value, ...` (no parentheses) still runs and warns MDL-DEPR061;\n" +
+			"-- `SET allow_create_change_locally = true` warns MDL-DEPR063.",
 		Example: "CREATE CONSTANT MyModule.SvcUrl TYPE String DEFAULT 'https://api.example.com/odata/v4/';\n\nCREATE CONSUMED ODATA SERVICE MyModule.SalesforceAPI (\n  Version: '1.0',\n  ODataVersion: OData4,\n  MetadataUrl: 'https://api.example.com/odata/$metadata',\n  Timeout: 300,\n  ServiceUrl: MyModule.SvcUrl\n);\n\nCREATE EXTERNAL ENTITIES FROM MyModule.SalesforceAPI INTO Integration;",
 		SeeAlso: []string{"odata", "odata.publish", "odata.show"},
 	})
diff --git a/cmd/mxcli/syntax/features_misc.go b/cmd/mxcli/syntax/features_misc.go
index 50f6410ae4..aae68a05a2 100644
--- a/cmd/mxcli/syntax/features_misc.go
+++ b/cmd/mxcli/syntax/features_misc.go
@@ -369,8 +369,8 @@ CREATE OR REPLACE NAVIGATION TabletOffline
 			"settings", "project settings", "configuration",
 			"startup", "shutdown", "hash algorithm", "java version",
 		},
-		Syntax:  "SHOW SETTINGS;\nDESCRIBE SETTINGS;\nDESCRIBE SETTINGS CONFIGURATION '<name>';   -- just one configuration\nALTER SETTINGS RUNTIME <key> = <value>;   -- MODEL is a deprecated alias\nALTER SETTINGS CONFIGURATION '<name>' <key> = <value>;",
-		Example: "SHOW SETTINGS;\nALTER SETTINGS RUNTIME AfterStartupMicroflow = 'Module.MF_Startup';",
+		Syntax:  "SHOW SETTINGS;\nDESCRIBE SETTINGS;\nDESCRIBE SETTINGS CONFIGURATION '<name>';   -- just one configuration\nALTER SETTINGS RUNTIME (<key>: <value>, ...);   -- MODEL is a deprecated alias\nALTER SETTINGS CONFIGURATION '<name>' (<key>: <value>, ...);",
+		Example: "SHOW SETTINGS;\nALTER SETTINGS RUNTIME (AfterStartupMicroflow: 'Module.MF_Startup');",
 		SeeAlso: []string{"settings.show", "settings.alter"},
 	})
 
@@ -460,33 +460,37 @@ create or modify translations in Administration for nl_NL (
 			"optimistic locking", "concurrency", "lost update",
 			"workflow group", "workflow groups", "add group", "task assignment",
 		},
-		Syntax: `ALTER SETTINGS RUNTIME <key> = <value>;
-ALTER SETTINGS CONFIGURATION '<name>' <key> = <value>, ...;
+		Syntax: `ALTER SETTINGS RUNTIME (<key>: <value>, ...);
+ALTER SETTINGS CONFIGURATION '<name>' (<key>: <value>, ...);
 ALTER SETTINGS CONSTANT '<qualifiedName>' VALUE '<value>' IN CONFIGURATION '<name>';
 ALTER SETTINGS DROP CONSTANT '<qualifiedName>' IN CONFIGURATION '<name>';
-ALTER SETTINGS LANGUAGE DefaultLanguageCode = '<code>';
+ALTER SETTINGS LANGUAGE (DefaultLanguageCode: '<code>');
 ALTER SETTINGS LANGUAGE ADD '<code>' [(CheckCompleteness: true, CustomDateFormat: '<fmt>')];
 ALTER SETTINGS LANGUAGE ADD OR MODIFY '<code>' [(...)];
 ALTER SETTINGS LANGUAGE MODIFY '<code>' (CheckCompleteness: true, ...);
 ALTER SETTINGS LANGUAGE REMOVE '<code>';
-ALTER SETTINGS WORKFLOWS UserEntity = '<qualifiedName>';
+ALTER SETTINGS WORKFLOWS (UserEntity: '<qualifiedName>');
 ALTER SETTINGS WORKFLOWS ADD [OR MODIFY] GROUP '<name>' [(Description: '<text>')];
 ALTER SETTINGS WORKFLOWS MODIFY GROUP '<name>' (Description: '<text>');
 ALTER SETTINGS WORKFLOWS REMOVE GROUP '<name>';
-CREATE [OR MODIFY] CONFIGURATION '<name>' [<key> = <value>, ...];
-DROP CONFIGURATION '<name>';`,
-		Example: `ALTER SETTINGS RUNTIME AfterStartupMicroflow = 'Module.MF_Startup';
-ALTER SETTINGS RUNTIME HashAlgorithm = 'BCrypt';
-ALTER SETTINGS RUNTIME EnableDataStorageOptimisticLocking = true;
-ALTER SETTINGS CONFIGURATION 'Default'
-  DatabaseType = 'PostgreSql',
-  DatabaseUrl = 'localhost:5432',
-  DatabaseName = 'mydb';
+CREATE [OR MODIFY] CONFIGURATION '<name>' [(<key>: <value>, ...)];
+DROP CONFIGURATION '<name>';
+
+-- A property is Key: value in a ( … ) list, as everywhere else in MDL (R3).
+-- Key = value, … without the parentheses still runs and warns MDL-DEPR060.`,
+		Example: `ALTER SETTINGS RUNTIME (AfterStartupMicroflow: 'Module.MF_Startup');
+ALTER SETTINGS RUNTIME (HashAlgorithm: 'BCrypt', EnableDataStorageOptimisticLocking: true);
+ALTER SETTINGS CONFIGURATION 'Default' (
+  DatabaseType: 'PostgreSql',
+  DatabaseUrl: 'localhost:5432',
+  DatabaseName: 'mydb'
+);
 ALTER SETTINGS CONSTANT 'BusinessEvents.ServerUrl' VALUE 'kafka:9092'
   IN CONFIGURATION 'Default';
-CREATE CONFIGURATION 'Production'
-  DatabaseType = 'PostgreSql',
-  HttpPortNumber = 8080;
+CREATE CONFIGURATION 'Production' (
+  DatabaseType: 'PostgreSql',
+  HttpPortNumber: 8080
+);
 
 -- LANGUAGE ADD/REMOVE change the ENABLED languages — the list under App
 -- Settings > Languages, and the only languages a build emits anything for. A
@@ -719,9 +723,9 @@ CE0135 "No regular expression specified" at build time.
 
 REQUIRED and UNIQUE rules are written as attribute constraints instead, on
 CREATE ENTITY or ALTER ENTITY:
-  ALTER ENTITY Shop.Product MODIFY ATTRIBUTE Email string(200)
+  ALTER ENTITY Shop.Product MODIFY ATTRIBUTE Email: string(200)
     NOT NULL ERROR MESSAGE 'Email is required';
-  ALTER ENTITY Shop.Product MODIFY ATTRIBUTE Code string(20)
+  ALTER ENTITY Shop.Product MODIFY ATTRIBUTE Code: string(20)
     UNIQUE ERROR MESSAGE 'Code must be unique';`,
 		Example: `CREATE REGULAR EXPRESSION Shop.EmailPattern (
   Expression: '^[^@\s]+@[^@\s]+\.[^@\s]+$'
diff --git a/cmd/mxcli/syntax/features_page.go b/cmd/mxcli/syntax/features_page.go
index 81e6b357bd..d19944a8c7 100644
--- a/cmd/mxcli/syntax/features_page.go
+++ b/cmd/mxcli/syntax/features_page.go
@@ -306,21 +306,23 @@ CREATE PAGE Sales.Detail (Title: 'Detail', Layout: Atlas_Core.Atlas_Default) {
 			"  DesignProperties: ['Full width': ON]\n\n" +
 			"ON A PAGE THAT ALREADY EXISTS, without rewriting it:\n\n" +
 			"  ALTER STYLING ON PAGE|SNIPPET Module.Name WIDGET <widgetName>\n" +
-			"    SET Class = 'css-class', Style = 'css', 'Design property' = 'Value'|ON|OFF;\n\n" +
+			"    SET (Class: 'css-class', Style: 'css', 'Design property': 'Value'|ON|OFF);\n\n" +
 			"  ALTER STYLING ON PAGE|SNIPPET Module.Name WIDGET <widgetName>\n" +
 			"    CLEAR DESIGN PROPERTIES;\n\n" +
 			"The widget is named by its MDL NAME — the identifier after the widget\n" +
 			"keyword (`ACTIONBUTTON btnSave`), not its caption. `DESCRIBE PAGE` prints\n" +
 			"the names.\n\n" +
-			"A bare `Class =` REPLACES the widget's classes rather than adding to them.\n" +
+			"A bare `Class:` REPLACES the widget's classes rather than adding to them.\n" +
 			"Read the current value first if you meant to append.\n\n" +
 			"Reach for ALTER STYLING rather than CREATE OR REPLACE PAGE whenever only\n" +
 			"the look changes: replacing the page rewrites every widget in it, so the\n" +
-			"diff is the whole document and anything MDL cannot yet spell is lost.",
+			"diff is the whole document and anything MDL cannot yet spell is lost.\n\n" +
+			"`SET Class = 'x', 'P' = ON` (no parentheses, `=`) still runs and warns\n" +
+			"MDL-DEPR062.",
 		Example: "CONTAINER ctn (\n  Class: 'my-card',\n  DynamicClasses: if $currentObject/Priority = 'High' then 'card-danger' else 'card-normal'\n) {\n  DYNAMICTEXT txt (Content: 'Styled text')\n}\n\n" +
 			"-- Restyle one widget on a page that already exists\n" +
 			"alter styling on page Sales.OrderOverview widget btnSave\n" +
-			"  set Class = 'btn-primary', 'Spacing top' = 'Large';\n\n" +
+			"  set (Class: 'btn-primary', 'Spacing top': 'Large');\n\n" +
 			"-- Back to Atlas defaults\n" +
 			"alter styling on snippet Sales.OrderRow widget ctnMain\n" +
 			"  clear design properties;",
diff --git a/cmd/mxcli/testrunner/generator_endpoint_test.go b/cmd/mxcli/testrunner/generator_endpoint_test.go
index 976513c798..1b695d3cf5 100644
--- a/cmd/mxcli/testrunner/generator_endpoint_test.go
+++ b/cmd/mxcli/testrunner/generator_endpoint_test.go
@@ -171,7 +171,7 @@ func TestEndpointCleanupCommands(t *testing.T) {
 			state:   projectState{afterStartup: "Mod.ASU", createdMxTest: true},
 			present: true,
 			want: []string{
-				"ALTER SETTINGS RUNTIME AfterStartupMicroflow = 'Mod.ASU'",
+				"ALTER SETTINGS RUNTIME (AfterStartupMicroflow: 'Mod.ASU')",
 				"DROP MODULE MxTest",
 			},
 		},
@@ -180,7 +180,7 @@ func TestEndpointCleanupCommands(t *testing.T) {
 			state:   projectState{createdMxTest: false},
 			present: true,
 			want: []string{
-				"ALTER SETTINGS RUNTIME AfterStartupMicroflow = ''",
+				"ALTER SETTINGS RUNTIME (AfterStartupMicroflow: '')",
 				"DROP MICROFLOW MxTest.Test_test_1",
 				"DROP MICROFLOW MxTest.Test_test_2",
 				"DROP MICROFLOW " + endpointStartupFlow,
@@ -191,7 +191,7 @@ func TestEndpointCleanupCommands(t *testing.T) {
 			name:    "drops nothing when the module never landed",
 			state:   projectState{afterStartup: "Mod.ASU", createdMxTest: true},
 			present: false,
-			want:    []string{"ALTER SETTINGS RUNTIME AfterStartupMicroflow = 'Mod.ASU'"},
+			want:    []string{"ALTER SETTINGS RUNTIME (AfterStartupMicroflow: 'Mod.ASU')"},
 		},
 	}
 
@@ -220,7 +220,7 @@ func TestEndpointCleanupRestoreIsAlwaysFirst(t *testing.T) {
 		{afterStartup: "Mod.ASU", createdMxTest: true},
 	} {
 		cmds := endpointCleanupCommands(st, suiteTestFlowNames(suite), true)
-		if !strings.HasPrefix(cmds[0], "ALTER SETTINGS RUNTIME AfterStartupMicroflow") {
+		if !strings.HasPrefix(cmds[0], "ALTER SETTINGS RUNTIME (AfterStartupMicroflow") {
 			t.Errorf("state %+v: first command is %q, want the after-startup restore", st, cmds[0])
 		}
 	}
diff --git a/cmd/mxcli/testrunner/host.go b/cmd/mxcli/testrunner/host.go
index 20b02bf531..e6ba9c5629 100644
--- a/cmd/mxcli/testrunner/host.go
+++ b/cmd/mxcli/testrunner/host.go
@@ -61,7 +61,7 @@ func InstallHostedEndpoint(projectPath string, w io.Writer) (*HostedEndpoint, er
 		h.Remove()
 		return nil, fmt.Errorf("injecting the test endpoint: %w", err)
 	}
-	if err := execMxcliCmd(projectPath, "ALTER SETTINGS RUNTIME AfterStartupMicroflow = "+quoteMDLString(endpointStartupFlow)); err != nil {
+	if err := execMxcliCmd(projectPath, "ALTER SETTINGS RUNTIME (AfterStartupMicroflow: "+quoteMDLString(endpointStartupFlow)+")"); err != nil {
 		h.Remove()
 		return nil, fmt.Errorf("pointing after-startup at the endpoint: %w", err)
 	}
diff --git a/cmd/mxcli/testrunner/runner.go b/cmd/mxcli/testrunner/runner.go
index b14a996f9b..fae3d0ea33 100644
--- a/cmd/mxcli/testrunner/runner.go
+++ b/cmd/mxcli/testrunner/runner.go
@@ -667,7 +667,7 @@ func moduleExists(projectPath, name string) (bool, error) {
 // changing projects that run at another level (mendixlabs/mxcli#802).
 func setupCommands(startupFlow string) []string {
 	return []string{
-		"ALTER SETTINGS RUNTIME AfterStartupMicroflow = " + quoteMDLString(startupFlow),
+		"ALTER SETTINGS RUNTIME (AfterStartupMicroflow: " + quoteMDLString(startupFlow) + ")",
 	}
 }
 
@@ -714,9 +714,9 @@ func execMDLScript(projectPath, mdl, namePattern string) error {
 // injection landed does not report a spurious cleanup failure.
 func cleanupCommands(st projectState, mxTestPresent bool) []string {
 	// Restore the original after-startup microflow, or clear it if there was none.
-	restore := "ALTER SETTINGS RUNTIME AfterStartupMicroflow = ''"
+	restore := "ALTER SETTINGS RUNTIME (AfterStartupMicroflow: '')"
 	if st.afterStartup != "" {
-		restore = "ALTER SETTINGS RUNTIME AfterStartupMicroflow = " + quoteMDLString(st.afterStartup)
+		restore = "ALTER SETTINGS RUNTIME (AfterStartupMicroflow: " + quoteMDLString(st.afterStartup) + ")"
 	}
 	cmds := []string{restore}
 	if !mxTestPresent {
diff --git a/cmd/mxcli/testrunner/runner_cleanup_test.go b/cmd/mxcli/testrunner/runner_cleanup_test.go
index d5f0f5e460..03f5642fa1 100644
--- a/cmd/mxcli/testrunner/runner_cleanup_test.go
+++ b/cmd/mxcli/testrunner/runner_cleanup_test.go
@@ -134,7 +134,7 @@ func TestCleanupCommands(t *testing.T) {
 			state:   projectState{afterStartup: "MyFirstModule.ASU_Startup", createdMxTest: true},
 			present: true,
 			want: []string{
-				"ALTER SETTINGS RUNTIME AfterStartupMicroflow = 'MyFirstModule.ASU_Startup'",
+				"ALTER SETTINGS RUNTIME (AfterStartupMicroflow: 'MyFirstModule.ASU_Startup')",
 				"DROP MODULE MxTest",
 			},
 		},
@@ -143,7 +143,7 @@ func TestCleanupCommands(t *testing.T) {
 			state:   projectState{createdMxTest: true},
 			present: true,
 			want: []string{
-				"ALTER SETTINGS RUNTIME AfterStartupMicroflow = ''",
+				"ALTER SETTINGS RUNTIME (AfterStartupMicroflow: '')",
 				"DROP MODULE MxTest",
 			},
 		},
@@ -154,7 +154,7 @@ func TestCleanupCommands(t *testing.T) {
 			state:   projectState{afterStartup: "Mod.Flow"},
 			present: true,
 			want: []string{
-				"ALTER SETTINGS RUNTIME AfterStartupMicroflow = 'Mod.Flow'",
+				"ALTER SETTINGS RUNTIME (AfterStartupMicroflow: 'Mod.Flow')",
 				"DROP MICROFLOW MxTest.TestRunner",
 			},
 		},
@@ -165,7 +165,7 @@ func TestCleanupCommands(t *testing.T) {
 			state:   projectState{afterStartup: "Mod.Flow", createdMxTest: true},
 			present: false,
 			want: []string{
-				"ALTER SETTINGS RUNTIME AfterStartupMicroflow = 'Mod.Flow'",
+				"ALTER SETTINGS RUNTIME (AfterStartupMicroflow: 'Mod.Flow')",
 			},
 		},
 	}
@@ -189,7 +189,7 @@ func TestCleanupCommands(t *testing.T) {
 func TestCleanupCommands_RestoreIsWellFormed(t *testing.T) {
 	parsed := parseSettingValue("  AfterStartupMicroflow = 'MyFirstModule.ASU_Startup',")
 	restore := cleanupCommands(projectState{afterStartup: parsed}, true)[0]
-	want := "ALTER SETTINGS RUNTIME AfterStartupMicroflow = 'MyFirstModule.ASU_Startup'"
+	want := "ALTER SETTINGS RUNTIME (AfterStartupMicroflow: 'MyFirstModule.ASU_Startup')"
 	if restore != want {
 		t.Errorf("restore command = %q, want %q", restore, want)
 	}
diff --git a/cmd/mxcli/testrunner/runner_endpoint.go b/cmd/mxcli/testrunner/runner_endpoint.go
index 74eb3883a6..e80204045d 100644
--- a/cmd/mxcli/testrunner/runner_endpoint.go
+++ b/cmd/mxcli/testrunner/runner_endpoint.go
@@ -211,9 +211,9 @@ func endpointReadyTimeout(suiteTimeout time.Duration) time.Duration {
 // when the module was already the user's, each generated document is named
 // explicitly so nothing of theirs is touched.
 func endpointCleanupCommands(st projectState, flows []string, mxTestPresent bool) []string {
-	restore := "ALTER SETTINGS RUNTIME AfterStartupMicroflow = ''"
+	restore := "ALTER SETTINGS RUNTIME (AfterStartupMicroflow: '')"
 	if st.afterStartup != "" {
-		restore = "ALTER SETTINGS RUNTIME AfterStartupMicroflow = " + quoteMDLString(st.afterStartup)
+		restore = "ALTER SETTINGS RUNTIME (AfterStartupMicroflow: " + quoteMDLString(st.afterStartup) + ")"
 	}
 	cmds := []string{restore}
 	if !mxTestPresent {
diff --git a/docs-site/src/appendixes/quick-reference.md b/docs-site/src/appendixes/quick-reference.md
index 9ced9a4d4a..7be500653b 100644
--- a/docs-site/src/appendixes/quick-reference.md
+++ b/docs-site/src/appendixes/quick-reference.md
@@ -83,12 +83,12 @@ CREATE CONSTANT MyModule.EnableLogging TYPE Boolean DEFAULT true;
 | List consumed odata services | `LIST CONSUMED ODATA SERVICES [IN Module];` | Consumed OData services |
 | Describe consumed odata service | `DESCRIBE CONSUMED ODATA SERVICE Module.Name;` | Full MDL output |
 | Create consumed odata service | `CREATE [OR MODIFY] CONSUMED ODATA SERVICE Module.Name (...);` | Version, MetadataUrl, Timeout, etc. |
-| Alter consumed odata service | `ALTER CONSUMED ODATA SERVICE Module.Name SET Key = Value;` | |
+| Alter consumed odata service | `ALTER CONSUMED ODATA SERVICE Module.Name SET (Key: Value, ...);` | |
 | Drop consumed odata service | `DROP CONSUMED ODATA SERVICE Module.Name;` | |
 | List published odata services | `LIST PUBLISHED ODATA SERVICES [IN Module];` | Published OData services |
 | Describe published odata service | `DESCRIBE PUBLISHED ODATA SERVICE Module.Name;` | Full MDL output |
 | Create published odata service | `CREATE [OR MODIFY] PUBLISHED ODATA SERVICE Module.Name (...) AUTHENTICATION ... { PUBLISH ENTITY ... };` | |
-| Alter published odata service | `ALTER PUBLISHED ODATA SERVICE Module.Name SET Key = Value;` | |
+| Alter published odata service | `ALTER PUBLISHED ODATA SERVICE Module.Name SET (Key: Value, ...);` | |
 | Drop published odata service | `DROP PUBLISHED ODATA SERVICE Module.Name;` | |
 | List external entities | `LIST EXTERNAL ENTITIES [IN Module];` | OData-backed entities |
 | List external actions | `LIST EXTERNAL ACTIONS [IN Module];` | Actions used in microflows |
@@ -300,11 +300,11 @@ CREATE OR REPLACE NAVIGATION Responsive
 |-----------|--------|-------|
 | List settings | `LIST SETTINGS;` | Overview of all settings parts |
 | Describe settings | `DESCRIBE SETTINGS;` | Full MDL output (round-trippable) |
-| Alter model settings | `ALTER SETTINGS RUNTIME Key = Value;` | AfterStartupMicroflow, HashAlgorithm, JavaVersion, etc. |
-| Alter configuration | `ALTER SETTINGS CONFIGURATION 'Name' Key = Value;` | DatabaseType, DatabaseUrl, HttpPortNumber, etc. |
+| Alter model settings | `ALTER SETTINGS RUNTIME (Key: Value, ...);` | AfterStartupMicroflow, HashAlgorithm, JavaVersion, etc. |
+| Alter configuration | `ALTER SETTINGS CONFIGURATION 'Name' (Key: Value, ...);` | DatabaseType, DatabaseUrl, HttpPortNumber, etc. |
 | Alter constant | `ALTER SETTINGS CONSTANT 'Name' VALUE 'val' IN CONFIGURATION 'cfg';` | Override constant per configuration |
-| Alter language | `ALTER SETTINGS LANGUAGE Key = Value;` | DefaultLanguageCode |
-| Alter workflows | `ALTER SETTINGS WORKFLOWS Key = Value;` | UserEntity, DefaultTaskParallelism |
+| Alter language | `ALTER SETTINGS LANGUAGE (Key: Value);` | DefaultLanguageCode |
+| Alter workflows | `ALTER SETTINGS WORKFLOWS (Key: Value, ...);` | UserEntity, DefaultTaskParallelism |
 
 ## Business Events
 
@@ -421,15 +421,15 @@ Modify an existing page or snippet's widget tree in-place without full `CREATE O
 
 | Operation | Syntax | Notes |
 |-----------|--------|-------|
-| Set property | `SET Caption = 'New' ON widgetName` | Single property on a widget |
+| Set property | `SET (Caption: 'New') ON widgetName` | Single property on a widget |
 | Set multiple | `SET (Caption = 'Save', ButtonStyle = Success) ON btn` | Multiple properties at once |
-| Page-level set | `SET Title = 'New Title'` | No ON clause for page properties |
+| Page-level set | `SET (Title: 'New Title')` | No ON clause for page properties |
 | Insert after | `INSERT AFTER widgetName { widgets }` | Add widgets after target |
 | Insert before | `INSERT BEFORE widgetName { widgets }` | Add widgets before target |
 | Insert into | `INSERT INTO containerName { widgets }` | Append as the container's last child (fills an empty container) |
-| Drop widgets | `DROP WIDGET name1, name2` | Remove widgets by name |
+| Drop widgets | `DROP name1, name2` | Remove widgets by name |
 | Replace widget | `REPLACE widgetName WITH { widgets }` | Replace widget subtree |
-| Pluggable prop | `SET 'showLabel' = false ON cbStatus` | Quoted name for pluggable widgets |
+| Pluggable prop | `SET ('showLabel': false) ON cbStatus` | Quoted name for pluggable widgets |
 | Add variable | `ADD Variables $name: Type = 'expr'` | Add a page variable |
 | Drop variable | `DROP Variables $name` | Remove a page variable |
 
@@ -438,15 +438,15 @@ Modify an existing page or snippet's widget tree in-place without full `CREATE O
 **Example:**
 ```sql
 ALTER PAGE Module.EditPage {
-  SET (Caption = 'Save & Close', ButtonStyle = Success) ON btnSave;
-  DROP WIDGET txtUnused;
+  SET (Caption: 'Save & Close', ButtonStyle: Success) ON btnSave;
+  DROP txtUnused;
   INSERT AFTER txtEmail {
     TEXTBOX txtPhone (Label: 'Phone', Attribute: Phone)
   }
 };
 
 ALTER SNIPPET Module.NavMenu {
-  SET Caption = 'Dashboard' ON btnHome
+  SET (Caption: 'Dashboard') ON btnHome
 };
 ```
 
diff --git a/docs-site/src/examples/alter-page.md b/docs-site/src/examples/alter-page.md
index 2afd6c931d..4cb0f50b67 100644
--- a/docs-site/src/examples/alter-page.md
+++ b/docs-site/src/examples/alter-page.md
@@ -6,7 +6,7 @@
 
 ```sql
 ALTER PAGE CRM.Customer_Edit {
-  SET (Caption = 'Save & Close', ButtonStyle = Success) ON btnSave
+  SET (Caption: 'Save & Close', ButtonStyle: Success) ON btnSave
 };
 ```
 
@@ -36,7 +36,7 @@ ALTER PAGE CRM.Customer_Overview {
 
 ```sql
 ALTER PAGE CRM.Customer_Edit {
-  DROP WIDGET txtLegacyField, lblOldNote
+  DROP txtLegacyField, lblOldNote
 };
 ```
 
@@ -58,12 +58,12 @@ ALTER PAGE CRM.Customer_Edit {
 
 ```sql
 ALTER PAGE CRM.Customer_Edit {
-  SET Title = 'Edit Customer Details';
-  SET Label = 'Email Address' ON txtEmail;
+  SET (Title: 'Edit Customer Details');
+  SET (Label: 'Email Address') ON txtEmail;
   INSERT AFTER txtPhone {
     TEXTBOX txtWebsite (Label: 'Website', Attribute: Website)
   };
-  DROP WIDGET lblInternalRef
+  DROP lblInternalRef
 };
 ```
 
@@ -108,12 +108,12 @@ ALTER PAGE CRM.Customer_List {
 
 -- Remove a column
 ALTER PAGE CRM.Customer_List {
-  DROP WIDGET dgCustomers.OldNotes
+  DROP dgCustomers.OldNotes
 };
 
 -- Rename a column header
 ALTER PAGE CRM.Customer_List {
-  SET Caption = 'E-mail Address' ON dgCustomers.Email
+  SET (Caption: 'E-mail Address') ON dgCustomers.Email
 };
 ```
 
@@ -123,7 +123,7 @@ Use `DESCRIBE PAGE CRM.Customer_List` to discover column names.
 
 ```sql
 ALTER SNIPPET CRM.NavigationMenu {
-  SET Caption = 'Dashboard' ON btnHome;
+  SET (Caption: 'Dashboard') ON btnHome;
   INSERT AFTER btnHome {
     ACTIONBUTTON btnReports (
       Caption: 'Reports',
diff --git a/docs-site/src/language/alter-entity.md b/docs-site/src/language/alter-entity.md
index e554339c0b..f436111636 100644
--- a/docs-site/src/language/alter-entity.md
+++ b/docs-site/src/language/alter-entity.md
@@ -49,10 +49,10 @@ a clause written where the type belongs is read *as* the type:
 
 ```mdl
 -- WRONG: `SET` is read as the type name, not as a keyword
-ALTER ENTITY Sales.Customer MODIFY ATTRIBUTE Discount SET DEFAULT 0;
+ALTER ENTITY Sales.Customer MODIFY ATTRIBUTE Discount: SET DEFAULT 0;
 
 -- Right: restate the type
-ALTER ENTITY Sales.Customer MODIFY ATTRIBUTE Discount Decimal DEFAULT 0;
+ALTER ENTITY Sales.Customer MODIFY ATTRIBUTE Discount: Decimal DEFAULT 0;
 ```
 
 mxcli refuses the first form and names the alternatives. Before it did, that
diff --git a/docs-site/src/language/project-settings.md b/docs-site/src/language/project-settings.md
index 661230d847..41a3ae27d1 100644
--- a/docs-site/src/language/project-settings.md
+++ b/docs-site/src/language/project-settings.md
@@ -27,9 +27,9 @@ ALTER SETTINGS RUNTIME <Key> = <Value>;
 Examples:
 
 ```sql
-ALTER SETTINGS RUNTIME AfterStartupMicroflow = 'MyModule.ACT_Startup';
-ALTER SETTINGS RUNTIME HashAlgorithm = 'BCrypt';
-ALTER SETTINGS RUNTIME JavaVersion = '17';
+ALTER SETTINGS RUNTIME ( AfterStartupMicroflow: 'MyModule.ACT_Startup' );
+ALTER SETTINGS RUNTIME ( HashAlgorithm: 'BCrypt' );
+ALTER SETTINGS RUNTIME ( JavaVersion: '17' );
 ```
 
 Mendix renamed the Java version property between versions — up to 11.6 it is stored
@@ -48,9 +48,9 @@ ALTER SETTINGS CONFIGURATION '<Name>' <Key> = <Value>;
 Examples:
 
 ```sql
-ALTER SETTINGS CONFIGURATION 'default' DatabaseType = 'POSTGRESQL';
-ALTER SETTINGS CONFIGURATION 'default' DatabaseUrl = 'jdbc:postgresql://localhost:5432/myapp';
-ALTER SETTINGS CONFIGURATION 'default' HttpPortNumber = '8080';
+ALTER SETTINGS CONFIGURATION 'default' ( DatabaseType: 'POSTGRESQL' );
+ALTER SETTINGS CONFIGURATION 'default' ( DatabaseUrl: 'jdbc:postgresql://localhost:5432/myapp' );
+ALTER SETTINGS CONFIGURATION 'default' ( HttpPortNumber: '8080' );
 ```
 
 ### Constant Overrides
@@ -92,7 +92,7 @@ ALTER SETTINGS LANGUAGE ADD 'ar_SD' (CheckCompleteness: true, CustomDateFormat:
 ALTER SETTINGS LANGUAGE MODIFY 'de_DE' (CheckCompleteness: true);
 
 -- make it the default (it must already be enabled)
-ALTER SETTINGS LANGUAGE DefaultLanguageCode = 'de_DE';
+ALTER SETTINGS LANGUAGE ( DefaultLanguageCode: 'de_DE' );
 
 -- disable it
 ALTER SETTINGS LANGUAGE REMOVE 'de_DE';
@@ -131,13 +131,13 @@ So the order of these two statements changes the result:
 ```sql
 -- right: the page's texts are stored as nl_NL
 ALTER SETTINGS LANGUAGE ADD 'nl_NL';
-ALTER SETTINGS LANGUAGE DefaultLanguageCode = 'nl_NL';
+ALTER SETTINGS LANGUAGE ( DefaultLanguageCode: 'nl_NL' );
 CREATE PAGE MyModule.Opslaan ( Title: 'Opslaanpagina', ... ) { ... }
 
 -- wrong: the page is authored while en_US is still the default, so its texts
 -- are stored as en_US and stay there
 CREATE PAGE MyModule.Opslaan ( Title: 'Opslaanpagina', ... ) { ... }
-ALTER SETTINGS LANGUAGE DefaultLanguageCode = 'nl_NL';
+ALTER SETTINGS LANGUAGE ( DefaultLanguageCode: 'nl_NL' );
 ```
 
 Changing `DefaultLanguageCode` **does not move text that already exists** — it
@@ -173,8 +173,8 @@ ALTER SETTINGS WORKFLOWS <Key> = <Value>;
 Examples:
 
 ```sql
-ALTER SETTINGS WORKFLOWS UserEntity = 'Administration.Account';
-ALTER SETTINGS WORKFLOWS DefaultTaskParallelism = '5';
+ALTER SETTINGS WORKFLOWS ( UserEntity: 'Administration.Account' );
+ALTER SETTINGS WORKFLOWS ( DefaultTaskParallelism: '5' );
 ```
 
 ## See Also
diff --git a/docs-site/src/language/snippets.md b/docs-site/src/language/snippets.md
index 8469362269..ffcf71ce16 100644
--- a/docs-site/src/language/snippets.md
+++ b/docs-site/src/language/snippets.md
@@ -94,7 +94,7 @@ Snippets support the same in-place modification operations as pages. See [ALTER
 
 ```sql
 ALTER SNIPPET MyModule.CustomerCard {
-  SET Caption = 'View Details' ON btnEdit;
+  SET (Caption: 'View Details') ON btnEdit;
   INSERT AFTER txtEmail {
     DYNAMICTEXT txtPhone (Content: '{1}', Attribute: Phone)
   };
diff --git a/docs-site/src/reference/page/alter-layout.md b/docs-site/src/reference/page/alter-layout.md
index 6bb19eef02..f3419800f7 100644
--- a/docs-site/src/reference/page/alter-layout.md
+++ b/docs-site/src/reference/page/alter-layout.md
@@ -23,10 +23,10 @@ INSERT BEFORE widgetName { widget_definitions };
 INSERT AFTER widgetName { widget_definitions };
 
 -- Set a property on a widget
-SET property = value ON widgetName;
+SET (property: value) ON widgetName;
 
 -- Remove widgets
-DROP WIDGET widgetName1, widgetName2;
+DROP widgetName1, widgetName2;
 
 -- Replace a widget with new widgets
 REPLACE widgetName WITH { widget_definitions };
@@ -114,11 +114,11 @@ Change it, then remove it:
 
 ```sql
 ALTER LAYOUT MyModule.App_Default {
-    SET Content = 'Renamed' ON brand;
+    SET (Content: 'Renamed') ON brand;
 };
 
 ALTER LAYOUT MyModule.App_Default {
-    DROP WIDGET brand;
+    DROP brand;
 };
 ```
 
diff --git a/docs-site/src/reference/settings/alter-settings.md b/docs-site/src/reference/settings/alter-settings.md
index c8593588b5..bd5957e1b3 100644
--- a/docs-site/src/reference/settings/alter-settings.md
+++ b/docs-site/src/reference/settings/alter-settings.md
@@ -2,31 +2,31 @@
 
 ## Synopsis
 
-    ALTER SETTINGS RUNTIME key = value
+    ALTER SETTINGS RUNTIME ( key: value, ... )
 
-    ALTER SETTINGS CONFIGURATION 'name' key = value
+    ALTER SETTINGS CONFIGURATION 'name' ( key: value, ... )
 
     ALTER SETTINGS CONSTANT 'name' VALUE 'value' IN CONFIGURATION 'config'
 
     ALTER SETTINGS DROP CONSTANT 'name' IN CONFIGURATION 'config'
 
-    CREATE CONFIGURATION 'name' [key = value, ...]
+    CREATE CONFIGURATION 'name' [( key: value, ... )]
 
     DROP CONFIGURATION 'name'
 
-    ALTER SETTINGS LANGUAGE key = value
+    ALTER SETTINGS LANGUAGE ( key: value, ... )
     ALTER SETTINGS LANGUAGE ADD [OR MODIFY] 'code' [( option: value, ... )]
     ALTER SETTINGS LANGUAGE MODIFY 'code' ( option: value, ... )
     ALTER SETTINGS LANGUAGE REMOVE 'code' 
 
-    ALTER SETTINGS WORKFLOWS key = value
+    ALTER SETTINGS WORKFLOWS ( key: value, ... )
     ALTER SETTINGS WORKFLOWS ADD [OR MODIFY] GROUP 'name' [( Description: 'text' )]
     ALTER SETTINGS WORKFLOWS MODIFY GROUP 'name' ( Description: 'text' )
     ALTER SETTINGS WORKFLOWS REMOVE GROUP 'name'
 
 ## Description
 
-Modifies project settings by category. Each category has its own syntax and available keys.
+Modifies project settings by category. Each category has its own syntax and available keys. Properties are written `Key: value` in a parenthesised list, as in every other MDL statement; the older `key = value, ...` without parentheses still runs and warns `MDL-DEPR060`, and `mxcli fmt --upgrade` rewrites it.
 
 **MODEL** settings control application-level behavior such as the after-startup microflow, hashing algorithm, and Java version.
 
@@ -61,7 +61,7 @@ task's group targeting selects from. Groups need Mendix **11.2** or later.
 ### Set the after-startup microflow
 
 ```sql
-ALTER SETTINGS RUNTIME AfterStartupMicroflow = 'MyModule.ACT_Startup';
+ALTER SETTINGS RUNTIME ( AfterStartupMicroflow: 'MyModule.ACT_Startup' );
 ```
 
 > **The after-startup microflow must return `Boolean`.** Mendix build fails with **CE0142**
@@ -71,13 +71,13 @@ ALTER SETTINGS RUNTIME AfterStartupMicroflow = 'MyModule.ACT_Startup';
 ### Configure database type
 
 ```sql
-ALTER SETTINGS CONFIGURATION 'default' DatabaseType = 'POSTGRESQL';
+ALTER SETTINGS CONFIGURATION 'default' ( DatabaseType: 'POSTGRESQL' );
 ```
 
 ### Set database URL for a configuration
 
 ```sql
-ALTER SETTINGS CONFIGURATION 'production' DatabaseUrl = 'jdbc:postgresql://dbhost:5432/myapp';
+ALTER SETTINGS CONFIGURATION 'production' ( DatabaseUrl: 'jdbc:postgresql://dbhost:5432/myapp' );
 ```
 
 ### Override a constant in a configuration
@@ -104,7 +104,7 @@ The code must already be enabled; `ALTER SETTINGS LANGUAGE DefaultLanguageCode`
 is validated against the enabled list.
 
 ```sql
-ALTER SETTINGS LANGUAGE DefaultLanguageCode = 'en_US';
+ALTER SETTINGS LANGUAGE ( DefaultLanguageCode: 'en_US' );
 ```
 
 ### Enable, change and disable a language
@@ -132,7 +132,7 @@ the run reports how many source strings are affected.
 ### Configure workflow user entity
 
 ```sql
-ALTER SETTINGS WORKFLOWS UserEntity = 'Administration.Account';
+ALTER SETTINGS WORKFLOWS ( UserEntity: 'Administration.Account' );
 ```
 
 ### Manage workflow groups
@@ -170,7 +170,7 @@ List the groups with [`SHOW WORKFLOW GROUPS`](show-settings.md).
 ### Set Java version
 
 ```sql
-ALTER SETTINGS RUNTIME JavaVersion = '17';
+ALTER SETTINGS RUNTIME ( JavaVersion: '17' );
 ```
 
 ### Remove a constant override from a configuration
@@ -182,10 +182,11 @@ ALTER SETTINGS DROP CONSTANT 'MyModule.ApiBaseUrl' IN CONFIGURATION 'staging';
 ### Create a new configuration
 
 ```sql
-CREATE CONFIGURATION 'Staging'
-  DatabaseType = 'PostgreSql',
-  DatabaseUrl = 'staging-db:5432',
-  HttpPortNumber = 8080;
+CREATE CONFIGURATION 'Staging' (
+  DatabaseType: 'PostgreSql',
+  DatabaseUrl: 'staging-db:5432',
+  HttpPortNumber: 8080
+);
 ```
 
 `DatabaseType` must name a Mendix database type — `Db2`, `Hsqldb`, `MySql`,
diff --git a/docs-site/src/tools/docker-run.md b/docs-site/src/tools/docker-run.md
index d0cd7a9dd2..ff621ddd51 100644
--- a/docs-site/src/tools/docker-run.md
+++ b/docs-site/src/tools/docker-run.md
@@ -28,8 +28,8 @@ The runtime uses configuration from the project's settings. You can view and mod
 ```sql
 SHOW SETTINGS;
 DESCRIBE SETTINGS;
-ALTER SETTINGS CONFIGURATION 'default' DatabaseType = 'POSTGRESQL';
-ALTER SETTINGS CONFIGURATION 'default' HttpPortNumber = '8080';
+ALTER SETTINGS CONFIGURATION 'default' ( DatabaseType: 'POSTGRESQL' );
+ALTER SETTINGS CONFIGURATION 'default' ( HttpPortNumber: '8080' );
 ```
 
 ## Checking Project Health
diff --git a/docs/01-project/MDL_QUICK_REFERENCE.md b/docs/01-project/MDL_QUICK_REFERENCE.md
index fad6388442..c039e9a29b 100644
--- a/docs/01-project/MDL_QUICK_REFERENCE.md
+++ b/docs/01-project/MDL_QUICK_REFERENCE.md
@@ -102,7 +102,7 @@ Modifies an existing entity without full replacement.
 |-----------|--------|-------|
 | Add attribute | `alter entity Module.Name add attribute [if not exists] attr: type [constraints];` | Comma-separate the whole action to add several: `add attribute A: integer, add attribute B: string(20)`. `if not exists` skips instead of erroring, so the script re-runs |
 | Drop attribute | `alter entity Module.Name drop attribute [if exists] AttrName;` | `if exists` skips when it is already gone |
-| Modify attributes | `alter entity Module.Name modify (attr: NewType [constraints]);` | Change type/constraints |
+| Modify attribute | `alter entity Module.Name modify attribute Attr: NewType [constraints];` | Change type/constraints. Always `Name: Type`; without the colon warns MDL-DEPR065 |
 | Rename attribute | `alter entity Module.Name rename attribute OldName to NewName;` | Also rewrites stored references (microflow members, page widgets, validation/access rules) and XPath constraints. Microflow expressions are free text and are **not** rewritten |
 | Add index | `alter entity Module.Name add index [if not exists] [name] [on] (Col1 [asc\|desc], ...);` | `on` is optional (SQL-like). **Without `if not exists`, re-running is an error** — a second identical index fails the build with CE0072 |
 | Document an association | `/** What it links. */`<br>`create association Mod.C_P from Mod.C to Mod.P;`<br>or `... to Mod.P comment 'What it links.';` | Both spellings work on create; the doc comment wins when both are present. `comment` survives here — and only here among the CREATE statements — because it is an association's **only inline** spelling |
@@ -256,7 +256,7 @@ expression specified".
 
 ```sql
 create entity Shop.Product ( Email: String(200) not null error message 'Required' );
-alter entity Shop.Product modify attribute Code String(20) unique error message 'Unique';
+alter entity Shop.Product modify attribute Code: String(20) unique error message 'Unique';
 ```
 
 A range bounded by another *attribute* cannot be authored in MDL, but survives a
@@ -337,18 +337,19 @@ create scheduled event Ops.WeeklyReport (
 | Show consumed odata services | `show consumed odata services [in module];` | Consumed OData services |
 | Describe consumed odata service | `describe consumed odata service Module.Name;` | Full MDL output |
 | Create consumed odata service | `create [or modify] consumed odata service Module.Name (...);` | Version, MetadataUrl, Timeout, etc. |
-| Alter consumed odata service | `alter consumed odata service Module.Name set key = value;` | |
+| Alter consumed odata service | `alter consumed odata service Module.Name set (Key: value, ...);` | |
 | Drop consumed odata service | `drop consumed odata service [if exists] Module.Name;` | |
 | Show published odata services | `show published odata services [in module];` | Published OData services |
 | Describe published odata service | `describe published odata service Module.Name;` | Full MDL output |
 | Create published odata service | `create [or modify] published odata service Module.Name (...) authentication ... { publish entity ... };` | |
 | Publish as GraphQL too | `create published odata service Module.Name (SupportsGraphQL: Yes) {...};` | Mendix 10.14+. Same location, clients POST a query. Exposed names must be unique beyond case (CE2881); query fields are camelCased |
-| Alter published odata service | `alter published odata service Module.Name set key = value;` | |
+| Alter published odata service | `alter published odata service Module.Name set (Key: value, ...);` | |
 | Drop published odata service | `drop published odata service [if exists] Module.Name;` | |
 | Show external entities | `show external entities [in module];` | OData-backed entities |
 | Show external actions | `show external actions [in module];` | Actions used in microflows |
 | Create external entity | `create [or modify] external entity Module.Name from consumed odata service Module.Client (...) (attrs);` | |
 | Create external entities | `create [or modify] external entities from Module.Client [into module] [entities (...)];` | Bulk from $metadata |
+| Allow local create/change | `alter entity Module.Name set (AllowCreateChangeLocally: true);` | `create external entity`'s key. `set allow_create_change_locally = true` warns MDL-DEPR063 |
 | Grant OData access | `grant access on published odata service Module.Name to Module.Role, ...;` | |
 | Revoke OData access | `revoke access on published odata service Module.Name from Module.Role, ...;` | |
 | Show contract entities | `show contract entities from Module.Client;` | Browse cached $metadata |
@@ -973,19 +974,19 @@ still flagged rather than guessed at.
 |-----------|--------|-------|
 | Show settings | `show settings;` | Overview of all settings parts |
 | Describe settings | `describe settings;` | Full MDL output (round-trippable) |
-| Alter model settings | `alter settings runtime key = value;` | AfterStartupMicroflow, HashAlgorithm, JavaVersion, etc. |
-| Alter configuration | `alter settings configuration 'Name' key = value;` | DatabaseType, DatabaseUrl, HttpPortNumber, etc. |
+| Alter model settings | `alter settings runtime (Key: value, ...);` | AfterStartupMicroflow, HashAlgorithm, JavaVersion, etc. |
+| Alter configuration | `alter settings configuration 'Name' (Key: value, ...);` | DatabaseType, DatabaseUrl, HttpPortNumber, etc. |
 | Alter constant | `alter settings constant 'Name' value 'val' in configuration 'cfg';` | Override constant per configuration |
 | Drop constant override | `alter settings drop constant 'Name' in configuration 'cfg';` | Reset to default value |
 | Create or modify configuration | `create or modify configuration 'Name' [key = value, ...];` | Upsert — what `describe settings` emits, so a described project replays onto a target that already has `Default` |
 | Create configuration | `create configuration 'Name' [key = value, ...];` | New server configuration. `DatabaseType` must be `Db2`, `Hsqldb`, `MySql`, `Oracle`, `PostgreSql`, `SapHana` or `SqlServer` (case-insensitive) |
 | Drop configuration | `drop configuration [if exists] 'Name';` | Remove a configuration |
-| Alter language | `alter settings LANGUAGE key = value;` | DefaultLanguageCode (must already be enabled). Set it **before** creating pages — it decides what language their captions are stored in |
+| Alter language | `alter settings LANGUAGE (Key: value);` | DefaultLanguageCode (must already be enabled). Set it **before** creating pages — it decides what language their captions are stored in |
 | Enable a language | `alter settings LANGUAGE add 'de_DE' [(CheckCompleteness: true, CustomDateFormat: 'yyyy-MM-dd')];` | Adds to the enabled list — the only languages a build emits translations for. A language is identified by its code; Studio Pro's "German, Germany" is derived for display and not stored |
 | Enable or modify (upsert) | `alter settings LANGUAGE add or modify 'de_DE' (CheckCompleteness: true);` | What `describe settings` emits, so a described project replays onto itself or onto one that already has the language |
 | Modify a language | `alter settings LANGUAGE modify 'de_DE' (CheckCompleteness: true);` | Changes only the options it names. `CheckCompleteness` turns on error reporting for texts with no translation in that language (the default language is always checked regardless) |
 | Disable a language | `alter settings LANGUAGE remove 'de_DE';` | The **default** language is refused (every missing translation falls back on it). Translations are NOT deleted — they stay in the model and stop being built; the run reports how many |
-| Alter workflows | `alter settings workflows key = value;` | UserEntity, DefaultTaskParallelism, WorkflowEngineParallelism |
+| Alter workflows | `alter settings workflows (Key: value, ...);` | UserEntity, DefaultTaskParallelism, WorkflowEngineParallelism |
 | Add a workflow group | `alter settings workflows add group 'Approvers' [(Description: 'Primary approval group')];` | The buckets under App Settings > Workflows > Groups that a user task's group targeting selects from. Mendix **11.2+**. `Description` is the only option — a `Settings$WorkflowGroup` stores Name and Description and nothing else, so the **name is the identity** and a second group differing only in case is refused |
 | Add or modify (upsert) | `alter settings workflows add or modify group 'Approvers' (Description: '...');` | What `describe settings` emits, so a described project replays onto itself |
 | Modify a workflow group | `alter settings workflows modify group 'Approvers' (Description: '...');` | Changes only the options it names, and keeps the group's element id — which is the **runtime's identity** for it (Mendix materialises one `System.WorkflowGroup` row per entry, keyed on that id), so an edit updates the row instead of replacing it |
@@ -1490,6 +1491,7 @@ MDL uses explicit property declarations for pages:
 | Declare a placeholder | `placeholder Main` | **No body.** Exactly one must be named `Main` — mxbuild enforces it (**CE0848**/**CE0849**), and names must be unique (**CE0495**). `placeholder X { … }` is the page-side form and declares nothing (MDL083) |
 | Alter layout | `alter layout Module.Name { <alter-page operations> };` | Edits the stored document, so widgets MDL cannot spell survive. Refused for a Marketplace target |
 | Set a design property | `alter page Module.Page { set ('Row size': 'Small') on lvOrders; };` | An Atlas design property of that widget's **type** — quoted, case-sensitive; `show design properties for <type>` lists them. `on`/`off` for a toggle, where `off` removes the entry. Same document `alter styling` writes. A **multi-select** (`Hide on`) or **compound** (`Spacing`) property needs the inline `DesignProperties: [...]` form, since a `set` assignment carries one value |
+| Restyle one widget | `alter styling on page Module.Page widget w set (Class: 'card', 'Full width': on);` | `set Class = …, 'P' = on` (no parentheses, `=`) warns MDL-DEPR062 |
 | Repoint one page | `alter page Module.Page { set Layout = Module.Layout [map (Old as New, …)]; };` | Rewrites the layout reference **and** every placeholder binding |
 | Set a design property on every widget of a type | `alter pages [in <module>] set 'Compact' = on, 'Striped' = on where widgettype = datagrid [dry run];` | The house-style sweep. `widgettype` takes the **MDL keyword**, which resolves to exactly one widget id — a `like '%datagrid%'` predicate also matches the data grid's *filter* widgets. Never a widget **name**: a name is unique only within its page. `dry run` previews against a discardable copy. A sweep that matches widgets and writes none of them exits non-zero |
 | Repoint many pages | `alter pages [in <module>] set layout = Module.Layout [map (…)] [where layout = Module.Old];` | The migration form. Marketplace pages are skipped and named. A `where layout` that names no real layout is an error, not a 0-page success |
@@ -1816,7 +1818,7 @@ Bulk translation of every user-visible string, one file per language. Entries us
 | Replace | `create or replace translations ...` | The file is authoritative: a translation whose source it does not name is **REMOVED**, and the run says which. `in Module` **bounds** the deletion |
 | Remove a language's translations | `create or replace translations [in Module] for <lang> ( );` | An empty file is authoritative over nothing, so everything in scope goes — the only way to take a language's translations out of the model |
 | Show languages | `show languages;` | ⚠️ languages that **have translations**, not enabled ones — a stock app reports 8 while 1 is enabled. The enabled list is in `describe settings`. Needs `refresh catalog full` |
-| Default language | `alter settings LANGUAGE DefaultLanguageCode = 'en_US';` | The language a translation file's left column is written in — **and the language a new `Caption:`/`Title:` is stored under**, so set it before authoring content. Changing it later does not move existing text and nothing warns |
+| Default language | `alter settings LANGUAGE (DefaultLanguageCode: 'en_US');` | The language a translation file's left column is written in — **and the language a new `Caption:`/`Title:` is stored under**, so set it before authoring content. Changing it later does not move existing text and nothing warns |
 
 **A translation for a language the project has not enabled is discarded at build
 time** — it is stored in the model, passes `mx check`, and produces no
diff --git a/mdl/ast/ast_alter_page.go b/mdl/ast/ast_alter_page.go
index 602a06abd7..3656f62fdf 100644
--- a/mdl/ast/ast_alter_page.go
+++ b/mdl/ast/ast_alter_page.go
@@ -81,21 +81,6 @@ func (r WidgetRef) Name() string {
 	return s
 }
 
-// Spellings of the generic ALTER that are aliases of its canonical form
-// (ADR-0011: an old form warns, and is rewritten mechanically). The visitor
-// records which one a statement used; the executor maps it to a deprecation
-// code. Nothing downstream of the validator may branch on these: both spellings
-// build the identical operation.
-const (
-	// `set Key = value …` / `set (Key = value, …) …` — R3 puts `:` between a
-	// property and its value; `=` is comparison.
-	AlterAliasSetEquals = "set-equals"
-	// `set Key: value …` — properties are a parenthesised list (R2), even one.
-	AlterAliasSetUnparenthesised = "set-unparenthesised"
-	// `drop widget a, b` — the target names the element; the kind is its own.
-	AlterAliasDropWidget = "drop-widget"
-)
-
 // IsColumn returns true if this addresses a member of a widget: a grid column
 // (`dg.Name` or `dg column(Name)`) or a scroll-container region.
 func (r WidgetRef) IsColumn() bool {
@@ -107,7 +92,6 @@ func (r WidgetRef) IsColumn() bool {
 type SetPropertyOp struct {
 	Target     WidgetRef              // empty Widget for page-level SET
 	Properties map[string]interface{} // property name -> value
-	Legacy     string                 // AlterAlias* when an old spelling was used, else ""
 }
 
 func (s *SetPropertyOp) isAlterPageOperation() {}
@@ -124,7 +108,6 @@ func (s *InsertWidgetOp) isAlterPageOperation() {}
 // DropWidgetOp represents: DROP WIDGET ref1, ref2, ...
 type DropWidgetOp struct {
 	Targets []WidgetRef
-	Legacy  string // AlterAliasDropWidget when written `drop widget …`, else ""
 }
 
 func (s *DropWidgetOp) isAlterPageOperation() {}
diff --git a/mdl/deprecation/deprecation.go b/mdl/deprecation/deprecation.go
index 36f7f253e2..e19836106c 100644
--- a/mdl/deprecation/deprecation.go
+++ b/mdl/deprecation/deprecation.go
@@ -157,6 +157,40 @@ const (
 	// on a text template: the placeholders bound by position (R4,
 	// ako/mxcli#751).
 	PositionalTemplateArguments = "MDL-DEPR009"
+
+	// Codes 060-069 and 101-103 are R3's (ako/mxcli#751,
+	// PROPOSAL_mdl_beta_syntax_freeze.md §3 R3): `:` sets a model property, so
+	// an `alter` sets properties in create's `( Key: value, … )` list, and a
+	// colon is written where a property list or an attribute definition has
+	// one and nowhere else.
+
+	// AlterPageSetEquals is the generic alter's `set Key = value` /
+	// `set (Key = value, …)`. Numbered from 101 because it shipped with the
+	// generic alter (ako/mxcli#712) before the registry existed; the code is
+	// published, so it is kept.
+	AlterPageSetEquals = "MDL-DEPR101"
+	// AlterPageSetUnparenthesised is `set Key: value` without the list's
+	// parentheses.
+	AlterPageSetUnparenthesised = "MDL-DEPR102"
+	// AlterPageDropWidget is `drop widget a, b`.
+	AlterPageDropWidget = "MDL-DEPR103"
+	// SettingsAssignment is a settings property written `Key = value`, outside
+	// a list: `alter settings <section>`, `alter settings configuration` and
+	// `create configuration`.
+	SettingsAssignment = "MDL-DEPR060"
+	// ODataAlterAssignment is `alter … odata service X set Key = value, …`.
+	ODataAlterAssignment = "MDL-DEPR061"
+	// StylingAssignment is `alter styling … set Class = 'x', 'Prop' = on`.
+	StylingAssignment = "MDL-DEPR062"
+	// AllowCreateChangeLocally is `alter entity … set allow_create_change_locally
+	// = true`, the only snake-case `=` alter action.
+	AllowCreateChangeLocally = "MDL-DEPR063"
+	// AssociationClauseColon is `type: Reference` (also `owner:`, `storage:`)
+	// on an association: a clause, which takes no colon.
+	AssociationClauseColon = "MDL-DEPR064"
+	// ModifyAttributeColon is `modify attribute A T`: an attribute definition
+	// is always `Name: Type`.
+	ModifyAttributeColon = "MDL-DEPR065"
 )
 
 // entries is the registry. Append only: a code is never reused or renumbered,
@@ -283,8 +317,8 @@ var entries = []Entry{
 		Rewrite:          Rewrite{Structural: "section name: `model` becomes `runtime`"},
 		RemovedIn:        2,
 		Note:             "`runtime` is the App Settings tab that holds these values in Studio Pro (R10); `model` also collided with the agent-editor document type.",
-		Example:          "alter settings model AfterStartupMicroflow = 'M.Startup';",
-		CanonicalExample: "alter settings runtime AfterStartupMicroflow = 'M.Startup';",
+		Example:          "alter settings model ( AfterStartupMicroflow: 'M.Startup' );",
+		CanonicalExample: "alter settings runtime ( AfterStartupMicroflow: 'M.Startup' );",
 	},
 	{
 		Code:      ReversedEntityGrant,
@@ -374,6 +408,105 @@ var entries = []Entry{
 
 func init() {
 	entries = append(entries, r8Entries...)
+	entries = append(entries, r3Entries...)
+}
+
+// r3Entries are R3's spellings (ako/mxcli#751): `:` sets a model property. An
+// `alter` takes exactly create's `( Key: value, … )` list, so a fragment of
+// describe output pastes into an alter unchanged.
+var r3Entries = []Entry{
+	{
+		Code:      AlterPageSetEquals,
+		Old:       "set Key = value [on target]  /  set (Key = value, …) [on target]",
+		Canonical: "set (Key: value, …) [on target]",
+		Rewrite:   Rewrite{Structural: "each `=` as `:`, and the assignments in parentheses when they are not"},
+		RemovedIn: 2,
+		Note: "In `alter page`, `alter snippet` and `alter layout`. `set layout = M.L` is a separate form " +
+			"and is not reported.",
+		Example:          "alter page M.P { set Caption = 'Save' on btnSave; };",
+		CanonicalExample: "alter page M.P { set (Caption: 'Save') on btnSave; };",
+	},
+	{
+		Code:             AlterPageSetUnparenthesised,
+		Old:              "set Key: value [on target]",
+		Canonical:        "set (Key: value) [on target]",
+		Rewrite:          Rewrite{Structural: "assignment in parentheses"},
+		RemovedIn:        2,
+		Note:             "Properties are a parenthesised list, even when there is one.",
+		Example:          "alter page M.P { set Caption: 'Save' on btnSave; };",
+		CanonicalExample: "alter page M.P { set (Caption: 'Save') on btnSave; };",
+	},
+	{
+		Code:             AlterPageDropWidget,
+		Old:              "drop widget a, b",
+		Canonical:        "drop a, b",
+		Rewrite:          Rewrite{Structural: "`drop widget a` as `drop a`"},
+		RemovedIn:        2,
+		Note:             "The target names the element; the kind is its own.",
+		Example:          "alter page M.P { drop widget txtOld; };",
+		CanonicalExample: "alter page M.P { drop txtOld; };",
+	},
+	{
+		Code:      SettingsAssignment,
+		Old:       "alter settings runtime Key = value, …  /  create configuration 'X' Key = value, …",
+		Canonical: "alter settings runtime ( Key: value, … )  /  create configuration 'X' ( Key: value, … )",
+		Rewrite:   Rewrite{Structural: "assignments in parentheses, each `=` as `:`"},
+		RemovedIn: 2,
+		Note: "Every settings section (runtime, language, workflows, configuration 'X') and `create configuration`. " +
+			"`alter settings constant 'C' value 'v'` is a clause, not a property, and is unchanged.",
+		Example:          "alter settings runtime AfterStartupMicroflow = 'M.Startup', BcryptCost = 11;",
+		CanonicalExample: "alter settings runtime ( AfterStartupMicroflow: 'M.Startup', BcryptCost: 11 );",
+	},
+	{
+		Code:             ODataAlterAssignment,
+		Old:              "alter consumed|published odata service X set Key = value, …",
+		Canonical:        "alter consumed|published odata service X set ( Key: value, … )",
+		Rewrite:          Rewrite{Structural: "assignments in parentheses, each `=` as `:`"},
+		RemovedIn:        2,
+		Note:             "The list takes exactly the keys and values of the service's `create` statement.",
+		Example:          "alter consumed odata service M.Crm set Version = '2.0', Timeout = 30;",
+		CanonicalExample: "alter consumed odata service M.Crm set ( Version: '2.0', Timeout: 30 );",
+	},
+	{
+		Code:             StylingAssignment,
+		Old:              "alter styling on page P widget w set Class = 'x', 'Full width' = on",
+		Canonical:        "alter styling on page P widget w set ( Class: 'x', 'Full width': on )",
+		Rewrite:          Rewrite{Structural: "assignments in parentheses, each `=` as `:`"},
+		RemovedIn:        2,
+		Note:             "The same list `alter page … set ( … ) on w` takes for a widget's class, style and design properties.",
+		Example:          "alter styling on page M.P widget ctn1 set Class = 'card', 'Full width' = on;",
+		CanonicalExample: "alter styling on page M.P widget ctn1 set ( Class: 'card', 'Full width': on );",
+	},
+	{
+		Code:             AllowCreateChangeLocally,
+		Old:              "alter entity M.E set allow_create_change_locally = true",
+		Canonical:        "alter entity M.E set ( AllowCreateChangeLocally: true )",
+		Rewrite:          Rewrite{Structural: "property as create's list: `set ( AllowCreateChangeLocally: <value> )`"},
+		RemovedIn:        2,
+		Note:             "The key `create external entity` takes for the same property.",
+		Example:          "alter entity M.Remote set allow_create_change_locally = true;",
+		CanonicalExample: "alter entity M.Remote set ( AllowCreateChangeLocally: true );",
+	},
+	{
+		Code:             AssociationClauseColon,
+		Old:              "type: Reference / owner: Both / storage: Table",
+		Canonical:        "type Reference / owner Both / storage Table",
+		Rewrite:          Rewrite{Structural: "clause without its colon: `type: Reference` as `type Reference` (also `owner`, `storage`)"},
+		RemovedIn:        2,
+		Note:             "A clause outside a property list takes no colon, as describe writes it.",
+		Example:          "create association M.Order_Customer from M.Order to M.Customer type: Reference;",
+		CanonicalExample: "create association M.Order_Customer from M.Order to M.Customer type Reference;",
+	},
+	{
+		Code:             ModifyAttributeColon,
+		Old:              "alter entity M.E modify attribute A Type",
+		Canonical:        "alter entity M.E modify attribute A: Type",
+		Rewrite:          Rewrite{Structural: "attribute definition with its colon: `A Type` as `A: Type`"},
+		RemovedIn:        2,
+		Note:             "An attribute definition is always `Name: Type`, as in `create entity` and `add attribute`.",
+		Example:          "alter entity M.E modify attribute Code String(20);",
+		CanonicalExample: "alter entity M.E modify attribute Code: String(20);",
+	},
 }
 
 // r8Entries are R8's spellings (ako/mxcli#752). Kept apart from the list above
diff --git a/mdl/executor/alter_aliases.go b/mdl/executor/alter_aliases.go
deleted file mode 100644
index 647668eefe..0000000000
--- a/mdl/executor/alter_aliases.go
+++ /dev/null
@@ -1,149 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-package executor
-
-import (
-	"fmt"
-	"strings"
-
-	"github.com/mendixlabs/mxcli/mdl/ast"
-	"github.com/mendixlabs/mxcli/mdl/backend"
-	"github.com/mendixlabs/mxcli/mdl/linter"
-)
-
-// The old spellings of ALTER PAGE / SNIPPET / LAYOUT are aliases of the generic
-// ALTER (ADR-0012 decision 2): they parse to the identical operation and warn
-// (ADR-0011: an old form keeps working through the alias window, and says what
-// replaces it).
-//
-// Each entry has the shape the deprecation registry (ako/mxcli#709) takes —
-// code, old form, canonical form, mechanical rewrite, language version it is
-// removed in — so the registry absorbs this table rather than re-deriving it.
-// Until it lands the codes are provisional and numbered from 101, clear of the
-// registry's seed entries. The grammar marks each alias alternative with
-// `// alias: <code>`; TestAlterAliasGrammarMarkersMatchTable pins the two
-// together, in both directions.
-type alterAlias struct {
-	Code      string // MDL-DEPRnnn
-	Spelling  string // ast.AlterAlias*
-	Old       string // the old form, as written
-	Canonical string // what replaces it
-	Rewrite   string // the mechanical rewrite, for `fmt --upgrade`
-	RemovedIn string // the MDL language version that drops the alias
-}
-
-var alterAliases = []alterAlias{
-	{
-		Code:      "MDL-DEPR101",
-		Spelling:  ast.AlterAliasSetEquals,
-		Old:       "set Key = value [on target]  /  set (Key = value, …) [on target]",
-		Canonical: "set (Key: value, …) [on target]",
-		Rewrite:   "put the assignments in parentheses and write each `=` as `:`",
-		RemovedIn: "mdl 2",
-	},
-	{
-		Code:      "MDL-DEPR102",
-		Spelling:  ast.AlterAliasSetUnparenthesised,
-		Old:       "set Key: value [on target]",
-		Canonical: "set (Key: value) [on target]",
-		Rewrite:   "put the assignment in parentheses",
-		RemovedIn: "mdl 2",
-	},
-	{
-		Code:      "MDL-DEPR103",
-		Spelling:  ast.AlterAliasDropWidget,
-		Old:       "drop widget a, b",
-		Canonical: "drop a, b",
-		Rewrite:   "remove the word `widget`",
-		RemovedIn: "mdl 2",
-	},
-}
-
-func alterAliasFor(spelling string) (alterAlias, bool) {
-	for _, a := range alterAliases {
-		if a.Spelling == spelling {
-			return a, true
-		}
-	}
-	return alterAlias{}, false
-}
-
-// validateAlterAliases warns on every old ALTER spelling a statement uses, once
-// per operation. A warning, never an error: both spellings build the identical
-// operation, and scripts in the wild use the old ones.
-func validateAlterAliases(stmt ast.Statement) []linter.Violation {
-	s, ok := stmt.(*ast.AlterPageStmt)
-	if !ok {
-		return nil
-	}
-	kind := strings.ToLower(s.ContainerType)
-	if kind == "" {
-		kind = "page"
-	}
-	var out []linter.Violation
-	for _, op := range s.Operations {
-		var spelling string
-		switch o := op.(type) {
-		case *ast.SetPropertyOp:
-			spelling = o.Legacy
-		case *ast.DropWidgetOp:
-			spelling = o.Legacy
-		}
-		if spelling == "" {
-			continue
-		}
-		a, known := alterAliasFor(spelling)
-		if !known {
-			continue
-		}
-		out = append(out, linter.Violation{
-			RuleID:   a.Code,
-			Severity: linter.SeverityWarning,
-			Message: fmt.Sprintf("alter %s %s: `%s` is the old spelling of `%s`",
-				kind, s.PageName.String(), a.Old, a.Canonical),
-			Location: linter.Location{
-				Module:       s.PageName.Module,
-				DocumentType: kind,
-				DocumentName: s.PageName.Name,
-			},
-			Suggestion: fmt.Sprintf("Write `%s` (%s). Both build the identical change; the old form is removed in %s.",
-				a.Canonical, a.Rewrite, a.RemovedIn),
-		})
-	}
-	return out
-}
-
-// validateAlterPageAddresses refuses, with no project needed, a target whose
-// address FORM a page cannot use: a quoted caption, an @n, a path of more than
-// two names. The generic grammar accepts every address form any document type
-// uses, and the page family's resolver refuses these whatever the page holds —
-// so `check` can say so up front instead of `exec` stopping mid-script. The
-// rule is the resolver's own (backend.CheckPageAlterTarget), not a copy.
-func validateAlterPageAddresses(stmt ast.Statement) []linter.Violation {
-	s, ok := stmt.(*ast.AlterPageStmt)
-	if !ok {
-		return nil
-	}
-	kind := strings.ToLower(s.ContainerType)
-	if kind == "" {
-		kind = "page"
-	}
-	var out []linter.Violation
-	for _, op := range s.Operations {
-		for _, ref := range alterPageOperationTargets(op) {
-			if err := backend.CheckPageAlterTarget(alterTargetOf(ref)); err != nil {
-				out = append(out, linter.Violation{
-					RuleID:   "MDL-ALTER01",
-					Severity: linter.SeverityError,
-					Message:  fmt.Sprintf("alter %s %s: %v", kind, s.PageName.String(), err),
-					Location: linter.Location{
-						Module:       s.PageName.Module,
-						DocumentType: kind,
-						DocumentName: s.PageName.Name,
-					},
-				})
-			}
-		}
-	}
-	return out
-}
diff --git a/mdl/executor/cmd_settings.go b/mdl/executor/cmd_settings.go
index 93bf8e21a8..520780ba33 100644
--- a/mdl/executor/cmd_settings.go
+++ b/mdl/executor/cmd_settings.go
@@ -148,27 +148,31 @@ func describeSettings(ctx *ExecContext, configName string) error {
 			}
 		}
 
-		addIfSet("AfterStartupMicroflow", "AfterStartupMicroflow = '%s'", ms.AfterStartupMicroflow)
-		addIfSet("BeforeShutdownMicroflow", "BeforeShutdownMicroflow = '%s'", ms.BeforeShutdownMicroflow)
-		addIfSet("HealthCheckMicroflow", "HealthCheckMicroflow = '%s'", ms.HealthCheckMicroflow)
-		add("HashAlgorithm", "HashAlgorithm = '%s'", ms.HashAlgorithm)
-		add("BcryptCost", "BcryptCost = %d", ms.BcryptCost)
+		addIfSet("AfterStartupMicroflow", "AfterStartupMicroflow: '%s'", ms.AfterStartupMicroflow)
+		addIfSet("BeforeShutdownMicroflow", "BeforeShutdownMicroflow: '%s'", ms.BeforeShutdownMicroflow)
+		addIfSet("HealthCheckMicroflow", "HealthCheckMicroflow: '%s'", ms.HealthCheckMicroflow)
+		add("HashAlgorithm", "HashAlgorithm: '%s'", ms.HashAlgorithm)
+		add("BcryptCost", "BcryptCost: %d", ms.BcryptCost)
 		// JavaVersion is stored under either JavaVersion or JavaMajorVersion; emit it
 		// when the document carries whichever spelling, in mxcli's single input name.
 		if settingsoverlay.JavaVersionKey(stored) != "" || stored == nil {
-			parts = append(parts, fmt.Sprintf("  JavaVersion = '%s'", ms.JavaVersion))
+			parts = append(parts, fmt.Sprintf("  JavaVersion: '%s'", ms.JavaVersion))
+		}
+		add("RoundingMode", "RoundingMode: '%s'", ms.RoundingMode)
+		add("AllowUserMultipleSessions", "AllowUserMultipleSessions: %t", ms.AllowUserMultipleSessions)
+		add("EnableDataStorageOptimisticLocking", "EnableDataStorageOptimisticLocking: %t", ms.EnableDataStorageOptimisticLocking)
+		add("UseDatabaseForeignKeyConstraints", "UseDatabaseForeignKeyConstraints: %t", ms.UseDatabaseForeignKeyConstraints)
+		add("UseOQLVersion2", "UseOQLVersion2: %t", ms.UseOQLVersion2)
+		add("DecimalScale", "DecimalScale: %d", ms.DecimalScale)
+		addIfSet("FirstDayOfWeek", "FirstDayOfWeek: '%s'", ms.FirstDayOfWeek)
+		addIfSet("SslCertificateAlgorithm", "SslCertificateAlgorithm: '%s'", ms.SslCertificateAlgorithm)
+		addIfSet("ScheduledEventTimeZoneCode", "ScheduledEventTimeZoneCode: '%s'", ms.ScheduledEventTimeZoneCode)
+		addIfSet("DefaultTimeZoneCode", "DefaultTimeZoneCode: '%s'", ms.DefaultTimeZoneCode)
+		// R3: the ( Key: value, … ) list every alter takes (ako/mxcli#751). An
+		// empty list does not parse, so nothing is written for none.
+		if len(parts) > 0 {
+			fmt.Fprintf(ctx.Output, "alter settings runtime (\n%s\n);\n\n", strings.Join(parts, ",\n"))
 		}
-		add("RoundingMode", "RoundingMode = '%s'", ms.RoundingMode)
-		add("AllowUserMultipleSessions", "AllowUserMultipleSessions = %t", ms.AllowUserMultipleSessions)
-		add("EnableDataStorageOptimisticLocking", "EnableDataStorageOptimisticLocking = %t", ms.EnableDataStorageOptimisticLocking)
-		add("UseDatabaseForeignKeyConstraints", "UseDatabaseForeignKeyConstraints = %t", ms.UseDatabaseForeignKeyConstraints)
-		add("UseOQLVersion2", "UseOQLVersion2 = %t", ms.UseOQLVersion2)
-		add("DecimalScale", "DecimalScale = %d", ms.DecimalScale)
-		addIfSet("FirstDayOfWeek", "FirstDayOfWeek = '%s'", ms.FirstDayOfWeek)
-		addIfSet("SslCertificateAlgorithm", "SslCertificateAlgorithm = '%s'", ms.SslCertificateAlgorithm)
-		addIfSet("ScheduledEventTimeZoneCode", "ScheduledEventTimeZoneCode = '%s'", ms.ScheduledEventTimeZoneCode)
-		addIfSet("DefaultTimeZoneCode", "DefaultTimeZoneCode = '%s'", ms.DefaultTimeZoneCode)
-		fmt.Fprintf(ctx.Output, "alter settings runtime\n%s;\n\n", strings.Join(parts, ",\n"))
 	}
 
 	// Configuration settings
@@ -211,7 +215,7 @@ func describeSettings(ctx *ExecContext, configName string) error {
 				mdlQuoted(l.Code), l.CheckCompleteness, mdlQuoted(l.CustomDateFormat),
 				mdlQuoted(l.CustomTimeFormat), mdlQuoted(l.CustomDateTimeFormat))
 		}
-		fmt.Fprintf(ctx.Output, "alter settings LANGUAGE\n  DefaultLanguageCode = '%s';\n", ps.Language.DefaultLanguageCode)
+		fmt.Fprintf(ctx.Output, "alter settings LANGUAGE (\n  DefaultLanguageCode: '%s'\n);\n", ps.Language.DefaultLanguageCode)
 		fmt.Fprintln(ctx.Output)
 	}
 
@@ -220,16 +224,16 @@ func describeSettings(ctx *ExecContext, configName string) error {
 		ws := ps.Workflows
 		var parts []string
 		if ws.UserEntity != "" {
-			parts = append(parts, fmt.Sprintf("  UserEntity = '%s'", ws.UserEntity))
+			parts = append(parts, fmt.Sprintf("  UserEntity: '%s'", ws.UserEntity))
 		}
 		if ws.DefaultTaskParallelism > 0 {
-			parts = append(parts, fmt.Sprintf("  DefaultTaskParallelism = %d", ws.DefaultTaskParallelism))
+			parts = append(parts, fmt.Sprintf("  DefaultTaskParallelism: %d", ws.DefaultTaskParallelism))
 		}
 		if ws.WorkflowEngineParallelism > 0 {
-			parts = append(parts, fmt.Sprintf("  WorkflowEngineParallelism = %d", ws.WorkflowEngineParallelism))
+			parts = append(parts, fmt.Sprintf("  WorkflowEngineParallelism: %d", ws.WorkflowEngineParallelism))
 		}
 		if len(parts) > 0 {
-			fmt.Fprintf(ctx.Output, "alter settings workflows\n%s;\n\n", strings.Join(parts, ",\n"))
+			fmt.Fprintf(ctx.Output, "alter settings workflows (\n%s\n);\n\n", strings.Join(parts, ",\n"))
 		}
 		// The groups, in stored order. `add or modify` so a described project
 		// re-executes against a project that already has some of them.
@@ -972,31 +976,31 @@ func settingsValueToString(val any) string {
 // writeSettingsConfiguration emits one configuration as re-executable MDL.
 func writeSettingsConfiguration(ctx *ExecContext, cfg *model.ServerConfiguration) {
 	var parts []string
-	parts = append(parts, "  DatabaseType = "+mdlQuoted(cfg.DatabaseType))
-	parts = append(parts, "  DatabaseUrl = "+mdlQuoted(cfg.DatabaseUrl))
-	parts = append(parts, "  DatabaseName = "+mdlQuoted(cfg.DatabaseName))
-	parts = append(parts, "  DatabaseUserName = "+mdlQuoted(cfg.DatabaseUserName))
+	parts = append(parts, "  DatabaseType: "+mdlQuoted(cfg.DatabaseType))
+	parts = append(parts, "  DatabaseUrl: "+mdlQuoted(cfg.DatabaseUrl))
+	parts = append(parts, "  DatabaseName: "+mdlQuoted(cfg.DatabaseName))
+	parts = append(parts, "  DatabaseUserName: "+mdlQuoted(cfg.DatabaseUserName))
 	// DatabasePassword is deliberately not printed (ako/mxcli#707): describe
 	// output is what gets committed and reviewed, and printing the stored value
 	// put a database credential into PR diffs. Omitting the key is lossless for
 	// the replay that matters — `create or modify` on an existing configuration
 	// is a patch, so the stored password is left as it is. On a project without
 	// this configuration the password starts empty, which the comment says.
-	parts = append(parts, fmt.Sprintf("  HttpPortNumber = %d", cfg.HttpPortNumber))
-	parts = append(parts, fmt.Sprintf("  ServerPortNumber = %d", cfg.ServerPortNumber))
+	parts = append(parts, fmt.Sprintf("  HttpPortNumber: %d", cfg.HttpPortNumber))
+	parts = append(parts, fmt.Sprintf("  ServerPortNumber: %d", cfg.ServerPortNumber))
 	if cfg.ApplicationRootUrl != "" {
-		parts = append(parts, "  ApplicationRootUrl = "+mdlQuoted(cfg.ApplicationRootUrl))
+		parts = append(parts, "  ApplicationRootUrl: "+mdlQuoted(cfg.ApplicationRootUrl))
 	}
 	if cfg.DatabasePassword != "" {
 		fmt.Fprintf(ctx.Output, "-- DatabasePassword is set in configuration %s and is not printed; "+
-			"add `DatabasePassword = '…'` to set it on a project that lacks it.\n", mdlQuoted(cfg.Name))
+			"add `DatabasePassword: '…'` to set it on a project that lacks it.\n", mdlQuoted(cfg.Name))
 	}
 	// CREATE OR MODIFY, not ALTER: a described project has to replay onto a
 	// target that does not have this configuration yet. ALTER answered
 	// "configuration not found: Acceptance" and stopped the whole file, which is
 	// the same shape as the language list emitting a comment — output that reads
 	// correctly and cannot be run.
-	fmt.Fprintf(ctx.Output, "create or modify configuration %s\n%s;\n\n", mdlQuoted(cfg.Name), strings.Join(parts, ",\n"))
+	fmt.Fprintf(ctx.Output, "create or modify configuration %s (\n%s\n);\n\n", mdlQuoted(cfg.Name), strings.Join(parts, ",\n"))
 
 	// Output constant overrides. A private override has no value in the
 	// model — emitting `value ''` would round-trip into a *shared* empty
diff --git a/mdl/executor/cmd_settings_configuration_test.go b/mdl/executor/cmd_settings_configuration_test.go
index 0366077a24..5bb9af51c3 100644
--- a/mdl/executor/cmd_settings_configuration_test.go
+++ b/mdl/executor/cmd_settings_configuration_test.go
@@ -51,7 +51,7 @@ func TestDescribeSettingsConfiguration_ByName(t *testing.T) {
 	if !strings.Contains(out, "create or modify configuration 'Default'") {
 		t.Errorf("expected the named configuration in its replayable form, got:\n%s", out)
 	}
-	if !strings.Contains(out, "ApplicationRootUrl = 'http://backend.local:8080/'") {
+	if !strings.Contains(out, "ApplicationRootUrl: 'http://backend.local:8080/'") {
 		t.Errorf("expected the root URL, got:\n%s", out)
 	}
 	// Naming one configuration means one configuration, not all of them.
diff --git a/mdl/executor/cmd_settings_describe_canonical_test.go b/mdl/executor/cmd_settings_describe_canonical_test.go
new file mode 100644
index 0000000000..e9ee8f3830
--- /dev/null
+++ b/mdl/executor/cmd_settings_describe_canonical_test.go
@@ -0,0 +1,67 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package executor
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/backend/mock"
+	"github.com/mendixlabs/mxcli/mdl/visitor"
+	"github.com/mendixlabs/mxcli/model"
+)
+
+// R3 (ako/mxcli#751): describe settings writes every section as the
+// ( Key: value, … ) list `alter` takes, so its output replays with no
+// deprecation warning, under no header and under `mdl 1;` alike. The control
+// is the property count: output that dropped the properties would parse
+// cleanly too.
+func TestDescribeSettings_EmitsCanonicalPropertyLists(t *testing.T) {
+	ps := &model.ProjectSettings{
+		Model: &model.ModelSettings{
+			AfterStartupMicroflow: "M.ASU", HashAlgorithm: "BCrypt", BcryptCost: 11,
+			JavaVersion: "Java21", RoundingMode: "HalfEven",
+		},
+		Configuration: &model.ConfigurationSettings{
+			Configurations: []*model.ServerConfiguration{
+				{Name: "Default", DatabaseType: "Hsqldb", DatabaseName: "default", HttpPortNumber: 8080,
+					ApplicationRootUrl: "http://localhost:8080/"},
+			},
+		},
+		Language: &model.LanguageSettings{DefaultLanguageCode: "en_US", Languages: []model.Language{{Code: "en_US"}}},
+		Workflows: &model.WorkflowsSettings{UserEntity: "System.User", DefaultTaskParallelism: 3,
+			Groups: []model.WorkflowGroup{{Name: "Approvers", Description: "First line"}}},
+	}
+	mb := &mock.MockBackend{
+		IsConnectedFunc:        func() bool { return true },
+		GetProjectSettingsFunc: func() (*model.ProjectSettings, error) { return ps, nil },
+	}
+	ctx, buf := newMockCtx(t, withBackend(mb))
+	if err := describeSettings(ctx, ""); err != nil {
+		t.Fatal(err)
+	}
+	out := buf.String()
+
+	for _, header := range []string{"", "mdl 1;\n"} {
+		prog, errs := visitor.Build(header + out)
+		if len(errs) > 0 {
+			t.Fatalf("describe output does not parse (header %q): %v\n%s", header, errs, out)
+		}
+		if len(prog.Deprecations) > 0 {
+			t.Errorf("describe output uses a deprecated spelling (header %q): %+v\n%s", header, prog.Deprecations, out)
+		}
+	}
+	for _, want := range []string{
+		"alter settings runtime (\n  AfterStartupMicroflow: 'M.ASU',",
+		"create or modify configuration 'Default' (\n  DatabaseType: 'Hsqldb',",
+		"alter settings LANGUAGE (\n  DefaultLanguageCode: 'en_US'\n);",
+		"alter settings workflows (\n  UserEntity: 'System.User',\n  DefaultTaskParallelism: 3\n);",
+	} {
+		if !strings.Contains(out, want) {
+			t.Errorf("describe output lacks %q:\n%s", want, out)
+		}
+	}
+	if strings.Contains(out, " = ") {
+		t.Errorf("describe output still assigns with `=`:\n%s", out)
+	}
+}
diff --git a/mdl/executor/cmd_settings_languages.go b/mdl/executor/cmd_settings_languages.go
index 634ba1814d..72ab7e90fe 100644
--- a/mdl/executor/cmd_settings_languages.go
+++ b/mdl/executor/cmd_settings_languages.go
@@ -251,7 +251,7 @@ func alterSettingsLanguageRemove(ctx *ExecContext, ps *model.ProjectSettings, st
 	if strings.EqualFold(ps.Language.DefaultLanguageCode, code) {
 		return mdlerrors.NewValidationf(
 			"%s is the project's DEFAULT language and cannot be removed — every missing translation falls back on it. "+
-				"Make another language the default first: `alter settings LANGUAGE DefaultLanguageCode = '<code>'`", code)
+				"Make another language the default first: `alter settings LANGUAGE (DefaultLanguageCode: '<code>')`", code)
 	}
 
 	stored := ps.Language.Languages[idx].Code
diff --git a/mdl/executor/validate_alter_page_addresses.go b/mdl/executor/validate_alter_page_addresses.go
new file mode 100644
index 0000000000..91d430acb1
--- /dev/null
+++ b/mdl/executor/validate_alter_page_addresses.go
@@ -0,0 +1,47 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package executor
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/backend"
+	"github.com/mendixlabs/mxcli/mdl/linter"
+)
+
+// validateAlterPageAddresses refuses, with no project needed, a target whose
+// address FORM a page cannot use: a quoted caption, an @n, a path of more than
+// two names. The generic grammar accepts every address form any document type
+// uses, and the page family's resolver refuses these whatever the page holds —
+// so `check` can say so up front instead of `exec` stopping mid-script. The
+// rule is the resolver's own (backend.CheckPageAlterTarget), not a copy.
+func validateAlterPageAddresses(stmt ast.Statement) []linter.Violation {
+	s, ok := stmt.(*ast.AlterPageStmt)
+	if !ok {
+		return nil
+	}
+	kind := strings.ToLower(s.ContainerType)
+	if kind == "" {
+		kind = "page"
+	}
+	var out []linter.Violation
+	for _, op := range s.Operations {
+		for _, ref := range alterPageOperationTargets(op) {
+			if err := backend.CheckPageAlterTarget(alterTargetOf(ref)); err != nil {
+				out = append(out, linter.Violation{
+					RuleID:   "MDL-ALTER01",
+					Severity: linter.SeverityError,
+					Message:  fmt.Sprintf("alter %s %s: %v", kind, s.PageName.String(), err),
+					Location: linter.Location{
+						Module:       s.PageName.Module,
+						DocumentType: kind,
+						DocumentName: s.PageName.Name,
+					},
+				})
+			}
+		}
+	}
+	return out
+}
diff --git a/mdl/executor/alter_aliases_test.go b/mdl/executor/validate_alter_page_addresses_test.go
similarity index 63%
rename from mdl/executor/alter_aliases_test.go
rename to mdl/executor/validate_alter_page_addresses_test.go
index 2ef32eae80..1975c8619b 100644
--- a/mdl/executor/alter_aliases_test.go
+++ b/mdl/executor/validate_alter_page_addresses_test.go
@@ -3,10 +3,6 @@
 package executor
 
 import (
-	"os"
-	"path/filepath"
-	"regexp"
-	"sort"
 	"strings"
 	"testing"
 
@@ -30,7 +26,8 @@ func aliasWarnings(t *testing.T, src string) []linter.Violation {
 }
 
 // The old ALTER PAGE spellings still run, and warn with the code that names
-// their rewrite (ako/mxcli#712). The canonical script is the control: it must
+// their rewrite (ako/mxcli#712; registered in mdl/deprecation since
+// ako/mxcli#751). The canonical script is the control: it must
 // produce no deprecation warning at all, or a warning on every ALTER would pass.
 func TestAlterAliases_OldSpellingsWarn(t *testing.T) {
 	old := aliasWarnings(t, `alter page M.P {
@@ -50,8 +47,8 @@ func TestAlterAliases_OldSpellingsWarn(t *testing.T) {
 	if strings.Join(codes, ",") != strings.Join(want, ",") {
 		t.Errorf("codes: got %v, want %v", codes, want)
 	}
-	if len(old) > 0 && !strings.Contains(old[0].Suggestion, "set (Key: value") {
-		t.Errorf("suggestion should name the canonical form: %q", old[0].Suggestion)
+	if len(old) > 0 && !strings.Contains(old[0].Message, "set (Key: value") {
+		t.Errorf("the warning should name the canonical form: %q", old[0].Message)
 	}
 
 	canonical := aliasWarnings(t, `alter page M.P {
@@ -66,47 +63,6 @@ func TestAlterAliases_OldSpellingsWarn(t *testing.T) {
 	}
 }
 
-// Every grammar alternative marked `// alias: <code>` has an entry in the
-// alias table, and every entry is marked somewhere in the grammar — so an alias
-// cannot be added to one without the other. The deprecation registry
-// (ako/mxcli#709) generalises this check.
-func TestAlterAliasGrammarMarkersMatchTable(t *testing.T) {
-	marker := regexp.MustCompile(`//\s*alias:\s*(MDL-DEPR\d+)`)
-	files, _ := filepath.Glob("../grammar/*.g4")
-	more, _ := filepath.Glob("../grammar/domains/*.g4")
-	files = append(files, more...)
-	if len(files) == 0 {
-		t.Fatal("no grammar files found")
-	}
-	marked := map[string]bool{}
-	for _, f := range files {
-		b, err := os.ReadFile(f)
-		if err != nil {
-			t.Fatal(err)
-		}
-		for _, m := range marker.FindAllStringSubmatch(string(b), -1) {
-			marked[m[1]] = true
-		}
-	}
-	table := map[string]bool{}
-	for _, a := range alterAliases {
-		table[a.Code] = true
-		if !marked[a.Code] {
-			t.Errorf("%s is in the alias table but no grammar alternative is marked `// alias: %s`", a.Code, a.Code)
-		}
-	}
-	var missing []string
-	for code := range marked {
-		if !table[code] {
-			missing = append(missing, code)
-		}
-	}
-	sort.Strings(missing)
-	for _, code := range missing {
-		t.Errorf("grammar marks an alias %s with no entry in alterAliases", code)
-	}
-}
-
 // A caption or @n target is a form a page does not use. The generic grammar
 // parses it (other document types need it), so check must refuse it — with no
 // project — rather than leave exec to stop partway through a script. A name
diff --git a/mdl/executor/validate_program.go b/mdl/executor/validate_program.go
index 8997177628..fb2b710ddf 100644
--- a/mdl/executor/validate_program.go
+++ b/mdl/executor/validate_program.go
@@ -110,9 +110,6 @@ func ValidateProgram(prog *ast.Program, projectPath string) []linter.Violation {
 		if awfStmt, ok := stmt.(*ast.AlterWorkflowStmt); ok {
 			violations = append(violations, ValidateAlterWorkflow(awfStmt)...)
 		}
-		// The old ALTER PAGE / SNIPPET / LAYOUT spellings are aliases of the
-		// generic ALTER and warn with their deprecation code (MDL-DEPR101..103).
-		violations = append(violations, validateAlterAliases(stmt)...)
 		// A page element is addressed by name; a caption or @n target is
 		// refused before exec would stop on it (MDL-ALTER01).
 		violations = append(violations, validateAlterPageAddresses(stmt)...)
diff --git a/mdl/grammar/MDLParser.g4 b/mdl/grammar/MDLParser.g4
index 28fe0f0230..6a43211cc9 100644
--- a/mdl/grammar/MDLParser.g4
+++ b/mdl/grammar/MDLParser.g4
@@ -163,7 +163,11 @@ alterStatement
     | alterEntitiesStatement
     | ALTER ASSOCIATION qualifiedName alterAssociationAction+
     | ALTER ENUMERATION qualifiedName alterEnumerationAction+
+    // R3 (ako/mxcli#751): `set ( Key: value, … )`, create's property list.
+    // The unparenthesised `set Key = value, …` is the old spelling.
+    | ALTER consumedODataServiceKw qualifiedName SET odataAlterPropertyList
     | ALTER consumedODataServiceKw qualifiedName SET odataAlterAssignment (COMMA odataAlterAssignment)*
+    | ALTER publishedODataServiceKw qualifiedName SET odataAlterPropertyList
     | ALTER publishedODataServiceKw qualifiedName SET odataAlterAssignment (COMMA odataAlterAssignment)*
     | ALTER STYLING ON (PAGE | SNIPPET) qualifiedName WIDGET IDENTIFIER alterStylingAction+
     | ALTER SETTINGS alterSettingsClause
@@ -226,16 +230,24 @@ publishedRestAlterAssignment
  * ```
  */
 alterStylingAction
-    : SET alterStylingAssignment (COMMA alterStylingAssignment)*
+    : SET LPAREN alterStylingAssignment (COMMA alterStylingAssignment)* RPAREN  // set ( Class: 'x', 'Full width': on )
+    | SET alterStylingAssignment (COMMA alterStylingAssignment)*  /* @alias MDL-DEPR062 */  // set Class = 'x'
     | CLEAR DESIGN PROPERTIES
     ;
 
+// `Key: value` is canonical (R3: `:` sets a model property); `=` is the old
+// spelling, still accepted.
+alterStylingAssignOp
+    : COLON
+    | EQUALS   /* @alias MDL-DEPR062 */
+    ;
+
 alterStylingAssignment
-    : CLASS EQUALS STRING_LITERAL                  // Class = 'my-class'
-    | STYLE EQUALS STRING_LITERAL                  // Style = 'color: red;'
-    | STRING_LITERAL EQUALS STRING_LITERAL         // 'Spacing top' = 'Large'
-    | STRING_LITERAL EQUALS ON                     // 'Full width' = ON
-    | STRING_LITERAL EQUALS OFF                    // 'Full width' = OFF
+    : CLASS alterStylingAssignOp STRING_LITERAL                  // Class: 'my-class'
+    | STYLE alterStylingAssignOp STRING_LITERAL                  // Style: 'color: red;'
+    | STRING_LITERAL alterStylingAssignOp STRING_LITERAL         // 'Spacing top': 'Large'
+    | STRING_LITERAL alterStylingAssignOp ON                     // 'Full width': ON
+    | STRING_LITERAL alterStylingAssignOp OFF                    // 'Full width': OFF
     ;
 
 /**
@@ -282,7 +294,7 @@ alterOperation
 alterSet
     : SET LAYOUT EQUALS qualifiedName (MAP LPAREN alterLayoutMapping (COMMA alterLayoutMapping)* RPAREN)?  // SET Layout = Atlas_Core.TopBar MAP (Main AS Content)
     | SET LPAREN alterPageAssignment (COMMA alterPageAssignment)* RPAREN (ON alterTarget)?  // set (Caption: 'Save', ButtonStyle: Success) on btnSave
-    | SET alterPageAssignment (ON alterTarget)?     // alias: MDL-DEPR102 — set Caption: 'Save' on btnSave
+    | SET alterPageAssignment (ON alterTarget)?     /* @alias MDL-DEPR102 */  // set Caption: 'Save' on btnSave
     ;
 
 alterLayoutMapping
@@ -299,7 +311,7 @@ alterReplace
 
 alterDrop
     : DROP alterTarget (COMMA alterTarget)*
-    | DROP WIDGET alterTarget (COMMA alterTarget)*   // alias: MDL-DEPR103 — drop widget a, b
+    | DROP WIDGET /* @alias MDL-DEPR103 */ alterTarget (COMMA alterTarget)*   // drop widget a, b
     ;
 
 // A fragment is written exactly as `create` writes the same content. Only the
@@ -408,7 +420,7 @@ alterPagesStylingAssignment
 // the old spelling, still accepted.
 alterAssignOp
     : COLON
-    | EQUALS   // alias: MDL-DEPR101 — set (Caption = 'Save') / set Caption = 'Save'
+    | EQUALS   /* @alias MDL-DEPR101 */  // set (Caption = 'Save') / set Caption = 'Save'
     ;
 
 alterPageAssignment
diff --git a/mdl/grammar/domains/MDLDomainModel.g4 b/mdl/grammar/domains/MDLDomainModel.g4
index 65ae1ff81e..ad40400cdd 100644
--- a/mdl/grammar/domains/MDLDomainModel.g4
+++ b/mdl/grammar/domains/MDLDomainModel.g4
@@ -189,9 +189,10 @@ associationOptions
     ;
 
 associationOption
-    : TYPE COLON? (REFERENCE | REFERENCE_SET)
-    | OWNER COLON? (DEFAULT | BOTH)
-    | STORAGE COLON? (COLUMN | TABLE)
+    // A clause takes no colon (R3): `type Reference`. The colon is an alias.
+    : TYPE (COLON /* @alias MDL-DEPR064 */)? (REFERENCE | REFERENCE_SET)
+    | OWNER (COLON /* @alias MDL-DEPR064 */)? (DEFAULT | BOTH)
+    | STORAGE (COLON /* @alias MDL-DEPR064 */)? (COLUMN | TABLE)
     | DELETE_BEHAVIOR /* @alias MDL-DEPR022 */ deleteBehavior errorMessageClause?
     | onDeleteClause
     | COMMENT STRING_LITERAL
@@ -268,15 +269,18 @@ alterEntityAction
     | docComment? ADD COLUMN ifNotExists? attributeDefinition
     | RENAME ATTRIBUTE attributeName TO attributeName
     | RENAME COLUMN attributeName TO attributeName
-    | MODIFY ATTRIBUTE attributeName COLON? dataType attributeConstraint*
-    | MODIFY COLUMN attributeName COLON? dataType attributeConstraint*
+    // An attribute definition is always `Name: Type` (R3). The colon is
+    // optional only so the old spelling keeps parsing: its ABSENCE is the alias.
+    | MODIFY ATTRIBUTE attributeName COLON? /* @alias MDL-DEPR065 */ dataType attributeConstraint*
+    | MODIFY COLUMN attributeName COLON? /* @alias MDL-DEPR065 */ dataType attributeConstraint*
     | DROP ATTRIBUTE ifExists? attributeName
     | DROP COLUMN ifExists? attributeName
     | DROP DEFAULT ON ATTRIBUTE attributeName   // clear an attribute's default value
     | SET DOCUMENTATION STRING_LITERAL
     | SET COMMENT STRING_LITERAL
     | SET POSITION LPAREN NUMBER_LITERAL COMMA NUMBER_LITERAL RPAREN
-    | SET ALLOW_CREATE_CHANGE_LOCALLY EQUALS (TRUE | FALSE)
+    | SET LPAREN ALLOW_CREATE_CHANGE_LOCALLY COLON (TRUE | FALSE) RPAREN    // set ( AllowCreateChangeLocally: true )
+    | SET ALLOW_CREATE_CHANGE_LOCALLY EQUALS /* @alias MDL-DEPR063 */ (TRUE | FALSE)
     | ADD INDEX ifNotExists? indexDefinition
     | DROP INDEX ifExists? indexDefinition
     | DROP INDEX ifExists? IDENTIFIER
diff --git a/mdl/grammar/domains/MDLService.g4 b/mdl/grammar/domains/MDLService.g4
index a44bb27775..1dc8826580 100644
--- a/mdl/grammar/domains/MDLService.g4
+++ b/mdl/grammar/domains/MDLService.g4
@@ -42,8 +42,9 @@ databaseQueryMapping
     ;
 
 createConfigurationStatement
-    : CONFIGURATION STRING_LITERAL
-      (settingsAssignment (COMMA settingsAssignment)*)?
+    : CONFIGURATION STRING_LITERAL settingsItemOptions?          // configuration 'X' ( Key: value, … )
+    | CONFIGURATION STRING_LITERAL
+      settingsAssignment (COMMA settingsAssignment)*             // old spelling: Key = value, … (MDL-DEPR060)
     ;
 
 /**
@@ -215,9 +216,15 @@ odataPropertyAssignment
     | identifierOrKeyword COLON expression
     ;
 
+// ALTER … SET ( Key: value, … ): exactly create's property list (R3).
+odataAlterPropertyList
+    : LPAREN odataPropertyAssignment (COMMA odataPropertyAssignment)* RPAREN
+    ;
+
+// The old spelling of the alter list: `set Key = value, …` (R3).
 odataAlterAssignment
-    : identifierOrKeyword EQUALS odataPropertyValue
-    | identifierOrKeyword EQUALS expression
+    : identifierOrKeyword EQUALS /* @alias MDL-DEPR061 */ odataPropertyValue
+    | identifierOrKeyword EQUALS /* @alias MDL-DEPR061 */ expression
     ;
 
 odataAuthenticationClause
diff --git a/mdl/grammar/domains/MDLSettings.g4 b/mdl/grammar/domains/MDLSettings.g4
index f3c3ba2651..e2533004ba 100644
--- a/mdl/grammar/domains/MDLSettings.g4
+++ b/mdl/grammar/domains/MDLSettings.g4
@@ -11,14 +11,17 @@ options { tokenVocab = MDLLexer; }
 // =============================================================================
 
 /**
- * ALTER SETTINGS RUNTIME Key = Value, ...;   (MODEL is a deprecated alias)
- * ALTER SETTINGS CONFIGURATION 'name' Key = Value, ...;
+ * ALTER SETTINGS RUNTIME ( Key: Value, ... );   (MODEL is a deprecated alias)
+ * ALTER SETTINGS CONFIGURATION 'name' ( Key: Value, ... );
  * ALTER SETTINGS CONSTANT 'name' VALUE 'value' [IN CONFIGURATION 'name'];
- * ALTER SETTINGS LANGUAGE Key = Value, ...;
+ * ALTER SETTINGS LANGUAGE ( Key: Value, ... );
  * ALTER SETTINGS LANGUAGE ADD [OR MODIFY] 'ar_SD' [(Key: Value, ...)];
  * ALTER SETTINGS LANGUAGE MODIFY 'ar_SD' (Key: Value, ...);
  * ALTER SETTINGS LANGUAGE REMOVE 'ar_SD';
- * ALTER SETTINGS WORKFLOWS Key = Value, ...;
+ * ALTER SETTINGS WORKFLOWS ( Key: Value, ... );
+ *
+ * `Key = Value, …` without the parentheses is the old spelling of the property
+ * list (MDL-DEPR060, R3).
  * ALTER SETTINGS WORKFLOWS ADD [OR MODIFY] GROUP 'Approvers' [(Description: '...')];
  * ALTER SETTINGS WORKFLOWS MODIFY GROUP 'Approvers' (Description: '...');
  * ALTER SETTINGS WORKFLOWS REMOVE GROUP 'Approvers';
@@ -45,10 +48,12 @@ alterSettingsClause
     | settingsSection ADD STRING_LITERAL settingsItemOptions?
     | settingsSection MODIFY STRING_LITERAL settingsItemOptions
     | settingsSection REMOVE STRING_LITERAL
-    | settingsSection settingsAssignment (COMMA settingsAssignment)*
+    | settingsSection settingsItemOptions                                  // runtime ( Key: value, … )
+    | settingsSection settingsAssignment (COMMA settingsAssignment)*        // old spelling (MDL-DEPR060)
     | CONSTANT STRING_LITERAL (VALUE settingsValue | DROP) (IN CONFIGURATION STRING_LITERAL)?
     | DROP CONSTANT STRING_LITERAL (IN CONFIGURATION STRING_LITERAL)?
-    | CONFIGURATION STRING_LITERAL settingsAssignment (COMMA settingsAssignment)*
+    | CONFIGURATION STRING_LITERAL settingsItemOptions                      // configuration 'X' ( Key: value, … )
+    | CONFIGURATION STRING_LITERAL settingsAssignment (COMMA settingsAssignment)*  // old spelling (MDL-DEPR060)
     ;
 
 // RUNTIME is Studio Pro's tab for Settings$ModelSettings (R10); MODEL, the
@@ -60,8 +65,11 @@ settingsSection
     | WORKFLOWS
     ;
 
+// The old spelling of a settings property: `Key = value`, outside a list. R3
+// (ako/mxcli#751): `:` sets a model property, in the ( Key: value, … ) list
+// every other statement uses.
 settingsAssignment
-    : IDENTIFIER EQUALS settingsValue
+    : IDENTIFIER EQUALS /* @alias MDL-DEPR060 */ settingsValue
     ;
 
 // The optional properties of an added language or workflow group, in the
diff --git a/mdl/upgrade/document_names_test.go b/mdl/upgrade/document_names_test.go
index 7079f4f1b1..5c7998a732 100644
--- a/mdl/upgrade/document_names_test.go
+++ b/mdl/upgrade/document_names_test.go
@@ -16,14 +16,14 @@ func TestUpgrade_DocumentTypeNames(t *testing.T) {
 		"grant access on odata service M.Api to M.User;\n" +
 		"create or modify queue M.Jobs (Parallelism: 2);\nlist queues;\n" +
 		"alter project security demo users off;\n" +
-		"alter settings model BcryptCost = 11;\n" +
+		"alter settings model ( BcryptCost: 11 );\n" +
 		"create microflow M.F () begin call microflow M.G() in queue M.Jobs; end;\n"
 	want := "CREATE CONSUMED REST SERVICE M.Api (BaseUrl: 'https://x', Authentication: none) { };\n" +
 		"list consumed odata services;\nlist published odata services in M;\n" +
 		"grant access on published odata service M.Api to M.User;\n" +
 		"create or modify task queue M.Jobs (Parallelism: 2);\nlist task queues;\n" +
 		"alter app security demo users off;\n" +
-		"alter settings runtime BcryptCost = 11;\n" +
+		"alter settings runtime ( BcryptCost: 11 );\n" +
 		// `in queue` is a call option, not the document type name.
 		"create microflow M.F () begin call microflow M.G() in queue M.Jobs; end;\n"
 	res := mustUpgrade(t, src, Options{})
diff --git a/mdl/upgrade/r3_property_lists_test.go b/mdl/upgrade/r3_property_lists_test.go
new file mode 100644
index 0000000000..cf7e655b53
--- /dev/null
+++ b/mdl/upgrade/r3_property_lists_test.go
@@ -0,0 +1,60 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package upgrade
+
+import (
+	"testing"
+)
+
+// R3 (ako/mxcli#751): every old property-list spelling upgrades to exactly
+// create's `( Key: value, … )` list, and the colons to where R3 puts them. The
+// visitor test (mdl/visitor/r3_property_lists_test.go) proves each pair builds
+// the same statements; this one proves the rewrite produces that pair, in the
+// layout it was written in.
+func TestUpgrade_R3PropertyLists(t *testing.T) {
+	cases := []struct{ old, want string }{
+		{"alter settings runtime AfterStartupMicroflow = 'M.Startup', BcryptCost = 11;\n",
+			"alter settings runtime ( AfterStartupMicroflow: 'M.Startup', BcryptCost: 11 );\n"},
+		// describe's old layout: one property per line.
+		{"alter settings runtime\n  HashAlgorithm = 'BCrypt',\n  BcryptCost = 11;\n",
+			"alter settings runtime (\n  HashAlgorithm: 'BCrypt',\n  BcryptCost: 11\n);\n"},
+		{"ALTER SETTINGS MODEL BcryptCost = 11;\n", "ALTER SETTINGS RUNTIME ( BcryptCost: 11 );\n"},
+		// Indented: the closing parenthesis lines up with the statement.
+		{"  alter settings configuration 'Default'\n    HttpPortNumber = 8080;\n",
+			"  alter settings configuration 'Default' (\n    HttpPortNumber: 8080\n  );\n"},
+		{"alter settings LANGUAGE\n  DefaultLanguageCode = 'en_US';\n",
+			"alter settings LANGUAGE (\n  DefaultLanguageCode: 'en_US'\n);\n"},
+		{"alter settings configuration 'Default' HttpPortNumber = 8080;\n",
+			"alter settings configuration 'Default' ( HttpPortNumber: 8080 );\n"},
+		{"create or modify configuration 'Acc'\n  DatabaseType = 'HSQLDB',\n  HttpPortNumber = 8081;\n",
+			"create or modify configuration 'Acc' (\n  DatabaseType: 'HSQLDB',\n  HttpPortNumber: 8081\n);\n"},
+		{"alter odata client M.Crm set Version = '2.0', HttpUsername = 'Bearer ' + @M.Token;\n",
+			"alter consumed odata service M.Crm set ( Version: '2.0', HttpUsername: 'Bearer ' + @M.Token );\n"},
+		{"ALTER PUBLISHED ODATA SERVICE M.Api SET Version='2.0.0';\n",
+			"ALTER PUBLISHED ODATA SERVICE M.Api SET ( Version:'2.0.0' );\n"},
+		{"alter styling on page M.P widget ctn1 set Class = 'card', 'Full width' = on;\n",
+			"alter styling on page M.P widget ctn1 set ( Class: 'card', 'Full width': on );\n"},
+		{"alter styling on page M.P widget ctn1 set ( Class = 'card' ) clear design properties;\n",
+			"alter styling on page M.P widget ctn1 set ( Class: 'card' ) clear design properties;\n"},
+		{"alter entity M.Remote set allow_create_change_locally = true;\n",
+			"alter entity M.Remote set ( AllowCreateChangeLocally: true );\n"},
+		{"alter entity M.E modify attribute Code String(20), modify column Amount Decimal;\n",
+			"alter entity M.E modify attribute Code: String(20), modify column Amount: Decimal;\n"},
+		{"create association M.A_B from M.A to M.B type: Reference owner:Both storage :Table;\n",
+			"create association M.A_B from M.A to M.B type Reference owner Both storage Table;\n"},
+		{"alter page M.P {\n  set Caption = 'Save' on btnSave;\n  set (Caption = 'x', ButtonStyle = Success) on b2;\n  set Title: 'T';\n  drop widget a, b;\n};\n",
+			"alter page M.P {\n  set (Caption: 'Save') on btnSave;\n  set (Caption: 'x', ButtonStyle: Success) on b2;\n  set (Title: 'T');\n  drop a, b;\n};\n"},
+		// A nested respelling inside the value is rewritten with the list.
+		{"alter page M.P { set Action = show_page M.Q(Item: $currentObject) on b; };\n",
+			"alter page M.P { set (Action: show page M.Q(Item = $currentObject)) on b; };\n"},
+	}
+	for _, c := range cases {
+		res := mustUpgrade(t, c.old, Options{})
+		if res.Source != c.want {
+			t.Errorf("upgrade of\n%s got:\n%s want:\n%s", c.old, res.Source, c.want)
+		}
+		if again := mustUpgrade(t, res.Source, Options{}); again.Changed() {
+			t.Errorf("upgrade is not idempotent on\n%s", res.Source)
+		}
+	}
+}
diff --git a/mdl/visitor/r3_property_lists_test.go b/mdl/visitor/r3_property_lists_test.go
new file mode 100644
index 0000000000..3696dcc8e0
--- /dev/null
+++ b/mdl/visitor/r3_property_lists_test.go
@@ -0,0 +1,140 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package visitor
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
+)
+
+// r3Pairs are R3's old spellings and their canonical forms (ako/mxcli#751): an
+// `alter` sets properties in create's `( Key: value, … )` list, a clause takes
+// no colon and an attribute definition always has one. Both spellings must
+// parse and build the same statements; only the old one may record the code,
+// and it must carry the rewrite `fmt --upgrade` applies.
+var r3Pairs = []r8Pair{
+	// alter settings, every section, and configurations.
+	{"settings runtime", "alter settings runtime AfterStartupMicroflow = 'M.Startup', BcryptCost = 11, UseOQLVersion2 = true;",
+		"alter settings runtime ( AfterStartupMicroflow: 'M.Startup', BcryptCost: 11, UseOQLVersion2: true );", deprecation.SettingsAssignment},
+	{"settings runtime qualified name", "alter settings runtime AfterStartupMicroflow = M.Startup;",
+		"alter settings runtime ( AfterStartupMicroflow: M.Startup );", deprecation.SettingsAssignment},
+	{"settings language", "alter settings language DefaultLanguageCode = 'en_US';",
+		"alter settings language ( DefaultLanguageCode: 'en_US' );", deprecation.SettingsAssignment},
+	{"settings workflows", "alter settings workflows UserEntity = 'System.User', DefaultTaskParallelism = 3;",
+		"alter settings workflows ( UserEntity: 'System.User', DefaultTaskParallelism: 3 );", deprecation.SettingsAssignment},
+	{"settings configuration", "alter settings configuration 'Default' DatabaseType = 'POSTGRESQL', HttpPortNumber = 8080;",
+		"alter settings configuration 'Default' ( DatabaseType: 'POSTGRESQL', HttpPortNumber: 8080 );", deprecation.SettingsAssignment},
+	{"create configuration", "create or modify configuration 'Acc' DatabaseType = 'HSQLDB', HttpPortNumber = 8081;",
+		"create or modify configuration 'Acc' ( DatabaseType: 'HSQLDB', HttpPortNumber: 8081 );", deprecation.SettingsAssignment},
+
+	// alter odata service / client.
+	{"odata client", "alter consumed odata service M.Crm set Version = '2.0', MetadataUrl = 'https://x.org/$metadata';",
+		"alter consumed odata service M.Crm set ( Version: '2.0', MetadataUrl: 'https://x.org/$metadata' );", deprecation.ODataAlterAssignment},
+	{"odata client expression", "alter consumed odata service M.Crm set HttpUsername = 'Bearer ' + @M.Token;",
+		"alter consumed odata service M.Crm set ( HttpUsername: 'Bearer ' + @M.Token );", deprecation.ODataAlterAssignment},
+	{"odata service", "alter published odata service M.Api set Version = '2.0.0', Summary = 'Orders';",
+		"alter published odata service M.Api set ( Version: '2.0.0', Summary: 'Orders' );", deprecation.ODataAlterAssignment},
+
+	// alter styling.
+	{"styling equals", "alter styling on page M.P widget ctn1 set Class = 'card', Style = 'margin: 0;', 'Spacing top' = 'Large', 'Full width' = on;",
+		"alter styling on page M.P widget ctn1 set ( Class: 'card', Style: 'margin: 0;', 'Spacing top': 'Large', 'Full width': on );", deprecation.StylingAssignment},
+	{"styling colon unparenthesised", "alter styling on snippet M.S widget ctn1 set 'Full width': off;",
+		"alter styling on snippet M.S widget ctn1 set ( 'Full width': off );", deprecation.StylingAssignment},
+	{"styling parenthesised equals", "alter styling on page M.P widget ctn1 set ( Class = 'card' ) clear design properties;",
+		"alter styling on page M.P widget ctn1 set ( Class: 'card' ) clear design properties;", deprecation.StylingAssignment},
+
+	// alter entity.
+	{"allow create change locally", "alter entity M.Remote set allow_create_change_locally = false;",
+		"alter entity M.Remote set ( AllowCreateChangeLocally: false );", deprecation.AllowCreateChangeLocally},
+	{"allow create change locally camel", "alter entity M.Remote set AllowCreateChangeLocally = true;",
+		"alter entity M.Remote set ( AllowCreateChangeLocally: true );", deprecation.AllowCreateChangeLocally},
+	{"modify attribute", "alter entity M.E modify attribute Code String(20) default 'x';",
+		"alter entity M.E modify attribute Code: String(20) default 'x';", deprecation.ModifyAttributeColon},
+	{"modify column", "alter entity M.E modify column Amount Decimal;",
+		"alter entity M.E modify column Amount: Decimal;", deprecation.ModifyAttributeColon},
+
+	// association clauses.
+	{"association type", "create association M.A_B from M.A to M.B type: Reference owner: Both storage: Table;",
+		"create association M.A_B from M.A to M.B type Reference owner Both storage Table;", deprecation.AssociationClauseColon},
+
+	// alter page / snippet / layout (MDL-DEPR101..103, folded into the registry).
+	{"page set equals", "alter page M.P { set Caption = 'Save' on btnSave; set (Caption = 'x', ButtonStyle = Success) on b2; };",
+		"alter page M.P { set (Caption: 'Save') on btnSave; set (Caption: 'x', ButtonStyle: Success) on b2; };", deprecation.AlterPageSetEquals},
+	{"page set unparenthesised", "alter snippet M.S { set Title: 'T'; };",
+		"alter snippet M.S { set (Title: 'T'); };", deprecation.AlterPageSetUnparenthesised},
+	{"page drop widget", "alter layout M.L { drop widget a, b; };",
+		"alter layout M.L { drop a, b; };", deprecation.AlterPageDropWidget},
+}
+
+func TestR3OldSpellingsAreAliases(t *testing.T) {
+	for _, p := range r3Pairs {
+		t.Run(p.name, func(t *testing.T) {
+			old := mustBuild(t, p.old)
+			canon := mustBuild(t, p.canon)
+			if got := deprecationCodes(canon); len(got) != 0 {
+				t.Errorf("canonical %q recorded %v, want none", p.canon, got)
+			}
+			got := deprecationCodes(old)
+			if len(got) == 0 {
+				t.Fatalf("old %q recorded nothing, want %s", p.old, p.code)
+			}
+			for _, d := range old.Deprecations {
+				if d.Code != p.code {
+					t.Errorf("old %q recorded %v, want only %s", p.old, got, p.code)
+				}
+				if d.Fix == nil {
+					t.Errorf("old %q: %s recorded without a rewrite (%s)", p.old, d.Code, d.NoFix)
+				}
+			}
+			if len(old.Statements) == 0 {
+				t.Fatalf("old %q built no statement", p.old)
+			}
+			if !reflect.DeepEqual(old.Statements, canon.Statements) {
+				t.Errorf("old and canonical build different statements:\n old:   %#v\n canon: %#v", old.Statements, canon.Statements)
+			}
+		})
+	}
+}
+
+// The canonical list is read, not merely parsed: each form must build the
+// values the executor acts on. Guards against a list alternative the visitor
+// never looks at, which would pass the pair test above only if both halves
+// built nothing — so the values are pinned here.
+func TestR3CanonicalListsCarryTheirValues(t *testing.T) {
+	settings := mustBuild(t, "alter settings runtime ( BcryptCost: 11, UseOQLVersion2: true );").Statements[0].(*ast.AlterSettingsStmt)
+	if settings.Properties["BcryptCost"] != int64(11) || settings.Properties["UseOQLVersion2"] != true {
+		t.Errorf("settings properties: %#v", settings.Properties)
+	}
+	cfg := mustBuild(t, "create configuration 'Acc' ( HttpPortNumber: 8081 );").Statements[0].(*ast.CreateConfigurationStmt)
+	if cfg.Properties["HttpPortNumber"] != "8081" {
+		t.Errorf("configuration properties: %#v", cfg.Properties)
+	}
+	client := mustBuild(t, "alter consumed odata service M.Crm set ( Version: '2.0', HttpUsername: 'Bearer ' + @M.Token );").Statements[0].(*ast.AlterODataClientStmt)
+	if client.Changes["Version"] != "2.0" || client.Changes["HttpUsername"] != "'Bearer ' + @M.Token" {
+		t.Errorf("odata client changes: %#v", client.Changes)
+	}
+	styling := mustBuild(t, "alter styling on page M.P widget c set ( Class: 'card', 'Full width': on );").Statements[0].(*ast.AlterStylingStmt)
+	if len(styling.Assignments) != 2 || styling.Assignments[0].Value != "card" || !styling.Assignments[1].ToggleOn {
+		t.Errorf("styling assignments: %#v", styling.Assignments)
+	}
+	entity := mustBuild(t, "alter entity M.Remote set ( AllowCreateChangeLocally: true );").Statements[0].(*ast.AlterEntityStmt)
+	if entity.Operation != ast.AlterEntitySetAllowCreateChangeLocally || !entity.BoolValue {
+		t.Errorf("alter entity: %#v", entity)
+	}
+}
+
+// An expression is refused on an OData property that takes a plain value, in
+// the canonical list as in the old spelling.
+func TestR3ODataListRefusesExpressionOnPlainProperty(t *testing.T) {
+	for _, src := range []string{
+		"alter published odata service M.Api set ( Version: '1' + '2' );",
+		"alter consumed odata service M.Crm set ( Version: '1' + '2' );",
+	} {
+		if _, errs := Build(src); len(errs) == 0 {
+			t.Errorf("%q: want an error for an expression on Version", src)
+		}
+	}
+}
diff --git a/mdl/visitor/r8_spellings_test.go b/mdl/visitor/r8_spellings_test.go
index 612bb81d2e..a2060ab230 100644
--- a/mdl/visitor/r8_spellings_test.go
+++ b/mdl/visitor/r8_spellings_test.go
@@ -38,8 +38,8 @@ var r8Pairs = []r8Pair{
 	{"complete task", pageWith("complete_task 'Approve'"), pageWith("complete task 'Approve'"), deprecation.PageActionWord},
 	{"menu sign out", "create navigation Responsive home page M.Home menu (menu item 'Out' sign_out;);",
 		"create navigation Responsive home page M.Home menu (menu item 'Out' sign out;);", deprecation.PageActionWord},
-	{"alter page set action", "alter page M.P { set Action = show_page M.Q on b };",
-		"alter page M.P { set Action = show page M.Q on b };", deprecation.PageActionWord},
+	{"alter page set action", "alter page M.P { set (Action: show_page M.Q) on b };",
+		"alter page M.P { set (Action: show page M.Q) on b };", deprecation.PageActionWord},
 
 	{"not null error", "create entity M.E (Name: String(100) not null error 'Required');",
 		"create entity M.E (Name: String(100) not null error message 'Required');", deprecation.ErrorMessageKeyword},
diff --git a/mdl/visitor/visitor_alter.go b/mdl/visitor/visitor_alter.go
index 5c54bc6bba..8c56e611f1 100644
--- a/mdl/visitor/visitor_alter.go
+++ b/mdl/visitor/visitor_alter.go
@@ -68,19 +68,29 @@ func (b *Builder) ExitAlterStatement(ctx *parser.AlterStatementContext) {
 	}
 
 	changes := make(map[string]any)
-	for _, propCtx := range ctx.AllOdataAlterAssignment() {
-		prop := propCtx.(*parser.OdataAlterAssignmentContext)
-		name := identifierOrKeywordText(prop.IdentifierOrKeyword())
+	// One property, in either spelling: `set ( Key: value, … )` or the old
+	// `set Key = value, …` (MDL-DEPR061). Both build the same statement.
+	set := func(name string, value parser.IOdataPropertyValueContext, expr parser.IExpressionContext) {
 		if ctx.ConsumedODataServiceKw() != nil && isODataClientExpressionProp(name) {
 			// Expression-typed: the expression as written (see visitor_odata_expression.go).
-			changes[name], _ = odataExpressionValue(prop.OdataPropertyValue(), prop.Expression())
-			continue
+			changes[name], _ = odataExpressionValue(value, expr)
+			return
 		}
-		val := prop.OdataPropertyValue()
-		if val != nil {
-			changes[name] = odataValueText(val.(*parser.OdataPropertyValueContext))
+		if value != nil {
+			changes[name] = odataValueText(value.(*parser.OdataPropertyValueContext))
+		}
+	}
+	if pl, ok := ctx.OdataAlterPropertyList().(*parser.OdataAlterPropertyListContext); ok && pl != nil {
+		for _, propCtx := range pl.AllOdataPropertyAssignment() {
+			prop := propCtx.(*parser.OdataPropertyAssignmentContext)
+			set(identifierOrKeywordText(prop.IdentifierOrKeyword()), prop.OdataPropertyValue(), prop.Expression())
 		}
 	}
+	for _, propCtx := range ctx.AllOdataAlterAssignment() {
+		prop := propCtx.(*parser.OdataAlterAssignmentContext)
+		set(identifierOrKeywordText(prop.IdentifierOrKeyword()), prop.OdataPropertyValue(), prop.Expression())
+	}
+	b.recordODataAlterAssignments(ctx)
 
 	if ctx.ConsumedODataServiceKw() != nil {
 		b.statements = append(b.statements, &ast.AlterODataClientStmt{
diff --git a/mdl/visitor/visitor_alter_alias_equivalence_test.go b/mdl/visitor/visitor_alter_alias_equivalence_test.go
index d48d43d73b..1908417a4c 100644
--- a/mdl/visitor/visitor_alter_alias_equivalence_test.go
+++ b/mdl/visitor/visitor_alter_alias_equivalence_test.go
@@ -5,13 +5,11 @@ package visitor
 import (
 	"reflect"
 	"testing"
-
-	"github.com/mendixlabs/mxcli/mdl/ast"
 )
 
 // ADR-0011: an alias parses to the IDENTICAL operation as its canonical form —
-// the only difference allowed is the Legacy marker that drives the
-// deprecation warning. Without this, an alias could silently build a different
+// the only difference allowed is the deprecation the visitor records for the
+// old spelling. Without this, an alias could silently build a different
 // change (a value parsed through another rule, a target dropped) and the
 // warning would tell the user the two are interchangeable when they are not.
 // `fmt --upgrade` relies on the same equivalence (ADR-0011, Negative).
@@ -22,8 +20,8 @@ func TestGenericAlter_AliasesBuildTheIdenticalOperation(t *testing.T) {
 		{"set unparenthesised colon", `set Caption: 'Save' on btnSave`, `set (Caption: 'Save') on btnSave`},
 		{"page-level set", `set Title = 'Edit'`, `set (Title: 'Edit')`},
 		{"quoted key", `set 'showLabel' = false on w1`, `set ('showLabel': false) on w1`},
-		{"action", `set Action = microflow M.ACT on btnGo`, `set (Action: microflow M.ACT) on btnGo`},
-		{"named action slot", `set 'createFileAction' = microflow M.F on up1`, `set ('createFileAction': microflow M.F) on up1`},
+		{"action", `set Action = call microflow M.ACT on btnGo`, `set (Action: call microflow M.ACT) on btnGo`},
+		{"named action slot", `set 'createFileAction' = call microflow M.F on up1`, `set ('createFileAction': call microflow M.F) on up1`},
 		{"datasource", `set DataSource = $Param on dv1`, `set (DataSource: $Param) on dv1`},
 		{"visible", `set Visible = [Name != ''] on txt1`, `set (Visible: [Name != '']) on txt1`},
 		{"expression", `set DynamicClasses = if $x/F then 'a' else '' on c1`, `set (DynamicClasses: if $x/F then 'a' else '') on c1`},
@@ -32,40 +30,22 @@ func TestGenericAlter_AliasesBuildTheIdenticalOperation(t *testing.T) {
 	}
 	for _, p := range pairs {
 		t.Run(p.name, func(t *testing.T) {
+			oldProg := mustBuild(t, "alter page M.P { "+p.old+"; };")
+			canonProg := mustBuild(t, "alter page M.P { "+p.canonical+"; };")
 			old := buildAlterPage(t, "alter page M.P { "+p.old+"; };").Operations
 			canon := buildAlterPage(t, "alter page M.P { "+p.canonical+"; };").Operations
 			if len(old) != 1 || len(canon) != 1 {
 				t.Fatalf("want one operation each, got %d and %d", len(old), len(canon))
 			}
-			if legacyOf(old[0]) == "" {
-				t.Fatalf("old spelling %q not flagged as an alias", p.old)
+			if len(oldProg.Deprecations) != 1 {
+				t.Fatalf("old spelling %q recorded %v, want one deprecation", p.old, deprecationCodes(oldProg))
 			}
-			if legacyOf(canon[0]) != "" {
-				t.Fatalf("canonical spelling %q flagged as alias %q", p.canonical, legacyOf(canon[0]))
+			if got := deprecationCodes(canonProg); len(got) != 0 {
+				t.Fatalf("canonical spelling %q recorded %v", p.canonical, got)
 			}
-			clearLegacy(old[0])
 			if !reflect.DeepEqual(old[0], canon[0]) {
 				t.Errorf("alias builds a different operation:\n old:       %#v\n canonical: %#v", old[0], canon[0])
 			}
 		})
 	}
 }
-
-func legacyOf(op ast.AlterPageOperation) string {
-	switch o := op.(type) {
-	case *ast.SetPropertyOp:
-		return o.Legacy
-	case *ast.DropWidgetOp:
-		return o.Legacy
-	}
-	return ""
-}
-
-func clearLegacy(op ast.AlterPageOperation) {
-	switch o := op.(type) {
-	case *ast.SetPropertyOp:
-		o.Legacy = ""
-	case *ast.DropWidgetOp:
-		o.Legacy = ""
-	}
-}
diff --git a/mdl/visitor/visitor_alter_generic_test.go b/mdl/visitor/visitor_alter_generic_test.go
index 81de337312..10cea2c380 100644
--- a/mdl/visitor/visitor_alter_generic_test.go
+++ b/mdl/visitor/visitor_alter_generic_test.go
@@ -6,6 +6,7 @@ import (
 	"testing"
 
 	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
 )
 
 // The generic ALTER (ADR-0012 decision 2, ako/mxcli#712): one grammar rule
@@ -31,10 +32,14 @@ func buildAlterPage(t *testing.T, input string) *ast.AlterPageStmt {
 }
 
 func TestGenericAlter_CanonicalSetIsParenthesisedAndColon(t *testing.T) {
-	stmt := buildAlterPage(t, `alter page Module.Page {
+	const src = `alter page Module.Page {
 		set (Caption: 'Save', ButtonStyle: Success) on btnSave;
 		set (Title: 'Edit order');
-	};`)
+	};`
+	stmt := buildAlterPage(t, src)
+	if got := deprecationCodes(mustBuild(t, src)); len(got) != 0 {
+		t.Errorf("canonical set must not be reported as an alias, got %v", got)
+	}
 	if len(stmt.Operations) != 2 {
 		t.Fatalf("want 2 operations, got %d", len(stmt.Operations))
 	}
@@ -45,22 +50,20 @@ func TestGenericAlter_CanonicalSetIsParenthesisedAndColon(t *testing.T) {
 	if onWidget.Properties["Caption"] != "Save" || onWidget.Properties["ButtonStyle"] != "Success" {
 		t.Errorf("properties: got %v", onWidget.Properties)
 	}
-	if onWidget.Legacy != "" {
-		t.Errorf("canonical set must not be flagged as an alias, got %q", onWidget.Legacy)
-	}
 	pageLevel := stmt.Operations[1].(*ast.SetPropertyOp)
 	if pageLevel.Target.Widget != "" || pageLevel.Properties["Title"] != "Edit order" {
 		t.Errorf("page-level set: target %q, properties %v", pageLevel.Target.Widget, pageLevel.Properties)
 	}
-	if pageLevel.Legacy != "" {
-		t.Errorf("canonical page-level set flagged as alias: %q", pageLevel.Legacy)
-	}
 }
 
 func TestGenericAlter_CanonicalDropNamesTargetsWithoutKeyword(t *testing.T) {
-	stmt := buildAlterPage(t, `alter snippet Module.Snip {
+	const src = `alter snippet Module.Snip {
 		drop txtOld, dgOrders.Total;
-	};`)
+	};`
+	stmt := buildAlterPage(t, src)
+	if got := deprecationCodes(mustBuild(t, src)); len(got) != 0 {
+		t.Errorf("canonical drop reported as an alias: %v", got)
+	}
 	if stmt.ContainerType != "SNIPPET" {
 		t.Errorf("container type: got %q", stmt.ContainerType)
 	}
@@ -69,18 +72,16 @@ func TestGenericAlter_CanonicalDropNamesTargetsWithoutKeyword(t *testing.T) {
 		drop.Targets[1].Widget != "dgOrders" || drop.Targets[1].Column != "Total" {
 		t.Errorf("targets: got %+v", drop.Targets)
 	}
-	if drop.Legacy != "" {
-		t.Errorf("canonical drop flagged as alias: %q", drop.Legacy)
-	}
 }
 
 // A widget may be NAMED like a keyword the old forms use; the canonical drop
 // of it must still parse as a drop of that name.
 func TestGenericAlter_DropOfWidgetNamedLikeAKeyword(t *testing.T) {
-	stmt := buildAlterPage(t, `alter page Module.Page { drop widget; };`)
+	const src = `alter page Module.Page { drop widget; };`
+	stmt := buildAlterPage(t, src)
 	drop := stmt.Operations[0].(*ast.DropWidgetOp)
-	if len(drop.Targets) != 1 || drop.Targets[0].Widget != "widget" || drop.Legacy != "" {
-		t.Errorf("got %+v legacy=%q", drop.Targets, drop.Legacy)
+	if got := deprecationCodes(mustBuild(t, src)); len(drop.Targets) != 1 || drop.Targets[0].Widget != "widget" || len(got) != 0 {
+		t.Errorf("got %+v, deprecations %v", drop.Targets, got)
 	}
 }
 
@@ -114,26 +115,17 @@ func TestGenericAlter_OldSpellingsAreFlaggedAliases(t *testing.T) {
 		name, op string
 		legacy   string
 	}{
-		{"set without parentheses", `set Caption = 'Save' on btnSave`, ast.AlterAliasSetEquals},
-		{"page-level set without parentheses", `set Title = 'Edit'`, ast.AlterAliasSetEquals},
-		{"parenthesised set with =", `set (Caption = 'Save', ButtonStyle = Success) on btnSave`, ast.AlterAliasSetEquals},
-		{"set without parentheses, with colon", `set Caption: 'Save' on btnSave`, ast.AlterAliasSetUnparenthesised},
-		{"drop widget", `drop widget txtOld, txtUnused`, ast.AlterAliasDropWidget},
+		{"set without parentheses", `set Caption = 'Save' on btnSave`, deprecation.AlterPageSetEquals},
+		{"page-level set without parentheses", `set Title = 'Edit'`, deprecation.AlterPageSetEquals},
+		{"parenthesised set with =", `set (Caption = 'Save', ButtonStyle = Success) on btnSave`, deprecation.AlterPageSetEquals},
+		{"set without parentheses, with colon", `set Caption: 'Save' on btnSave`, deprecation.AlterPageSetUnparenthesised},
+		{"drop widget", `drop widget txtOld, txtUnused`, deprecation.AlterPageDropWidget},
 	}
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
-			stmt := buildAlterPage(t, "alter page Module.Page { "+c.op+"; };")
-			var got string
-			switch o := stmt.Operations[0].(type) {
-			case *ast.SetPropertyOp:
-				got = o.Legacy
-			case *ast.DropWidgetOp:
-				got = o.Legacy
-			default:
-				t.Fatalf("unexpected op %T", o)
-			}
-			if got != c.legacy {
-				t.Errorf("legacy spelling: got %q, want %q", got, c.legacy)
+			got := deprecationCodes(mustBuild(t, "alter page Module.Page { "+c.op+"; };"))
+			if len(got) != 1 || got[0] != c.legacy {
+				t.Errorf("recorded %v, want [%s]", got, c.legacy)
 			}
 		})
 	}
diff --git a/mdl/visitor/visitor_alter_page.go b/mdl/visitor/visitor_alter_page.go
index 326905bffa..063696b1ec 100644
--- a/mdl/visitor/visitor_alter_page.go
+++ b/mdl/visitor/visitor_alter_page.go
@@ -86,26 +86,14 @@ func (b *Builder) buildAlterSet(ctx *parser.AlterSetContext) ast.AlterPageOperat
 		}
 	}
 
-	usedEquals := false
 	for _, assignCtx := range ctx.AllAlterPageAssignment() {
 		assign := assignCtx.(*parser.AlterPageAssignmentContext)
-		if ao := assign.AlterAssignOp(); ao != nil && ao.(*parser.AlterAssignOpContext).EQUALS() != nil {
-			usedEquals = true
-		}
 		name, value := b.buildAlterPageAssignment(assign)
 		if name != "" {
 			op.Properties[name] = value
 		}
 	}
-
-	// Which alias, if any. `=` is reported first: its rewrite — the
-	// parenthesised, colon form — also fixes a missing parenthesis.
-	switch {
-	case usedEquals:
-		op.Legacy = ast.AlterAliasSetEquals
-	case ctx.LPAREN() == nil:
-		op.Legacy = ast.AlterAliasSetUnparenthesised
-	}
+	b.recordAlterPageSet(ctx)
 
 	return op
 }
@@ -225,9 +213,7 @@ func (b *Builder) buildAlterInsert(ctx *parser.AlterInsertContext) *ast.InsertWi
 // buildAlterDrop builds a DropWidgetOp from the parse tree.
 func (b *Builder) buildAlterDrop(ctx *parser.AlterDropContext) *ast.DropWidgetOp {
 	op := &ast.DropWidgetOp{}
-	if ctx.WIDGET() != nil {
-		op.Legacy = ast.AlterAliasDropWidget
-	}
+	b.recordAlterPageDropWidget(ctx)
 	for _, tr := range ctx.AllAlterTarget() {
 		op.Targets = append(op.Targets, b.buildAlterTarget(tr))
 	}
diff --git a/mdl/visitor/visitor_document_names_test.go b/mdl/visitor/visitor_document_names_test.go
index 4b00ed67a6..46b26d3f34 100644
--- a/mdl/visitor/visitor_document_names_test.go
+++ b/mdl/visitor/visitor_document_names_test.go
@@ -31,7 +31,7 @@ func TestDocumentTypeNamesFollowStudioPro(t *testing.T) {
 		{deprecation.ConsumedODataService,
 			"create odata client M.Crm (ODataVersion: OData4, MetadataUrl: 'https://x/$metadata');",
 			"create consumed odata service M.Crm (ODataVersion: OData4, MetadataUrl: 'https://x/$metadata');"},
-		{deprecation.ConsumedODataService, "alter odata client M.Crm set Version = '2';", "alter consumed odata service M.Crm set Version = '2';"},
+		{deprecation.ConsumedODataService, "alter odata client M.Crm set ( Version: '2' );", "alter consumed odata service M.Crm set ( Version: '2' );"},
 		{deprecation.ConsumedODataService, "drop odata client M.Crm;", "drop consumed odata service M.Crm;"},
 		{deprecation.ConsumedODataService, "describe odata client M.Crm;", "describe consumed odata service M.Crm;"},
 		{deprecation.ConsumedODataService, "list odata clients;", "list consumed odata services;"},
@@ -43,7 +43,7 @@ func TestDocumentTypeNamesFollowStudioPro(t *testing.T) {
 		{deprecation.PublishedODataService,
 			"create odata service M.Api (Path: 'odata/v1', Namespace: 'M');",
 			"create published odata service M.Api (Path: 'odata/v1', Namespace: 'M');"},
-		{deprecation.PublishedODataService, "alter odata service M.Api set Version = '2';", "alter published odata service M.Api set Version = '2';"},
+		{deprecation.PublishedODataService, "alter odata service M.Api set ( Version: '2' );", "alter published odata service M.Api set ( Version: '2' );"},
 		{deprecation.PublishedODataService, "drop odata service M.Api;", "drop published odata service M.Api;"},
 		{deprecation.PublishedODataService, "describe odata service M.Api;", "describe published odata service M.Api;"},
 		{deprecation.PublishedODataService, "list odata services in M;", "list published odata services in M;"},
@@ -61,8 +61,8 @@ func TestDocumentTypeNamesFollowStudioPro(t *testing.T) {
 		{deprecation.AppSecurity, "alter project security guest access on role Guest;", "alter app security guest access on role Guest;"},
 		{deprecation.AppSecurity, "alter project security strict mode on;", "alter app security strict mode on;"},
 		// settings runtime
-		{deprecation.SettingsRuntime, "alter settings model BcryptCost = 11, HashAlgorithm = 'BCrypt';", "alter settings runtime BcryptCost = 11, HashAlgorithm = 'BCrypt';"},
-		{deprecation.SettingsRuntime, "ALTER SETTINGS MODEL BcryptCost = 11;", "ALTER SETTINGS RUNTIME BcryptCost = 11;"},
+		{deprecation.SettingsRuntime, "alter settings model ( BcryptCost: 11, HashAlgorithm: 'BCrypt' );", "alter settings runtime ( BcryptCost: 11, HashAlgorithm: 'BCrypt' );"},
+		{deprecation.SettingsRuntime, "ALTER SETTINGS MODEL (BcryptCost: 11);", "ALTER SETTINGS RUNTIME (BcryptCost: 11);"},
 	}
 	for _, c := range cases {
 		t.Run(c.old, func(t *testing.T) {
@@ -94,7 +94,7 @@ func TestDocumentTypeNamesLeaveOtherUsesAlone(t *testing.T) {
 		"drop published rest service M.Api;",
 		"list consumed mcp services;",
 		"show project security;",
-		"alter settings workflows UserEntity = 'System.User';",
+		"alter settings workflows ( UserEntity: 'System.User' );",
 	} {
 		t.Run(src, func(t *testing.T) {
 			if got := deprecationCodes(mustBuild(t, src)); len(got) != 0 {
diff --git a/mdl/visitor/visitor_entity.go b/mdl/visitor/visitor_entity.go
index 1811689b7f..711ac31a6c 100644
--- a/mdl/visitor/visitor_entity.go
+++ b/mdl/visitor/visitor_entity.go
@@ -604,6 +604,9 @@ func parseAnnotationParamInt(ctx parser.IAnnotationParamContext) int {
 
 // ExitAlterEntityAction handles ALTER ENTITY ... ADD/DROP/RENAME/MODIFY ATTRIBUTE ...
 func (b *Builder) ExitAlterEntityAction(ctx *parser.AlterEntityActionContext) {
+	// R3 respellings (visitor_r3_property_lists.go).
+	b.recordAllowCreateChangeLocally(ctx)
+	b.recordModifyAttributeColon(ctx)
 	// Walk up to the parent AlterStatement to get the entity's qualified name
 	parent := ctx.GetParent()
 	for parent != nil {
diff --git a/mdl/visitor/visitor_odata_expression.go b/mdl/visitor/visitor_odata_expression.go
index 1ab3f31044..7862d5ac87 100644
--- a/mdl/visitor/visitor_odata_expression.go
+++ b/mdl/visitor/visitor_odata_expression.go
@@ -66,6 +66,12 @@ func (b *Builder) ExitOdataPropertyAssignment(ctx *parser.OdataPropertyAssignmen
 	if _, onClient := ctx.GetParent().(*parser.CreateODataClientStatementContext); onClient && isODataClientExpressionProp(name) {
 		return
 	}
+	// `alter consumed odata service X set ( Key: expr )` takes the same list.
+	if list, ok := ctx.GetParent().(*parser.OdataAlterPropertyListContext); ok && isODataClientExpressionProp(name) {
+		if alter, ok := list.GetParent().(*parser.AlterStatementContext); ok && alter.ConsumedODataServiceKw() != nil {
+			return
+		}
+	}
 	b.addError(odataExpressionNotAllowed(name, ctx.Expression()))
 }
 
diff --git a/mdl/visitor/visitor_r3_property_lists.go b/mdl/visitor/visitor_r3_property_lists.go
new file mode 100644
index 0000000000..7087deca97
--- /dev/null
+++ b/mdl/visitor/visitor_r3_property_lists.go
@@ -0,0 +1,300 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package visitor
+
+import (
+	"strings"
+
+	"github.com/antlr4-go/antlr/v4"
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
+	"github.com/mendixlabs/mxcli/mdl/grammar/parser"
+)
+
+// R3 (PROPOSAL_mdl_beta_syntax_freeze.md §3, ako/mxcli#751): `:` sets a model
+// property. An `alter` sets properties in exactly the `( Key: value, … )` list
+// its `create` takes, so a fragment of describe output pastes into an alter
+// unchanged; a clause outside a property list takes no colon, and an attribute
+// definition always has one. Every old spelling here is a respelling — the
+// grammar builds the same statement from both — so each use is recorded as a
+// deprecation with the edits that rewrite it, and nothing is gated on the
+// language version.
+
+// oldAssignment is one `Key = value` of an old-spelling list, by the rune
+// offset where its key ends and the `=` token.
+type oldAssignment struct {
+	keyStop int
+	op      antlr.Token
+}
+
+// assignmentAt reads an assignment whose key is child 0 of ctx and whose
+// operator is the node op (a terminal or a one-token rule).
+func assignmentAt(ctx antlr.ParserRuleContext, op antlr.Tree) (oldAssignment, bool) {
+	if ctx == nil || op == nil || ctx.GetChildCount() == 0 {
+		return oldAssignment{}, false
+	}
+	_, keyStop := nodeSpan(ctx.GetChild(0))
+	var tok antlr.Token
+	switch o := op.(type) {
+	case antlr.TerminalNode:
+		tok = o.GetSymbol()
+	case antlr.ParserRuleContext:
+		tok = o.GetStart()
+	}
+	if keyStop < 0 || tok == nil {
+		return oldAssignment{}, false
+	}
+	return oldAssignment{keyStop: keyStop, op: tok}, true
+}
+
+// colonEdits writes each assignment's `=` as `:`, directly after the key:
+// `Caption = 'x'` becomes `Caption: 'x'`.
+func colonEdits(as []oldAssignment) []ast.TextEdit {
+	out := make([]ast.TextEdit, 0, len(as))
+	for _, a := range as {
+		out = append(out, ast.TextEdit{Start: a.keyStop + 1, Stop: a.op.GetStop() + 1, Text: ":"})
+	}
+	return out
+}
+
+// wrapEdits puts the list from first to last in parentheses. A list that
+// starts on a new line after before (describe's layout) opens its parenthesis
+// on before's line and closes it on a line of its own, indented as that line
+// is; otherwise the parentheses hug the list, padded with a space when pad is
+// set.
+func wrapEdits(before, first, last antlr.Token, pad bool) []ast.TextEdit {
+	if before != nil && first != nil && before.GetInputStream() != nil {
+		is := before.GetInputStream()
+		gap := is.GetText(before.GetStop()+1, first.GetStart()-1)
+		if strings.Contains(gap, "\n") {
+			return []ast.TextEdit{
+				insertAt(before.GetStop()+1, " ("),
+				insertAt(last.GetStop()+1, "\n"+lineIndent(is, before.GetStart())+")"),
+			}
+		}
+	}
+	open, closing := "(", ")"
+	if pad {
+		open, closing = "( ", " )"
+	}
+	return []ast.TextEdit{insertAt(first.GetStart(), open), insertAt(last.GetStop()+1, closing)}
+}
+
+// recordOldList records code for an old-spelling assignment list written
+// after before, with the rewrite to `( Key: value, … )`.
+func (b *Builder) recordOldList(code string, before antlr.Token, first, last antlr.ParserRuleContext, as []oldAssignment, subject string) {
+	if first == nil || last == nil || first.GetStart() == nil || last.GetStop() == nil {
+		return
+	}
+	b.recordDeprecation(code, first.GetStart(), subject)
+	edits := append(colonEdits(as), wrapEdits(before, first.GetStart(), last.GetStop(), true)...)
+	b.fixLastDeprecation(code, &ast.Fix{Edits: edits}, "")
+}
+
+// recordAlterPageSet reports the generic alter's old `set` spellings:
+// `set Key = value` / `set (Key = value)` (MDL-DEPR101) and `set Key: value`
+// (MDL-DEPR102). `=` is reported first: its rewrite, the parenthesised colon
+// form, also adds a missing parenthesis.
+func (b *Builder) recordAlterPageSet(ctx *parser.AlterSetContext) {
+	assigns := ctx.AllAlterPageAssignment()
+	if len(assigns) == 0 {
+		return
+	}
+	var as []oldAssignment
+	for _, a := range assigns {
+		ac := a.(*parser.AlterPageAssignmentContext)
+		if op, ok := ac.AlterAssignOp().(*parser.AlterAssignOpContext); ok && op != nil && op.EQUALS() != nil {
+			if oa, ok := assignmentAt(ac, op); ok {
+				as = append(as, oa)
+			}
+		}
+	}
+	var edits []ast.TextEdit
+	code := deprecation.AlterPageSetEquals
+	switch {
+	case len(as) > 0:
+		edits = colonEdits(as)
+	case ctx.LPAREN() == nil:
+		code = deprecation.AlterPageSetUnparenthesised
+	default:
+		return
+	}
+	if ctx.LPAREN() == nil {
+		first := assigns[0].(*parser.AlterPageAssignmentContext).GetStart()
+		last := assigns[len(assigns)-1].(*parser.AlterPageAssignmentContext).GetStop()
+		edits = append(edits, insertAt(first.GetStart(), "("), insertAt(last.GetStop()+1, ")"))
+	}
+	b.recordDeprecation(code, ctx.SET().GetSymbol(), "alter set")
+	b.fixLastDeprecation(code, &ast.Fix{Edits: edits}, "")
+}
+
+// recordAlterPageDropWidget reports `drop widget a, b` (MDL-DEPR103).
+func (b *Builder) recordAlterPageDropWidget(ctx *parser.AlterDropContext) {
+	w := ctx.WIDGET()
+	targets := ctx.AllAlterTarget()
+	if w == nil || len(targets) == 0 {
+		return
+	}
+	tok := w.GetSymbol()
+	b.recordDeprecation(deprecation.AlterPageDropWidget, tok, "drop widget")
+	edit := ast.TextEdit{Start: tok.GetStart(), Stop: targets[0].GetStart().GetStart(), Text: ""}
+	b.fixLastDeprecation(deprecation.AlterPageDropWidget, &ast.Fix{Edits: []ast.TextEdit{edit}}, "")
+}
+
+// recordSettingsAssignments reports a settings list written `Key = value, …`
+// (MDL-DEPR060), in `alter settings` and `create configuration`.
+func (b *Builder) recordSettingsAssignments(assigns []parser.ISettingsAssignmentContext) {
+	if len(assigns) == 0 {
+		return
+	}
+	var as []oldAssignment
+	for _, a := range assigns {
+		ac := a.(*parser.SettingsAssignmentContext)
+		if oa, ok := assignmentAt(ac, ac.EQUALS()); ok {
+			as = append(as, oa)
+		}
+	}
+	first := assigns[0].(*parser.SettingsAssignmentContext)
+	b.recordOldList(deprecation.SettingsAssignment, tokenBefore(first), first,
+		assigns[len(assigns)-1].(*parser.SettingsAssignmentContext), as, "settings")
+}
+
+// recordODataAlterAssignments reports `alter … odata service X set Key =
+// value, …` (MDL-DEPR061).
+func (b *Builder) recordODataAlterAssignments(ctx *parser.AlterStatementContext) {
+	assigns := ctx.AllOdataAlterAssignment()
+	if len(assigns) == 0 {
+		return
+	}
+	var as []oldAssignment
+	for _, a := range assigns {
+		ac := a.(*parser.OdataAlterAssignmentContext)
+		if oa, ok := assignmentAt(ac, ac.EQUALS()); ok {
+			as = append(as, oa)
+		}
+	}
+	b.recordOldList(deprecation.ODataAlterAssignment, ctx.SET().GetSymbol(),
+		assigns[0].(*parser.OdataAlterAssignmentContext), assigns[len(assigns)-1].(*parser.OdataAlterAssignmentContext),
+		as, "odata service")
+}
+
+// ExitAlterStylingAction reports `alter styling … set Class = 'x', 'P' = on`
+// (MDL-DEPR062): an `=`, or a list without its parentheses.
+func (b *Builder) ExitAlterStylingAction(ctx *parser.AlterStylingActionContext) {
+	assigns := ctx.AllAlterStylingAssignment()
+	if ctx.SET() == nil || len(assigns) == 0 {
+		return
+	}
+	var as []oldAssignment
+	for _, a := range assigns {
+		ac := a.(*parser.AlterStylingAssignmentContext)
+		if op, ok := ac.AlterStylingAssignOp().(*parser.AlterStylingAssignOpContext); ok && op != nil && op.EQUALS() != nil {
+			if oa, ok := assignmentAt(ac, op); ok {
+				as = append(as, oa)
+			}
+		}
+	}
+	parenthesised := ctx.LPAREN() != nil
+	if len(as) == 0 && parenthesised {
+		return
+	}
+	edits := colonEdits(as)
+	first := assigns[0].(*parser.AlterStylingAssignmentContext)
+	last := assigns[len(assigns)-1].(*parser.AlterStylingAssignmentContext)
+	if !parenthesised {
+		edits = append(edits, wrapEdits(ctx.SET().GetSymbol(), first.GetStart(), last.GetStop(), true)...)
+	}
+	b.recordDeprecation(deprecation.StylingAssignment, ctx.SET().GetSymbol(), "alter styling")
+	b.fixLastDeprecation(deprecation.StylingAssignment, &ast.Fix{Edits: edits}, "")
+}
+
+// recordAllowCreateChangeLocally reports `set allow_create_change_locally =
+// v` (MDL-DEPR063), rewritten to `set ( AllowCreateChangeLocally: v )`.
+func (b *Builder) recordAllowCreateChangeLocally(ctx *parser.AlterEntityActionContext) {
+	key, eq := ctx.ALLOW_CREATE_CHANGE_LOCALLY(), ctx.EQUALS()
+	if ctx.SET() == nil || key == nil || eq == nil {
+		return
+	}
+	var value antlr.TerminalNode = ctx.TRUE()
+	if value == nil {
+		value = ctx.FALSE()
+	}
+	if value == nil {
+		return
+	}
+	kt := key.GetSymbol()
+	b.recordDeprecation(deprecation.AllowCreateChangeLocally, kt, "alter entity")
+	b.fixLastDeprecation(deprecation.AllowCreateChangeLocally, &ast.Fix{Edits: []ast.TextEdit{
+		{Start: kt.GetStart(), Stop: eq.GetSymbol().GetStop() + 1, Text: "( AllowCreateChangeLocally:"},
+		insertAt(value.GetSymbol().GetStop()+1, " )"),
+	}}, "")
+}
+
+// recordModifyAttributeColon reports `modify attribute A Type` (MDL-DEPR065),
+// rewritten to `modify attribute A: Type`.
+func (b *Builder) recordModifyAttributeColon(ctx *parser.AlterEntityActionContext) {
+	if ctx.MODIFY() == nil || ctx.COLON() != nil || ctx.DataType() == nil {
+		return
+	}
+	names := ctx.AllAttributeName()
+	if len(names) == 0 || names[0].GetStop() == nil {
+		return
+	}
+	stop := names[0].GetStop()
+	b.recordDeprecation(deprecation.ModifyAttributeColon, stop, "modify attribute")
+	b.fixLastDeprecation(deprecation.ModifyAttributeColon,
+		&ast.Fix{Edits: []ast.TextEdit{insertAt(stop.GetStop()+1, ":")}}, "")
+}
+
+// recordAssociationClauseColon reports `type: Reference`, `owner: Both` and
+// `storage: Table` (MDL-DEPR064): the colon goes, and the clause keeps one
+// space before its value.
+func (b *Builder) recordAssociationClauseColon(ctx *parser.AssociationOptionContext) {
+	colon := ctx.COLON()
+	if colon == nil || ctx.GetChildCount() < 3 {
+		return
+	}
+	_, kwStop := nodeSpan(ctx.GetChild(0))
+	valueStart, _ := nodeSpan(ctx.GetChild(2))
+	if kwStop < 0 || valueStart < 0 {
+		return
+	}
+	b.recordDeprecation(deprecation.AssociationClauseColon, colon.GetSymbol(), "association")
+	b.fixLastDeprecation(deprecation.AssociationClauseColon,
+		&ast.Fix{Edits: []ast.TextEdit{replaceGap(kwStop, valueStart, " ")}}, "")
+}
+
+// lineIndent is the leading whitespace of the line holding rune offset pos.
+func lineIndent(is antlr.CharStream, pos int) string {
+	if pos <= 0 {
+		return ""
+	}
+	head := is.GetText(0, pos-1)
+	line := head[strings.LastIndex(head, "\n")+1:]
+	return line[:len(line)-len(strings.TrimLeft(line, " \t"))]
+}
+
+// tokenBefore is the token directly before ctx in the token stream (on the
+// default channel), or nil.
+func tokenBefore(ctx antlr.ParserRuleContext) antlr.Token {
+	p, ok := ctx.GetParent().(antlr.ParserRuleContext)
+	if !ok || p == nil {
+		return nil
+	}
+	var prev antlr.Token
+	for i := 0; i < p.GetChildCount(); i++ {
+		c := p.GetChild(i)
+		if c == antlr.Tree(ctx) {
+			return prev
+		}
+		switch x := c.(type) {
+		case antlr.TerminalNode:
+			prev = x.GetSymbol()
+		case antlr.ParserRuleContext:
+			if x.GetStop() != nil {
+				prev = x.GetStop()
+			}
+		}
+	}
+	return nil
+}
diff --git a/mdl/visitor/visitor_r8_spellings.go b/mdl/visitor/visitor_r8_spellings.go
index 21b9b44ffb..bd7e1a0feb 100644
--- a/mdl/visitor/visitor_r8_spellings.go
+++ b/mdl/visitor/visitor_r8_spellings.go
@@ -165,6 +165,7 @@ func (b *Builder) recordDeleteBehavior(kw antlr.TerminalNode, behaviour parser.I
 
 // ExitAssociationOption reports `delete_behavior …` and `reference_set`.
 func (b *Builder) ExitAssociationOption(ctx *parser.AssociationOptionContext) {
+	b.recordAssociationClauseColon(ctx) // R3: `type: Reference` (visitor_r3_property_lists.go)
 	b.recordDeleteBehavior(ctx.DELETE_BEHAVIOR(), ctx.DeleteBehavior())
 	if n := ctx.REFERENCE_SET(); n != nil && strings.Contains(n.GetText(), "_") {
 		b.recordRespelling(deprecation.ReferenceSetUnderscore, n.GetSymbol(), "ReferenceSet")
diff --git a/mdl/visitor/visitor_settings.go b/mdl/visitor/visitor_settings.go
index 2d601cb6d3..02f0ffd67e 100644
--- a/mdl/visitor/visitor_settings.go
+++ b/mdl/visitor/visitor_settings.go
@@ -49,22 +49,9 @@ func (b *Builder) ExitAlterSettingsClause(ctx *parser.AlterSettingsClauseContext
 		if len(allStrings) > 0 {
 			stmt.ConfigName = unquoteStringLit(allStrings[0])
 		}
-		for _, assignCtx := range ctx.AllSettingsAssignment() {
-			assign, ok := assignCtx.(*parser.SettingsAssignmentContext)
-			if !ok || assign == nil {
-				continue
-			}
-			if assign.IDENTIFIER() == nil || assign.SettingsValue() == nil {
-				continue
-			}
-			key := assign.IDENTIFIER().GetText()
-			svCtx, ok := assign.SettingsValue().(*parser.SettingsValueContext)
-			if !ok || svCtx == nil {
-				continue
-			}
-			val := settingsValueText(svCtx)
-			stmt.Properties[key] = val
-		}
+		eachSettingsProperty(ctx.SettingsItemOptions(), ctx.AllSettingsAssignment(), func(key string, sv *parser.SettingsValueContext) {
+			stmt.Properties[key] = settingsValueText(sv)
+		})
 	} else if ctx.SettingsSection() != nil && ctx.GROUP() != nil {
 		// ALTER SETTINGS WORKFLOWS ADD [OR MODIFY] GROUP 'Approvers' [( Description: '…' )]
 		// ALTER SETTINGS WORKFLOWS MODIFY          GROUP 'Approvers'  ( Description: '…' )
@@ -92,25 +79,13 @@ func (b *Builder) ExitAlterSettingsClause(ctx *parser.AlterSettingsClauseContext
 		}
 		collectSettingsItemOptions(ctx.SettingsItemOptions(), stmt.Properties)
 	} else if ctx.SettingsSection() != nil {
-		// ALTER SETTINGS MODEL|LANGUAGE|WORKFLOWS Key = Value, ...
+		// ALTER SETTINGS RUNTIME|LANGUAGE|WORKFLOWS ( Key: Value, ... )
 		stmt.Section = settingsSectionName(ctx.SettingsSection())
-		for _, assignCtx := range ctx.AllSettingsAssignment() {
-			assign, ok := assignCtx.(*parser.SettingsAssignmentContext)
-			if !ok || assign == nil {
-				continue
-			}
-			if assign.IDENTIFIER() == nil || assign.SettingsValue() == nil {
-				continue
-			}
-			key := assign.IDENTIFIER().GetText()
-			svCtx, ok := assign.SettingsValue().(*parser.SettingsValueContext)
-			if !ok || svCtx == nil {
-				continue
-			}
-			val := settingsValueToInterface(svCtx)
-			stmt.Properties[key] = val
-		}
+		eachSettingsProperty(ctx.SettingsItemOptions(), ctx.AllSettingsAssignment(), func(key string, sv *parser.SettingsValueContext) {
+			stmt.Properties[key] = settingsValueToInterface(sv)
+		})
 	}
+	b.recordSettingsAssignments(ctx.AllSettingsAssignment())
 
 	b.statements = append(b.statements, stmt)
 }
@@ -132,23 +107,39 @@ func (b *Builder) ExitCreateConfigurationStatement(ctx *parser.CreateConfigurati
 		}
 	}
 
-	for _, assignCtx := range ctx.AllSettingsAssignment() {
-		assign, ok := assignCtx.(*parser.SettingsAssignmentContext)
-		if !ok || assign == nil {
-			continue
+	eachSettingsProperty(ctx.SettingsItemOptions(), ctx.AllSettingsAssignment(), func(key string, sv *parser.SettingsValueContext) {
+		stmt.Properties[key] = settingsValueText(sv)
+	})
+	b.recordSettingsAssignments(ctx.AllSettingsAssignment())
+
+	b.statements = append(b.statements, stmt)
+}
+
+// eachSettingsProperty calls f for every property of a settings list, in
+// either spelling: the canonical ( Key: value, … ) list, or the old
+// `Key = value, …` assignments (MDL-DEPR060). Both build the same statement.
+func eachSettingsProperty(opts parser.ISettingsItemOptionsContext, assigns []parser.ISettingsAssignmentContext,
+	f func(key string, sv *parser.SettingsValueContext)) {
+	if oc, ok := opts.(*parser.SettingsItemOptionsContext); ok && oc != nil {
+		for _, o := range oc.AllSettingsItemOption() {
+			so, ok := o.(*parser.SettingsItemOptionContext)
+			if !ok || so == nil || so.IdentifierOrKeyword() == nil || so.SettingsValue() == nil {
+				continue
+			}
+			if sv, ok := so.SettingsValue().(*parser.SettingsValueContext); ok && sv != nil {
+				f(unquoteIdentifier(so.IdentifierOrKeyword().GetText()), sv)
+			}
 		}
-		if assign.IDENTIFIER() == nil || assign.SettingsValue() == nil {
+	}
+	for _, a := range assigns {
+		assign, ok := a.(*parser.SettingsAssignmentContext)
+		if !ok || assign == nil || assign.IDENTIFIER() == nil || assign.SettingsValue() == nil {
 			continue
 		}
-		key := assign.IDENTIFIER().GetText()
-		svCtx, ok := assign.SettingsValue().(*parser.SettingsValueContext)
-		if !ok || svCtx == nil {
-			continue
+		if sv, ok := assign.SettingsValue().(*parser.SettingsValueContext); ok && sv != nil {
+			f(assign.IDENTIFIER().GetText(), sv)
 		}
-		stmt.Properties[key] = settingsValueText(svCtx)
 	}
-
-	b.statements = append(b.statements, stmt)
 }
 
 // collectSettingsItemOptions reads a ( key: value, … ) option list — the shared

From 85737c99d6b11b884494abe491dd4435db21bd72 Mon Sep 17 00:00:00 2001
From: Ako <andrej@koelewijn.net>
Date: Mon, 28 Sep 2026 05:48:41 +0000
Subject: [PATCH 05/35] R5: bare workflow and widget expressions, one constant
 reference, revoke mirrors grant (#753)

The rest of R5 after #775, each old spelling a registered deprecated alias
with an fmt --upgrade rewrite (codes 080-085):

- workflow decision / wait for timer / timer boundary event / timer event
  sub-process / due date take a bare expression; the string form keeps its
  meaning (MDL-DEPR080). describe writes the bare form, forcing the name of a
  decision or wait for timer when the expression would read as the name.
- page Visible: / Editable: take a bare client expression, stored as written,
  in create page and alter page set; [expr] is MDL-DEPR081 and its rewrite is
  the expression it stored. A constant condition ([true]/[false]) has no bare
  spelling and is not reported.
- revoke rights|all on entity M.E from M.Role; the reversed form is
  MDL-DEPR082.
- @Module.Const is the one constant reference: REST $Const (083), agent
  Key: M.C (084), alter settings constant 'M.C' (085).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 cmd/mxcli/runconstants.go                     |   2 +-
 mdl/ast/ast_agenteditor.go                    |   4 +-
 mdl/deprecation/deprecation.go                | 111 +++++++++++++
 mdl/executor/cmd_agenteditor_kbs.go           |   2 +-
 mdl/executor/cmd_agenteditor_mock_test.go     |   3 +-
 mdl/executor/cmd_agenteditor_models.go        |   2 +-
 .../cmd_pages_builder_visible_when.go         |   2 +-
 mdl/executor/cmd_pages_describe_output.go     |  20 ++-
 mdl/executor/cmd_settings.go                  |   2 +-
 mdl/executor/cmd_workflows.go                 |  49 +++++-
 .../describe_widget_conditions_test.go        |  40 +++++
 .../describe_workflow_expressions_test.go     |  97 ++++++++++++
 mdl/executor/validate_settings_refs.go        |   2 +-
 mdl/executor/validate_widget_editability.go   |   2 +-
 mdl/executor/validate_workflow_esp.go         |   2 +-
 mdl/executor/validate_workflow_rewrite.go     |   4 +-
 mdl/executor/workflow_esp_test.go             |   2 +-
 mdl/grammar/MDLParser.g4                      |   9 +-
 mdl/grammar/domains/MDLAgent.g4               |  10 +-
 mdl/grammar/domains/MDLPage.g4                |  12 +-
 mdl/grammar/domains/MDLSecurity.g4            |   6 +-
 mdl/grammar/domains/MDLService.g4             |   4 +-
 mdl/grammar/domains/MDLSettings.g4            |  13 +-
 mdl/grammar/domains/MDLWorkflow.g4            |  37 +++--
 mdl/upgrade/constant_refs_test.go             |  46 ++++++
 mdl/upgrade/revoke_entity_test.go             |  26 +++
 mdl/upgrade/widget_conditions_test.go         |  58 +++++++
 mdl/upgrade/workflow_expressions_test.go      |  72 +++++++++
 mdl/visitor/visitor_alter_page.go             |  12 ++
 mdl/visitor/visitor_constant_refs.go          | 108 +++++++++++++
 mdl/visitor/visitor_constant_refs_test.go     |  68 ++++++++
 mdl/visitor/visitor_deprecations_test.go      |   4 +-
 mdl/visitor/visitor_page_v3.go                |   8 +-
 mdl/visitor/visitor_rest.go                   |   6 +-
 mdl/visitor/visitor_revoke_entity_test.go     |  55 +++++++
 mdl/visitor/visitor_security.go               |   9 +-
 mdl/visitor/visitor_settings.go               |  35 ++---
 mdl/visitor/visitor_strict_properties.go      |   6 +-
 mdl/visitor/visitor_widget_conditions.go      |  94 +++++++++++
 mdl/visitor/visitor_widget_conditions_test.go | 114 ++++++++++++++
 mdl/visitor/visitor_workflow.go               |  85 +++-------
 mdl/visitor/visitor_workflow_expressions.go   | 148 ++++++++++++++++++
 .../visitor_workflow_expressions_test.go      | 124 +++++++++++++++
 mdl/visitor/visitor_xpath_brackets.go         |  31 ++++
 44 files changed, 1407 insertions(+), 139 deletions(-)
 create mode 100644 mdl/executor/describe_widget_conditions_test.go
 create mode 100644 mdl/executor/describe_workflow_expressions_test.go
 create mode 100644 mdl/upgrade/constant_refs_test.go
 create mode 100644 mdl/upgrade/revoke_entity_test.go
 create mode 100644 mdl/upgrade/widget_conditions_test.go
 create mode 100644 mdl/upgrade/workflow_expressions_test.go
 create mode 100644 mdl/visitor/visitor_constant_refs.go
 create mode 100644 mdl/visitor/visitor_constant_refs_test.go
 create mode 100644 mdl/visitor/visitor_revoke_entity_test.go
 create mode 100644 mdl/visitor/visitor_widget_conditions.go
 create mode 100644 mdl/visitor/visitor_widget_conditions_test.go
 create mode 100644 mdl/visitor/visitor_workflow_expressions.go
 create mode 100644 mdl/visitor/visitor_workflow_expressions_test.go

diff --git a/cmd/mxcli/runconstants.go b/cmd/mxcli/runconstants.go
index 05649256c6..abb7e8f8b9 100644
--- a/cmd/mxcli/runconstants.go
+++ b/cmd/mxcli/runconstants.go
@@ -17,7 +17,7 @@ import (
 // value, and that map is what the standalone runtime is handed as
 // MicroflowConstants — the configuration's overrides are not in it. So
 //
-//	alter settings constant 'Encryption.EncryptionKey' value '…' in configuration 'Default';
+//	alter settings constant @Encryption.EncryptionKey value '…' in configuration 'Default';
 //
 // executed, reported success, survived a round-trip through `describe settings`,
 // and then did nothing: the app ran with the constant's default. Measured in
diff --git a/mdl/ast/ast_agenteditor.go b/mdl/ast/ast_agenteditor.go
index 9fe3bc84c0..46b6060adc 100644
--- a/mdl/ast/ast_agenteditor.go
+++ b/mdl/ast/ast_agenteditor.go
@@ -6,7 +6,7 @@ package ast
 //
 //	CREATE MODEL Module.Name (
 //	  Provider: MxCloudGenAI,
-//	  Key: Module.SomeConstant
+//	  Key: @Module.SomeConstant
 //	  -- optional Portal-populated fields:
 //	  [, DisplayName: '...']
 //	  [, KeyName: '...']
@@ -92,7 +92,7 @@ func (s *AlterConsumedMCPServiceStmt) isStatement() {}
 //
 //	CREATE KNOWLEDGE BASE Module.Name (
 //	  Provider: MxCloudGenAI,
-//	  Key: Module.SomeConstant
+//	  Key: @Module.SomeConstant
 //	);
 type CreateKnowledgeBaseStmt struct {
 	Folder           string // Folder path within module (empty = leave placement alone)
diff --git a/mdl/deprecation/deprecation.go b/mdl/deprecation/deprecation.go
index 36f7f253e2..1c0edd2486 100644
--- a/mdl/deprecation/deprecation.go
+++ b/mdl/deprecation/deprecation.go
@@ -157,6 +157,31 @@ const (
 	// on a text template: the placeholders bound by position (R4,
 	// ako/mxcli#751).
 	PositionalTemplateArguments = "MDL-DEPR009"
+
+	// Codes 080–089 are the rest of R5 (ako/mxcli#753): expressions bare, one
+	// constant reference, and the revoke that mirrors the grant.
+
+	// WorkflowStringExpression is a workflow decision's condition, a timer's
+	// delay or first execution time, or a due date written inside a string:
+	// `decision '$WorkflowContext/Total > 1000'`.
+	WorkflowStringExpression = "MDL-DEPR080"
+	// BracketedWidgetCondition is a page widget's conditional `Visible: [expr]`
+	// / `Editable: [expr]`: a client expression written in the brackets of an
+	// XPath constraint.
+	BracketedWidgetCondition = "MDL-DEPR081"
+	// ReversedEntityRevoke is `revoke M.Role on M.E [(rights)]`, the revoke
+	// with the role first — the mirror of MDL-DEPR030's grant.
+	ReversedEntityRevoke = "MDL-DEPR082"
+	// DollarConstant is a consumed REST service credential written `$Const`:
+	// a constant named like a variable, and without its module.
+	DollarConstant = "MDL-DEPR083"
+	// BareConstantKey is an agent-editor model's or knowledge base's `Key:
+	// Module.Const` (and `set Key = Module.Const`): a constant written as a
+	// plain document name.
+	BareConstantKey = "MDL-DEPR084"
+	// QuotedSettingsConstant is `alter settings [drop] constant 'Module.Const'`:
+	// a constant named in a string.
+	QuotedSettingsConstant = "MDL-DEPR085"
 )
 
 // entries is the registry. Append only: a code is never reused or renumbered,
@@ -374,6 +399,92 @@ var entries = []Entry{
 
 func init() {
 	entries = append(entries, r8Entries...)
+	entries = append(entries, r5Entries...)
+}
+
+// r5Entries are the rest of R5's spellings (ako/mxcli#753), kept apart for the
+// same reason as r8Entries.
+var r5Entries = []Entry{
+	{
+		Code:      WorkflowStringExpression,
+		Old:       "decision '<expression>' / timer '<expression>' / due date '<expression>'",
+		Canonical: "decision <expression> / timer <expression> / due date <expression>",
+		Rewrite:   Rewrite{Structural: "the expression out of its string: `decision '$Ctx/Total > 1000'` becomes `decision $Ctx/Total > 1000`"},
+		RemovedIn: 2,
+		Note: "Expressions are bare everywhere (R5): a workflow decision, `wait for timer`, a timer boundary " +
+			"event, a timer event sub-process and a due date (workflow, user task, alter workflow). The string " +
+			"form keeps its meaning — its content is the expression — so it is an alias, not a change of " +
+			"meaning. A string whose content does not read back as the same bare expression is left in place " +
+			"and reported by fmt --upgrade.",
+		Example: "create workflow M.W parameter $WorkflowContext: M.E begin " +
+			"decision '$WorkflowContext/Total > 1000' outcomes true -> { } false -> { }; end workflow;",
+		CanonicalExample: "create workflow M.W parameter $WorkflowContext: M.E begin " +
+			"decision $WorkflowContext/Total > 1000 outcomes true -> { } false -> { }; end workflow;",
+	},
+	{
+		Code:      BracketedWidgetCondition,
+		Old:       "Visible: [<expression>] / Editable: [<expression>]",
+		Canonical: "Visible: <expression> / Editable: <expression>",
+		Rewrite: Rewrite{Structural: "the brackets become the expression they store: `Visible: [Active]` becomes " +
+			"`Visible: $currentObject/Active`"},
+		RemovedIn: 2,
+		Note: "A conditional visibility or editability is a client expression, not XPath, so it is written bare " +
+			"like every other expression (R5) and stored as written — name an attribute as " +
+			"`$currentObject/Attr`. Also in `alter page … set (Visible: …)`. The bracketed form rooted a bare " +
+			"attribute in $currentObject; the rewrite writes the expression it stored. One whose stored text " +
+			"would not read back as the same bare expression is left in place and reported by fmt --upgrade.",
+		Example: "create page M.P (Title: 'P', Layout: Atlas_Core.Atlas_Default) { dataview dv (DataSource: $E) { " +
+			"textbox t (Attribute: Name, Visible: [Active and $currentObject/Name != empty]) } };",
+		CanonicalExample: "create page M.P (Title: 'P', Layout: Atlas_Core.Atlas_Default) { dataview dv (DataSource: $E) { " +
+			"textbox t (Attribute: Name, Visible: $currentObject/Active and $currentObject/Name != empty) } };",
+	},
+	{
+		Code:      ReversedEntityRevoke,
+		Old:       "revoke M.Role on M.E [(rights)]",
+		Canonical: "revoke rights|all on entity M.E from M.Role",
+		Rewrite: Rewrite{Structural: "rights (or `all` when none are listed) before `on entity`, roles after `from`: " +
+			"`revoke R on M.E (write *)` becomes `revoke write * on entity M.E from R`, `revoke R on M.E` becomes " +
+			"`revoke all on entity M.E from R`"},
+		RemovedIn: 2,
+		Note: "The revoke mirrors the grant (MDL-DEPR030). `all` removes the roles' access rule; a rights list " +
+			"takes those rights away and keeps the rule.",
+		Example:          "revoke M.User, M.Admin on M.Order (write *, delete);",
+		CanonicalExample: "revoke write *, delete on entity M.Order from M.User, M.Admin;",
+	},
+	{
+		Code:      DollarConstant,
+		Old:       "Username: $Const",
+		Canonical: "Username: @Module.Const",
+		Rewrite:   Rewrite{Structural: "`$Const` becomes `@<the service's module>.Const`"},
+		RemovedIn: 2,
+		Note: "A constant is referred to one way everywhere: `@Module.Const` (R5). `$` names a variable, and " +
+			"`$Const` meant a constant of the consumed REST service's own module.",
+		Example: "create consumed rest service M.Api (BaseUrl: 'https://example.com', " +
+			"Authentication: basic (Username: $ApiUser, Password: @M.ApiPassword)) { };",
+		CanonicalExample: "create consumed rest service M.Api (BaseUrl: 'https://example.com', " +
+			"Authentication: basic (Username: @M.ApiUser, Password: @M.ApiPassword)) { };",
+	},
+	{
+		Code:             BareConstantKey,
+		Old:              "Key: Module.Const",
+		Canonical:        "Key: @Module.Const",
+		Rewrite:          Rewrite{Structural: "`@` before the constant's name"},
+		RemovedIn:        2,
+		Note:             "A constant is referred to one way everywhere: `@Module.Const` (R5). Also in `alter model|knowledge base … set Key = …`.",
+		Example:          "create model M.GPT (Provider: MxCloudGenAI, Key: M.ApiKey);",
+		CanonicalExample: "create model M.GPT (Provider: MxCloudGenAI, Key: @M.ApiKey);",
+	},
+	{
+		Code:      QuotedSettingsConstant,
+		Old:       "alter settings constant 'Module.Const' …",
+		Canonical: "alter settings constant @Module.Const …",
+		Rewrite:   Rewrite{Structural: "the constant's name out of its string, with `@`: `constant 'M.ApiUrl'` becomes `constant @M.ApiUrl`"},
+		RemovedIn: 2,
+		Note: "A constant is referred to one way everywhere: `@Module.Const` (R5). Also in `alter settings drop " +
+			"constant`. A string that is not a qualified name is left in place and reported by fmt --upgrade.",
+		Example:          "alter settings constant 'M.ApiUrl' value 'https://test.example.com' in configuration 'Default';",
+		CanonicalExample: "alter settings constant @M.ApiUrl value 'https://test.example.com' in configuration 'Default';",
+	},
 }
 
 // r8Entries are R8's spellings (ako/mxcli#752). Kept apart from the list above
diff --git a/mdl/executor/cmd_agenteditor_kbs.go b/mdl/executor/cmd_agenteditor_kbs.go
index 26eeacd8f8..4705850f12 100644
--- a/mdl/executor/cmd_agenteditor_kbs.go
+++ b/mdl/executor/cmd_agenteditor_kbs.go
@@ -90,7 +90,7 @@ func describeAgentEditorKnowledgeBase(ctx *ExecContext, name ast.QualifiedName)
 		lines = append(lines, fmt.Sprintf("  Provider: %s", k.Provider))
 	}
 	if k.Key != nil && k.Key.QualifiedName != "" {
-		lines = append(lines, fmt.Sprintf("  Key: %s", k.Key.QualifiedName))
+		lines = append(lines, fmt.Sprintf("  Key: @%s", k.Key.QualifiedName))
 	}
 	if k.ModelDisplayName != "" {
 		lines = append(lines, fmt.Sprintf("  ModelDisplayName: '%s'", escapeSQLString(k.ModelDisplayName)))
diff --git a/mdl/executor/cmd_agenteditor_mock_test.go b/mdl/executor/cmd_agenteditor_mock_test.go
index 0a273b8fe2..6985c6a1ed 100644
--- a/mdl/executor/cmd_agenteditor_mock_test.go
+++ b/mdl/executor/cmd_agenteditor_mock_test.go
@@ -347,7 +347,7 @@ func TestDescribeAgentEditorModel_Mock(t *testing.T) {
 	assertContainsStr(t, out, "create or modify model")
 	assertTerminated(t, out) // #744
 	assertContainsStr(t, out, "Provider")
-	assertContainsStr(t, out, "Key")
+	assertContainsStr(t, out, "Key: @M.APIKey") // R5: the one constant reference (ako/mxcli#753)
 }
 
 func TestShowAgentEditorAgents_Mock(t *testing.T) {
@@ -470,6 +470,7 @@ func TestDescribeAgentEditorKnowledgeBase_Mock(t *testing.T) {
 	assertContainsStr(t, out, "create or modify knowledge base")
 	assertTerminated(t, out) // #744
 	assertContainsStr(t, out, "Provider")
+	assertContainsStr(t, out, "Key: @M.KBKey") // R5: the one constant reference (ako/mxcli#753)
 }
 
 func TestShowAgentEditorConsumedMCPServices_Mock(t *testing.T) {
diff --git a/mdl/executor/cmd_agenteditor_models.go b/mdl/executor/cmd_agenteditor_models.go
index 071bdaece7..2d81638f6d 100644
--- a/mdl/executor/cmd_agenteditor_models.go
+++ b/mdl/executor/cmd_agenteditor_models.go
@@ -96,7 +96,7 @@ func describeAgentEditorModel(ctx *ExecContext, name ast.QualifiedName) error {
 		lines = append(lines, fmt.Sprintf("  Provider: %s", m.Provider))
 	}
 	if m.Key != nil && m.Key.QualifiedName != "" {
-		lines = append(lines, fmt.Sprintf("  Key: %s", m.Key.QualifiedName))
+		lines = append(lines, fmt.Sprintf("  Key: @%s", m.Key.QualifiedName))
 	}
 	// Portal-populated fields — round-tripped but flagged read-only in MDL.
 	if m.DisplayName != "" {
diff --git a/mdl/executor/cmd_pages_builder_visible_when.go b/mdl/executor/cmd_pages_builder_visible_when.go
index cf6060b5c9..fa04caac91 100644
--- a/mdl/executor/cmd_pages_builder_visible_when.go
+++ b/mdl/executor/cmd_pages_builder_visible_when.go
@@ -78,7 +78,7 @@ func (pb *pageBuilder) applyVisibleWhen(widget pages.Widget, w *ast.WidgetV3) er
 		}
 		all = append(values, emptyConditionValue)
 	default:
-		return mdlerrors.NewValidationf("%s: %s is not a Boolean or enumeration attribute — use an expression instead: `Visible: [...]`", where, attrQN)
+		return mdlerrors.NewValidationf("%s: %s is not a Boolean or enumeration attribute — use an expression instead: `Visible: $currentObject/…`", where, attrQN)
 	}
 
 	visible := map[string]bool{}
diff --git a/mdl/executor/cmd_pages_describe_output.go b/mdl/executor/cmd_pages_describe_output.go
index 86bbe9296d..1d5d91c2e1 100644
--- a/mdl/executor/cmd_pages_describe_output.go
+++ b/mdl/executor/cmd_pages_describe_output.go
@@ -117,16 +117,28 @@ func appendDataGridPagingProps(props []string, w rawWidget) []string {
 	return props
 }
 
+// widgetConditionMDL writes a conditional Visible / Editable as the bare
+// expression it stores (R5, ako/mxcli#753). One that would not read back bare
+// as itself — `true`, a lone name, text the MDL expression grammar cannot
+// parse — is written in the deprecated bracketed form, as before.
+func widgetConditionMDL(key, expr string) string {
+	expr = describeExpr(expr)
+	if visitor.BareWidgetCondition(key, expr) {
+		return key + ": " + expr
+	}
+	return fmt.Sprintf("%s: [%s]", key, expr)
+}
+
 // appendConditionalProps appends VISIBLE IF and EDITABLE IF if present.
 func appendConditionalProps(props []string, w rawWidget) []string {
 	if w.VisibleIf != "" {
-		props = append(props, fmt.Sprintf("Visible: [%s]", describeExpr(w.VisibleIf)))
+		props = append(props, widgetConditionMDL("Visible", w.VisibleIf))
 	}
 	if prop := visibleWhenProp(w); prop != "" {
 		props = append(props, prop)
 	}
 	if w.EditableIf != "" {
-		props = append(props, fmt.Sprintf("Editable: [%s]", describeExpr(w.EditableIf)))
+		props = append(props, widgetConditionMDL("Editable", w.EditableIf))
 	}
 	return props
 }
@@ -188,13 +200,13 @@ func appendAppearanceProps(props []string, w rawWidget) []string {
 		props = append(props, formatDesignPropertiesMDL(w.DesignProperties))
 	}
 	if w.VisibleIf != "" {
-		props = append(props, fmt.Sprintf("Visible: [%s]", describeExpr(w.VisibleIf)))
+		props = append(props, widgetConditionMDL("Visible", w.VisibleIf))
 	}
 	if prop := visibleWhenProp(w); prop != "" {
 		props = append(props, prop)
 	}
 	if w.EditableIf != "" {
-		props = append(props, fmt.Sprintf("Editable: [%s]", describeExpr(w.EditableIf)))
+		props = append(props, widgetConditionMDL("Editable", w.EditableIf))
 	}
 	return props
 }
diff --git a/mdl/executor/cmd_settings.go b/mdl/executor/cmd_settings.go
index 93bf8e21a8..8847872c72 100644
--- a/mdl/executor/cmd_settings.go
+++ b/mdl/executor/cmd_settings.go
@@ -748,7 +748,7 @@ func alterSettingsConstant(ctx *ExecContext, ps *model.ProjectSettings, stmt *as
 					"constant '%s' has a private value in configuration '%s'; "+
 						"its value is stored on the developer's workstation, not in the shared model. "+
 						"Change the constant to a shared value in Studio Pro first, "+
-						"or use `alter settings drop constant '%s' in configuration '%s'` to remove the override",
+						"or use `alter settings drop constant @%s in configuration '%s'` to remove the override",
 					stmt.ConstantId, targetConfig, stmt.ConstantId, targetConfig)
 			}
 			cv.Value = stmt.Value
diff --git a/mdl/executor/cmd_workflows.go b/mdl/executor/cmd_workflows.go
index 241ea23493..182252ad30 100644
--- a/mdl/executor/cmd_workflows.go
+++ b/mdl/executor/cmd_workflows.go
@@ -223,7 +223,7 @@ func describeWorkflowToString(ctx *ExecContext, name ast.QualifiedName) (string,
 
 	// Due date
 	if targetWf.DueDate != "" {
-		lines = append(lines, fmt.Sprintf("  due date %s", mdlQuoted(targetWf.DueDate)))
+		lines = append(lines, fmt.Sprintf("  due date %s", workflowExpressionMDL(targetWf.DueDate)))
 	}
 
 	lines = append(lines, formatWorkflowEventHandlers(ctx, targetWf.EventHandlers)...)
@@ -326,7 +326,7 @@ func formatBoundaryEvents(events []*workflows.BoundaryEvent, indent string) []st
 			}
 			lines = append(lines, header)
 		} else if event.TimerDelay != "" {
-			lines = append(lines, fmt.Sprintf("%s%s %s", indent, keyword, mdlQuoted(event.TimerDelay)))
+			lines = append(lines, fmt.Sprintf("%s%s %s", indent, keyword, workflowExpressionMDL(event.TimerDelay)))
 		} else {
 			lines = append(lines, fmt.Sprintf("%s%s", indent, keyword))
 		}
@@ -362,7 +362,7 @@ func formatEventSubProcesses(esps []*workflows.EventSubProcess, indent string) [
 			trigger = "interrupting"
 		}
 		if start.Timer {
-			header += fmt.Sprintf(" on %s timer %s", trigger, mdlQuoted(start.FirstExecutionTime))
+			header += fmt.Sprintf(" on %s timer %s", trigger, workflowExpressionMDL(start.FirstExecutionTime))
 			if start.Name != "" {
 				header += " as " + mdlIdent(start.Name)
 			}
@@ -452,7 +452,9 @@ func formatFlowActivities(flow *workflows.Flow, indent string, mainFlow bool) []
 			}
 			nameClause := workflowActivityNameClause(a.Name, caption)
 			if a.DelayExpression != "" {
-				actLines = append(actLines, fmt.Sprintf("%swait for timer%s %s comment %s", indent, nameClause, mdlQuoted(a.DelayExpression), mdlQuoted(caption)))
+				var delay string
+				nameClause, delay = namedWorkflowExpressionMDL(a.Name, nameClause, a.DelayExpression, visitor.WorkflowWaitForTimerReadsBack)
+				actLines = append(actLines, fmt.Sprintf("%swait for timer%s %s comment %s", indent, nameClause, delay, mdlQuoted(caption)))
 			} else {
 				actLines = append(actLines, fmt.Sprintf("%swait for timer%s comment %s", indent, nameClause, mdlQuoted(caption)))
 			}
@@ -603,7 +605,7 @@ func formatUserTask(a *workflows.UserTask, indent string) []string {
 
 	// Due date (task-level)
 	if a.DueDate != "" {
-		lines = append(lines, fmt.Sprintf("%s  due date %s", indent, mdlQuoted(a.DueDate)))
+		lines = append(lines, fmt.Sprintf("%s  due date %s", indent, workflowExpressionMDL(a.DueDate)))
 	}
 
 	// Task description
@@ -927,7 +929,9 @@ func formatExclusiveSplit(a *workflows.ExclusiveSplitActivity, indent string) []
 
 	nameClause, captionClause := workflowCaptionClauses(a.Name, a.Caption, "Decision")
 	if a.Expression != "" {
-		lines = append(lines, fmt.Sprintf("%sdecision%s %s%s", indent, nameClause, mdlQuoted(a.Expression), captionClause))
+		var expr string
+		nameClause, expr = namedWorkflowExpressionMDL(a.Name, nameClause, a.Expression, visitor.WorkflowDecisionReadsBack)
+		lines = append(lines, fmt.Sprintf("%sdecision%s %s%s", indent, nameClause, expr, captionClause))
 	} else {
 		lines = append(lines, fmt.Sprintf("%sdecision%s%s", indent, nameClause, captionClause))
 	}
@@ -998,6 +1002,39 @@ func targetingXPathMDL(xpath string) string {
 	return mdlQuoted(xpath)
 }
 
+// workflowExpressionMDL writes a stored workflow expression — a due date, a
+// timer's delay or first execution time — bare (R5, ako/mxcli#753). One that
+// does not read back as itself when written bare (surrounding whitespace, text
+// the MDL expression grammar cannot parse) is written in the deprecated string
+// form, which carries it byte for byte: describe must never alter a stored
+// expression.
+func workflowExpressionMDL(expr string) string {
+	if visitor.BareExpression(expr) {
+		return expr
+	}
+	return mdlQuoted(expr)
+}
+
+// namedWorkflowExpressionMDL is workflowExpressionMDL for the expression of a
+// decision or `wait for timer`, which follows the activity's optional name: an
+// expression that starts with a word could be read as the name. When it
+// would, the name is written even where the writer would derive it, which
+// stores the same name; when even that does not read back, the string form.
+func namedWorkflowExpressionMDL(name, nameClause, expr string, readsBack func(nameClause, expr string) bool) (string, string) {
+	if !visitor.BareExpression(expr) {
+		return nameClause, mdlQuoted(expr)
+	}
+	if readsBack(nameClause, expr) {
+		return nameClause, expr
+	}
+	if nameClause == "" && name != "" {
+		if forced := " " + mdlIdent(name); readsBack(forced, expr) {
+			return forced, expr
+		}
+	}
+	return nameClause, mdlQuoted(expr)
+}
+
 // workflowCallArguments renders a workflow call's parameter mappings in R4's
 // argument form, `(Param = expression)` right after the callee
 // (ako/mxcli#751).
diff --git a/mdl/executor/describe_widget_conditions_test.go b/mdl/executor/describe_widget_conditions_test.go
new file mode 100644
index 0000000000..231181bcad
--- /dev/null
+++ b/mdl/executor/describe_widget_conditions_test.go
@@ -0,0 +1,40 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package executor
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/visitor"
+)
+
+// R5 (ako/mxcli#753): describe page writes a conditional Visible / Editable as
+// the bare expression it stores; one that would read back as a plain value is
+// bracketed, as before.
+func TestDescribePage_WidgetConditionIsBare(t *testing.T) {
+	for _, tc := range []struct{ key, expr, want string }{
+		{"Visible", "$currentObject/Active", "Visible: $currentObject/Active"},
+		{"Editable", "$currentObject/Status = 'Open'", "Editable: $currentObject/Status = 'Open'"},
+		{"Visible", "true", "Visible: [true]"},
+	} {
+		if got := widgetConditionMDL(tc.key, tc.expr); got != tc.want {
+			t.Errorf("widgetConditionMDL(%q, %q) = %q, want %q", tc.key, tc.expr, got, tc.want)
+		}
+	}
+	props := appendAppearanceProps(nil, rawWidget{VisibleIf: "$currentObject/A and $currentObject/B", EditableIf: "$currentObject/C"})
+	src := "create page M.P (Title: 'P', Layout: Atlas_Core.Atlas_Default) { dataview dv (DataSource: $E) { textbox t (Attribute: Name, " +
+		strings.Join(props, ", ") + ") } };"
+	prog, errs := visitor.Build(src)
+	if len(errs) > 0 {
+		t.Fatalf("does not re-parse: %v\n%s", errs, src)
+	}
+	if len(prog.Deprecations) != 0 {
+		t.Errorf("deprecations %v", prog.Deprecations)
+	}
+	w := prog.Statements[0].(*ast.CreatePageStmtV3).Widgets[0].Children[0]
+	if w.Properties["VisibleIf"] != "$currentObject/A and $currentObject/B" || w.Properties["EditableIf"] != "$currentObject/C" {
+		t.Errorf("re-parsed as %#v", w.Properties)
+	}
+}
diff --git a/mdl/executor/describe_workflow_expressions_test.go b/mdl/executor/describe_workflow_expressions_test.go
new file mode 100644
index 0000000000..8a5ff455e1
--- /dev/null
+++ b/mdl/executor/describe_workflow_expressions_test.go
@@ -0,0 +1,97 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package executor
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
+	"github.com/mendixlabs/mxcli/mdl/visitor"
+	"github.com/mendixlabs/mxcli/sdk/workflows"
+)
+
+// R5 (ako/mxcli#753): describe writes a workflow's expressions bare. The
+// output must re-parse to the stored expression byte for byte; one that would
+// not is written in the deprecated string form.
+
+func describedWorkflowActivity(t *testing.T, act workflows.WorkflowActivity) (string, *ast.Program) {
+	t.Helper()
+	out := strings.Join(formatWorkflowActivities(&workflows.Flow{Activities: []workflows.WorkflowActivity{act}}, "  "), "\n")
+	prog, errs := visitor.Build("create workflow M.WF\n  parameter $WorkflowContext: M.E\nbegin\n" + out + "\nend workflow;")
+	if len(errs) > 0 {
+		t.Fatalf("does not re-parse: %v\n%s", errs, out)
+	}
+	return out, prog
+}
+
+func onlyWorkflowStringExpression(prog *ast.Program) bool {
+	for _, d := range prog.Deprecations {
+		if d.Code != deprecation.WorkflowStringExpression {
+			return false
+		}
+	}
+	return len(prog.Deprecations) > 0
+}
+
+func TestDescribeWorkflow_DecisionExpressionIsBare(t *testing.T) {
+	for _, tc := range []struct {
+		name, caption, expr, want string
+		quoted                    bool
+	}{
+		{"decision1", "Large order?", "$WorkflowContext/Total > 1000",
+			"decision decision1 $WorkflowContext/Total > 1000 comment 'Large order?'", false},
+		{"BigOrder", "BigOrder", "toLowerCase($WorkflowContext/Name) = 'big'",
+			"decision toLowerCase($WorkflowContext/Name) = 'big'", false},
+		// Written after no name, `Total` would be read as the name: the name
+		// is written, which stores the same name.
+		{"BigOrder", "BigOrder", "Total + 1 > 3", "decision BigOrder Total + 1 > 3", false},
+		// Not an MDL expression: the string carries it as stored.
+		{"decision1", "Decision", "${PT1H}", "decision decision1 '${PT1H}'", true},
+	} {
+		split := &workflows.ExclusiveSplitActivity{Expression: tc.expr}
+		split.Name, split.Caption = tc.name, tc.caption
+		out, prog := describedWorkflowActivity(t, split)
+		if !strings.Contains(out, tc.want) {
+			t.Errorf("describe wrote:\n%s\nwant a line containing %q", out, tc.want)
+		}
+		d := prog.Statements[0].(*ast.CreateWorkflowStmt).Activities[0].(*ast.WorkflowDecisionNode)
+		// A name the writer derives from the caption is not written.
+		if d.Expression != tc.expr || (d.Name != tc.name && !(d.Name == "" && tc.name == tc.caption)) {
+			t.Errorf("%q re-parsed as name %q expression %q", tc.want, d.Name, d.Expression)
+		}
+		if got := onlyWorkflowStringExpression(prog); got != tc.quoted {
+			t.Errorf("%q: deprecations %v", tc.want, prog.Deprecations)
+		}
+	}
+}
+
+func TestDescribeWorkflow_TimersAndDueDatesAreBare(t *testing.T) {
+	timer := &workflows.WaitForTimerActivity{DelayExpression: "addHours([%CurrentDateTime%], 1)"}
+	timer.Name, timer.Caption = "wait1", "Wait"
+	out, prog := describedWorkflowActivity(t, timer)
+	if !strings.Contains(out, "wait for timer wait1 addHours([%CurrentDateTime%], 1) comment 'Wait'") {
+		t.Errorf("describe wrote:\n%s", out)
+	}
+	if len(prog.Deprecations) != 0 {
+		t.Errorf("deprecations %v", prog.Deprecations)
+	}
+
+	task := &workflows.UserTask{DueDate: "addDays([%CurrentDateTime%], 3)"}
+	task.Name, task.Caption = "Review", "Review"
+	task.BoundaryEvents = []*workflows.BoundaryEvent{{EventType: "InterruptingTimer", TimerDelay: "addHours([%CurrentDateTime%], 8)"}}
+	out, prog = describedWorkflowActivity(t, task)
+	for _, want := range []string{"due date addDays([%CurrentDateTime%], 3)", "boundary event interrupting timer addHours([%CurrentDateTime%], 8)"} {
+		if !strings.Contains(out, want) {
+			t.Errorf("describe wrote:\n%s\nwant %q", out, want)
+		}
+	}
+	if len(prog.Deprecations) != 0 {
+		t.Errorf("deprecations %v", prog.Deprecations)
+	}
+	ut := prog.Statements[0].(*ast.CreateWorkflowStmt).Activities[0].(*ast.WorkflowUserTaskNode)
+	if ut.DueDate != task.DueDate || len(ut.BoundaryEvents) != 1 || ut.BoundaryEvents[0].Delay != "addHours([%CurrentDateTime%], 8)" {
+		t.Errorf("re-parsed as %#v", ut)
+	}
+}
diff --git a/mdl/executor/validate_settings_refs.go b/mdl/executor/validate_settings_refs.go
index 7b8598579c..86680a24e7 100644
--- a/mdl/executor/validate_settings_refs.go
+++ b/mdl/executor/validate_settings_refs.go
@@ -132,7 +132,7 @@ func checkAfterStartupReturnsBoolean(key, ref string, returnTypes map[string]str
 
 // validateSettingsConstantRef resolves the constant an override names.
 //
-// This one is not merely a dangling pointer: `alter settings constant 'Typo'
+// This one is not merely a dangling pointer: `alter settings constant @Typo
 // value 'x'` CREATES the override, so a misspelled name leaves dead
 // configuration data behind and the build fails. Dropping an override is exempt
 // — removing one whose constant is already gone is legitimate cleanup, and
diff --git a/mdl/executor/validate_widget_editability.go b/mdl/executor/validate_widget_editability.go
index da7b4edfb0..bbb68a7d53 100644
--- a/mdl/executor/validate_widget_editability.go
+++ b/mdl/executor/validate_widget_editability.go
@@ -112,7 +112,7 @@ func validateWidgetEditability(w *ast.WidgetV3, locationPrefix string) []linter.
 				"widget stays enabled",
 			locationPrefix, widgetLabel(w.Name, w.Type), key, w.Type,
 		),
-		Suggestion: "Use `visible: [ ... ]` to hide it conditionally (buttons do support conditional " +
+		Suggestion: "Use `visible: <expression>` to hide it conditionally (buttons do support conditional " +
 			"visibility), or move the condition into the microflow the button calls",
 	}}
 }
diff --git a/mdl/executor/validate_workflow_esp.go b/mdl/executor/validate_workflow_esp.go
index 0b3bf9e457..e3fae43b73 100644
--- a/mdl/executor/validate_workflow_esp.go
+++ b/mdl/executor/validate_workflow_esp.go
@@ -114,7 +114,7 @@ func ValidateWorkflowEventSubProcesses(stmt *ast.CreateWorkflowStmt) []linter.Vi
 				Severity:   linter.SeverityError,
 				Location:   loc,
 				Message:    fmt.Sprintf("event subprocess %s starts on a timer with no first execution time — the build fails CE0126", esp.Name),
-				Suggestion: "Give the timer an expression, e.g. `on interrupting timer 'addDays([%CurrentDateTime%], 1)'`.",
+				Suggestion: "Give the timer an expression, e.g. `on interrupting timer addDays([%CurrentDateTime%], 1)`.",
 			})
 		}
 	}
diff --git a/mdl/executor/validate_workflow_rewrite.go b/mdl/executor/validate_workflow_rewrite.go
index ba0c6c8f21..0f512d4c96 100644
--- a/mdl/executor/validate_workflow_rewrite.go
+++ b/mdl/executor/validate_workflow_rewrite.go
@@ -26,7 +26,7 @@ import (
 // (issue #948). That is the same shape as a dropped queue binding
 // (checkNoQueuedCalls) — guard-don't-drop, ADR-0005.
 //
-// Boundary events ARE authorable (`boundary event interrupting timer '…' { … }`),
+// Boundary events ARE authorable (`boundary event interrupting timer … { … }`),
 // so a script that restates them is allowed straight through — that is the normal
 // way to edit a workflow that has one. So are event sub-processes and
 // notification activities now; only a sub-process with no start event, which MDL
@@ -173,7 +173,7 @@ func checkNoDroppedWorkflowConstructs(ctx *ExecContext, workflowID model.ID, qua
 	return mdlerrors.NewUnsupported(fmt.Sprintf(
 		"workflow %s has %d stored boundary event(s) but this statement declares %d — "+
 			"rewriting it would delete the difference, along with each one's handler flow.\n"+
-			"  Restate them (`boundary event interrupting timer '<expr>' { … }`), which "+
+			"  Restate them (`boundary event interrupting timer <expr> { … }`), which "+
 			"`describe workflow %s` now emits, or use ALTER WORKFLOW to change one activity at a time.",
 		qualifiedName, storedBE, authored, qualifiedName))
 }
diff --git a/mdl/executor/workflow_esp_test.go b/mdl/executor/workflow_esp_test.go
index 77f996dba4..be91980807 100644
--- a/mdl/executor/workflow_esp_test.go
+++ b/mdl/executor/workflow_esp_test.go
@@ -108,7 +108,7 @@ func TestWorkflowESP_DescribeRoundTrips(t *testing.T) {
 		"boundary event non interrupting notification nudge 'Nudge'",
 		"event subprocess ESP_Cancel 'Cancel request' on interrupting notification cancelStart 'Cancel received' {",
 		"event subprocess ESP_Loop on non interrupting notification loopStart 'loopStart' {",
-		"event subprocess ESP_Expire 'Expire' on interrupting timer 'addDays([%CurrentDateTime%], 30)' as expireStart comment 'After 30 days' {",
+		"event subprocess ESP_Expire 'Expire' on interrupting timer addDays([%CurrentDateTime%], 30) as expireStart comment 'After 30 days' {",
 		"jump to logIt;",
 	} {
 		if !strings.Contains(first, want) {
diff --git a/mdl/grammar/MDLParser.g4 b/mdl/grammar/MDLParser.g4
index 28fe0f0230..ee4de53c4f 100644
--- a/mdl/grammar/MDLParser.g4
+++ b/mdl/grammar/MDLParser.g4
@@ -414,8 +414,13 @@ alterAssignOp
 alterPageAssignment
     : DATASOURCE alterAssignOp dataSourceExprV3               // DataSource: selection widgetName
     | ACTION alterAssignOp actionExprV3                       // Action: MICROFLOW Module.MF | SHOW_PAGE Module.Page | SAVE_CHANGES CLOSE_PAGE
-    | VISIBLE alterAssignOp xpathConstraint                   // Visible: [Name != ''] (conditional visibility)
-    | EDITABLE alterAssignOp xpathConstraint                  // Editable: [Status = 'Open'] (conditional editability)
+    // R5 (ako/mxcli#753): the condition is a bare expression; the bracketed
+    // form is the deprecated alias. The plain value keeps its reading, ahead of
+    // the expression, as in widgetPropertyV3.
+    | VISIBLE alterAssignOp xpathConstraint /* @alias MDL-DEPR081 */  // Visible: [Name != ''] (conditional visibility)
+    | EDITABLE alterAssignOp xpathConstraint /* @alias MDL-DEPR081 */ // Editable: [Status = 'Open'] (conditional editability)
+    | (VISIBLE | EDITABLE) alterAssignOp propertyValueV3      // Visible: false, Editable: Never
+    | (VISIBLE | EDITABLE) alterAssignOp expression           // Visible: $currentObject/Name != ''
     // A pluggable widget's NAMED action slot, addressed by the widget's own key:
     // `set 'createFileAction' = microflow M.F on fileUploader1`. The ALTER-level
     // twin of widgetPropertyV3's `key: actionExprV3` (#956); without it the value
diff --git a/mdl/grammar/domains/MDLAgent.g4 b/mdl/grammar/domains/MDLAgent.g4
index fb3cfc61b8..ea647a8955 100644
--- a/mdl/grammar/domains/MDLAgent.g4
+++ b/mdl/grammar/domains/MDLAgent.g4
@@ -11,7 +11,7 @@ options { tokenVocab = MDLLexer; }
 // =============================================================================
 // CREATE MODEL Module.Name (
 //   Provider: MxCloudGenAI,
-//   Key: Module.SomeConstant
+//   Key: @Module.SomeConstant
 //   [, DisplayName: '...', KeyName: '...', etc. — Portal-populated metadata]
 // );
 createModelStatement
@@ -22,7 +22,10 @@ createModelStatement
 
 modelProperty
     : identifierOrKeyword COLON identifierOrKeyword       // Provider: MxCloudGenAI
-    | identifierOrKeyword COLON qualifiedName             // Key: Module.Constant
+    | identifierOrKeyword COLON AT qualifiedName          // Key: @Module.Constant (the one constant reference, R5)
+    // A document name (Model: Module.Model). For Key, a constant, the bare name
+    // is the deprecated spelling of Key: @Module.Constant.
+    | identifierOrKeyword COLON qualifiedName /* @alias MDL-DEPR084 */
     | identifierOrKeyword COLON STRING_LITERAL            // DisplayName: 'GPT-4 Turbo' etc.
     | identifierOrKeyword COLON NUMBER_LITERAL            // ConnectionTimeoutSeconds: 30
     | identifierOrKeyword COLON booleanLiteral            // Enabled: true
@@ -58,7 +61,7 @@ createConsumedMCPServiceStatement
 // =============================================================================
 // CREATE KNOWLEDGE BASE Module.Name (
 //   Provider: MxCloudGenAI,
-//   Key: Module.SomeConstant
+//   Key: @Module.SomeConstant
 // );
 createKnowledgeBaseStatement
     : KNOWLEDGE BASE qualifiedName
@@ -109,6 +112,7 @@ agentEditorAlterValue
     | NUMBER_LITERAL
     | DOLLAR_STRING
     | booleanLiteral
+    | AT qualifiedName   // Key = @Module.Constant
     | qualifiedName
     | identifierOrKeyword
     ;
diff --git a/mdl/grammar/domains/MDLPage.g4 b/mdl/grammar/domains/MDLPage.g4
index e22901c397..3829c27af4 100644
--- a/mdl/grammar/domains/MDLPage.g4
+++ b/mdl/grammar/domains/MDLPage.g4
@@ -523,11 +523,19 @@ widgetPropertyV3
     | DESIGNPROPERTIES COLON designPropertyListV3       // DesignProperties: [...]
     | WIDTH COLON NUMBER_LITERAL                        // Width: 200
     | HEIGHT COLON NUMBER_LITERAL                      // Height: 100
-    | VISIBLE COLON xpathConstraint                    // Visible: [IsActive = true]
+    // R5 (ako/mxcli#753): a conditional Visible / Editable is a client
+    // expression, written bare like every other expression and stored as
+    // written. The bracketed form is the deprecated alias; it roots a bare
+    // attribute in $currentObject on the way in. The plain values keep their
+    // alternative, ahead of the expression, so `Visible: false` and `Editable:
+    // Never` mean what they did.
+    | VISIBLE COLON xpathConstraint /* @alias MDL-DEPR081 */  // Visible: [IsActive = true]
     | VISIBLE COLON qualifiedName IN LPAREN visibleValueV3 (COMMA visibleValueV3)* RPAREN  // Visible: Status in (Running, empty) | Mod.Entity.Attr in (…)
     | VISIBLE COLON propertyValueV3                   // Visible: false
-    | EDITABLE COLON xpathConstraint                  // Editable: [Status != 'Closed']
+    | VISIBLE COLON expression                        // Visible: $currentObject/Status = 'Open'
+    | EDITABLE COLON xpathConstraint /* @alias MDL-DEPR081 */ // Editable: [Status != 'Closed']
     | EDITABLE COLON propertyValueV3                  // Editable: Never | Always
+    | EDITABLE COLON expression                       // Editable: $currentObject/Status != 'Closed'
     | TOOLTIP COLON propertyValueV3                   // Tooltip: 'text'
     // Generic datasource-typed property (e.g. chart series `staticDataSource:
     // database Module.View`, `dynamicDataSource: $var`). Placed before the
diff --git a/mdl/grammar/domains/MDLSecurity.g4 b/mdl/grammar/domains/MDLSecurity.g4
index 95dcfedb9a..7e0c36fe2e 100644
--- a/mdl/grammar/domains/MDLSecurity.g4
+++ b/mdl/grammar/domains/MDLSecurity.g4
@@ -56,8 +56,12 @@ grantEntityAccessStatement
       (WHERE STRING_LITERAL)?
     ;
 
+// R5 (ako/mxcli#753): the revoke mirrors the grant — rights first, then
+// `on entity`, the roles after `from`. `all` removes the roles' access rule
+// altogether; a rights list takes those rights away and keeps the rule.
 revokeEntityAccessStatement
-    : REVOKE moduleRoleList ON qualifiedName
+    : REVOKE (ALL | entityAccessRightList) ON ENTITY qualifiedName FROM moduleRoleList
+    | REVOKE moduleRoleList ON qualifiedName /* @alias MDL-DEPR082 */
       (LPAREN entityAccessRightList RPAREN)?
     ;
 
diff --git a/mdl/grammar/domains/MDLService.g4 b/mdl/grammar/domains/MDLService.g4
index a44bb27775..ee4d706041 100644
--- a/mdl/grammar/domains/MDLService.g4
+++ b/mdl/grammar/domains/MDLService.g4
@@ -57,8 +57,8 @@ createRestClientStatement
 
 restClientProperty
     : identifierOrKeyword COLON STRING_LITERAL                       // BaseUrl: '...', Username: '...'
-    | identifierOrKeyword COLON VARIABLE                             // Username: $Constant (legacy, stored as Rest$ConstantValue)
-    | identifierOrKeyword COLON AT qualifiedName                     // Username: @Module.Constant (preferred Mendix convention)
+    | identifierOrKeyword COLON VARIABLE /* @alias MDL-DEPR083 */    // Username: $Constant (a constant of the client's own module)
+    | identifierOrKeyword COLON AT qualifiedName                     // Username: @Module.Constant (the one constant reference, R5)
     | identifierOrKeyword COLON NONE                                 // Authentication: NONE
     | identifierOrKeyword COLON BASIC LPAREN restClientProperty (COMMA restClientProperty)* RPAREN
     ;
diff --git a/mdl/grammar/domains/MDLSettings.g4 b/mdl/grammar/domains/MDLSettings.g4
index f3c3ba2651..b1e6ef8525 100644
--- a/mdl/grammar/domains/MDLSettings.g4
+++ b/mdl/grammar/domains/MDLSettings.g4
@@ -13,7 +13,7 @@ options { tokenVocab = MDLLexer; }
 /**
  * ALTER SETTINGS RUNTIME Key = Value, ...;   (MODEL is a deprecated alias)
  * ALTER SETTINGS CONFIGURATION 'name' Key = Value, ...;
- * ALTER SETTINGS CONSTANT 'name' VALUE 'value' [IN CONFIGURATION 'name'];
+ * ALTER SETTINGS CONSTANT @Module.Name VALUE 'value' [IN CONFIGURATION 'name'];
  * ALTER SETTINGS LANGUAGE Key = Value, ...;
  * ALTER SETTINGS LANGUAGE ADD [OR MODIFY] 'ar_SD' [(Key: Value, ...)];
  * ALTER SETTINGS LANGUAGE MODIFY 'ar_SD' (Key: Value, ...);
@@ -46,11 +46,18 @@ alterSettingsClause
     | settingsSection MODIFY STRING_LITERAL settingsItemOptions
     | settingsSection REMOVE STRING_LITERAL
     | settingsSection settingsAssignment (COMMA settingsAssignment)*
-    | CONSTANT STRING_LITERAL (VALUE settingsValue | DROP) (IN CONFIGURATION STRING_LITERAL)?
-    | DROP CONSTANT STRING_LITERAL (IN CONFIGURATION STRING_LITERAL)?
+    | CONSTANT settingsConstantRef (VALUE settingsValue | DROP) (IN CONFIGURATION STRING_LITERAL)?
+    | DROP CONSTANT settingsConstantRef (IN CONFIGURATION STRING_LITERAL)?
     | CONFIGURATION STRING_LITERAL settingsAssignment (COMMA settingsAssignment)*
     ;
 
+// R5 (ako/mxcli#753): a constant is referred to one way everywhere,
+// `@Module.Const`. The quoted name is the deprecated spelling.
+settingsConstantRef
+    : AT qualifiedName
+    | STRING_LITERAL /* @alias MDL-DEPR085 */
+    ;
+
 // RUNTIME is Studio Pro's tab for Settings$ModelSettings (R10); MODEL, the
 // old name, is an alias. The visitor stores both as the "model" section.
 settingsSection
diff --git a/mdl/grammar/domains/MDLWorkflow.g4 b/mdl/grammar/domains/MDLWorkflow.g4
index 296f414957..bfa5695241 100644
--- a/mdl/grammar/domains/MDLWorkflow.g4
+++ b/mdl/grammar/domains/MDLWorkflow.g4
@@ -41,7 +41,7 @@ workflowHeaderClause
     // rule bypasses by taking IDENTIFIER directly.
     | EXPORT LEVEL (IDENTIFIER | API | HIDDEN_KW)
     | OVERVIEW PAGE qualifiedName
-    | DUE DATE_TYPE dueDate=STRING_LITERAL
+    | DUE DATE_TYPE dueDate=workflowExpression
     | workflowEventHandlerClause
     ;
 
@@ -68,7 +68,7 @@ workflowEventSubProcess
  */
 workflowEventSubProcessTrigger
     : NOTIFICATION workflowActivityName? STRING_LITERAL?
-    | TIMER STRING_LITERAL (AS workflowActivityName)? (COMMENT STRING_LITERAL)?
+    | TIMER workflowExpression (AS workflowActivityName)? (COMMENT STRING_LITERAL)?
     ;
 
 /**
@@ -143,6 +143,23 @@ workflowActivityName
     | QUOTED_IDENTIFIER
     ;
 
+/**
+ * A Mendix expression a workflow stores: a decision's condition, a timer's
+ * delay or first execution time, a due date. R5 (ako/mxcli#753): written bare,
+ * like every other expression in MDL — `decision $WorkflowContext/Total > 1000`.
+ *
+ * The string form (`decision '$WorkflowContext/Total > 1000'`) is the
+ * deprecated spelling of the same thing: its CONTENT is the expression, as it
+ * always was. It is listed first so a lone string keeps that reading; no slot
+ * here takes a string-valued expression (a condition is Boolean or an
+ * enumeration, a timer or due date a DateTime), so nothing written bare means
+ * a string either.
+ */
+workflowExpression
+    : STRING_LITERAL /* @alias MDL-DEPR080 */
+    | expression
+    ;
+
 /**
  * A user task. Its clauses are a SET, not a sequence — see
  * `workflowHeaderClause` for why, and `checkWorkflowClausesAtMostOnce` for the
@@ -167,7 +184,7 @@ workflowUserTaskClause
     | TARGETING (USERS | GROUPS)? XPATH STRING_LITERAL /* @alias MDL-DEPR031 */
     | ON CREATED MICROFLOW qualifiedName
     | ENTITY qualifiedName
-    | DUE DATE_TYPE STRING_LITERAL
+    | DUE DATE_TYPE workflowExpression
     | DESCRIPTION STRING_LITERAL
     | OUTCOMES workflowUserTaskOutcome+
     | BOUNDARY EVENT workflowBoundaryEventClause ((BOUNDARY EVENT)? workflowBoundaryEventClause)*
@@ -218,9 +235,9 @@ workflowFallbackClause
  * with two boundary events did not parse.
  */
 workflowBoundaryEventClause
-    : INTERRUPTING TIMER STRING_LITERAL? (LBRACE workflowBody RBRACE)?
-    | NON INTERRUPTING TIMER STRING_LITERAL? (LBRACE workflowBody RBRACE)?
-    | TIMER STRING_LITERAL? (LBRACE workflowBody RBRACE)?
+    : INTERRUPTING TIMER workflowExpression? (LBRACE workflowBody RBRACE)?
+    | NON INTERRUPTING TIMER workflowExpression? (LBRACE workflowBody RBRACE)?
+    | TIMER workflowExpression? (LBRACE workflowBody RBRACE)?
     // A notification boundary event is triggered by `notify workflow … target
     // <name>`, so its name is what matters; the string is its caption.
     | INTERRUPTING NOTIFICATION workflowActivityName? STRING_LITERAL? (LBRACE workflowBody RBRACE)?
@@ -266,7 +283,7 @@ workflowCallWorkflowStmt
     ;
 
 workflowDecisionStmt
-    : DECISION workflowActivityName? STRING_LITERAL? (COMMENT STRING_LITERAL)?
+    : DECISION workflowActivityName? workflowExpression? (COMMENT STRING_LITERAL)?
       (OUTCOMES workflowConditionOutcome+)?
     ;
 
@@ -288,7 +305,7 @@ workflowJumpToStmt
     ;
 
 workflowWaitForTimerStmt
-    : WAIT FOR TIMER workflowActivityName? STRING_LITERAL? (COMMENT STRING_LITERAL)?
+    : WAIT FOR TIMER workflowActivityName? workflowExpression? (COMMENT STRING_LITERAL)?
     ;
 
 workflowWaitForNotificationStmt
@@ -332,7 +349,7 @@ workflowSetProperty
     : DISPLAY STRING_LITERAL
     | DESCRIPTION STRING_LITERAL
     | EXPORT LEVEL (IDENTIFIER | API | HIDDEN_KW)
-    | DUE DATE_TYPE STRING_LITERAL
+    | DUE DATE_TYPE workflowExpression
     | OVERVIEW PAGE qualifiedName
     | PARAMETER VARIABLE COLON qualifiedName
     ;
@@ -343,7 +360,7 @@ activitySetProperty
     | TARGETING MICROFLOW qualifiedName
     | TARGETING XPATH xpathConstraint+
     | TARGETING XPATH STRING_LITERAL /* @alias MDL-DEPR031 */
-    | DUE DATE_TYPE STRING_LITERAL
+    | DUE DATE_TYPE workflowExpression
     ;
 
 alterActivityRef
diff --git a/mdl/upgrade/constant_refs_test.go b/mdl/upgrade/constant_refs_test.go
new file mode 100644
index 0000000000..0500761fb4
--- /dev/null
+++ b/mdl/upgrade/constant_refs_test.go
@@ -0,0 +1,46 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package upgrade
+
+import (
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
+)
+
+// R5 (ako/mxcli#753): every constant reference becomes `@Module.Const`.
+func TestUpgrade_ConstantReferences(t *testing.T) {
+	for _, tc := range []struct{ name, src, want string }{
+		{"rest credentials qualified with the service's module",
+			"create consumed rest service Shop.Api (BaseUrl: 'https://x', Authentication: basic (Username: $ApiUser, Password: $ApiPass)) { };",
+			"create consumed rest service Shop.Api (BaseUrl: 'https://x', Authentication: basic (Username: @Shop.ApiUser, Password: @Shop.ApiPass)) { };"},
+		{"model and alter key",
+			"create model M.GPT (Provider: MxCloudGenAI, Key: M.ApiKey);\nalter knowledge base M.KB set Key = M.K2;",
+			"create model M.GPT (Provider: MxCloudGenAI, Key: @M.ApiKey);\nalter knowledge base M.KB set Key = @M.K2;"},
+		{"settings",
+			"ALTER SETTINGS CONSTANT 'M.ApiUrl' VALUE 'https://x';\nalter settings drop constant 'M.Old' in configuration 'Default';",
+			"ALTER SETTINGS CONSTANT @M.ApiUrl VALUE 'https://x';\nalter settings drop constant @M.Old in configuration 'Default';"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			res := mustUpgrade(t, tc.src, Options{})
+			if res.Source != tc.want {
+				t.Errorf("got:\n%s\nwant:\n%s", res.Source, tc.want)
+			}
+			if len(res.Unrewritten) != 0 {
+				t.Errorf("Unrewritten = %+v", res.Unrewritten)
+			}
+		})
+	}
+}
+
+// A settings constant string that is not a Module.Constant name is reported.
+func TestUpgrade_SettingsConstantNotANameIsReported(t *testing.T) {
+	src := "alter settings constant 'NoModule' value 'x';"
+	res := mustUpgrade(t, src, Options{})
+	if res.Source != src {
+		t.Errorf("rewritten to %q", res.Source)
+	}
+	if len(res.Unrewritten) != 1 || res.Unrewritten[0].Code != deprecation.QuotedSettingsConstant {
+		t.Errorf("Unrewritten = %+v", res.Unrewritten)
+	}
+}
diff --git a/mdl/upgrade/revoke_entity_test.go b/mdl/upgrade/revoke_entity_test.go
new file mode 100644
index 0000000000..7f0346197b
--- /dev/null
+++ b/mdl/upgrade/revoke_entity_test.go
@@ -0,0 +1,26 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package upgrade
+
+import "testing"
+
+// R5 (ako/mxcli#753): the reversed entity revoke is rewritten to the form that
+// mirrors the grant, keeping names, rights and case as written.
+func TestUpgrade_RevokeEntityMirrorsGrant(t *testing.T) {
+	for _, tc := range []struct{ name, src, want string }{
+		{"partial, several roles", "revoke Shop.User, Shop.Admin on Shop.Order (write (Email, \"Status\"), delete); -- keep\n",
+			"revoke write (Email, \"Status\"), delete on entity Shop.Order from Shop.User, Shop.Admin; -- keep\n"},
+		{"full", "revoke Shop.User on Shop.Order;", "revoke all on entity Shop.Order from Shop.User;"},
+		{"upper case", "REVOKE Shop.User ON Shop.Order (READ *);", "REVOKE READ * ON ENTITY Shop.Order FROM Shop.User;"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			res := mustUpgrade(t, tc.src, Options{})
+			if res.Source != tc.want {
+				t.Errorf("got:\n%s\nwant:\n%s", res.Source, tc.want)
+			}
+			if len(res.Unrewritten) != 0 {
+				t.Errorf("Unrewritten = %+v", res.Unrewritten)
+			}
+		})
+	}
+}
diff --git a/mdl/upgrade/widget_conditions_test.go b/mdl/upgrade/widget_conditions_test.go
new file mode 100644
index 0000000000..101dbf7860
--- /dev/null
+++ b/mdl/upgrade/widget_conditions_test.go
@@ -0,0 +1,58 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package upgrade
+
+import (
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
+)
+
+// R5 (ako/mxcli#753): `Visible: [expr]` / `Editable: [expr]` become the bare
+// expression the brackets stored — a bare attribute rooted in $currentObject.
+func TestUpgrade_WidgetConditionsBare(t *testing.T) {
+	page := func(props string) string {
+		return "create page M.P (Title: 'P', Layout: Atlas_Core.Atlas_Default) {\n  dataview dv (DataSource: $E) {\n    textbox t (Attribute: Name, " +
+			props + ") -- keep\n  }\n};"
+	}
+	for _, tc := range []struct{ name, src, want string }{
+		{"visible, attribute rooted", page("Visible: [Active]"), page("Visible: $currentObject/Active")},
+		{"editable", page("Editable: [$currentObject/Status = 'Open']"), page("Editable: $currentObject/Status = 'Open'")},
+		{"both", page("Visible: [Active], Editable: [not(Locked)]"), page("Visible: $currentObject/Active, Editable: not($currentObject/Locked)")},
+		{"alter page set", "alter page M.P { set (Visible: [Active]) on t };", "alter page M.P { set (Visible: $currentObject/Active) on t };"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			res := mustUpgrade(t, tc.src, Options{})
+			if res.Source != tc.want {
+				t.Errorf("got:\n%s\nwant:\n%s", res.Source, tc.want)
+			}
+			if len(res.Unrewritten) != 0 {
+				t.Errorf("Unrewritten = %+v", res.Unrewritten)
+			}
+		})
+	}
+}
+
+// A condition the rewrite cannot carry — here one holding an mdl 0 backslash
+// escape, whose value the string-escape rewrite owns — is reported, not
+// rewritten.
+func TestUpgrade_WidgetConditionNotBareIsReported(t *testing.T) {
+	src := `create page M.P (Title: 'P', Layout: Atlas_Core.Atlas_Default) { dataview dv (DataSource: $E) { textbox t (Attribute: Name, Visible: [$currentObject/Name = 'a\tb']) } };`
+	res := mustUpgrade(t, src, Options{})
+	if res.Source != src {
+		t.Errorf("rewritten to %q", res.Source)
+	}
+	if len(res.Unrewritten) != 1 || res.Unrewritten[0].Code != deprecation.BracketedWidgetCondition {
+		t.Errorf("Unrewritten = %+v, want one %s", res.Unrewritten, deprecation.BracketedWidgetCondition)
+	}
+}
+
+// A constant condition has no bare spelling — bare, `true` is the plain value,
+// stored differently — so its brackets are not reported at all.
+func TestUpgrade_ConstantWidgetConditionIsNotAnAlias(t *testing.T) {
+	src := "create page M.P (Title: 'P', Layout: Atlas_Core.Atlas_Default) { dataview dv (DataSource: $E) { textbox t (Attribute: Name, Editable: [true]) } };"
+	res := mustUpgrade(t, src, Options{})
+	if res.Source != src || len(res.Unrewritten) != 0 {
+		t.Errorf("rewritten to %q, Unrewritten %+v", res.Source, res.Unrewritten)
+	}
+}
diff --git a/mdl/upgrade/workflow_expressions_test.go b/mdl/upgrade/workflow_expressions_test.go
new file mode 100644
index 0000000000..2a6da5f526
--- /dev/null
+++ b/mdl/upgrade/workflow_expressions_test.go
@@ -0,0 +1,72 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package upgrade
+
+import (
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
+)
+
+// R5 (ako/mxcli#753): a workflow expression in a string is rewritten to the
+// bare expression, keeping everything around it.
+func TestUpgrade_WorkflowExpressionsBare(t *testing.T) {
+	head := "create workflow M.WF\n  parameter $WorkflowContext: M.E\n"
+	for _, tc := range []struct{ name, src, want string }{
+		{
+			"decision, timers and due dates",
+			head + "  due date 'addDays([%CurrentDateTime%], 2)'\nbegin\n" +
+				"  user task Review 'Review'\n    due date 'addHours([%CurrentDateTime%], 4)'\n    outcomes 'Done' { }\n" +
+				"    boundary event interrupting timer 'addHours([%CurrentDateTime%], 8)' { };\n" +
+				"  decision '$WorkflowContext/Total > 1000' comment 'Large?' -- keep\n    outcomes true -> { } false -> { };\n" +
+				"  wait for timer 'addHours([%CurrentDateTime%], 1)' comment 'Wait';\n" +
+				"  event subprocess Esp on interrupting timer 'addDays([%CurrentDateTime%], 30)' as Start { };\nend workflow;",
+			head + "  due date addDays([%CurrentDateTime%], 2)\nbegin\n" +
+				"  user task Review 'Review'\n    due date addHours([%CurrentDateTime%], 4)\n    outcomes 'Done' { }\n" +
+				"    boundary event interrupting timer addHours([%CurrentDateTime%], 8) { };\n" +
+				"  decision $WorkflowContext/Total > 1000 comment 'Large?' -- keep\n    outcomes true -> { } false -> { };\n" +
+				"  wait for timer addHours([%CurrentDateTime%], 1) comment 'Wait';\n" +
+				"  event subprocess Esp on interrupting timer addDays([%CurrentDateTime%], 30) as Start { };\nend workflow;",
+		},
+		{
+			"a string with no space around it",
+			"alter workflow M.WF set activity Review due date'addDays([%CurrentDateTime%], 1)';",
+			"alter workflow M.WF set activity Review due date addDays([%CurrentDateTime%], 1);",
+		},
+		{
+			"upper case, doubled quotes inside",
+			"ALTER WORKFLOW M.WF SET DUE DATE 'if $x = ''a'' then [%CurrentDateTime%] else [%BeginOfCurrentDay%]';",
+			"ALTER WORKFLOW M.WF SET DUE DATE if $x = 'a' then [%CurrentDateTime%] else [%BeginOfCurrentDay%];",
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			res := mustUpgrade(t, tc.src, Options{})
+			if res.Source != tc.want {
+				t.Errorf("got:\n%s\nwant:\n%s", res.Source, tc.want)
+			}
+			if len(res.Unrewritten) != 0 {
+				t.Errorf("Unrewritten = %+v", res.Unrewritten)
+			}
+		})
+	}
+}
+
+// A string whose content is not a bare expression that reads back as itself
+// is reported, not rewritten: unquoting it would change what is stored. So is
+// a decision whose bare expression would be read as the decision's name.
+func TestUpgrade_WorkflowExpressionNotBareIsReported(t *testing.T) {
+	head := "create workflow M.WF\n  parameter $WorkflowContext: M.E\nbegin\n"
+	for _, src := range []string{
+		"alter workflow M.WF set due date '${PT1H}';",
+		"alter workflow M.WF set due date ' addDays([%CurrentDateTime%], 1)';",
+		head + "  decision 'Total + 1 > 3'\n    outcomes true -> { } false -> { };\nend workflow;",
+	} {
+		res := mustUpgrade(t, src, Options{})
+		if res.Source != src {
+			t.Errorf("%q was rewritten to %q", src, res.Source)
+		}
+		if len(res.Unrewritten) != 1 || res.Unrewritten[0].Code != deprecation.WorkflowStringExpression {
+			t.Errorf("%q: Unrewritten = %+v, want one %s", src, res.Unrewritten, deprecation.WorkflowStringExpression)
+		}
+	}
+}
diff --git a/mdl/visitor/visitor_alter_page.go b/mdl/visitor/visitor_alter_page.go
index 326905bffa..cba4d1b35a 100644
--- a/mdl/visitor/visitor_alter_page.go
+++ b/mdl/visitor/visitor_alter_page.go
@@ -188,6 +188,18 @@ func (b *Builder) buildAlterPageAssignment(ctx *parser.AlterPageAssignmentContex
 			return "EditableIf", buildConditionalExpression(xc)
 		}
 	}
+	// Visible: <expression> / Editable: <expression> — the canonical form, the
+	// expression stored as written (R5); a plain value keeps the key it had
+	// when it reached the generic alternative below.
+	if kw := visibleOrEditable(ctx.VISIBLE(), ctx.EDITABLE()); kw != nil {
+		if e := ctx.Expression(); e != nil {
+			if ctx.VISIBLE() != nil {
+				return "VisibleIf", bareArgumentText(e)
+			}
+			return "EditableIf", bareArgumentText(e)
+		}
+		return kw.GetText(), buildPropertyValueV3(ctx.PropertyValueV3())
+	}
 
 	var name string
 
diff --git a/mdl/visitor/visitor_constant_refs.go b/mdl/visitor/visitor_constant_refs.go
new file mode 100644
index 0000000000..44351bd1ec
--- /dev/null
+++ b/mdl/visitor/visitor_constant_refs.go
@@ -0,0 +1,108 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package visitor
+
+import (
+	"strings"
+
+	"github.com/antlr4-go/antlr/v4"
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
+	"github.com/mendixlabs/mxcli/mdl/grammar/parser"
+)
+
+// R5 (ADR-0010; ako/mxcli#753): a constant is referred to one way everywhere,
+// `@Module.Const` — the spelling a Mendix expression uses. The other spellings
+// are deprecated aliases whose use is recorded here with the rewrite to `@`.
+
+// dollarConstantName is the qualified name a consumed REST service's `$Const`
+// credential names: a constant of the service's own module, unless the name is
+// already qualified.
+func dollarConstantName(module, variable string) string {
+	name := strings.TrimPrefix(variable, "$")
+	if strings.Contains(name, ".") || module == "" {
+		return name
+	}
+	return module + "." + name
+}
+
+// recordDollarConstant records MDL-DEPR083 on a `$Const` credential, with the
+// rewrite to `@Module.Const`.
+func (b *Builder) recordDollarConstant(v antlr.TerminalNode, module string) {
+	tok := v.GetSymbol()
+	b.recordDeprecation(deprecation.DollarConstant, tok, "constant reference")
+	name := dollarConstantName(module, tok.GetText())
+	if !strings.Contains(name, ".") {
+		b.fixLastDeprecation(deprecation.DollarConstant, nil, "the service has no module to qualify "+tok.GetText()+" with")
+		return
+	}
+	b.fixLastDeprecation(deprecation.DollarConstant,
+		&ast.Fix{Edits: []ast.TextEdit{replaceSpan(tok, tok, "@"+name)}}, "")
+}
+
+// ExitModelProperty records an agent-editor `Key: Module.Const` written
+// without its `@`.
+func (b *Builder) ExitModelProperty(ctx *parser.ModelPropertyContext) {
+	idents := ctx.AllIdentifierOrKeyword()
+	if len(idents) == 0 || !strings.EqualFold(idents[0].GetText(), "key") || ctx.AT() != nil {
+		return
+	}
+	b.recordBareConstantKey(ctx.QualifiedName())
+}
+
+// ExitAgentEditorAlterAssignment records `set Key = Module.Const` written
+// without its `@`.
+func (b *Builder) ExitAgentEditorAlterAssignment(ctx *parser.AgentEditorAlterAssignmentContext) {
+	iok := ctx.IdentifierOrKeyword()
+	val, ok := ctx.AgentEditorAlterValue().(*parser.AgentEditorAlterValueContext)
+	if iok == nil || !ok || val == nil || !strings.EqualFold(iok.GetText(), "key") || val.AT() != nil {
+		return
+	}
+	b.recordBareConstantKey(val.QualifiedName())
+}
+
+// recordBareConstantKey records MDL-DEPR084 on a constant named without `@`,
+// with the rewrite that adds it.
+func (b *Builder) recordBareConstantKey(qn parser.IQualifiedNameContext) {
+	if qn == nil || qn.GetStart() == nil {
+		return
+	}
+	b.recordDeprecation(deprecation.BareConstantKey, qn.GetStart(), "constant reference")
+	b.fixLastDeprecation(deprecation.BareConstantKey,
+		&ast.Fix{Edits: []ast.TextEdit{insertAt(qn.GetStart().GetStart(), "@")}}, "")
+}
+
+// settingsConstantRefText is the qualified name a settings constant
+// reference names: `@M.C` or, deprecated, `'M.C'`.
+func settingsConstantRefText(ctx parser.ISettingsConstantRefContext) string {
+	if ctx == nil {
+		return ""
+	}
+	if qn := ctx.QualifiedName(); qn != nil {
+		return getQualifiedNameText(qn)
+	}
+	if lit := ctx.STRING_LITERAL(); lit != nil {
+		return unquoteStringLit(lit)
+	}
+	return ""
+}
+
+// ExitSettingsConstantRef records MDL-DEPR085 on a constant named in a string,
+// with the rewrite to `@Module.Const` when the string holds a qualified name
+// that reads back as itself.
+func (b *Builder) ExitSettingsConstantRef(ctx *parser.SettingsConstantRefContext) {
+	lit := ctx.STRING_LITERAL()
+	if lit == nil {
+		return
+	}
+	b.recordDeprecation(deprecation.QuotedSettingsConstant, lit.GetSymbol(), "constant reference")
+	name := unquoteStringLit(lit)
+	qn, ok := parseRule(name, func(p *parser.MDLParser) antlr.ParserRuleContext { return p.QualifiedName() })
+	if holdsInterpretedEscape(lit) || !ok || getQualifiedNameText(qn.(parser.IQualifiedNameContext)) != name || !strings.Contains(name, ".") {
+		b.fixLastDeprecation(deprecation.QuotedSettingsConstant, nil,
+			"the string "+lit.GetText()+" is not a Module.Constant name; write it as @Module.Constant by hand")
+		return
+	}
+	b.fixLastDeprecation(deprecation.QuotedSettingsConstant,
+		&ast.Fix{Edits: []ast.TextEdit{replaceSpan(lit.GetSymbol(), lit.GetSymbol(), "@"+name)}}, "")
+}
diff --git a/mdl/visitor/visitor_constant_refs_test.go b/mdl/visitor/visitor_constant_refs_test.go
new file mode 100644
index 0000000000..29bdb950a6
--- /dev/null
+++ b/mdl/visitor/visitor_constant_refs_test.go
@@ -0,0 +1,68 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package visitor
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
+)
+
+// R5 (ako/mxcli#753): `@Module.Const` is the one constant reference. The
+// other spellings are deprecated aliases that build the same statement.
+func TestConstantReference_OneSpelling(t *testing.T) {
+	for _, tc := range []struct{ name, old, canonical, code string }{
+		{"rest credential $Const",
+			"create consumed rest service M.Api (BaseUrl: 'https://x', Authentication: basic (Username: $ApiUser, Password: $ApiPass)) { };",
+			"create consumed rest service M.Api (BaseUrl: 'https://x', Authentication: basic (Username: @M.ApiUser, Password: @M.ApiPass)) { };",
+			deprecation.DollarConstant},
+		{"model key",
+			"create model M.GPT (Provider: MxCloudGenAI, Key: M.ApiKey);",
+			"create model M.GPT (Provider: MxCloudGenAI, Key: @M.ApiKey);",
+			deprecation.BareConstantKey},
+		{"knowledge base key",
+			"create knowledge base M.KB (Provider: MxCloudGenAI, Key: M.KbKey);",
+			"create knowledge base M.KB (Provider: MxCloudGenAI, Key: @M.KbKey);",
+			deprecation.BareConstantKey},
+		{"alter model key",
+			"alter model M.GPT set Key = M.OtherKey;",
+			"alter model M.GPT set Key = @M.OtherKey;",
+			deprecation.BareConstantKey},
+		{"settings constant value",
+			"alter settings constant 'M.ApiUrl' value 'https://x' in configuration 'Default';",
+			"alter settings constant @M.ApiUrl value 'https://x' in configuration 'Default';",
+			deprecation.QuotedSettingsConstant},
+		{"settings drop constant",
+			"alter settings drop constant 'M.ApiUrl' in configuration 'Default';",
+			"alter settings drop constant @M.ApiUrl in configuration 'Default';",
+			deprecation.QuotedSettingsConstant},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			old, canon := mustBuild(t, tc.old), mustBuild(t, tc.canonical)
+			if !reflect.DeepEqual(old.Statements, canon.Statements) {
+				t.Errorf("old built %#v\ncanonical   %#v", old.Statements[0], canon.Statements[0])
+			}
+			for _, c := range deprecationCodes(old) {
+				if c != tc.code {
+					t.Errorf("old form recorded %s, want only %s", c, tc.code)
+				}
+			}
+			if len(old.Deprecations) == 0 {
+				t.Errorf("old form recorded nothing, want %s", tc.code)
+			}
+			if got := deprecationCodes(canon); len(got) != 0 {
+				t.Errorf("canonical form recorded %v", got)
+			}
+		})
+	}
+}
+
+// A model's other qualified-name properties name documents, not constants,
+// and are not reported.
+func TestConstantReference_DocumentNamesAreNotConstants(t *testing.T) {
+	prog := mustBuild(t, "create agent M.Helper (UsageType: Task, Model: M.GPT, SystemPrompt: 'x');")
+	if got := deprecationCodes(prog); len(got) != 0 {
+		t.Errorf("recorded %v", got)
+	}
+}
diff --git a/mdl/visitor/visitor_deprecations_test.go b/mdl/visitor/visitor_deprecations_test.go
index 34aa6436c7..e2a1a42ca3 100644
--- a/mdl/visitor/visitor_deprecations_test.go
+++ b/mdl/visitor/visitor_deprecations_test.go
@@ -105,9 +105,9 @@ var createOrReplaceCases = map[string]string{
 	"configuration":               "configuration 'Default';",
 	"publishedrestservice":        "published rest service M.OrderAPI (Path: 'rest/orders/v1', Version: '1.0.0', ServiceName: 'Order API') { };",
 	"datatransformer":             "data transformer M.Flatten source json '{\"id\": 1}' { jslt '{\"id\": .id}'; };",
-	"model":                       "model M.GPT4 (Provider: MxCloudGenAI, Key: M.ModelApiKey);",
+	"model":                       "model M.GPT4 (Provider: MxCloudGenAI, Key: @M.ModelApiKey);",
 	"consumedmcpservice":          "consumed mcp service M.WebSearch (ProtocolVersion: v2025_03_26, Version: '1.0');",
-	"knowledgebase":               "knowledge base M.Docs (Provider: MxCloudGenAI, Key: M.KBApiKey);",
+	"knowledgebase":               "knowledge base M.Docs (Provider: MxCloudGenAI, Key: @M.KBApiKey);",
 	"agent":                       "agent M.Summarizer (UsageType: Task, Model: M.GPT4, SystemPrompt: 'Summarize.', UserPrompt: 'Text.');",
 	"nanoflow":                    "nanoflow M.NF_Validate () begin return; end;",
 	"rule":                        "rule M.Rule_IsSolvent ($c: M.Customer) returns Boolean begin return true; end;",
diff --git a/mdl/visitor/visitor_page_v3.go b/mdl/visitor/visitor_page_v3.go
index 9baa27d7f5..e6ea42c565 100644
--- a/mdl/visitor/visitor_page_v3.go
+++ b/mdl/visitor/visitor_page_v3.go
@@ -845,7 +845,9 @@ func parseWidgetPropertyV3(ctx parser.IWidgetPropertyV3Context, widget *ast.Widg
 			return
 		}
 		if xc := propCtx.XpathConstraint(); xc != nil {
-			widget.Properties["VisibleIf"] = buildConditionalExpression(xc)
+			widget.Properties["VisibleIf"] = buildConditionalExpression(xc) // MDL-DEPR081
+		} else if e := propCtx.Expression(); e != nil {
+			widget.Properties["VisibleIf"] = bareArgumentText(e)
 		} else if valCtx := propCtx.PropertyValueV3(); valCtx != nil {
 			widget.Properties["Visible"] = buildPropertyValueV3(valCtx)
 		}
@@ -855,7 +857,9 @@ func parseWidgetPropertyV3(ctx parser.IWidgetPropertyV3Context, widget *ast.Widg
 	// Editable: [expression] (conditional editability) or Editable: Never (static)
 	if propCtx.EDITABLE() != nil {
 		if xc := propCtx.XpathConstraint(); xc != nil {
-			widget.Properties["EditableIf"] = buildConditionalExpression(xc)
+			widget.Properties["EditableIf"] = buildConditionalExpression(xc) // MDL-DEPR081
+		} else if e := propCtx.Expression(); e != nil {
+			widget.Properties["EditableIf"] = bareArgumentText(e)
 		} else if valCtx := propCtx.PropertyValueV3(); valCtx != nil {
 			widget.Properties["Editable"] = buildPropertyValueV3(valCtx)
 		}
diff --git a/mdl/visitor/visitor_rest.go b/mdl/visitor/visitor_rest.go
index 459469bac1..cda84ac66e 100644
--- a/mdl/visitor/visitor_rest.go
+++ b/mdl/visitor/visitor_rest.go
@@ -61,8 +61,10 @@ func (b *Builder) ExitCreateRestClientStatement(ctx *parser.CreateRestClientStat
 					if sl := sp.STRING_LITERAL(); sl != nil {
 						val = unquoteStringLit(sl)
 					} else if v := sp.VARIABLE(); v != nil {
-						// $Constant reference (legacy) — keep $ prefix
-						val = v.GetText()
+						// $Constant (MDL-DEPR083): a constant of the service's own
+						// module, stored qualified as `@Module.Const` stores it.
+						val = "$" + dollarConstantName(stmt.Name.Module, v.GetText())
+						b.recordDollarConstant(v, stmt.Name.Module)
 					} else if sp.AT() != nil {
 						// @Module.Constant reference (preferred Mendix convention)
 						// Store with $ prefix so the writer serializes as Rest$ConstantValue
diff --git a/mdl/visitor/visitor_revoke_entity_test.go b/mdl/visitor/visitor_revoke_entity_test.go
new file mode 100644
index 0000000000..2dc73d8ddc
--- /dev/null
+++ b/mdl/visitor/visitor_revoke_entity_test.go
@@ -0,0 +1,55 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package visitor
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
+)
+
+// R5 (ako/mxcli#753): the entity revoke mirrors the grant — rights (or `all`)
+// first, `on entity`, the roles after `from`. The reversed form is the
+// deprecated alias MDL-DEPR082 and builds the same statement.
+
+func revokeStmt(t *testing.T, src string) (*ast.RevokeEntityAccessStmt, *ast.Program) {
+	t.Helper()
+	prog := mustBuild(t, src)
+	if len(prog.Statements) != 1 {
+		t.Fatalf("%q: %d statements, want 1", src, len(prog.Statements))
+	}
+	r, ok := prog.Statements[0].(*ast.RevokeEntityAccessStmt)
+	if !ok {
+		t.Fatalf("%q: built %T", src, prog.Statements[0])
+	}
+	return r, prog
+}
+
+func TestRevokeEntity_CanonicalFormAndAlias(t *testing.T) {
+	for _, tc := range []struct {
+		old, canonical string
+		partial        bool
+	}{
+		{"revoke Shop.User, Shop.Admin on Shop.Order (write (Email), delete);",
+			"revoke write (Email), delete on entity Shop.Order from Shop.User, Shop.Admin;", true},
+		{"revoke Shop.User on Shop.Order;", "revoke all on entity Shop.Order from Shop.User;", false},
+		{"REVOKE Shop.User ON Shop.Order (READ *);", "REVOKE READ * ON ENTITY Shop.Order FROM Shop.User;", true},
+	} {
+		old, oldProg := revokeStmt(t, tc.old)
+		canon, canonProg := revokeStmt(t, tc.canonical)
+		if !reflect.DeepEqual(old, canon) {
+			t.Errorf("%s built %#v\n%s built %#v", tc.old, old, tc.canonical, canon)
+		}
+		if (len(canon.Rights) > 0) != tc.partial || len(canon.Roles) == 0 || canon.Entity.Name != "Order" {
+			t.Errorf("%s built %#v", tc.canonical, canon)
+		}
+		if got := deprecationCodes(oldProg); !reflect.DeepEqual(got, []string{deprecation.ReversedEntityRevoke}) {
+			t.Errorf("%s recorded %v, want [%s]", tc.old, got, deprecation.ReversedEntityRevoke)
+		}
+		if got := deprecationCodes(canonProg); len(got) != 0 {
+			t.Errorf("%s recorded %v, want none", tc.canonical, got)
+		}
+	}
+}
diff --git a/mdl/visitor/visitor_security.go b/mdl/visitor/visitor_security.go
index f6e4ca7409..6cac255ea9 100644
--- a/mdl/visitor/visitor_security.go
+++ b/mdl/visitor/visitor_security.go
@@ -147,7 +147,8 @@ func (b *Builder) ExitGrantEntityAccessStatement(ctx *parser.GrantEntityAccessSt
 	b.statements = append(b.statements, stmt)
 }
 
-// ExitRevokeEntityAccessStatement handles REVOKE role1, role2 ON Module.Entity [(rights...)]
+// ExitRevokeEntityAccessStatement handles REVOKE rights|ALL ON ENTITY Module.Entity FROM role1, role2,
+// and its deprecated alias REVOKE role1, role2 ON Module.Entity [(rights...)].
 func (b *Builder) ExitRevokeEntityAccessStatement(ctx *parser.RevokeEntityAccessStatementContext) {
 	qn := ctx.QualifiedName()
 	if qn == nil {
@@ -164,13 +165,17 @@ func (b *Builder) ExitRevokeEntityAccessStatement(ctx *parser.RevokeEntityAccess
 		}
 	}
 
-	// Parse optional rights list for partial revoke
+	// Parse optional rights list for partial revoke; `all` (or, in the old
+	// form, no list) is the full revoke.
 	if earl := ctx.EntityAccessRightList(); earl != nil {
 		for _, ear := range earl.AllEntityAccessRight() {
 			right := parseEntityAccessRight(ear)
 			stmt.Rights = append(stmt.Rights, right)
 		}
 	}
+	if ctx.ENTITY() == nil {
+		b.recordReversedEntityRevoke(ctx)
+	}
 
 	b.statements = append(b.statements, stmt)
 }
diff --git a/mdl/visitor/visitor_settings.go b/mdl/visitor/visitor_settings.go
index 2d601cb6d3..a7f8d92bdc 100644
--- a/mdl/visitor/visitor_settings.go
+++ b/mdl/visitor/visitor_settings.go
@@ -16,38 +16,31 @@ func (b *Builder) ExitAlterSettingsClause(ctx *parser.AlterSettingsClauseContext
 	}
 
 	if ctx.DROP() != nil && ctx.CONSTANT() != nil {
-		// ALTER SETTINGS DROP CONSTANT 'name' [IN CONFIGURATION 'cfg']
+		// ALTER SETTINGS DROP CONSTANT @name [IN CONFIGURATION 'cfg']
 		stmt.Section = "constant"
 		stmt.DropConstant = true
-		allStrings := ctx.AllSTRING_LITERAL()
-		if len(allStrings) > 0 {
-			stmt.ConstantId = unquoteStringLit(allStrings[0])
-		}
-		if ctx.IN() != nil && ctx.CONFIGURATION() != nil && len(allStrings) > 1 {
-			stmt.ConfigName = unquoteStringLit(allStrings[1])
+		stmt.ConstantId = settingsConstantRefText(ctx.SettingsConstantRef())
+		if ctx.IN() != nil && ctx.CONFIGURATION() != nil && ctx.STRING_LITERAL() != nil {
+			stmt.ConfigName = unquoteStringLit(ctx.STRING_LITERAL())
 		}
 	} else if ctx.CONSTANT() != nil {
-		// ALTER SETTINGS CONSTANT 'name' (VALUE 'value' | DROP) [IN CONFIGURATION 'cfg']
+		// ALTER SETTINGS CONSTANT @name (VALUE 'value' | DROP) [IN CONFIGURATION 'cfg']
 		stmt.Section = "constant"
-		allStrings := ctx.AllSTRING_LITERAL()
-		if len(allStrings) > 0 {
-			stmt.ConstantId = unquoteStringLit(allStrings[0])
-		}
+		stmt.ConstantId = settingsConstantRefText(ctx.SettingsConstantRef())
 		if ctx.DROP() != nil {
 			stmt.DropConstant = true
 		} else if ctx.SettingsValue() != nil {
 			stmt.Value = settingsValueText(ctx.SettingsValue().(*parser.SettingsValueContext))
 		}
 		// Check for IN CONFIGURATION 'name'
-		if ctx.IN() != nil && ctx.CONFIGURATION() != nil && len(allStrings) > 1 {
-			stmt.ConfigName = unquoteStringLit(allStrings[1])
+		if ctx.IN() != nil && ctx.CONFIGURATION() != nil && ctx.STRING_LITERAL() != nil {
+			stmt.ConfigName = unquoteStringLit(ctx.STRING_LITERAL())
 		}
 	} else if ctx.CONFIGURATION() != nil {
 		// ALTER SETTINGS CONFIGURATION 'name' Key = Value, ...
 		stmt.Section = "configuration"
-		allStrings := ctx.AllSTRING_LITERAL()
-		if len(allStrings) > 0 {
-			stmt.ConfigName = unquoteStringLit(allStrings[0])
+		if lit := ctx.STRING_LITERAL(); lit != nil {
+			stmt.ConfigName = unquoteStringLit(lit)
 		}
 		for _, assignCtx := range ctx.AllSettingsAssignment() {
 			assign, ok := assignCtx.(*parser.SettingsAssignmentContext)
@@ -74,8 +67,8 @@ func (b *Builder) ExitAlterSettingsClause(ctx *parser.AlterSettingsClauseContext
 		stmt.AddGroup = ctx.ADD() != nil && !stmt.UpsertGroup
 		stmt.ModifyGroup = ctx.MODIFY() != nil && !stmt.UpsertGroup
 		stmt.RemoveGroup = ctx.REMOVE() != nil
-		if all := ctx.AllSTRING_LITERAL(); len(all) > 0 {
-			stmt.GroupName = unquoteStringLit(all[0])
+		if lit := ctx.STRING_LITERAL(); lit != nil {
+			stmt.GroupName = unquoteStringLit(lit)
 		}
 		collectSettingsItemOptions(ctx.SettingsItemOptions(), stmt.Properties)
 	} else if ctx.SettingsSection() != nil && (ctx.ADD() != nil || ctx.MODIFY() != nil || ctx.REMOVE() != nil) {
@@ -87,8 +80,8 @@ func (b *Builder) ExitAlterSettingsClause(ctx *parser.AlterSettingsClauseContext
 		stmt.AddLanguage = ctx.ADD() != nil && !stmt.UpsertLanguage
 		stmt.ModifyLanguage = ctx.MODIFY() != nil && !stmt.UpsertLanguage
 		stmt.RemoveLanguage = ctx.REMOVE() != nil
-		if all := ctx.AllSTRING_LITERAL(); len(all) > 0 {
-			stmt.LanguageCode = unquoteStringLit(all[0])
+		if lit := ctx.STRING_LITERAL(); lit != nil {
+			stmt.LanguageCode = unquoteStringLit(lit)
 		}
 		collectSettingsItemOptions(ctx.SettingsItemOptions(), stmt.Properties)
 	} else if ctx.SettingsSection() != nil {
diff --git a/mdl/visitor/visitor_strict_properties.go b/mdl/visitor/visitor_strict_properties.go
index 75c0ae8eae..2c5d42162d 100644
--- a/mdl/visitor/visitor_strict_properties.go
+++ b/mdl/visitor/visitor_strict_properties.go
@@ -195,7 +195,7 @@ var businessEventServiceSchema = propSchema{on: "a business event service", keys
 // written as a string was dropped.
 var modelSchema = propSchema{on: "a model", keys: []propKey{
 	{"Provider", []propShape{shapeName}},
-	{"Key", []propShape{shapeQName}},
+	{"Key", []propShape{shapeConstant, shapeQName}},
 	{"DisplayName", []propShape{shapeString}},
 	{"KeyName", []propShape{shapeString}},
 	{"KeyId", []propShape{shapeString}},
@@ -206,7 +206,7 @@ var modelSchema = propSchema{on: "a model", keys: []propKey{
 
 var knowledgeBaseSchema = propSchema{on: "a knowledge base", keys: []propKey{
 	{"Provider", nameShapes},
-	{"Key", []propShape{shapeQName}},
+	{"Key", []propShape{shapeConstant, shapeQName}},
 	{"ModelDisplayName", []propShape{shapeString}},
 	{"ModelName", []propShape{shapeString}},
 	{"KeyName", []propShape{shapeString}},
@@ -266,6 +266,8 @@ var agentKnowledgeBaseSchema = propSchema{on: "an agent's knowledge base block",
 func modelPropertyShape(pc *parser.ModelPropertyContext) propShape {
 	idents := pc.AllIdentifierOrKeyword()
 	switch {
+	case pc.AT() != nil:
+		return shapeConstant
 	case pc.QualifiedName() != nil:
 		return shapeQName
 	case pc.STRING_LITERAL() != nil:
diff --git a/mdl/visitor/visitor_widget_conditions.go b/mdl/visitor/visitor_widget_conditions.go
new file mode 100644
index 0000000000..d07b2145e4
--- /dev/null
+++ b/mdl/visitor/visitor_widget_conditions.go
@@ -0,0 +1,94 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package visitor
+
+import (
+	"strings"
+
+	"github.com/antlr4-go/antlr/v4"
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
+	"github.com/mendixlabs/mxcli/mdl/grammar/parser"
+)
+
+// R5 (ADR-0010; ako/mxcli#753): a page widget's conditional visibility and
+// editability are client expressions, written bare — `Visible:
+// $currentObject/Status = 'Open'` — and stored as written. `Visible: [expr]`
+// wrote one in the brackets of an XPath constraint and rooted a bare
+// attribute in $currentObject on the way in; it is the deprecated alias
+// MDL-DEPR081, whose rewrite writes the expression the brackets stored.
+
+func isBooleanLiteral(s string) bool {
+	return strings.EqualFold(s, "true") || strings.EqualFold(s, "false")
+}
+
+func visibleOrEditable(visible, editable antlr.TerminalNode) antlr.TerminalNode {
+	if visible != nil {
+		return visible
+	}
+	return editable
+}
+
+// BareWidgetCondition reports whether `<key>: <expr>` (key Visible or
+// Editable) reads back as a conditional expression storing exactly expr.
+// describe asks it before writing a stored condition bare; an expression the
+// plain-value reading claims (`true`, a lone name) or the `Attr in (…)` form
+// claims does not, and is written in brackets instead.
+func BareWidgetCondition(key, expr string) bool {
+	if !BareExpression(expr) {
+		return false
+	}
+	ctx, ok := parseRule(key+": "+expr, func(p *parser.MDLParser) antlr.ParserRuleContext {
+		return p.WidgetPropertyV3()
+	})
+	if !ok {
+		return false
+	}
+	w := ctx.(*parser.WidgetPropertyV3Context)
+	if visibleOrEditable(w.VISIBLE(), w.EDITABLE()) == nil || w.Expression() == nil {
+		return false
+	}
+	return bareArgumentText(w.Expression()) == expr
+}
+
+// ExitWidgetPropertyV3 records a bracketed Visible / Editable in a widget's
+// properties.
+func (b *Builder) ExitWidgetPropertyV3(ctx *parser.WidgetPropertyV3Context) {
+	b.recordBracketedWidgetCondition(visibleOrEditable(ctx.VISIBLE(), ctx.EDITABLE()), ctx.XpathConstraint())
+}
+
+// ExitAlterPageAssignment records a bracketed Visible / Editable in `alter
+// page … set (…)`.
+func (b *Builder) ExitAlterPageAssignment(ctx *parser.AlterPageAssignmentContext) {
+	b.recordBracketedWidgetCondition(visibleOrEditable(ctx.VISIBLE(), ctx.EDITABLE()), ctx.XpathConstraint())
+}
+
+// recordBracketedWidgetCondition records MDL-DEPR081 with the rewrite that
+// replaces the brackets by the expression they store. There is none when that
+// expression would not read back bare as itself.
+func (b *Builder) recordBracketedWidgetCondition(kw antlr.TerminalNode, xc parser.IXpathConstraintContext) {
+	if kw == nil || xc == nil {
+		return
+	}
+	stored := buildConditionalExpression(xc)
+	if isBooleanLiteral(stored) {
+		// `Editable: [false]` stores a constant CONDITION; bare, `false` is the
+		// plain value, which Studio Pro stores differently. A constant
+		// condition has no bare spelling, so the brackets are not an alias
+		// for one here.
+		return
+	}
+	b.recordDeprecation(deprecation.BracketedWidgetCondition, kw.GetSymbol(), kw.GetText())
+	key := "Visible"
+	if kw.GetSymbol().GetTokenType() == parser.MDLLexerEDITABLE {
+		key = "Editable"
+	}
+	if holdsInterpretedEscape(xc) || !BareWidgetCondition(key, stored) {
+		b.fixLastDeprecation(deprecation.BracketedWidgetCondition, nil,
+			"the condition "+nodeText(xc)+" stores "+stored+", which does not read back as the same bare expression; "+
+				"write it bare by hand")
+		return
+	}
+	b.fixLastDeprecation(deprecation.BracketedWidgetCondition,
+		&ast.Fix{Edits: []ast.TextEdit{replaceSpan(xc.GetStart(), xc.GetStop(), stored)}}, "")
+}
diff --git a/mdl/visitor/visitor_widget_conditions_test.go b/mdl/visitor/visitor_widget_conditions_test.go
new file mode 100644
index 0000000000..4240921274
--- /dev/null
+++ b/mdl/visitor/visitor_widget_conditions_test.go
@@ -0,0 +1,114 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package visitor
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
+)
+
+// R5 (ako/mxcli#753): a conditional Visible / Editable is a bare expression,
+// stored as written. `Visible: [expr]` is the deprecated alias MDL-DEPR081.
+
+func textboxProps(t *testing.T, props string) (map[string]any, *ast.Program) {
+	t.Helper()
+	prog := mustBuild(t, "create page M.P (Title: 'P', Layout: Atlas_Core.Atlas_Default) { dataview dv (DataSource: $E) { textbox t (Attribute: Name, "+props+") } };")
+	return prog.Statements[0].(*ast.CreatePageStmtV3).Widgets[0].Children[0].Properties, prog
+}
+
+func TestWidgetCondition_BareIsCanonical(t *testing.T) {
+	for _, tc := range []struct{ bracketed, bare string }{
+		{"Visible: [Active]", "Visible: $currentObject/Active"},
+		{"Visible: [$currentObject/Price > 3 and Active]", "Visible: $currentObject/Price > 3 and $currentObject/Active"},
+		{"Editable: [$currentObject/Status = 'Open']", "Editable: $currentObject/Status = 'Open'"},
+		{"Visible: [not($currentObject/Active)]", "Visible: not($currentObject/Active)"},
+	} {
+		old, oldProg := textboxProps(t, tc.bracketed)
+		canon, canonProg := textboxProps(t, tc.bare)
+		if !reflect.DeepEqual(old, canon) {
+			t.Errorf("%s built %#v\n%s built %#v", tc.bracketed, old, tc.bare, canon)
+		}
+		if got := deprecationCodes(oldProg); !reflect.DeepEqual(got, []string{deprecation.BracketedWidgetCondition}) {
+			t.Errorf("%s recorded %v, want [%s]", tc.bracketed, got, deprecation.BracketedWidgetCondition)
+		}
+		if got := deprecationCodes(canonProg); len(got) != 0 {
+			t.Errorf("%s recorded %v, want none", tc.bare, got)
+		}
+	}
+}
+
+// The bare form stores the expression as written: nothing is rooted, spacing
+// is kept.
+func TestWidgetCondition_BareIsStoredAsWritten(t *testing.T) {
+	props, _ := textboxProps(t, "Visible: $currentObject/Status  =  'Open' or $Flag")
+	if got := props["VisibleIf"]; got != "$currentObject/Status  =  'Open' or $Flag" {
+		t.Errorf("VisibleIf = %#v", got)
+	}
+}
+
+// A plain value keeps its old reading: it is not a conditional expression.
+func TestWidgetCondition_PlainValuesUnchanged(t *testing.T) {
+	for _, tc := range []struct {
+		props, key string
+		want       any
+	}{
+		{"Visible: false", "Visible", false},
+		{"Visible: Active", "Visible", "Active"},
+		{"Editable: Never", "Editable", "Never"},
+	} {
+		props, prog := textboxProps(t, tc.props)
+		if props[tc.key] != tc.want || props["VisibleIf"] != nil || props["EditableIf"] != nil {
+			t.Errorf("%s built %#v", tc.props, props)
+		}
+		if got := deprecationCodes(prog); len(got) != 0 {
+			t.Errorf("%s recorded %v", tc.props, got)
+		}
+	}
+}
+
+func alterSet(t *testing.T, set string) (map[string]any, *ast.Program) {
+	t.Helper()
+	prog := mustBuild(t, "alter page M.P { set ("+set+") on t };")
+	return prog.Statements[0].(*ast.AlterPageStmt).Operations[0].(*ast.SetPropertyOp).Properties, prog
+}
+
+func TestWidgetCondition_AlterPageSet(t *testing.T) {
+	old, oldProg := alterSet(t, "Visible: [Active]")
+	canon, canonProg := alterSet(t, "Visible: $currentObject/Active")
+	if !reflect.DeepEqual(old, canon) || canon["VisibleIf"] != "$currentObject/Active" {
+		t.Errorf("bracketed built %#v, bare %#v", old, canon)
+	}
+	if got := deprecationCodes(oldProg); !reflect.DeepEqual(got, []string{deprecation.BracketedWidgetCondition}) {
+		t.Errorf("bracketed recorded %v", got)
+	}
+	if got := deprecationCodes(canonProg); len(got) != 0 {
+		t.Errorf("bare recorded %v", got)
+	}
+	if p, _ := alterSet(t, "Editable: $currentObject/Status != 'Closed'"); p["EditableIf"] != "$currentObject/Status != 'Closed'" {
+		t.Errorf("Editable built %#v", p)
+	}
+	if p, _ := alterSet(t, "Visible: false"); p["Visible"] != false {
+		t.Errorf("Visible: false built %#v", p)
+	}
+}
+
+func TestBareWidgetCondition(t *testing.T) {
+	for _, tc := range []struct {
+		expr string
+		want bool
+	}{
+		{"$currentObject/Active", true},
+		{"$currentObject/Status = 'Open'", true},
+		{"true", false},             // the plain value
+		{"Active", false},           // a plain name
+		{"Status in (A, B)", false}, // `based on attribute value`
+		{"", false},
+	} {
+		if got := BareWidgetCondition("Visible", tc.expr); got != tc.want {
+			t.Errorf("BareWidgetCondition(%q) = %v, want %v", tc.expr, got, tc.want)
+		}
+	}
+}
diff --git a/mdl/visitor/visitor_workflow.go b/mdl/visitor/visitor_workflow.go
index 85e0ef1823..4ed84a9a92 100644
--- a/mdl/visitor/visitor_workflow.go
+++ b/mdl/visitor/visitor_workflow.go
@@ -74,9 +74,7 @@ func (b *Builder) ExitCreateWorkflowStatement(ctx *parser.CreateWorkflowStatemen
 				stmt.OverviewPage = buildQualifiedName(qn)
 			}
 		case hc.DUE() != nil && hc.DATE_TYPE() != nil:
-			if tok := hc.GetDueDate(); tok != nil {
-				stmt.DueDate = unquoteStringLit(tok)
-			}
+			stmt.DueDate = workflowExpressionText(hc.GetDueDate())
 		case hc.WorkflowEventHandlerClause() != nil:
 			h, ok := hc.WorkflowEventHandlerClause().(*parser.WorkflowEventHandlerClauseContext)
 			if !ok {
@@ -354,7 +352,7 @@ func buildWorkflowSetPropertyOp(ctx *parser.WorkflowSetPropertyContext) *ast.Set
 		}
 	} else if ctx.DUE() != nil {
 		op.Property = "due_date"
-		op.Value = unquoteStringLit(ctx.STRING_LITERAL())
+		op.Value = workflowExpressionText(ctx.WorkflowExpression())
 	} else if ctx.OVERVIEW() != nil {
 		op.Property = "overview_page"
 		if qn := ctx.QualifiedName(); qn != nil {
@@ -400,7 +398,7 @@ func buildActivitySetPropertyOp(ctx *parser.ActivitySetPropertyContext, ref stri
 		}
 	} else if ctx.DUE() != nil {
 		op.Property = "due_date"
-		op.Value = unquoteStringLit(ctx.STRING_LITERAL())
+		op.Value = workflowExpressionText(ctx.WorkflowExpression())
 	}
 
 	return op
@@ -618,9 +616,7 @@ func applyWorkflowUserTaskClause(node *ast.WorkflowUserTaskNode, clause parser.I
 			node.Entity = buildQualifiedName(qn)
 		}
 	case c.DUE() != nil && c.DATE_TYPE() != nil:
-		if str := c.STRING_LITERAL(); str != nil {
-			node.DueDate = unquoteStringLit(str)
-		}
+		node.DueDate = workflowExpressionText(c.WorkflowExpression())
 	case c.DESCRIPTION() != nil:
 		if str := c.STRING_LITERAL(); str != nil {
 			node.TaskDescription = unquoteStringLit(str)
@@ -763,30 +759,11 @@ func buildWorkflowCallWorkflow(ctx parser.IWorkflowCallWorkflowStmtContext) *ast
 // buildWorkflowDecision builds a WorkflowDecisionNode.
 func buildWorkflowDecision(ctx parser.IWorkflowDecisionStmtContext) *ast.WorkflowDecisionNode {
 	dCtx := ctx.(*parser.WorkflowDecisionStmtContext)
-	node := &ast.WorkflowDecisionNode{
-		Name: workflowActivityNameText(dCtx.WorkflowActivityName()),
-	}
-
-	allStrings := dCtx.AllSTRING_LITERAL()
-	stringIdx := 0
-
-	// First STRING_LITERAL is the expression (if present and COMMENT is not present or expression comes first)
-	if len(allStrings) > 0 && dCtx.COMMENT() == nil {
-		// All strings are expression
-		node.Expression = unquoteStringLit(allStrings[0])
-		stringIdx = 1
-	} else if len(allStrings) > 0 && dCtx.COMMENT() != nil {
-		// Distinguish expression from comment
-		if len(allStrings) >= 2 {
-			node.Expression = unquoteStringLit(allStrings[0])
-			node.Caption = unquoteStringLit(allStrings[1])
-		} else {
-			// Only one string with COMMENT - it's the caption
-			node.Caption = unquoteStringLit(allStrings[0])
-		}
-		stringIdx = len(allStrings)
+	node := &ast.WorkflowDecisionNode{}
+	node.Name, node.Expression = activityNameAndExpression(dCtx.WorkflowActivityName(), dCtx.WorkflowExpression())
+	if dCtx.COMMENT() != nil && dCtx.STRING_LITERAL() != nil {
+		node.Caption = unquoteStringLit(dCtx.STRING_LITERAL())
 	}
-	_ = stringIdx
 
 	for _, outcomeCtx := range dCtx.AllWorkflowConditionOutcome() {
 		outcome := buildWorkflowConditionOutcome(outcomeCtx)
@@ -878,18 +855,10 @@ func buildWorkflowJumpTo(ctx parser.IWorkflowJumpToStmtContext) *ast.WorkflowJum
 // buildWorkflowWaitForTimer builds a WorkflowWaitForTimerNode.
 func buildWorkflowWaitForTimer(ctx parser.IWorkflowWaitForTimerStmtContext) *ast.WorkflowWaitForTimerNode {
 	wtCtx := ctx.(*parser.WorkflowWaitForTimerStmtContext)
-	node := &ast.WorkflowWaitForTimerNode{
-		Name: workflowActivityNameText(wtCtx.WorkflowActivityName()),
-	}
-
-	allStrings := wtCtx.AllSTRING_LITERAL()
-	if len(allStrings) > 0 && wtCtx.COMMENT() == nil {
-		node.DelayExpression = unquoteStringLit(allStrings[0])
-	} else if len(allStrings) >= 2 && wtCtx.COMMENT() != nil {
-		node.DelayExpression = unquoteStringLit(allStrings[0])
-		node.Caption = unquoteStringLit(allStrings[1])
-	} else if len(allStrings) == 1 && wtCtx.COMMENT() != nil {
-		node.Caption = unquoteStringLit(allStrings[0])
+	node := &ast.WorkflowWaitForTimerNode{}
+	node.Name, node.DelayExpression = activityNameAndExpression(wtCtx.WorkflowActivityName(), wtCtx.WorkflowExpression())
+	if wtCtx.COMMENT() != nil && wtCtx.STRING_LITERAL() != nil {
+		node.Caption = unquoteStringLit(wtCtx.STRING_LITERAL())
 	}
 
 	return node
@@ -931,13 +900,13 @@ func buildBoundaryEventNode(beCtx parser.IWorkflowBoundaryEventClauseContext) as
 	default:
 		be.EventType = "Timer"
 	}
-	// A timer's string is its delay; a notification event's is its caption.
-	if s := beCtx2.STRING_LITERAL(); s != nil {
-		if notification {
-			be.Caption = unquoteStringLit(s)
-		} else {
-			be.Delay = unquoteStringLit(s)
-		}
+	// A timer's expression is its delay; a notification event's string is its
+	// caption.
+	if s := beCtx2.STRING_LITERAL(); s != nil && notification {
+		be.Caption = unquoteStringLit(s)
+	}
+	if !notification {
+		be.Delay = workflowExpressionText(beCtx2.WorkflowExpression())
 	}
 	if notification {
 		be.Name = workflowActivityNameText(beCtx2.WorkflowActivityName())
@@ -973,17 +942,11 @@ func buildWorkflowEventSubProcess(ctx parser.IWorkflowEventSubProcessContext) as
 	if t, ok := c.WorkflowEventSubProcessTrigger().(*parser.WorkflowEventSubProcessTriggerContext); ok && t != nil {
 		node.Timer = t.TIMER() != nil
 		node.StartName = workflowActivityNameText(t.WorkflowActivityName())
-		strs := t.AllSTRING_LITERAL()
-		switch {
-		case node.Timer:
-			if len(strs) > 0 {
-				node.FirstExecutionTime = unquoteStringLit(strs[0])
-			}
-			if t.COMMENT() != nil && len(strs) > 1 {
-				node.StartCaption = unquoteStringLit(strs[1])
-			}
-		case len(strs) > 0:
-			node.StartCaption = unquoteStringLit(strs[0])
+		if node.Timer {
+			node.FirstExecutionTime = workflowExpressionText(t.WorkflowExpression())
+		}
+		if s := t.STRING_LITERAL(); s != nil {
+			node.StartCaption = unquoteStringLit(s)
 		}
 	}
 	if body := c.WorkflowBody(); body != nil {
diff --git a/mdl/visitor/visitor_workflow_expressions.go b/mdl/visitor/visitor_workflow_expressions.go
new file mode 100644
index 0000000000..5a1b5b40a4
--- /dev/null
+++ b/mdl/visitor/visitor_workflow_expressions.go
@@ -0,0 +1,148 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package visitor
+
+import (
+	"strings"
+	"unicode"
+
+	"github.com/antlr4-go/antlr/v4"
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
+	"github.com/mendixlabs/mxcli/mdl/grammar/parser"
+)
+
+// R5 (ADR-0010; ako/mxcli#753): an expression is written bare, never in a
+// string. A workflow stores five of them — a decision's condition, `wait for
+// timer`'s delay, a timer boundary event's delay, a timer event sub-process's
+// first execution time and a due date — and each took a string whose CONTENT
+// was the expression. The bare form stores its source text, as a bare workflow
+// call argument does (#751); the string form is the deprecated alias
+// MDL-DEPR080 and keeps its meaning under every language version, since none
+// of these slots takes a string-valued expression.
+
+// workflowExpressionText is the expression a workflowExpression stores: the
+// string's content for the deprecated form, the source text for the bare one.
+func workflowExpressionText(ctx parser.IWorkflowExpressionContext) string {
+	if ctx == nil {
+		return ""
+	}
+	if lit := ctx.STRING_LITERAL(); lit != nil {
+		return unquoteStringLit(lit)
+	}
+	if e := ctx.Expression(); e != nil {
+		return bareArgumentText(e)
+	}
+	return ""
+}
+
+// activityNameAndExpression reads the `name? expression?` slot pair of a
+// decision and a `wait for timer`. An identifier directly followed by `(` is
+// a function call, not a name and a parenthesised expression: `decision
+// length($s) > 0` is one expression. The grammar alone reads it as the name
+// `length` and the expression `($s) > 0`, since both parses are valid and the
+// name comes first.
+func activityNameAndExpression(name parser.IWorkflowActivityNameContext, expr parser.IWorkflowExpressionContext) (string, string) {
+	if name == nil || expr == nil || expr.Expression() == nil {
+		return workflowActivityNameText(name), workflowExpressionText(expr)
+	}
+	nameStop, exprStart := name.GetStop(), expr.GetStart()
+	if nameStop != nil && exprStart != nil && exprStart.GetTokenType() == parser.MDLLexerLPAREN &&
+		nameStop.GetStop()+1 == exprStart.GetStart() {
+		joined := extractExpressionText(name) + extractExpressionText(expr)
+		if ctx, ok := parseRule(joined, func(p *parser.MDLParser) antlr.ParserRuleContext { return p.Expression() }); ok {
+			return "", bareArgumentText(ctx.(parser.IExpressionContext))
+		}
+	}
+	return workflowActivityNameText(name), workflowExpressionText(expr)
+}
+
+// WorkflowDecisionReadsBack reports whether `decision<nameClause> <expr>`
+// builds a decision with exactly that expression, and a name when nameClause
+// (empty, or a space and the name as describe writes it) has one. describe
+// asks it before writing a decision's condition bare: an expression that
+// starts with a word can otherwise be read as the activity's name.
+func WorkflowDecisionReadsBack(nameClause, expr string) bool {
+	ctx, ok := parseRule("decision"+nameClause+" "+expr, func(p *parser.MDLParser) antlr.ParserRuleContext {
+		return p.WorkflowDecisionStmt()
+	})
+	if !ok {
+		return false
+	}
+	n := buildWorkflowDecision(ctx.(parser.IWorkflowDecisionStmtContext))
+	return n.Expression == expr && (n.Name == "") == (nameClause == "")
+}
+
+// WorkflowWaitForTimerReadsBack is WorkflowDecisionReadsBack for `wait for
+// timer<nameClause> <expr>`.
+func WorkflowWaitForTimerReadsBack(nameClause, expr string) bool {
+	ctx, ok := parseRule("wait for timer"+nameClause+" "+expr, func(p *parser.MDLParser) antlr.ParserRuleContext {
+		return p.WorkflowWaitForTimerStmt()
+	})
+	if !ok {
+		return false
+	}
+	n := buildWorkflowWaitForTimer(ctx.(parser.IWorkflowWaitForTimerStmtContext))
+	return n.DelayExpression == expr && (n.Name == "") == (nameClause == "")
+}
+
+// ExitWorkflowExpression records MDL-DEPR080 on an expression written in a
+// string, with the rewrite that takes it out.
+func (b *Builder) ExitWorkflowExpression(ctx *parser.WorkflowExpressionContext) {
+	lit := ctx.STRING_LITERAL()
+	if lit == nil || unquoteStringLit(lit) == "" {
+		// `''` is no expression at all — `alter workflow … set due date ''`
+		// clears it — so it is not one written in a string. It has no bare
+		// spelling and stays as it is.
+		return
+	}
+	b.recordDeprecation(deprecation.WorkflowStringExpression, lit.GetSymbol(), "workflow expression")
+	fix, why := workflowStringExpressionFix(ctx, lit)
+	b.fixLastDeprecation(deprecation.WorkflowStringExpression, fix, why)
+}
+
+// workflowStringExpressionFix replaces the string by its content. It has none
+// when the content is not a bare expression that reads back as itself, or —
+// for a decision or `wait for timer` with no name — when the bare expression
+// would be read as the activity's name.
+func workflowStringExpressionFix(ctx *parser.WorkflowExpressionContext, lit antlr.TerminalNode) (*ast.Fix, string) {
+	if holdsInterpretedEscape(lit) {
+		return nil, "the expression string holds a backslash escape; write the expression bare by hand"
+	}
+	expr := unquoteStringLit(lit)
+	why := "the string " + lit.GetText() + " does not read back as the same bare expression; write it bare by hand"
+	if !BareExpression(expr) {
+		return nil, why
+	}
+	switch p := ctx.GetParent().(type) {
+	case *parser.WorkflowDecisionStmtContext:
+		if p.WorkflowActivityName() == nil && !WorkflowDecisionReadsBack("", expr) {
+			return nil, why
+		}
+	case *parser.WorkflowWaitForTimerStmtContext:
+		if p.WorkflowActivityName() == nil && !WorkflowWaitForTimerReadsBack("", expr) {
+			return nil, why
+		}
+	}
+	t := lit.GetSymbol()
+	// A string needs no space to part it from its neighbours; a bare
+	// expression does: `timer'x'comment 'c'`.
+	if is := t.GetInputStream(); is != nil {
+		if t.GetStart() > 0 && gluesToWord(is.GetText(t.GetStart()-1, t.GetStart()-1)) {
+			expr = " " + expr
+		}
+		if t.GetStop()+1 < is.Size() && gluesToWord(is.GetText(t.GetStop()+1, t.GetStop()+1)) {
+			expr += " "
+		}
+	}
+	return &ast.Fix{Edits: []ast.TextEdit{{Start: t.GetStart(), Stop: t.GetStop() + 1, Text: expr}}}, ""
+}
+
+// gluesToWord reports whether a neighbouring character would lex as part of
+// a bare expression's first or last token.
+func gluesToWord(s string) bool {
+	for _, r := range s {
+		return unicode.IsLetter(r) || unicode.IsDigit(r) || strings.ContainsRune("_$'\"`%", r)
+	}
+	return false
+}
diff --git a/mdl/visitor/visitor_workflow_expressions_test.go b/mdl/visitor/visitor_workflow_expressions_test.go
new file mode 100644
index 0000000000..824b0e9d59
--- /dev/null
+++ b/mdl/visitor/visitor_workflow_expressions_test.go
@@ -0,0 +1,124 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package visitor
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
+)
+
+// R5 (ako/mxcli#753): a workflow's expressions — a decision's condition, a
+// timer's delay or first execution time, a due date — are written bare. The
+// string form is the deprecated alias MDL-DEPR080 and builds exactly what the
+// bare form builds: its content is the expression.
+
+const wfHead = "create workflow M.WF\n  parameter $WorkflowContext: M.E\n"
+
+func TestWorkflowExpression_BareFormIsCanonical(t *testing.T) {
+	for _, tc := range []struct{ name, quoted, bare string }{
+		{"decision",
+			wfHead + "begin\n  decision '$WorkflowContext/Total > 1000' comment 'Large?'\n    outcomes true -> { } false -> { };\nend workflow;",
+			wfHead + "begin\n  decision $WorkflowContext/Total > 1000 comment 'Large?'\n    outcomes true -> { } false -> { };\nend workflow;"},
+		{"named decision",
+			wfHead + "begin\n  decision Big 'toLowerCase($WorkflowContext/Name) = ''big'''\n    outcomes true -> { } false -> { };\nend workflow;",
+			wfHead + "begin\n  decision Big toLowerCase($WorkflowContext/Name) = 'big'\n    outcomes true -> { } false -> { };\nend workflow;"},
+		{"decision starting with a function call",
+			wfHead + "begin\n  decision 'toLowerCase($WorkflowContext/Name) = ''big'''\n    outcomes true -> { } false -> { };\nend workflow;",
+			wfHead + "begin\n  decision toLowerCase($WorkflowContext/Name) = 'big'\n    outcomes true -> { } false -> { };\nend workflow;"},
+		{"wait for timer",
+			wfHead + "begin\n  wait for timer 'addHours([%CurrentDateTime%], 1)' comment 'Wait';\nend workflow;",
+			wfHead + "begin\n  wait for timer addHours([%CurrentDateTime%], 1) comment 'Wait';\nend workflow;"},
+		{"named wait for timer",
+			wfHead + "begin\n  wait for timer T1 'addHours([%CurrentDateTime%], 1)';\nend workflow;",
+			wfHead + "begin\n  wait for timer T1 addHours([%CurrentDateTime%], 1);\nend workflow;"},
+		{"workflow and user task due dates, boundary timers",
+			wfHead + "  due date 'addDays([%CurrentDateTime%], 2)'\nbegin\n  user task Review 'Review'\n    due date 'addHours([%CurrentDateTime%], 4)'\n" +
+				"    outcomes 'Done' { }\n    boundary event interrupting timer 'addHours([%CurrentDateTime%], 8)' { }\n" +
+				"    boundary event non interrupting timer 'addHours([%CurrentDateTime%], 9)'\n    boundary event timer 'addHours([%CurrentDateTime%], 10)';\nend workflow;",
+			wfHead + "  due date addDays([%CurrentDateTime%], 2)\nbegin\n  user task Review 'Review'\n    due date addHours([%CurrentDateTime%], 4)\n" +
+				"    outcomes 'Done' { }\n    boundary event interrupting timer addHours([%CurrentDateTime%], 8) { }\n" +
+				"    boundary event non interrupting timer addHours([%CurrentDateTime%], 9)\n    boundary event timer addHours([%CurrentDateTime%], 10);\nend workflow;"},
+		{"timer event sub-process",
+			wfHead + "begin\n  event subprocess Esp on interrupting timer 'addDays([%CurrentDateTime%], 30)' as Start comment 'After 30 days' { };\nend workflow;",
+			wfHead + "begin\n  event subprocess Esp on interrupting timer addDays([%CurrentDateTime%], 30) as Start comment 'After 30 days' { };\nend workflow;"},
+		{"alter workflow due date",
+			"alter workflow M.WF set due date 'addDays([%CurrentDateTime%], 1)';",
+			"alter workflow M.WF set due date addDays([%CurrentDateTime%], 1);"},
+		{"alter activity due date",
+			"alter workflow M.WF set activity Review due date 'addDays([%CurrentDateTime%], 1)';",
+			"alter workflow M.WF set activity Review due date addDays([%CurrentDateTime%], 1);"},
+		{"inserted wait for timer",
+			"alter workflow M.WF insert after Review wait for timer 'addHours([%CurrentDateTime%], 1)' comment 'W';",
+			"alter workflow M.WF insert after Review wait for timer addHours([%CurrentDateTime%], 1) comment 'W';"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			old, canon := mustBuild(t, tc.quoted), mustBuild(t, tc.bare)
+			if !reflect.DeepEqual(old.Statements, canon.Statements) {
+				t.Errorf("string form built %#v\nbare form    %#v", old.Statements, canon.Statements)
+			}
+			for _, d := range old.Deprecations {
+				if d.Code != deprecation.WorkflowStringExpression {
+					t.Errorf("string form recorded %s", d.Code)
+				}
+			}
+			if len(old.Deprecations) == 0 {
+				t.Errorf("string form recorded no %s", deprecation.WorkflowStringExpression)
+			}
+			if got := deprecationCodes(canon); len(got) != 0 {
+				t.Errorf("bare form recorded %v, want none", got)
+			}
+		})
+	}
+}
+
+func decisionOf(t *testing.T, body string) *ast.WorkflowDecisionNode {
+	t.Helper()
+	prog := mustBuild(t, wfHead+"begin\n  "+body+"\n    outcomes true -> { } false -> { };\nend workflow;")
+	wf := prog.Statements[0].(*ast.CreateWorkflowStmt)
+	return wf.Activities[0].(*ast.WorkflowDecisionNode)
+}
+
+// The name slot before a decision's expression: a name followed by a space is
+// a name; a word directly followed by `(` is a function call.
+func TestWorkflowExpression_DecisionNameOrCall(t *testing.T) {
+	for _, tc := range []struct{ body, name, expr string }{
+		{"decision toLowerCase($WorkflowContext/Name) = 'big'", "", "toLowerCase($WorkflowContext/Name) = 'big'"},
+		{"decision BigOrder toLowerCase($WorkflowContext/Name) = 'big'", "BigOrder", "toLowerCase($WorkflowContext/Name) = 'big'"},
+		{"decision BigOrder $WorkflowContext/Big", "BigOrder", "$WorkflowContext/Big"},
+		{"decision BigOrder comment 'Is it big?'", "BigOrder", ""},
+		{"decision $WorkflowContext/Big", "", "$WorkflowContext/Big"},
+	} {
+		d := decisionOf(t, tc.body)
+		if d.Name != tc.name || d.Expression != tc.expr {
+			t.Errorf("%q: name %q expression %q, want %q %q", tc.body, d.Name, d.Expression, tc.name, tc.expr)
+		}
+	}
+}
+
+// `set due date ”` clears the due date: it is no expression at all, so it is
+// not an expression written in a string.
+func TestWorkflowExpression_EmptyStringIsNotDeprecated(t *testing.T) {
+	prog := mustBuild(t, "alter workflow M.WF set due date '';")
+	if got := deprecationCodes(prog); len(got) != 0 {
+		t.Errorf("recorded %v, want none", got)
+	}
+}
+
+func TestWorkflowDecisionReadsBack(t *testing.T) {
+	for _, tc := range []struct {
+		nameClause, expr string
+		want             bool
+	}{
+		{"", "$WorkflowContext/Total > 1000", true},
+		{"", "toLowerCase($WorkflowContext/Name) = 'big'", true},
+		{"", "Total + 1 > 3", false}, // `Total` would be the name
+		{" decision1", "Total + 1 > 3", true},
+	} {
+		if got := WorkflowDecisionReadsBack(tc.nameClause, tc.expr); got != tc.want {
+			t.Errorf("WorkflowDecisionReadsBack(%q, %q) = %v, want %v", tc.nameClause, tc.expr, got, tc.want)
+		}
+	}
+}
diff --git a/mdl/visitor/visitor_xpath_brackets.go b/mdl/visitor/visitor_xpath_brackets.go
index b1f46488ac..51efc8f235 100644
--- a/mdl/visitor/visitor_xpath_brackets.go
+++ b/mdl/visitor/visitor_xpath_brackets.go
@@ -141,6 +141,37 @@ func (b *Builder) recordReversedEntityGrant(ctx *parser.GrantEntityAccessStateme
 	b.fixLastDeprecation(deprecation.ReversedEntityGrant, &ast.Fix{Edits: edits}, "")
 }
 
+// recordReversedEntityRevoke records MDL-DEPR082 on the reversed revoke and
+// computes its rewrite: `revoke R1, R2 on M.E [(rights)]` becomes `revoke
+// rights|all on entity M.E from R1, R2`. Roles, entity and rights are moved as
+// written.
+func (b *Builder) recordReversedEntityRevoke(ctx *parser.RevokeEntityAccessStatementContext) {
+	revoke := ctx.REVOKE().GetSymbol()
+	b.recordDeprecation(deprecation.ReversedEntityRevoke, revoke, "")
+
+	roles, ok1 := ctx.ModuleRoleList().(antlr.ParserRuleContext)
+	entity, ok2 := ctx.QualifiedName().(antlr.ParserRuleContext)
+	if !ok1 || !ok2 || entity.GetStop() == nil {
+		b.fixLastDeprecation(deprecation.ReversedEntityRevoke, nil, "the statement is incomplete")
+		return
+	}
+	like := revoke.GetText()
+	rights := keywordLike(like, "all")
+	last := entity.GetStop()
+	if list, ok := ctx.EntityAccessRightList().(antlr.ParserRuleContext); ok && list != nil {
+		if ctx.RPAREN() == nil {
+			b.fixLastDeprecation(deprecation.ReversedEntityRevoke, nil, "the statement is incomplete")
+			return
+		}
+		rights = nodeText(list)
+		last = ctx.RPAREN().GetSymbol()
+	}
+	text := rights + " " + keywordLike(like, "on") + " " + keywordLike(like, "entity") + " " +
+		nodeText(entity) + " " + keywordLike(like, "from") + " " + nodeText(roles)
+	b.fixLastDeprecation(deprecation.ReversedEntityRevoke,
+		&ast.Fix{Edits: []ast.TextEdit{replaceSpan(roles.GetStart(), last, text)}}, "")
+}
+
 // recordQuotedTargetingXPath records MDL-DEPR031 on a quoted targeting XPath,
 // with the rewrite that takes the XPath out of its string.
 func (b *Builder) recordQuotedTargetingXPath(lit antlr.TerminalNode) {

From 8af84328170412acf24ab71e60ac8208d1674f23 Mon Sep 17 00:00:00 2001
From: Ako <andrej@koelewijn.net>
Date: Mon, 28 Sep 2026 05:48:48 +0000
Subject: [PATCH 06/35] docs: R5 bare expressions, one constant reference,
 canonical revoke (#753)

Skills, docs-site, mxcli syntax, MDL_QUICK_REFERENCE, the spec docs, the
CHANGELOG and the mdl-examples doctype tests in the canonical forms.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .claude/skills/mendix/agents/SKILL.md         |  6 +--
 .claude/skills/mendix/alter-page/SKILL.md     | 16 +++---
 .../mendix/connect-rapidminer-graph/SKILL.md  |  4 +-
 .claude/skills/mendix/create-page/SKILL.md    | 53 +++++++++----------
 .../mendix/create-page/reference/widgets.md   |  2 +-
 .../skills/mendix/manage-security/SKILL.md    |  8 +--
 .../skills/mendix/project-settings/SKILL.md   |  6 +--
 .../skills/mendix/write-workflows/SKILL.md    | 17 +++---
 CHANGELOG.md                                  |  6 ++-
 cmd/mxcli/syntax/features_domain_model.go     |  2 +-
 cmd/mxcli/syntax/features_integration.go      | 12 ++---
 cmd/mxcli/syntax/features_misc.go             |  6 +--
 cmd/mxcli/syntax/features_page.go             |  8 ++-
 cmd/mxcli/syntax/features_security.go         | 12 +++--
 cmd/mxcli/syntax/features_workflow.go         | 32 +++++------
 docs-site/src/appendixes/quick-reference.md   |  4 +-
 .../src/appendixes/version-compatibility.md   |  4 +-
 docs-site/src/examples/security.md            |  6 +--
 docs-site/src/language/entity-access.md       |  6 +--
 docs-site/src/language/grant-revoke.md        |  8 +--
 docs-site/src/language/pages.md               |  8 +--
 docs-site/src/language/project-settings.md    |  4 +-
 docs-site/src/language/workflow-activities.md | 22 ++++----
 docs-site/src/language/workflow-structure.md  |  6 +--
 .../reference/agent/create-knowledge-base.md  |  6 +--
 docs-site/src/reference/agent/create-model.md |  8 +--
 .../reference/domain-model/create-constant.md |  2 +-
 docs-site/src/reference/security/revoke.md    | 14 ++---
 .../src/reference/settings/alter-settings.md  | 17 +++---
 .../src/reference/workflow/create-workflow.md | 16 +++---
 docs/01-project/MDL_QUICK_REFERENCE.md        | 32 +++++------
 .../01-language-reference.md                  | 12 ++---
 docs/05-mdl-specification/03-domain-model.md  |  2 +-
 .../workflow-586-clause-order-canonical.mdl   |  8 +--
 .../bug-tests/workflow-586-clause-order.mdl   |  8 +--
 .../doctype-tests/03-page-examples.mdl        |  2 +-
 .../doctype-tests/08-security-examples.mdl    | 14 ++---
 .../14-project-settings-examples.mdl          |  8 +--
 .../doctype-tests/24-workflow-examples.mdl    | 22 ++++----
 .../27-agent-editor-model-examples.mdl        | 12 ++---
 .../28-agent-editor-examples.mdl              |  8 +--
 .../use-cases/ai-agent-platform-demo.mdl      |  6 +--
 42 files changed, 240 insertions(+), 215 deletions(-)

diff --git a/.claude/skills/mendix/agents/SKILL.md b/.claude/skills/mendix/agents/SKILL.md
index 218f74ea3d..ce87df5eb2 100644
--- a/.claude/skills/mendix/agents/SKILL.md
+++ b/.claude/skills/mendix/agents/SKILL.md
@@ -39,7 +39,7 @@ register `ASU_AgentEditor` as an after-startup microflow.
 ```sql
 create model Module.MyModel (
   Provider: MxCloudGenAI,   -- default, can omit
-  key: Module.ApiKeyConst   -- must be a String constant
+  key: @Module.ApiKeyConst   -- must be a String constant
 );
 ```
 
@@ -64,7 +64,7 @@ document Studio Pro created**, rather than from memory or from this file.
 ```sql
 create knowledge base Module.ProductDocs (
   Provider: MxCloudGenAI,
-  key: Module.KBKeyConst
+  key: @Module.KBKeyConst
 );
 ```
 
@@ -173,7 +173,7 @@ The feature uses `CustomBlobDocument` BSON type with a `Contents` field holding
 
 ### Minimal agent (no tools)
 ```sql
-create model Module.M (Provider: MxCloudGenAI, key: Module.K);
+create model Module.M (Provider: MxCloudGenAI, key: @Module.K);
 create agent Module.A (
   UsageType: task,
   model: Module.M,
diff --git a/.claude/skills/mendix/alter-page/SKILL.md b/.claude/skills/mendix/alter-page/SKILL.md
index 861a4fa7a7..318564a70c 100644
--- a/.claude/skills/mendix/alter-page/SKILL.md
+++ b/.claude/skills/mendix/alter-page/SKILL.md
@@ -193,16 +193,16 @@ so a silent write would build cleanly and then fail to open.
 | `PopupResizable` | Page-level only (case-sensitive) | Boolean | `set (PopupResizable: true)` |
 | `Class` | Page-level (case-sensitive, no ON) | CSS class string | `set (Class: 'container-fluid bg-light')` |
 | `Style` | Page-level (case-sensitive, no ON) | Inline CSS string | `set (Style: 'min-height: 100vh')` |
-| `Visible` (conditional) | Any widget | `[expression]` | `set (Visible: [Name != '']) on ctnDetails` |
-| `Editable` (conditional) | Input widgets | `[expression]` | `set (Editable: [Active]) on txtName` |
+| `Visible` (conditional) | Any widget | expression | `set (Visible: $currentObject/Name != '') on ctnDetails` |
+| `Editable` (conditional) | Input widgets | expression | `set (Editable: $currentObject/Active) on txtName` |
 | `'quotedProp'` | Pluggable widgets | String, Boolean, Number | `set ('showLabel': false) on cbStatus` |
 
-> **Conditional visibility/editability** — `set (Visible: [expr]) on widget` (and
-> `Editable`) attach a per-object expression. Bare attributes are rooted in the
-> widget data context automatically: `[Name != '']` becomes
-> `$currentObject/Name != ''` (paths you write with `$currentObject/…`/`$Param/…`
-> pass through). Setting `Editable` on a non-input widget is rejected. This mirrors
-> CREATE PAGE's `visible: [...]` — see the create-page skill for enum-value rules.
+> **Conditional visibility/editability** — `set (Visible: <expr>) on widget` (and
+> `Editable`) attach a per-object client expression, stored as written: name
+> attributes as `$currentObject/Name`. The bracketed `set (Visible: [Name != ''])`,
+> which roots a bare attribute for you, still works and warns MDL-DEPR081. Setting
+> `Editable` on a non-input widget is rejected. This mirrors CREATE PAGE's
+> `visible:` — see the create-page skill for enum-value rules.
 
 **Pluggable widget properties** use quoted names to set values in the widget's `Object.Properties[]`. Boolean values are stored as `"yes"`/`"no"` in BSON.
 
diff --git a/.claude/skills/mendix/connect-rapidminer-graph/SKILL.md b/.claude/skills/mendix/connect-rapidminer-graph/SKILL.md
index 9cfd0b7303..3cb0ea1b27 100644
--- a/.claude/skills/mendix/connect-rapidminer-graph/SKILL.md
+++ b/.claude/skills/mendix/connect-rapidminer-graph/SKILL.md
@@ -301,9 +301,7 @@ where {
 
 ## Credential management
 
-For demos, literal credentials inline in the microflow are the simplest and most reliable. For anything else, put them in a project constant and reference it from the microflow via `$ConstantName` (requires a non-trivial amount of setup — see the project settings skill).
-
-**Do not** use `$ConstantName` in `create consumed rest service ... authentication: basic (username: $C, password: $C)` — the MDL parser rejects the `$` prefix there, and the skill files' claim of `rest$ConstantValue` serialization isn't reachable.
+For demos, literal credentials inline in the microflow are the simplest and most reliable. For anything else, put them in a project constant and reference it as `@Module.ConstantName` — the one way MDL refers to a constant, in a microflow expression and in `create consumed rest service ... authentication: basic (username: @Module.User, password: @Module.Password)` alike. The older `$ConstantName` spelling in a REST credential still parses and warns MDL-DEPR083.
 
 ## Related skills
 
diff --git a/.claude/skills/mendix/create-page/SKILL.md b/.claude/skills/mendix/create-page/SKILL.md
index 3f944f0807..7d2dbd3c30 100644
--- a/.claude/skills/mendix/create-page/SKILL.md
+++ b/.claude/skills/mendix/create-page/SKILL.md
@@ -259,43 +259,43 @@ See the dedicated skill file: [ALTER PAGE/SNIPPET](../alter-page/SKILL.md)
 
 ## Conditional Visibility and Editability
 
-Any widget (including CONTAINER) can have conditional visibility. Input widgets can also have conditional editability. Use bracket syntax `[expression]`:
+Any widget (including CONTAINER) can have conditional visibility. Input widgets can also have conditional editability. The condition is a Mendix client expression, written bare like every expression in MDL and stored exactly as written — so name the context object's attributes as `$currentObject/Attr`:
 
 ```sql
 -- Conditionally visible widget (boolean attribute)
-textbox txtName (label: 'Name', attribute: Name, visible: [IsActive])
+textbox txtName (label: 'Name', attribute: Name, visible: $currentObject/IsActive)
 
 -- Conditionally visible container
-container ctnDetails (visible: [Name != '']) { dynamictext t (content: '...') }
+container ctnDetails (visible: $currentObject/Name != '') { dynamictext t (content: '...') }
 
 -- Conditionally editable input (boolean)
-textbox txtStatus (label: 'Status', attribute: status, editable: [CanEdit])
+textbox txtStatus (label: 'Status', attribute: status, editable: $currentObject/CanEdit)
 
--- Enum comparison: use the QUALIFIED enum value. Attributes are rooted for you,
--- but a bare enum VALUE would be treated as an attribute — always qualify it.
+-- Enum comparison: use the QUALIFIED enum value.
 textbox txtNotes (label: 'Notes', attribute: Notes,
-  visible: [Status = MES.EquipmentStatus.Running])
+  visible: $currentObject/Status = MES.EquipmentStatus.Running)
 
 -- Combined
 textbox txtEmail (label: 'Email', attribute: Email,
-  visible: [ShowEmail],
-  editable: [CanEdit])
+  visible: $currentObject/ShowEmail,
+  editable: $currentObject/CanEdit)
 
--- Static values still work
+-- Static values still work — a plain value is not a condition
 textbox txtReadOnly (label: 'Read Only', attribute: Name, editable: Never)
 textbox txtHidden (label: 'Hidden', attribute: Name, visible: false)
 
--- A quoted-string expression is also accepted (CREATE and ALTER). Unlike the
--- bracket form, it is NOT auto-rooted — write $currentObject/ yourself.
-dynamictext ovChip (content: 'chip', visible: '$currentObject/Name != empty')
-
--- Function calls work in the bracket form, including functions whose name is
--- also an MDL keyword (trim, length, find). Arguments are rooted like any other
--- reference.
-dynamictext tTrim (content: 'x', visible: [trim($currentObject/Slug) != ''])
-textbox txtSlug (label: 'Slug', attribute: Slug, editable: [length(Slug) > 0])
+-- Function calls work, including functions whose name is also an MDL keyword
+-- (trim, length, find).
+dynamictext tTrim (content: 'x', visible: trim($currentObject/Slug) != '')
+textbox txtSlug (label: 'Slug', attribute: Slug, editable: length($currentObject/Slug) > 0)
 ```
 
+The older bracketed form, `visible: [IsActive]`, still parses: it roots a bare
+attribute in `$currentObject` for you, and warns **MDL-DEPR081**. `mxcli fmt
+--upgrade` rewrites it to the expression it stores (`visible: $currentObject/IsActive`).
+A constant condition (`editable: [false]`, stored as the condition `false`, not as
+`Never`) has no bare spelling and keeps its brackets.
+
 **Visible based on an attribute value** (Studio Pro's "Visible: based on attribute
 value") — list the Boolean/enumeration values that SHOW the widget; `empty` is
 "(empty)". Only an attribute of the enclosing data container's own entity:
@@ -307,7 +307,7 @@ textbox txtPassword (label: 'Password', attribute: Password, visible: IsLocalUse
 
 
 > **`visible:`/`editable:` is a Mendix *expression*, not XPath** — a different
-> function set from a datasource `where` clause, even though both use `[ ... ]`:
+> function set from a datasource `where [ ... ]` clause:
 >
 > | | `visible:` / `editable:` (client expression) | `where [ … ]` (XPath) |
 > |---|---|---|
@@ -323,23 +323,20 @@ textbox txtPassword (label: 'Password', attribute: Password, visible: IsLocalUse
 > [XPath keywords](https://docs.mendix.com/refguide/xpath-keywords-and-system-variables/).
 
 > **An unparseable conditional is an error, not a silent drop.** If the
-> expression inside `visible: [ ... ]` / `editable: [ ... ]` can't be parsed, the
+> expression in `visible:` / `editable:` can't be parsed, the
 > property has nowhere to go and would vanish on write — leaving the widget
 > unconditionally visible/editable, which looks identical to a specificity bug in
 > the running app. `mxcli check` reports this as **MDL-WIDGET19** and fails the
 > command instead. Until v0.16.x, `trim(…)` and `length(…)` hit exactly this path
 > and disappeared without a word (issue #852).
 
-> **Attribute rooting is automatic** — a bare attribute in a widget
-> visibility/editability expression (`[Name != '']`, `[IsActive]`) is rooted in the
-> widget data context as `$currentObject/Name != ''` for you, so it no longer
-> triggers CE0117. Paths you write with an explicit `$currentObject/…` or `$Param/…`
-> prefix pass through unchanged.
+> **Attributes are not rooted for you in the bare form** — the expression is
+> stored as written, so a bare `Name` is CE0117. Write `$currentObject/Name` (or
+> `$Param/…`). Only the deprecated bracketed form roots a bare attribute.
 >
 > **Enum comparison differs by context:**
 > - **Widget visibility/editability expression** (per-object): qualified enum value —
->   `[Status = MES.EquipmentStatus.Running]` (the `Status` attribute is rooted for you;
->   the *value* must stay qualified, or it would be mistaken for an attribute).
+>   `$currentObject/Status = MES.EquipmentStatus.Running`.
 > - **XPath datasource constraint** (`where […]`): the string key works —
 >   `where [Status = 'Running']` (see [xpath-constraints](../xpath-constraints/SKILL.md)).
 > - **Microflow expression**: qualified value —
diff --git a/.claude/skills/mendix/create-page/reference/widgets.md b/.claude/skills/mendix/create-page/reference/widgets.md
index 8cfd2ee1b4..7e75d8e763 100644
--- a/.claude/skills/mendix/create-page/reference/widgets.md
+++ b/.claude/skills/mendix/create-page/reference/widgets.md
@@ -842,7 +842,7 @@ conditional visibility — or put the condition in the microflow it calls:
 ```sql
 actionbutton btnSubmit (
   caption: 'Submit', action: call microflow Mod.ACT_Submit,
-  visible: [$currentObject/Status = Mod.Status.Draft]
+  visible: $currentObject/Status = Mod.Status.Draft
 )
 ```
 
diff --git a/.claude/skills/mendix/manage-security/SKILL.md b/.claude/skills/mendix/manage-security/SKILL.md
index 2c0cafa6ca..7cc0901808 100644
--- a/.claude/skills/mendix/manage-security/SKILL.md
+++ b/.claude/skills/mendix/manage-security/SKILL.md
@@ -262,16 +262,16 @@ grant read (Phone) on entity MyModule.Customer to MyModule.User;
 grant read *, write * on entity MyModule.Order to MyModule.User where [Status = 'Open'];
 
 -- Revoke entity access entirely
-revoke MyModule.Viewer on MyModule.Customer;
+revoke all on entity MyModule.Customer from MyModule.Viewer;
 
 -- Partial revoke: remove read on specific attribute
-revoke MyModule.User on MyModule.Customer (read (Phone));
+revoke read (Phone) on entity MyModule.Customer from MyModule.User;
 
 -- Partial revoke: downgrade write to read-only
-revoke MyModule.User on MyModule.Customer (write (Email));
+revoke write (Email) on entity MyModule.Customer from MyModule.User;
 
 -- Partial revoke: remove structural permission
-revoke MyModule.User on MyModule.Customer (delete);
+revoke delete on entity MyModule.Customer from MyModule.User;
 ```
 
 #### Members added later
diff --git a/.claude/skills/mendix/project-settings/SKILL.md b/.claude/skills/mendix/project-settings/SKILL.md
index bcf305d913..485a5dad9d 100644
--- a/.claude/skills/mendix/project-settings/SKILL.md
+++ b/.claude/skills/mendix/project-settings/SKILL.md
@@ -131,14 +131,14 @@ show constant values;
 show constant values in MyModule;    -- Filter by module
 
 -- Override a constant value in a configuration
-alter settings constant 'BusinessEvents.ServerUrl' value 'kafka:9092'
+alter settings constant @BusinessEvents.ServerUrl value 'kafka:9092'
   in configuration 'Default';
 
 -- Without IN CONFIGURATION (uses first configuration)
-alter settings constant 'MyModule.ApiKey' value 'abc123';
+alter settings constant @MyModule.ApiKey value 'abc123';
 
 -- Remove a constant override (reset to default)
-alter settings drop constant 'MyModule.ApiKey' in configuration 'Default';
+alter settings drop constant @MyModule.ApiKey in configuration 'Default';
 ```
 
 #### Shared vs private values
diff --git a/.claude/skills/mendix/write-workflows/SKILL.md b/.claude/skills/mendix/write-workflows/SKILL.md
index bce603c6df..f218c29d6a 100644
--- a/.claude/skills/mendix/write-workflows/SKILL.md
+++ b/.claude/skills/mendix/write-workflows/SKILL.md
@@ -87,6 +87,11 @@ build with `CE0117 "Error(s) in expression."`.
 
 ## Activities
 
+Expressions are bare, as everywhere in MDL: a decision's condition, a timer's
+delay, a due date (`decision $WorkflowContext/Total > 1000`, `due date
+addDays([%CurrentDateTime%], 3)`). The older string form (`decision '…'`) still
+parses and warns `MDL-DEPR080`; `mxcli fmt --upgrade` rewrites it.
+
 Every activity statement ends with `;`. Blocks `{ … }` nest a sub-flow.
 
 ```sql
@@ -113,14 +118,14 @@ begin
 
   -- Decision: a boolean or enum exclusive split. The name is optional; give one
   -- when a `jump to` targets it.
-  decision decision1 '$WorkflowContext/Total > 1000'
+  decision decision1 $WorkflowContext/Total > 1000
     outcomes
       true  -> { call microflow Module.ACT_Escalate; }
       false -> { call microflow Module.ACT_AutoApprove; };
 
   -- An enum decision: each outcome is a FULLY QUALIFIED enumeration value
   -- (Module.Enumeration.Value), plus one '' outcome for "none of the above".
-  decision decision2 '$WorkflowContext/Status'
+  decision decision2 $WorkflowContext/Status
     outcomes
       'Module.ENUM_Status.Approved' -> { }
       'Module.ENUM_Status.Rejected' -> { }
@@ -132,7 +137,7 @@ begin
     path 2 { call microflow Module.ACT_Log; };
 
   -- Wait for a timer, then continue (duration is a Mendix expression)
-  wait for timer timer1 'addHours([%CurrentDateTime%], 1)';
+  wait for timer timer1 addHours([%CurrentDateTime%], 1);
 
   -- Wait for an external notification (e.g. an event)
   wait for notification waitForNotification1;
@@ -173,7 +178,7 @@ begin
   user task Review 'Review'
     page Module.ReviewPage
     outcomes 'Done' { }
-    boundary event interrupting timer 'addDays([%CurrentDateTime%], 3)' {
+    boundary event interrupting timer addDays([%CurrentDateTime%], 3) {
       call microflow Module.ACT_Escalate;
     };
 end workflow;
@@ -219,7 +224,7 @@ begin
     call microflow HR.ACT_LogCancel;
   };
   event subprocess ESP_Reminder 'Daily reminder'
-    on non interrupting timer 'addDays([%CurrentDateTime%], 1)' as espReminderStart {
+    on non interrupting timer addDays([%CurrentDateTime%], 1) as espReminderStart {
     call microflow HR.ACT_Remind;
   };
 end workflow;
@@ -272,7 +277,7 @@ typed, and each op writes exactly one outcome type into it:
 | `insert outcome '<name>' on X { }` | `UserTaskOutcome` | a user task |
 | `insert condition '<Module.Enum.Value>' on X { }` | `…ConditionOutcome` | a decision, a call microflow |
 | `insert path on X { }` | `ParallelSplitOutcome` | a parallel split |
-| `insert boundary event on X interrupting timer '<expr>' { }` | a boundary event | user task, call microflow, call workflow, wait for notification |
+| `insert boundary event on X interrupting timer <expr> { }` | a boundary event | user task, call microflow, call workflow, wait for notification |
 
 Aim one at the wrong kind and the outcome lands in a list that cannot hold it,
 which is **not** a build error: the project stops **loading**, so Studio Pro will
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3c0e773a25..0fe4742f02 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,9 +8,13 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ### Changed
 
+- **One way to refer to a constant: `@Module.Const`** (ako/mxcli#753, R5) — the spelling a Mendix expression already uses is now the only one: a consumed REST service's credentials (`Username: @Shop.ApiUser`), an agent-editor model's or knowledge base's `Key: @Shop.ApiKey` (also `alter model … set Key = @Shop.ApiKey`), and `alter settings [drop] constant @Shop.ApiUrl … in configuration 'Default'`. `describe model` and `describe knowledge base` print `Key: @…`. **Migrating a script:** nothing breaks — a REST credential's `$ApiUser` (a constant of the service's own module) warns **MDL-DEPR083**, a bare `Key: Shop.ApiKey` **MDL-DEPR084**, and `alter settings constant 'Shop.ApiUrl'` **MDL-DEPR085**; each builds the same statement and `mxcli fmt --upgrade` rewrites it. A settings string that is not a `Module.Name` is left in place and reported.
+- **An entity revoke mirrors the grant** (ako/mxcli#753, R5) — `revoke write (Email), delete on entity Shop.Order from Shop.User;` takes rights away and keeps the rule, `revoke all on entity Shop.Order from Shop.User;` removes the rule. **Migrating a script:** nothing breaks — `revoke Shop.User on Shop.Order [(rights)]` still parses and builds the same statement, `check` / `exec` warn **MDL-DEPR082**, and `mxcli fmt --upgrade` rewrites it.
+- **A page widget's conditional `Visible:` / `Editable:` is a bare expression** (ako/mxcli#753, R5) — `textbox t (Attribute: Name, Visible: $currentObject/IsActive, Editable: $currentObject/Status != 'Closed')`, and the same in `alter page … set (Visible: …) on t`. It is a client expression, not XPath, so it is written like every other expression and stored exactly as written: an attribute is `$currentObject/Attr`. A plain value keeps its meaning (`Visible: false`, `Editable: Never`). `describe page` prints the bare form. `Visible: $currentObject/Active` used to parse as a data source and fail check (MDL-WIDGET19); it now stores the condition. **Migrating a script:** nothing breaks — `Visible: [IsActive]` still parses, roots a bare attribute in `$currentObject` as before, and warns **MDL-DEPR081**; `mxcli fmt --upgrade` rewrites it to the expression it stores (`Visible: $currentObject/IsActive`). A constant condition (`Editable: [false]`, stored as the condition `false` rather than as `Never`) has no bare spelling, keeps its brackets and is not reported.
+- **A workflow's expressions are written bare** (ako/mxcli#753, R5) — a decision's condition, `wait for timer`'s delay, a timer boundary event, a timer event sub-process's first execution time and a due date (workflow, user task, `alter workflow … set [activity …] due date`) are MDL expressions like every other: `decision $WorkflowContext/Total > 1000 comment 'Large order?'`, `due date addDays([%CurrentDateTime%], 3)`. The expression is stored as written. `describe workflow` prints the bare form; a stored expression that would not read back as itself (one the MDL expression grammar cannot parse, or with surrounding whitespace) keeps the string form, and a decision or `wait for timer` whose expression would otherwise read as the activity's name gets its name written. **Migrating a script:** nothing breaks — the string form still parses with the same meaning (its content is the expression; no slot takes a string-valued expression), `check` / `exec` warn **MDL-DEPR080**, and `mxcli fmt --upgrade` rewrites it. A string that does not read back as the same bare expression is left in place and reported. `set due date ''` still clears a due date and is not reported.
 - **Document types are named as Studio Pro names them** (ako/mxcli#755, R10) — `consumed rest service` (was `rest client`), `consumed odata service` (was `odata client`), `published odata service` (was `odata service`), `task queue` (was `queue`), `alter app security` (was `alter project security`) and `alter settings runtime` (was `alter settings model`), in every statement that names the type: create, alter, drop, describe, list, move, grant/revoke on a published OData service, and an external entity's `from consumed odata service`. `describe` writes the new names. **Migrating a script:** nothing breaks — the old names still parse and build the identical statement, `check` / `exec` warn **MDL-DEPR550** to **MDL-DEPR555**, and `mxcli fmt --upgrade` rewrites them. `call microflow … in queue M.Q` is a call option, not the type name, and is unchanged.
 
-- **An entity grant names the rights first, and every XPath is written in `[ ]`** (ako/mxcli#753, R5) — `grant read *, write (Email), create on entity Shop.Order to Shop.User where [Status = 'Open'];` takes the word order of every other grant, and the constraint is bracketed like a datasource or retrieve `where`, so the quotes inside it are written once instead of doubled. A workflow user task's targeting is the same: `targeting users xpath [System.UserRoles = '[%UserRole_Manager%]']`, and `alter workflow … set activity … targeting xpath [ … ]`. Sibling predicate groups (`[a][b]`) are one constraint, kept as written. `describe entity` and `describe workflow` print the new forms; a stored constraint the bracketed grammar does not read (none in the Studio Pro-authored PedApp and TestApp fixtures) is printed in the old quoted form so the output stays re-executable. **Migrating a script:** nothing breaks — `grant Shop.User on Shop.Order (read *) where '[…]'` and `targeting xpath '[…]'` still parse and build the same rule, and `check` / `exec` warn **MDL-DEPR030** and **MDL-DEPR031**; `mxcli fmt --upgrade` rewrites both. A quoted value that is not a bracketed XPath is left in place and reported. `revoke` keeps its current form for now.
+- **An entity grant names the rights first, and every XPath is written in `[ ]`** (ako/mxcli#753, R5) — `grant read *, write (Email), create on entity Shop.Order to Shop.User where [Status = 'Open'];` takes the word order of every other grant, and the constraint is bracketed like a datasource or retrieve `where`, so the quotes inside it are written once instead of doubled. A workflow user task's targeting is the same: `targeting users xpath [System.UserRoles = '[%UserRole_Manager%]']`, and `alter workflow … set activity … targeting xpath [ … ]`. Sibling predicate groups (`[a][b]`) are one constraint, kept as written. `describe entity` and `describe workflow` print the new forms; a stored constraint the bracketed grammar does not read (none in the Studio Pro-authored PedApp and TestApp fixtures) is printed in the old quoted form so the output stays re-executable. **Migrating a script:** nothing breaks — `grant Shop.User on Shop.Order (read *) where '[…]'` and `targeting xpath '[…]'` still parse and build the same rule, and `check` / `exec` warn **MDL-DEPR030** and **MDL-DEPR031**; `mxcli fmt --upgrade` rewrites both. A quoted value that is not a bracketed XPath is left in place and reported.
 - **A microflow error handler is `on error [without rollback] begin … end error`; `while` takes `begin … end while` like `loop`** (ako/mxcli#754, R2) — braces hold declarative children and imperative flow is `begin … end <keyword>`, and the error handler was the only brace block inside a microflow. `describe microflow` / `describe nanoflow` now print `commit $O on error begin … end error;` (an empty handler `… on error without rollback begin end error;`), and so do the generated test flows of `mxcli test`. Under the `mdl 1;` preview header a `while` without `begin`, or ending in a bare `end`, is an error; without the header it keeps parsing and warns **MDL-V1-WHILE**, and `mxcli fmt --upgrade --header` inserts the missing words. Measured on the Studio Pro-authored PedApp and TestApp fixtures: the round-trip harness stays green. **Migrating a script:** nothing breaks — `on error { … }` still parses, builds the identical handler, and `check` / `exec` warn **MDL-DEPR540**; `mxcli fmt --upgrade` rewrites it.
 - **One argument form at every call site: `Param = expression`; one text-template form: `with ({1} = …)`** (ako/mxcli#751, R3/R4) — `call microflow`/`nanoflow`/`java action`/…, `execute database query`, `send rest request`, `show page`, and page/button actions and microflow/nanoflow data sources all bind an argument as `Order = $Order`, with no `$` on the parameter name and `=` rather than `:`. A workflow's `call microflow` / `call workflow` takes its arguments the same way, right after the callee, as bare expressions: `call microflow Shop.ACT_Process(Order = $WorkflowContext) as act1 comment 'Process'`. `show message` and `validation feedback` take `with ({1} = $a, {2} = $b)`, like `log` and the REST templates. `describe` writes these forms; it also writes a validation feedback's template arguments, which it used to drop, so describe → exec lost them. Measured on a copy of the Studio Pro-authored TestApp (Mendix 11.14.0): a script in the new forms and the same script in the old forms describe identically, and `mx check` reports 0 errors. **Migrating a script:** nothing breaks — `$Param = e` (**MDL-DEPR006**), `Param: e` (**MDL-DEPR007**), a workflow's `with (Param = '<expression>')` (**MDL-DEPR008**, same meaning: the string's content is the expression) and `objects [..]` / `parameters [..]` (**MDL-DEPR009**) still parse and build the same model, `check` / `exec` warn, and `mxcli fmt --upgrade` rewrites them. A workflow string whose content does not read back as the same bare expression is left in place and reported, and `describe` keeps the string form for such a stored expression.
 - **`describe page` no longer invents names Mendix does not store; `alter page` addresses a DataGrid 2 column by what it shows** (ako/mxcli#749, R12) — a layout grid's rows and columns, a data grid's columns and control bar, a gallery's template and filter, a chart's series and other object-list items have no Name in the model, and describe used to print one it made up (`row row1`, `column col3`, `controlbar controlBar1`, and a data-grid column named after its attribute, so two columns over `FullName` were both `column FullName`). They now print without one — `row { column (DesktopWidth: 6) { … } }`, `column (Attribute: FullName, Caption: 'Full name')` — and the widget name is optional in the grammar for exactly those elements. A column is addressed as `grid column(Attr)`, written as describe writes the attribute (`Owner/Name` over an association), or `grid column('Caption')`; an address two columns share is refused, listing the matches, unless `@n` picks one (`drop dg column(FullName)@2`). A widget Mendix does store a name for still needs one: `check` reports a missing one as **MDL-WIDGET35** and the page builder refuses it. Measured on the Studio Pro-authored PedApp fixture: the round-trip harness stays green, and `mx check` 11.13 shows no new error after `alter page … column(…)` edits and a create with nameless rows, grid columns and gallery slots. **Migrating a script:** nothing breaks — a name written on one of those elements still parses, is ignored as before, and `check` / `exec` warn **MDL-DEPR005**; `mxcli fmt --upgrade` removes it. The older `grid.Column` address keeps working. The info-level MDL-WIDGET16 note about dropped column names is gone, replaced by that warning.
diff --git a/cmd/mxcli/syntax/features_domain_model.go b/cmd/mxcli/syntax/features_domain_model.go
index 8f094e8420..ae9a6dc1cb 100644
--- a/cmd/mxcli/syntax/features_domain_model.go
+++ b/cmd/mxcli/syntax/features_domain_model.go
@@ -418,7 +418,7 @@ func init() {
 			"show constants", "constant values", "modify constant",
 			"string constant", "integer constant", "boolean constant",
 		},
-		Syntax: "CREATE CONSTANT Module.Name\n  TYPE String|Integer|Long|Decimal|Boolean|DateTime\n  DEFAULT value\n  [COMMENT 'description'];\n\nCREATE OR MODIFY CONSTANT Module.Name\n  TYPE DataType DEFAULT value [COMMENT 'text'];\n\nSHOW CONSTANTS;\nSHOW CONSTANTS IN <module>;\nSHOW CONSTANT VALUES;\nDESCRIBE CONSTANT Module.Name;\nDROP CONSTANT Module.Name;\n\nRemove override:\n  ALTER SETTINGS DROP CONSTANT 'Module.Name' IN CONFIGURATION 'cfg';\n\n" +
+		Syntax: "CREATE CONSTANT Module.Name\n  TYPE String|Integer|Long|Decimal|Boolean|DateTime\n  DEFAULT value\n  [COMMENT 'description'];\n\nCREATE OR MODIFY CONSTANT Module.Name\n  TYPE DataType DEFAULT value [COMMENT 'text'];\n\nSHOW CONSTANTS;\nSHOW CONSTANTS IN <module>;\nSHOW CONSTANT VALUES;\nDESCRIBE CONSTANT Module.Name;\nDROP CONSTANT Module.Name;\n\nRemove override:\n  ALTER SETTINGS DROP CONSTANT @Module.Name IN CONFIGURATION 'cfg';\n\n" +
 			"Shared vs private values:\n" +
 			"  A per-configuration override holds either a SHARED value (stored in the\n" +
 			"  model, so in version control — every developer gets it) or a PRIVATE one\n" +
diff --git a/cmd/mxcli/syntax/features_integration.go b/cmd/mxcli/syntax/features_integration.go
index e1a662c6ec..00ca59a952 100644
--- a/cmd/mxcli/syntax/features_integration.go
+++ b/cmd/mxcli/syntax/features_integration.go
@@ -816,8 +816,8 @@ DESCRIBE DATABASE CONNECTION Ops.Erp;`,
 			"agent", "agents", "model", "knowledge base", "mcp service",
 			"agent editor", "llm", "ai", "genai", "mxcloudgenai",
 		},
-		Syntax:  "LIST MODELS [IN Module];\nLIST KNOWLEDGE BASES [IN Module];\nLIST CONSUMED MCP SERVICES [IN Module];\nLIST AGENTS [IN Module];\nDESCRIBE MODEL Module.Name;\nCREATE MODEL Module.Name (Provider: MxCloudGenAI, Key: Module.ApiKey);\nCREATE KNOWLEDGE BASE Module.Name (Provider: MxCloudGenAI, Key: Module.KBKey);\nCREATE CONSUMED MCP SERVICE Module.Name (ProtocolVersion: v2025_03_26, ...);\nCREATE AGENT Module.Name (UsageType: Task|Chat, Model: Module.MyModel, SystemPrompt: '...') { ... };\nDROP AGENT Module.Name;",
-		Example: "CREATE MODEL MyModule.GPT4 (\n  Provider: MxCloudGenAI,\n  Key: MyModule.ModelApiKey\n);\n\nCREATE AGENT MyModule.Summarizer (\n  UsageType: Task,\n  Model: MyModule.GPT4,\n  SystemPrompt: 'Summarize in 3 sentences.',\n  UserPrompt: 'Enter text.'\n);",
+		Syntax:  "LIST MODELS [IN Module];\nLIST KNOWLEDGE BASES [IN Module];\nLIST CONSUMED MCP SERVICES [IN Module];\nLIST AGENTS [IN Module];\nDESCRIBE MODEL Module.Name;\nCREATE MODEL Module.Name (Provider: MxCloudGenAI, Key: @Module.ApiKey);\nCREATE KNOWLEDGE BASE Module.Name (Provider: MxCloudGenAI, Key: @Module.KBKey);\nCREATE CONSUMED MCP SERVICE Module.Name (ProtocolVersion: v2025_03_26, ...);\nCREATE AGENT Module.Name (UsageType: Task|Chat, Model: Module.MyModel, SystemPrompt: '...') { ... };\nDROP AGENT Module.Name;",
+		Example: "CREATE MODEL MyModule.GPT4 (\n  Provider: MxCloudGenAI,\n  Key: @MyModule.ModelApiKey\n);\n\nCREATE AGENT MyModule.Summarizer (\n  UsageType: Task,\n  Model: MyModule.GPT4,\n  SystemPrompt: 'Summarize in 3 sentences.',\n  UserPrompt: 'Enter text.'\n);",
 		SeeAlso: []string{"agents.model", "agents.knowledge-base", "agents.mcp-service", "agents.agent"},
 	})
 
@@ -825,8 +825,8 @@ DESCRIBE DATABASE CONNECTION Ops.Erp;`,
 		Path:     "agents.model",
 		Summary:  "CREATE/DROP MODEL documents for AI agents",
 		Keywords: []string{"create model", "drop model", "describe model", "list models", "provider", "mxcloudgenai"},
-		Syntax:   "CREATE [OR MODIFY] MODEL Module.Name [FOLDER 'path'] (\n  Provider: MxCloudGenAI,\n  Key: Module.ApiKeyConstant\n);\nDESCRIBE MODEL Module.Name;\nLIST MODELS [IN Module];\nDROP MODEL Module.Name;",
-		Example:  "create model MyModule.GPT4 (\n  Provider: MxCloudGenAI,\n  Key: MyModule.ModelApiKey\n);",
+		Syntax:   "CREATE [OR MODIFY] MODEL Module.Name [FOLDER 'path'] (\n  Provider: MxCloudGenAI,\n  Key: @Module.ApiKeyConstant\n);\nDESCRIBE MODEL Module.Name;\nLIST MODELS [IN Module];\nDROP MODEL Module.Name;",
+		Example:  "create model MyModule.GPT4 (\n  Provider: MxCloudGenAI,\n  Key: @MyModule.ModelApiKey\n);",
 		SeeAlso:  []string{"agents"},
 	})
 
@@ -834,8 +834,8 @@ DESCRIBE DATABASE CONNECTION Ops.Erp;`,
 		Path:     "agents.knowledge-base",
 		Summary:  "CREATE/DROP KNOWLEDGE BASE documents for AI agents",
 		Keywords: []string{"create knowledge base", "drop knowledge base", "knowledge base", "kb", "rag"},
-		Syntax:   "CREATE [OR MODIFY] KNOWLEDGE BASE Module.Name [FOLDER 'path'] (\n  Provider: MxCloudGenAI,\n  Key: Module.KBApiKeyConstant\n);\nDESCRIBE KNOWLEDGE BASE Module.Name;\nLIST KNOWLEDGE BASES [IN Module];\nDROP KNOWLEDGE BASE Module.Name;",
-		Example:  "create knowledge base MyModule.ProductDocs (\n  Provider: MxCloudGenAI,\n  Key: MyModule.KBApiKey\n);",
+		Syntax:   "CREATE [OR MODIFY] KNOWLEDGE BASE Module.Name [FOLDER 'path'] (\n  Provider: MxCloudGenAI,\n  Key: @Module.KBApiKeyConstant\n);\nDESCRIBE KNOWLEDGE BASE Module.Name;\nLIST KNOWLEDGE BASES [IN Module];\nDROP KNOWLEDGE BASE Module.Name;",
+		Example:  "create knowledge base MyModule.ProductDocs (\n  Provider: MxCloudGenAI,\n  Key: @MyModule.KBApiKey\n);",
 		SeeAlso:  []string{"agents"},
 	})
 
diff --git a/cmd/mxcli/syntax/features_misc.go b/cmd/mxcli/syntax/features_misc.go
index 50f6410ae4..2adceeb49c 100644
--- a/cmd/mxcli/syntax/features_misc.go
+++ b/cmd/mxcli/syntax/features_misc.go
@@ -462,8 +462,8 @@ create or modify translations in Administration for nl_NL (
 		},
 		Syntax: `ALTER SETTINGS RUNTIME <key> = <value>;
 ALTER SETTINGS CONFIGURATION '<name>' <key> = <value>, ...;
-ALTER SETTINGS CONSTANT '<qualifiedName>' VALUE '<value>' IN CONFIGURATION '<name>';
-ALTER SETTINGS DROP CONSTANT '<qualifiedName>' IN CONFIGURATION '<name>';
+ALTER SETTINGS CONSTANT @<qualifiedName> VALUE '<value>' IN CONFIGURATION '<name>';
+ALTER SETTINGS DROP CONSTANT @<qualifiedName> IN CONFIGURATION '<name>';
 ALTER SETTINGS LANGUAGE DefaultLanguageCode = '<code>';
 ALTER SETTINGS LANGUAGE ADD '<code>' [(CheckCompleteness: true, CustomDateFormat: '<fmt>')];
 ALTER SETTINGS LANGUAGE ADD OR MODIFY '<code>' [(...)];
@@ -482,7 +482,7 @@ ALTER SETTINGS CONFIGURATION 'Default'
   DatabaseType = 'PostgreSql',
   DatabaseUrl = 'localhost:5432',
   DatabaseName = 'mydb';
-ALTER SETTINGS CONSTANT 'BusinessEvents.ServerUrl' VALUE 'kafka:9092'
+ALTER SETTINGS CONSTANT @BusinessEvents.ServerUrl VALUE 'kafka:9092'
   IN CONFIGURATION 'Default';
 CREATE CONFIGURATION 'Production'
   DatabaseType = 'PostgreSql',
diff --git a/cmd/mxcli/syntax/features_page.go b/cmd/mxcli/syntax/features_page.go
index 81e6b357bd..0378124d96 100644
--- a/cmd/mxcli/syntax/features_page.go
+++ b/cmd/mxcli/syntax/features_page.go
@@ -120,7 +120,7 @@ CREATE PAGE Sales.Detail (Title: 'Detail', Layout: Atlas_Core.Atlas_Default) {
 			"image", "filter", "textfilter", "numberfilter", "datefilter",
 			"dropdownfilter", "dropdownsort", "customwidget", "pluggablewidget",
 			"statictext", "staticimage", "dynamicimage", "dropdown", "referenceselector",
-			"legacydatagrid",
+			"legacydatagrid", "visible", "editable", "conditional visibility",
 		},
 		Syntax: "-- Containers\nLAYOUTGRID name { ROW r { COLUMN c (DesktopWidth: 6) { ... } } }\nCONTAINER name (Class: 'cls') { ... }\nCONTAINER name (OnClick: CALL MICROFLOW Module.MF) { ... }   -- clickable container\nCUSTOMCONTAINER name (Class: 'cls') { ... }\nGROUPBOX name (Caption: 'C') { ... }\nTABCONTAINER name { TABPAGE tp (Caption: 'One') { ... } TABPAGE tp2 (Caption: 'Two') { ... } }\n\n" +
 			"-- Data widgets\nDATAVIEW name (DataSource: $Param) { ... FOOTER f { ... } }\nDATAGRID name (DataSource: DATABASE Module.Entity) { COLUMN c (Attribute: A) }\nGALLERY name (DataSource: DATABASE Module.Entity, DesktopColumns: 3) { ... }\nLISTVIEW name (DataSource: DATABASE Module.Entity) { ... }\nLISTVIEW name (...) { ... TEMPLATE FOR Module.Specialization { ... } }\n\n" +
@@ -144,6 +144,12 @@ CREATE PAGE Sales.Detail (Title: 'Detail', Layout: Atlas_Core.Atlas_Default) {
 			"--   container the grid declares — it used to be dropped on write with no\n" +
 			"--   diagnostic, and is now refused (MDL-WIDGET30).\n\n" +
 			"-- Inputs\nTEXTBOX name (Label: 'L', Attribute: Attr)\nTEXTAREA | DATEPICKER | COMBOBOX | CHECKBOX | RADIOBUTTONS\n\n" +
+			"-- Conditional visibility / editability: a bare client expression, stored as\n" +
+			"-- written (name attributes as $currentObject/Attr). A plain value is static.\n" +
+			"TEXTBOX name (Attribute: Attr, Visible: $currentObject/IsActive, Editable: $currentObject/Status != 'Closed')\n" +
+			"TEXTBOX name (Attribute: Attr, Visible: false, Editable: Never)\n" +
+			"--   The bracketed Visible: [IsActive] (attributes rooted for you) is the deprecated\n" +
+			"--   spelling, MDL-DEPR081.\n\n" +
 			"-- Actions\nACTIONBUTTON name (Caption: 'C', Action: SAVE CHANGES, ButtonStyle: Primary)\nLINKBUTTON name (Caption: 'C', Action: ...)\n\n" +
 			"-- Display\nDYNAMICTEXT name (Content: 'Hello, {1}!', ContentParams: [{1} = Name])\nTITLE name (Content: 'Heading')\nIMAGE name (Image: 'Module.Collection.ImageName')\nIMAGE name (ImageType: imageUrl, ImageUrl: 'https://…')\n" +
 			"--   IMAGE needs a source. Its default, `ImageType: image`, shows an entry from an\n" +
diff --git a/cmd/mxcli/syntax/features_security.go b/cmd/mxcli/syntax/features_security.go
index 0008f1c306..23e6d86736 100644
--- a/cmd/mxcli/syntax/features_security.go
+++ b/cmd/mxcli/syntax/features_security.go
@@ -34,13 +34,15 @@ func init() {
 			"create", "delete", "xpath", "row-level security",
 		},
 		Syntax: "GRANT <rights> ON ENTITY <module>.<entity> TO <module>.<role> [, ...] [WHERE [<xpath>]];\n" +
-			"REVOKE <module>.<role> ON <module>.<entity>;\n" +
-			"REVOKE <module>.<role> ON <module>.<entity> (<rights>);\n\n" +
+			"REVOKE ALL ON ENTITY <module>.<entity> FROM <module>.<role> [, ...];       -- removes the rule\n" +
+			"REVOKE <rights> ON ENTITY <module>.<entity> FROM <module>.<role> [, ...];  -- takes rights away\n\n" +
 			"Rights: CREATE, DELETE, READ *, READ (<attr>,...), WRITE *, WRITE (<attr>,...)\n\n" +
 			"The XPath is written in [ ], as everywhere else, so quotes inside it are\n" +
 			"not doubled; sibling groups ([a][b]) are one constraint. The old order,\n" +
 			"GRANT <role> ON <entity> (<rights>) WHERE '<xpath>', still parses and\n" +
-			"warns MDL-DEPR030; `mxcli fmt --upgrade` rewrites it.\n\n" +
+			"warns MDL-DEPR030; `mxcli fmt --upgrade` rewrites it. The revoke mirrors\n" +
+			"the grant; its old order, REVOKE <role> ON <entity> [(<rights>)], warns\n" +
+			"MDL-DEPR082 and is rewritten the same way.\n\n" +
 			"A module role is always Module.Role. A bare role name parses but is\n" +
 			"refused (MDL-GRANT02) — mxcli cannot tell which module it belongs to.\n\n" +
 			"Members added later:\n" +
@@ -66,7 +68,9 @@ func init() {
 			"-- Contract extends DocumentBase: DocName is inherited, ContractNumber is own\n" +
 			"GRANT READ (DocName, ContractNumber) ON ENTITY Docs.Contract TO Docs.Viewer;\n\n" +
 			"-- Attachment extends System.FileDocument: Name and Size are inherited\n" +
-			"GRANT READ (Category, \"Name\", Size) ON ENTITY Docs.Attachment TO Docs.Viewer;",
+			"GRANT READ (Category, \"Name\", Size) ON ENTITY Docs.Attachment TO Docs.Viewer;\n\n" +
+			"REVOKE WRITE (Email) ON ENTITY Shop.Customer FROM Shop.User;\n" +
+			"REVOKE ALL ON ENTITY Shop.Order FROM Shop.User;",
 		SeeAlso: []string{"security.module-role", "security.microflow-access"},
 	})
 
diff --git a/cmd/mxcli/syntax/features_workflow.go b/cmd/mxcli/syntax/features_workflow.go
index 2c813ce03c..4ce92b0fab 100644
--- a/cmd/mxcli/syntax/features_workflow.go
+++ b/cmd/mxcli/syntax/features_workflow.go
@@ -39,7 +39,7 @@ func init() {
 			"  [DESCRIPTION '<text>']\n" +
 			"  [EXPORT LEVEL Hidden | API]\n" +
 			"  [OVERVIEW PAGE Module.OverviewPage]\n" +
-			"  [DUE DATE '<expression>']\n" +
+			"  [DUE DATE <expression>]\n" +
 			"  [ON WORKFLOW EVENTS (<type>, ...) MICROFLOW Module.Handler [AS '<description>']]...\n" +
 			"  [ON ANY WORKFLOW EVENT MICROFLOW Module.Handler [AS '<description>']]...\n" +
 			"BEGIN\n  <activities>\nEND WORKFLOW;\n\n" +
@@ -126,7 +126,7 @@ func init() {
 			"  [TARGETING [USERS | GROUPS] MICROFLOW Module.MF | TARGETING [USERS | GROUPS] XPATH [<xpath>]]\n" +
 			"  [ON CREATED MICROFLOW Module.MF]  -- (System.WorkflowUserTask, <context entity>), returns nothing\n" +
 			"  [ENTITY Module.Entity]\n" +
-			"  [DUE DATE '<expression>']\n" +
+			"  [DUE DATE <expression>]\n" +
 			"  [DESCRIPTION '<text>']\n" +
 			"  OUTCOMES '<outcome1>' { <activities> } '<outcome2>' { <activities> };\n\n" + "-- The clauses are a SET: write them in ANY order, each at most once\n" +
 			"-- (ako/mxcli#586). The two TARGETING spellings are ONE clause — a task\n" +
@@ -196,7 +196,7 @@ func init() {
 			"  [TARGETING [USERS | GROUPS] MICROFLOW Module.MF | TARGETING [USERS | GROUPS] XPATH [<xpath>]]\n" +
 			"  [ON CREATED MICROFLOW Module.MF]  -- (System.WorkflowUserTask, <context entity>), returns nothing\n" +
 			"  [ENTITY Module.Entity]\n" +
-			"  [DUE DATE '<expression>']\n" +
+			"  [DUE DATE <expression>]\n" +
 			"  [DESCRIPTION '<text>']\n" +
 			"  [PARTICIPANTS ALL | <n> | <n> PERCENT]\n" +
 			"  [DECIDE BY <rule>]\n" +
@@ -237,12 +237,14 @@ func init() {
 		// cannot open. This entry taught 'Under 1000' / 'Over 1000' — both of
 		// which corrupt the model (ako/mxcli#1031, ako/mxcli#1065).
 		Syntax: "-- Boolean decision:\n" +
-			"DECISION [<name>] '<boolean-expression>' [COMMENT '<text>']\n  OUTCOMES TRUE -> { <activities> } FALSE -> { <activities> };\n\n" +
+			"DECISION [<name>] <boolean-expression> [COMMENT '<text>']\n  OUTCOMES TRUE -> { <activities> } FALSE -> { <activities> };\n\n" +
 			"-- Enumeration decision — each outcome is a QUALIFIED enum value,\n" +
 			"-- plus one '' outcome for 'none of the above' (without it: CE6686):\n" +
-			"DECISION [<name>] '<enum-expression>' [COMMENT '<text>']\n  OUTCOMES 'Module.Enumeration.Value' -> { <activities> } ... '' -> { };",
-		Example: "-- Boolean\nDECISION decision1 '$WorkflowContext/Amount > 1000'\n  OUTCOMES\n    TRUE -> {\n      USER TASK ManagerApproval 'Manager must approve'\n        OUTCOMES 'OK' { };\n    }\n    FALSE -> { };\n\n" +
-			"-- Enumeration: the value must be Module.Enumeration.Value.\n-- A bare 'Approved' makes the project UNLOADABLE, not merely invalid.\nDECISION decision2 '$WorkflowContext/Status'\n  OUTCOMES\n    'Sales.ENUM_Status.Approved' -> { }\n    'Sales.ENUM_Status.Rejected' -> { }\n    '' -> { };",
+			"DECISION [<name>] <enum-expression> [COMMENT '<text>']\n  OUTCOMES 'Module.Enumeration.Value' -> { <activities> } ... '' -> { };\n\n" +
+			"-- The expression is bare (R5). The older string form, DECISION '<expression>',\n" +
+			"-- is the deprecated alias MDL-DEPR080, as it is for timers and due dates.",
+		Example: "-- Boolean\nDECISION decision1 $WorkflowContext/Amount > 1000\n  OUTCOMES\n    TRUE -> {\n      USER TASK ManagerApproval 'Manager must approve'\n        OUTCOMES 'OK' { };\n    }\n    FALSE -> { };\n\n" +
+			"-- Enumeration: the value must be Module.Enumeration.Value.\n-- A bare 'Approved' makes the project UNLOADABLE, not merely invalid.\nDECISION decision2 $WorkflowContext/Status\n  OUTCOMES\n    'Sales.ENUM_Status.Approved' -> { }\n    'Sales.ENUM_Status.Rejected' -> { }\n    '' -> { };",
 		SeeAlso: []string{"workflow.create", "workflow.parallel-split"},
 	})
 
@@ -329,7 +331,7 @@ func init() {
 			"DECISION <name> ['<caption>'] ...\nPARALLEL SPLIT <name> ...\n" +
 			"WAIT FOR TIMER <name> ...\nWAIT FOR NOTIFICATION <name>\n" +
 			"CALL MICROFLOW Module.MF AS <name>\nCALL WORKFLOW Module.WF AS <name>",
-		Example: "DECISION decision1 '$WorkflowContext/Total > 1000'\n" +
+		Example: "DECISION decision1 $WorkflowContext/Total > 1000\n" +
 			"  OUTCOMES\n    true -> { }\n    false -> { };\n\n" +
 			"PARALLEL SPLIT split1\n  PATH 1 { JUMP TO decision1; }\n  PATH 2 { };",
 		SeeAlso: []string{"workflow.create", "workflow.decision", "workflow.parallel-split", "workflow.end"},
@@ -407,8 +409,8 @@ func init() {
 		// 'Workflows$TimerBoundaryEvent' could not be found"). This entry showed
 		// the bare form, with 'P3D' — not a valid timer expression — as its delay.
 		// ako/view-entity-examples FINDINGS §7.
-		Syntax:     "-- inline, as a clause of a USER TASK (after OUTCOMES):\nBOUNDARY EVENT (INTERRUPTING | NON INTERRUPTING) TIMER '<datetime-expression>' { <activities> }\nBOUNDARY EVENT (INTERRUPTING | NON INTERRUPTING) NOTIFICATION <name> ['<caption>'] { <activities> }\n\n-- A notification boundary event (Mendix 11.11+) is triggered by `notify workflow`\n-- targeting its name, so the name is unique in the workflow. ALTER cannot insert\n-- one yet; restate the workflow instead.\n\n-- or add a timer to an existing task:\nALTER WORKFLOW <wf> INSERT BOUNDARY EVENT ON <task> (INTERRUPTING | NON INTERRUPTING) TIMER '<datetime-expression>' { <activities> }\n\n-- Name the kind: a bare TIMER is refused on Mendix 11 (MDL-WF07) — it writes a\n-- type the runtime cannot load. The delay is an expression that yields a\n-- DateTime, e.g. 'addDays([%CurrentDateTime%], 3)'. mxcli ends every boundary\n-- path with Mendix's end-of-path marker, so a path may end in a call; use\n-- JUMP TO to return to the task instead.",
-		Example:    "user task ReviewTask 'Review'\n  page Module.WF_Review\n  outcomes 'Done' { }\n  boundary event interrupting timer 'addDays([%CurrentDateTime%], 3)' {\n    call microflow Module.WF_Escalate;\n  };",
+		Syntax:     "-- inline, as a clause of a USER TASK (after OUTCOMES):\nBOUNDARY EVENT (INTERRUPTING | NON INTERRUPTING) TIMER <datetime-expression> { <activities> }\nBOUNDARY EVENT (INTERRUPTING | NON INTERRUPTING) NOTIFICATION <name> ['<caption>'] { <activities> }\n\n-- A notification boundary event (Mendix 11.11+) is triggered by `notify workflow`\n-- targeting its name, so the name is unique in the workflow. ALTER cannot insert\n-- one yet; restate the workflow instead.\n\n-- or add a timer to an existing task:\nALTER WORKFLOW <wf> INSERT BOUNDARY EVENT ON <task> (INTERRUPTING | NON INTERRUPTING) TIMER <datetime-expression> { <activities> }\n\n-- Name the kind: a bare TIMER is refused on Mendix 11 (MDL-WF07) — it writes a\n-- type the runtime cannot load. The delay is an expression that yields a\n-- DateTime, e.g. addDays([%CurrentDateTime%], 3). mxcli ends every boundary\n-- path with Mendix's end-of-path marker, so a path may end in a call; use\n-- JUMP TO to return to the task instead.",
+		Example:    "user task ReviewTask 'Review'\n  page Module.WF_Review\n  outcomes 'Done' { }\n  boundary event interrupting timer addDays([%CurrentDateTime%], 3) {\n    call microflow Module.WF_Escalate;\n  };",
 		MinVersion: "10.6.0",
 		SeeAlso:    []string{"workflow.user-task", "workflow.notification", "workflow.event-subprocess"},
 	})
@@ -425,7 +427,7 @@ func init() {
 			"  ON (INTERRUPTING | NON INTERRUPTING) NOTIFICATION [<start>] ['<start caption>']\n" +
 			"  { <activities> };\n" +
 			"EVENT SUBPROCESS <name> ['<caption>']\n" +
-			"  ON (INTERRUPTING | NON INTERRUPTING) TIMER '<first-execution-time>' [AS <start>] [COMMENT '<start caption>']\n" +
+			"  ON (INTERRUPTING | NON INTERRUPTING) TIMER <first-execution-time> [AS <start>] [COMMENT '<start caption>']\n" +
 			"  { <activities> };\n\n" +
 			"-- Interrupting cancels every active path first; non-interrupting runs alongside.\n" +
 			"-- A notification start is what `notify workflow` targets. The body's End is\n" +
@@ -440,7 +442,7 @@ func init() {
 			"    call microflow HR.ACT_LogCancel;\n" +
 			"  };\n" +
 			"  event subprocess ESP_Reminder 'Daily reminder'\n" +
-			"    on non interrupting timer 'addDays([%CurrentDateTime%], 1)' as espReminderStart {\n" +
+			"    on non interrupting timer addDays([%CurrentDateTime%], 1) as espReminderStart {\n" +
 			"    call microflow HR.ACT_Remind;\n" +
 			"  };\n" +
 			"end workflow;",
@@ -489,7 +491,7 @@ func init() {
 			"add activity", "drop activity", "replace activity",
 		},
 		// SET properties are keyword-led phrases, not `name = value` assignments:
-		// `SET DUE DATE '<expr>'`, `SET DISPLAY '<text>'`, `SET OVERVIEW PAGE
+		// `SET DUE DATE <expr>`, `SET DISPLAY '<text>'`, `SET OVERVIEW PAGE
 		// Module.Page`. The `= ` this entry used to show does not parse.
 		// INSERT names the anchor first and the activity second — INSERT AFTER
 		// <name> <activity> — and there is no BEFORE. DROP and REPLACE take the
@@ -504,8 +506,8 @@ func init() {
 		// the wrong kind used to produce a project Mendix could not LOAD
 		// (ako/mxcli#415); it is refused now, but the entry documented only two
 		// of the ops, which is how an author reached for the wrong one.
-		Syntax:  "ALTER WORKFLOW Module.Name SET DISPLAY '<text>';\nALTER WORKFLOW Module.Name SET DUE DATE '<expression>';\nALTER WORKFLOW Module.Name SET OVERVIEW PAGE Module.Page;\nALTER WORKFLOW Module.Name SET ACTIVITY <name> <property>;\nALTER WORKFLOW Module.Name INSERT AFTER <name> <activity>;\nALTER WORKFLOW Module.Name DROP ACTIVITY <name>;\nALTER WORKFLOW Module.Name REPLACE ACTIVITY <name> WITH <activity>;\nALTER WORKFLOW Module.Name INSERT OUTCOME '<name>' ON <user-task> { <activities> };\nALTER WORKFLOW Module.Name DROP OUTCOME '<name>' ON <activity>;\nALTER WORKFLOW Module.Name INSERT CONDITION '<Module.Enum.Value>' ON <decision|call-microflow> { <activities> };\nALTER WORKFLOW Module.Name INSERT PATH ON <parallel-split> { <activities> };\nALTER WORKFLOW Module.Name INSERT BOUNDARY EVENT ON <activity> (INTERRUPTING | NON INTERRUPTING) TIMER '<datetime-expression>' { <activities> };",
-		Example: "ALTER WORKFLOW HR.LeaveApproval SET DUE DATE 'addDays([%CurrentDateTime%], 7)';\nALTER WORKFLOW HR.LeaveApproval INSERT AFTER ReviewTask\n  CALL MICROFLOW HR.NotifyHR;\nALTER WORKFLOW HR.LeaveApproval DROP ACTIVITY ObsoleteStep;\n\n-- The INSERT op has to match the activity kind: an outcome list is typed,\n-- and the wrong one is refused (it would leave a project Mendix cannot open).\nALTER WORKFLOW HR.LeaveApproval INSERT OUTCOME 'Rejected' ON ReviewTask { };\nALTER WORKFLOW HR.LeaveApproval INSERT CONDITION 'HR.Status.Urgent' ON Triage { };\nALTER WORKFLOW HR.LeaveApproval INSERT PATH ON NotifyAll { };",
+		Syntax:  "ALTER WORKFLOW Module.Name SET DISPLAY '<text>';\nALTER WORKFLOW Module.Name SET DUE DATE <expression>;\nALTER WORKFLOW Module.Name SET OVERVIEW PAGE Module.Page;\nALTER WORKFLOW Module.Name SET ACTIVITY <name> <property>;\nALTER WORKFLOW Module.Name INSERT AFTER <name> <activity>;\nALTER WORKFLOW Module.Name DROP ACTIVITY <name>;\nALTER WORKFLOW Module.Name REPLACE ACTIVITY <name> WITH <activity>;\nALTER WORKFLOW Module.Name INSERT OUTCOME '<name>' ON <user-task> { <activities> };\nALTER WORKFLOW Module.Name DROP OUTCOME '<name>' ON <activity>;\nALTER WORKFLOW Module.Name INSERT CONDITION '<Module.Enum.Value>' ON <decision|call-microflow> { <activities> };\nALTER WORKFLOW Module.Name INSERT PATH ON <parallel-split> { <activities> };\nALTER WORKFLOW Module.Name INSERT BOUNDARY EVENT ON <activity> (INTERRUPTING | NON INTERRUPTING) TIMER <datetime-expression> { <activities> };",
+		Example: "ALTER WORKFLOW HR.LeaveApproval SET DUE DATE addDays([%CurrentDateTime%], 7);\nALTER WORKFLOW HR.LeaveApproval INSERT AFTER ReviewTask\n  CALL MICROFLOW HR.NotifyHR;\nALTER WORKFLOW HR.LeaveApproval DROP ACTIVITY ObsoleteStep;\n\n-- The INSERT op has to match the activity kind: an outcome list is typed,\n-- and the wrong one is refused (it would leave a project Mendix cannot open).\nALTER WORKFLOW HR.LeaveApproval INSERT OUTCOME 'Rejected' ON ReviewTask { };\nALTER WORKFLOW HR.LeaveApproval INSERT CONDITION 'HR.Status.Urgent' ON Triage { };\nALTER WORKFLOW HR.LeaveApproval INSERT PATH ON NotifyAll { };",
 		SeeAlso: []string{"workflow.create", "workflow.drop"},
 	})
 }
diff --git a/docs-site/src/appendixes/quick-reference.md b/docs-site/src/appendixes/quick-reference.md
index 9ced9a4d4a..a8babb9b69 100644
--- a/docs-site/src/appendixes/quick-reference.md
+++ b/docs-site/src/appendixes/quick-reference.md
@@ -220,7 +220,7 @@ Nested folders use `/` separator: `'Parent/Child/Grandchild'`. Missing folders a
 | Grant page access | `GRANT VIEW ON PAGE Mod.Page TO Mod.Role, ...;` | |
 | Revoke page access | `REVOKE VIEW ON PAGE Mod.Page FROM Mod.Role, ...;` | |
 | Grant entity access | `GRANT CREATE, DELETE, READ *, WRITE * ON ENTITY Mod.Entity TO Mod.Role;` | Supports member lists and WHERE |
-| Revoke entity access | `REVOKE Mod.Role ON Mod.Entity;` | |
+| Revoke entity access | `REVOKE ALL ON ENTITY Mod.Entity FROM Mod.Role;` | |
 | Set security level | `ALTER APP SECURITY LEVEL OFF\|PROTOTYPE\|PRODUCTION;` | |
 | Toggle demo users | `ALTER APP SECURITY DEMO USERS ON\|OFF;` | |
 | Toggle guest access | `ALTER APP SECURITY GUEST ACCESS ON ROLE UserRole\|OFF;` | Anonymous users; role required (CE0133) |
@@ -302,7 +302,7 @@ CREATE OR REPLACE NAVIGATION Responsive
 | Describe settings | `DESCRIBE SETTINGS;` | Full MDL output (round-trippable) |
 | Alter model settings | `ALTER SETTINGS RUNTIME Key = Value;` | AfterStartupMicroflow, HashAlgorithm, JavaVersion, etc. |
 | Alter configuration | `ALTER SETTINGS CONFIGURATION 'Name' Key = Value;` | DatabaseType, DatabaseUrl, HttpPortNumber, etc. |
-| Alter constant | `ALTER SETTINGS CONSTANT 'Name' VALUE 'val' IN CONFIGURATION 'cfg';` | Override constant per configuration |
+| Alter constant | `ALTER SETTINGS CONSTANT @Module.Name VALUE 'val' IN CONFIGURATION 'cfg';` | Override constant per configuration |
 | Alter language | `ALTER SETTINGS LANGUAGE Key = Value;` | DefaultLanguageCode |
 | Alter workflows | `ALTER SETTINGS WORKFLOWS Key = Value;` | UserEntity, DefaultTaskParallelism |
 
diff --git a/docs-site/src/appendixes/version-compatibility.md b/docs-site/src/appendixes/version-compatibility.md
index 7e4e521b85..bb9e199d23 100644
--- a/docs-site/src/appendixes/version-compatibility.md
+++ b/docs-site/src/appendixes/version-compatibility.md
@@ -75,8 +75,8 @@ The tables below show exactly which features are available on each Mendix versio
 | Basic pages | `CREATE PAGE ... { ... }` | Yes | Yes | Yes | Yes |
 | ALTER PAGE | `ALTER PAGE ... SET/INSERT/DROP` | -- | Yes | Yes | Yes |
 | Pluggable widgets | `DATAGRID`, `GALLERY`, `COMBOBOX`, `IMAGE` | -- | Yes | Yes | Yes |
-| Conditional visibility | `Visible: [xpath]` | -- | -- | -- | Yes |
-| Conditional editability | `Editable: [xpath]` | -- | -- | -- | Yes |
+| Conditional visibility | `Visible: <expression>` | -- | -- | -- | Yes |
+| Conditional editability | `Editable: <expression>` | -- | -- | -- | Yes |
 | Responsive column widths | `TabletWidth: 6, PhoneWidth: 12` | -- | -- | -- | Yes |
 | Page parameters (entity) | `Params: { $Item: Module.Entity }` | 9.4+ | Yes | Yes | Yes |
 | Page parameters (primitive) | `Params: { $Qty: Integer }` | -- | -- | -- | 11.6+ |
diff --git a/docs-site/src/examples/security.md b/docs-site/src/examples/security.md
index 655ea0ffc0..10ddba5055 100644
--- a/docs-site/src/examples/security.md
+++ b/docs-site/src/examples/security.md
@@ -87,13 +87,13 @@ GRANT READ (Phone) ON ENTITY Sales.Customer TO Sales.Viewer;
 
 ```sql
 -- Remove all access for a role
-REVOKE Sales.Viewer ON Sales.Customer;
+REVOKE ALL ON ENTITY Sales.Customer FROM Sales.Viewer;
 
 -- Partial revoke: remove read on a specific attribute
-REVOKE Sales.User ON Sales.Customer (READ (Phone));
+REVOKE READ (Phone) ON ENTITY Sales.Customer FROM Sales.User;
 
 -- Partial revoke: downgrade write to read-only
-REVOKE Sales.User ON Sales.Customer (WRITE (Email));
+REVOKE WRITE (Email) ON ENTITY Sales.Customer FROM Sales.User;
 
 -- Remove microflow access
 REVOKE EXECUTE ON MICROFLOW Sales.ACT_Order_Delete FROM Sales.User;
diff --git a/docs-site/src/language/entity-access.md b/docs-site/src/language/entity-access.md
index 36983d2518..ff6c58ea94 100644
--- a/docs-site/src/language/entity-access.md
+++ b/docs-site/src/language/entity-access.md
@@ -157,13 +157,13 @@ Examples:
 
 ```sql
 -- Remove all access for Viewer
-REVOKE Shop.Viewer ON Shop.Customer;
+REVOKE ALL ON ENTITY Shop.Customer FROM Shop.Viewer;
 
 -- Remove read access on a specific attribute
-REVOKE Shop.User ON Shop.Customer (READ (Notes));
+REVOKE READ (Notes) ON ENTITY Shop.Customer FROM Shop.User;
 
 -- Downgrade write to read-only on Email
-REVOKE Shop.User ON Shop.Customer (WRITE (Email));
+REVOKE WRITE (Email) ON ENTITY Shop.Customer FROM Shop.User;
 ```
 
 A full `REVOKE` (without rights list) removes the entire access rule. A partial `REVOKE` downgrades specific rights: `REVOKE READ (x)` sets member x to no access, `REVOKE WRITE (x)` downgrades from ReadWrite to ReadOnly.
diff --git a/docs-site/src/language/grant-revoke.md b/docs-site/src/language/grant-revoke.md
index 7cb3652c12..8bd921be68 100644
--- a/docs-site/src/language/grant-revoke.md
+++ b/docs-site/src/language/grant-revoke.md
@@ -61,16 +61,16 @@ Examples:
 
 ```sql
 -- Remove all access
-REVOKE Shop.Viewer ON Shop.Customer;
+REVOKE ALL ON ENTITY Shop.Customer FROM Shop.Viewer;
 
 -- Remove read access on a specific member
-REVOKE Shop.User ON Shop.Customer (READ (Notes));
+REVOKE READ (Notes) ON ENTITY Shop.Customer FROM Shop.User;
 
 -- Downgrade write to read-only
-REVOKE Shop.User ON Shop.Customer (WRITE (Email));
+REVOKE WRITE (Email) ON ENTITY Shop.Customer FROM Shop.User;
 
 -- Remove delete permission only
-REVOKE Shop.User ON Shop.Customer (DELETE);
+REVOKE DELETE ON ENTITY Shop.Customer FROM Shop.User;
 ```
 
 ## Microflow Access
diff --git a/docs-site/src/language/pages.md b/docs-site/src/language/pages.md
index 05b8715dd1..9fc102e51e 100644
--- a/docs-site/src/language/pages.md
+++ b/docs-site/src/language/pages.md
@@ -93,14 +93,16 @@ Values are 1-12 (grid units) or `AutoFill`. TabletWidth and PhoneWidth default t
 
 ### Conditional Visibility
 
-Any widget can be conditionally visible using an XPath expression in brackets:
+Any widget can be conditionally visible. The condition is a Mendix client expression, written bare and stored as written, so an attribute of the context object is `$currentObject/Attr`:
 
 ```sql
-TEXTBOX txtName (Label: 'Name', Attribute: Name, Visible: [IsActive])
+TEXTBOX txtName (Label: 'Name', Attribute: Name, Visible: $currentObject/IsActive)
 ```
 
 Static values also work: `Visible: false` hides the widget unconditionally.
 
+The older bracketed form, `Visible: [IsActive]`, still parses — it roots a bare attribute in `$currentObject` — and warns `MDL-DEPR081`; `mxcli fmt --upgrade` rewrites it to the expression it stores. A constant condition such as `Editable: [false]` has no bare spelling and keeps its brackets.
+
 Studio Pro's **"based on attribute value"** form lists the values of a Boolean or
 enumeration attribute (of the enclosing data container's entity) that show the
 widget; `empty` is Studio Pro's "(empty)" choice:
@@ -119,7 +121,7 @@ set up that way in Studio Pro.
 Input widgets can be conditionally editable:
 
 ```sql
-TEXTBOX txtStatus (Label: 'Status', Attribute: Status, Editable: [Status != 'Closed'])
+TEXTBOX txtStatus (Label: 'Status', Attribute: Status, Editable: $currentObject/Status != 'Closed')
 ```
 
 Static values: `Editable: Never`, `Editable: Always`.
diff --git a/docs-site/src/language/project-settings.md b/docs-site/src/language/project-settings.md
index 661230d847..0c450ef835 100644
--- a/docs-site/src/language/project-settings.md
+++ b/docs-site/src/language/project-settings.md
@@ -58,13 +58,13 @@ ALTER SETTINGS CONFIGURATION 'default' HttpPortNumber = '8080';
 Override a constant value within a specific configuration:
 
 ```sql
-ALTER SETTINGS CONSTANT '<ConstantName>' VALUE '<value>' IN CONFIGURATION '<cfg>';
+ALTER SETTINGS CONSTANT @<Module.Constant> VALUE '<value>' IN CONFIGURATION '<cfg>';
 ```
 
 Example:
 
 ```sql
-ALTER SETTINGS CONSTANT 'MyModule.ApiBaseUrl' VALUE 'https://staging.example.com' IN CONFIGURATION 'default';
+ALTER SETTINGS CONSTANT @MyModule.ApiBaseUrl VALUE 'https://staging.example.com' IN CONFIGURATION 'default';
 ```
 
 ### Language Settings
diff --git a/docs-site/src/language/workflow-activities.md b/docs-site/src/language/workflow-activities.md
index bc2e58e63b..35b7927e93 100644
--- a/docs-site/src/language/workflow-activities.md
+++ b/docs-site/src/language/workflow-activities.md
@@ -142,24 +142,26 @@ CALL WORKFLOW HR.BackgroundCheck COMMENT 'Run background check sub-process';
 
 ## Decision
 
-Branch the workflow based on a condition. Each outcome contains a block of activities:
+Branch the workflow based on a condition. The condition is a bare expression, Boolean or enumeration; each outcome contains a block of activities:
 
 ```sql
-DECISION ['<caption>']
-  OUTCOMES '<outcome>' { <activities> } ['<outcome>' { <activities> }] ...;
+DECISION [<name>] <expression> [COMMENT '<caption>']
+  OUTCOMES TRUE -> { <activities> } FALSE -> { <activities> };
 ```
 
 Example:
 
 ```sql
-DECISION 'Order value over $1000?'
-  OUTCOMES 'Yes' {
+DECISION $WorkflowContext/Total > 1000 COMMENT 'Order value over $1000?'
+  OUTCOMES TRUE -> {
     USER TASK ManagerApproval 'Manager must approve'
       PAGE Shop.ApprovalPage
-      OUTCOMES 'Approved' { } 'Rejected' { END; };
-  } 'No' { };
+      OUTCOMES 'Approved' { } 'Rejected' { END WORKFLOW; };
+  } FALSE -> { };
 ```
 
+An enumeration decision has one outcome per qualified enumeration value, plus `''` for "none of the above". The expression used to be written in a string (`DECISION '$WorkflowContext/Total > 1000'`); that form still parses and warns `MDL-DEPR080`, and `mxcli fmt --upgrade` rewrites it.
+
 ## Parallel Split
 
 Execute multiple paths concurrently. The workflow continues after all paths complete:
@@ -206,13 +208,13 @@ JUMP TO ReviewTask;
 Pause the workflow until a timer expression evaluates:
 
 ```sql
-WAIT FOR TIMER ['<expression>'];
+WAIT FOR TIMER [<name>] [<expression>] [COMMENT '<caption>'];
 ```
 
 Example:
 
 ```sql
-WAIT FOR TIMER 'addDays([%CurrentDateTime%], 3)';
+WAIT FOR TIMER addDays([%CurrentDateTime%], 3);
 ```
 
 ## Wait for Notification
@@ -262,7 +264,7 @@ EVENT SUBPROCESS <name> ['<caption>']
   { <activities> };
 
 EVENT SUBPROCESS <name> ['<caption>']
-  ON (INTERRUPTING | NON INTERRUPTING) TIMER '<first-execution-time>' [AS <start>] [COMMENT '<start caption>']
+  ON (INTERRUPTING | NON INTERRUPTING) TIMER <first-execution-time> [AS <start>] [COMMENT '<start caption>']
   { <activities> };
 ```
 
diff --git a/docs-site/src/language/workflow-structure.md b/docs-site/src/language/workflow-structure.md
index 0a647bb91e..b6f33ee555 100644
--- a/docs-site/src/language/workflow-structure.md
+++ b/docs-site/src/language/workflow-structure.md
@@ -43,15 +43,15 @@ BEGIN
     };
 
   -- After both paths complete, manager reviews
-  DECISION 'Manager approval required?'
-    OUTCOMES 'Yes' {
+  DECISION $WorkflowContext/NeedsManagerApproval COMMENT 'Manager approval required?'
+    OUTCOMES TRUE -> {
       USER TASK ManagerReview 'Review onboarding'
         PAGE HR.ManagerReviewPage
         OUTCOMES 'Approve' { } 'Reject' {
           CALL MICROFLOW HR.ACT_RejectOnboarding;
           END WORKFLOW;
         };
-    } 'No' { };
+    } FALSE -> { };
 
   CALL MICROFLOW HR.ACT_CompleteOnboarding;
 END WORKFLOW;
diff --git a/docs-site/src/reference/agent/create-knowledge-base.md b/docs-site/src/reference/agent/create-knowledge-base.md
index 4a1d5832b3..72b16c3cbf 100644
--- a/docs-site/src/reference/agent/create-knowledge-base.md
+++ b/docs-site/src/reference/agent/create-knowledge-base.md
@@ -5,7 +5,7 @@
 ```sql
 CREATE [ OR MODIFY ] KNOWLEDGE BASE module.Name (
     Provider: MxCloudGenAI,
-    key: module.KeyConstant
+    key: @module.KeyConstant
 );
 
 DROP KNOWLEDGE BASE module.Name
@@ -44,7 +44,7 @@ CREATE CONSTANT MyModule."KBKey"
 
 CREATE KNOWLEDGE BASE MyModule."ProductDocs" (
     Provider: MxCloudGenAI,
-    key: MyModule.KBKey
+    key: @MyModule.KBKey
 );
 /
 ```
@@ -54,7 +54,7 @@ CREATE KNOWLEDGE BASE MyModule."ProductDocs" (
 ```sql
 CREATE OR MODIFY KNOWLEDGE BASE MyModule."ProductDocs" (
     Provider: MxCloudGenAI,
-    key: MyModule.KBKey
+    key: @MyModule.KBKey
 );
 /
 ```
diff --git a/docs-site/src/reference/agent/create-model.md b/docs-site/src/reference/agent/create-model.md
index 15e29e0584..3a6be9641d 100644
--- a/docs-site/src/reference/agent/create-model.md
+++ b/docs-site/src/reference/agent/create-model.md
@@ -5,7 +5,7 @@
 ```sql
 CREATE [ OR MODIFY ] MODEL module.Name (
     Provider: MxCloudGenAI,
-    key: module.KeyConstant
+    key: @module.KeyConstant
     [, DisplayName: 'display name' ]
     [, KeyName: 'portal key name' ]
     [, Environment: 'environment' ]
@@ -58,7 +58,7 @@ CREATE CONSTANT MyModule."ModelKey"
 
 CREATE MODEL MyModule."GPT4Model" (
     Provider: MxCloudGenAI,
-    key: MyModule.ModelKey
+    key: @MyModule.ModelKey
 );
 /
 ```
@@ -68,7 +68,7 @@ CREATE MODEL MyModule."GPT4Model" (
 ```sql
 CREATE MODEL MyModule."ConfiguredModel" (
     Provider: MxCloudGenAI,
-    key: MyModule.ModelKey,
+    key: @MyModule.ModelKey,
     DisplayName: 'GPT-4 Turbo (128K)',
     KeyName: 'prod-gpt4-turbo',
     Environment: 'production'
@@ -81,7 +81,7 @@ CREATE MODEL MyModule."ConfiguredModel" (
 ```sql
 CREATE OR MODIFY MODEL MyModule."GPT4Model" (
     Provider: MxCloudGenAI,
-    key: MyModule.ModelKey,
+    key: @MyModule.ModelKey,
     DisplayName: 'GPT-4 Turbo (Updated)'
 );
 /
diff --git a/docs-site/src/reference/domain-model/create-constant.md b/docs-site/src/reference/domain-model/create-constant.md
index a3a6ef5fa0..9ca7e8fcdc 100644
--- a/docs-site/src/reference/domain-model/create-constant.md
+++ b/docs-site/src/reference/domain-model/create-constant.md
@@ -72,7 +72,7 @@ CREATE CONSTANT MyModule.DatabasePassword TYPE String DEFAULT '';
 CREATE CONSTANT MyModule.ApiBaseUrl TYPE String DEFAULT 'https://api.example.com';
 
 -- Override in a specific runtime configuration
-ALTER SETTINGS CONSTANT 'MyModule.ApiBaseUrl' VALUE 'https://staging.example.com' IN CONFIGURATION 'Staging';
+ALTER SETTINGS CONSTANT @MyModule.ApiBaseUrl VALUE 'https://staging.example.com' IN CONFIGURATION 'Staging';
 ```
 
 ### Shared and private values
diff --git a/docs-site/src/reference/security/revoke.md b/docs-site/src/reference/security/revoke.md
index a499b549b2..203db6dd7f 100644
--- a/docs-site/src/reference/security/revoke.md
+++ b/docs-site/src/reference/security/revoke.md
@@ -4,10 +4,10 @@
 
 ```sql
 -- Entity access (full -- removes entire rule)
-REVOKE module.Role ON module.Entity
+REVOKE ALL ON ENTITY module.Entity FROM module.Role [, ...]
 
 -- Entity access (partial -- downgrades specific rights)
-REVOKE module.Role ON module.Entity ( rights )
+REVOKE rights ON ENTITY module.Entity FROM module.Role [, ...]
 
 -- Microflow access
 REVOKE EXECUTE ON MICROFLOW module.Name FROM module.Role [, ...]
@@ -25,7 +25,7 @@ Removes previously granted access rights from module roles. Each form is the cou
 
 ### Entity Access
 
-Without a rights list, removes the entire entity access rule for the specified module role on the entity.
+The entity revoke mirrors the entity grant: rights first, then `ON ENTITY`, then the roles after `FROM`. `REVOKE ALL` removes the entire entity access rule for the specified module roles on the entity. The older form with the role first, `REVOKE module.Role ON module.Entity [( rights )]`, still parses and warns `MDL-DEPR082`; `mxcli fmt --upgrade` rewrites it.
 
 With a rights list, performs a **partial revoke**: `REVOKE READ (x)` sets member x to no access. `REVOKE WRITE (x)` downgrades member x from ReadWrite to ReadOnly. `REVOKE CREATE` and `REVOKE DELETE` remove the structural permission. The access rule itself is preserved.
 
@@ -69,25 +69,25 @@ Removes execute permission on a nanoflow from one or more module roles.
 Remove all entity access for a role:
 
 ```sql
-REVOKE Shop.Viewer ON Shop.Customer;
+REVOKE ALL ON ENTITY Shop.Customer FROM Shop.Viewer;
 ```
 
 Partial revoke -- remove read access on a specific attribute:
 
 ```sql
-REVOKE Shop.User ON Shop.Customer (READ (Notes));
+REVOKE READ (Notes) ON ENTITY Shop.Customer FROM Shop.User;
 ```
 
 Partial revoke -- downgrade write to read-only:
 
 ```sql
-REVOKE Shop.User ON Shop.Customer (WRITE (Email));
+REVOKE WRITE (Email) ON ENTITY Shop.Customer FROM Shop.User;
 ```
 
 Partial revoke -- remove structural permission:
 
 ```sql
-REVOKE Shop.User ON Shop.Customer (DELETE);
+REVOKE DELETE ON ENTITY Shop.Customer FROM Shop.User;
 ```
 
 Remove microflow execution from multiple roles:
diff --git a/docs-site/src/reference/settings/alter-settings.md b/docs-site/src/reference/settings/alter-settings.md
index c8593588b5..c52ec1f356 100644
--- a/docs-site/src/reference/settings/alter-settings.md
+++ b/docs-site/src/reference/settings/alter-settings.md
@@ -6,9 +6,9 @@
 
     ALTER SETTINGS CONFIGURATION 'name' key = value
 
-    ALTER SETTINGS CONSTANT 'name' VALUE 'value' IN CONFIGURATION 'config'
+    ALTER SETTINGS CONSTANT @Module.Name VALUE 'value' IN CONFIGURATION 'config'
 
-    ALTER SETTINGS DROP CONSTANT 'name' IN CONFIGURATION 'config'
+    ALTER SETTINGS DROP CONSTANT @Module.Name IN CONFIGURATION 'config'
 
     CREATE CONFIGURATION 'name' [key = value, ...]
 
@@ -32,7 +32,7 @@ Modifies project settings by category. Each category has its own syntax and avai
 
 **CONFIGURATION** settings control named runtime configurations. Each project can have multiple configurations (e.g., `default`, `staging`, `production`). Settings include database type, database URL, HTTP port number, and other runtime parameters. The configuration name must be enclosed in single quotes.
 
-**CONSTANT** settings override the default value of a project constant within a specific runtime configuration. Both the constant name and the configuration name must be enclosed in single quotes.
+**CONSTANT** settings override the default value of a project constant within a specific runtime configuration. The constant is named as MDL names a constant everywhere, `@Module.Name`; the configuration name is enclosed in single quotes. The older quoted constant name (`CONSTANT 'Module.Name'`) still parses and warns `MDL-DEPR085`; `mxcli fmt --upgrade` rewrites it.
 
 **LANGUAGE** settings control localization: the default language code, and the
 list of **enabled** languages — the only ones a build emits translations for.
@@ -50,8 +50,11 @@ task's group targeting selects from. Groups need Mendix **11.2** or later.
 **value**
 : The new value for the setting. String values must be enclosed in single quotes.
 
-**name** (CONFIGURATION, CONSTANT)
-: The name of the configuration or constant, enclosed in single quotes.
+**name** (CONFIGURATION)
+: The name of the configuration, enclosed in single quotes.
+
+**Module.Name** (CONSTANT)
+: The constant, written `@Module.Name`.
 
 **config** (CONSTANT only)
 : The name of the runtime configuration where the constant override applies, enclosed in single quotes.
@@ -83,7 +86,7 @@ ALTER SETTINGS CONFIGURATION 'production' DatabaseUrl = 'jdbc:postgresql://dbhos
 ### Override a constant in a configuration
 
 ```sql
-ALTER SETTINGS CONSTANT 'MyModule.ApiBaseUrl' VALUE 'https://api.staging.example.com' IN CONFIGURATION 'staging';
+ALTER SETTINGS CONSTANT @MyModule.ApiBaseUrl VALUE 'https://api.staging.example.com' IN CONFIGURATION 'staging';
 ```
 
 An override's value is either **shared** — stored in the model, and so in version
@@ -176,7 +179,7 @@ ALTER SETTINGS RUNTIME JavaVersion = '17';
 ### Remove a constant override from a configuration
 
 ```sql
-ALTER SETTINGS DROP CONSTANT 'MyModule.ApiBaseUrl' IN CONFIGURATION 'staging';
+ALTER SETTINGS DROP CONSTANT @MyModule.ApiBaseUrl IN CONFIGURATION 'staging';
 ```
 
 ### Create a new configuration
diff --git a/docs-site/src/reference/workflow/create-workflow.md b/docs-site/src/reference/workflow/create-workflow.md
index 9073fd1b06..f12c450a47 100644
--- a/docs-site/src/reference/workflow/create-workflow.md
+++ b/docs-site/src/reference/workflow/create-workflow.md
@@ -32,7 +32,7 @@ USER TASK name 'caption'
     [ TARGETING MICROFLOW module.MicroflowName ]
     [ TARGETING [ USERS | GROUPS ] XPATH [ xpath ] ]
     [ ENTITY module.Entity ]
-    [ DUE DATE 'expression' ]
+    [ DUE DATE expression ]
     [ DESCRIPTION 'text' ]
     OUTCOMES 'OutcomeName' { activities } [ 'OutcomeName' { activities } ... ]
 ```
@@ -63,10 +63,12 @@ CALL WORKFLOW module.Name [ 'caption' ]
 :   A conditional branch based on an expression. Each outcome maps to a different execution path.
 
 ```sql
-DECISION [ 'caption' ]
-    OUTCOMES 'OutcomeName' { activities } [ 'OutcomeName' { activities } ... ]
+DECISION [ name ] expression [ COMMENT 'caption' ]
+    OUTCOMES TRUE -> { activities } FALSE -> { activities }
 ```
 
+Every workflow expression — a decision's condition, a timer's delay, a due date — is written bare: `DECISION $Context/Total > 1000`, `DUE DATE addDays([%CurrentDateTime%], 3)`. The string form (`DECISION '$Context/Total > 1000'`) still parses and warns `MDL-DEPR080`; `mxcli fmt --upgrade` rewrites it.
+
 **PARALLEL SPLIT**
 :   Splits the workflow into parallel paths that execute concurrently and rejoin before continuing.
 
@@ -88,7 +90,7 @@ JUMP TO activity_name [ 'caption' ]
 :   Pauses the workflow until a timer expression elapses.
 
 ```sql
-WAIT FOR TIMER [ 'duration_expression' ]
+WAIT FOR TIMER [ name ] [ datetime_expression ] [ COMMENT 'caption' ]
 ```
 
 **WAIT FOR NOTIFICATION**
@@ -113,8 +115,8 @@ User tasks, call microflow activities, and wait-for-notification activities supp
 USER TASK name 'caption'
     PAGE module.Page
     OUTCOMES 'Done' { }
-    BOUNDARY EVENT InterruptingTimer '${PT1H}' { activities }
-    BOUNDARY EVENT NonInterruptingTimer '${PT30M}' { activities }
+    BOUNDARY EVENT INTERRUPTING TIMER addHours([%CurrentDateTime%], 1) { activities }
+    BOUNDARY EVENT NON INTERRUPTING TIMER addMinutes([%CurrentDateTime%], 30) { activities }
 ```
 
 ## Parameters
@@ -185,7 +187,7 @@ BEGIN
     USER TASK AssignTask 'Handle ticket'
         PAGE Support.TicketPage
         OUTCOMES 'Resolved' { }
-        BOUNDARY EVENT InterruptingTimer '${PT24H}' {
+        BOUNDARY EVENT INTERRUPTING TIMER addHours([%CurrentDateTime%], 24) {
             CALL MICROFLOW Support.ACT_EscalateTicket;
         };
 END WORKFLOW;
diff --git a/docs/01-project/MDL_QUICK_REFERENCE.md b/docs/01-project/MDL_QUICK_REFERENCE.md
index fad6388442..750314028e 100644
--- a/docs/01-project/MDL_QUICK_REFERENCE.md
+++ b/docs/01-project/MDL_QUICK_REFERENCE.md
@@ -671,8 +671,8 @@ Nested folders use `/` separator: `'Parent/Child/Grandchild'`. Missing folders a
 | Revoke page access | `revoke view on page Mod.Page from Mod.Role, ...;` | |
 | Grant entity access | `grant create, delete, read *, write * on entity Mod.Entity to Mod.Role;` / `grant read * on entity Mod.Entity to Mod.Role where [Status = 'Open'];` | The XPath is in brackets, quotes written once; the old `grant Mod.Role on Mod.Entity (…) where '…'` warns MDL-DEPR030 (`fmt --upgrade` rewrites it). Additive — merges with existing. A module role must be qualified: a bare `Role` parses but is refused (MDL-GRANT02). Inherited members are named like the entity's own (`read *` covers them); an unknown name is an error. Entities extending `System.User` are the exception — their platform members must not be granted |
 | Access for members added later | — | A rule's default for new members is derived from the grant: `write *` → ReadWrite, `read *` → ReadOnly, member lists alone → **None**. So an attribute added later is granted None on a member-listed rule — clean build, blank field. `alter entity … add attribute` warns and prints the widening grant. The rule's *default* decides this, not how narrow its member list is |
-| Revoke entity access | `revoke Mod.Role on Mod.Entity;` | Full revoke — removes entire rule |
-| Revoke entity access (partial) | `revoke Mod.Role on Mod.Entity (read (attr));` | Partial — downgrades specific rights |
+| Revoke entity access | `revoke all on entity Mod.Entity from Mod.Role;` | Full revoke — removes entire rule |
+| Revoke entity access (partial) | `revoke read (attr) on entity Mod.Entity from Mod.Role;` | Partial — downgrades specific rights |
 | Set security level | `alter app security level off\|prototype\|production;` | |
 | Toggle demo users | `alter app security demo users on\|off;` | |
 | Enable guest access | `alter app security guest access on role UserRole;` | Anonymous users. The role is what visitors get — its entity access is the public surface. Mendix fails the build without one (CE0133), so `on` is refused unless a role is given or already stored. mxcli validates the role exists; Mendix does not |
@@ -708,7 +708,7 @@ mandatory and a misplaced clause failed with a token error
 (`mismatched input 'ON' expecting ';'`) that named neither the clause nor the rule.
 
 **Workflow Activity Types:**
-- `[multi] user task <name> '<caption>' [page Mod.Page] [targeting [users|groups] microflow Mod.MF] [targeting [users|groups] xpath [<xpath>]] [on created microflow Mod.MF] [entity Mod.Entity] [due date '<expr>'] [description '<text>'] [participants all|<n>|<n> percent] [decide by <rule>] [await all users] [outcomes '<out>' { } ...] [boundary event …];`
+- `[multi] user task <name> '<caption>' [page Mod.Page] [targeting [users|groups] microflow Mod.MF] [targeting [users|groups] xpath [<xpath>]] [on created microflow Mod.MF] [entity Mod.Entity] [due date <expr>] [description '<text>'] [participants all|<n>|<n> percent] [decide by <rule>] [await all users] [outcomes '<out>' { } ...] [boundary event …];`
   - **Multi-user only:** `decide by consensus|majority more than half|majority most chosen|threshold <n> percent|votes fallback '<outcome>'`, `decide by veto '<outcome>'`, `decide by microflow Mod.MF`. A fallback is required for consensus, majority and threshold (CE1866), a veto needs its outcome (CE1867), and a decision microflow returns String (CE5012) — all `MDL-WF13` / check. Omitted: all participants, consensus on the first outcome, not waiting.
   - The **task page** must take a `System.WorkflowUserTask` parameter — none at all is CE7410, none of that type is CE7412; extra parameters are allowed.
   - A **targeting microflow** takes exactly `System.Workflow` + the context entity (or a generalization of it), in either order — anything else is CE6677. Users targeting returns a list of `System.User`, groups a list of `System.WorkflowGroup`.
@@ -717,18 +717,18 @@ mandatory and a misplaced clause failed with a token error
 - `call microflow Mod.MF[(<Param> = <expr>, ...)] [as <name>] [comment '<text>'] [outcomes '<out>' -> { } ...];`
 - `call agent microflow Mod.MF [as <name>] [comment '<text>'] [with (<Param> = '<expr>', ...)] [outcomes … -> { } ...];` — an **AI agent task** (Mendix 11.9+): the call-microflow statement stored as `Workflows$AIAgentTaskActivity`. Its microflow must take at least one parameter (CE1590).
 - `call workflow Mod.WF[(<Param> = <expr>, ...)] [as <name>] [comment '<text>'];`
-- `decision [<name>] ['<expression>'] outcomes <true|false|'Module.Enum.Value'> -> { } ...;`
+- `decision [<name>] [<expression>] [comment '<caption>'] outcomes <true|false|'Module.Enum.Value'> -> { } ...;` — the expression is bare; a decision's condition, a timer and a due date written in a string (`decision '<expr>'`) warn MDL-DEPR080
 - `parallel split [<name>] path 1 { } path 2 { };`
 - `jump to <activity-name>;`
-- `wait for timer [<name>] ['<expr>'];`
+- `wait for timer [<name>] [<expr>] [comment '<caption>'];`
 - `wait for notification [<name>];`
 - `notification [<name>] [comment '<caption>'];` — an intermediate notification event (Mendix 11.11+)
 - `end workflow [comment '<caption>'];` — only inside a `{ }` block; ends the whole workflow
-- Boundary events, after `outcomes`: `boundary event [non] interrupting timer '<expr>' { … }` or `boundary event [non] interrupting notification <name> ['<caption>'] { … }` (11.11+). One interrupting event per activity (CE6697, MDL-WF15).
+- Boundary events, after `outcomes`: `boundary event [non] interrupting timer <expr> { … }` or `boundary event [non] interrupting notification <name> ['<caption>'] { … }` (11.11+). One interrupting event per activity (CE6697, MDL-WF15).
 
 **Notifying a workflow** (a microflow statement): `[$Notified =] notify workflow $Workflow target Module.Workflow.ElementName;` — the element is a notification-started event sub-process's start, a notification activity, a notification boundary event or a wait for notification, and mxcli resolves which. The target is required (CE0166, MDL-WF16).
 
-**Event sub-processes**, after the main body: `event subprocess <name> ['<caption>'] on [non] interrupting notification [<start>] ['<caption>'] { … };` (11.8+) or `… on [non] interrupting timer '<first-execution-time>' [as <start>] [comment '<caption>'] { … };` (11.13+). The body's End is implicit; a `jump to` stays in its own sub-process (CE6682, MDL-WF05); a timer needs its expression (CE0126, MDL-WF14).
+**Event sub-processes**, after the main body: `event subprocess <name> ['<caption>'] on [non] interrupting notification [<start>] ['<caption>'] { … };` (11.8+) or `… on [non] interrupting timer <first-execution-time> [as <start>] [comment '<caption>'] { … };` (11.13+). The body's End is implicit; a `jump to` stays in its own sub-process (CE6682, MDL-WF05); a timer needs its expression (CE0126, MDL-WF14).
 
 **Workflow event handlers.** `on workflow events (UserTaskStarted, UserTaskEnded)
 microflow Mod.MF as 'Task audit'` in the header runs the microflow for each listed
@@ -780,7 +780,7 @@ an enumeration return as well, and a required (`not null`) attribute does **not*
 exempt it. Boolean decisions (`true`/`false`) do not take one.
 
 ```sql
-  decision '$WorkflowContext/Kind'
+  decision $WorkflowContext/Kind
     outcomes
       'Module.Kind.Standard' -> { }
       'Module.Kind.Priority' -> { }
@@ -809,14 +809,14 @@ Modify an existing workflow's properties, activities, outcomes, paths, condition
 | Set display name | `set display 'name'` | Workflow-level display name |
 | Set description | `set description 'text'` | Workflow-level description |
 | Set export level | `set export level api\|Hidden` | Visibility level |
-| Set due date | `set due date 'expr'` | Workflow-level due date expression |
+| Set due date | `set due date <expr>` | Workflow-level due date expression |
 | Set overview page | `set overview page Module.Page` | Workflow overview page |
 | Set parameter | `set parameter $Var: Module.Entity` | Workflow context parameter |
 | Set activity page | `set activity name page Module.Page` | Change user task page |
 | Set activity description | `set activity name description 'text'` | Activity description |
 | Set activity targeting | `set activity name targeting [users\|groups] microflow Module.MF` | Target user/group assignment |
 | Set activity XPath | `set activity name targeting xpath [<xpath>]` | XPath targeting, in brackets; the quoted `xpath '[…]'` warns MDL-DEPR031 |
-| Set activity due date | `set activity name due date 'expr'` | Activity-level due date |
+| Set activity due date | `set activity name due date <expr>` | Activity-level due date |
 | Insert activity | `insert after name call microflow Module.MF` | Insert after named activity |
 | Drop activity | `drop activity name` | Remove activity by name |
 | Replace activity | `replace activity name with activity` | Replace activity in-place |
@@ -826,7 +826,7 @@ Modify an existing workflow's properties, activities, outcomes, paths, condition
 | Drop path | `drop path 'name' on activity` | Remove parallel split path |
 | Insert condition | `insert condition 'name' on activity { body }` | Add decision branch |
 | Drop condition | `drop condition 'name' on activity` | Remove decision branch |
-| Insert boundary event | `insert boundary event on activity interrupting timer ['expr'] { body }` | Add boundary timer |
+| Insert boundary event | `insert boundary event on activity interrupting timer [<expr>] { body }` | Add boundary timer |
 | Drop boundary event | `drop boundary event on activity` | Remove boundary event |
 
 **Activity references** can be identifiers (`ReviewOrder`) or string literals (`'Review the order'`). Use `@N` suffix for positional disambiguation when multiple activities share a name (e.g., `ACT_Process@2`).
@@ -860,7 +860,7 @@ alter workflow Module.OrderApproval
 
 -- Boundary events
 alter workflow Module.OrderApproval
-  insert boundary event on ReviewOrder interrupting timer 'addHours([%CurrentDateTime%], 2)' {
+  insert boundary event on ReviewOrder interrupting timer addHours([%CurrentDateTime%], 2) {
     call microflow Module.ACT_BoundaryHandler;
     jump to ReviewOrder;
   };
@@ -975,8 +975,8 @@ still flagged rather than guessed at.
 | Describe settings | `describe settings;` | Full MDL output (round-trippable) |
 | Alter model settings | `alter settings runtime key = value;` | AfterStartupMicroflow, HashAlgorithm, JavaVersion, etc. |
 | Alter configuration | `alter settings configuration 'Name' key = value;` | DatabaseType, DatabaseUrl, HttpPortNumber, etc. |
-| Alter constant | `alter settings constant 'Name' value 'val' in configuration 'cfg';` | Override constant per configuration |
-| Drop constant override | `alter settings drop constant 'Name' in configuration 'cfg';` | Reset to default value |
+| Alter constant | `alter settings constant @Module.Name value 'val' in configuration 'cfg';` | Override constant per configuration |
+| Drop constant override | `alter settings drop constant @Module.Name in configuration 'cfg';` | Reset to default value |
 | Create or modify configuration | `create or modify configuration 'Name' [key = value, ...];` | Upsert — what `describe settings` emits, so a described project replays onto a target that already has `Default` |
 | Create configuration | `create configuration 'Name' [key = value, ...];` | New server configuration. `DatabaseType` must be `Db2`, `Hsqldb`, `MySql`, `Oracle`, `PostgreSql`, `SapHana` or `SqlServer` (case-insensitive) |
 | Drop configuration | `drop configuration [if exists] 'Name';` | Remove a configuration |
@@ -1568,8 +1568,8 @@ create page MyModule.Customer_Edit
 | DesktopWidth | `column (desktopwidth: 8)` | 1-12 or AutoFill |
 | TabletWidth | `column (tabletwidth: 6)` | 1-12 or AutoFill (default: auto) |
 | PhoneWidth | `column (phonewidth: 12)` | 1-12 or AutoFill (default: auto) |
-| Visible | `textbox txt (visible: [IsActive])` | Conditional visibility (XPath expression) |
-| Editable | `textbox txt (editable: [status != 'Closed'])` | Conditional editability (XPath expression) |
+| Visible | `textbox txt (visible: $currentObject/IsActive)` | Conditional visibility: a client expression, stored as written; `visible: [IsActive]` warns MDL-DEPR081 |
+| Editable | `textbox txt (editable: $currentObject/Status != 'Closed')` | Conditional editability: a client expression, stored as written |
 | Image | `staticimage img (Image: 'Mod.Images.logo')` | Image-collection entry, `Module.Collection.Image`. Omitted → CE0436 "No image selected." |
 | DataSource (dynamicimage) | `dynamicimage img (DataSource: database from Mod.Photo)` | The entity holding the image. Omitted → CE0489 "Select an entity for the data source of this dynamic image." |
 | DefaultImage | `dynamicimage img (DefaultImage: 'Mod.Images.placeholder')` | Fallback when the object has no image |
diff --git a/docs/05-mdl-specification/01-language-reference.md b/docs/05-mdl-specification/01-language-reference.md
index 1bafd64bff..a15095ebfe 100644
--- a/docs/05-mdl-specification/01-language-reference.md
+++ b/docs/05-mdl-specification/01-language-reference.md
@@ -1121,13 +1121,13 @@ Partial revoke semantics: `revoke read (x)` sets member x to no access. `revoke
 **Examples:**
 ```sql
 -- Remove all access
-revoke Shop.Viewer on Shop.Customer;
+revoke all on entity Shop.Customer from Shop.Viewer;
 
 -- Remove read on specific attribute
-revoke Shop.User on Shop.Customer (read (Phone));
+revoke read (Phone) on entity Shop.Customer from Shop.User;
 
 -- Downgrade write to read-only
-revoke Shop.User on Shop.Customer (write (Email));
+revoke write (Email) on entity Shop.Customer from Shop.User;
 ```
 
 ### CREATE USER ROLE
@@ -1272,8 +1272,8 @@ Displays one row per constant per configuration. Shows the default value followe
 ```sql
 alter settings runtime key = value;
 alter settings configuration 'Name' key = value;
-alter settings constant 'Name' value 'val' in configuration 'cfg';
-alter settings drop constant 'Name' in configuration 'cfg';
+alter settings constant @Module.Name value 'val' in configuration 'cfg';
+alter settings drop constant @Module.Name in configuration 'cfg';
 alter settings LANGUAGE key = value;
 alter settings workflows key = value;
 ```
@@ -1298,7 +1298,7 @@ show constant values;
 create configuration 'Staging' DatabaseType = 'POSTGRESQL', DatabaseUrl = 'staging-db:5432';
 
 -- Remove a constant override
-alter settings drop constant 'MyModule.ApiKey' in configuration 'Default';
+alter settings drop constant @MyModule.ApiKey in configuration 'Default';
 
 -- Drop a configuration
 drop configuration 'Staging';
diff --git a/docs/05-mdl-specification/03-domain-model.md b/docs/05-mdl-specification/03-domain-model.md
index 459f935dfd..c542d848bf 100644
--- a/docs/05-mdl-specification/03-domain-model.md
+++ b/docs/05-mdl-specification/03-domain-model.md
@@ -398,7 +398,7 @@ grant read (Name, Email), write (Email) on entity Sales.Customer to Sales.User;
 grant read *, write * on entity Sales.Order to Sales.User where [Status = 'Open'];
 
 -- Revoke
-revoke Sales.User on Sales.Order;
+revoke all on entity Sales.Order from Sales.User;
 ```
 
 ### Access Rule Properties
diff --git a/mdl-examples/bug-tests/workflow-586-clause-order-canonical.mdl b/mdl-examples/bug-tests/workflow-586-clause-order-canonical.mdl
index caaa7e8322..165dd72f9e 100644
--- a/mdl-examples/bug-tests/workflow-586-clause-order-canonical.mdl
+++ b/mdl-examples/bug-tests/workflow-586-clause-order-canonical.mdl
@@ -93,7 +93,7 @@ create or replace workflow WF586.Review
   description 'Reviews a request'
   export level Hidden
   overview page WF586.Overview
-  due date '${P2D}'
+  due date addDays([%CurrentDateTime%], 2)
   on any workflow event microflow WF586.ACT_OnEvent as 'all events'
 begin
   user task Review 'Review the request'
@@ -101,17 +101,17 @@ begin
     targeting microflow WF586.ACT_GetUsers
     on created microflow WF586.ACT_OnCreated
     entity WF586.Request
-    due date '${PT4H}'
+    due date addHours([%CurrentDateTime%], 4)
     description 'Check the request and decide'
     outcomes
       'Approve' { call microflow WF586.ACT_Audit; }
       'Reject'  { }
-    boundary event interrupting timer '${PT8H}';
+    boundary event interrupting timer addHours([%CurrentDateTime%], 8);
 
   multi user task Confirm 'Confirm the decision'
     page WF586.TaskPage
     targeting groups xpath '[Name = ''Administrator'']'
-    due date '${PT2H}'
+    due date addHours([%CurrentDateTime%], 2)
     participants 60 percent
     decide by majority more than half fallback 'Confirmed'
     await all users
diff --git a/mdl-examples/bug-tests/workflow-586-clause-order.mdl b/mdl-examples/bug-tests/workflow-586-clause-order.mdl
index a931f66b58..2a6b07ad98 100644
--- a/mdl-examples/bug-tests/workflow-586-clause-order.mdl
+++ b/mdl-examples/bug-tests/workflow-586-clause-order.mdl
@@ -108,7 +108,7 @@ end;
 -- grammar demanded: the event handler first, `folder` last.
 create or replace workflow WF586.Review
   on any workflow event microflow WF586.ACT_OnEvent as 'all events'
-  due date '${P2D}'
+  due date addDays([%CurrentDateTime%], 2)
   description 'Reviews a request'
   overview page WF586.Overview
   display 'Request review'
@@ -121,12 +121,12 @@ begin
   user task Review 'Review the request'
     on created microflow WF586.ACT_OnCreated
     description 'Check the request and decide'
-    boundary event interrupting timer '${PT8H}'
+    boundary event interrupting timer addHours([%CurrentDateTime%], 8)
     entity WF586.Request
     outcomes
       'Approve' { call microflow WF586.ACT_Audit; }
       'Reject'  { }
-    due date '${PT4H}'
+    due date addHours([%CurrentDateTime%], 4)
     page WF586.TaskPage
     targeting microflow WF586.ACT_GetUsers;
 
@@ -140,6 +140,6 @@ begin
     page WF586.TaskPage
     participants 60 percent
     targeting groups xpath '[Name = ''Administrator'']'
-    due date '${PT2H}';
+    due date addHours([%CurrentDateTime%], 2);
 end workflow;
 /
diff --git a/mdl-examples/doctype-tests/03-page-examples.mdl b/mdl-examples/doctype-tests/03-page-examples.mdl
index cba76478b4..f137e8efe3 100644
--- a/mdl-examples/doctype-tests/03-page-examples.mdl
+++ b/mdl-examples/doctype-tests/03-page-examples.mdl
@@ -2672,7 +2672,7 @@ create page PgTest.P040_ConditionalProps
     row row1 {
       column col1 (desktopwidth: 8, tabletwidth: 6, phonewidth: 12) {
         dataview dv1 (datasource: microflow PgTest.DS_GetFirstCustomer) {
-          textbox txtName (label: 'Name', attribute: Name, visible: [$currentObject/Name != empty])
+          textbox txtName (label: 'Name', attribute: Name, visible: $currentObject/Name != empty)
           textbox txtPhone (label: 'Phone', attribute: Phone, editable: [true])
         }
       }
diff --git a/mdl-examples/doctype-tests/08-security-examples.mdl b/mdl-examples/doctype-tests/08-security-examples.mdl
index 0ee6568d48..1caa821446 100644
--- a/mdl-examples/doctype-tests/08-security-examples.mdl
+++ b/mdl-examples/doctype-tests/08-security-examples.mdl
@@ -414,13 +414,13 @@ grant read (Notes) on entity SecTest.Customer to SecTest.User;
  * Remove read access on a specific attribute (Notes).
  * Other permissions are preserved.
  */
-revoke SecTest.User on SecTest.Customer (read (Notes));
+revoke read (Notes) on entity SecTest.Customer from SecTest.User;
 /
 
 /**
  * Downgrade write to read-only on Email.
  */
-revoke SecTest.User on SecTest.Customer (write (Email));
+revoke write (Email) on entity SecTest.Customer from SecTest.User;
 /
 
 -- ============================================================================
@@ -430,7 +430,7 @@ revoke SecTest.User on SecTest.Customer (write (Email));
 /**
  * Remove the Viewer role's access rule from Customer entirely.
  */
-revoke SecTest.Viewer on SecTest.Customer;
+revoke all on entity SecTest.Customer from SecTest.Viewer;
 /
 
 -- Verify after revoke
@@ -670,9 +670,9 @@ show access on page SecTest.Order_Overview;
 -- Revoke entity access to avoid CE0066 "entity access out of date".
 -- When a module has partial access rules (not all entities covered by all
 -- roles), MxBuild reports CE0066 regardless of security level.
-revoke SecTest.Administrator on SecTest.Customer;
-revoke SecTest.User on SecTest.Customer;
-revoke SecTest.User on SecTest.Order;
-revoke SecTest.Manager on SecTest.Customer;
+revoke all on entity SecTest.Customer from SecTest.Administrator;
+revoke all on entity SecTest.Customer from SecTest.User;
+revoke all on entity SecTest.Order from SecTest.User;
+revoke all on entity SecTest.Customer from SecTest.Manager;
 
 
diff --git a/mdl-examples/doctype-tests/14-project-settings-examples.mdl b/mdl-examples/doctype-tests/14-project-settings-examples.mdl
index 43e88e4c44..435ff47776 100644
--- a/mdl-examples/doctype-tests/14-project-settings-examples.mdl
+++ b/mdl-examples/doctype-tests/14-project-settings-examples.mdl
@@ -149,21 +149,21 @@ alter settings configuration 'Default'
  * Example 3.1: Override a constant value in a specific configuration
  */
 create constant MyModule.ServerUrl type string default 'localhost:9092';
-alter settings constant 'MyModule.ServerUrl' value 'kafka:9092'
+alter settings constant @MyModule.ServerUrl value 'kafka:9092'
   in configuration 'Default';
 
 /**
  * Example 3.2: Remove a constant override (reset to default)
  */
-alter settings drop constant 'MyModule.ServerUrl' in configuration 'Default';
+alter settings drop constant @MyModule.ServerUrl in configuration 'Default';
 
 /**
  * Example 3.3: Alternative syntax for removing a constant override
  * (Re-set the value first so there is something to drop)
  */
-alter settings constant 'MyModule.ServerUrl' value 'kafka:9092'
+alter settings constant @MyModule.ServerUrl value 'kafka:9092'
   in configuration 'Default';
-alter settings constant 'MyModule.ServerUrl' drop in configuration 'Default';
+alter settings constant @MyModule.ServerUrl drop in configuration 'Default';
 
 -- MARK: Create / Drop Configuration
 
diff --git a/mdl-examples/doctype-tests/24-workflow-examples.mdl b/mdl-examples/doctype-tests/24-workflow-examples.mdl
index 7372777181..d74400f887 100644
--- a/mdl-examples/doctype-tests/24-workflow-examples.mdl
+++ b/mdl-examples/doctype-tests/24-workflow-examples.mdl
@@ -158,7 +158,7 @@ begin
 
   call microflow WFTest.ACT_Validate;
 
-  decision '$WorkflowContext/Total > 1000'
+  decision $WorkflowContext/Total > 1000
     outcomes
       true -> { call microflow WFTest.ACT_Process; }
       false -> { call microflow WFTest.ACT_Notify; }
@@ -238,7 +238,7 @@ alter workflow WFTest.OrderApproval
 -- INSERT / DROP boundary event
 
 alter workflow WFTest.OrderApproval
-  insert boundary event on ReviewOrder interrupting timer 'addHours([%CurrentDateTime%], 2)' {
+  insert boundary event on ReviewOrder interrupting timer addHours([%CurrentDateTime%], 2) {
     call microflow WFTest.ACT_BoundaryHandler;
     jump to ReviewOrder;
   };
@@ -259,7 +259,7 @@ alter workflow WFTest.OrderApproval
 -- All remaining activity types
 
 alter workflow WFTest.OrderApproval
-  insert after ACT_Escalate@1 wait for timer 'addHours([%CurrentDateTime%], 1)' comment 'WaitOneHour';
+  insert after ACT_Escalate@1 wait for timer addHours([%CurrentDateTime%], 1) comment 'WaitOneHour';
 
 alter workflow WFTest.OrderApproval
   insert after WaitOneHour wait for notification comment 'WaitForApproval';
@@ -277,7 +277,7 @@ alter workflow WFTest.OrderApproval
 
 -- NON INTERRUPTING TIMER boundary event (compare with INTERRUPTING above)
 alter workflow WFTest.OrderApproval
-  insert boundary event on GroupApproval non interrupting timer 'addHours([%CurrentDateTime%], 48)' {
+  insert boundary event on GroupApproval non interrupting timer addHours([%CurrentDateTime%], 48) {
     call microflow WFTest.ACT_Notify;
   };
 
@@ -507,7 +507,7 @@ create workflow WFTest.NamedActivities
 begin
   call microflow WFTest.ACT_Validate as callMicroflow1;
 
-  decision decision1 '$WorkflowContext/Total > 1000'
+  decision decision1 $WorkflowContext/Total > 1000
     outcomes
       true -> {
         user task Rework 'Fix and resubmit'
@@ -525,7 +525,7 @@ begin
     path 2 { call microflow WFTest.ACT_Review as callMicroflow4; }
   ;
 
-  wait for timer timer1 'addHours([%CurrentDateTime%], 1)';
+  wait for timer timer1 addHours([%CurrentDateTime%], 1) ;
   wait for notification waitForNotification1;
 end workflow;
 /
@@ -544,7 +544,7 @@ end workflow;
 create workflow WFTest.EndInBranches
   parameter $OrderContext: WFTest.OrderContext
 begin
-  decision decision1 '$WorkflowContext/Total > 1000'
+  decision decision1 $WorkflowContext/Total > 1000
     outcomes
       true -> {
         user task ManagerReview 'Manager review'
@@ -560,11 +560,11 @@ begin
     outcomes
       'Cancel' { end workflow; }
       'Confirm' { }
-    boundary event interrupting timer 'addDays([%CurrentDateTime%], 3)' {
+    boundary event interrupting timer addDays([%CurrentDateTime%], 3) {
       end workflow comment 'Expired';
     };
 
-  wait for timer timer1 'addHours([%CurrentDateTime%], 1)';
+  wait for timer timer1 addHours([%CurrentDateTime%], 1) ;
 end workflow;
 /
 
@@ -783,11 +783,11 @@ begin
     outcomes 'Approve' { } 'Reject' { };
 
   event subprocess ESP_Expire 'Expire'
-    on interrupting timer 'addDays([%CurrentDateTime%], 30)' as ExpireStart comment 'After 30 days' {
+    on interrupting timer addDays([%CurrentDateTime%], 30) as ExpireStart comment 'After 30 days' {
   };
 
   event subprocess ESP_Remind 'Daily reminder'
-    on non interrupting timer 'addDays([%CurrentDateTime%], 1)' as RemindStart {
+    on non interrupting timer addDays([%CurrentDateTime%], 1) as RemindStart {
     call microflow WFTest.ACT_LogCancel with (OrderContext = '$WorkflowContext');
   };
 end workflow;
diff --git a/mdl-examples/doctype-tests/27-agent-editor-model-examples.mdl b/mdl-examples/doctype-tests/27-agent-editor-model-examples.mdl
index 167d916843..83f3e7c539 100644
--- a/mdl-examples/doctype-tests/27-agent-editor-model-examples.mdl
+++ b/mdl-examples/doctype-tests/27-agent-editor-model-examples.mdl
@@ -65,7 +65,7 @@ create constant ModelTest."ClaudeKey"
  */
 create model ModelTest."GPT4Model" (
   Provider: MxCloudGenAI,
-  key: ModelTest.GPT4Key
+  key: @ModelTest.GPT4Key
 );
 /
 
@@ -77,7 +77,7 @@ create model ModelTest."GPT4Model" (
  */
 create model ModelTest."ClaudeModel" (
   Provider: MxCloudGenAI,
-  key: ModelTest.ClaudeKey
+  key: @ModelTest.ClaudeKey
 );
 /
 
@@ -95,7 +95,7 @@ create model ModelTest."ClaudeModel" (
  */
 create model ModelTest."ConfiguredModel" (
   Provider: MxCloudGenAI,
-  key: ModelTest.GPT4Key,
+  key: @ModelTest.GPT4Key,
   DisplayName: 'GPT-4 Turbo (128K)',
   KeyName: 'prod-gpt4-turbo',
   Environment: 'production'
@@ -153,11 +153,11 @@ list models in ModelTest;
 -- These statements produce errors (commented out to not block the script):
 
 -- Duplicate model name:
--- CREATE MODEL ModelTest.GPT4Model (Provider: MxCloudGenAI, Key: ModelTest.GPT4Key);
+-- CREATE MODEL ModelTest.GPT4Model (Provider: MxCloudGenAI, Key: @ModelTest.GPT4Key);
 -- → Error: model already exists: ModelTest.GPT4Model
 
 -- Missing constant:
--- CREATE MODEL ModelTest.BadModel (Provider: MxCloudGenAI, Key: ModelTest.NoSuchConst);
+-- CREATE MODEL ModelTest.BadModel (Provider: MxCloudGenAI, Key: @ModelTest.NoSuchConst);
 -- → Error: CREATE MODEL ModelTest.BadModel: constant not found: ModelTest.NoSuchConst
 
 -- Drop non-existent model:
@@ -176,7 +176,7 @@ list models in ModelTest;
 
 create or modify model ModelTest."GPT4Model" (
   Provider: MxCloudGenAI,
-  key: ModelTest.GPT4Key,
+  key: @ModelTest.GPT4Key,
   DisplayName: 'GPT-4 Turbo (Updated)'
 );
 /
diff --git a/mdl-examples/doctype-tests/28-agent-editor-examples.mdl b/mdl-examples/doctype-tests/28-agent-editor-examples.mdl
index a83629ea4a..4347e0cd3b 100644
--- a/mdl-examples/doctype-tests/28-agent-editor-examples.mdl
+++ b/mdl-examples/doctype-tests/28-agent-editor-examples.mdl
@@ -46,7 +46,7 @@ create constant AgentTest."KBKey"
 
 create model AgentTest."TestModel" (
   Provider: MxCloudGenAI,
-  key: AgentTest.ModelKey
+  key: @AgentTest.ModelKey
 );
 /
 
@@ -56,7 +56,7 @@ create model AgentTest."TestModel" (
 
 create knowledge base AgentTest."ProductDocs" (
   Provider: MxCloudGenAI,
-  key: AgentTest.KBKey
+  key: @AgentTest.KBKey
 );
 /
 
@@ -170,14 +170,14 @@ describe consumed mcp service AgentTest.WebSearch;
 
 create or modify model AgentTest."TestModel" (
   Provider: MxCloudGenAI,
-  key: AgentTest.ModelKey,
+  key: @AgentTest.ModelKey,
   DisplayName: 'Updated Model Name'
 );
 /
 
 create or modify knowledge base AgentTest."ProductDocs" (
   Provider: MxCloudGenAI,
-  key: AgentTest.KBKey
+  key: @AgentTest.KBKey
 );
 /
 
diff --git a/mdl-examples/use-cases/ai-agent-platform-demo.mdl b/mdl-examples/use-cases/ai-agent-platform-demo.mdl
index 528c8a20c1..d490b5da53 100644
--- a/mdl-examples/use-cases/ai-agent-platform-demo.mdl
+++ b/mdl-examples/use-cases/ai-agent-platform-demo.mdl
@@ -310,7 +310,7 @@ end workflow;
 -- Boundary timer: if the agent task sits unreviewed for 4 hours → auto-escalate
 alter workflow AICustSupport.CaseResolution
   insert boundary event on ReviewAIResponse interrupting
-    timer 'addHours([%CurrentDateTime%], 4)' {
+    timer addHours([%CurrentDateTime%], 4) {
       call microflow AICustSupport.ACT_Case_Escalate;
       jump to ReviewAIResponse;
     };
@@ -334,7 +334,7 @@ create constant AICustSupport."KBKey"
 -- Model document (visible in Studio Pro Agent Editor — developer UX)
 create model AICustSupport."GPT4TurboModel" (
   Provider:    MxCloudGenAI,
-  key:         AICustSupport.LLMKey,
+  key:         @AICustSupport.LLMKey,
   DisplayName: 'GPT-4 Turbo (128K context)',
   Environment: 'production'
 );
@@ -342,7 +342,7 @@ create model AICustSupport."GPT4TurboModel" (
 -- Knowledge Base for RAG: product docs and known-solution articles
 create knowledge base AICustSupport."SupportKnowledgeBase" (
   Provider: MxCloudGenAI,
-  key:      AICustSupport.KBKey
+  key:      @AICustSupport.KBKey
 );
 
 -- Consumed MCP service: real-time web search tool (MCP 2025-03-26 / A2A)

From 6f0b0224e658a2011412b5f30c4e722bf008beaf Mon Sep 17 00:00:00 2001
From: Ako <andrej@koelewijn.net>
Date: Mon, 28 Sep 2026 05:56:25 +0000
Subject: [PATCH 07/35] mdl/visitor: keep MDL-DEPR074's begin/end apart from
 touching text
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

fmt --upgrade rewrote `insert after $X{ … }drop …` to `$Xbegin … enddrop`,
which lexes as a variable and an identifier; the upgrade's re-parse refused it.
The fragment's words now get a space where the source had none.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 mdl/upgrade/r2_children_test.go    | 23 +++++++++++++++++++
 mdl/visitor/visitor_r2_children.go | 37 +++++++++++++++++++++++++++++-
 2 files changed, 59 insertions(+), 1 deletion(-)

diff --git a/mdl/upgrade/r2_children_test.go b/mdl/upgrade/r2_children_test.go
index b629f902c2..8b3cb4ffb7 100644
--- a/mdl/upgrade/r2_children_test.go
+++ b/mdl/upgrade/r2_children_test.go
@@ -95,3 +95,26 @@ ALTER NANOFLOW M.N {
 		t.Errorf("second upgrade changed the script again: %v", again.Rewritten)
 	}
 }
+
+// A brace touches the text around it: `$X{ … }drop`. The braces are
+// punctuation, `begin` and `end` are words, so the rewrite must not glue them
+// to their neighbours (`$Xbegin` is a variable name, `enddrop` an identifier).
+func TestUpgrade_R2AlterFragmentBracesTouchingTheirNeighbours(t *testing.T) {
+	src := `alter microflow M.F {
+  insert after $IsValid{log info node 'X' 'y';}drop log * node 'Debug' *;
+  replace 'Cap' with{log info node 'X' 'z';};
+};
+`
+	want := `alter microflow M.F {
+  insert after $IsValid begin log info node 'X' 'y'; end drop log * node 'Debug' *;
+  replace 'Cap' with begin log info node 'X' 'z'; end;
+};
+`
+	res := mustUpgrade(t, src, Options{})
+	if res.Source != want {
+		t.Fatalf("got:\n%s\nwant:\n%s", res.Source, want)
+	}
+	if res.Rewritten[deprecation.AlterFlowFragmentBraces] != 1 {
+		t.Errorf("Rewritten = %v", res.Rewritten)
+	}
+}
diff --git a/mdl/visitor/visitor_r2_children.go b/mdl/visitor/visitor_r2_children.go
index 25a317e85a..64faca7369 100644
--- a/mdl/visitor/visitor_r2_children.go
+++ b/mdl/visitor/visitor_r2_children.go
@@ -3,6 +3,8 @@
 package visitor
 
 import (
+	"strings"
+
 	"github.com/antlr4-go/antlr/v4"
 	"github.com/mendixlabs/mxcli/mdl/ast"
 	"github.com/mendixlabs/mxcli/mdl/deprecation"
@@ -67,7 +69,7 @@ func (b *Builder) EnterStatement(ctx *parser.StatementContext) {
 				if op, ok := x.GetParent().(antlr.ParserRuleContext); ok && op.GetStart() != nil {
 					like = op.GetStart().GetText()
 				}
-				use(deprecation.AlterFlowFragmentBraces, x.LBRACE().GetSymbol()).swap(x.LBRACE(), x.RBRACE(),
+				use(deprecation.AlterFlowFragmentBraces, x.LBRACE().GetSymbol()).swapWords(x.LBRACE(), x.RBRACE(),
 					keywordLike(like, "begin"), keywordLike(like, "end"))
 			}
 		case *parser.MessageMemberTreeContext:
@@ -100,6 +102,39 @@ func (u *r2Use) swap(open, closing antlr.TerminalNode, newOpen, newClose string)
 	u.edits = append(u.edits, replaceSpan(o, o, newOpen), replaceSpan(c, c, newClose))
 }
 
+// swapWords respells a brace pair as the words newOpen … newClose. A brace is
+// punctuation and may touch its neighbours (`$X{ … }drop`); a word may not, or
+// it lexes as part of them (`$Xbegin`, `enddrop`), so each word is set apart
+// by a space where the source has none.
+func (u *r2Use) swapWords(open, closing antlr.TerminalNode, newOpen, newClose string) {
+	o, c := open.GetSymbol(), closing.GetSymbol()
+	u.edits = append(u.edits,
+		replaceSpan(o, o, padWord(o, newOpen)),
+		replaceSpan(c, c, padWord(c, newClose)))
+}
+
+// padWord is word, with a space on each side where the text next to tok is
+// not whitespace. A `;` after it needs none: `end;` is the canonical spelling.
+func padWord(tok antlr.Token, word string) string {
+	in := tok.GetInputStream()
+	if in == nil {
+		return word
+	}
+	if start := tok.GetStart(); start > 0 && !isSpaceText(in.GetText(start-1, start-1)) {
+		word = " " + word
+	}
+	if stop := tok.GetStop(); stop+1 < in.Size() {
+		if next := in.GetText(stop+1, stop+1); next != ";" && !isSpaceText(next) {
+			word += " "
+		}
+	}
+	return word
+}
+
+func isSpaceText(s string) bool {
+	return s == "" || strings.TrimSpace(s) == ""
+}
+
 // imageItems rewrites `( image X from file '…', … )` as
 // `{ image X ( File: '…' ) … }`.
 func (u *r2Use) imageItems(ctx *parser.ImageCollectionBodyContext) {

From e39520b9d0beba4557929428da266455c3fc7036 Mon Sep 17 00:00:00 2001
From: Ako <andrej@koelewijn.net>
Date: Mon, 28 Sep 2026 05:56:26 +0000
Subject: [PATCH 08/35] mdl/deprecation: structural rewrites are noun phrases
 after "Rewrite the"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The warning prints "Rewrite the <Structural>"; MDL-DEPR031 and 070-074 began
with "the" (or "each"), so it read "Rewrite the the fragment's …". A
registry test now refuses a leading "the".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 mdl/deprecation/deprecation.go      | 12 ++++++------
 mdl/deprecation/deprecation_test.go |  6 ++++++
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/mdl/deprecation/deprecation.go b/mdl/deprecation/deprecation.go
index 0316633214..b1ce04eb34 100644
--- a/mdl/deprecation/deprecation.go
+++ b/mdl/deprecation/deprecation.go
@@ -322,7 +322,7 @@ var entries = []Entry{
 		Code:      QuotedTargetingXPath,
 		Old:       "targeting [users|groups] xpath '[xpath]'",
 		Canonical: "targeting [users|groups] xpath [xpath]",
-		Rewrite:   Rewrite{Structural: "the XPath out of its string: `xpath '[Name = ''Admin'']'` becomes `xpath [Name = 'Admin']`"},
+		Rewrite:   Rewrite{Structural: "XPath out of its string: `xpath '[Name = ''Admin'']'` becomes `xpath [Name = 'Admin']`"},
 		RemovedIn: 2,
 		Note: "XPath is written in [ ] everywhere (R5), so the quotes inside it are no longer doubled. " +
 			"A string whose value is not a bracketed XPath is left in place and reported by `fmt --upgrade`.",
@@ -402,7 +402,7 @@ var r2Entries = []Entry{
 		Code:      RestOperationBraces,
 		Old:       "operation X { Method: get, … }",
 		Canonical: "operation X ( Method: get, … )",
-		Rewrite:   Rewrite{Structural: "the operation's braces become parentheses"},
+		Rewrite:   Rewrite{Structural: "operation's braces: `operation X { … }` becomes `operation X ( … )`"},
 		RemovedIn: 2,
 		Note: "An operation is a child of the service: its properties are in ( ) like every child's, " +
 			"and { } holds children (R2). A body or response mapping keeps its { } tree.",
@@ -415,7 +415,7 @@ var r2Entries = []Entry{
 		Code:      AgentAttachmentBraces,
 		Old:       "tool X { … } / mcp service M.S { … } / knowledge base K { … }",
 		Canonical: "tool X ( … ) / mcp service M.S ( … ) / knowledge base K ( … )",
-		Rewrite:   Rewrite{Structural: "the attachment's braces become parentheses"},
+		Rewrite:   Rewrite{Structural: "attachment's braces: `tool X { … }` becomes `tool X ( … )`"},
 		RemovedIn: 2,
 		Note:      "In create agent and in alter agent … add. An attachment is a child of the agent: its properties are in ( ) (R2).",
 		Example: "create agent M.A (UsageType: Task, Model: M.Gpt, SystemPrompt: 'x') " +
@@ -427,7 +427,7 @@ var r2Entries = []Entry{
 		Code:      ImageCollectionParens,
 		Old:       "image collection M.C ( image X from file '…', … )",
 		Canonical: "image collection M.C { image X ( File: '…' ) … }",
-		Rewrite: Rewrite{Structural: "the images move into { } without commas, and `from file '…'` " +
+		Rewrite: Rewrite{Structural: "image list: the images move into { } without commas, and `from file '…'` " +
 			"becomes `( File: '…' )`"},
 		RemovedIn:        2,
 		Note:             "The images are the collection's children, so they are in { }, each with its properties in ( ) (R2).",
@@ -438,7 +438,7 @@ var r2Entries = []Entry{
 		Code:      MessageTreeParens,
 		Old:       "message definition collection M.C ( definition D for M.E ( A, M.E_B/M.B ( C ) ) )",
 		Canonical: "message definition collection M.C { definition D for M.E { A, M.E_B/M.B { C } } }",
-		Rewrite:   Rewrite{Structural: "each parenthesised definition list and member tree moves into { }"},
+		Rewrite:   Rewrite{Structural: "message trees: each parenthesised definition list and member tree moves into { }"},
 		RemovedIn: 2,
 		Note: "The definitions and members are children, so they are in { }, as in an import or export " +
 			"mapping (R2). Also in `alter message definition collection … add definition` and " +
@@ -450,7 +450,7 @@ var r2Entries = []Entry{
 		Code:      AlterFlowFragmentBraces,
 		Old:       "alter microflow M.F { insert after $X { … } }",
 		Canonical: "alter microflow M.F { insert after $X begin … end; }",
-		Rewrite:   Rewrite{Structural: "the fragment's `{` becomes `begin` and its `}` becomes `end`"},
+		Rewrite:   Rewrite{Structural: "fragment's braces: `{` becomes `begin` and `}` becomes `end`"},
 		RemovedIn: 2,
 		Note: "A fragment is imperative flow, written exactly as the body of `create microflow`, so it is " +
 			"`begin … end` (R2). The operations around it are the alter's children and stay in its { }.",
diff --git a/mdl/deprecation/deprecation_test.go b/mdl/deprecation/deprecation_test.go
index de608703f2..e21746ba9b 100644
--- a/mdl/deprecation/deprecation_test.go
+++ b/mdl/deprecation/deprecation_test.go
@@ -4,6 +4,7 @@ package deprecation
 
 import (
 	"regexp"
+	"strings"
 	"testing"
 )
 
@@ -31,6 +32,11 @@ func TestRegistryEntriesAreWellFormed(t *testing.T) {
 		if swap == (e.Rewrite.Structural != "") {
 			t.Errorf("%s: a rewrite is either a keyword swap or structural, exactly one: %+v", e.Code, e.Rewrite)
 		}
+		// The warning prints "Rewrite the <Structural>", so a Structural that
+		// starts with "the" reads "Rewrite the the …".
+		if strings.HasPrefix(strings.ToLower(e.Rewrite.Structural), "the ") {
+			t.Errorf("%s: Structural %q starts with \"the\"; it is printed after \"Rewrite the\"", e.Code, e.Rewrite.Structural)
+		}
 		if e.Old == "" || e.Canonical == "" || e.Example == "" || e.CanonicalExample == "" {
 			t.Errorf("%s is incomplete: %+v", e.Code, e)
 		}

From 7eabdd2602642f8a7913a5b87043131ef1461dac Mon Sep 17 00:00:00 2001
From: Ako <andrej@koelewijn.net>
Date: Mon, 28 Sep 2026 06:32:16 +0000
Subject: [PATCH 09/35] fix(grammar): a bare timer delay does not take the
 'non' of the next boundary event (#753)

With the delay optional and the next boundary event allowed without a
repeated 'boundary event', 'interrupting timer non interrupting timer x'
read 'non' as the first timer's bare delay and made the second event
interrupting. A predicate keeps a bare delay from starting with NON, so
the script builds what it built when only a string could be the delay.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 mdl/grammar/domains/MDLWorkflow.g4            | 18 ++++++++--
 mdl/upgrade/workflow_expressions_test.go      |  9 +++++
 mdl/visitor/visitor_workflow.go               |  4 ++-
 .../visitor_workflow_expressions_test.go      | 35 +++++++++++++++++++
 4 files changed, 62 insertions(+), 4 deletions(-)

diff --git a/mdl/grammar/domains/MDLWorkflow.g4 b/mdl/grammar/domains/MDLWorkflow.g4
index bfa5695241..04816a6466 100644
--- a/mdl/grammar/domains/MDLWorkflow.g4
+++ b/mdl/grammar/domains/MDLWorkflow.g4
@@ -160,6 +160,18 @@ workflowExpression
     | expression
     ;
 
+/**
+ * A timer boundary event's delay. The delay is optional and the next boundary
+ * event may follow without repeating `boundary event`, so a bare delay must not
+ * start with the `non` of `non interrupting timer`, a word the expression
+ * grammar admits as a name: `interrupting timer non interrupting timer 'x'` is
+ * two events, the first without a delay, as it was when only a string could be
+ * the delay (ako/mxcli#753).
+ */
+workflowTimerDelay
+    : {p.GetTokenStream().LA(1) != MDLParserNON}? workflowExpression
+    ;
+
 /**
  * A user task. Its clauses are a SET, not a sequence — see
  * `workflowHeaderClause` for why, and `checkWorkflowClausesAtMostOnce` for the
@@ -235,9 +247,9 @@ workflowFallbackClause
  * with two boundary events did not parse.
  */
 workflowBoundaryEventClause
-    : INTERRUPTING TIMER workflowExpression? (LBRACE workflowBody RBRACE)?
-    | NON INTERRUPTING TIMER workflowExpression? (LBRACE workflowBody RBRACE)?
-    | TIMER workflowExpression? (LBRACE workflowBody RBRACE)?
+    : INTERRUPTING TIMER workflowTimerDelay? (LBRACE workflowBody RBRACE)?
+    | NON INTERRUPTING TIMER workflowTimerDelay? (LBRACE workflowBody RBRACE)?
+    | TIMER workflowTimerDelay? (LBRACE workflowBody RBRACE)?
     // A notification boundary event is triggered by `notify workflow … target
     // <name>`, so its name is what matters; the string is its caption.
     | INTERRUPTING NOTIFICATION workflowActivityName? STRING_LITERAL? (LBRACE workflowBody RBRACE)?
diff --git a/mdl/upgrade/workflow_expressions_test.go b/mdl/upgrade/workflow_expressions_test.go
index 2a6da5f526..4a6e3fbb99 100644
--- a/mdl/upgrade/workflow_expressions_test.go
+++ b/mdl/upgrade/workflow_expressions_test.go
@@ -28,6 +28,15 @@ func TestUpgrade_WorkflowExpressionsBare(t *testing.T) {
 				"  wait for timer addHours([%CurrentDateTime%], 1) comment 'Wait';\n" +
 				"  event subprocess Esp on interrupting timer addDays([%CurrentDateTime%], 30) as Start { };\nend workflow;",
 		},
+		{
+			// The first timer has no delay, and `non` must stay the start of
+			// the second event rather than become the first one's delay.
+			"a delayless timer before a non-interrupting one",
+			head + "begin\n  user task Review 'Review'\n    outcomes 'Done' { }\n" +
+				"    boundary event interrupting timer non interrupting timer 'addHours([%CurrentDateTime%], 1)';\nend workflow;",
+			head + "begin\n  user task Review 'Review'\n    outcomes 'Done' { }\n" +
+				"    boundary event interrupting timer non interrupting timer addHours([%CurrentDateTime%], 1);\nend workflow;",
+		},
 		{
 			"a string with no space around it",
 			"alter workflow M.WF set activity Review due date'addDays([%CurrentDateTime%], 1)';",
diff --git a/mdl/visitor/visitor_workflow.go b/mdl/visitor/visitor_workflow.go
index 4ed84a9a92..41798aefa4 100644
--- a/mdl/visitor/visitor_workflow.go
+++ b/mdl/visitor/visitor_workflow.go
@@ -906,7 +906,9 @@ func buildBoundaryEventNode(beCtx parser.IWorkflowBoundaryEventClauseContext) as
 		be.Caption = unquoteStringLit(s)
 	}
 	if !notification {
-		be.Delay = workflowExpressionText(beCtx2.WorkflowExpression())
+		if d := beCtx2.WorkflowTimerDelay(); d != nil {
+			be.Delay = workflowExpressionText(d.WorkflowExpression())
+		}
 	}
 	if notification {
 		be.Name = workflowActivityNameText(beCtx2.WorkflowActivityName())
diff --git a/mdl/visitor/visitor_workflow_expressions_test.go b/mdl/visitor/visitor_workflow_expressions_test.go
index 824b0e9d59..3f27774a06 100644
--- a/mdl/visitor/visitor_workflow_expressions_test.go
+++ b/mdl/visitor/visitor_workflow_expressions_test.go
@@ -122,3 +122,38 @@ func TestWorkflowDecisionReadsBack(t *testing.T) {
 		}
 	}
 }
+
+// A timer boundary event's delay is optional, and the next clause may follow
+// without repeating `boundary event`. `non` of `non interrupting timer` is
+// also a word the expression grammar admits as a bare name, so a bare delay
+// must not take it: `interrupting timer non interrupting timer 'x'` is an
+// interrupting timer with no delay and a non-interrupting one, as it was
+// before the delay could be written bare — not an interrupting timer whose
+// delay is `non` followed by a second interrupting one.
+func TestWorkflowExpression_BoundaryDelayDoesNotTakeNon(t *testing.T) {
+	for _, activity := range []string{
+		"user task R 'R'\n    outcomes 'Done' { }",
+		"multi user task R 'R'\n    outcomes 'Done' { }",
+		"call microflow M.F",
+	} {
+		for _, second := range []string{"'x'", "x"} {
+			src := wfHead + "begin\n  " + activity + "\n    boundary event interrupting timer non interrupting timer " + second + ";\nend workflow;"
+			prog := mustBuild(t, src)
+			wf := prog.Statements[0].(*ast.CreateWorkflowStmt)
+			var events []ast.WorkflowBoundaryEventNode
+			switch a := wf.Activities[0].(type) {
+			case *ast.WorkflowUserTaskNode:
+				events = a.BoundaryEvents
+			case *ast.WorkflowCallMicroflowNode:
+				events = a.BoundaryEvents
+			}
+			want := []ast.WorkflowBoundaryEventNode{
+				{EventType: "InterruptingTimer"},
+				{EventType: "NonInterruptingTimer", Delay: "x"},
+			}
+			if !reflect.DeepEqual(events, want) {
+				t.Errorf("%s\nbuilt %+v\nwant  %+v", src, events, want)
+			}
+		}
+	}
+}

From 3125713d326907d996aea89320d5379f32e4e7ae Mon Sep 17 00:00:00 2001
From: Ako <andrej@koelewijn.net>
Date: Mon, 28 Sep 2026 06:32:16 +0000
Subject: [PATCH 10/35] test(executor): the workflow round trip expects a bare
 decision condition (#753)

describe writes a decision's condition bare since R5; the integration
test still asserted the string form and failed in CI.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 mdl/executor/roundtrip_workflow_test.go | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/mdl/executor/roundtrip_workflow_test.go b/mdl/executor/roundtrip_workflow_test.go
index 7805430388..3f3920586b 100644
--- a/mdl/executor/roundtrip_workflow_test.go
+++ b/mdl/executor/roundtrip_workflow_test.go
@@ -145,7 +145,7 @@ begin
       true -> { }
       false -> { };
 
-  decision '$WorkflowContext/IsApproved'
+  decision $WorkflowContext/IsApproved
     outcomes
       true -> {
         wait for timer '${PT2H}';
@@ -192,7 +192,8 @@ end workflow;`
 		{"call microflow args", "call microflow " + mod + ".ScoreCalc(Score = $WorkflowContext/Score)"},
 		{"outcomes true", "true ->"},
 		{"outcomes false", "false ->"},
-		{"decision", "decision '$WorkflowContext/IsApproved'"},
+		// R5 (#753): describe writes a decision's condition bare.
+		{"decision", "decision $WorkflowContext/IsApproved"},
 		{"wait for timer", "wait for timer '${PT2H}'"},
 		{"jump to", "jump to ReviewTask"},
 		{"parallel split", "parallel split"},

From 3621c63949fcd9fe2cdb915e249deac4f921450b Mon Sep 17 00:00:00 2001
From: Ako <andrej@koelewijn.net>
Date: Mon, 28 Sep 2026 06:51:38 +0000
Subject: [PATCH 11/35] mdl/visitor: R3 rewrites keep a comment between the
 tokens they touch (#751)

fmt --upgrade promises to keep comments, but the MDL-DEPR103, -064, -060..063
rewrites replaced whole gaps: 'drop widget -- c\n a' became 'drop a',
'type: /* c */ Reference' became 'type Reference'. A gap that holds more than
whitespace now keeps its text; only the old token goes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 mdl/upgrade/r3_property_lists_test.go    | 29 ++++++++++++
 mdl/visitor/visitor_r3_property_lists.go | 60 +++++++++++++++++++++---
 2 files changed, 83 insertions(+), 6 deletions(-)

diff --git a/mdl/upgrade/r3_property_lists_test.go b/mdl/upgrade/r3_property_lists_test.go
index cf7e655b53..6f43935051 100644
--- a/mdl/upgrade/r3_property_lists_test.go
+++ b/mdl/upgrade/r3_property_lists_test.go
@@ -58,3 +58,32 @@ func TestUpgrade_R3PropertyLists(t *testing.T) {
 		}
 	}
 }
+
+// A comment between the tokens a rewrite touches survives it: the rewrite
+// removes the old token and the blank space after it, never the text between
+// two tokens (upgrade.go: "comments, layout … are kept").
+func TestUpgrade_R3KeepsCommentsInsideTheRewrite(t *testing.T) {
+	cases := []struct{ old, want string }{
+		{"alter page M.P { drop widget -- old\n  a; };\n",
+			"alter page M.P { drop -- old\n  a; };\n"},
+		{"alter page M.P { drop widget /* x */ a; };\n",
+			"alter page M.P { drop /* x */ a; };\n"},
+		{"create association M.A_B from M.A to M.B type: /* c */ Reference;\n",
+			"create association M.A_B from M.A to M.B type /* c */ Reference;\n"},
+		{"create association M.A_B from M.A to M.B type /* c */ : Reference;\n",
+			"create association M.A_B from M.A to M.B type /* c */ Reference;\n"},
+		{"alter settings runtime BcryptCost /* c */ = 11;\n",
+			"alter settings runtime ( BcryptCost /* c */ : 11 );\n"},
+		{"alter entity M.Remote set allow_create_change_locally /* c */ = true;\n",
+			"alter entity M.Remote set ( AllowCreateChangeLocally /* c */ : true );\n"},
+	}
+	for _, c := range cases {
+		res := mustUpgrade(t, c.old, Options{})
+		if res.Source != c.want {
+			t.Errorf("upgrade of\n%s got:\n%s want:\n%s", c.old, res.Source, c.want)
+		}
+		if again := mustUpgrade(t, res.Source, Options{}); again.Changed() {
+			t.Errorf("upgrade is not idempotent on\n%s", res.Source)
+		}
+	}
+}
diff --git a/mdl/visitor/visitor_r3_property_lists.go b/mdl/visitor/visitor_r3_property_lists.go
index 7087deca97..1117112ea1 100644
--- a/mdl/visitor/visitor_r3_property_lists.go
+++ b/mdl/visitor/visitor_r3_property_lists.go
@@ -49,14 +49,50 @@ func assignmentAt(ctx antlr.ParserRuleContext, op antlr.Tree) (oldAssignment, bo
 
 // colonEdits writes each assignment's `=` as `:`, directly after the key:
 // `Caption = 'x'` becomes `Caption: 'x'`.
+//
+// A comment between the key and the `=` stays where it is: only the `=` is
+// replaced then (`Key /* c */: 'x'`).
 func colonEdits(as []oldAssignment) []ast.TextEdit {
 	out := make([]ast.TextEdit, 0, len(as))
 	for _, a := range as {
-		out = append(out, ast.TextEdit{Start: a.keyStop + 1, Stop: a.op.GetStop() + 1, Text: ":"})
+		start := a.keyStop + 1
+		if !blankBetween(a.op.GetInputStream(), start, a.op.GetStart()) {
+			start = a.op.GetStart()
+		}
+		out = append(out, ast.TextEdit{Start: start, Stop: a.op.GetStop() + 1, Text: ":"})
 	}
 	return out
 }
 
+// blankBetween reports whether the runes in [start, stop) are whitespace only
+// — no comment the rewrite would delete. A missing stream counts as blank.
+func blankBetween(is antlr.CharStream, start, stop int) bool {
+	if is == nil || stop <= start {
+		return true
+	}
+	return strings.TrimSpace(is.GetText(start, stop-1)) == ""
+}
+
+// afterBlank is the offset of the first non-blank rune after tok: deleting
+// [tok.start, afterBlank(tok)) removes the token and the space after it, and
+// keeps a comment that follows.
+func afterBlank(tok antlr.Token) int {
+	end := tok.GetStop() + 1
+	is := tok.GetInputStream()
+	if is == nil {
+		return end
+	}
+	for end < is.Size() {
+		switch is.GetText(end, end) {
+		case " ", "\t", "\n", "\r":
+			end++
+			continue
+		}
+		break
+	}
+	return end
+}
+
 // wrapEdits puts the list from first to last in parentheses. A list that
 // starts on a new line after before (describe's layout) opens its parenthesis
 // on before's line and closes it on a line of its own, indented as that line
@@ -137,7 +173,7 @@ func (b *Builder) recordAlterPageDropWidget(ctx *parser.AlterDropContext) {
 	}
 	tok := w.GetSymbol()
 	b.recordDeprecation(deprecation.AlterPageDropWidget, tok, "drop widget")
-	edit := ast.TextEdit{Start: tok.GetStart(), Stop: targets[0].GetStart().GetStart(), Text: ""}
+	edit := ast.TextEdit{Start: tok.GetStart(), Stop: afterBlank(tok), Text: ""}
 	b.fixLastDeprecation(deprecation.AlterPageDropWidget, &ast.Fix{Edits: []ast.TextEdit{edit}}, "")
 }
 
@@ -225,7 +261,8 @@ func (b *Builder) recordAllowCreateChangeLocally(ctx *parser.AlterEntityActionCo
 	kt := key.GetSymbol()
 	b.recordDeprecation(deprecation.AllowCreateChangeLocally, kt, "alter entity")
 	b.fixLastDeprecation(deprecation.AllowCreateChangeLocally, &ast.Fix{Edits: []ast.TextEdit{
-		{Start: kt.GetStart(), Stop: eq.GetSymbol().GetStop() + 1, Text: "( AllowCreateChangeLocally:"},
+		{Start: kt.GetStart(), Stop: kt.GetStop() + 1, Text: "( AllowCreateChangeLocally"},
+		colonEdits([]oldAssignment{{keyStop: kt.GetStop(), op: eq.GetSymbol()}})[0],
 		insertAt(value.GetSymbol().GetStop()+1, " )"),
 	}}, "")
 }
@@ -259,9 +296,20 @@ func (b *Builder) recordAssociationClauseColon(ctx *parser.AssociationOptionCont
 	if kwStop < 0 || valueStart < 0 {
 		return
 	}
-	b.recordDeprecation(deprecation.AssociationClauseColon, colon.GetSymbol(), "association")
-	b.fixLastDeprecation(deprecation.AssociationClauseColon,
-		&ast.Fix{Edits: []ast.TextEdit{replaceGap(kwStop, valueStart, " ")}}, "")
+	ct := colon.GetSymbol()
+	is := ct.GetInputStream()
+	edit := replaceGap(kwStop, valueStart, " ")
+	if !blankBetween(is, kwStop+1, valueStart) {
+		// A comment sits in the gap: delete only the colon and the space
+		// after it, keeping one space between the keyword and what follows.
+		text := ""
+		if kwStop+1 == ct.GetStart() {
+			text = " "
+		}
+		edit = ast.TextEdit{Start: ct.GetStart(), Stop: afterBlank(ct), Text: text}
+	}
+	b.recordDeprecation(deprecation.AssociationClauseColon, ct, "association")
+	b.fixLastDeprecation(deprecation.AssociationClauseColon, &ast.Fix{Edits: []ast.TextEdit{edit}}, "")
 }
 
 // lineIndent is the leading whitespace of the line holding rune offset pos.

From 11a9ff598f33e1670bd2ad75b2ebbd58261ffaac Mon Sep 17 00:00:00 2001
From: Ako <andrej@koelewijn.net>
Date: Mon, 28 Sep 2026 06:51:39 +0000
Subject: [PATCH 12/35] mdl/executor: renamed design property suggests the
 canonical styling list (#751)

The MDL-WIDGET renamed-property suggestion told users to write
`set 'Key' = 'Value'`, the spelling this PR deprecates as MDL-DEPR062.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 mdl/executor/validate_alter_styling.go              | 8 ++++----
 mdl/executor/validate_alter_styling_renamed_test.go | 8 ++++----
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/mdl/executor/validate_alter_styling.go b/mdl/executor/validate_alter_styling.go
index 63a91e81ed..2b66d9dd30 100644
--- a/mdl/executor/validate_alter_styling.go
+++ b/mdl/executor/validate_alter_styling.go
@@ -19,7 +19,7 @@ import (
 // *ast.AlterStylingStmt is not among them, so an unsupported key was silent
 // until mxbuild:
 //
-//	alter styling on page … widget lvThings set 'Remove empty text' = on;
+//	alter styling on page … widget lvThings set ( 'Remove empty text': on );
 //	  mxcli check --references -> Check passed!
 //	  mxcli exec               -> Updated styling on widget "lvThings"
 //	  mxcli docker check       -> [CE6083] "Design property Remove empty text is
@@ -243,9 +243,9 @@ func renamedStylingSuggestion(r *designPropRename, value string) string {
 		return fmt.Sprintf("ALTER STYLING cannot write its current form, which is a compound: set "+
 			"`DesignProperties: [%s]` on the widget in CREATE PAGE, or in an ALTER PAGE REPLACE.", r.Replacement)
 	}
-	// 'Key': 'Value'  →  set 'Key' = 'Value'
-	if i := strings.Index(r.Replacement, "': "); i > 0 {
-		return fmt.Sprintf("Write it as `set %s' = %s`.", r.Replacement[:i], r.Replacement[i+3:])
+	// 'Key': 'Value'  →  set ( 'Key': 'Value' ), the canonical list (R3)
+	if strings.Contains(r.Replacement, "': ") {
+		return fmt.Sprintf("Write it as `set ( %s )`.", r.Replacement)
 	}
 	return renamedDesignPropSuggestion(r, value)
 }
diff --git a/mdl/executor/validate_alter_styling_renamed_test.go b/mdl/executor/validate_alter_styling_renamed_test.go
index 409ca92af8..f808db2b01 100644
--- a/mdl/executor/validate_alter_styling_renamed_test.go
+++ b/mdl/executor/validate_alter_styling_renamed_test.go
@@ -24,8 +24,8 @@ func TestAlterStyling_RenamedKey_NamesTheCurrentProperty(t *testing.T) {
 	}{
 		{
 			name:    "renamed property, value mapped through old option names",
-			set:     `set 'Align content' = 'Left align as column'`,
-			want:    []string{"renamed", "Align content (deprecated)", "CE6087", `set 'Align content (deprecated)' = 'Left align as a column'`},
+			set:     `set ( 'Align content': 'Left align as column' )`,
+			want:    []string{"renamed", "Align content (deprecated)", "CE6087", `set ( 'Align content (deprecated)': 'Left align as a column' )`},
 			wantNot: []string{"CE6083"},
 		},
 		{
@@ -33,13 +33,13 @@ func TestAlterStyling_RenamedKey_NamesTheCurrentProperty(t *testing.T) {
 			// cannot write (one flat value — the MDL-WIDGET12 limit): point at
 			// the inline form instead.
 			name:    "spacing side renamed into a compound",
-			set:     `set 'Spacing bottom' = 'Outer medium'`,
+			set:     `set ( 'Spacing bottom': 'Outer medium' )`,
 			want:    []string{"renamed", "CE6087", "'Spacing': ['margin-bottom': 'M']", "DesignProperties"},
 			wantNot: []string{"CE6083"},
 		},
 		{
 			name:    "multi-select toggle renamed into an option",
-			set:     `set 'Hide on phone' = on`,
+			set:     `set ( 'Hide on phone': on )`,
 			want:    []string{"renamed", "CE6087", "'Hide on': ['Phone': on]", "DesignProperties"},
 			wantNot: []string{"CE6083"},
 		},

From a32681c70c1d4f51cdaa38f044ecfe95aa580e12 Mon Sep 17 00:00:00 2001
From: Ako <andrej@koelewijn.net>
Date: Mon, 28 Sep 2026 06:51:40 +0000
Subject: [PATCH 13/35] docs: settings and OData alter syntax in the R3
 property list (#751)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../skills/mendix/odata-data-sharing/SKILL.md    |  2 +-
 docs-site/src/language/project-settings.md       |  8 ++++----
 .../01-language-reference.md                     | 16 ++++++++--------
 3 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/.claude/skills/mendix/odata-data-sharing/SKILL.md b/.claude/skills/mendix/odata-data-sharing/SKILL.md
index b38a891e72..938115b155 100644
--- a/.claude/skills/mendix/odata-data-sharing/SKILL.md
+++ b/.claude/skills/mendix/odata-data-sharing/SKILL.md
@@ -81,7 +81,7 @@ Then re-import: `CREATE OR MODIFY EXTERNAL ENTITIES FROM F1Now.NowApi` maps the
 new entity sets. Do **not** `DROP CONSUMED ODATA SERVICE` and recreate it to force a
 refresh — that invalidates the client ID the existing external entities point at.
 
-Note that `ALTER CONSUMED ODATA SERVICE SET MetadataUrl = …` does *not* re-fetch. Use
+Note that `ALTER CONSUMED ODATA SERVICE … SET ( MetadataUrl: … )` does *not* re-fetch. Use
 `CREATE OR MODIFY` when the contract is what changed.
 
 **Use Cases for Local Metadata:**
diff --git a/docs-site/src/language/project-settings.md b/docs-site/src/language/project-settings.md
index 41a3ae27d1..da6068d8a7 100644
--- a/docs-site/src/language/project-settings.md
+++ b/docs-site/src/language/project-settings.md
@@ -21,7 +21,7 @@ Settings are organized into categories. Each `ALTER SETTINGS` command targets on
 Runtime-level settings such as the after-startup microflow, hashing algorithm, and Java version:
 
 ```sql
-ALTER SETTINGS RUNTIME <Key> = <Value>;
+ALTER SETTINGS RUNTIME ( <Key>: <Value>, ... );
 ```
 
 Examples:
@@ -42,7 +42,7 @@ project already uses.
 Server configuration settings like database type, URL, and HTTP port. Each configuration is identified by name (commonly `'default'`):
 
 ```sql
-ALTER SETTINGS CONFIGURATION '<Name>' <Key> = <Value>;
+ALTER SETTINGS CONFIGURATION '<Name>' ( <Key>: <Value>, ... );
 ```
 
 Examples:
@@ -75,7 +75,7 @@ for. A translation written for any other language is stored in the model, passes
 the step that makes translating an app do anything.
 
 ```sql
-ALTER SETTINGS LANGUAGE <Key> = <Value>;
+ALTER SETTINGS LANGUAGE ( <Key>: <Value>, ... );
 ALTER SETTINGS LANGUAGE ADD [OR MODIFY] '<code>' [( <option>: <value>, ... )];
 ALTER SETTINGS LANGUAGE MODIFY '<code>' ( <option>: <value>, ... );
 ALTER SETTINGS LANGUAGE REMOVE '<code>';
@@ -167,7 +167,7 @@ because the default is the source language every other translation is keyed on.
 Configure workflow behavior such as the user entity and task parallelism:
 
 ```sql
-ALTER SETTINGS WORKFLOWS <Key> = <Value>;
+ALTER SETTINGS WORKFLOWS ( <Key>: <Value>, ... );
 ```
 
 Examples:
diff --git a/docs/05-mdl-specification/01-language-reference.md b/docs/05-mdl-specification/01-language-reference.md
index 1bafd64bff..97a1fff12b 100644
--- a/docs/05-mdl-specification/01-language-reference.md
+++ b/docs/05-mdl-specification/01-language-reference.md
@@ -1270,26 +1270,26 @@ Displays one row per constant per configuration. Shows the default value followe
 ### ALTER SETTINGS
 
 ```sql
-alter settings runtime key = value;
-alter settings configuration 'Name' key = value;
+alter settings runtime ( key: value, ... );
+alter settings configuration 'Name' ( key: value, ... );
 alter settings constant 'Name' value 'val' in configuration 'cfg';
 alter settings drop constant 'Name' in configuration 'cfg';
-alter settings LANGUAGE key = value;
-alter settings workflows key = value;
+alter settings language ( key: value, ... );
+alter settings workflows ( key: value, ... );
 ```
 
 ### CREATE / DROP CONFIGURATION
 
 ```sql
-create configuration 'Name' [key = value, ...];
+create configuration 'Name' [( key: value, ... )];
 drop configuration 'Name';
 ```
 
 **Example:**
 ```sql
-alter settings runtime AfterStartupMicroflow = 'MyModule.ACT_Startup';
-alter settings configuration 'default' DatabaseType = 'POSTGRESQL';
-alter settings LANGUAGE DefaultLanguageCode = 'en_US';
+alter settings runtime ( AfterStartupMicroflow: 'MyModule.ACT_Startup' );
+alter settings configuration 'default' ( DatabaseType: 'POSTGRESQL' );
+alter settings language ( DefaultLanguageCode: 'en_US' );
 
 -- View constant values across all configurations
 show constant values;

From bf8c1ad2dd0b920559e435c36d40f5a93cd852e3 Mon Sep 17 00:00:00 2001
From: Ako <andrej@koelewijn.net>
Date: Mon, 28 Sep 2026 06:51:53 +0000
Subject: [PATCH 14/35] =?UTF-8?q?R6:=20one=20verb=20per=20job=20=E2=80=94?=
 =?UTF-8?q?=20show->describe,=20drop,=20call=20rest=20service=20(#755,=20p?=
 =?UTF-8?q?art=202)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The remaining single-thing `show` forms get their `describe` spelling and
the words that broke a pattern take the pattern's word. Every old spelling
keeps parsing with its meaning and warns with a registered code (090-096):

- MDL-DEPR090: `show|list page X`, `project security`, `security matrix`,
  `structure`, `context of` -> `describe …` (new describe alternatives that
  build the same statement). `show entity|association|navigation|settings`
  print a summary where describe prints MDL, so they are reported without a
  rewrite.
- MDL-DEPR091: `alter user role … remove module roles` -> `drop`.
- MDL-DEPR092: `alter settings language|workflows remove …` -> `drop`.
- MDL-DEPR093: `column` for `attribute` in alter entity.
- MDL-DEPR094: `rest call` -> `call rest service`; describe emits it.
- MDL-DEPR095: `describe widget X` -> `describe widget type X`.
- MDL-DEPR096: `define fragment` -> `create fragment`; describe emits it.

Syntax entries, skills, docs-site and the quick reference use the canonical
forms.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .claude/skills/mendix/alter-page/SKILL.md     |   2 +-
 .claude/skills/mendix/assess-quality/SKILL.md |   2 +-
 .../atlas-design/reference/building-blocks.md |   6 +-
 .../mendix/connect-rapidminer-graph/SKILL.md  |   2 +-
 .claude/skills/mendix/custom-widgets/SKILL.md |   4 +-
 .claude/skills/mendix/fragments/SKILL.md      |  32 ++---
 .../reference/rest-api-example.md             |   2 +-
 .../skills/mendix/manage-navigation/SKILL.md  |   2 +-
 .../skills/mendix/manage-security/SKILL.md    |  14 +--
 .claude/skills/mendix/mock-rest-apis/SKILL.md |   2 +-
 .../skills/mendix/organize-project/SKILL.md   |   2 +-
 .../skills/mendix/project-settings/SKILL.md   |   4 +-
 .../mendix/rest-call-from-json/SKILL.md       |   8 +-
 .claude/skills/mendix/rest-client/SKILL.md    |  16 +--
 .../write-microflows/reference/integration.md |  14 +--
 cmd/mxcli/syntax/features_integration.go      |   8 +-
 cmd/mxcli/syntax/features_misc.go             |  38 +++---
 cmd/mxcli/syntax/features_page.go             |  32 ++---
 cmd/mxcli/syntax/features_security.go         |   6 +-
 cmd/mxcli/syntax/retired_spellings_test.go    |  27 ++++
 docs-site/src/SUMMARY.md                      |   4 +-
 docs-site/src/appendixes/error-messages.md    |   2 +-
 docs-site/src/appendixes/quick-reference.md   |  20 +--
 docs-site/src/examples/rest-integration.md    |  12 +-
 docs-site/src/ide/vscode-project-tree.md      |   2 +-
 docs-site/src/internals/reference-tracking.md |   2 +-
 docs-site/src/language/basics.md              |  15 +++
 docs-site/src/language/entity-access.md       |   2 +-
 docs-site/src/language/project-settings.md    |   4 +-
 docs-site/src/language/roles.md               |   4 +-
 docs-site/src/language/security.md            |   6 +-
 docs-site/src/language/widget-types.md        |   2 +-
 docs-site/src/migration/validation.md         |   2 +-
 docs-site/src/preface/mendix-concepts.md      |   2 +-
 docs-site/src/reference/capabilities.md       |   4 +-
 .../catalog/show-references-impact.md         |   8 +-
 docs-site/src/reference/query/README.md       |   2 +-
 .../src/reference/query/describe-widget.md    |   8 +-
 docs-site/src/reference/query/search.md       |   2 +-
 .../reference/query/show-business-events.md   |   2 +-
 .../src/reference/query/show-constants.md     |   2 +-
 docs-site/src/reference/query/show-modules.md |   2 +-
 .../src/reference/query/show-structure.md     |  14 +--
 docs-site/src/reference/query/show-widgets.md |   2 +-
 .../src/reference/query/show-workflows.md     |   2 +-
 docs-site/src/reference/security/README.md    |   6 +-
 .../src/reference/settings/alter-settings.md  |   8 +-
 docs-site/src/tools/code-navigation.md        |   4 +-
 docs-site/src/tools/refresh-catalog.md        |   2 +-
 docs-site/src/tools/show-context.md           |  14 +--
 docs-site/src/tools/tui-commands.md           |   2 +-
 docs-site/src/tutorial/describe-search.md     |   2 +-
 docs-site/src/tutorial/exploring.md           |   4 +-
 docs-site/src/tutorial/installation.md        |   2 +-
 docs-site/src/tutorial/mdl-ai-workflow.md     |   2 +-
 docs-site/src/tutorial/quickstart.md          |   2 +-
 docs-site/src/tutorial/show-structure.md      |  38 +++---
 docs/01-project/MDL_QUICK_REFERENCE.md        |  48 +++----
 ...759-create-configuration-storage-names.mdl |   2 +-
 .../doctype-tests/11-navigation-examples.mdl  |   6 +-
 .../doctype-tests/navigation-profiles.mdl     |   2 +-
 mdl/deprecation/deprecation.go                | 118 ++++++++++++++++--
 mdl/executor/cmd_fragments.go                 |   2 +-
 mdl/executor/cmd_fragments_mock_test.go       |   2 +-
 mdl/executor/cmd_microflows_format_action.go  |   2 +-
 .../cmd_microflows_format_restcall_test.go    |   4 +-
 mdl/executor/fragment_test.go                 |   8 +-
 mdl/executor/stmt_summary.go                  |   2 +-
 mdl/executor/validate_microflow_rest.go       |   4 +-
 mdl/executor/validate_widget_kind.go          |   2 +-
 mdl/grammar/domains/MDLCatalog.g4             |  37 ++++--
 mdl/grammar/domains/MDLDomainModel.g4         |  18 +--
 mdl/grammar/domains/MDLMicroflow.g4           |  10 +-
 mdl/grammar/domains/MDLSecurity.g4            |   3 +-
 mdl/grammar/domains/MDLSettings.g4            |  17 +--
 mdl/repl/repl.go                              |   2 +
 mdl/upgrade/examples_test.go                  |   9 +-
 mdl/upgrade/r8_spellings_test.go              |   4 +-
 mdl/upgrade/verbs_test.go                     |  50 ++++++++
 mdl/visitor/r8_spellings_test.go              |   4 +-
 mdl/visitor/visitor_deprecations.go           | 114 +++++++++++------
 mdl/visitor/visitor_deprecations_test.go      |  34 ++---
 mdl/visitor/visitor_document_names_test.go    |   4 +-
 mdl/visitor/visitor_entity.go                 |   8 +-
 mdl/visitor/visitor_query.go                  |  52 ++++++++
 mdl/visitor/visitor_settings.go               |  10 +-
 mdl/visitor/visitor_verbs.go                  | 113 +++++++++++++++++
 mdl/visitor/visitor_verbs_test.go             | 108 ++++++++++++++++
 88 files changed, 887 insertions(+), 348 deletions(-)
 create mode 100644 mdl/upgrade/verbs_test.go
 create mode 100644 mdl/visitor/visitor_verbs.go
 create mode 100644 mdl/visitor/visitor_verbs_test.go

diff --git a/.claude/skills/mendix/alter-page/SKILL.md b/.claude/skills/mendix/alter-page/SKILL.md
index 861a4fa7a7..62f51f2906 100644
--- a/.claude/skills/mendix/alter-page/SKILL.md
+++ b/.claude/skills/mendix/alter-page/SKILL.md
@@ -542,7 +542,7 @@ adds. Both still fail at exec if they are genuinely wrong.
 | Missing `on widgetName` for widget SET | Add `on widgetName` (only page-level properties — `Title`, `Documentation`, `PopupWidth`, `PopupHeight`, `PopupResizable`, `Class`, `Style` — omit ON) |
 | `unsupported page-level property: title` | Page-level property names are case-sensitive — use `Title`, `PopupWidth`, `PopupHeight`, `PopupResizable`, `Class`, `Style` |
 | Using unquoted pluggable property names | Quote pluggable props: `set ('showLabel': false) on cb` |
-| `pluggable property "X" not found` | The widget does not declare it — casing is not the problem (any casing resolves). The error lists the keys it does declare; `describe widget <type>` or `describe page` shows them in context. Run `mxcli check … --references` to get this before the script runs |
+| `pluggable property "X" not found` | The widget does not declare it — casing is not the problem (any casing resolves). The error lists the keys it does declare; `describe widget type <type>` or `describe page` shows them in context. Run `mxcli check … --references` to get this before the script runs |
 | Wrong widget name | Use `describe page Module.Name` to see widget names |
 | SET on non-existent widget | Widget names are case-sensitive; check with DESCRIBE |
 | Missing semicolons between operations | Each operation inside `{ }` ends with `;` |
diff --git a/.claude/skills/mendix/assess-quality/SKILL.md b/.claude/skills/mendix/assess-quality/SKILL.md
index 774cf41164..53840e01f5 100644
--- a/.claude/skills/mendix/assess-quality/SKILL.md
+++ b/.claude/skills/mendix/assess-quality/SKILL.md
@@ -40,7 +40,7 @@ Use catalog queries to understand the project's shape:
 
 ```sql
 -- Overview of project size and structure
-show structure depth 2
+describe structure depth 2
 
 -- Key metrics
 select module_name, count(*) from CATALOG.entities GROUP by module_name
diff --git a/.claude/skills/mendix/atlas-design/reference/building-blocks.md b/.claude/skills/mendix/atlas-design/reference/building-blocks.md
index ef4f318f1b..5440173086 100644
--- a/.claude/skills/mendix/atlas-design/reference/building-blocks.md
+++ b/.claude/skills/mendix/atlas-design/reference/building-blocks.md
@@ -49,7 +49,7 @@ is the fallback for hand-tuning or the modelsdk engine; the how-to is below.
    `DesignProperties:` — copy both.
 3. **Reproduce the tree** on your page, binding real data where the block has
    placeholder text (`'Card title'` → your attribute/content).
-4. **DRY it** — if the shape repeats, put it in a `define fragment` and `use` it.
+4. **DRY it** — if the shape repeats, put it in a `create fragment` and `use` it.
 
 ### Worked example — `Card`
 
@@ -80,7 +80,7 @@ the slot with each card's own content. This is the key idiom: one card wrapper,
 arbitrary bodies, no copy-paste of the wrapper markup.
 
 ```mdl
-define fragment SectionCard as {
+create fragment SectionCard as {
   container card1 (designproperties: ['Card style': on, 'Spacing': ['margin-bottom': 'Large']]) {
     container cardBody (class: 'card-body') {
       slot content            -- each page's widgets land here
@@ -119,7 +119,7 @@ inside; typed **parameters** vary *which entity* and *which microflow*. Declare
 `datasource` and/or `action` parameter and the card becomes a real component:
 
 ```mdl
-define fragment EntityCard($data: datasource, $onOpen: action) as {
+create fragment EntityCard($data: datasource, $onOpen: action) as {
   container card1 (designproperties: ['Card style': on]) {
     listview lv (datasource: $data) {
       slot content
diff --git a/.claude/skills/mendix/connect-rapidminer-graph/SKILL.md b/.claude/skills/mendix/connect-rapidminer-graph/SKILL.md
index 9cfd0b7303..e407b032c3 100644
--- a/.claude/skills/mendix/connect-rapidminer-graph/SKILL.md
+++ b/.claude/skills/mendix/connect-rapidminer-graph/SKILL.md
@@ -182,7 +182,7 @@ begin
   end loop;
 
   -- Inline REST CALL — NOT the REST Client (see notes)
-  $RawJson = rest call post 'https://graphstudio.mendixdemo.com/sparql/graphmart/http%3A%2F%2Fcambridgesemantics.com%2FGraphmart%2F3617250aca6a40d88972c1c0de38f86a'
+  $RawJson = call rest service post 'https://graphstudio.mendixdemo.com/sparql/graphmart/http%3A%2F%2Fcambridgesemantics.com%2FGraphmart%2F3617250aca6a40d88972c1c0de38f86a'
     header 'Accept'       = 'application/sparql-results+json'
     header 'Content-Type' = 'application/sparql-query'
     auth basic '<username>' password '<password>'
diff --git a/.claude/skills/mendix/custom-widgets/SKILL.md b/.claude/skills/mendix/custom-widgets/SKILL.md
index bf0bd33717..62526e3a45 100644
--- a/.claude/skills/mendix/custom-widgets/SKILL.md
+++ b/.claude/skills/mendix/custom-widgets/SKILL.md
@@ -25,7 +25,7 @@ the **properties** (the widget's own spelling — `tagName`, not `TagName`), and
 the **body containers** — `attribute` is an object list (one entry per
 repetition), `tagcontentcontainer` a child slot (holds widgets).
 
-**Ask the widget rather than guessing.** `describe widget <name>` lists every
+**Ask the widget rather than guessing.** `describe widget type <name>` lists every
 property with its type, default and enumeration members; every body container
 and whether MDL can express it; and a complete example that parses AND checks as
 written:
@@ -94,7 +94,7 @@ form is reported only when the widget resolves, because without a definition
 matter because a required slot left empty is not a silent no-op at build time —
 it is `CE0642 "Property '…' is required."`, one per slot.
 
-`describe widget <name> -p <project.mpr>` lists a widget's container keywords
+`describe widget type <name> -p <project.mpr>` lists a widget's container keywords
 under **Body containers**, and — for an object list — the widgets-typed **slots
 inside one item**, with the widget types that route into each:
 
diff --git a/.claude/skills/mendix/fragments/SKILL.md b/.claude/skills/mendix/fragments/SKILL.md
index 5e592cf509..de133d3ca7 100644
--- a/.claude/skills/mendix/fragments/SKILL.md
+++ b/.claude/skills/mendix/fragments/SKILL.md
@@ -1,6 +1,6 @@
 ---
 name: fragments
-description: "Define reusable widget groups with DEFINE FRAGMENT and place them with USE FRAGMENT. Use when the same widget pattern repeats across pages and should be written once."
+description: "Define reusable widget groups with CREATE FRAGMENT and place them with USE FRAGMENT. Use when the same widget pattern repeats across pages and should be written once."
 ---
 
 # Mendix Fragments Skill
@@ -8,7 +8,7 @@ description: "Define reusable widget groups with DEFINE FRAGMENT and place them
 ## When to Use This Skill
 
 Use this skill when:
-- Defining reusable widget groups with `define fragment`
+- Defining reusable widget groups with `create fragment`
 - Inserting fragments into pages or snippets with `use fragment`
 - Listing or inspecting fragments with `show fragments` / `describe fragment`
 - Building multiple pages that share common widget patterns (footers, form fields, buttons)
@@ -24,10 +24,10 @@ Fragments are **script-scoped, transient** widget groups:
 
 ## Syntax Reference
 
-### DEFINE FRAGMENT
+### CREATE FRAGMENT
 
 ```mdl
-define fragment SaveCancelFooter as {
+create fragment SaveCancelFooter as {
   footer footer1 {
     actionbutton btnSave (caption: 'Save', action: save changes, buttonstyle: primary)
     actionbutton btnCancel (caption: 'Cancel', action: cancel changes)
@@ -38,7 +38,7 @@ define fragment SaveCancelFooter as {
 Multiple top-level widgets:
 
 ```mdl
-define fragment CustomerFields as {
+create fragment CustomerFields as {
   textbox txtName (label: 'Name', attribute: Name)
   textbox txtEmail (label: 'Email', attribute: Email)
   textbox txtPhone (label: 'Phone', attribute: Phone)
@@ -79,7 +79,7 @@ panel, or section) whose body varies per use. Declare a `slot` where the caller'
 widgets should land, then fill it with the `use fragment X { … }` payload form:
 
 ```mdl
-define fragment Card as {
+create fragment Card as {
   container cardWrap (class: 'card', designproperties: ['Card style': on]) {
     container cardBody (class: 'card-body') {
       slot content            -- caller's widgets are spliced in here
@@ -106,7 +106,7 @@ Rules (v1):
   (no slot marker), and there are no BSON/round-trip surprises.
 
 > For varying a leaf **value** (a label or attribute name) rather than wrapping a
-> subtree, scalar params (`define fragment F($label, $attr) as …`) are a planned
+> subtree, scalar params (`create fragment F($label, $attr) as …`) are a planned
 > v1.1 follow-up; today use a slot plus a one-line value fill.
 
 ### Parameter bindings — datasource & action (experimental)
@@ -118,7 +118,7 @@ its value at the use site. This turns a shell into a real reusable component —
 one panel bound to a different entity and a different handler per use.
 
 ```mdl
-define fragment DataPanel($data: datasource, $onEdit: action) as {
+create fragment DataPanel($data: datasource, $onEdit: action) as {
   container panelWrap (class: 'card') {
     listview lvItems (datasource: $data) {
       slot content
@@ -171,7 +171,7 @@ describe fragment SaveCancelFooter;
 ### Pattern 1: Standard CRUD Footer
 
 ```mdl
-define fragment CrudFooter as {
+create fragment CrudFooter as {
   footer footer1 {
     actionbutton btnSave (caption: 'Save', action: save changes, buttonstyle: primary)
     actionbutton btnCancel (caption: 'Cancel', action: cancel changes)
@@ -197,7 +197,7 @@ create page Module.Order_Edit (...) {
 ### Pattern 2: Form Field Groups
 
 ```mdl
-define fragment AddressFields as {
+create fragment AddressFields as {
   textbox txtStreet (label: 'Street', attribute: Street)
   textbox txtCity (label: 'City', attribute: City)
   textbox txtZip (label: 'Zip Code', attribute: ZipCode)
@@ -217,7 +217,7 @@ create page Module.Customer_Edit (...) {
 ### Pattern 3: Same Fragment with Prefix
 
 ```mdl
-define fragment ActionButtons as {
+create fragment ActionButtons as {
   actionbutton btnApprove (caption: 'Approve', action: save changes, buttonstyle: success)
   actionbutton btnReject (caption: 'Reject', action: cancel changes, buttonstyle: danger)
 };
@@ -242,8 +242,8 @@ create page Module.DualPanel (...) {
 
 ```mdl
 -- WRONG: Defining the same fragment name twice causes an error
-define fragment footer as { ... };
-define fragment footer as { ... };  -- Error: fragment "Footer" already defined
+create fragment footer as { ... };
+create fragment footer as { ... };  -- Error: fragment "Footer" already defined
 ```
 
 ### Missing Fragment
@@ -274,10 +274,10 @@ use fragment footer as second_
 create page Module.MyPage (...) {
   use fragment footer   -- Error: fragment "Footer" not found
 };
-define fragment footer as { ... };
+create fragment footer as { ... };
 
 -- CORRECT: Define before use
-define fragment footer as { ... };
+create fragment footer as { ... };
 create page Module.MyPage (...) {
   use fragment footer   -- OK
 };
@@ -285,7 +285,7 @@ create page Module.MyPage (...) {
 
 ## Validation Checklist
 
-- [ ] All `define fragment` statements appear before their `use fragment` references
+- [ ] All `create fragment` statements appear before their `use fragment` references
 - [ ] No duplicate fragment names in the script
 - [ ] Prefix used when the same fragment appears multiple times on one page
 - [ ] Fragment widget names don't conflict with other widgets on the page
diff --git a/.claude/skills/mendix/json-structures-and-mappings/reference/rest-api-example.md b/.claude/skills/mendix/json-structures-and-mappings/reference/rest-api-example.md
index d07efbbb1e..4df48e7351 100644
--- a/.claude/skills/mendix/json-structures-and-mappings/reference/rest-api-example.md
+++ b/.claude/skills/mendix/json-structures-and-mappings/reference/rest-api-example.md
@@ -139,7 +139,7 @@ create microflow Integration.GetCountryInfo ()
 returns string as $json
 begin
   -- Fetch country data from REST API
-  $response = rest call get 'https://restcountries.com/v3.1/name/netherlands'
+  $response = call rest service get 'https://restcountries.com/v3.1/name/netherlands'
     header Accept = 'application/json'
     timeout 30
     returns string
diff --git a/.claude/skills/mendix/manage-navigation/SKILL.md b/.claude/skills/mendix/manage-navigation/SKILL.md
index 8c1977cdd3..07cb796d95 100644
--- a/.claude/skills/mendix/manage-navigation/SKILL.md
+++ b/.claude/skills/mendix/manage-navigation/SKILL.md
@@ -345,7 +345,7 @@ show references to MyModule.Home_Web;
 show impact of MyModule.Home_Web;
 
 -- Full context for a page (includes navigation references)
-show context of MyModule.Home_Web;
+describe context of MyModule.Home_Web;
 ```
 
 ## Common Patterns
diff --git a/.claude/skills/mendix/manage-security/SKILL.md b/.claude/skills/mendix/manage-security/SKILL.md
index 2c0cafa6ca..bf51ff7597 100644
--- a/.claude/skills/mendix/manage-security/SKILL.md
+++ b/.claude/skills/mendix/manage-security/SKILL.md
@@ -97,7 +97,7 @@ then stops part-way through.
 
 ```sql
 -- Project-wide security overview
-show project security;
+describe app security;
 
 -- Module roles (all or filtered)
 show module roles;
@@ -114,8 +114,8 @@ show access on entity MyModule.Customer;
 show access on MyModule.Customer;        -- a bare name means the entity
 
 -- Full security matrix
-show security matrix;
-show security matrix in MyModule;
+describe security matrix;
+describe security matrix in MyModule;
 ```
 
 ### Describe Commands
@@ -390,9 +390,9 @@ create user role RegularUser (MyModule.User, OtherModule.Reader);
 -- Create with manage all roles permission
 create user role SuperAdmin (MyModule.Admin) manage all roles;
 
--- Add/remove module roles
+-- Add/drop module roles
 alter user role RegularUser add module roles (MyModule.Viewer);
-alter user role RegularUser remove module roles (MyModule.Viewer);
+alter user role RegularUser drop module roles (MyModule.Viewer);
 
 -- Remove user role
 drop user role RegularUser;
@@ -506,7 +506,7 @@ create user role AppUser (Shop.User);
 create user role AppAdmin (Shop.Admin) manage all roles;
 
 -- 6. Verify
-show security matrix in Shop;
+describe security matrix in Shop;
 describe user role AppAdmin;
 ```
 
@@ -543,7 +543,7 @@ rule's default cover it, or change the default.
 After setting up security, verify with:
 ```bash
 # check security matrix
-mxcli -p app.mpr -c "show security matrix in MyModule"
+mxcli -p app.mpr -c "describe security matrix in MyModule"
 
 # Validate with Mendix
 mxcli docker check -p app.mpr
diff --git a/.claude/skills/mendix/mock-rest-apis/SKILL.md b/.claude/skills/mendix/mock-rest-apis/SKILL.md
index 201a549491..6bea6c56d1 100644
--- a/.claude/skills/mendix/mock-rest-apis/SKILL.md
+++ b/.claude/skills/mendix/mock-rest-apis/SKILL.md
@@ -49,7 +49,7 @@ create constant MyModule.ApiBaseUrl type String default 'https://api.example.com
 
 create microflow MyModule.CallApi() returns string
 begin
-  $response = rest call get @MyModule.ApiBaseUrl + '/rates'
+  $response = call rest service get @MyModule.ApiBaseUrl + '/rates'
     header Accept = 'application/json'
     returns string;
   return $response;
diff --git a/.claude/skills/mendix/organize-project/SKILL.md b/.claude/skills/mendix/organize-project/SKILL.md
index 4797cb3b61..aa2a0a7f10 100644
--- a/.claude/skills/mendix/organize-project/SKILL.md
+++ b/.claude/skills/mendix/organize-project/SKILL.md
@@ -149,7 +149,7 @@ Three things about the output are deliberate:
 Use the CLI's `--json` flag for a row per document (`Module, Folder, Kind, Document`)
 when comparing against a checked-in layout.
 
-Do **not** reach for `show structure` here: it groups by document type at every
+Do **not** reach for `describe structure` here: it groups by document type at every
 depth and never shows which folder a document sits in.
 
 ## Moving Documents
diff --git a/.claude/skills/mendix/project-settings/SKILL.md b/.claude/skills/mendix/project-settings/SKILL.md
index bcf305d913..cc8ddc1253 100644
--- a/.claude/skills/mendix/project-settings/SKILL.md
+++ b/.claude/skills/mendix/project-settings/SKILL.md
@@ -194,7 +194,7 @@ and produces nothing at build time — so enable the language first.
 alter settings LANGUAGE add 'de_DE';
 alter settings LANGUAGE add 'ar_SD' (CheckCompleteness: true, CustomDateFormat: 'yyyy-MM-dd');
 alter settings LANGUAGE modify 'de_DE' (CheckCompleteness: true);
-alter settings LANGUAGE remove 'de_DE';
+alter settings Language drop 'de_DE';
 
 -- the default must already be enabled
 alter settings LANGUAGE DefaultLanguageCode = 'en_US';
@@ -251,7 +251,7 @@ alter settings workflows add or modify group 'Approvers' (Description: 'Approves
 -- changes only the options it names
 alter settings workflows modify group 'Reviewers' (Description: 'Second-line review');
 
-alter settings workflows remove group 'Reviewers';
+alter settings workflows drop group 'Reviewers';
 
 show workflow groups;
 ```
diff --git a/.claude/skills/mendix/rest-call-from-json/SKILL.md b/.claude/skills/mendix/rest-call-from-json/SKILL.md
index 19aad2b575..2c9f8d71da 100644
--- a/.claude/skills/mendix/rest-call-from-json/SKILL.md
+++ b/.claude/skills/mendix/rest-call-from-json/SKILL.md
@@ -121,7 +121,7 @@ begin
   @position(185, 200)
   declare $endpoint string = $baseUrl + '/path';
   @position(375, 200)
-  $Result = rest call get '{1}' with ({1} = $endpoint)
+  $Result = call rest service get '{1}' with ({1} = $endpoint)
     header 'Accept' = 'application/json'
     timeout 300
     returns mapping Module.IMM_MyMapping as Module.MyRootObject on error rollback;
@@ -139,7 +139,7 @@ end;
 
 **For list responses** (JSON root is an array):
 ```sql
-  $Results = rest call get '{1}' with ({1} = $endpoint)
+  $Results = call rest service get '{1}' with ({1} = $endpoint)
     header 'Accept' = 'application/json'
     timeout 300
     returns mapping Module.IMM_MyMapping as Module.MyItem on error rollback;
@@ -220,7 +220,7 @@ create or modify microflow Module.POST_Document_Upload (
 returns boolean as $Ok
 begin
   declare $Ok boolean = false;
-  $Response = rest call post 'https://api.example.com/documents'
+  $Response = call rest service post 'https://api.example.com/documents'
     header 'ContentType' = 'application/pdf'
     body binary $Doc/Contents
     timeout 300
@@ -307,7 +307,7 @@ begin
   @position(185, 200)
   declare $endpoint string = $baseUrl + '/data/web/random';
   @position(375, 200)
-  $Result = rest call get '{1}' with ({1} = $endpoint)
+  $Result = call rest service get '{1}' with ({1} = $endpoint)
     header 'Accept' = 'application/json'
     timeout 300
     returns mapping Integrations.IMM_BibleVerse as Integrations.BibleApiResponse on error rollback;
diff --git a/.claude/skills/mendix/rest-client/SKILL.md b/.claude/skills/mendix/rest-client/SKILL.md
index 8e3658de8f..baf98c7565 100644
--- a/.claude/skills/mendix/rest-client/SKILL.md
+++ b/.claude/skills/mendix/rest-client/SKILL.md
@@ -135,7 +135,7 @@ returns HTTP 200 with a 4-byte payload.
 Upload binary from a **microflow** instead, which does have a binary body:
 
 ```sql
-rest call post 'https://api.example.com/upload'
+call rest service post 'https://api.example.com/upload'
   header 'ContentType' = 'application/pdf'
   body binary $Doc/Contents
   returns response;
@@ -260,40 +260,40 @@ Call an HTTP endpoint directly from a microflow — no REST client document need
 
 ```sql
 -- Simple GET returning a string
-$response = rest call get 'https://api.example.com/data'
+$response = call rest service get 'https://api.example.com/data'
   header Accept = 'application/json'
   timeout 30
   returns string;
 
 -- GET with URL template parameters
-$response = rest call get 'https://api.example.com/users/{1}' with (
+$response = call rest service get 'https://api.example.com/users/{1}' with (
   {1} = toString($UserId)
 )
   header Accept = 'application/json'
   returns string;
 
 -- POST with body
-$response = rest call post 'https://api.example.com/items'
+$response = call rest service post 'https://api.example.com/items'
   header 'Content-Type' = 'application/json'
   body '{"name": "test"}'
   returns string;
 
 -- With basic auth
-$response = rest call get 'https://api.example.com/secure'
+$response = call rest service get 'https://api.example.com/secure'
   auth basic 'username' password 'password'
   returns string;
 
 -- With import mapping (JSON → entity)
-$item = rest call get 'https://api.example.com/item/1'
+$item = call rest service get 'https://api.example.com/item/1'
   header Accept = 'application/json'
   returns mapping Module.IMM_Item as Module.Item;
 
 -- Fire and forget
-rest call delete 'https://api.example.com/item/1'
+call rest service delete 'https://api.example.com/item/1'
   returns nothing;
 
 -- Error handling
-$response = rest call get 'https://api.example.com/data'
+$response = call rest service get 'https://api.example.com/data'
   returns string
   on error continue;
 ```
diff --git a/.claude/skills/mendix/write-microflows/reference/integration.md b/.claude/skills/mendix/write-microflows/reference/integration.md
index 73ba8ba895..abc2e6a6b3 100644
--- a/.claude/skills/mendix/write-microflows/reference/integration.md
+++ b/.claude/skills/mendix/write-microflows/reference/integration.md
@@ -133,13 +133,13 @@ Direct HTTP call with URL, headers, auth, body, and response handling specified
 
 ```mdl
 -- Simple GET returning string
-$response = rest call get 'https://api.example.com/data'
+$response = call rest service get 'https://api.example.com/data'
     header Accept = 'application/json'
     timeout 30
     returns string;
 
 -- POST with JSON body
-$response = rest call post 'https://api.example.com/items'
+$response = call rest service post 'https://api.example.com/items'
     header 'Content-Type' = 'application/json'
     header Accept = 'application/json'
     body '{{"name": "{1}", "value": {2}}' with (
@@ -155,28 +155,28 @@ $response = rest call post 'https://api.example.com/items'
 -- itself, and the content type goes on a header. A consumed REST CLIENT
 -- document has no binary body — `Body: file from $Doc` there is refused as
 -- MDL-REST02 — so binary uploads belong here.
-$response = rest call post 'https://api.example.com/upload'
+$response = call rest service post 'https://api.example.com/upload'
     header 'ContentType' = 'application/pdf'
     body binary $Doc/Contents
     timeout 300
     returns response;
 
 -- GET with URL template parameters
-$response = rest call get 'https://api.example.com/users/{1}' with (
+$response = call rest service get 'https://api.example.com/users/{1}' with (
     {1} = toString($UserId)
 )
     header Accept = 'application/json'
     returns string;
 
 -- With basic authentication
-$response = rest call get 'https://api.example.com/secure'
+$response = call rest service get 'https://api.example.com/secure'
     header Accept = 'application/json'
     auth basic $username password $password
     timeout 30
     returns string;
 
 -- DELETE (no response)
-rest call delete 'https://api.example.com/items/{1}' with (
+call rest service delete 'https://api.example.com/items/{1}' with (
     {1} = $ItemId
 )
     returns nothing
@@ -200,7 +200,7 @@ create persistent entity MyModule.MyFile extends System.FileDocument ();
 
 create microflow MyModule.ACT_Download ($Location: String)
 begin
-  $file = rest call get '{1}' with ({1} = $Location)
+  $file = call rest service get '{1}' with ({1} = $Location)
     header 'Accept' = 'application/octet-stream'
     timeout 300
     returns MyModule.MyFile;
diff --git a/cmd/mxcli/syntax/features_integration.go b/cmd/mxcli/syntax/features_integration.go
index e1a662c6ec..0d085a16ee 100644
--- a/cmd/mxcli/syntax/features_integration.go
+++ b/cmd/mxcli/syntax/features_integration.go
@@ -199,14 +199,14 @@ func init() {
 
 	Register(SyntaxFeature{
 		Path:    "rest.call",
-		Summary: "REST CALL activity inside a microflow, and its five RETURNS forms",
+		Summary: "CALL REST SERVICE activity inside a microflow, and its five RETURNS forms",
 		Keywords: []string{
 			"rest call", "call rest service", "http get", "http post",
 			"returns response", "returns string", "returns mapping",
 			"file document", "filedocument", "download", "httpresponse",
 			"body binary", "binary", "upload", "post binary",
 		},
-		Syntax: "[$Var =] REST CALL GET|POST|PUT|PATCH|DELETE '<url>' [WITH ({1} = expr, ...)]\n" +
+		Syntax: "[$Var =] CALL REST SERVICE GET|POST|PUT|PATCH|DELETE '<url>' [WITH ({1} = expr, ...)]\n" +
 			"  [HEADER 'Name' = expr]\n" +
 			"  [AUTH BASIC $user PASSWORD $pass]\n" +
 			"  [BODY '<template>' [WITH ({1} = expr)] | BODY <expr> | BODY BINARY <expr>\n" +
@@ -227,7 +227,7 @@ func init() {
 		Example: "create persistent entity MyModule.MyFile extends System.FileDocument ();\n\n" +
 			"create microflow MyModule.ACT_Download ($Location: String)\n" +
 			"begin\n" +
-			"  $file = rest call get '{1}' with ({1} = $Location)\n" +
+			"  $file = call rest service get '{1}' with ({1} = $Location)\n" +
 			"    header 'Accept' = 'application/octet-stream'\n" +
 			"    timeout 300\n" +
 			"    returns MyModule.MyFile;\n" +
@@ -299,7 +299,7 @@ func init() {
 			"body", "response", "mapping", "authentication",
 			"json structure", "import mapping", "export mapping",
 		},
-		Syntax:  "CREATE [OR MODIFY] CONSUMED REST SERVICE Module.Name (\n  BaseUrl: 'https://...',\n  Authentication: NONE | BASIC (...)\n)\n{\n  OPERATION Name {\n    Method: GET|POST|PUT|DELETE|PATCH,\n    Path: '/path/{param}',\n    Parameters: ($param: Type),\n    Query: ($param: Type),\n    Headers: ('Key' = 'Value'),\n    Timeout: 30,\n    Body: JSON FROM $var | MAPPING Entity { jsonField = Attribute, ... },\n    Response: JSON AS $var | MAPPING Entity { Attribute = jsonField, ... }\n  }\n};\n\n-- MAPPING takes a target ENTITY plus a body listing the JSON fields; Mendix\n-- stores it inline on the operation. An existing import/export mapping\n-- document cannot be referenced here (rejected as MDL-REST01).\n-- There is no FILE request body: Mendix's consumed operation stores one of\n-- Rest$JsonBody, Rest$StringBody or Rest$ImplicitMappingBody, so a file\n-- document has nowhere to go. `Body: FILE FROM $Doc` is rejected as\n-- MDL-REST02 rather than sent as the literal text \"$Doc\" (it used to be,\n-- returning 200 with a 4-byte payload). Binary POST lives on the\n-- microflow activity: `rest call post '<url>' body binary $Doc/Contents`.\n-- `Response: FILE AS $Doc` is unaffected — downloads work.",
+		Syntax:  "CREATE [OR MODIFY] CONSUMED REST SERVICE Module.Name (\n  BaseUrl: 'https://...',\n  Authentication: NONE | BASIC (...)\n)\n{\n  OPERATION Name {\n    Method: GET|POST|PUT|DELETE|PATCH,\n    Path: '/path/{param}',\n    Parameters: ($param: Type),\n    Query: ($param: Type),\n    Headers: ('Key' = 'Value'),\n    Timeout: 30,\n    Body: JSON FROM $var | MAPPING Entity { jsonField = Attribute, ... },\n    Response: JSON AS $var | MAPPING Entity { Attribute = jsonField, ... }\n  }\n};\n\n-- MAPPING takes a target ENTITY plus a body listing the JSON fields; Mendix\n-- stores it inline on the operation. An existing import/export mapping\n-- document cannot be referenced here (rejected as MDL-REST01).\n-- There is no FILE request body: Mendix's consumed operation stores one of\n-- Rest$JsonBody, Rest$StringBody or Rest$ImplicitMappingBody, so a file\n-- document has nowhere to go. `Body: FILE FROM $Doc` is rejected as\n-- MDL-REST02 rather than sent as the literal text \"$Doc\" (it used to be,\n-- returning 200 with a 4-byte payload). Binary POST lives on the\n-- microflow activity: `call rest service post '<url>' body binary $Doc/Contents`.\n-- `Response: FILE AS $Doc` is unaffected — downloads work.",
 		Example: "CREATE CONSUMED REST SERVICE Module.PetStore (\n  BaseUrl: 'https://petstore.example.com/api',\n  Authentication: NONE\n)\n{\n  OPERATION GetPet {\n    Method: GET,\n    Path: '/pets/{id}',\n    Parameters: ($id: String),\n    Query: ($verbose: String),\n    Response: MAPPING Module.Pet {\n      Name = name,\n      Status = status\n    }\n  }\n};",
 		SeeAlso: []string{"rest", "rest.published"},
 	})
diff --git a/cmd/mxcli/syntax/features_misc.go b/cmd/mxcli/syntax/features_misc.go
index 50f6410ae4..03d52067f3 100644
--- a/cmd/mxcli/syntax/features_misc.go
+++ b/cmd/mxcli/syntax/features_misc.go
@@ -238,7 +238,7 @@ DISCONNECT;`,
 			"show navigation", "describe navigation", "navigation menu",
 			"navigation homes", "list profiles",
 		},
-		Syntax:  "SHOW NAVIGATION;\nSHOW NAVIGATION MENU;\nSHOW NAVIGATION MENU <profile>;\nSHOW NAVIGATION HOMES;\nDESCRIBE NAVIGATION;\nDESCRIBE NAVIGATION <profile>;",
+		Syntax:  "SHOW NAVIGATION;\nSHOW NAVIGATION MENU;\nSHOW NAVIGATION MENU <profile>;\nLIST NAVIGATION HOMES;\nDESCRIBE NAVIGATION;\nDESCRIBE NAVIGATION <profile>;",
 		Example: "SHOW NAVIGATION;\nSHOW NAVIGATION MENU Responsive;\nDESCRIBE NAVIGATION Responsive;",
 	})
 
@@ -278,7 +278,7 @@ DISCONNECT;`,
 -- module roles called Administrator in three modules). A qualified name here
 -- gives a project Mendix cannot LOAD -- StorageLoadException "not a valid
 -- UserRoleIdentifier", raised before checking runs, so there is no error code
--- and no line number. List the real ones with SHOW USER ROLES.
+-- and no line number. List the real ones with LIST USER ROLES.
 --
 -- ICON is a qualified name into an ICON COLLECTION (Atlas_Core.Atlas,
 -- Atlas_Core.Atlas_Filled, Atlas_Core.Atlas_Styling, or your own) -- a model
@@ -369,8 +369,8 @@ CREATE OR REPLACE NAVIGATION TabletOffline
 			"settings", "project settings", "configuration",
 			"startup", "shutdown", "hash algorithm", "java version",
 		},
-		Syntax:  "SHOW SETTINGS;\nDESCRIBE SETTINGS;\nDESCRIBE SETTINGS CONFIGURATION '<name>';   -- just one configuration\nALTER SETTINGS RUNTIME <key> = <value>;   -- MODEL is a deprecated alias\nALTER SETTINGS CONFIGURATION '<name>' <key> = <value>;",
-		Example: "SHOW SETTINGS;\nALTER SETTINGS RUNTIME AfterStartupMicroflow = 'Module.MF_Startup';",
+		Syntax:  "DESCRIBE SETTINGS;\nDESCRIBE SETTINGS CONFIGURATION '<name>';   -- just one configuration\nALTER SETTINGS RUNTIME <key> = <value>;   -- MODEL is a deprecated alias\nALTER SETTINGS CONFIGURATION '<name>' <key> = <value>;",
+		Example: "DESCRIBE SETTINGS;\nALTER SETTINGS RUNTIME AfterStartupMicroflow = 'Module.MF_Startup';",
 		SeeAlso: []string{"settings.show", "settings.alter"},
 	})
 
@@ -445,8 +445,8 @@ create or modify translations in Administration for nl_NL (
 		Keywords: []string{
 			"show settings", "describe settings", "list settings",
 		},
-		Syntax:  "SHOW SETTINGS;\nDESCRIBE SETTINGS;\nDESCRIBE SETTINGS CONFIGURATION '<name>';",
-		Example: "SHOW SETTINGS;\nDESCRIBE SETTINGS;\nDESCRIBE SETTINGS CONFIGURATION 'Default';",
+		Syntax:  "DESCRIBE SETTINGS;\nDESCRIBE SETTINGS CONFIGURATION '<name>';",
+		Example: "DESCRIBE SETTINGS;\nDESCRIBE SETTINGS CONFIGURATION 'Default';",
 	})
 
 	Register(SyntaxFeature{
@@ -468,11 +468,11 @@ ALTER SETTINGS LANGUAGE DefaultLanguageCode = '<code>';
 ALTER SETTINGS LANGUAGE ADD '<code>' [(CheckCompleteness: true, CustomDateFormat: '<fmt>')];
 ALTER SETTINGS LANGUAGE ADD OR MODIFY '<code>' [(...)];
 ALTER SETTINGS LANGUAGE MODIFY '<code>' (CheckCompleteness: true, ...);
-ALTER SETTINGS LANGUAGE REMOVE '<code>';
+ALTER SETTINGS LANGUAGE DROP '<code>';
 ALTER SETTINGS WORKFLOWS UserEntity = '<qualifiedName>';
 ALTER SETTINGS WORKFLOWS ADD [OR MODIFY] GROUP '<name>' [(Description: '<text>')];
 ALTER SETTINGS WORKFLOWS MODIFY GROUP '<name>' (Description: '<text>');
-ALTER SETTINGS WORKFLOWS REMOVE GROUP '<name>';
+ALTER SETTINGS WORKFLOWS DROP GROUP '<name>';
 CREATE [OR MODIFY] CONFIGURATION '<name>' [<key> = <value>, ...];
 DROP CONFIGURATION '<name>';`,
 		Example: `ALTER SETTINGS RUNTIME AfterStartupMicroflow = 'Module.MF_Startup';
@@ -495,7 +495,7 @@ CREATE CONFIGURATION 'Production'
 ALTER SETTINGS LANGUAGE ADD 'de_DE';
 ALTER SETTINGS LANGUAGE ADD 'ar_SD' (CheckCompleteness: true);
 ALTER SETTINGS LANGUAGE MODIFY 'ar_SD' (CustomDateFormat: 'yyyy-MM-dd');
-ALTER SETTINGS LANGUAGE REMOVE 'de_DE';
+ALTER SETTINGS LANGUAGE DROP 'de_DE';
 
 -- ADD OR MODIFY is the upsert, and what DESCRIBE emits: it enables a language
 -- that is not there and changes one that is, so a described project replays onto
@@ -531,7 +531,7 @@ ALTER SETTINGS LANGUAGE REMOVE 'de_DE';
 ALTER SETTINGS WORKFLOWS ADD GROUP 'Approvers' (Description: 'Primary approval group');
 ALTER SETTINGS WORKFLOWS ADD GROUP 'Reviewers';
 ALTER SETTINGS WORKFLOWS MODIFY GROUP 'Reviewers' (Description: 'Second-line review');
-ALTER SETTINGS WORKFLOWS REMOVE GROUP 'Reviewers';
+ALTER SETTINGS WORKFLOWS DROP GROUP 'Reviewers';
 SHOW WORKFLOW GROUPS;
 
 -- Description is the ONLY option: a Settings$WorkflowGroup stores Name and
@@ -827,26 +827,26 @@ DROP SCHEDULED EVENT Ops.HourlyPing;`,
 
 	Register(SyntaxFeature{
 		Path:    "structure",
-		Summary: "SHOW STRUCTURE — compact project overview at configurable depth",
+		Summary: "DESCRIBE STRUCTURE — compact project overview at configurable depth",
 		Keywords: []string{
-			"structure", "show structure", "project overview",
+			"structure", "describe structure", "project overview",
 			"repo map", "module summary", "depth",
 		},
-		Syntax: "SHOW STRUCTURE [DEPTH 1|2|3] [IN <module>] [ALL];",
+		Syntax: "DESCRIBE STRUCTURE [DEPTH 1|2|3] [IN <module>] [ALL];",
 		Example: `-- Module counts only
-SHOW STRUCTURE DEPTH 1;
+DESCRIBE STRUCTURE DEPTH 1;
 
 -- Elements with signatures (default)
-SHOW STRUCTURE;
+DESCRIBE STRUCTURE;
 
 -- Full types and parameter names
-SHOW STRUCTURE DEPTH 3;
+DESCRIBE STRUCTURE DEPTH 3;
 
 -- Focus on one module
-SHOW STRUCTURE IN MyModule;
+DESCRIBE STRUCTURE IN MyModule;
 
 -- Include system modules
-SHOW STRUCTURE DEPTH 1 ALL;`,
+DESCRIBE STRUCTURE DEPTH 1 ALL;`,
 	})
 
 	// ── Move ────────────────────────────────────────────────────────────
@@ -935,7 +935,7 @@ LIST FOLDERS;
 mxcli -p app.mpr --json -c "LIST FOLDERS IN MyModule"
 
 -- Complements MOVE: MOVE places a document in a folder, LIST FOLDERS reads
--- the placement back. SHOW STRUCTURE is organised by document type at every
+-- the placement back. DESCRIBE STRUCTURE is organised by document type at every
 -- depth, so it never shows which folder a document sits in.
 --
 -- Empty folders are listed too (with [0]), and documents still at the module
diff --git a/cmd/mxcli/syntax/features_page.go b/cmd/mxcli/syntax/features_page.go
index 81e6b357bd..5dc3559284 100644
--- a/cmd/mxcli/syntax/features_page.go
+++ b/cmd/mxcli/syntax/features_page.go
@@ -31,15 +31,15 @@ func init() {
 
 	Register(SyntaxFeature{
 		Path:    "page.widget-describe",
-		Summary: "DESCRIBE WIDGET — a widget's properties, enum values and editor rules",
+		Summary: "DESCRIBE WIDGET TYPE — a widget's properties, enum values and editor rules",
 		Keywords: []string{
-			"describe widget", "widget properties", "widget definition", "what properties",
+			"describe widget type", "describe widget", "widget properties", "widget definition", "what properties",
 			"enum values", "widget rules", "hidden properties", "pluggable widget properties",
 		},
-		Syntax: `DESCRIBE WIDGET <keyword>;
-DESCRIBE WIDGET '<widget id>';`,
-		Example: `DESCRIBE WIDGET combobox;
-DESCRIBE WIDGET 'com.mendix.widget.web.htmlelement.HTMLElement';
+		Syntax: `DESCRIBE WIDGET TYPE <keyword>;
+DESCRIBE WIDGET TYPE '<widget id>';`,
+		Example: `DESCRIBE WIDGET TYPE combobox;
+DESCRIBE WIDGET TYPE 'com.mendix.widget.web.htmlelement.HTMLElement';
 
 -- Names the widget by its MDL keyword or its full widget id.
 --
@@ -82,7 +82,7 @@ SHOW IMPACT OF htmlelement;
 		Syntax: `<widget-mdl-name> <name> [( Prop: Value, ... )] [{ <containers and widgets> }]
 <container-name> <name> [( Prop: Value, ... )] [{ ... }]`,
 		Example: `-- Any widget with a definition is written by its own MDL name. There is no
--- list of blessed keywords: if ` + "`describe widget <name>`" + ` knows it, you can write it.
+-- list of blessed keywords: if ` + "`describe widget type <name>`" + ` knows it, you can write it.
 CREATE PAGE Sales.Detail (Title: 'Detail', Layout: Atlas_Core.Atlas_Default) {
   htmlelement frame (tagName: 'div') {
     -- object lists and child slots the widget's own definition declares
@@ -657,19 +657,19 @@ CREATE PAGE Sales.Detail (Title: 'Detail', Layout: Atlas_Core.Atlas_Default) {
 			"fragment", "fragments", "reusable widgets", "define fragment",
 			"use fragment", "template", "script scope",
 		},
-		Syntax:  "DEFINE FRAGMENT Name AS { <widgets> };\nDEFINE FRAGMENT Name AS { <widgets> SLOT [name] <widgets> };\nDEFINE FRAGMENT Name ($d: datasource, $a: action) AS { <widgets> };\nUSE FRAGMENT Name [(args)] [AS prefix_];\nUSE FRAGMENT Name [(args)] [AS prefix_] { <payload widgets> };\nSHOW FRAGMENTS;\nDESCRIBE FRAGMENT Name;\nDESCRIBE FRAGMENT FROM PAGE Module.Page WIDGET widgetName;",
-		Example: "DEFINE FRAGMENT SaveCancelFooter AS {\n  FOOTER footer1 {\n    ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE CHANGES, ButtonStyle: Primary)\n    ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL CHANGES)\n  }\n};\n\nCREATE PAGE Module.EditPage (Params: { $Param: Module.Customer }, Title: 'Edit', Layout: 'Atlas_Core.Atlas_Default') {\n  DATAVIEW dv (DataSource: $Param) {\n    TEXTBOX txtName (Label: 'Name', Attribute: Name)\n    USE FRAGMENT SaveCancelFooter\n  }\n};",
+		Syntax:  "CREATE FRAGMENT Name AS { <widgets> };\nCREATE FRAGMENT Name AS { <widgets> SLOT [name] <widgets> };\nCREATE FRAGMENT Name ($d: datasource, $a: action) AS { <widgets> };\nUSE FRAGMENT Name [(args)] [AS prefix_];\nUSE FRAGMENT Name [(args)] [AS prefix_] { <payload widgets> };\nSHOW FRAGMENTS;\nDESCRIBE FRAGMENT Name;\nDESCRIBE FRAGMENT FROM PAGE Module.Page WIDGET widgetName;",
+		Example: "CREATE FRAGMENT SaveCancelFooter AS {\n  FOOTER footer1 {\n    ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE CHANGES, ButtonStyle: Primary)\n    ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL CHANGES)\n  }\n};\n\nCREATE PAGE Module.EditPage (Params: { $Param: Module.Customer }, Title: 'Edit', Layout: 'Atlas_Core.Atlas_Default') {\n  DATAVIEW dv (DataSource: $Param) {\n    TEXTBOX txtName (Label: 'Name', Attribute: Name)\n    USE FRAGMENT SaveCancelFooter\n  }\n};",
 		SeeAlso: []string{"fragment.define", "fragment.use", "fragment.slot", "fragment.params", "snippet"},
 	})
 
 	Register(SyntaxFeature{
 		Path:    "fragment.define",
-		Summary: "DEFINE FRAGMENT — declare a reusable widget group for the script session",
+		Summary: "CREATE FRAGMENT — declare a reusable widget group for the script session",
 		Keywords: []string{
 			"define fragment", "declare fragment", "create fragment",
 		},
-		Syntax:  "DEFINE FRAGMENT Name AS {\n  <widgets>\n};",
-		Example: "DEFINE FRAGMENT FormFields AS {\n  TEXTBOX txtName (Label: 'Name', Attribute: Name)\n  TEXTBOX txtEmail (Label: 'Email', Attribute: Email)\n};",
+		Syntax:  "CREATE FRAGMENT Name AS {\n  <widgets>\n};",
+		Example: "CREATE FRAGMENT FormFields AS {\n  TEXTBOX txtName (Label: 'Name', Attribute: Name)\n  TEXTBOX txtEmail (Label: 'Email', Attribute: Email)\n};",
 		SeeAlso: []string{"fragment", "fragment.use"},
 	})
 
@@ -692,8 +692,8 @@ CREATE PAGE Sales.Detail (Title: 'Detail', Layout: Atlas_Core.Atlas_Default) {
 			"fragment parameter", "fragment param", "datasource param", "action param",
 			"binding", "rebind", "building block override", "reusable component",
 		},
-		Syntax:  "-- Declare typed params, reference with $name in a datasource/action slot:\nDEFINE FRAGMENT Name ($data: datasource, $onEdit: action) AS { … };\n-- Supply values at the use site:\nUSE FRAGMENT Name ($data: <datasource>, $onEdit: <action>) [{ payload }]\n-- Building blocks: rebind the outermost datasource / first button:\nUSE BUILDING BLOCK Module.Block (datasource: <ds>, action: <action>) [AS prefix_]",
-		Example: "DEFINE FRAGMENT DataPanel ($data: datasource, $onEdit: action) AS {\n  CONTAINER panel (Class: 'card') {\n    LISTVIEW lv (DataSource: $data) {\n      SLOT content\n      ACTIONBUTTON edit (Caption: 'Edit', Action: $onEdit, ButtonStyle: Primary)\n    }\n  }\n};\n\nCREATE PAGE Module.Orders (Title: 'Orders', Layout: Atlas_Core.Atlas_Default) {\n  USE FRAGMENT DataPanel ($data: DATABASE Sales.Order, $onEdit: MICROFLOW Sales.Edit) {\n    DYNAMICTEXT heading (Content: 'Orders', RenderMode: H4)\n  }\n};\n\n-- Rebind a building block's datasource and primary button:\nUSE BUILDING BLOCK Atlas_Web_Content.List_Cards (datasource: DATABASE Sales.Order, action: CALL MICROFLOW Sales.Open) AS orders_\n\n-- Notes:\n--   * Param kinds: datasource | action. Every declared param must be supplied.\n--   * A microflow value parses as a datasource and is reinterpreted for an action param.\n--   * BB binding-point rule: datasource → first datasource widget; action → first button.",
+		Syntax:  "-- Declare typed params, reference with $name in a datasource/action slot:\nCREATE FRAGMENT Name ($data: datasource, $onEdit: action) AS { … };\n-- Supply values at the use site:\nUSE FRAGMENT Name ($data: <datasource>, $onEdit: <action>) [{ payload }]\n-- Building blocks: rebind the outermost datasource / first button:\nUSE BUILDING BLOCK Module.Block (datasource: <ds>, action: <action>) [AS prefix_]",
+		Example: "CREATE FRAGMENT DataPanel ($data: datasource, $onEdit: action) AS {\n  CONTAINER panel (Class: 'card') {\n    LISTVIEW lv (DataSource: $data) {\n      SLOT content\n      ACTIONBUTTON edit (Caption: 'Edit', Action: $onEdit, ButtonStyle: Primary)\n    }\n  }\n};\n\nCREATE PAGE Module.Orders (Title: 'Orders', Layout: Atlas_Core.Atlas_Default) {\n  USE FRAGMENT DataPanel ($data: DATABASE Sales.Order, $onEdit: MICROFLOW Sales.Edit) {\n    DYNAMICTEXT heading (Content: 'Orders', RenderMode: H4)\n  }\n};\n\n-- Rebind a building block's datasource and primary button:\nUSE BUILDING BLOCK Atlas_Web_Content.List_Cards (datasource: DATABASE Sales.Order, action: CALL MICROFLOW Sales.Open) AS orders_\n\n-- Notes:\n--   * Param kinds: datasource | action. Every declared param must be supplied.\n--   * A microflow value parses as a datasource and is reinterpreted for an action param.\n--   * BB binding-point rule: datasource → first datasource widget; action → first button.",
 		SeeAlso: []string{"fragment", "fragment.slot", "fragment.use"},
 	})
 
@@ -704,8 +704,8 @@ CREATE PAGE Sales.Detail (Title: 'Detail', Layout: Atlas_Core.Atlas_Default) {
 			"slot", "content slot", "fragment slot", "wrap content",
 			"card wrapper", "reusable shell", "use fragment payload",
 		},
-		Syntax:  "-- In the definition, mark where caller content lands:\nDEFINE FRAGMENT Name AS { <wrapper> SLOT [name] <wrapper> };\n-- At the use site, supply the payload in a brace block:\nUSE FRAGMENT Name [AS prefix_] { <payload widgets> }",
-		Example: "DEFINE FRAGMENT Card AS {\n  CONTAINER cardWrap (Class: 'card', DesignProperties: ['Card style': on]) {\n    CONTAINER cardBody (Class: 'card-body') {\n      SLOT content\n    }\n  }\n};\n\nCREATE PAGE Module.Dashboard (Title: 'Dashboard', Layout: Atlas_Core.Atlas_Default) {\n  USE FRAGMENT Card {\n    DYNAMICTEXT cardHeading (Content: 'Welcome', RenderMode: H2)\n    DYNAMICTEXT cardText (Content: 'Any widgets can go inside the reusable Card shell')\n  }\n};\n\n-- Notes:\n--   * Slot name is optional (defaults to 'content'); one slot per fragment.\n--   * USE FRAGMENT with no payload leaves the slot empty (valid).\n--   * Supplying a payload to a slotless fragment is an error.",
+		Syntax:  "-- In the definition, mark where caller content lands:\nCREATE FRAGMENT Name AS { <wrapper> SLOT [name] <wrapper> };\n-- At the use site, supply the payload in a brace block:\nUSE FRAGMENT Name [AS prefix_] { <payload widgets> }",
+		Example: "CREATE FRAGMENT Card AS {\n  CONTAINER cardWrap (Class: 'card', DesignProperties: ['Card style': on]) {\n    CONTAINER cardBody (Class: 'card-body') {\n      SLOT content\n    }\n  }\n};\n\nCREATE PAGE Module.Dashboard (Title: 'Dashboard', Layout: Atlas_Core.Atlas_Default) {\n  USE FRAGMENT Card {\n    DYNAMICTEXT cardHeading (Content: 'Welcome', RenderMode: H2)\n    DYNAMICTEXT cardText (Content: 'Any widgets can go inside the reusable Card shell')\n  }\n};\n\n-- Notes:\n--   * Slot name is optional (defaults to 'content'); one slot per fragment.\n--   * USE FRAGMENT with no payload leaves the slot empty (valid).\n--   * Supplying a payload to a slotless fragment is an error.",
 		SeeAlso: []string{"fragment", "fragment.define", "fragment.use"},
 	})
 
diff --git a/cmd/mxcli/syntax/features_security.go b/cmd/mxcli/syntax/features_security.go
index 0008f1c306..375bed7c4d 100644
--- a/cmd/mxcli/syntax/features_security.go
+++ b/cmd/mxcli/syntax/features_security.go
@@ -10,8 +10,8 @@ func init() {
 			"security", "access control", "roles", "permissions",
 			"grant", "revoke", "authentication", "authorization",
 		},
-		Syntax:  "SHOW PROJECT SECURITY;\nSHOW MODULE ROLES [IN <module>];\nSHOW USER ROLES;\nSHOW SECURITY MATRIX [IN <module>];",
-		Example: "SHOW PROJECT SECURITY;\nSHOW SECURITY MATRIX IN Shop;",
+		Syntax:  "DESCRIBE APP SECURITY;\nLIST MODULE ROLES [IN <module>];\nLIST USER ROLES;\nDESCRIBE SECURITY MATRIX [IN <module>];",
+		Example: "DESCRIBE APP SECURITY;\nDESCRIBE SECURITY MATRIX IN Shop;",
 		SeeAlso: []string{"security.module-role", "security.entity-access", "security.user-role"},
 	})
 
@@ -129,7 +129,7 @@ func init() {
 			"user role", "application role", "manage roles",
 			"add module roles", "remove module roles",
 		},
-		Syntax:  "CREATE USER ROLE <name> (<role> [, ...]) [MANAGE ALL ROLES];\nALTER USER ROLE <name> ADD MODULE ROLES (<role> [, ...]);\nALTER USER ROLE <name> REMOVE MODULE ROLES (<role> [, ...]);\nDROP USER ROLE [IF EXISTS] <name>;",
+		Syntax:  "CREATE USER ROLE <name> (<role> [, ...]) [MANAGE ALL ROLES];\nALTER USER ROLE <name> ADD MODULE ROLES (<role> [, ...]);\nALTER USER ROLE <name> DROP MODULE ROLES (<role> [, ...]);\nDROP USER ROLE [IF EXISTS] <name>;",
 		Example: "CREATE USER ROLE AppAdmin (Shop.Admin, HR.Admin) MANAGE ALL ROLES;\nALTER USER ROLE AppAdmin ADD MODULE ROLES (Reporting.Viewer);",
 		SeeAlso: []string{"security.module-role", "security.demo-user"},
 	})
diff --git a/cmd/mxcli/syntax/retired_spellings_test.go b/cmd/mxcli/syntax/retired_spellings_test.go
index 514f2ce4e3..a251eb42df 100644
--- a/cmd/mxcli/syntax/retired_spellings_test.go
+++ b/cmd/mxcli/syntax/retired_spellings_test.go
@@ -40,3 +40,30 @@ func TestSyntaxDocs_NoRetiredSpellings(t *testing.T) {
 		}
 	}
 }
+
+// R6 (ako/mxcli#755): the old verbs still parse as deprecated aliases, but the
+// reference an agent reads shows only the canonical ones. Case-insensitive,
+// because the entries mix the two cases.
+func TestSyntaxDocs_NoR6DeprecatedVerbs(t *testing.T) {
+	deprecated := map[string]string{
+		"rest call ":            "call rest service (MDL-DEPR094)",
+		"define fragment":       "create fragment (MDL-DEPR096)",
+		"remove module roles":   "drop module roles (MDL-DEPR091)",
+		"show project security": "describe app security (MDL-DEPR090)",
+		"show security matrix":  "describe security matrix (MDL-DEPR090)",
+		"show structure":        "describe structure (MDL-DEPR090)",
+		"show context of":       "describe context of (MDL-DEPR090)",
+		"language remove '":     "language drop (MDL-DEPR092)",
+		"remove group '":        "drop group (MDL-DEPR092)",
+	}
+	for _, f := range All() {
+		for field, text := range map[string]string{"Syntax": f.Syntax, "Example": f.Example} {
+			low := strings.ToLower(text)
+			for old, canonical := range deprecated {
+				if strings.Contains(low, old) {
+					t.Errorf("syntax topic %q, %s field, shows %q — write %s", f.Path, field, old, canonical)
+				}
+			}
+		}
+	}
+}
diff --git a/docs-site/src/SUMMARY.md b/docs-site/src/SUMMARY.md
index 7d31ab83d5..b76b4ea65f 100644
--- a/docs-site/src/SUMMARY.md
+++ b/docs-site/src/SUMMARY.md
@@ -21,7 +21,7 @@
 - [Exploring a Project](tutorial/exploring.md)
   - [SHOW MODULES, SHOW ENTITIES](tutorial/show-commands.md)
   - [DESCRIBE, SEARCH](tutorial/describe-search.md)
-  - [SHOW STRUCTURE](tutorial/show-structure.md)
+  - [DESCRIBE STRUCTURE](tutorial/show-structure.md)
 - [Your First Changes](tutorial/first-changes.md)
   - [Creating an Entity](tutorial/create-entity.md)
   - [Creating a Microflow](tutorial/create-microflow.md)
@@ -223,7 +223,7 @@
   - [SHOW WORKFLOWS](reference/query/show-workflows.md)
   - [SHOW BUSINESS EVENTS](reference/query/show-business-events.md)
   - [SHOW IMAGE COLLECTION](reference/query/show-image-collection.md)
-  - [SHOW STRUCTURE](reference/query/show-structure.md)
+  - [DESCRIBE STRUCTURE](reference/query/show-structure.md)
   - [SHOW WIDGETS](reference/query/show-widgets.md)
   - [DESCRIBE ENTITY](reference/query/describe-entity.md)
   - [DESCRIBE MICROFLOW / NANOFLOW](reference/query/describe-microflow.md)
diff --git a/docs-site/src/appendixes/error-messages.md b/docs-site/src/appendixes/error-messages.md
index c4dfbb4acc..ecb4457ba6 100644
--- a/docs-site/src/appendixes/error-messages.md
+++ b/docs-site/src/appendixes/error-messages.md
@@ -100,7 +100,7 @@ page MyModule.OrderList: widget `cb1` (combobox) has no property
 **Cause:** The property key written on a pluggable widget is not declared in the widget's `.def.json` (the extracted schema from its `.mpk`). Usually a typo; sometimes a property that exists in a different widget but not this one.
 
 **Solution:**
-1. Compare the key against the widget's known properties — `mxcli widget describe <name>` lists them (or `describe widget <name>;` in MDL).
+1. Compare the key against the widget's known properties — `mxcli widget describe <name>` lists them (or `describe widget type <name>;` in MDL).
 2. Use the suggested replacement if one is offered (Levenshtein-nearest match).
 3. If the property genuinely doesn't exist on this widget version, check that `.mxcli/widgets/` has the latest schema: `mxcli refresh catalog -p app.mpr` re-extracts any `.mpk` whose mtime changed.
 4. If the property was just added by a `.mpk` upgrade, make sure `mxcli init` or `widget init` was run after the upgrade.
diff --git a/docs-site/src/appendixes/quick-reference.md b/docs-site/src/appendixes/quick-reference.md
index 9ced9a4d4a..032cb1ef95 100644
--- a/docs-site/src/appendixes/quick-reference.md
+++ b/docs-site/src/appendixes/quick-reference.md
@@ -204,16 +204,16 @@ Nested folders use `/` separator: `'Parent/Child/Grandchild'`. Missing folders a
 
 | Statement | Syntax | Notes |
 |-----------|--------|-------|
-| List project security | `LIST PROJECT SECURITY;` | Displays security level, admin, demo users |
+| Describe app security | `DESCRIBE APP SECURITY;` | Displays security level, admin, demo users |
 | List module roles | `LIST MODULE ROLES [IN Module];` | All roles or filtered by module |
 | List user roles | `LIST USER ROLES;` | Project-level user roles |
 | List demo users | `LIST DEMO USERS;` | Configured demo users |
 | List access on element | `LIST ACCESS ON [ENTITY\|MICROFLOW\|PAGE\|NANOFLOW] Mod.Name;` | Which roles can access; a bare name means the entity |
-| List security matrix | `LIST SECURITY MATRIX [IN Module];` | Full access overview |
+| Describe security matrix | `DESCRIBE SECURITY MATRIX [IN Module];` | Full access overview |
 | Create module role | `CREATE MODULE ROLE Mod.Role [DESCRIPTION 'text'];` | |
 | Drop module role | `DROP MODULE ROLE Mod.Role;` | |
 | Create user role | `CREATE USER ROLE Name (Mod.Role, ...) [MANAGE ALL ROLES];` | Aggregates module roles |
-| Alter user role | `ALTER USER ROLE Name ADD\|REMOVE MODULE ROLES (Mod.Role, ...);` | |
+| Alter user role | `ALTER USER ROLE Name ADD\|DROP MODULE ROLES (Mod.Role, ...);` | |
 | Drop user role | `DROP USER ROLE [IF EXISTS] Name;` | `IF EXISTS` makes a cleanup script re-runnable |
 | Grant microflow access | `GRANT EXECUTE ON MICROFLOW Mod.MF TO Mod.Role, ...;` | |
 | Revoke microflow access | `REVOKE EXECUTE ON MICROFLOW Mod.MF FROM Mod.Role, ...;` | |
@@ -263,11 +263,11 @@ END WORKFLOW;
 
 | Statement | Syntax | Notes |
 |-----------|--------|-------|
-| Structure overview | `LIST STRUCTURE;` | Depth 2 (elements with signatures), user modules only |
-| Module counts | `LIST STRUCTURE DEPTH 1;` | One line per module with element counts |
-| Full types | `LIST STRUCTURE DEPTH 3;` | Typed attributes, named parameters |
-| Filter by module | `LIST STRUCTURE IN ModuleName;` | Single module only |
-| Include all modules | `LIST STRUCTURE DEPTH 1 ALL;` | Include system/marketplace modules |
+| Structure overview | `DESCRIBE STRUCTURE;` | Depth 2 (elements with signatures), user modules only |
+| Module counts | `DESCRIBE STRUCTURE DEPTH 1;` | One line per module with element counts |
+| Full types | `DESCRIBE STRUCTURE DEPTH 3;` | Typed attributes, named parameters |
+| Filter by module | `DESCRIBE STRUCTURE IN ModuleName;` | Single module only |
+| Include all modules | `DESCRIBE STRUCTURE DEPTH 1 ALL;` | Include system/marketplace modules |
 
 ## Navigation
 
@@ -298,7 +298,7 @@ CREATE OR REPLACE NAVIGATION Responsive
 
 | Statement | Syntax | Notes |
 |-----------|--------|-------|
-| List settings | `LIST SETTINGS;` | Overview of all settings parts |
+| Describe settings | `DESCRIBE SETTINGS;` | All settings parts, as MDL |
 | Describe settings | `DESCRIBE SETTINGS;` | Full MDL output (round-trippable) |
 | Alter model settings | `ALTER SETTINGS RUNTIME Key = Value;` | AfterStartupMicroflow, HashAlgorithm, JavaVersion, etc. |
 | Alter configuration | `ALTER SETTINGS CONFIGURATION 'Name' Key = Value;` | DatabaseType, DatabaseUrl, HttpPortNumber, etc. |
@@ -514,7 +514,7 @@ CLI subcommand: `mxcli sql --driver postgres --dsn '...' "SELECT 1"` (see `mxcli
 | List callees | `LIST CALLEES OF Module.Name;` | What this element calls |
 | List references | `LIST REFERENCES OF Module.Name;` | All references to/from |
 | List impact | `LIST IMPACT OF Module.Name;` | Impact analysis |
-| List context | `LIST CONTEXT OF Module.Name;` | Surrounding context |
+| Describe context | `DESCRIBE CONTEXT OF Module.Name;` | Surrounding context |
 | Full-text search | `SEARCH '<keyword>';` | Search across all strings and source |
 
 Cross-reference commands require `REFRESH CATALOG FULL` to populate reference data.
diff --git a/docs-site/src/examples/rest-integration.md b/docs-site/src/examples/rest-integration.md
index 80eaee30cc..6fa22b1192 100644
--- a/docs-site/src/examples/rest-integration.md
+++ b/docs-site/src/examples/rest-integration.md
@@ -8,7 +8,7 @@ Calling external APIs from microflows -- GET, POST, authentication, and error ha
 CREATE MICROFLOW Integration.FetchWebpage ()
 RETURNS String AS $Content
 BEGIN
-  $Content = REST CALL GET 'https://example.com/api/status'
+  $Content = CALL REST SERVICE GET 'https://example.com/api/status'
     HEADER Accept = 'application/json'
     TIMEOUT 30
     RETURNS String;
@@ -26,7 +26,7 @@ CREATE MICROFLOW Integration.SearchProducts (
 )
 RETURNS String AS $Response
 BEGIN
-  $Response = REST CALL GET 'https://api.example.com/search?q={1}&page={2}' WITH (
+  $Response = CALL REST SERVICE GET 'https://api.example.com/search?q={1}&page={2}' WITH (
     {1} = urlEncode($Query),
     {2} = toString($Page)
   )
@@ -47,7 +47,7 @@ CREATE MICROFLOW Integration.CreateCustomer (
 )
 RETURNS String AS $Response
 BEGIN
-  $Response = REST CALL POST 'https://api.example.com/customers'
+  $Response = CALL REST SERVICE POST 'https://api.example.com/customers'
     HEADER 'Content-Type' = 'application/json'
     BODY '{{"name": "{1}", "email": "{2}"}' WITH (
       {1} = $Name,
@@ -73,7 +73,7 @@ CREATE MICROFLOW Integration.UploadDocument (
 RETURNS Boolean AS $Ok
 BEGIN
   DECLARE $Ok Boolean = false;
-  $Response = REST CALL POST 'https://api.example.com/documents'
+  $Response = CALL REST SERVICE POST 'https://api.example.com/documents'
     HEADER 'ContentType' = 'application/pdf'
     BODY BINARY $Doc/Contents
     TIMEOUT 300
@@ -104,7 +104,7 @@ CREATE MICROFLOW Integration.FetchSecureData (
 )
 RETURNS String AS $Response
 BEGIN
-  $Response = REST CALL GET 'https://api.example.com/secure/data'
+  $Response = CALL REST SERVICE GET 'https://api.example.com/secure/data'
     HEADER Accept = 'application/json'
     AUTH BASIC $Username PASSWORD $Password
     TIMEOUT 30
@@ -126,7 +126,7 @@ RETURNS Boolean AS $Success
 BEGIN
   DECLARE $Success Boolean = false;
 
-  $Response = REST CALL GET $Url
+  $Response = CALL REST SERVICE GET $Url
     HEADER Accept = 'application/json'
     TIMEOUT 30
     RETURNS String
diff --git a/docs-site/src/ide/vscode-project-tree.md b/docs-site/src/ide/vscode-project-tree.md
index b313771fb1..74bd8568bc 100644
--- a/docs-site/src/ide/vscode-project-tree.md
+++ b/docs-site/src/ide/vscode-project-tree.md
@@ -61,4 +61,4 @@ The tree is backed by the same metadata that powers the `SHOW` commands:
 | Entities in a module | `SHOW ENTITIES IN MyModule` |
 | Microflows in a module | `SHOW MICROFLOWS IN MyModule` |
 | Pages in a module | `SHOW PAGES IN MyModule` |
-| Full structure | `SHOW STRUCTURE IN MyModule DEPTH 2` |
+| Full structure | `DESCRIBE STRUCTURE IN MyModule DEPTH 2` |
diff --git a/docs-site/src/internals/reference-tracking.md b/docs-site/src/internals/reference-tracking.md
index f1088fba24..0f738ab815 100644
--- a/docs-site/src/internals/reference-tracking.md
+++ b/docs-site/src/internals/reference-tracking.md
@@ -74,7 +74,7 @@ Returns all direct and transitive dependents -- everything that would potentiall
 Assemble context for understanding a document:
 
 ```sql
-SHOW CONTEXT OF Sales.ProcessOrder DEPTH 3;
+DESCRIBE CONTEXT OF Sales.ProcessOrder DEPTH 3;
 ```
 
 Returns the element itself plus its callers and callees up to the specified depth, providing a focused view of the element's neighborhood in the dependency graph.
diff --git a/docs-site/src/language/basics.md b/docs-site/src/language/basics.md
index e109b8f5db..24db6ce4e2 100644
--- a/docs-site/src/language/basics.md
+++ b/docs-site/src/language/basics.md
@@ -52,6 +52,21 @@ Each keyword has one spelling, and a page action uses the words a microflow uses
 | `type ReferenceSet` | `type reference_set` | `MDL-DEPR023` |
 | `returns nothing` (REST call) | `returns none` | `MDL-DEPR024` |
 
+## One Verb per Job
+
+`list` enumerates, `describe` shows one thing, and an `alter` adds and drops its children. The older verbs still parse with the same meaning and warn with the code shown; `mxcli fmt --upgrade` rewrites them, except where noted:
+
+| Canonical | Deprecated | Code |
+|---|---|---|
+| `describe page M.P`, `describe app security`, `describe security matrix [in M]`, `describe structure …`, `describe context of X` | `show` (or `list`) with the same words; `show project security` | `MDL-DEPR090` |
+| `describe entity X`, `describe association X`, `describe navigation`, `describe settings` | `show entity X`, `show association X`, `show navigation [menu]`, `show settings` — these print a summary where `describe` prints the definition as MDL, so `fmt --upgrade` reports them and leaves them in place | `MDL-DEPR090` |
+| `alter user role R drop module roles (…)` | `… remove module roles (…)` | `MDL-DEPR091` |
+| `alter settings language drop '…'`, `alter settings workflows drop group '…'` | `remove` | `MDL-DEPR092` |
+| `alter entity E add\|rename\|modify\|drop attribute …` | `… column …` | `MDL-DEPR093` |
+| `call rest service get '…' …` | `rest call get '…' …` | `MDL-DEPR094` |
+| `describe widget type combobox` | `describe widget combobox` | `MDL-DEPR095` |
+| `create fragment F as { … }` | `define fragment F as { … }` | `MDL-DEPR096` |
+
 ## Language Version Header
 
 A script may start with a header that names the MDL language version it is written in:
diff --git a/docs-site/src/language/entity-access.md b/docs-site/src/language/entity-access.md
index 36983d2518..4ae6dc8258 100644
--- a/docs-site/src/language/entity-access.md
+++ b/docs-site/src/language/entity-access.md
@@ -176,7 +176,7 @@ SHOW ACCESS ON ENTITY Shop.Customer;
 SHOW ACCESS ON Shop.Customer;
 
 -- Full matrix across a module
-SHOW SECURITY MATRIX IN Shop;
+DESCRIBE SECURITY MATRIX IN Shop;
 ```
 
 ## See Also
diff --git a/docs-site/src/language/project-settings.md b/docs-site/src/language/project-settings.md
index 661230d847..0f54c496f5 100644
--- a/docs-site/src/language/project-settings.md
+++ b/docs-site/src/language/project-settings.md
@@ -78,7 +78,7 @@ the step that makes translating an app do anything.
 ALTER SETTINGS LANGUAGE <Key> = <Value>;
 ALTER SETTINGS LANGUAGE ADD [OR MODIFY] '<code>' [( <option>: <value>, ... )];
 ALTER SETTINGS LANGUAGE MODIFY '<code>' ( <option>: <value>, ... );
-ALTER SETTINGS LANGUAGE REMOVE '<code>';
+ALTER SETTINGS LANGUAGE DROP '<code>';
 ```
 
 ```sql
@@ -95,7 +95,7 @@ ALTER SETTINGS LANGUAGE MODIFY 'de_DE' (CheckCompleteness: true);
 ALTER SETTINGS LANGUAGE DefaultLanguageCode = 'de_DE';
 
 -- disable it
-ALTER SETTINGS LANGUAGE REMOVE 'de_DE';
+ALTER SETTINGS LANGUAGE DROP 'de_DE';
 ```
 
 A language is identified by its **code** alone — Studio Pro's "Arabic, Sudan" is
diff --git a/docs-site/src/language/roles.md b/docs-site/src/language/roles.md
index 28ad06b90d..ae7bffb86e 100644
--- a/docs-site/src/language/roles.md
+++ b/docs-site/src/language/roles.md
@@ -60,11 +60,11 @@ CREATE USER ROLE AppViewer (Shop.Viewer);
 
 ### ALTER USER ROLE
 
-Add or remove module roles from an existing user role:
+Add or drop module roles from an existing user role:
 
 ```sql
 ALTER USER ROLE AppAdmin ADD MODULE ROLES (Reporting.Admin);
-ALTER USER ROLE AppUser REMOVE MODULE ROLES (Shop.Viewer);
+ALTER USER ROLE AppUser DROP MODULE ROLES (Shop.Viewer);
 ```
 
 ### DROP USER ROLE
diff --git a/docs-site/src/language/security.md b/docs-site/src/language/security.md
index 98f24f47cf..1e657b61b8 100644
--- a/docs-site/src/language/security.md
+++ b/docs-site/src/language/security.md
@@ -32,7 +32,7 @@ MDL provides several commands for viewing the current security configuration:
 
 ```sql
 -- Project-wide settings
-SHOW PROJECT SECURITY;
+DESCRIBE APP SECURITY;
 
 -- Roles
 SHOW MODULE ROLES;
@@ -46,8 +46,8 @@ SHOW ACCESS ON ENTITY Shop.Customer;
 SHOW ACCESS ON Shop.Customer;         -- a bare name means the entity
 
 -- Full matrix
-SHOW SECURITY MATRIX;
-SHOW SECURITY MATRIX IN Shop;
+DESCRIBE SECURITY MATRIX;
+DESCRIBE SECURITY MATRIX IN Shop;
 
 -- Demo users
 SHOW DEMO USERS;
diff --git a/docs-site/src/language/widget-types.md b/docs-site/src/language/widget-types.md
index d503360e8c..13f4c41556 100644
--- a/docs-site/src/language/widget-types.md
+++ b/docs-site/src/language/widget-types.md
@@ -484,7 +484,7 @@ list in mxcli:
 Ask the widget:
 
 ```sql
-DESCRIBE WIDGET htmlelement;
+DESCRIBE WIDGET TYPE htmlelement;
 ```
 
 It lists every property with its type, default and enumeration members, every
diff --git a/docs-site/src/migration/validation.md b/docs-site/src/migration/validation.md
index efeddfae87..91e46a8213 100644
--- a/docs-site/src/migration/validation.md
+++ b/docs-site/src/migration/validation.md
@@ -95,7 +95,7 @@ mxcli docker check -p app.mpr          # No compiler errors
 mxcli lint -p app.mpr                  # No critical lint issues
 mxcli report -p app.mpr               # Review quality scores
 mxcli test tests/ -p app.mpr          # All tests pass
-mxcli -p app.mpr -c "SHOW STRUCTURE DEPTH 2"  # Review structure
+mxcli -p app.mpr -c "DESCRIBE STRUCTURE DEPTH 2"  # Review structure
 ```
 
 ## Iterative Workflow
diff --git a/docs-site/src/preface/mendix-concepts.md b/docs-site/src/preface/mendix-concepts.md
index ef6e25a607..62a6367791 100644
--- a/docs-site/src/preface/mendix-concepts.md
+++ b/docs-site/src/preface/mendix-concepts.md
@@ -205,7 +205,7 @@ Project
 In mxcli, you can explore this structure with:
 
 ```sql
-SHOW STRUCTURE DEPTH 2;
+DESCRIBE STRUCTURE DEPTH 2;
 ```
 
 ## What's Next
diff --git a/docs-site/src/reference/capabilities.md b/docs-site/src/reference/capabilities.md
index 140e3ecbe1..063d7038fa 100644
--- a/docs-site/src/reference/capabilities.md
+++ b/docs-site/src/reference/capabilities.md
@@ -16,11 +16,11 @@ Everything mxcli can do, organized by use case.
 | List nanoflows | `LIST NANOFLOWS [IN Module]` | |
 | List layouts | `LIST LAYOUTS [IN Module]` | |
 | List snippets | `LIST SNIPPETS [IN Module]` | |
-| Compact overview | `LIST STRUCTURE [DEPTH 1\|2\|3]` | Tree view of entire project |
+| Compact overview | `DESCRIBE STRUCTURE [DEPTH 1\|2\|3]` | Tree view of entire project |
 | Describe any document | `DESCRIBE ENTITY\|MICROFLOW\|PAGE ...` | Full MDL output (re-executable) |
 | Full-text search | `SEARCH 'keyword'` | Across all strings and source |
 | Show languages | `LIST LANGUAGES` | All languages in the project |
-| Show project security | `LIST PROJECT SECURITY` | Security overview |
+| Describe app security | `DESCRIBE APP SECURITY` | Security overview |
 | Show access rules | `LIST ACCESS ON [ENTITY] Module.Name` | Entity/microflow/page/nanoflow access |
 | Show settings | `LIST SETTINGS` | Project-level settings |
 
diff --git a/docs-site/src/reference/catalog/show-references-impact.md b/docs-site/src/reference/catalog/show-references-impact.md
index 501dcdc352..29bb586b04 100644
--- a/docs-site/src/reference/catalog/show-references-impact.md
+++ b/docs-site/src/reference/catalog/show-references-impact.md
@@ -6,7 +6,7 @@
 
     SHOW IMPACT OF qualified_name
 
-    SHOW CONTEXT OF qualified_name [ DEPTH n ]
+    DESCRIBE CONTEXT OF qualified_name [ DEPTH n ]
 
 ## Description
 
@@ -16,7 +16,7 @@ These commands provide different views of cross-reference information for a give
 
 **SHOW IMPACT OF** performs an impact analysis showing what would be affected if the specified element were changed or removed. This is broader than `SHOW REFERENCES` as it considers transitive dependencies and indirect effects.
 
-**SHOW CONTEXT OF** assembles the surrounding context of an element -- its definition, its callers, callees, and related elements -- suitable for providing to an LLM or for understanding an element in its broader project context. The optional `DEPTH` parameter controls how many levels of related elements to include.
+**DESCRIBE CONTEXT OF** assembles the surrounding context of an element -- its definition, its callers, callees, and related elements -- suitable for providing to an LLM or for understanding an element in its broader project context. The optional `DEPTH` parameter controls how many levels of related elements to include.
 
 ### Attributes, enumerations and enumeration values
 
@@ -68,13 +68,13 @@ SHOW IMPACT OF Sales.Order.DiscountCode;
 ### Gather context for a microflow
 
 ```sql
-SHOW CONTEXT OF Sales.ACT_CreateOrder;
+DESCRIBE CONTEXT OF Sales.ACT_CreateOrder;
 ```
 
 ### Gather deeper context
 
 ```sql
-SHOW CONTEXT OF Sales.ACT_CreateOrder DEPTH 3;
+DESCRIBE CONTEXT OF Sales.ACT_CreateOrder DEPTH 3;
 ```
 
 ### Check impact before moving an element
diff --git a/docs-site/src/reference/query/README.md b/docs-site/src/reference/query/README.md
index 57815af5e9..efc6a4ec59 100644
--- a/docs-site/src/reference/query/README.md
+++ b/docs-site/src/reference/query/README.md
@@ -15,7 +15,7 @@ Statements for browsing and inspecting project elements. Query statements are re
 | [SHOW CONSTANTS](show-constants.md) | List constants, optionally filtered by module |
 | [SHOW WORKFLOWS](show-workflows.md) | List workflows, optionally filtered by module |
 | [SHOW BUSINESS EVENTS](show-business-events.md) | List business event services |
-| [SHOW STRUCTURE](show-structure.md) | Hierarchical project overview at configurable depth |
+| [DESCRIBE STRUCTURE](show-structure.md) | Hierarchical project overview at configurable depth |
 | [SHOW WIDGETS](show-widgets.md) | List widgets across pages with optional filtering |
 
 ## DESCRIBE Statements
diff --git a/docs-site/src/reference/query/describe-widget.md b/docs-site/src/reference/query/describe-widget.md
index e8b4d3984b..a2131e6c2c 100644
--- a/docs-site/src/reference/query/describe-widget.md
+++ b/docs-site/src/reference/query/describe-widget.md
@@ -2,9 +2,9 @@
 
 ## Synopsis
 
-    DESCRIBE WIDGET <keyword>
+    DESCRIBE WIDGET TYPE <keyword>
 
-    DESCRIBE WIDGET '<widget id>'
+    DESCRIBE WIDGET TYPE '<widget id>'
 
 ## Description
 
@@ -38,7 +38,7 @@ widget appears at all. Without it, they come from mxcli's embedded template.
 ## Examples
 
 ```sql
-DESCRIBE WIDGET htmlelement;
+DESCRIBE WIDGET TYPE htmlelement;
 ```
 
 Example output, abbreviated:
@@ -82,7 +82,7 @@ MDL example (parses as written):
 By widget id:
 
 ```sql
-DESCRIBE WIDGET 'com.mendix.widget.web.htmlelement.HTMLElement';
+DESCRIBE WIDGET TYPE 'com.mendix.widget.web.htmlelement.HTMLElement';
 ```
 
 ## Notes
diff --git a/docs-site/src/reference/query/search.md b/docs-site/src/reference/query/search.md
index 52422bd8df..41f3f6d42e 100644
--- a/docs-site/src/reference/query/search.md
+++ b/docs-site/src/reference/query/search.md
@@ -39,4 +39,4 @@ Search using the CLI:
 
 ## See Also
 
-[SHOW STRUCTURE](show-structure.md), [SHOW ENTITIES](show-entities.md), [SHOW MICROFLOWS](show-microflows.md)
+[DESCRIBE STRUCTURE](show-structure.md), [SHOW ENTITIES](show-entities.md), [SHOW MICROFLOWS](show-microflows.md)
diff --git a/docs-site/src/reference/query/show-business-events.md b/docs-site/src/reference/query/show-business-events.md
index 061350444b..30d874ef64 100644
--- a/docs-site/src/reference/query/show-business-events.md
+++ b/docs-site/src/reference/query/show-business-events.md
@@ -31,4 +31,4 @@ SHOW BUSINESS EVENTS IN OrderModule
 
 ## See Also
 
-[SHOW MODULES](show-modules.md), [SHOW STRUCTURE](show-structure.md)
+[SHOW MODULES](show-modules.md), [DESCRIBE STRUCTURE](show-structure.md)
diff --git a/docs-site/src/reference/query/show-constants.md b/docs-site/src/reference/query/show-constants.md
index c933bf48ad..269cd0b50d 100644
--- a/docs-site/src/reference/query/show-constants.md
+++ b/docs-site/src/reference/query/show-constants.md
@@ -47,4 +47,4 @@ SHOW CONSTANT VALUES IN MyModule
 
 ## See Also
 
-[SHOW MODULES](show-modules.md), [SHOW STRUCTURE](show-structure.md), [SHOW / DESCRIBE SETTINGS](../settings/show-settings.md)
+[SHOW MODULES](show-modules.md), [DESCRIBE STRUCTURE](show-structure.md), [SHOW / DESCRIBE SETTINGS](../settings/show-settings.md)
diff --git a/docs-site/src/reference/query/show-modules.md b/docs-site/src/reference/query/show-modules.md
index 8638c31b84..dfb28644b8 100644
--- a/docs-site/src/reference/query/show-modules.md
+++ b/docs-site/src/reference/query/show-modules.md
@@ -31,4 +31,4 @@ SHOW ENTITIES IN MyFirstModule
 
 ## See Also
 
-[SHOW STRUCTURE](show-structure.md), [SHOW ENTITIES](show-entities.md), [SHOW MICROFLOWS](show-microflows.md), [SHOW PAGES](show-pages.md)
+[DESCRIBE STRUCTURE](show-structure.md), [SHOW ENTITIES](show-entities.md), [SHOW MICROFLOWS](show-microflows.md), [SHOW PAGES](show-pages.md)
diff --git a/docs-site/src/reference/query/show-structure.md b/docs-site/src/reference/query/show-structure.md
index c4540728c7..5b9cf8dace 100644
--- a/docs-site/src/reference/query/show-structure.md
+++ b/docs-site/src/reference/query/show-structure.md
@@ -1,8 +1,8 @@
-# SHOW STRUCTURE
+# DESCRIBE STRUCTURE
 
 ## Synopsis
 
-    SHOW STRUCTURE [DEPTH 1|2|3] [IN <module>] [ALL]
+    DESCRIBE STRUCTURE [DEPTH 1|2|3] [IN <module>] [ALL]
 
 ## Description
 
@@ -26,25 +26,25 @@ This is useful for getting a quick birds-eye view of what a project contains wit
 Show module-level summary (one line per module):
 
 ```sql
-SHOW STRUCTURE DEPTH 1
+DESCRIBE STRUCTURE DEPTH 1
 ```
 
 Show default structure (documents with signatures, user modules only):
 
 ```sql
-SHOW STRUCTURE
+DESCRIBE STRUCTURE
 ```
 
-Show structure of a single module:
+Describe structure of a single module:
 
 ```sql
-SHOW STRUCTURE IN MyFirstModule
+DESCRIBE STRUCTURE IN MyFirstModule
 ```
 
 Show full detail including all modules:
 
 ```sql
-SHOW STRUCTURE DEPTH 3 ALL
+DESCRIBE STRUCTURE DEPTH 3 ALL
 ```
 
 ## See Also
diff --git a/docs-site/src/reference/query/show-widgets.md b/docs-site/src/reference/query/show-widgets.md
index cb7397f006..5ff9e26734 100644
--- a/docs-site/src/reference/query/show-widgets.md
+++ b/docs-site/src/reference/query/show-widgets.md
@@ -41,4 +41,4 @@ SHOW WIDGETS WHERE WidgetType = 'DataGrid'
 
 ## See Also
 
-[SHOW PAGES](show-pages.md), [DESCRIBE PAGE](describe-page.md), [SHOW STRUCTURE](show-structure.md)
+[SHOW PAGES](show-pages.md), [DESCRIBE PAGE](describe-page.md), [DESCRIBE STRUCTURE](show-structure.md)
diff --git a/docs-site/src/reference/query/show-workflows.md b/docs-site/src/reference/query/show-workflows.md
index c0591cf72a..075b86b3ca 100644
--- a/docs-site/src/reference/query/show-workflows.md
+++ b/docs-site/src/reference/query/show-workflows.md
@@ -31,4 +31,4 @@ SHOW WORKFLOWS IN Approvals
 
 ## See Also
 
-[SHOW MODULES](show-modules.md), [SHOW MICROFLOWS](show-microflows.md), [SHOW STRUCTURE](show-structure.md)
+[SHOW MODULES](show-modules.md), [SHOW MICROFLOWS](show-microflows.md), [DESCRIBE STRUCTURE](show-structure.md)
diff --git a/docs-site/src/reference/security/README.md b/docs-site/src/reference/security/README.md
index 6a8f5cf3a5..a222cea16b 100644
--- a/docs-site/src/reference/security/README.md
+++ b/docs-site/src/reference/security/README.md
@@ -19,12 +19,12 @@ Mendix security operates at two levels. **Module roles** define permissions with
 
 | Statement | Syntax |
 |-----------|--------|
-| Show project security | `SHOW PROJECT SECURITY` |
+| Describe app security | `DESCRIBE APP SECURITY` |
 | Show module roles | `SHOW MODULE ROLES [IN module]` |
 | Show user roles | `SHOW USER ROLES` |
 | Show demo users | `SHOW DEMO USERS` |
 | Show access on element | `SHOW ACCESS ON [ENTITY\|MICROFLOW\|PAGE\|NANOFLOW] module.Name` |
-| Show security matrix | `SHOW SECURITY MATRIX [IN module]` |
+| Describe security matrix | `DESCRIBE SECURITY MATRIX [IN module]` |
 | Alter app security level | `ALTER APP SECURITY LEVEL OFF\|PROTOTYPE\|PRODUCTION` |
 | Toggle demo users | `ALTER APP SECURITY DEMO USERS ON\|OFF` |
 | Toggle strict mode | `ALTER APP SECURITY STRICT MODE ON\|OFF` |
@@ -32,4 +32,4 @@ Mendix security operates at two levels. **Module roles** define permissions with
 | Drop module role | `DROP MODULE ROLE module.Role` |
 | Drop user role | `DROP USER ROLE [IF EXISTS] Name` |
 | Drop demo user | `DROP DEMO USER [IF EXISTS] 'username'` |
-| Alter user role | `ALTER USER ROLE Name ADD\|REMOVE MODULE ROLES (module.Role, ...)` |
+| Alter user role | `ALTER USER ROLE Name ADD\|DROP MODULE ROLES (module.Role, ...)` |
diff --git a/docs-site/src/reference/settings/alter-settings.md b/docs-site/src/reference/settings/alter-settings.md
index c8593588b5..5a1176514f 100644
--- a/docs-site/src/reference/settings/alter-settings.md
+++ b/docs-site/src/reference/settings/alter-settings.md
@@ -17,12 +17,12 @@
     ALTER SETTINGS LANGUAGE key = value
     ALTER SETTINGS LANGUAGE ADD [OR MODIFY] 'code' [( option: value, ... )]
     ALTER SETTINGS LANGUAGE MODIFY 'code' ( option: value, ... )
-    ALTER SETTINGS LANGUAGE REMOVE 'code' 
+    ALTER SETTINGS LANGUAGE DROP 'code' 
 
     ALTER SETTINGS WORKFLOWS key = value
     ALTER SETTINGS WORKFLOWS ADD [OR MODIFY] GROUP 'name' [( Description: 'text' )]
     ALTER SETTINGS WORKFLOWS MODIFY GROUP 'name' ( Description: 'text' )
-    ALTER SETTINGS WORKFLOWS REMOVE GROUP 'name'
+    ALTER SETTINGS WORKFLOWS DROP GROUP 'name'
 
 ## Description
 
@@ -114,7 +114,7 @@ ALTER SETTINGS LANGUAGE ADD 'de_DE';
 ALTER SETTINGS LANGUAGE ADD 'ar_SD' (CheckCompleteness: true, CustomDateFormat: 'yyyy-MM-dd');
 ALTER SETTINGS LANGUAGE ADD OR MODIFY 'de_DE' (CheckCompleteness: true);
 ALTER SETTINGS LANGUAGE MODIFY 'de_DE' (CustomDateFormat: 'dd.MM.yyyy');
-ALTER SETTINGS LANGUAGE REMOVE 'de_DE';
+ALTER SETTINGS LANGUAGE DROP 'de_DE';
 ```
 
 Options: `CheckCompleteness` (report errors for texts with no translation in this
@@ -147,7 +147,7 @@ ALTER SETTINGS WORKFLOWS ADD OR MODIFY GROUP 'Approvers' (Description: 'Approves
 -- changes only the options it names
 ALTER SETTINGS WORKFLOWS MODIFY GROUP 'Reviewers' (Description: 'Second-line review');
 
-ALTER SETTINGS WORKFLOWS REMOVE GROUP 'Reviewers';
+ALTER SETTINGS WORKFLOWS DROP GROUP 'Reviewers';
 ```
 
 `Description` is the only option, because a workflow group stores a name and a
diff --git a/docs-site/src/tools/code-navigation.md b/docs-site/src/tools/code-navigation.md
index 98db7b099c..96cb86e427 100644
--- a/docs-site/src/tools/code-navigation.md
+++ b/docs-site/src/tools/code-navigation.md
@@ -20,7 +20,7 @@ This populates the reference data needed for callers, callees, references, impac
 | `SHOW CALLEES OF` | Find what a given element calls |
 | `SHOW REFERENCES OF` | Find all references to and from an element |
 | `SHOW IMPACT OF` | Analyze the impact of changing an element |
-| `SHOW CONTEXT OF` | Show the surrounding context of an element |
+| `DESCRIBE CONTEXT OF` | Show the surrounding context of an element |
 | `SEARCH` | Full-text search across all strings and source |
 
 ## CLI Subcommands
@@ -54,7 +54,7 @@ SHOW CALLERS OF Sales.ACT_ProcessOrder;
 SHOW IMPACT OF Sales.Customer;
 
 -- Step 4: Gather context for AI consumption
-SHOW CONTEXT OF Sales.SubmitOrder;
+DESCRIBE CONTEXT OF Sales.SubmitOrder;
 ```
 
 ## How AI Assistants Use This
diff --git a/docs-site/src/tools/refresh-catalog.md b/docs-site/src/tools/refresh-catalog.md
index d3bb6e0d27..906e75663e 100644
--- a/docs-site/src/tools/refresh-catalog.md
+++ b/docs-site/src/tools/refresh-catalog.md
@@ -42,7 +42,7 @@ This level is required for:
 - `SHOW CALLEES OF`
 - `SHOW REFERENCES OF`
 - `SHOW IMPACT OF`
-- `SHOW CONTEXT OF`
+- `DESCRIBE CONTEXT OF`
 - `SEARCH`
 - Full-text catalog queries
 
diff --git a/docs-site/src/tools/show-context.md b/docs-site/src/tools/show-context.md
index 38a2ea09a5..b8817eff4d 100644
--- a/docs-site/src/tools/show-context.md
+++ b/docs-site/src/tools/show-context.md
@@ -13,20 +13,20 @@ REFRESH CATALOG FULL;
 ## Syntax
 
 ```sql
-SHOW CONTEXT OF <qualified-name>
+DESCRIBE CONTEXT OF <qualified-name>
 ```
 
 ## Examples
 
 ```sql
--- Show context of a microflow
-SHOW CONTEXT OF Sales.ACT_ProcessOrder;
+-- Describe context of a microflow
+DESCRIBE CONTEXT OF Sales.ACT_ProcessOrder;
 
--- Show context of an entity
-SHOW CONTEXT OF Sales.Customer;
+-- Describe context of an entity
+DESCRIBE CONTEXT OF Sales.Customer;
 
--- Show context of a page
-SHOW CONTEXT OF Sales.CustomerOverview;
+-- Describe context of a page
+DESCRIBE CONTEXT OF Sales.CustomerOverview;
 ```
 
 ## CLI Usage
diff --git a/docs-site/src/tools/tui-commands.md b/docs-site/src/tools/tui-commands.md
index d053a192dc..3f47f5a001 100644
--- a/docs-site/src/tools/tui-commands.md
+++ b/docs-site/src/tools/tui-commands.md
@@ -16,7 +16,7 @@ Press `:` to open the command palette at the bottom of the TUI. The command bar
 | `:run` | Execute the current MDL file |
 | `:callers` | Show callers of the selected element |
 | `:callees` | Show callees of the selected element |
-| `:context` | Show context of the selected element |
+| `:context` | Describe context of the selected element |
 | `:impact` | Show impact analysis of the selected element |
 | `:refs` | Show references to the selected element |
 | `:diagram` | Open a diagram of the selected element in the system browser |
diff --git a/docs-site/src/tutorial/describe-search.md b/docs-site/src/tutorial/describe-search.md
index e8cf83a79d..7f857d3eb8 100644
--- a/docs-site/src/tutorial/describe-search.md
+++ b/docs-site/src/tutorial/describe-search.md
@@ -238,4 +238,4 @@ A typical exploration workflow looks like this:
 
 This workflow mirrors how you would explore a project in Mendix Studio Pro -- browsing the project explorer, opening documents, and using Find to locate things.
 
-Next, learn how to get a compact overview of the entire project with [SHOW STRUCTURE](show-structure.md).
+Next, learn how to get a compact overview of the entire project with [DESCRIBE STRUCTURE](show-structure.md).
diff --git a/docs-site/src/tutorial/exploring.md b/docs-site/src/tutorial/exploring.md
index 25d1cc3c1f..9a6889911e 100644
--- a/docs-site/src/tutorial/exploring.md
+++ b/docs-site/src/tutorial/exploring.md
@@ -7,7 +7,7 @@ mxcli provides three families of commands for exploration:
 - **SHOW** commands list elements by type. `SHOW ENTITIES` lists all entities; `SHOW MICROFLOWS IN Sales` narrows the list to one module.
 - **DESCRIBE** commands display the full MDL source for a single element, giving you the complete definition including attributes, associations, logic, and widget trees.
 - **SEARCH** performs full-text search across every string in the project -- captions, messages, expressions, documentation, and more.
-- **SHOW STRUCTURE** gives you a compact tree view of the entire project or a single module, at varying levels of detail.
+- **DESCRIBE STRUCTURE** gives you a compact tree view of the entire project or a single module, at varying levels of detail.
 
 These commands are read-only. They never modify your project. You can run them freely to build a mental model of the application before making any changes.
 
@@ -18,7 +18,7 @@ In this chapter, you will:
 1. List modules, entities, microflows, pages, and other elements with **SHOW** commands
 2. Inspect the full definition of any element with **DESCRIBE**
 3. Find elements by keyword with **SEARCH**
-4. Get a bird's-eye view of project structure with **SHOW STRUCTURE**
+4. Get a bird's-eye view of project structure with **DESCRIBE STRUCTURE**
 
 ## Prerequisites
 
diff --git a/docs-site/src/tutorial/installation.md b/docs-site/src/tutorial/installation.md
index 402d3974c0..88daeed899 100644
--- a/docs-site/src/tutorial/installation.md
+++ b/docs-site/src/tutorial/installation.md
@@ -17,7 +17,7 @@ The Codespace comes with mxcli, a JDK, Docker-in-Docker, Claude Code, and a samp
 Once the Codespace is running:
 
 ```bash
-./mxcli -p App.mpr -c "SHOW STRUCTURE"          # Explore the project
+./mxcli -p App.mpr -c "DESCRIBE STRUCTURE"          # Explore the project
 ./mxcli exec scripts/01-explore.mdl -p App.mpr   # Run an example script
 ./mxcli                                           # Start interactive REPL
 ```
diff --git a/docs-site/src/tutorial/mdl-ai-workflow.md b/docs-site/src/tutorial/mdl-ai-workflow.md
index f4a067309e..75b9de9a4a 100644
--- a/docs-site/src/tutorial/mdl-ai-workflow.md
+++ b/docs-site/src/tutorial/mdl-ai-workflow.md
@@ -56,7 +56,7 @@ Before making changes, the AI uses mxcli to understand the current state of your
 SHOW MODULES;
 
 -- Check what's already in the Sales module
-SHOW STRUCTURE IN Sales;
+DESCRIBE STRUCTURE IN Sales;
 
 -- Look at an existing entity for context
 DESCRIBE ENTITY Sales.Category;
diff --git a/docs-site/src/tutorial/quickstart.md b/docs-site/src/tutorial/quickstart.md
index b650c19d55..2c218013e4 100644
--- a/docs-site/src/tutorial/quickstart.md
+++ b/docs-site/src/tutorial/quickstart.md
@@ -57,7 +57,7 @@ LIST MODULES;
 LIST ENTITIES IN MyFirstModule;
 
 -- See the full structure at a glance
-LIST STRUCTURE;
+DESCRIBE STRUCTURE;
 ```
 
 ## 4. Create something
diff --git a/docs-site/src/tutorial/show-structure.md b/docs-site/src/tutorial/show-structure.md
index 65ce79cb2a..361e6c79ec 100644
--- a/docs-site/src/tutorial/show-structure.md
+++ b/docs-site/src/tutorial/show-structure.md
@@ -1,13 +1,13 @@
-# SHOW STRUCTURE
+# DESCRIBE STRUCTURE
 
-The `SHOW STRUCTURE` command gives you a compact, tree-style overview of a project. It is the fastest way to understand the overall shape of an application -- what modules exist, what types of documents they contain, and how large each module is.
+The `DESCRIBE STRUCTURE` command gives you a compact, tree-style overview of a project. It is the fastest way to understand the overall shape of an application -- what modules exist, what types of documents they contain, and how large each module is.
 
 ## Default view
 
-With no arguments, `SHOW STRUCTURE` displays all user modules at depth 2 -- modules with their documents listed by type:
+With no arguments, `DESCRIBE STRUCTURE` displays all user modules at depth 2 -- modules with their documents listed by type:
 
 ```sql
-SHOW STRUCTURE;
+DESCRIBE STRUCTURE;
 ```
 
 Example output:
@@ -49,7 +49,7 @@ The `DEPTH` option controls how much detail is shown:
 Shows one line per module with element counts:
 
 ```sql
-SHOW STRUCTURE DEPTH 1;
+DESCRIBE STRUCTURE DEPTH 1;
 ```
 
 ```
@@ -61,14 +61,14 @@ This is useful for getting a quick sense of project size and where the complexit
 
 ### DEPTH 2 -- Elements with signatures (default)
 
-This is the default when you run `SHOW STRUCTURE` with no depth specified. It shows modules, their documents grouped by type, and compact signatures for each element. See the example under [Default view](#default-view) above.
+This is the default when you run `DESCRIBE STRUCTURE` with no depth specified. It shows modules, their documents grouped by type, and compact signatures for each element. See the example under [Default view](#default-view) above.
 
 ### DEPTH 3 -- Full detail
 
 Shows typed attributes and named parameters:
 
 ```sql
-SHOW STRUCTURE DEPTH 3;
+DESCRIBE STRUCTURE DEPTH 3;
 ```
 
 ```
@@ -116,13 +116,13 @@ Depth 3 is verbose but gives you the most complete picture without running indiv
 Use `IN` to show only a single module:
 
 ```sql
-SHOW STRUCTURE IN MyFirstModule;
+DESCRIBE STRUCTURE IN MyFirstModule;
 ```
 
 This produces the same tree format but limited to one module. Combine with `DEPTH` for control over detail:
 
 ```sql
-SHOW STRUCTURE DEPTH 3 IN MyFirstModule;
+DESCRIBE STRUCTURE DEPTH 3 IN MyFirstModule;
 ```
 
 ## Including system modules
@@ -130,7 +130,7 @@ SHOW STRUCTURE DEPTH 3 IN MyFirstModule;
 By default, system and marketplace modules are hidden. Add `ALL` to include them:
 
 ```sql
-SHOW STRUCTURE DEPTH 1 ALL;
+DESCRIBE STRUCTURE DEPTH 1 ALL;
 ```
 
 ```
@@ -142,30 +142,30 @@ System              15 entities, 0 microflows, 0 pages
 
 This is useful when you need to see system entities (like `System.Image` or `System.FileDocument`) or check what a marketplace module provides.
 
-## Using SHOW STRUCTURE from the command line
+## Using DESCRIBE STRUCTURE from the command line
 
 ```bash
 # Quick project overview
-mxcli -p app.mpr -c "SHOW STRUCTURE DEPTH 1"
+mxcli -p app.mpr -c "DESCRIBE STRUCTURE DEPTH 1"
 
 # Detailed view of one module
-mxcli -p app.mpr -c "SHOW STRUCTURE DEPTH 3 IN Sales"
+mxcli -p app.mpr -c "DESCRIBE STRUCTURE DEPTH 3 IN Sales"
 
 # Full project including system modules
-mxcli -p app.mpr -c "SHOW STRUCTURE ALL"
+mxcli -p app.mpr -c "DESCRIBE STRUCTURE ALL"
 ```
 
-## When to use SHOW STRUCTURE vs SHOW + DESCRIBE
+## When to use DESCRIBE STRUCTURE vs SHOW + DESCRIBE
 
 | Goal | Command |
 |------|---------|
-| "What modules are in this project?" | `SHOW STRUCTURE DEPTH 1` |
-| "What does module X contain?" | `SHOW STRUCTURE IN X` |
+| "What modules are in this project?" | `DESCRIBE STRUCTURE DEPTH 1` |
+| "What does module X contain?" | `DESCRIBE STRUCTURE IN X` |
 | "List all entities (just names)" | `SHOW ENTITIES` |
 | "What are the attributes of entity X?" | `DESCRIBE ENTITY X` |
-| "Give me a complete overview of everything" | `SHOW STRUCTURE DEPTH 3` |
+| "Give me a complete overview of everything" | `DESCRIBE STRUCTURE DEPTH 3` |
 
-`SHOW STRUCTURE` is best for orientation -- understanding the shape of the project at a glance. For detailed work on specific elements, switch to `DESCRIBE`.
+`DESCRIBE STRUCTURE` is best for orientation -- understanding the shape of the project at a glance. For detailed work on specific elements, switch to `DESCRIBE`.
 
 ## What is next
 
diff --git a/docs/01-project/MDL_QUICK_REFERENCE.md b/docs/01-project/MDL_QUICK_REFERENCE.md
index fad6388442..eafa7231d8 100644
--- a/docs/01-project/MDL_QUICK_REFERENCE.md
+++ b/docs/01-project/MDL_QUICK_REFERENCE.md
@@ -549,13 +549,13 @@ it is for pages.
 > Mendix stores one `RequestBodyHandling` — so a statement asking for both is
 > refused as **MDL-SOAP01** by `mxcli check` and by `exec`, which call the same
 > function.
-| REST call (string) | `$Var = rest call get '<url>' returns string;` | Body as string |
-| REST call (response) | `$Var = rest call get '<url>' returns response;` | `System.HttpResponse` object. There is no specialization form — Mendix does not allow HttpResponse to be specialized (CE1540) |
-| REST call (file document) | `$Var = rest call get '<url>' returns Module.MyFile;` | Stores the body in a file document. Must be a **specialization** of `System.FileDocument` — the base type is rejected as a return type (CE0362 / MDL064) |
-| REST call (binary body) | `rest call post '<url>' header 'ContentType' = 'application/pdf' body binary $Doc/Contents returns response;` | Uploads raw bytes (`Microflows$BinaryRequestHandling`). The expression is the FileDocument's **Contents member**, not the document. A consumed REST **client document** has no binary body — `Body: FILE FROM $Doc` there is refused as MDL-REST02 |
-| REST call (mapping single) | `$Var = rest call get '<url>' returns mapping Module.IMM as Module.Entity;` | Single object — Studio Pro emits `ForceSingleOccurrence=true` |
-| REST call (mapping list) | `$Var = rest call get '<url>' returns mapping Module.IMM as list of Module.Entity;` | List result |
-| REST call (none) | `rest call get '<url>' returns nothing;` | Discard response |
+| REST call (string) | `$Var = call rest service get '<url>' returns string;` | Body as string |
+| REST call (response) | `$Var = call rest service get '<url>' returns response;` | `System.HttpResponse` object. There is no specialization form — Mendix does not allow HttpResponse to be specialized (CE1540) |
+| REST call (file document) | `$Var = call rest service get '<url>' returns Module.MyFile;` | Stores the body in a file document. Must be a **specialization** of `System.FileDocument` — the base type is rejected as a return type (CE0362 / MDL064) |
+| REST call (binary body) | `call rest service post '<url>' header 'ContentType' = 'application/pdf' body binary $Doc/Contents returns response;` | Uploads raw bytes (`Microflows$BinaryRequestHandling`). The expression is the FileDocument's **Contents member**, not the document. A consumed REST **client document** has no binary body — `Body: FILE FROM $Doc` there is refused as MDL-REST02 |
+| REST call (mapping single) | `$Var = call rest service get '<url>' returns mapping Module.IMM as Module.Entity;` | Single object — Studio Pro emits `ForceSingleOccurrence=true` |
+| REST call (mapping list) | `$Var = call rest service get '<url>' returns mapping Module.IMM as list of Module.Entity;` | List result |
+| REST call (none) | `call rest service get '<url>' returns nothing;` | Discard response |
 | Show page | `show page Module.PageName (Param = $value);` | `Param = expression`, as at every call site. `($Param = …)` and `(Param: …)` are deprecated (MDL-DEPR006/007) |
 | Close page | `close page;` | |
 | Download file | `download file $FileDocument [show in browser];` | Streams a `System.FileDocument` |
@@ -652,16 +652,16 @@ Nested folders use `/` separator: `'Parent/Child/Grandchild'`. Missing folders a
 
 | Statement | Syntax | Notes |
 |-----------|--------|-------|
-| Show project security | `show project security;` | Displays security level, admin, demo users |
+| Describe app security | `describe app security;` | Displays security level, admin, demo users |
 | Show module roles | `show module roles [in module];` | All roles or filtered by module |
 | Show user roles | `show user roles;` | Project-level user roles |
 | Show demo users | `show demo users;` | Configured demo users |
 | Show access on element | `show access on microflow\|nanoflow\|page\|entity Mod.Name;` | Which roles can access |
-| Show security matrix | `show security matrix [in module];` | Full access overview |
+| Describe security matrix | `describe security matrix [in module];` | Full access overview |
 | Create module role | `create [or modify] module role Mod.Role [description 'text'];` | `or modify` updates an existing role instead of failing, so a security script can be re-run |
 | Drop module role | `drop module role Mod.Role;` | |
 | Create user role | `create user role Name (Mod.Role, ...) [manage all roles];` | Aggregates module roles |
-| Alter user role | `alter user role Name add\|remove module roles (Mod.Role, ...);` | |
+| Alter user role | `alter user role Name add\|drop module roles (Mod.Role, ...);` | |
 | Drop user role | `drop user role [if exists] Name;` | `if exists` makes a cleanup script re-runnable |
 | Grant microflow access | `grant execute on microflow Mod.MF to Mod.Role, ...;` | |
 | Revoke microflow access | `revoke execute on microflow Mod.MF from Mod.Role, ...;` | |
@@ -874,12 +874,12 @@ alter workflow Module.OrderApproval
 
 | Statement | Syntax | Notes |
 |-----------|--------|-------|
-| Structure overview | `show structure;` | Depth 2 (elements with signatures), user modules only |
-| Module counts | `show structure depth 1;` | One line per module with element counts |
-| Full types | `show structure depth 3;` | Typed attributes, named parameters |
-| Filter by module | `show structure in ModuleName;` | Single module only |
-| Include all modules | `show structure depth 1 all;` | Include system/marketplace modules |
-| Folder layout | `list folders [in module];` | `show structure` is by document type at every depth and never shows folders — use this to read back where a `move` put something |
+| Structure overview | `describe structure;` | Depth 2 (elements with signatures), user modules only |
+| Module counts | `describe structure depth 1;` | One line per module with element counts |
+| Full types | `describe structure depth 3;` | Typed attributes, named parameters |
+| Filter by module | `describe structure in ModuleName;` | Single module only |
+| Include all modules | `describe structure depth 1 all;` | Include system/marketplace modules |
+| Folder layout | `list folders [in module];` | `describe structure` is by document type at every depth and never shows folders — use this to read back where a `move` put something |
 
 ## Navigation
 
@@ -984,12 +984,12 @@ still flagged rather than guessed at.
 | Enable a language | `alter settings LANGUAGE add 'de_DE' [(CheckCompleteness: true, CustomDateFormat: 'yyyy-MM-dd')];` | Adds to the enabled list — the only languages a build emits translations for. A language is identified by its code; Studio Pro's "German, Germany" is derived for display and not stored |
 | Enable or modify (upsert) | `alter settings LANGUAGE add or modify 'de_DE' (CheckCompleteness: true);` | What `describe settings` emits, so a described project replays onto itself or onto one that already has the language |
 | Modify a language | `alter settings LANGUAGE modify 'de_DE' (CheckCompleteness: true);` | Changes only the options it names. `CheckCompleteness` turns on error reporting for texts with no translation in that language (the default language is always checked regardless) |
-| Disable a language | `alter settings LANGUAGE remove 'de_DE';` | The **default** language is refused (every missing translation falls back on it). Translations are NOT deleted — they stay in the model and stop being built; the run reports how many |
+| Disable a language | `alter settings Language drop 'de_DE';` | The **default** language is refused (every missing translation falls back on it). Translations are NOT deleted — they stay in the model and stop being built; the run reports how many |
 | Alter workflows | `alter settings workflows key = value;` | UserEntity, DefaultTaskParallelism, WorkflowEngineParallelism |
 | Add a workflow group | `alter settings workflows add group 'Approvers' [(Description: 'Primary approval group')];` | The buckets under App Settings > Workflows > Groups that a user task's group targeting selects from. Mendix **11.2+**. `Description` is the only option — a `Settings$WorkflowGroup` stores Name and Description and nothing else, so the **name is the identity** and a second group differing only in case is refused |
 | Add or modify (upsert) | `alter settings workflows add or modify group 'Approvers' (Description: '...');` | What `describe settings` emits, so a described project replays onto itself |
 | Modify a workflow group | `alter settings workflows modify group 'Approvers' (Description: '...');` | Changes only the options it names, and keeps the group's element id — which is the **runtime's identity** for it (Mendix materialises one `System.WorkflowGroup` row per entry, keyed on that id), so an edit updates the row instead of replacing it |
-| Remove a workflow group | `alter settings workflows remove group 'Approvers';` | Nothing in the model references a group (a user task targets groups through a microflow or an XPath returning `System.WorkflowGroup` objects), so there is nothing to dangle — the coupling is at runtime |
+| Remove a workflow group | `alter settings workflows drop group 'Approvers';` | Nothing in the model references a group (a user task targets groups through a microflow or an XPath returning `System.WorkflowGroup` objects), so there is nothing to dangle — the coupling is at runtime |
 | List workflow groups | `show workflow groups;` | Reads the settings directly; no catalog refresh needed |
 | List languages | `show languages;` | ⚠️ languages that have TRANSLATIONS, not enabled ones (a stock app reports 8 while 1 is enabled). For the enabled list use `describe settings`. Requires `refresh catalog full` |
 
@@ -1445,10 +1445,10 @@ MDL uses explicit property declarations for pages:
 | DataView read-only style | `ReadOnlyStyle: Inherit\|Control\|Text` | `dataview dv (datasource: $O, ReadOnlyStyle: Text)` — a DataView's own, distinct from a checkbox's. **Control** is Studio Pro's default here, not Inherit |
 | Page CSS class / style | `Class: 'css-class', Style: 'css: rule'` | `(Title: 'Home', Class: 'container-fluid bg-light', Style: 'min-height: 100vh')` — the page's Appearance |
 | Page variables | `variables: { $name: type = 'expr' }` | `variables: { $show: boolean = 'true' }` |
-| Repeated widget entries | `<container> <name> ( … )` **in the widget body** | A repeatable property (FileUploader `allowedFileFormats`, HTML Element `attributes`, a chart's `series`) is a block, never a property value. `attributes: [(attributeName: 'x')]` is **MDL-WIDGET27** — it used to check clean, exec, and vanish from storage. `describe widget <name> -p app.mpr` lists the container keywords |
+| Repeated widget entries | `<container> <name> ( … )` **in the widget body** | A repeatable property (FileUploader `allowedFileFormats`, HTML Element `attributes`, a chart's `series`) is a block, never a property value. `attributes: [(attributeName: 'x')]` is **MDL-WIDGET27** — it used to check clean, exec, and vanish from storage. `describe widget type <name> -p app.mpr` lists the container keywords |
 | Data grid 2 column filter | `column (attribute: A) { textfilter f }` | **Inside the column's braces.** `column (…) filter { … }` is the GALLERY form — the grammar reads it as a column with no body plus a sibling `filter` widget, which the grid has nowhere to put; it used to be dropped on write and is now **MDL-WIDGET30**. A grid-wide filter bar is `controlbar`; a gallery spells that same slot `filter`. Match the filter to the column's type (String → `textfilter`, number → `numberfilter`, DateTime → `datefilter`, Enumeration **and Boolean** → `dropdownfilter` — the drop-down filter's own attribute types are Enum and Boolean, and a Boolean column filters Yes/No). A column may carry a **custom-content widget AND a filter**: `content` and `filter` are separate slots, so `column (attribute: IsActive) { checkbox cb (Editable: Never, ReadOnlyStyle: Control) dropdownfilter ddf }` renders checkbox cells and still filters |
-| Widget with nowhere to go | any widget in a pluggable widget's body | A child matching no container, slot or `template` catch-all is **MDL-WIDGET30** at check time and refused by `exec`. `describe widget <name> -p app.mpr` lists what the parent declares. Needs the parent's definition, so it is silent without `-p` |
-| Inspect a widget | `describe widget <keyword\|'widget id'>;` | `describe widget combobox;` — properties, enum values, defaults and the editor rules that HIDE properties under some configurations. **Body containers** names what the widget's body takes, and for an object list the widgets-typed slots *inside one item* plus the widget types that route into each — that is where `column … { textfilter }` is spelled out. Works with no project open; with one, reads the installed `.mpk` (version-accurate, and the only place a Marketplace widget appears). Same output as `mxcli widget describe` |
+| Widget with nowhere to go | any widget in a pluggable widget's body | A child matching no container, slot or `template` catch-all is **MDL-WIDGET30** at check time and refused by `exec`. `describe widget type <name> -p app.mpr` lists what the parent declares. Needs the parent's definition, so it is silent without `-p` |
+| Inspect a widget | `describe widget type <keyword\|'widget id'>;` | `describe widget type combobox;` — properties, enum values, defaults and the editor rules that HIDE properties under some configurations. **Body containers** names what the widget's body takes, and for an object list the widgets-typed slots *inside one item* plus the widget types that route into each — that is where `column … { textfilter }` is spelled out. Works with no project open; with one, reads the installed `.mpk` (version-accurate, and the only place a Marketplace widget appears). Same output as `mxcli widget describe` |
 | Widget name | Required after type | `textbox txtName (...)` |
 | Attribute binding | `attribute: AttrName` | `textbox txt (label: 'Name', attribute: Name)` |
 | Attribute over an association | `attribute: Assoc/Attr` (bare association name, multi-hop OK) | `textbox txt (label: 'Rule', attribute: RuleAction_BusinessRule/Name)` — works on textbox, textarea, datepicker, dropdown, checkbox and radiobuttons, the same as on a data grid column |
@@ -1671,8 +1671,8 @@ This is the generic ALTER — `alter <type> Module.Name { set (Key: value) on <t
 | Pluggable prop | `set ('showLabel': false) on cbStatus` | Quoted name for pluggable widgets |
 | Named action slot | `set ('createFileAction': call microflow M.ACT_Create) on fileUploader1` | A pluggable widget's action-typed property, by its own key; any `create page` action form. Refused on a key that is not action-typed |
 | Set column prop | `set (caption: 'New') on dgGrid column(Attr)` | A DataGrid 2 column by its attribute, or `column('Caption')`; `@n` when two columns match. The older `dgGrid.colName` (a derived name) still works |
-| Drop column | `drop dgGrid column(Attr)` | Remove a DataGrid column |
-| Insert column | `insert after dgGrid column(Attr) { column (…) }` | Add column to DataGrid; a column takes no name |
+| Drop attribute | `drop dgGrid column(Attr)` | Remove a DataGrid column |
+| Insert column | `insert after dgGrid column(Attr) { column (…) }` | Add attribute to DataGrid; a column takes no name |
 | Add variable | `add variables $name: type = 'expr'` | Add a page variable |
 | Drop variable | `drop variables $name` | Remove a page variable |
 | Set layout | `set layout = Module.LayoutName` | Change page layout, auto-maps placeholders |
@@ -1846,7 +1846,7 @@ mxcli exec de_DE.mdl -p app.mpr
 | Show callees | `show callees of Module.Name;` | What this element calls |
 | Show references | `show references of Module.Name;` | All references to/from |
 | Show impact | `show impact of Module.Name;` | Impact analysis |
-| Show context | `show context of Module.Name;` | Surrounding context |
+| Show context | `describe context of Module.Name;` | Surrounding context |
 | Full-text search | `search '<keyword>';` | Search across all strings and source |
 
 Cross-reference commands require `refresh catalog full` to populate reference data.
diff --git a/mdl-examples/bug-tests/759-create-configuration-storage-names.mdl b/mdl-examples/bug-tests/759-create-configuration-storage-names.mdl
index 8b26a0ea4f..32f720e10a 100644
--- a/mdl-examples/bug-tests/759-create-configuration-storage-names.mdl
+++ b/mdl-examples/bug-tests/759-create-configuration-storage-names.mdl
@@ -61,4 +61,4 @@ alter settings configuration 'Issue759 Postgres'
   DatabaseType = 'PostgreSql',
   ApplicationRootUrl = 'http://localhost:8081/';
 
-show settings;
+describe settings;
diff --git a/mdl-examples/doctype-tests/11-navigation-examples.mdl b/mdl-examples/doctype-tests/11-navigation-examples.mdl
index 7c880f554f..dc2b7c04dc 100644
--- a/mdl-examples/doctype-tests/11-navigation-examples.mdl
+++ b/mdl-examples/doctype-tests/11-navigation-examples.mdl
@@ -53,10 +53,10 @@ show navigation menu Responsive;
 show navigation menu;
 
 -- ============================================================================
--- SHOW NAVIGATION HOMES — home page assignments across all profiles and roles
+-- LIST NAVIGATION HOMES — home page assignments across all profiles and roles
 -- ============================================================================
 
-show navigation homes;
+list navigation homes;
 
 -- MARK: CREATE OR REPLACE NAVIGATION
 
@@ -141,7 +141,7 @@ where RefKind in ('home_page', 'menu_item', 'login_page');
 
 show impact of NavTest.NavTest_Home;
 
-show context of NavTest.NavTest_Home;
+describe context of NavTest.NavTest_Home;
 
 /**
  * Responsive navigation
diff --git a/mdl-examples/doctype-tests/navigation-profiles.mdl b/mdl-examples/doctype-tests/navigation-profiles.mdl
index 6f5e4bc6fd..82c860b33d 100644
--- a/mdl-examples/doctype-tests/navigation-profiles.mdl
+++ b/mdl-examples/doctype-tests/navigation-profiles.mdl
@@ -59,4 +59,4 @@ create or replace navigation PhoneOffline
     menu item 'Home' page MyFirstModule.Home_Web;
   );
 
-show navigation;
+describe navigation;
diff --git a/mdl/deprecation/deprecation.go b/mdl/deprecation/deprecation.go
index 36f7f253e2..7244d060a5 100644
--- a/mdl/deprecation/deprecation.go
+++ b/mdl/deprecation/deprecation.go
@@ -157,6 +157,26 @@ const (
 	// on a text template: the placeholders bound by position (R4,
 	// ako/mxcli#751).
 	PositionalTemplateArguments = "MDL-DEPR009"
+
+	// R6: one verb per job (ako/mxcli#755). A block of their own, 090-099, so
+	// the parallel phase-3 changes do not collide.
+
+	// ShowSingleThing is `show` (or `list`) on a form that names one thing:
+	// entity, association, page, navigation, app security, security matrix,
+	// structure, context, settings. Its canonical verb is `describe`.
+	ShowSingleThing = "MDL-DEPR090"
+	// UserRoleRemove is `alter user role … remove module roles`.
+	UserRoleRemove = "MDL-DEPR091"
+	// SettingsRemove is `alter settings language|workflows remove …`.
+	SettingsRemove = "MDL-DEPR092"
+	// ColumnForAttribute is `column` for `attribute` in alter entity.
+	ColumnForAttribute = "MDL-DEPR093"
+	// RestCall is the `rest call` microflow statement.
+	RestCall = "MDL-DEPR094"
+	// DescribeWidgetType is `describe widget <name>` for a widget definition.
+	DescribeWidgetType = "MDL-DEPR095"
+	// DefineFragment is `define fragment`.
+	DefineFragment = "MDL-DEPR096"
 )
 
 // entries is the registry. Append only: a code is never reused or renumbered,
@@ -183,9 +203,9 @@ var entries = []Entry{
 		RemovedIn: 2,
 		Note: "Reported only for plurals and relationship queries, whose canonical " +
 			"form is `list`. Forms that name a single thing (`show entity X`, " +
-			"`show navigation`, `show project security`, …) become `describe`, and " +
-			"session state (`show version`, `show status`) a REPL command; they are " +
-			"not reported until those forms exist.",
+			"`show navigation`, `show project security`, …) become `describe` " +
+			"(MDL-DEPR090), and session state (`show version`, `show status`) a REPL " +
+			"command (R7), which is not reported until that command exists.",
 		Example:          "show entities in M;",
 		CanonicalExample: "list entities in M;",
 	},
@@ -272,7 +292,7 @@ var entries = []Entry{
 		Canonical:        "alter app security …",
 		Rewrite:          Rewrite{Structural: "security name: `project security` becomes `app security`"},
 		RemovedIn:        2,
-		Note:             "Studio Pro calls it App Security (R10). `show project security` becomes `describe app security` with the rest of R6, and is not reported here yet.",
+		Note:             "Studio Pro calls it App Security (R10). `show project security` becomes `describe app security` (MDL-DEPR090).",
 		Example:          "alter project security demo users off;",
 		CanonicalExample: "alter app security demo users off;",
 	},
@@ -374,6 +394,88 @@ var entries = []Entry{
 
 func init() {
 	entries = append(entries, r8Entries...)
+	entries = append(entries, r6Entries...)
+}
+
+// r6Entries are R6's verbs (ako/mxcli#755, PROPOSAL_mdl_beta_syntax_freeze.md
+// §3 R6).
+var r6Entries = []Entry{
+	{
+		Code:      ShowSingleThing,
+		Old:       "show entity|association|page|navigation|project security|security matrix|structure|context of|settings …",
+		Canonical: "describe entity|association|page|navigation|app security|security matrix|structure|context of|settings …",
+		Rewrite: Rewrite{Structural: "verb as `describe`: `show page X` -> `describe page X`, `show project security` -> " +
+			"`describe app security`; the same for `list` on these forms"},
+		RemovedIn: 2,
+		Note: "`show` is dropped (R6): plurals are listed, one thing is described. For page, app security, security " +
+			"matrix, structure and context the describe is the same statement. `show entity`, `show association`, " +
+			"`show navigation` and `show settings` print a summary where describe prints the full definition as MDL, " +
+			"so they keep their summary and `fmt --upgrade` reports them instead of rewriting them.",
+		Example:          "show security matrix in M;",
+		CanonicalExample: "describe security matrix in M;",
+	},
+	{
+		Code:             UserRoleRemove,
+		Old:              "alter user role R remove module roles (…)",
+		Canonical:        "alter user role R drop module roles (…)",
+		Rewrite:          Rewrite{Token: "remove", Replacement: "drop"},
+		RemovedIn:        2,
+		Note:             "An alter adds and drops its children (R6), as `alter entity … drop attribute` does.",
+		Example:          "alter user role Clerk remove module roles (M.User);",
+		CanonicalExample: "alter user role Clerk drop module roles (M.User);",
+	},
+	{
+		Code:             SettingsRemove,
+		Old:              "alter settings language remove '…' / alter settings workflows remove group '…'",
+		Canonical:        "alter settings language drop '…' / alter settings workflows drop group '…'",
+		Rewrite:          Rewrite{Token: "remove", Replacement: "drop"},
+		RemovedIn:        2,
+		Note:             "An alter adds and drops its children (R6). `modify` and `add or modify` are unchanged for now.",
+		Example:          "alter settings language remove 'ar_SD';",
+		CanonicalExample: "alter settings language drop 'ar_SD';",
+	},
+	{
+		Code:             ColumnForAttribute,
+		Old:              "alter entity E add|rename|modify|drop column …",
+		Canonical:        "alter entity E add|rename|modify|drop attribute …",
+		Rewrite:          Rewrite{Token: "column", Replacement: "attribute"},
+		RemovedIn:        2,
+		Note:             "An entity has attributes; `column` was a synonym in four alter entity actions.",
+		Example:          "alter entity M.E drop column Note;",
+		CanonicalExample: "alter entity M.E drop attribute Note;",
+	},
+	{
+		Code:      RestCall,
+		Old:       "rest call get|post|… 'url' …",
+		Canonical: "call rest service get|post|… 'url' …",
+		Rewrite:   Rewrite{Structural: "statement keyword: `rest call` becomes `call rest service`"},
+		RemovedIn: 2,
+		Note: "Studio Pro's name for the activity, in the `call <kind>` pattern of every other call (R6). " +
+			"The clauses after the method are unchanged.",
+		Example:          "create microflow M.F () begin $R = rest call get 'https://example.com' returns string; end;",
+		CanonicalExample: "create microflow M.F () begin $R = call rest service get 'https://example.com' returns string; end;",
+	},
+	{
+		Code:      DescribeWidgetType,
+		Old:       "describe widget <name>",
+		Canonical: "describe widget type <name>",
+		Rewrite:   Rewrite{Structural: "`type` after `widget`: `describe widget combobox` -> `describe widget type combobox`"},
+		RemovedIn: 2,
+		Note: "`widget type` asks which kind of widget, and cannot be read as a widget on a page " +
+			"(`describe fragment … widget`, `describe styling … widget`).",
+		Example:          "describe widget combobox;",
+		CanonicalExample: "describe widget type combobox;",
+	},
+	{
+		Code:             DefineFragment,
+		Old:              "define fragment F as { … }",
+		Canonical:        "create fragment F as { … }",
+		Rewrite:          Rewrite{Token: "define", Replacement: "create"},
+		RemovedIn:        2,
+		Note:             "`create` is the verb every other definition uses (R6). A fragment is still session-scoped and unqualified.",
+		Example:          "define fragment Header as { dynamictext t (Content: 'x') };",
+		CanonicalExample: "create fragment Header as { dynamictext t (Content: 'x') };",
+	},
 }
 
 // r8Entries are R8's spellings (ako/mxcli#752). Kept apart from the list above
@@ -429,12 +531,12 @@ var r8Entries = []Entry{
 	},
 	{
 		Code:             ReturnsNone,
-		Old:              "rest call … returns none",
-		Canonical:        "rest call … returns nothing",
+		Old:              "call rest service … returns none",
+		Canonical:        "call rest service … returns nothing",
 		Rewrite:          Rewrite{Token: "none", Replacement: "nothing"},
 		RemovedIn:        2,
-		Example:          "create microflow M.F () begin rest call get 'https://example.com' returns none; end;",
-		CanonicalExample: "create microflow M.F () begin rest call get 'https://example.com' returns nothing; end;",
+		Example:          "create microflow M.F () begin call rest service get 'https://example.com' returns none; end;",
+		CanonicalExample: "create microflow M.F () begin call rest service get 'https://example.com' returns nothing; end;",
 	},
 }
 
diff --git a/mdl/executor/cmd_fragments.go b/mdl/executor/cmd_fragments.go
index 88861a055d..ee4e097365 100644
--- a/mdl/executor/cmd_fragments.go
+++ b/mdl/executor/cmd_fragments.go
@@ -59,7 +59,7 @@ func describeFragment(ctx *ExecContext, name ast.QualifiedName) error {
 		return mdlerrors.NewNotFound("fragment", name.Name)
 	}
 
-	fmt.Fprintf(ctx.Output, "define fragment %s as {\n", frag.Name)
+	fmt.Fprintf(ctx.Output, "create fragment %s as {\n", frag.Name)
 	for _, w := range frag.Widgets {
 		outputASTWidgetMDL(ctx.Output, w, 1)
 	}
diff --git a/mdl/executor/cmd_fragments_mock_test.go b/mdl/executor/cmd_fragments_mock_test.go
index ed568af678..6d7616a3e0 100644
--- a/mdl/executor/cmd_fragments_mock_test.go
+++ b/mdl/executor/cmd_fragments_mock_test.go
@@ -44,7 +44,7 @@ func TestDescribeFragment_Mock(t *testing.T) {
 	assertNoError(t, describeFragment(ctx, ast.QualifiedName{Name: "myFrag"}))
 
 	out := buf.String()
-	assertContainsStr(t, out, "define fragment myFrag")
+	assertContainsStr(t, out, "create fragment myFrag")
 	assertContainsStr(t, out, "Button btnSave")
 }
 
diff --git a/mdl/executor/cmd_microflows_format_action.go b/mdl/executor/cmd_microflows_format_action.go
index ea5d53803b..a1c0dd3359 100644
--- a/mdl/executor/cmd_microflows_format_action.go
+++ b/mdl/executor/cmd_microflows_format_action.go
@@ -1272,7 +1272,7 @@ func formatRestCallAction(ctx *ExecContext, a *microflows.RestCallAction) string
 		sb.WriteString(" = ")
 	}
 
-	sb.WriteString("rest call ")
+	sb.WriteString("call rest service ")
 
 	// HTTP method
 	method := "get"
diff --git a/mdl/executor/cmd_microflows_format_restcall_test.go b/mdl/executor/cmd_microflows_format_restcall_test.go
index 5e77efb4aa..3132e33db4 100644
--- a/mdl/executor/cmd_microflows_format_restcall_test.go
+++ b/mdl/executor/cmd_microflows_format_restcall_test.go
@@ -26,7 +26,7 @@ func TestFormatRestCallAction_GET(t *testing.T) {
 	if got == "" {
 		t.Fatal("expected non-empty output")
 	}
-	assertContains(t, got, "rest call get")
+	assertContains(t, got, "call rest service get")
 	assertContains(t, got, "'https://api.example.com/orders'")
 	assertContains(t, got, "$Response = ")
 	assertContains(t, got, "returns String")
@@ -59,7 +59,7 @@ func TestFormatRestCallAction_POST_CustomBody(t *testing.T) {
 		ResultHandling: &microflows.ResultHandlingNone{},
 	}
 	got := e.formatRestCallAction(action)
-	assertContains(t, got, "rest call post")
+	assertContains(t, got, "call rest service post")
 	assertContains(t, got, "body '{\"name\": \"test\"}'")
 	assertContains(t, got, "returns nothing")
 }
diff --git a/mdl/executor/fragment_test.go b/mdl/executor/fragment_test.go
index 8458f7a0ae..525ac1cdbb 100644
--- a/mdl/executor/fragment_test.go
+++ b/mdl/executor/fragment_test.go
@@ -155,8 +155,8 @@ func TestExecDescribeFragment(t *testing.T) {
 	}
 
 	output := buf.String()
-	if !strings.Contains(output, "define fragment Footer") {
-		t.Errorf("Expected 'define fragment Footer' in output, got: %s", output)
+	if !strings.Contains(output, "create fragment Footer") {
+		t.Errorf("Expected 'create fragment Footer' in output, got: %s", output)
 	}
 	if !strings.Contains(output, "footer f1") {
 		t.Errorf("Expected 'footer f1' in output, got: %s", output)
@@ -666,8 +666,8 @@ func TestRoundtripDefineAndDescribe(t *testing.T) {
 	}
 
 	output := buf.String()
-	if !strings.Contains(output, "define fragment Footer") {
-		t.Errorf("Expected define fragment in output, got: %s", output)
+	if !strings.Contains(output, "create fragment Footer") {
+		t.Errorf("Expected create fragment in output, got: %s", output)
 	}
 	if !strings.Contains(output, "footer f1") {
 		t.Errorf("Expected footer f1 in output, got: %s", output)
diff --git a/mdl/executor/stmt_summary.go b/mdl/executor/stmt_summary.go
index ad3ba7de28..42027e9df7 100644
--- a/mdl/executor/stmt_summary.go
+++ b/mdl/executor/stmt_summary.go
@@ -211,7 +211,7 @@ func stmtSummary(stmt ast.Statement) string {
 
 	// Fragments
 	case *ast.DefineFragmentStmt:
-		return fmt.Sprintf("define fragment %s", s.Name)
+		return fmt.Sprintf("create fragment %s", s.Name)
 	case *ast.DescribeFragmentFromStmt:
 		return fmt.Sprintf("describe fragment from %s %s widget %s", s.ContainerType, s.ContainerName, s.WidgetName)
 
diff --git a/mdl/executor/validate_microflow_rest.go b/mdl/executor/validate_microflow_rest.go
index 89fe402ed0..c8d2d4162e 100644
--- a/mdl/executor/validate_microflow_rest.go
+++ b/mdl/executor/validate_microflow_rest.go
@@ -39,7 +39,7 @@ func (v *microflowValidator) checkRestFileDocumentResult(stmt *ast.RestCallStmt)
 
 	if entity.Module == "" {
 		v.addViolation("MDL064", linter.SeverityError,
-			fmt.Sprintf("rest call 'returns %s': the file document type needs a module prefix",
+			fmt.Sprintf("call rest service 'returns %s': the file document type needs a module prefix",
 				entity.Name),
 			fmt.Sprintf("Write the qualified name, e.g. 'MyModule.%s'", entity.Name))
 		return
@@ -47,7 +47,7 @@ func (v *microflowValidator) checkRestFileDocumentResult(stmt *ast.RestCallStmt)
 
 	if entity.String() == systemFileDocument {
 		v.addViolation("MDL064", linter.SeverityError,
-			"rest call 'returns System.FileDocument': Mendix does not allow the base "+
+			"call rest service 'returns System.FileDocument': Mendix does not allow the base "+
 				"System.FileDocument as a REST result type — mxbuild rejects it with CE0362 "+
 				"\"System entity 'System.FileDocument' is not allowed as a return type.\"",
 			"Create an entity that specializes it (create persistent entity MyModule.MyFile "+
diff --git a/mdl/executor/validate_widget_kind.go b/mdl/executor/validate_widget_kind.go
index 1949167472..a2e4a0532e 100644
--- a/mdl/executor/validate_widget_kind.go
+++ b/mdl/executor/validate_widget_kind.go
@@ -108,7 +108,7 @@ func validateWidgetKind(w *ast.WidgetV3, registry *WidgetRegistry, parentDef *Wi
 			Severity: linter.SeverityError,
 			Message: fmt.Sprintf("%s: `%s` is not a widget in this project%s",
 				locationPrefix, strings.ToLower(w.Type), nearestWidgetNames(registry, w.Type)),
-			Suggestion: "run `mxcli widget init` if the package was just installed, or `describe widget <name>` to see what is available",
+			Suggestion: "run `mxcli widget init` if the package was just installed, or `describe widget type <name>` to see what is available",
 		}}
 	}
 
diff --git a/mdl/grammar/domains/MDLCatalog.g4 b/mdl/grammar/domains/MDLCatalog.g4
index 9ba4cf9807..f74ce0410a 100644
--- a/mdl/grammar/domains/MDLCatalog.g4
+++ b/mdl/grammar/domains/MDLCatalog.g4
@@ -59,9 +59,13 @@ showStatement
     | showOrList MESSAGE DEFINITION COLLECTION (IN (qualifiedName | IDENTIFIER))?
     | showOrList IMPORT MAPPINGS (IN (qualifiedName | IDENTIFIER))?
     | showOrList EXPORT MAPPINGS (IN (qualifiedName | IDENTIFIER))?
-    | showOrList ENTITY qualifiedName
-    | showOrList ASSOCIATION qualifiedName
-    | showOrList PAGE qualifiedName
+    // R6: a single thing is described, not shown. `show` on these is a
+    // deprecated alias (MDL-DEPR090); page, app security, security matrix,
+    // structure and context build the same statement as their describe, the
+    // others keep their summary and are reported without a rewrite.
+    | showOrList ENTITY qualifiedName /* @alias MDL-DEPR090 */
+    | showOrList ASSOCIATION qualifiedName /* @alias MDL-DEPR090 */
+    | showOrList PAGE qualifiedName /* @alias MDL-DEPR090 */
     | showOrList CONNECTIONS
     | showOrList STATUS
     | showOrList VERSION
@@ -71,12 +75,12 @@ showStatement
     | showOrList CALLEES OF qualifiedName TRANSITIVE?
     | showOrList REFERENCES TO qualifiedName
     | showOrList IMPACT OF qualifiedName
-    | showOrList CONTEXT OF qualifiedName (DEPTH NUMBER_LITERAL)?
+    | showOrList CONTEXT OF qualifiedName (DEPTH NUMBER_LITERAL)? /* @alias MDL-DEPR090 */
     | showOrList COMMUNITY MEMBERS OF qualifiedName
     | showOrList COMMUNITY OF qualifiedName
     | showOrList COMMUNITIES
     | showOrList WIDGETS showWidgetsFilter?
-    | showOrList PROJECT SECURITY
+    | showOrList PROJECT SECURITY /* @alias MDL-DEPR090 */
     | showOrList MODULE ROLES (IN (qualifiedName | IDENTIFIER))?
     | showOrList USER ROLES
     | showOrList DEMO USERS
@@ -91,20 +95,20 @@ showStatement
     | showOrList ACCESS ON PAGE qualifiedName
     | showOrList ACCESS ON WORKFLOW qualifiedName
     | showOrList ACCESS ON NANOFLOW qualifiedName
-    | showOrList SECURITY MATRIX (IN (qualifiedName | IDENTIFIER))?
+    | showOrList SECURITY MATRIX (IN (qualifiedName | IDENTIFIER))? /* @alias MDL-DEPR090 */
     | showOrList consumedODataServicesKw (IN (qualifiedName | IDENTIFIER))?
     | showOrList publishedODataServicesKw (IN (qualifiedName | IDENTIFIER))?
     | showOrList EXTERNAL ENTITIES (IN (qualifiedName | IDENTIFIER))?
     | showOrList EXTERNAL ACTIONS (IN (qualifiedName | IDENTIFIER))?
-    | showOrList NAVIGATION
-    | showOrList NAVIGATION MENU_KW (qualifiedName | IDENTIFIER)?
+    | showOrList NAVIGATION /* @alias MDL-DEPR090 */
+    | showOrList NAVIGATION MENU_KW (qualifiedName | IDENTIFIER)? /* @alias MDL-DEPR090 */
     | showOrList NAVIGATION HOMES
     | showOrList DESIGN PROPERTIES (FOR widgetTypeKeyword)?
-    | showOrList STRUCTURE (DEPTH NUMBER_LITERAL)? (IN (qualifiedName | IDENTIFIER))? ALL?
+    | showOrList STRUCTURE (DEPTH NUMBER_LITERAL)? (IN (qualifiedName | IDENTIFIER))? ALL? /* @alias MDL-DEPR090 */
     | showOrList BUSINESS EVENT SERVICES (IN (qualifiedName | IDENTIFIER))?
     | showOrList BUSINESS EVENT CLIENTS (IN (qualifiedName | IDENTIFIER))?
     | showOrList BUSINESS EVENTS (IN (qualifiedName | IDENTIFIER))?
-    | showOrList SETTINGS
+    | showOrList SETTINGS /* @alias MDL-DEPR090 */
     | showOrList FRAGMENTS
     | showOrList DATABASE CONNECTIONS (IN (qualifiedName | IDENTIFIER))?
     | showOrList consumedRestServicesKw (IN (qualifiedName | IDENTIFIER))?
@@ -180,8 +184,11 @@ describeStatement
     | DESCRIBE publishedODataServiceKw qualifiedName  // DESCRIBE PUBLISHED ODATA SERVICE Module.ServiceName
     | DESCRIBE EXTERNAL ENTITY qualifiedName    // DESCRIBE EXTERNAL ENTITY Module.EntityName
     | DESCRIBE NAVIGATION (qualifiedName | IDENTIFIER)?  // DESCRIBE NAVIGATION [profile]
-    | DESCRIBE WIDGET identifierOrKeyword                                      // DESCRIBE WIDGET combobox | DESCRIBE WIDGET 'com.mendix…'
-    | DESCRIBE WIDGET STRING_LITERAL                                           // …by full widget id, which contains dots
+    // R6: `widget type` names the kind of widget, so it cannot be read as a
+    // widget on a page. `describe widget <name>` is a deprecated alias.
+    | DESCRIBE WIDGET TYPE (identifierOrKeyword | STRING_LITERAL)              // DESCRIBE WIDGET TYPE combobox | DESCRIBE WIDGET TYPE 'com.mendix…'
+    | DESCRIBE WIDGET identifierOrKeyword /* @alias MDL-DEPR095 */             // DESCRIBE WIDGET combobox
+    | DESCRIBE WIDGET STRING_LITERAL /* @alias MDL-DEPR095 */                  // …by full widget id, which contains dots
     | DESCRIBE STYLING ON (PAGE | SNIPPET) qualifiedName (WIDGET IDENTIFIER)?  // DESCRIBE STYLING ON PAGE Module.Page [WIDGET name]
     | DESCRIBE CATALOG DOT (catalogTableName)  // DESCRIBE CATALOG.ENTITIES
     | DESCRIBE BUSINESS EVENT SERVICE qualifiedName  // DESCRIBE BUSINESS EVENT SERVICE Module.Name
@@ -210,6 +217,12 @@ describeStatement
     | DESCRIBE FRAGMENT identifierOrKeyword            // DESCRIBE FRAGMENT Name
     | DESCRIBE JAR DEPENDENCY (qualifiedName | IDENTIFIER) STRING_LITERAL   // DESCRIBE JAR DEPENDENCY ModuleName 'group:artifact'
     | DESCRIBE TRANSLATIONS (IN identifierOrKeyword)? FOR identifierOrKeyword   // DESCRIBE TRANSLATIONS [IN Module] FOR nl_NL
+    // R6: the single-thing reports that were `show` forms. Each builds the
+    // same statement as its `show` spelling (MDL-DEPR090).
+    | DESCRIBE APP SECURITY                                                     // DESCRIBE APP SECURITY
+    | DESCRIBE SECURITY MATRIX (IN (qualifiedName | IDENTIFIER))?              // DESCRIBE SECURITY MATRIX [IN Module]
+    | DESCRIBE STRUCTURE (DEPTH NUMBER_LITERAL)? (IN (qualifiedName | IDENTIFIER))? ALL?  // DESCRIBE STRUCTURE [DEPTH n] [IN Module] [ALL]
+    | DESCRIBE CONTEXT OF qualifiedName (DEPTH NUMBER_LITERAL)?                // DESCRIBE CONTEXT OF Module.Name [DEPTH n]
     | DESCRIBE qualifiedName    // DESCRIBE Module.Name — type auto-detected at execution time (must be LAST so all typed forms above win)
     ;
 
diff --git a/mdl/grammar/domains/MDLDomainModel.g4 b/mdl/grammar/domains/MDLDomainModel.g4
index 65ae1ff81e..f65ad231bd 100644
--- a/mdl/grammar/domains/MDLDomainModel.g4
+++ b/mdl/grammar/domains/MDLDomainModel.g4
@@ -258,20 +258,22 @@ alterEntitiesAction
     : docComment? ADD ATTRIBUTE ifNotExists? attributeDefinition
     ;
 
+attributeKw
+    : ATTRIBUTE
+    | COLUMN /* @alias MDL-DEPR093 */
+    ;
+
 entityPersistenceFilter
     : PERSISTENT
     | NON_PERSISTENT
     ;
 
 alterEntityAction
-    : docComment? ADD ATTRIBUTE ifNotExists? attributeDefinition
-    | docComment? ADD COLUMN ifNotExists? attributeDefinition
-    | RENAME ATTRIBUTE attributeName TO attributeName
-    | RENAME COLUMN attributeName TO attributeName
-    | MODIFY ATTRIBUTE attributeName COLON? dataType attributeConstraint*
-    | MODIFY COLUMN attributeName COLON? dataType attributeConstraint*
-    | DROP ATTRIBUTE ifExists? attributeName
-    | DROP COLUMN ifExists? attributeName
+    // R6: `column` is a deprecated synonym for `attribute` (MDL-DEPR093).
+    : docComment? ADD attributeKw ifNotExists? attributeDefinition
+    | RENAME attributeKw attributeName TO attributeName
+    | MODIFY attributeKw attributeName COLON? dataType attributeConstraint*
+    | DROP attributeKw ifExists? attributeName
     | DROP DEFAULT ON ATTRIBUTE attributeName   // clear an attribute's default value
     | SET DOCUMENTATION STRING_LITERAL
     | SET COMMENT STRING_LITERAL
diff --git a/mdl/grammar/domains/MDLMicroflow.g4 b/mdl/grammar/domains/MDLMicroflow.g4
index 88f5d00f45..3c6d68b090 100644
--- a/mdl/grammar/domains/MDLMicroflow.g4
+++ b/mdl/grammar/domains/MDLMicroflow.g4
@@ -769,7 +769,7 @@ validationFeedbackStatement
  * REST call statement for making HTTP requests to external APIs.
  */
 restCallStatement
-    : (VARIABLE EQUALS)? REST CALL httpMethod restCallUrl restCallUrlParams?
+    : (VARIABLE EQUALS)? restCallKw httpMethod restCallUrl restCallUrlParams?
       restCallHeaderClause*
       restCallAuthClause?
       restCallBodyClause?
@@ -778,6 +778,14 @@ restCallStatement
       onErrorClause?
     ;
 
+// R6: `call rest service`, Studio Pro's name for the activity, in the
+// `call <kind>` pattern every other call follows. `rest call` is a deprecated
+// alias (MDL-DEPR094).
+restCallKw
+    : CALL REST SERVICE
+    | REST CALL /* @alias MDL-DEPR094 */
+    ;
+
 httpMethod
     : GET
     | POST
diff --git a/mdl/grammar/domains/MDLSecurity.g4 b/mdl/grammar/domains/MDLSecurity.g4
index 95dcfedb9a..fe772d176f 100644
--- a/mdl/grammar/domains/MDLSecurity.g4
+++ b/mdl/grammar/domains/MDLSecurity.g4
@@ -30,7 +30,8 @@ createUserRoleStatement
 
 alterUserRoleStatement
     : ALTER USER ROLE identifierOrKeyword ADD MODULE ROLES LPAREN moduleRoleList RPAREN
-    | ALTER USER ROLE identifierOrKeyword REMOVE MODULE ROLES LPAREN moduleRoleList RPAREN
+    // R6: an alter's children are added and dropped; `remove` is the old verb.
+    | ALTER USER ROLE identifierOrKeyword (DROP | REMOVE /* @alias MDL-DEPR091 */) MODULE ROLES LPAREN moduleRoleList RPAREN
     ;
 
 // IF EXISTS makes a cleanup script re-runnable. Without it the statement fails
diff --git a/mdl/grammar/domains/MDLSettings.g4 b/mdl/grammar/domains/MDLSettings.g4
index f3c3ba2651..b18e331811 100644
--- a/mdl/grammar/domains/MDLSettings.g4
+++ b/mdl/grammar/domains/MDLSettings.g4
@@ -17,13 +17,13 @@ options { tokenVocab = MDLLexer; }
  * ALTER SETTINGS LANGUAGE Key = Value, ...;
  * ALTER SETTINGS LANGUAGE ADD [OR MODIFY] 'ar_SD' [(Key: Value, ...)];
  * ALTER SETTINGS LANGUAGE MODIFY 'ar_SD' (Key: Value, ...);
- * ALTER SETTINGS LANGUAGE REMOVE 'ar_SD';
+ * ALTER SETTINGS LANGUAGE DROP 'ar_SD';          (REMOVE is a deprecated alias)
  * ALTER SETTINGS WORKFLOWS Key = Value, ...;
  * ALTER SETTINGS WORKFLOWS ADD [OR MODIFY] GROUP 'Approvers' [(Description: '...')];
  * ALTER SETTINGS WORKFLOWS MODIFY GROUP 'Approvers' (Description: '...');
- * ALTER SETTINGS WORKFLOWS REMOVE GROUP 'Approvers';
+ * ALTER SETTINGS WORKFLOWS DROP GROUP 'Approvers'; (REMOVE is a deprecated alias)
  *
- * ADD/REMOVE name the ENABLED languages — the list Studio Pro shows under
+ * ADD/DROP name the ENABLED languages — the list Studio Pro shows under
  * App Settings > Languages, and the only languages a build emits anything for.
  * A language is identified by its code alone: Studio Pro's "Arabic, Sudan" is
  * derived from `ar_SD` for display and is not stored (verified against a
@@ -40,11 +40,11 @@ alterSettingsClause
     : settingsSection ADD OR MODIFY GROUP STRING_LITERAL settingsItemOptions?
     | settingsSection ADD GROUP STRING_LITERAL settingsItemOptions?
     | settingsSection MODIFY GROUP STRING_LITERAL settingsItemOptions
-    | settingsSection REMOVE GROUP STRING_LITERAL
+    | settingsSection (DROP | REMOVE /* @alias MDL-DEPR092 */) GROUP STRING_LITERAL
     | settingsSection ADD OR MODIFY STRING_LITERAL settingsItemOptions?
     | settingsSection ADD STRING_LITERAL settingsItemOptions?
     | settingsSection MODIFY STRING_LITERAL settingsItemOptions
-    | settingsSection REMOVE STRING_LITERAL
+    | settingsSection (DROP | REMOVE /* @alias MDL-DEPR092 */) STRING_LITERAL
     | settingsSection settingsAssignment (COMMA settingsAssignment)*
     | CONSTANT STRING_LITERAL (VALUE settingsValue | DROP) (IN CONFIGURATION STRING_LITERAL)?
     | DROP CONSTANT STRING_LITERAL (IN CONFIGURATION STRING_LITERAL)?
@@ -292,14 +292,17 @@ helpTopicWord
     ;
 
 /**
- * DEFINE FRAGMENT Name [($p: datasource, $q: action)] AS { widgets }
+ * CREATE FRAGMENT Name [($p: datasource, $q: action)] AS { widgets }
+ *
+ * R6: `create`, the verb every other definition uses; DEFINE is a deprecated
+ * alias (MDL-DEPR096). A fragment is still session-scoped and unqualified.
  *
  * Optional typed parameters let a fragment bind a datasource or an action
  * handler supplied by the caller (`use fragment Name ($p: $Data, $q: microflow M)`).
  * References in the body use the bare `$p` form in a datasource/action position.
  */
 defineFragmentStatement
-    : DEFINE FRAGMENT identifierOrKeyword fragmentParams? AS LBRACE pageBodyV3 RBRACE
+    : (CREATE | DEFINE /* @alias MDL-DEPR096 */) FRAGMENT identifierOrKeyword fragmentParams? AS LBRACE pageBodyV3 RBRACE
     ;
 
 fragmentParams
diff --git a/mdl/repl/repl.go b/mdl/repl/repl.go
index 430439fbd7..c62d1041d5 100644
--- a/mdl/repl/repl.go
+++ b/mdl/repl/repl.go
@@ -473,6 +473,8 @@ func (c *mdlCompleter) dynamicComplete(line, lineUpper string) ([][]rune, int) {
 		"SHOW MODULE ROLES IN ",
 		"SHOW SECURITY MATRIX IN ",
 		"SHOW STRUCTURE IN ",
+		"DESCRIBE SECURITY MATRIX IN ",
+		"DESCRIBE STRUCTURE IN ",
 		"SHOW WIDGETS IN ",
 		"SHOW DATABASE CONNECTIONS IN ",
 		"SHOW REST CLIENTS IN ",
diff --git a/mdl/upgrade/examples_test.go b/mdl/upgrade/examples_test.go
index 7aff1a46e5..1da2e70b2b 100644
--- a/mdl/upgrade/examples_test.go
+++ b/mdl/upgrade/examples_test.go
@@ -212,9 +212,12 @@ func TestUpgrade_ExamplesKeepTheirStatements(t *testing.T) {
 				t.Errorf("%s (%+v): upgraded output does not parse: %v", path, opts, errs[0])
 				continue
 			}
-			if len(got.Deprecations) > 0 {
-				t.Errorf("%s (%+v): upgraded output still records %d deprecation(s), first %s at line %d",
-					path, opts, len(got.Deprecations), got.Deprecations[0].Code, got.Deprecations[0].Line)
+			// A use the upgrade reported as unrewritable (Result.Unrewritten) stays,
+			// by contract: it is reported, never guessed at. Anything beyond those
+			// is a rewrite that did not produce the canonical form.
+			if len(got.Deprecations) > len(res.Unrewritten) {
+				t.Errorf("%s (%+v): upgraded output still records %d deprecation(s) (%d reported unrewritable), first %s at line %d",
+					path, opts, len(got.Deprecations), len(res.Unrewritten), got.Deprecations[0].Code, got.Deprecations[0].Line)
 			}
 			want, _ := visitor.Build(src)
 			foldModeFlags(want.Statements)
diff --git a/mdl/upgrade/r8_spellings_test.go b/mdl/upgrade/r8_spellings_test.go
index 03dbe6c1dc..6490d5419d 100644
--- a/mdl/upgrade/r8_spellings_test.go
+++ b/mdl/upgrade/r8_spellings_test.go
@@ -39,8 +39,8 @@ func TestUpgrade_R8Spellings(t *testing.T) {
 			"create association M.A_B from M.A to M.B ON DELETE CASCADE;\n"},
 		{"alter association M.A_B set delete_behavior delete but keep references error_message 'x';\n",
 			"alter association M.A_B set on delete set null error message 'x';\n"},
-		{"create microflow M.F () begin rest call get 'https://x.org' returns none; end;\n",
-			"create microflow M.F () begin rest call get 'https://x.org' returns nothing; end;\n"},
+		{"create microflow M.F () begin call rest service get 'https://x.org' returns none; end;\n",
+			"create microflow M.F () begin call rest service get 'https://x.org' returns nothing; end;\n"},
 	}
 	for _, c := range cases {
 		res := mustUpgrade(t, c.old, Options{})
diff --git a/mdl/upgrade/verbs_test.go b/mdl/upgrade/verbs_test.go
new file mode 100644
index 0000000000..0b3608d52d
--- /dev/null
+++ b/mdl/upgrade/verbs_test.go
@@ -0,0 +1,50 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package upgrade
+
+import (
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
+)
+
+// R6 (ako/mxcli#755): the old verbs are rewritten in place, in the letter case
+// the script uses; the `show` summaries with no describe equivalent are left
+// alone and reported.
+func TestUpgrade_R6Verbs(t *testing.T) {
+	src := "SHOW PROJECT SECURITY;\nshow security matrix in M;\nshow structure depth 2;\nshow context of M.F;\n" +
+		"show page M.P;\nshow entity M.E;\n" +
+		"alter user role Clerk remove module roles (M.User);\n" +
+		"alter settings workflows remove group 'Approvers';\n" +
+		"alter entity M.E add column Note: String(200), drop column Old;\n" +
+		"create microflow M.F () begin $R = REST CALL get 'https://x.org' returns string; end;\n" +
+		"describe widget combobox;\n" +
+		"define fragment Hdr as { dynamictext t (Content: 'x') };\n"
+	want := "DESCRIBE APP SECURITY;\ndescribe security matrix in M;\ndescribe structure depth 2;\ndescribe context of M.F;\n" +
+		"describe page M.P;\nshow entity M.E;\n" +
+		"alter user role Clerk drop module roles (M.User);\n" +
+		"alter settings workflows drop group 'Approvers';\n" +
+		"alter entity M.E add attribute Note: String(200), drop attribute Old;\n" +
+		"create microflow M.F () begin $R = CALL REST SERVICE get 'https://x.org' returns string; end;\n" +
+		"describe widget type combobox;\n" +
+		"create fragment Hdr as { dynamictext t (Content: 'x') };\n"
+	res := mustUpgrade(t, src, Options{})
+	if res.Source != want {
+		t.Fatalf("got:\n%s\nwant:\n%s", res.Source, want)
+	}
+	for code, n := range map[string]int{
+		deprecation.ShowSingleThing: 5, deprecation.UserRoleRemove: 1, deprecation.SettingsRemove: 1,
+		deprecation.ColumnForAttribute: 2, deprecation.RestCall: 1, deprecation.DescribeWidgetType: 1,
+		deprecation.DefineFragment: 1,
+	} {
+		if res.Rewritten[code] != n {
+			t.Errorf("Rewritten[%s] = %d, want %d (all: %v)", code, res.Rewritten[code], n, res.Rewritten)
+		}
+	}
+	if len(res.Unrewritten) != 1 || res.Unrewritten[0].Code != deprecation.ShowSingleThing || res.Unrewritten[0].Line != 6 {
+		t.Errorf("Unrewritten = %+v, want the `show entity` on line 6", res.Unrewritten)
+	}
+	if again := mustUpgrade(t, res.Source, Options{}); again.Changed() {
+		t.Errorf("second upgrade changed the script again: %v", again.Rewritten)
+	}
+}
diff --git a/mdl/visitor/r8_spellings_test.go b/mdl/visitor/r8_spellings_test.go
index 612bb81d2e..ce3bfaac5f 100644
--- a/mdl/visitor/r8_spellings_test.go
+++ b/mdl/visitor/r8_spellings_test.go
@@ -68,8 +68,8 @@ var r8Pairs = []r8Pair{
 	{"reference_set", "create association M.A_B from M.A to M.B type reference_set;",
 		"create association M.A_B from M.A to M.B type ReferenceSet;", deprecation.ReferenceSetUnderscore},
 
-	{"returns none", "create microflow M.F () begin rest call get 'https://x.org' returns none; end;",
-		"create microflow M.F () begin rest call get 'https://x.org' returns nothing; end;", deprecation.ReturnsNone},
+	{"returns none", "create microflow M.F () begin call rest service get 'https://x.org' returns none; end;",
+		"create microflow M.F () begin call rest service get 'https://x.org' returns nothing; end;", deprecation.ReturnsNone},
 }
 
 func TestR8OldSpellingsAreAliases(t *testing.T) {
diff --git a/mdl/visitor/visitor_deprecations.go b/mdl/visitor/visitor_deprecations.go
index 491ab7a6d2..fce12052c5 100644
--- a/mdl/visitor/visitor_deprecations.go
+++ b/mdl/visitor/visitor_deprecations.go
@@ -131,58 +131,94 @@ func (b *Builder) recordCreateOrReplace(ctx *parser.CreateStatementContext) {
 	b.recordDeprecation(deprecation.CreateOrReplace, ctx.REPLACE().GetSymbol(), kind)
 }
 
-// showNotYetList lists the showStatement forms whose decided canonical form is
-// NOT `list` (PROPOSAL_mdl_beta_syntax_freeze.md §3, R6): a single thing
-// becomes `describe`, session state a REPL command. Keyed on the token after
-// `show` (CATALOG only with STATUS, see showCanonicalIsList). `list` builds the
-// same statement for these today, but it is not their canonical form, so
-// recommending it would name the wrong form and make `fmt --upgrade` rewrite
-// them twice. They get their own registry entries once the canonical forms
-// exist (plan item 3.5). Pinned by TestShowRecordsDeprecation.
-var showNotYetList = map[int]bool{
-	parser.MDLParserENTITY:      true, // show entity X      -> describe entity X
-	parser.MDLParserASSOCIATION: true, // show association X -> describe association X
-	parser.MDLParserPAGE:        true, // show page X        -> describe page X
-	parser.MDLParserNAVIGATION:  true, // show navigation …  -> describe navigation
-	parser.MDLParserSTRUCTURE:   true, // show structure     -> describe structure
-	parser.MDLParserCONTEXT:     true, // show context of X  -> describe context of X
+// showKind is what the showStatement that follows `show` is, for R6
+// (PROPOSAL_mdl_beta_syntax_freeze.md §3): a plural or relationship query,
+// whose canonical verb is `list` (MDL-DEPR002); a single thing, whose
+// canonical verb is `describe` (MDL-DEPR090); or session state, which becomes
+// a REPL command (R7) and is not reported yet. Pinned by
+// TestShowRecordsDeprecation and TestShowSingleThingIsDescribe.
+type showKind int
+
+const (
+	showIsList showKind = iota
+	showIsDescribe
+	showIsSession
+)
+
+// showDescribeFirst lists the tokens after `show` that name one thing. Keyed
+// on the first token (NAVIGATION is refined below: `navigation homes` is a
+// list).
+var showDescribeFirst = map[int]bool{
+	parser.MDLParserENTITY:      true, // show entity X        -> describe entity X
+	parser.MDLParserASSOCIATION: true, // show association X   -> describe association X
+	parser.MDLParserPAGE:        true, // show page X          -> describe page X
+	parser.MDLParserNAVIGATION:  true, // show navigation …    -> describe navigation
+	parser.MDLParserSTRUCTURE:   true, // show structure       -> describe structure
+	parser.MDLParserCONTEXT:     true, // show context of X    -> describe context of X
 	parser.MDLParserPROJECT:     true, // show project security -> describe app security
-	parser.MDLParserSECURITY:    true, // show security matrix  -> describe security matrix
-	parser.MDLParserSETTINGS:    true, // show settings      -> describe (one thing)
-	parser.MDLParserVERSION:     true, // session state      -> REPL command (R7)
-	parser.MDLParserSTATUS:      true, // session state      -> REPL command (R7)
-	parser.MDLParserCONNECTIONS: true, // session state      -> REPL command (R7)
+	parser.MDLParserSECURITY:    true, // show security matrix -> describe security matrix
+	parser.MDLParserSETTINGS:    true, // show settings        -> describe settings
 }
 
-// showCanonicalIsList reports whether the showStatement that ctx starts is a
-// form whose canonical spelling is `list` (plurals and relationship queries).
-func showCanonicalIsList(ctx *parser.ShowOrListContext) bool {
+// showSession lists the session-state forms (R7): not reported until the REPL
+// commands that replace them exist.
+var showSession = map[int]bool{
+	parser.MDLParserVERSION:     true,
+	parser.MDLParserSTATUS:      true,
+	parser.MDLParserCONNECTIONS: true,
+}
+
+// showStatementKind classifies the showStatement that ctx starts.
+func showStatementKind(ctx *parser.ShowOrListContext) showKind {
 	stmt, ok := ctx.GetParent().(*parser.ShowStatementContext)
 	if !ok || stmt.GetChildCount() < 2 {
-		return true
+		return showIsList
 	}
-	next := func(i int) int {
-		if i >= stmt.GetChildCount() {
-			return antlr.TokenInvalidType
-		}
-		if tn, ok := stmt.GetChild(i).(antlr.TerminalNode); ok {
-			return tn.GetSymbol().GetTokenType()
+	first := tokenTypeAt(stmt, 1)
+	switch {
+	case first == parser.MDLParserCATALOG:
+		if tokenTypeAt(stmt, 2) == parser.MDLParserSTATUS {
+			return showIsSession // catalog status is session state
 		}
+		return showIsList
+	case first == parser.MDLParserNAVIGATION && stmt.HOMES() != nil:
+		return showIsList
+	case showSession[first]:
+		return showIsSession
+	case showDescribeFirst[first]:
+		return showIsDescribe
+	}
+	return showIsList
+}
+
+// tokenTypeAt is the token type of stmt's i-th child, or TokenInvalidType when
+// it is not a terminal.
+func tokenTypeAt(stmt antlr.ParserRuleContext, i int) int {
+	if i >= stmt.GetChildCount() {
 		return antlr.TokenInvalidType
 	}
-	first := next(1)
-	if first == parser.MDLParserCATALOG {
-		return next(2) != parser.MDLParserSTATUS // catalog status is session state
+	if tn, ok := stmt.GetChild(i).(antlr.TerminalNode); ok {
+		return tn.GetSymbol().GetTokenType()
 	}
-	return !showNotYetList[first]
+	return antlr.TokenInvalidType
 }
 
-// ExitShowOrList records MDL-DEPR002 for `show` where its canonical form is
-// `list`. showOrList is used only by showStatement, where `show` and `list`
-// build the same statement.
+// ExitShowOrList records the deprecated `show`: MDL-DEPR002 where its
+// canonical form is `list`, MDL-DEPR090 where it is `describe` (for `list`
+// as well: a single thing is described, not listed). showOrList is
+// used only by showStatement, where `show` and `list` build the same
+// statement.
 func (b *Builder) ExitShowOrList(ctx *parser.ShowOrListContext) {
-	if ctx == nil || ctx.SHOW() == nil || !showCanonicalIsList(ctx) {
+	if ctx == nil {
 		return
 	}
-	b.recordDeprecation(deprecation.Show, ctx.SHOW().GetSymbol(), "")
+	switch showStatementKind(ctx) {
+	case showIsList:
+		if ctx.SHOW() != nil {
+			b.recordDeprecation(deprecation.Show, ctx.SHOW().GetSymbol(), "")
+		}
+	case showIsDescribe:
+		// `list entity X` names one thing too, so it is reported with `show`.
+		b.recordShowSingleThing(ctx)
+	}
 }
diff --git a/mdl/visitor/visitor_deprecations_test.go b/mdl/visitor/visitor_deprecations_test.go
index 34aa6436c7..da9e36b7bc 100644
--- a/mdl/visitor/visitor_deprecations_test.go
+++ b/mdl/visitor/visitor_deprecations_test.go
@@ -259,22 +259,24 @@ func TestShowRecordsDeprecation(t *testing.T) {
 		{"show access on M.E;", []string{deprecation.Show}},
 		{"show design properties;", []string{deprecation.Show}},
 		{"show widgets;", []string{deprecation.Show}},
-		// Not reported: the decided canonical form of these is NOT `list`
-		// (PROPOSAL_mdl_beta_syntax_freeze.md §3, R6). Single things become
-		// `describe`, session state a REPL command, so `list entity M.E` or
-		// `list version` would name a non-canonical form and make
-		// `fmt --upgrade` rewrite them twice.
-		{"show entity M.E;", nil},
-		{"show association M.A;", nil},
-		{"show page M.P;", nil},
-		{"show navigation;", nil},
-		{"show navigation homes;", nil},
-		{"show navigation menu M.Nav;", nil},
-		{"show structure depth 2 in M;", nil},
-		{"show context of M.MF;", nil},
-		{"show project security;", nil},
-		{"show security matrix in M;", nil},
-		{"show settings;", nil},
+		// A single thing is described, not listed (PROPOSAL_mdl_beta_syntax_freeze.md
+		// §3, R6): MDL-DEPR090, never MDL-DEPR002, so `fmt --upgrade` does
+		// not rewrite them to a `list` that is not canonical either. `list`
+		// on these forms is reported too.
+		{"show entity M.E;", []string{deprecation.ShowSingleThing}},
+		{"show association M.A;", []string{deprecation.ShowSingleThing}},
+		{"show page M.P;", []string{deprecation.ShowSingleThing}},
+		{"list page M.P;", []string{deprecation.ShowSingleThing}},
+		{"show navigation;", []string{deprecation.ShowSingleThing}},
+		{"show navigation homes;", []string{deprecation.Show}},
+		{"list navigation homes;", nil},
+		{"show navigation menu M.Nav;", []string{deprecation.ShowSingleThing}},
+		{"show structure depth 2 in M;", []string{deprecation.ShowSingleThing}},
+		{"show context of M.MF;", []string{deprecation.ShowSingleThing}},
+		{"show project security;", []string{deprecation.ShowSingleThing}},
+		{"show security matrix in M;", []string{deprecation.ShowSingleThing}},
+		{"show settings;", []string{deprecation.ShowSingleThing}},
+		// Session state becomes a REPL command (R7), not reported until then.
 		{"show version;", nil},
 		{"show status;", nil},
 		{"show connections;", nil},
diff --git a/mdl/visitor/visitor_document_names_test.go b/mdl/visitor/visitor_document_names_test.go
index 4b00ed67a6..97048f8dbe 100644
--- a/mdl/visitor/visitor_document_names_test.go
+++ b/mdl/visitor/visitor_document_names_test.go
@@ -93,7 +93,9 @@ func TestDocumentTypeNamesLeaveOtherUsesAlone(t *testing.T) {
 		"create microflow M.F () begin call microflow M.G() in queue M.Jobs; end;",
 		"drop published rest service M.Api;",
 		"list consumed mcp services;",
-		"show project security;",
+		// `project security` after `show` is R6's MDL-DEPR090 (the whole
+		// phrase becomes `describe app security`), not R10's name alias.
+		"describe app security;",
 		"alter settings workflows UserEntity = 'System.User';",
 	} {
 		t.Run(src, func(t *testing.T) {
diff --git a/mdl/visitor/visitor_entity.go b/mdl/visitor/visitor_entity.go
index 1811689b7f..d26ca47e46 100644
--- a/mdl/visitor/visitor_entity.go
+++ b/mdl/visitor/visitor_entity.go
@@ -619,7 +619,7 @@ func (b *Builder) ExitAlterEntityAction(ctx *parser.AlterEntityActionContext) {
 			attrNames := ctx.AllAttributeName()
 
 			// ADD ATTRIBUTE / ADD COLUMN
-			if ctx.ADD() != nil && (ctx.ATTRIBUTE() != nil || ctx.COLUMN() != nil) {
+			if ctx.ADD() != nil && ctx.AttributeKw() != nil {
 				if attrDef := ctx.AttributeDefinition(); attrDef != nil {
 					attr := buildSingleAttribute(attrDef.(*parser.AttributeDefinitionContext))
 					// A `/** … */` doc comment written BETWEEN clauses (before the
@@ -645,7 +645,7 @@ func (b *Builder) ExitAlterEntityAction(ctx *parser.AlterEntityActionContext) {
 			}
 
 			// RENAME ATTRIBUTE / RENAME COLUMN
-			if ctx.RENAME() != nil && (ctx.ATTRIBUTE() != nil || ctx.COLUMN() != nil) && len(attrNames) >= 2 {
+			if ctx.RENAME() != nil && ctx.AttributeKw() != nil && len(attrNames) >= 2 {
 				b.statements = append(b.statements, &ast.AlterEntityStmt{
 					Name:          name,
 					Operation:     ast.AlterEntityRenameAttribute,
@@ -656,7 +656,7 @@ func (b *Builder) ExitAlterEntityAction(ctx *parser.AlterEntityActionContext) {
 			}
 
 			// MODIFY ATTRIBUTE / MODIFY COLUMN
-			if ctx.MODIFY() != nil && (ctx.ATTRIBUTE() != nil || ctx.COLUMN() != nil) && len(attrNames) >= 1 {
+			if ctx.MODIFY() != nil && ctx.AttributeKw() != nil && len(attrNames) >= 1 {
 				dt := buildDataType(ctx.DataType())
 				stmt := &ast.AlterEntityStmt{
 					Name:          name,
@@ -714,7 +714,7 @@ func (b *Builder) ExitAlterEntityAction(ctx *parser.AlterEntityActionContext) {
 			}
 
 			// DROP ATTRIBUTE / DROP COLUMN
-			if ctx.DROP() != nil && (ctx.ATTRIBUTE() != nil || ctx.COLUMN() != nil) && len(attrNames) >= 1 {
+			if ctx.DROP() != nil && ctx.AttributeKw() != nil && len(attrNames) >= 1 {
 				b.statements = append(b.statements, &ast.AlterEntityStmt{
 					Name:          name,
 					Operation:     ast.AlterEntityDropAttribute,
diff --git a/mdl/visitor/visitor_query.go b/mdl/visitor/visitor_query.go
index aac02877eb..bc40bc1b57 100644
--- a/mdl/visitor/visitor_query.go
+++ b/mdl/visitor/visitor_query.go
@@ -817,6 +817,14 @@ func (b *Builder) ExitDescribeStatement(ctx *parser.DescribeStatementContext) {
 		return
 	}
 
+	// R6: the single-thing reports that were `show` forms. Each builds the
+	// statement its `show` spelling builds, so the two are one statement and
+	// `show` is a pure alias (MDL-DEPR090).
+	if stmt := describeReport(ctx); stmt != nil {
+		b.statements = append(b.statements, stmt)
+		return
+	}
+
 	// DESCRIBE GLYPH 57350 | DESCRIBE GLYPH 'star'. Placed with the other
 	// no-document statements: a glyph is a character code in a font, so it has no
 	// qualified name for the chain below to build.
@@ -1403,3 +1411,47 @@ func (b *Builder) ExitUpdateStatement(ctx *parser.UpdateStatementContext) {
 // ----------------------------------------------------------------------------
 // Helper Functions
 // ----------------------------------------------------------------------------
+
+// describeReport builds `describe app security`, `describe security matrix`,
+// `describe structure` and `describe context of`: the same statements as their
+// `show` spellings (see ExitShowStatement). Nil for every other describe.
+func describeReport(ctx *parser.DescribeStatementContext) ast.Statement {
+	inModule := func() string {
+		if ctx.IN() == nil {
+			return ""
+		}
+		if qn := ctx.QualifiedName(); qn != nil {
+			return getQualifiedNameText(qn)
+		}
+		if id := ctx.IDENTIFIER(); id != nil {
+			return id.GetText()
+		}
+		return ""
+	}
+	depth := func() int {
+		if ctx.DEPTH() != nil {
+			if n := ctx.NUMBER_LITERAL(); n != nil {
+				if d, err := strconv.Atoi(n.GetText()); err == nil {
+					return d
+				}
+			}
+		}
+		return 2
+	}
+	switch {
+	case ctx.APP() != nil && ctx.SECURITY() != nil:
+		return &ast.ShowStmt{ObjectType: ast.ShowProjectSecurity}
+	case ctx.SECURITY() != nil && ctx.MATRIX() != nil:
+		return &ast.ShowStmt{ObjectType: ast.ShowSecurityMatrix, InModule: inModule()}
+	case ctx.STRUCTURE() != nil && ctx.JSON() == nil:
+		return &ast.ShowStmt{ObjectType: ast.ShowStructure, Depth: depth(), All: ctx.ALL() != nil, InModule: inModule()}
+	case ctx.CONTEXT() != nil && ctx.OF() != nil:
+		qn := ctx.QualifiedName()
+		if qn == nil {
+			return nil
+		}
+		name := buildQualifiedName(qn)
+		return &ast.ShowStmt{ObjectType: ast.ShowContext, Name: &name, Depth: depth()}
+	}
+	return nil
+}
diff --git a/mdl/visitor/visitor_settings.go b/mdl/visitor/visitor_settings.go
index 2d601cb6d3..79ad75c262 100644
--- a/mdl/visitor/visitor_settings.go
+++ b/mdl/visitor/visitor_settings.go
@@ -68,25 +68,25 @@ func (b *Builder) ExitAlterSettingsClause(ctx *parser.AlterSettingsClauseContext
 	} else if ctx.SettingsSection() != nil && ctx.GROUP() != nil {
 		// ALTER SETTINGS WORKFLOWS ADD [OR MODIFY] GROUP 'Approvers' [( Description: '…' )]
 		// ALTER SETTINGS WORKFLOWS MODIFY          GROUP 'Approvers'  ( Description: '…' )
-		// ALTER SETTINGS WORKFLOWS REMOVE          GROUP 'Approvers'
+		// ALTER SETTINGS WORKFLOWS DROP            GROUP 'Approvers' (REMOVE: MDL-DEPR092)
 		stmt.Section = settingsSectionName(ctx.SettingsSection())
 		stmt.UpsertGroup = ctx.ADD() != nil && ctx.OR() != nil && ctx.MODIFY() != nil
 		stmt.AddGroup = ctx.ADD() != nil && !stmt.UpsertGroup
 		stmt.ModifyGroup = ctx.MODIFY() != nil && !stmt.UpsertGroup
-		stmt.RemoveGroup = ctx.REMOVE() != nil
+		stmt.RemoveGroup = ctx.DROP() != nil || ctx.REMOVE() != nil
 		if all := ctx.AllSTRING_LITERAL(); len(all) > 0 {
 			stmt.GroupName = unquoteStringLit(all[0])
 		}
 		collectSettingsItemOptions(ctx.SettingsItemOptions(), stmt.Properties)
-	} else if ctx.SettingsSection() != nil && (ctx.ADD() != nil || ctx.MODIFY() != nil || ctx.REMOVE() != nil) {
+	} else if ctx.SettingsSection() != nil && (ctx.ADD() != nil || ctx.MODIFY() != nil || ctx.DROP() != nil || ctx.REMOVE() != nil) {
 		// ALTER SETTINGS LANGUAGE ADD    'ar_SD' [( key: value, … )]
 		// ALTER SETTINGS LANGUAGE MODIFY 'ar_SD'  ( key: value, … )
-		// ALTER SETTINGS LANGUAGE REMOVE 'ar_SD'
+		// ALTER SETTINGS LANGUAGE DROP   'ar_SD' (REMOVE: MDL-DEPR092)
 		stmt.Section = settingsSectionName(ctx.SettingsSection())
 		stmt.UpsertLanguage = ctx.ADD() != nil && ctx.OR() != nil && ctx.MODIFY() != nil
 		stmt.AddLanguage = ctx.ADD() != nil && !stmt.UpsertLanguage
 		stmt.ModifyLanguage = ctx.MODIFY() != nil && !stmt.UpsertLanguage
-		stmt.RemoveLanguage = ctx.REMOVE() != nil
+		stmt.RemoveLanguage = ctx.DROP() != nil || ctx.REMOVE() != nil
 		if all := ctx.AllSTRING_LITERAL(); len(all) > 0 {
 			stmt.LanguageCode = unquoteStringLit(all[0])
 		}
diff --git a/mdl/visitor/visitor_verbs.go b/mdl/visitor/visitor_verbs.go
new file mode 100644
index 0000000000..17ab28badc
--- /dev/null
+++ b/mdl/visitor/visitor_verbs.go
@@ -0,0 +1,113 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package visitor
+
+import (
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
+	"github.com/mendixlabs/mxcli/mdl/grammar/parser"
+)
+
+// R6 (PROPOSAL_mdl_beta_syntax_freeze.md §3; ADR-0010): one verb per job.
+// `show` is split between `list` and `describe`, an alter's children are
+// added and dropped, and the words that broke a pattern (`rest call`,
+// `define fragment`, `describe widget <name>`, the `column` synonym) take the
+// pattern's word. Every old spelling builds the same statement as its
+// replacement, so the parse tree is the only place it is visible: the
+// listeners below record it (codes MDL-DEPR090..096).
+
+// showNoRewrite says why a single-thing `show` has no mechanical rewrite: its
+// summary is not what `describe` prints, so rewriting it would change the
+// output. Keyed on the token after `show`.
+var showNoRewrite = map[int]string{
+	parser.MDLParserENTITY: "`show entity` prints a summary table, `describe entity` the full definition as MDL; " +
+		"replace it by hand",
+	parser.MDLParserASSOCIATION: "`show association` prints a summary, `describe association` the full definition " +
+		"as MDL; replace it by hand",
+	parser.MDLParserNAVIGATION: "`show navigation` prints a summary table, `describe navigation` the full " +
+		"definition as MDL; replace it by hand",
+	parser.MDLParserSETTINGS: "`show settings` prints a summary table, `describe settings` the full definition " +
+		"as MDL; replace it by hand",
+}
+
+// recordShowSingleThing records MDL-DEPR090 for `show` (or `list`) on a form
+// that names one thing, with the rewrite to `describe` where the describe
+// statement is the same statement: page, app security, security matrix,
+// structure and context.
+func (b *Builder) recordShowSingleThing(ctx *parser.ShowOrListContext) {
+	stmt, ok := ctx.GetParent().(*parser.ShowStatementContext)
+	if !ok {
+		return
+	}
+	verb := ctx.GetStart()
+	b.recordDeprecation(deprecation.ShowSingleThing, verb, "")
+	first := tokenTypeAt(stmt, 1)
+	if why, ok := showNoRewrite[first]; ok {
+		if first == parser.MDLParserNAVIGATION && stmt.MENU_KW() != nil {
+			why = "`show navigation menu` prints the menu tree, `describe navigation` the profile as MDL; replace it by hand"
+		}
+		b.fixLastDeprecation(deprecation.ShowSingleThing, nil, why)
+		return
+	}
+	edit := replaceSpan(verb, verb, keywordLike(verb.GetText(), "describe"))
+	if first == parser.MDLParserPROJECT {
+		// `show project security` -> `describe app security` (R10's name).
+		edit = replaceSpan(verb, stmt.SECURITY().GetSymbol(), keywordLike(verb.GetText(), "describe app security"))
+	}
+	b.fixLastDeprecation(deprecation.ShowSingleThing, &ast.Fix{Edits: []ast.TextEdit{edit}}, "")
+}
+
+// EnterAlterUserRoleStatement records `remove module roles` for `drop module
+// roles`.
+func (b *Builder) EnterAlterUserRoleStatement(ctx *parser.AlterUserRoleStatementContext) {
+	if ctx.REMOVE() != nil {
+		b.recordDeprecation(deprecation.UserRoleRemove, ctx.REMOVE().GetSymbol(), "")
+	}
+}
+
+// EnterAlterSettingsClause records `remove` on a language or workflow group.
+func (b *Builder) EnterAlterSettingsClause(ctx *parser.AlterSettingsClauseContext) {
+	if ctx.REMOVE() != nil {
+		b.recordDeprecation(deprecation.SettingsRemove, ctx.REMOVE().GetSymbol(), "")
+	}
+}
+
+// ExitAttributeKw records `column` for `attribute` in alter entity.
+func (b *Builder) ExitAttributeKw(ctx *parser.AttributeKwContext) {
+	if ctx.COLUMN() != nil {
+		b.recordDeprecation(deprecation.ColumnForAttribute, ctx.COLUMN().GetSymbol(), "")
+	}
+}
+
+// ExitRestCallKw records `rest call` for `call rest service`, rewriting both
+// words at once in the letter case of the first.
+func (b *Builder) ExitRestCallKw(ctx *parser.RestCallKwContext) {
+	if ctx.REST() == nil || ctx.CALL() == nil || ctx.SERVICE() != nil {
+		return
+	}
+	first := ctx.REST().GetSymbol()
+	b.recordDeprecation(deprecation.RestCall, first, "")
+	edit := replaceSpan(first, ctx.CALL().GetSymbol(), keywordLike(first.GetText(), "call rest service"))
+	b.fixLastDeprecation(deprecation.RestCall, &ast.Fix{Edits: []ast.TextEdit{edit}}, "")
+}
+
+// EnterDescribeStatement records `describe widget <name>` for `describe widget
+// type <name>`. Only the widget-definition forms: `describe styling … widget`
+// and `describe fragment … widget` name a widget on a page, which is the
+// reading `type` exists to keep apart.
+func (b *Builder) EnterDescribeStatement(ctx *parser.DescribeStatementContext) {
+	if ctx.WIDGET() == nil || ctx.TYPE() != nil || ctx.STYLING() != nil || ctx.FRAGMENT() != nil {
+		return
+	}
+	w := ctx.WIDGET().GetSymbol()
+	b.recordDeprecation(deprecation.DescribeWidgetType, w, "")
+	edit := insertAt(w.GetStop()+1, " "+keywordLike(w.GetText(), "type"))
+	b.fixLastDeprecation(deprecation.DescribeWidgetType, &ast.Fix{Edits: []ast.TextEdit{edit}}, "")
+}
+
+// EnterDefineFragmentStatement records `define fragment` for `create fragment`.
+func (b *Builder) EnterDefineFragmentStatement(ctx *parser.DefineFragmentStatementContext) {
+	if ctx.DEFINE() != nil {
+		b.recordDeprecation(deprecation.DefineFragment, ctx.DEFINE().GetSymbol(), "")
+	}
+}
diff --git a/mdl/visitor/visitor_verbs_test.go b/mdl/visitor/visitor_verbs_test.go
new file mode 100644
index 0000000000..7a0d822980
--- /dev/null
+++ b/mdl/visitor/visitor_verbs_test.go
@@ -0,0 +1,108 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package visitor
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
+)
+
+// R6 (ako/mxcli#755): every old verb builds exactly the statement its
+// canonical spelling builds, records its code, and the canonical spelling
+// records nothing. The registry test covers one example per code; these cover
+// every grammar alternative the alias appears in.
+func TestR6OldVerbsAreAliases(t *testing.T) {
+	cases := []struct {
+		old, canonical, code string
+	}{
+		{"show page M.P;", "describe page M.P;", deprecation.ShowSingleThing},
+		{"show project security;", "describe app security;", deprecation.ShowSingleThing},
+		{"list project security;", "describe app security;", deprecation.ShowSingleThing},
+		{"show security matrix;", "describe security matrix;", deprecation.ShowSingleThing},
+		{"show security matrix in M;", "describe security matrix in M;", deprecation.ShowSingleThing},
+		{"show structure;", "describe structure;", deprecation.ShowSingleThing},
+		{"show structure depth 3 in M all;", "describe structure depth 3 in M all;", deprecation.ShowSingleThing},
+		{"show context of M.F;", "describe context of M.F;", deprecation.ShowSingleThing},
+		{"show context of M.F depth 4;", "describe context of M.F depth 4;", deprecation.ShowSingleThing},
+		{"alter user role Clerk remove module roles (M.User, M.Admin);",
+			"alter user role Clerk drop module roles (M.User, M.Admin);", deprecation.UserRoleRemove},
+		{"alter settings language remove 'ar_SD';", "alter settings language drop 'ar_SD';", deprecation.SettingsRemove},
+		{"alter settings workflows remove group 'Approvers';",
+			"alter settings workflows drop group 'Approvers';", deprecation.SettingsRemove},
+		{"alter entity M.E add column Note: String(200);", "alter entity M.E add attribute Note: String(200);",
+			deprecation.ColumnForAttribute},
+		{"alter entity M.E rename column Note to Remark;", "alter entity M.E rename attribute Note to Remark;",
+			deprecation.ColumnForAttribute},
+		{"alter entity M.E modify column Note: String(400);", "alter entity M.E modify attribute Note: String(400);",
+			deprecation.ColumnForAttribute},
+		{"alter entity M.E drop column if exists Note;", "alter entity M.E drop attribute if exists Note;",
+			deprecation.ColumnForAttribute},
+		{"create microflow M.F () begin rest call post 'https://x.org' body '{}' timeout 30 returns nothing; end;",
+			"create microflow M.F () begin call rest service post 'https://x.org' body '{}' timeout 30 returns nothing; end;",
+			deprecation.RestCall},
+		{"describe widget combobox;", "describe widget type combobox;", deprecation.DescribeWidgetType},
+		{"describe widget 'com.mendix.widget.web.combobox.Combobox';",
+			"describe widget type 'com.mendix.widget.web.combobox.Combobox';", deprecation.DescribeWidgetType},
+		{"define fragment Hdr ($p: datasource) as { dynamictext t (Content: 'x') };",
+			"create fragment Hdr ($p: datasource) as { dynamictext t (Content: 'x') };", deprecation.DefineFragment},
+	}
+	for _, c := range cases {
+		t.Run(c.old, func(t *testing.T) {
+			old := mustBuild(t, c.old)
+			if got := deprecationCodes(old); !reflect.DeepEqual(got, []string{c.code}) {
+				t.Errorf("old recorded %v, want [%s]", got, c.code)
+			}
+			canon := mustBuild(t, c.canonical)
+			if got := deprecationCodes(canon); len(got) != 0 {
+				t.Errorf("canonical recorded %v, want none", got)
+			}
+			if len(old.Statements) != 1 || !reflect.DeepEqual(old.Statements, canon.Statements) {
+				t.Errorf("old and canonical build different statements:\n old:   %#v\n canon: %#v",
+					old.Statements, canon.Statements)
+			}
+		})
+	}
+}
+
+// `show entity|association|navigation|settings` print a summary where
+// describe prints the definition as MDL: deprecated, but they keep their
+// statement and carry no rewrite, only the reason.
+func TestR6ShowSummariesAreReportedWithoutRewrite(t *testing.T) {
+	for _, src := range []string{
+		"show entity M.E;", "show association M.A;", "show navigation;",
+		"show navigation menu Responsive;", "show settings;",
+	} {
+		t.Run(src, func(t *testing.T) {
+			prog := mustBuild(t, src)
+			if len(prog.Deprecations) != 1 || prog.Deprecations[0].Code != deprecation.ShowSingleThing {
+				t.Fatalf("recorded %+v, want one %s", prog.Deprecations, deprecation.ShowSingleThing)
+			}
+			d := prog.Deprecations[0]
+			if d.Fix != nil || d.NoFix == "" {
+				t.Errorf("Fix = %+v, NoFix = %q; want no fix and a reason", d.Fix, d.NoFix)
+			}
+		})
+	}
+}
+
+// The words that stay: a widget on a page (`describe styling … widget`,
+// `describe fragment … widget`), `drop` as the canonical verb, and a plain
+// `describe widget type`.
+func TestR6CanonicalFormsRecordNothing(t *testing.T) {
+	for _, src := range []string{
+		"describe styling on page M.P widget btn1;",
+		"describe fragment from page M.P widget btn1;",
+		"describe widget type combobox;",
+		"alter entity M.E drop default on attribute Note;",
+		"create association M.A_B from M.A to M.B type Reference storage column;",
+		"list navigation homes;",
+	} {
+		t.Run(src, func(t *testing.T) {
+			if got := deprecationCodes(mustBuild(t, src)); len(got) != 0 {
+				t.Errorf("recorded %v, want none", got)
+			}
+		})
+	}
+}

From bf0d1d38df2171f9fc7f58510b1012ca9fe81469 Mon Sep 17 00:00:00 2001
From: Ako <andrej@koelewijn.net>
Date: Mon, 28 Sep 2026 06:54:50 +0000
Subject: [PATCH 15/35] fix(grammar): a misspelt statement keyword is an error
 at the word (R7)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

helpStatement was IDENTIFIER helpTopicWord*, the grammar's catch-all: any
statement starting with an unknown word parsed as a help topic and the visitor
dropped it, so 'craete module Foo;' was a silent no-op and 'craete entity
M.E (...)' reported its error at the '('. A predicate limits the rule to
help/exit/quit, and a statement that starts with an unknown word reports
"unknown statement 'craete' — did you mean 'create'?" at the word.

Part of #755.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 mdl/grammar/MDLParser.g4                     | 30 +++++++++++
 mdl/grammar/domains/MDLSettings.g4           |  7 ++-
 mdl/visitor/visitor.go                       |  5 +-
 mdl/visitor/visitor_session_commands_test.go | 52 +++++++++++++++++++
 mdl/visitor/visitor_unknown_statement.go     | 53 ++++++++++++++++++++
 5 files changed, 145 insertions(+), 2 deletions(-)
 create mode 100644 mdl/visitor/visitor_session_commands_test.go
 create mode 100644 mdl/visitor/visitor_unknown_statement.go

diff --git a/mdl/grammar/MDLParser.g4 b/mdl/grammar/MDLParser.g4
index 28fe0f0230..24bc7b5127 100644
--- a/mdl/grammar/MDLParser.g4
+++ b/mdl/grammar/MDLParser.g4
@@ -14,6 +14,36 @@ options {
     tokenVocab = MDLLexer;
 }
 
+// Hand-written parser helpers. In the Go target `@members` is package-level
+// code; the predicates in the imported grammars call it by name.
+@parser::members {
+// IsHelpWord reports whether word begins a help statement: `help`, `exit` or
+// `quit`, in any letter case. They are IDENTIFIERs rather than keywords, so
+// that reserving them does not take the words away as names; the predicate
+// on helpStatement is what keeps that rule from being the grammar's
+// catch-all, where a misspelt statement keyword (`craete entity …`) parsed
+// as a help topic and was silently dropped (ako/mxcli#755, R7).
+//
+// The generated file imports no strings package, so the letter case is folded
+// here by hand; the words are ASCII.
+func IsHelpWord(word string) bool {
+	if len(word) != 4 {
+		return false
+	}
+	folded := []byte(word)
+	for i, c := range folded {
+		if c >= 'A' && c <= 'Z' {
+			folded[i] = c + ('a' - 'A')
+		}
+	}
+	switch string(folded) {
+	case "help", "exit", "quit":
+		return true
+	}
+	return false
+}
+}
+
 import
     MDLDomainModel,
     MDLMicroflow,
diff --git a/mdl/grammar/domains/MDLSettings.g4 b/mdl/grammar/domains/MDLSettings.g4
index f3c3ba2651..cc0475bac3 100644
--- a/mdl/grammar/domains/MDLSettings.g4
+++ b/mdl/grammar/domains/MDLSettings.g4
@@ -283,7 +283,12 @@ linkMapping
  * CREATE MODULE ROLE alternative wins as it did before.
  */
 helpStatement
-    : IDENTIFIER (helpTopicWord (DOT? helpTopicWord)*)?  // HELP [topic]
+    // Only `help`, `exit` and `quit` start one (IsHelpWord, MDLParser.g4).
+    // Without the predicate every IDENTIFIER did, so `craete entity M.E;`
+    // was a help statement with a topic, parsed without error and dropped
+    // (ako/mxcli#755, R7).
+    : {IsHelpWord(p.GetTokenStream().LT(1).GetText())}?
+      IDENTIFIER (helpTopicWord (DOT? helpTopicWord)*)?  // HELP [topic]
     ;
 
 helpTopicWord
diff --git a/mdl/visitor/visitor.go b/mdl/visitor/visitor.go
index c178beee41..0f0ee1e36c 100644
--- a/mdl/visitor/visitor.go
+++ b/mdl/visitor/visitor.go
@@ -35,11 +35,14 @@ func newErrorListener() *errorListener {
 }
 
 // SyntaxError is called by ANTLR when a syntax error is encountered.
-func (l *errorListener) SyntaxError(_ antlr.Recognizer, _ any, line, column int, msg string, _ antlr.RecognitionException) {
+func (l *errorListener) SyntaxError(rec antlr.Recognizer, sym any, line, column int, msg string, _ antlr.RecognitionException) {
 	offending := ""
 	if line >= 1 && line <= len(l.source) {
 		offending = l.source[line-1]
 	}
+	if word, ok := unknownStatementWord(rec, sym, msg); ok {
+		msg = unknownStatementMessage(word)
+	}
 	enhancedMsg := l.deduplicateHint(enhanceErrorMessage(msg, offending), line)
 	l.errors = append(l.errors, fmt.Errorf("line %d:%d %s", line, column, enhancedMsg))
 }
diff --git a/mdl/visitor/visitor_session_commands_test.go b/mdl/visitor/visitor_session_commands_test.go
new file mode 100644
index 0000000000..87acd33a99
--- /dev/null
+++ b/mdl/visitor/visitor_session_commands_test.go
@@ -0,0 +1,52 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package visitor
+
+import (
+	"strings"
+	"testing"
+)
+
+// R7 (ako/mxcli#755): `helpStatement` was `IDENTIFIER helpTopicWord*`, the
+// grammar's catch-all, so a misspelt statement keyword was a HELP statement.
+// `craete module Foo;` parsed cleanly into nothing at all — the visitor dropped
+// a help statement whose word was not help/exit/quit — and `craete entity
+// M.E (…)` reported its error at the `(`, far from the typo.
+func TestMisspeltStatementKeywordIsAnErrorAtTheWord(t *testing.T) {
+	for _, tc := range []struct {
+		input string
+		near  string // the suggestion the error must carry
+	}{
+		{"craete module Foo;", "create"},
+		{"dropp entity M.E;", "drop"},
+		{"craete persistent entity Shop.Note (Text: string(200));", "create"},
+		{"descibe entity M.E;", "describe"},
+	} {
+		prog, errs := Build(tc.input)
+		if len(errs) == 0 {
+			t.Errorf("%q: parsed without error into %d statement(s); a misspelt keyword must be an error",
+				tc.input, len(prog.Statements))
+			continue
+		}
+		first := errs[0].Error()
+		if !strings.HasPrefix(first, "line 1:0 ") {
+			t.Errorf("%q: first error is not at the misspelt word (line 1:0): %s", tc.input, first)
+		}
+		word := strings.Fields(tc.input)[0]
+		want := "unknown statement '" + word + "' — did you mean '" + tc.near + "'?"
+		if !strings.Contains(first, want) {
+			t.Errorf("%q: error does not say %q: %s", tc.input, want, first)
+		}
+	}
+}
+
+// The words the rule exists for still parse, with and without a topic, in any
+// letter case.
+func TestSessionWordsStillParse(t *testing.T) {
+	for _, in := range []string{"help;", "HELP;", "Help workflow;", "help workflow.user-task;", "exit;", "QUIT;"} {
+		prog, errs := Build(in)
+		if len(errs) > 0 || len(prog.Statements) != 1 {
+			t.Errorf("%q: %d statement(s), errors %v", in, len(prog.Statements), errs)
+		}
+	}
+}
diff --git a/mdl/visitor/visitor_unknown_statement.go b/mdl/visitor/visitor_unknown_statement.go
new file mode 100644
index 0000000000..6f301f9dd1
--- /dev/null
+++ b/mdl/visitor/visitor_unknown_statement.go
@@ -0,0 +1,53 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package visitor
+
+import (
+	"fmt"
+
+	"github.com/antlr4-go/antlr/v4"
+	"github.com/mendixlabs/mxcli/mdl/grammar/parser"
+	"github.com/mendixlabs/mxcli/mdl/suggest"
+)
+
+// statementWords are the words a statement starts with, for suggesting the
+// one a misspelt first word was meant to be.
+var statementWords = []string{
+	"create", "alter", "drop", "describe", "list", "show", "grant", "revoke",
+	"rename", "move", "update", "refresh", "search", "select", "import",
+	"define", "execute", "help", "exit",
+}
+
+// unknownStatementWord reports the word a statement failed to start with: an
+// IDENTIFIER that no statement alternative accepts (R7, ako/mxcli#755). Only a
+// failure at the start of a statement qualifies — the parser is still in the
+// statement (or program) rule, and ANTLR's "no viable alternative" names that
+// one word alone — since the same word mid-statement is a different mistake.
+func unknownStatementWord(rec antlr.Recognizer, sym any, msg string) (string, bool) {
+	tok, ok := sym.(antlr.Token)
+	if !ok || tok.GetTokenType() != parser.MDLParserIDENTIFIER {
+		return "", false
+	}
+	p, ok := rec.(antlr.Parser)
+	if !ok {
+		return "", false
+	}
+	switch p.GetParserRuleContext().(type) {
+	case *parser.StatementContext, *parser.ProgramContext:
+	default:
+		return "", false
+	}
+	if msg != "no viable alternative at input '"+tok.GetText()+"'" {
+		return "", false
+	}
+	return tok.GetText(), true
+}
+
+// unknownStatementMessage is the error for a statement starting with word.
+func unknownStatementMessage(word string) string {
+	msg := fmt.Sprintf("unknown statement '%s'", word)
+	if near := suggest.Closest(word, statementWords); near != "" {
+		return msg + fmt.Sprintf(" — did you mean '%s'?", near)
+	}
+	return msg + " — a statement starts with a keyword such as create, alter, drop, describe or list"
+}

From 6b919b6f68dd9cc70e6b91bfe8c5773dc026e312 Mon Sep 17 00:00:00 2001
From: Ako <andrej@koelewijn.net>
Date: Mon, 28 Sep 2026 07:01:37 +0000
Subject: [PATCH 16/35] feat(mdl): session commands are REPL-only under mdl 1
 (R7)

connect, disconnect, use, set <key> = ..., status, check, build, lint,
debug, execute script, execute runtime, help and introspect api need a
session or an environment. The grammar keeps parsing them, because the REPL
reads its input with the same parser; a script that holds one is refused
under 'mdl 1;' and warns MDL-V1-SESSION without the header (ADR-0011). The
REPL never validates a program, so it keeps accepting them.

fmt --upgrade --header has no rewrite for it (moving the command out of the
script is a decision about how the script is run), so it is listed as
unrewritable, and the three examples that exercise help and lint keep mdl 0.

Part of #755.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 cmd/mxcli/syntax/features_misc.go            | 52 ++++++++--
 docs-site/src/language/basics.md             |  3 +-
 docs/01-project/MDL_QUICK_REFERENCE.md       |  8 ++
 mdl/executor/strict_parsing_test.go          |  5 +-
 mdl/upgrade/examples_test.go                 |  6 ++
 mdl/upgrade/gated.go                         |  3 +
 mdl/upgrade/gated_test.go                    |  5 +-
 mdl/visitor/visitor_session_commands.go      | 99 ++++++++++++++++++++
 mdl/visitor/visitor_session_commands_test.go | 64 +++++++++++++
 mdl/visitor/visitor_upgrade_fixes.go         |  2 +-
 10 files changed, 233 insertions(+), 14 deletions(-)
 create mode 100644 mdl/visitor/visitor_session_commands.go

diff --git a/cmd/mxcli/syntax/features_misc.go b/cmd/mxcli/syntax/features_misc.go
index 50f6410ae4..88869064a7 100644
--- a/cmd/mxcli/syntax/features_misc.go
+++ b/cmd/mxcli/syntax/features_misc.go
@@ -171,11 +171,41 @@ func init() {
 		SeeAlso: []string{"move", "folders", "create-modifiers"},
 	})
 
+	// ── Session commands (R7, ako/mxcli#755) ───────────────────────────
+
+	Register(SyntaxFeature{
+		Path:    "session-commands",
+		Summary: "REPL commands that set up the session: connect, set format, status, help, … — not for scripts",
+		Keywords: []string{
+			"session", "session command", "repl", "repl command", "meta-command",
+			"connect", "disconnect", "use", "set format", "status", "check", "build",
+			"lint", "debug", "execute script", "execute runtime", "help", "introspect",
+			"MDL-V1-SESSION",
+		},
+		Syntax: "CONNECT LOCAL '<app.mpr>';   DISCONNECT;   STATUS;\n" +
+			"SET format = json|table;       USE <session> | USE ALL;\n" +
+			"CHECK;  BUILD;  LINT [target];  DEBUG '<…>';  INTROSPECT API;\n" +
+			"EXECUTE SCRIPT '<file.mdl>';   EXECUTE RUNTIME '<command>';\n" +
+			"HELP [topic];\n\n" +
+			"-- A session command needs a session or an environment: a connection, an\n" +
+			"-- output format, a build, a running app. It is typed at the REPL, or given\n" +
+			"-- as a command-line flag. A .mdl script holds model statements only:\n" +
+			"--\n" +
+			"--   mxcli exec script.mdl -p app.mpr --json\n" +
+			"--\n" +
+			"-- Under `mdl 1;` a session command in a script is an error; without the\n" +
+			"-- header it runs as before and warns MDL-V1-SESSION. The REPL keeps\n" +
+			"-- accepting them. EXIT / QUIT end a script and are not session commands.",
+		Example: "-- at the REPL\nCONNECT LOCAL '/projects/MyApp/MyApp.mpr';\nSET format = json;\nSTATUS;\n\n" +
+			"-- from the shell, for a script\nmxcli exec changes.mdl -p /projects/MyApp/MyApp.mpr --json",
+		SeeAlso: []string{"connect", "disconnect", "status", "language-header"},
+	})
+
 	// ── Connection ──────────────────────────────────────────────────────
 
 	Register(SyntaxFeature{
 		Path:    "connect",
-		Summary: "Connect to a Mendix project (.mpr file) for the current session",
+		Summary: "Connect to a Mendix project (.mpr file) for the current REPL session",
 		Keywords: []string{
 			"connect", "connect local", "connect project",
 			"open project", "mpr", "connection",
@@ -183,15 +213,17 @@ func init() {
 		Syntax: `CONNECT LOCAL '<path/to/app.mpr>';
 CONNECT LOCAL '<path>' BRANCH '<branch>';
 
--- CLI flags (equivalent)
-mxcli -p <path/to/app.mpr> -c "<statement>"`,
-		Example: `CONNECT LOCAL '/projects/MyApp/MyApp.mpr';
+-- CLI flags (equivalent, and the form for a script)
+mxcli -p <path/to/app.mpr> -c "<statement>"
+mxcli exec script.mdl -p <path/to/app.mpr>
 
--- Read-write session
+-- A session command: typed at the REPL. In a script it is an error under
+-- mdl 1 and a warning (MDL-V1-SESSION) without the header.`,
+		Example: `-- at the REPL
 CONNECT LOCAL '/projects/MyApp/MyApp.mpr';
 CREATE ENTITY MyModule.Product ( Name: String(200) );
 DISCONNECT;`,
-		SeeAlso: []string{"disconnect", "status"},
+		SeeAlso: []string{"disconnect", "status", "session-commands"},
 	})
 
 	Register(SyntaxFeature{
@@ -200,9 +232,9 @@ DISCONNECT;`,
 		Keywords: []string{
 			"disconnect", "close", "close connection", "close project",
 		},
-		Syntax:  "DISCONNECT;",
+		Syntax:  "DISCONNECT;\n\n-- A session command, for the REPL (see session-commands).",
 		Example: "DISCONNECT;",
-		SeeAlso: []string{"connect", "status"},
+		SeeAlso: []string{"connect", "status", "session-commands"},
 	})
 
 	Register(SyntaxFeature{
@@ -212,9 +244,9 @@ DISCONNECT;`,
 			"status", "show status", "connection status",
 			"project info", "version", "connected",
 		},
-		Syntax:  "STATUS;\nSHOW STATUS;",
+		Syntax:  "STATUS;\nSHOW STATUS;\n\n-- A session command, for the REPL (see session-commands).",
 		Example: "STATUS;\n-- Output: Connected to /projects/MyApp/MyApp.mpr (Mendix 10.24.0, 5 modules)",
-		SeeAlso: []string{"connect", "disconnect"},
+		SeeAlso: []string{"connect", "disconnect", "session-commands"},
 	})
 
 	// ── Navigation ──────────────────────────────────────────────────────
diff --git a/docs-site/src/language/basics.md b/docs-site/src/language/basics.md
index e109b8f5db..e98cddc21b 100644
--- a/docs-site/src/language/basics.md
+++ b/docs-site/src/language/basics.md
@@ -78,6 +78,7 @@ What `mdl 1` makes strict (each is a warning without the header, with the code s
 | `''` is the only string escape; a backslash is an ordinary character, so `'C:\temp'` is that path. | `\n`, `\r`, `\t`, `\\` and `\'` are escapes; `MDL-V1-ESCAPE` for each literal whose value would change. |
 | In a REST client, published REST service, business event service, model, knowledge base, consumed MCP service or agent, an unknown property key is an error that names the key it most likely meant, and so is a value its key does not take (`Response: json from $X`). | The property is ignored, or read by its shape as before; `MDL-V1-PROP` / `MDL-V1-PROPVALUE`. |
 | A `while` loop is `while <condition> begin … end while;`; leaving out `begin`, or the `while` after `end`, is an error. | Accepted; `MDL-V1-WHILE`. |
+| A session command — `connect`, `disconnect`, `use`, `set format = …`, `status`, `check`, `build`, `lint`, `debug`, `execute script`, `execute runtime`, `help`, `introspect api` — is an error in a script. Type it at the REPL, or use the command-line flag (`mxcli exec script.mdl -p app.mpr --json`). The REPL keeps accepting them. | Runs as before; `MDL-V1-SESSION`. |
 
 ### Upgrading a script: `mxcli fmt --upgrade`
 
@@ -102,7 +103,7 @@ mxcli fmt --upgrade --header -w script.mdl  # also add `mdl 1;`
 | `MDL-V1-REPLACE02` | `create or replace user role` / `demo user` becomes a plain `create` |
 | `MDL-V1-WHILE` | inserts the missing `begin` after a `while` condition and `while` after its `end` |
 
-A construct with no mechanical rewrite is reported with the reason, and `fmt` refuses to add the header rather than change the script's meaning: an unknown or mis-shaped property (`MDL-V1-PROP`, `MDL-V1-PROPVALUE`), `create or replace view entity` (`MDL-V1-REPLACE01`), a nested list operation such as `count(filter(…))`, `find`/`contains` on a variable whose type the script does not state, and an escaped line break (`\n`) inside an expression. While `mdl 1` is a preview, the header is added only when asked. Running `fmt --upgrade` on its own output changes nothing.
+A construct with no mechanical rewrite is reported with the reason, and `fmt` refuses to add the header rather than change the script's meaning: an unknown or mis-shaped property (`MDL-V1-PROP`, `MDL-V1-PROPVALUE`), `create or replace view entity` (`MDL-V1-REPLACE01`), a session command in a script (`MDL-V1-SESSION`: move it to the command line or the REPL), a nested list operation such as `count(filter(…))`, `find`/`contains` on a variable whose type the script does not state, and an escaped line break (`\n`) inside an expression. While `mdl 1` is a preview, the header is added only when asked. Running `fmt --upgrade` on its own output changes nothing.
 
 The design is in [ADR-0011](https://github.com/mendixlabs/mxcli/blob/main/docs/13-decisions/0011-mdl-language-versioning.md); `mxcli syntax language-header` has the details.
 
diff --git a/docs/01-project/MDL_QUICK_REFERENCE.md b/docs/01-project/MDL_QUICK_REFERENCE.md
index fad6388442..589970e633 100644
--- a/docs/01-project/MDL_QUICK_REFERENCE.md
+++ b/docs/01-project/MDL_QUICK_REFERENCE.md
@@ -13,6 +13,14 @@ mdl 1;
 create persistent entity Sales.Customer ( Name: String(200) );
 ```
 
+## Session commands — the REPL, not a script
+
+`connect`, `disconnect`, `use`, `set format = …`, `status`, `check`, `build`, `lint`, `debug`, `execute script`, `execute runtime`, `help` and `introspect api` set up or inspect the session. Type them at the REPL, or use the command-line flags; a `.mdl` script holds model statements only. Under `mdl 1;` a session command in a script is an error; without the header it runs and warns `MDL-V1-SESSION`. `exit` / `quit` are not session commands.
+
+```bash
+mxcli exec changes.mdl -p app.mpr --json     # not: connect local 'app.mpr'; set format = json; in the script
+```
+
 ## DESCRIBE — type is optional
 
 Every `describe <type> Module.Name` statement also accepts a **bare** form with the type omitted — `describe Module.Name` — and the document type is auto-detected from the project (via the catalog `objects` index, built on demand). Use it anywhere: the REPL, `exec` scripts, and `mxcli describe Module.Name`.
diff --git a/mdl/executor/strict_parsing_test.go b/mdl/executor/strict_parsing_test.go
index 02de497512..1d821273d6 100644
--- a/mdl/executor/strict_parsing_test.go
+++ b/mdl/executor/strict_parsing_test.go
@@ -26,6 +26,9 @@ var strictParsingCases = []struct {
 	{"unknown property key", "show modules;\ncreate published rest service M.S (Path: 'rest/s', Verison: '1.0') { };", "MDL-V1-PROP", "did you mean 'Version'"},
 	{"mis-shaped property value", "show modules;\ncreate rest client M.Api (BaseUrl: 'https://x', Authentication: none) { operation Post { Method: post, Path: '/u', Response: json from $X } };", "MDL-V1-PROPVALUE", "takes none or json as $var"},
 	// A change of meaning, not a rejection: see TestStringEscapeUnderEachVersion.
+	// R7 (ako/mxcli#755): a session command belongs at the REPL or on the
+	// command line; under mdl 0 the script still sets the format.
+	{"session command", "show modules;\nset format = json;", "MDL-V1-SESSION", "`set format` is a session command"},
 	{"backslash escape", "show modules;\ncreate persistent entity M.N (T: String(20) default 'C:\\temp');", "MDL-V1-ESCAPE", ""},
 }
 
@@ -35,7 +38,7 @@ func countStatements(e *Executor, ran *int, defaults *[]any) {
 		*ran++
 		return nil
 	}
-	for _, s := range []ast.Statement{&ast.CreatePublishedRestServiceStmt{}, &ast.CreateRestClientStmt{}} {
+	for _, s := range []ast.Statement{&ast.CreatePublishedRestServiceStmt{}, &ast.CreateRestClientStmt{}, &ast.SetStmt{}} {
 		e.registry.handlers[reflect.TypeOf(s)] = func(*ExecContext, ast.Statement) error {
 			*ran++
 			return nil
diff --git a/mdl/upgrade/examples_test.go b/mdl/upgrade/examples_test.go
index 7aff1a46e5..538079451d 100644
--- a/mdl/upgrade/examples_test.go
+++ b/mdl/upgrade/examples_test.go
@@ -121,6 +121,12 @@ var keepsItsVersion = map[string][]string{
 	// parameter) instead of the template text. Measured by the execute-both
 	// test before this entry was made.
 	"bug-tests/264-log-node-expression-roundtrip.mdl": {"MDL-V1-ESCAPE"},
+	// Scripts that exercise session commands — `help <topic>` and `lint` —
+	// which are REPL commands under mdl 1 (R7, ako/mxcli#755). They test the
+	// commands, so they stay mdl 0 scripts rather than lose what they test.
+	"bug-tests/904-lint-rules-discovery.mdl":    {"MDL-V1-SESSION"},
+	"bug-tests/syntax-1025-topic-drilldown.mdl": {"MDL-V1-SESSION"},
+	"doctype-tests/20-help-examples.mdl":        {"MDL-V1-SESSION"},
 }
 
 // buildsTheSameModelNotTheSameAST lists the example scripts whose upgrade
diff --git a/mdl/upgrade/gated.go b/mdl/upgrade/gated.go
index 7bb63d8421..38dffc32f2 100644
--- a/mdl/upgrade/gated.go
+++ b/mdl/upgrade/gated.go
@@ -47,6 +47,9 @@ var unrewritable = map[string]string{
 	"MDL-V1-REPLACE01": "`create or replace view entity` drops and recreates the view entity under mdl 0, " +
 		"which no mdl 1 statement does: write `create or modify view entity` to keep its identity, or " +
 		"`drop entity` then `create view entity` to discard it",
+	"MDL-V1-SESSION": "a session command (`connect`, `set format`, `status`, `help`, …) is refused in an mdl 1 " +
+		"script, and no model statement does what it does: move it out of the script, to the command line " +
+		"(`-p app.mpr` to connect, `--json` for the output format) or the REPL",
 }
 
 // visitorFix applies the rewrite the visitor computed from the parse tree when
diff --git a/mdl/upgrade/gated_test.go b/mdl/upgrade/gated_test.go
index 0d676f1897..7ffb34e58c 100644
--- a/mdl/upgrade/gated_test.go
+++ b/mdl/upgrade/gated_test.go
@@ -187,7 +187,10 @@ func TestUpgrade_ListCallFormToStatementForm(t *testing.T) {
 // Every change of meaning the visitor gates has a rewrite or is listed as
 // having none, never both. The list of changes with none may only shrink.
 func TestGatedRegistryIsComplete(t *testing.T) {
-	pinned := map[string]bool{"MDL-V1-PROP": true, "MDL-V1-PROPVALUE": true, "MDL-V1-REPLACE01": true}
+	// MDL-V1-SESSION (R7, ako/mxcli#755) was added with its change: moving a
+	// session command out of a script is a decision about how the script is run.
+	pinned := map[string]bool{"MDL-V1-PROP": true, "MDL-V1-PROPVALUE": true, "MDL-V1-REPLACE01": true,
+		"MDL-V1-SESSION": true}
 	known := map[string]bool{}
 	for _, c := range visitor.LanguageChanges() {
 		known[c.Code] = true
diff --git a/mdl/visitor/visitor_session_commands.go b/mdl/visitor/visitor_session_commands.go
new file mode 100644
index 0000000000..be0da433de
--- /dev/null
+++ b/mdl/visitor/visitor_session_commands.go
@@ -0,0 +1,99 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package visitor
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/mendixlabs/mxcli/mdl/grammar/parser"
+	"github.com/mendixlabs/mxcli/mdl/langver"
+)
+
+// R7 (PROPOSAL_mdl_beta_syntax_freeze.md §3; ADR-0010): MDL is what makes
+// sense in a checked-in `.mdl` file applied to a model. A session command —
+// one that needs a session or an environment: a connection, an output format,
+// a build, a running app — is typed at the REPL or given as a command-line
+// flag (`mxcli exec script.mdl -p app.mpr --json`).
+//
+// The grammar keeps parsing them, because the REPL reads its input with the
+// same parser. What changes is a script: under mdl 1 a session command in it
+// is refused, under mdl 0 it runs as before and warns. The REPL never
+// validates a program (ValidateProgram is `check` and `exec`), so it sees
+// neither the warning nor, for a line without a header, the error.
+
+// sessionCommandInScript is the new rejection of a session command in a script.
+var sessionCommandInScript = langver.Change{
+	Code:  "MDL-V1-SESSION",
+	Since: langver.V1,
+	Old:   "a session command in a script runs as if typed at the REPL",
+	New: "an error: a script holds model statements only; type the command at the REPL, " +
+		"or use the command-line flag (`-p app.mpr` to connect, `--json` for the output format)",
+}
+
+// ExitUtilityStatement gates the session commands among the utility
+// statements (R7). The others — `exit`, `refresh catalog`, `search`, `sql`,
+// `import from`, `define fragment`, `show lint rules` — are not session
+// commands and are not reported.
+func (b *Builder) ExitUtilityStatement(ctx *parser.UtilityStatementContext) {
+	cmd := sessionCommand(ctx)
+	if cmd == "" {
+		return
+	}
+	if b.gate(sessionCommandInScript, ctx) {
+		b.addError(fmt.Errorf("line %d: `%s` is a session command, not a model statement: under %s a script "+
+			"holds model statements only. Type it at the REPL, or use the command-line flag "+
+			"(`-p app.mpr` to connect, `--json` for the output format)",
+			ctx.GetStart().GetLine(), cmd, b.langVersion))
+		return
+	}
+	if n := len(b.langNotes); n > 0 && b.langNotes[n-1].Code == sessionCommandInScript.Code {
+		b.langNotes[n-1].Message = fmt.Sprintf("`%s` is a session command: %s", cmd, b.langNotes[n-1].Message)
+	}
+}
+
+// sessionCommand names the session command ctx holds, or "" when it holds
+// another utility statement.
+func sessionCommand(ctx *parser.UtilityStatementContext) string {
+	switch {
+	case ctx.ConnectStatement() != nil:
+		return "connect"
+	case ctx.DisconnectStatement() != nil:
+		return "disconnect"
+	case ctx.StatusStatement() != nil:
+		return "status"
+	case ctx.CheckStatement() != nil:
+		return "check"
+	case ctx.BuildStatement() != nil:
+		return "build"
+	case ctx.ExecuteScriptStatement() != nil:
+		return "execute script"
+	case ctx.ExecuteRuntimeStatement() != nil:
+		return "execute runtime"
+	case ctx.UseSessionStatement() != nil:
+		return "use"
+	case ctx.IntrospectApiStatement() != nil:
+		return "introspect api"
+	case ctx.DebugStatement() != nil:
+		return "debug"
+	case ctx.SessionSetStatement() != nil:
+		set := ctx.SessionSetStatement().(*parser.SessionSetStatementContext)
+		if k := set.IdentifierOrKeyword(); k != nil {
+			return "set " + strings.ToLower(k.GetText())
+		}
+		return "set"
+	case ctx.LintStatement() != nil:
+		// `show lint rules` lists the rules; only running the linter needs
+		// a session.
+		if l := ctx.LintStatement().(*parser.LintStatementContext); l.SHOW() == nil {
+			return "lint"
+		}
+	case ctx.HelpStatement() != nil:
+		// `exit` and `quit` end a script, which is meaningful in one.
+		if h := ctx.HelpStatement().(*parser.HelpStatementContext); h.IDENTIFIER() != nil &&
+			strings.EqualFold(h.IDENTIFIER().GetText(), "help") {
+			return "help"
+		}
+	}
+	return ""
+}
diff --git a/mdl/visitor/visitor_session_commands_test.go b/mdl/visitor/visitor_session_commands_test.go
index 87acd33a99..fe4ef609b4 100644
--- a/mdl/visitor/visitor_session_commands_test.go
+++ b/mdl/visitor/visitor_session_commands_test.go
@@ -5,6 +5,8 @@ package visitor
 import (
 	"strings"
 	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/ast"
 )
 
 // R7 (ako/mxcli#755): `helpStatement` was `IDENTIFIER helpTopicWord*`, the
@@ -50,3 +52,65 @@ func TestSessionWordsStillParse(t *testing.T) {
 		}
 	}
 }
+
+// R7 (ako/mxcli#755): a session command needs a session — a connection, an
+// output format, a running app — so it belongs at the REPL or on the command
+// line, not in a checked-in script. Under mdl 1 a script that holds one is
+// refused; under mdl 0 it runs as before and warns, once per command.
+func TestSessionCommandInAScript(t *testing.T) {
+	session := []string{
+		"connect local 'app.mpr';",
+		"disconnect;",
+		"status;",
+		"set format = json;",
+		"check;",
+		"build;",
+		"lint;",
+		"use all;",
+		"introspect api;",
+		"debug 'x';",
+		"execute script 'other.mdl';",
+		"execute runtime 'reload_model';",
+		"help;",
+		"help workflow;",
+	}
+	for _, stmt := range session {
+		prog, errs := Build(stmt)
+		if len(errs) > 0 {
+			t.Errorf("mdl 0: %q: %v", stmt, errs)
+			continue
+		}
+		if n := countNotes(prog.LanguageNotes, sessionCommandInScript.Code); n != 1 {
+			t.Errorf("mdl 0: %q: %d %s note(s), want 1", stmt, n, sessionCommandInScript.Code)
+		}
+		_, errs = Build("mdl 1;\n" + stmt)
+		if len(errs) != 1 || !strings.Contains(errs[0].Error(), "session command") {
+			t.Errorf("mdl 1: %q: want one session-command error, got %v", stmt, errs)
+		}
+	}
+
+	// Controls: model statements, `exit` (which ends a script) and `show lint
+	// rules` (a listing) are not session commands and are not reported.
+	for _, stmt := range []string{"create module M;", "exit;", "show lint rules;", "refresh catalog;"} {
+		for _, src := range []string{stmt, "mdl 1;\n" + stmt} {
+			prog, errs := Build(src)
+			if len(errs) > 0 {
+				t.Errorf("%q: %v", src, errs)
+				continue
+			}
+			if n := countNotes(prog.LanguageNotes, sessionCommandInScript.Code); n != 0 {
+				t.Errorf("%q: reported as a session command", src)
+			}
+		}
+	}
+}
+
+func countNotes(notes []ast.LanguageNote, code string) int {
+	n := 0
+	for _, note := range notes {
+		if note.Code == code {
+			n++
+		}
+	}
+	return n
+}
diff --git a/mdl/visitor/visitor_upgrade_fixes.go b/mdl/visitor/visitor_upgrade_fixes.go
index e1dd49e9de..a6a669d8d0 100644
--- a/mdl/visitor/visitor_upgrade_fixes.go
+++ b/mdl/visitor/visitor_upgrade_fixes.go
@@ -31,7 +31,7 @@ func LanguageChanges() []langver.Change {
 	return []langver.Change{
 		semicolonRequired, slashIsNotATerminator, backslashIsLiteral, limitOneIsAList,
 		listCallForm, setIsMandatory, viewEntityReplaceIsModify, roleReplaceIsModify, whileBlockRequired,
-		unknownPropertyKey, misshapedPropertyValue,
+		unknownPropertyKey, misshapedPropertyValue, sessionCommandInScript,
 	}
 }
 

From 0e46128e589f5bf39c991e7ed2464e4d724f9200 Mon Sep 17 00:00:00 2001
From: Ako <andrej@koelewijn.net>
Date: Mon, 28 Sep 2026 07:10:01 +0000
Subject: [PATCH 17/35] roundtrip: an upgrade use reported as unrewritable may
 stay in the output
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The execute-both property test required an upgraded script to record no
deprecation at all. MDL-DEPR090's summary forms (show entity, …) are
reported without a rewrite by design, so allow exactly the uses the
upgrade listed in Result.Unrewritten, as mdl/upgrade's examples test does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 mdl/roundtrip/upgrade_property_test.go | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/mdl/roundtrip/upgrade_property_test.go b/mdl/roundtrip/upgrade_property_test.go
index fe508c0fcd..1f77762723 100644
--- a/mdl/roundtrip/upgrade_property_test.go
+++ b/mdl/roundtrip/upgrade_property_test.go
@@ -102,9 +102,12 @@ func TestUpgradeExecutesToTheSameModel(t *testing.T) {
 			if len(errs) > 0 {
 				t.Fatalf("upgraded script does not parse: %v", errs[0])
 			}
-			if n := len(prog.Deprecations); n > 0 {
-				t.Fatalf("upgraded script still has %d deprecated spelling(s), first %s at line %d",
-					n, prog.Deprecations[0].Code, prog.Deprecations[0].Line)
+			// A use the upgrade reported as unrewritable stays by contract
+			// (reported, never guessed at); anything beyond those is a rewrite
+			// that did not produce the canonical form.
+			if n := len(prog.Deprecations); n > len(res.Unrewritten) {
+				t.Fatalf("upgraded script still has %d deprecated spelling(s) (%d reported unrewritable), first %s at line %d",
+					n, len(res.Unrewritten), prog.Deprecations[0].Code, prog.Deprecations[0].Line)
 			}
 			if !all && onlyTerminatorsAndHeader(res) {
 				headerOnly = append(headerOnly, rel)

From d513348fb57ca8e30dc2b40b68a4890990282d0f Mon Sep 17 00:00:00 2001
From: Ako <andrej@koelewijn.net>
Date: Mon, 28 Sep 2026 07:25:21 +0000
Subject: [PATCH 18/35] R6: mxcli's own messages and commands use the canonical
 verbs (#755)

The CLI subcommands structure, context and describe projectsecurity, the TUI
overview preview, the generated CLAUDE.md / tool templates, and three error
hints (slot outside a fragment, an already-enabled language, a binary REST
body) still wrote show structure / show context of / show project security /
define fragment / alter settings language remove / rest call. They now write
describe structure, describe context of, describe app security, create
fragment, drop and call rest service. Also the blog drafts and the
implement-mdl-feature contributor skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .claude/skills/implement-mdl-feature.md          |  6 +++---
 cmd/mxcli/cmd_describe.go                        |  2 +-
 cmd/mxcli/cmd_query.go                           |  4 ++--
 cmd/mxcli/init_claudemd.go                       |  4 ++--
 cmd/mxcli/tool_templates.go                      |  4 ++--
 cmd/mxcli/tui/preview.go                         |  2 +-
 cmd/mxcli/tui/preview_test.go                    |  4 ++--
 docs-site/src/blog/custom-pluggable-widgets.md   |  2 +-
 .../src/blog/discover-understand-your-app.md     |  2 +-
 .../src/blog/progressive-element-disclosure.md   |  2 +-
 docs-site/src/blog/structure-system.md           | 16 ++++++++--------
 mdl/executor/cmd_pages_builder_v3.go             |  8 ++++----
 mdl/executor/cmd_rest_clients.go                 |  2 +-
 mdl/executor/cmd_rest_clients_file_body_test.go  |  2 +-
 mdl/executor/cmd_settings_languages.go           |  2 +-
 mdl/executor/fragment_test.go                    |  2 +-
 16 files changed, 32 insertions(+), 32 deletions(-)

diff --git a/.claude/skills/implement-mdl-feature.md b/.claude/skills/implement-mdl-feature.md
index e82ebbb960..6d5061c83f 100644
--- a/.claude/skills/implement-mdl-feature.md
+++ b/.claude/skills/implement-mdl-feature.md
@@ -137,7 +137,7 @@ Based on the BSON structure, design MDL syntax that:
 
 Example design for REST call:
 ```sql
-$response = rest call get 'http://api.example.com/data'
+$response = call rest service get 'http://api.example.com/data'
   header 'Content-Type' = 'application/json'
   header Accept = 'application/json'
   auth basic $username password $password
@@ -156,7 +156,7 @@ Add examples to `mdl-examples/doctype-tests/`:
 create microflow RestExamples.SimpleGet()
 returns string as $response
 begin
-  $response = rest call get 'https://api.example.com/data'
+  $response = call rest service get 'https://api.example.com/data'
     timeout 30
     returns string;
   return $response;
@@ -597,7 +597,7 @@ Expected: Valid MDL output that could be re-parsed.
 create microflow Test.RestExample()
 returns string as \$R
 begin
-  \$R = rest call get 'http://example.com' timeout 30 returns string;
+  \$R = call rest service get 'http://example.com' timeout 30 returns string;
   return \$R;
 end;"
 
diff --git a/cmd/mxcli/cmd_describe.go b/cmd/mxcli/cmd_describe.go
index 04b2869997..6029b8bff2 100644
--- a/cmd/mxcli/cmd_describe.go
+++ b/cmd/mxcli/cmd_describe.go
@@ -147,7 +147,7 @@ Example:
 		case "USERROLE", "USER ROLE":
 			mdlCmd = fmt.Sprintf("DESCRIBE USER ROLE '%s'", name)
 		case "PROJECTSECURITY", "PROJECT SECURITY":
-			mdlCmd = "SHOW PROJECT SECURITY"
+			mdlCmd = "DESCRIBE APP SECURITY"
 		case "SETTINGS":
 			mdlCmd = "DESCRIBE SETTINGS"
 		case "DEMOUSER", "DEMO USER":
diff --git a/cmd/mxcli/cmd_query.go b/cmd/mxcli/cmd_query.go
index 4de39e190a..352f19230d 100644
--- a/cmd/mxcli/cmd_query.go
+++ b/cmd/mxcli/cmd_query.go
@@ -157,7 +157,7 @@ Examples:
 			os.Exit(1)
 		}
 
-		mdlCmd := "SHOW STRUCTURE"
+		mdlCmd := "DESCRIBE STRUCTURE"
 		if depth != 2 {
 			mdlCmd += fmt.Sprintf(" DEPTH %d", depth)
 		}
@@ -211,7 +211,7 @@ Examples:
 			os.Exit(1)
 		}
 
-		mdlCmd := fmt.Sprintf("SHOW CONTEXT OF %s", args[0])
+		mdlCmd := fmt.Sprintf("DESCRIBE CONTEXT OF %s", args[0])
 		if depth > 0 {
 			mdlCmd += fmt.Sprintf(" DEPTH %d", depth)
 		}
diff --git a/cmd/mxcli/init_claudemd.go b/cmd/mxcli/init_claudemd.go
index f65f4ef86f..de9c780ca9 100644
--- a/cmd/mxcli/init_claudemd.go
+++ b/cmd/mxcli/init_claudemd.go
@@ -161,7 +161,7 @@ func generateClaudeMD(projectName, mprFile string) string {
 	w("## Running mxcli\n\n")
 	w("The binary is in the **root of this project**, not on " + bt + "PATH" + bt + " — always " + bt + "./mxcli" + bt + ".\n\n")
 	w(bt3 + "bash\n")
-	w("./mxcli -p " + mprPath + " -c \"SHOW STRUCTURE\"   # one command\n")
+	w("./mxcli -p " + mprPath + " -c \"DESCRIBE STRUCTURE\"   # one command\n")
 	w("./mxcli exec script.mdl -p " + mprPath + "        # a script\n")
 	w("./mxcli                                          # REPL\n")
 	w(bt3 + "\n\n")
@@ -201,7 +201,7 @@ func generateClaudeMD(projectName, mprFile string) string {
 	w("| What MDL can say, and how | " + bt + "./mxcli syntax" + bt + " → " + bt + "./mxcli syntax <topic> [sub]" + bt + " (" + bt + "--json" + bt + " for bulk) |\n")
 	w("| Which lint rules exist | " + bt + "./mxcli lint -p " + mprPath + " --list-rules" + bt + " |\n")
 	w("| What a command takes | " + bt + "./mxcli help <command>" + bt + " |\n")
-	w("| What this project contains | " + bt + "./mxcli -p " + mprPath + " -c \"SHOW STRUCTURE\"" + bt + " |\n")
+	w("| What this project contains | " + bt + "./mxcli -p " + mprPath + " -c \"DESCRIBE STRUCTURE\"" + bt + " |\n")
 	w("| Why it was built this way | " + bt + "docs/brain/" + bt + " (above) |\n")
 	w("\n")
 	w("**Skills** are in " + bt + ".ai-context/skills/<name>/SKILL.md" + bt + " (and " + bt + ".claude/skills/" + bt + ", which is\n")
diff --git a/cmd/mxcli/tool_templates.go b/cmd/mxcli/tool_templates.go
index 71f2ef4ce1..9686dbb818 100644
--- a/cmd/mxcli/tool_templates.go
+++ b/cmd/mxcli/tool_templates.go
@@ -479,7 +479,7 @@ MPR file: %s
 
 ## Quick Commands
 
-- Explore: ./mxcli -p %s -c "SHOW STRUCTURE"
+- Explore: ./mxcli -p %s -c "DESCRIBE STRUCTURE"
 - Check: ./mxcli check script.mdl -p %s --references
 - Execute: ./mxcli exec script.mdl -p %s
 - Search: ./mxcli search -p %s "keyword"
@@ -530,7 +530,7 @@ func generateCopilotInstructions(projectName, mprPath string) string {
 		"## Quick Commands\n\n"+
 		"```bash\n"+
 		"# Explore project structure\n"+
-		"./mxcli -p %s -c \"SHOW STRUCTURE\"\n\n"+
+		"./mxcli -p %s -c \"DESCRIBE STRUCTURE\"\n\n"+
 		"# Validate an MDL script (always do this before executing)\n"+
 		"./mxcli check script.mdl -p %s --references\n\n"+
 		"# Execute an MDL script\n"+
diff --git a/cmd/mxcli/tui/preview.go b/cmd/mxcli/tui/preview.go
index b343e49089..9ad0b7620b 100644
--- a/cmd/mxcli/tui/preview.go
+++ b/cmd/mxcli/tui/preview.go
@@ -16,7 +16,7 @@ import (
 func buildDescribeCmd(nodeType, qualifiedName string) string {
 	switch strings.ToLower(nodeType) {
 	case "systemoverview":
-		return "SHOW STRUCTURE DEPTH 2"
+		return "DESCRIBE STRUCTURE DEPTH 2"
 	case "security", "category", "domainmodel", "navigation", "projectsecurity", "navprofile",
 		"nanoflow": // DESCRIBE NANOFLOW not implemented in executor
 		return ""
diff --git a/cmd/mxcli/tui/preview_test.go b/cmd/mxcli/tui/preview_test.go
index 66d9795ea0..ff5f8e0dac 100644
--- a/cmd/mxcli/tui/preview_test.go
+++ b/cmd/mxcli/tui/preview_test.go
@@ -22,8 +22,8 @@ func TestBuildDescribeCmd(t *testing.T) {
 		{"DemoUser", "demo_user", "DESCRIBE DEMO USER 'demo_user'"},
 
 		// Virtual root node: show structure overview
-		{"systemoverview", "SystemOverview", "SHOW STRUCTURE DEPTH 2"},
-		{"SystemOverview", "SystemOverview", "SHOW STRUCTURE DEPTH 2"},
+		{"systemoverview", "SystemOverview", "DESCRIBE STRUCTURE DEPTH 2"},
+		{"SystemOverview", "SystemOverview", "DESCRIBE STRUCTURE DEPTH 2"},
 
 		// Virtual container nodes: no valid DESCRIBE, return empty string
 		{"security", "", ""},
diff --git a/docs-site/src/blog/custom-pluggable-widgets.md b/docs-site/src/blog/custom-pluggable-widgets.md
index 94a1273627..e2b946681b 100644
--- a/docs-site/src/blog/custom-pluggable-widgets.md
+++ b/docs-site/src/blog/custom-pluggable-widgets.md
@@ -12,7 +12,7 @@
 
 ```mdl
 SHOW WIDGETS
-DESCRIBE WIDGET DataGrid2
+DESCRIBE WIDGET TYPE DataGrid2
 ```
 
 <!-- TODO: how mxcli discovers widget types present in the project -->
diff --git a/docs-site/src/blog/discover-understand-your-app.md b/docs-site/src/blog/discover-understand-your-app.md
index 98dbc71c46..37b0254c9e 100644
--- a/docs-site/src/blog/discover-understand-your-app.md
+++ b/docs-site/src/blog/discover-understand-your-app.md
@@ -10,7 +10,7 @@
 
 ## Getting the Lay of the Land
 
-<!-- TODO: SHOW STRUCTURE, SHOW MODULES — reading the output -->
+<!-- TODO: DESCRIBE STRUCTURE, LIST MODULES — reading the output -->
 
 ## Exploring Entities and Associations
 
diff --git a/docs-site/src/blog/progressive-element-disclosure.md b/docs-site/src/blog/progressive-element-disclosure.md
index 08bd9fd210..75a886bf8f 100644
--- a/docs-site/src/blog/progressive-element-disclosure.md
+++ b/docs-site/src/blog/progressive-element-disclosure.md
@@ -10,7 +10,7 @@
 
 ## The Problem with Full Output
 
-<!-- TODO: why dumping everything at once (full DESCRIBE, full SHOW STRUCTURE) is overwhelming for AI and humans alike -->
+<!-- TODO: why dumping everything at once (full DESCRIBE, full DESCRIBE STRUCTURE) is overwhelming for AI and humans alike -->
 
 ## How mxcli Applies It
 
diff --git a/docs-site/src/blog/structure-system.md b/docs-site/src/blog/structure-system.md
index 5ee1487462..0b78d8e0de 100644
--- a/docs-site/src/blog/structure-system.md
+++ b/docs-site/src/blog/structure-system.md
@@ -1,4 +1,4 @@
-# Understanding Your App's Structure with SHOW STRUCTURE
+# Understanding Your App's Structure with DESCRIBE STRUCTURE
 
 *Draft — not yet published*
 
@@ -6,14 +6,14 @@
 
 <!-- TODO: date -->
 
-<!-- TODO: intro — SHOW STRUCTURE as a fast way to orient in any project -->
+<!-- TODO: intro — DESCRIBE STRUCTURE as a fast way to orient in any project -->
 
 ## The Three Depth Levels
 
 ```mdl
-SHOW STRUCTURE
-SHOW STRUCTURE DEPTH 2
-SHOW STRUCTURE DEPTH 3
+DESCRIBE STRUCTURE
+DESCRIBE STRUCTURE DEPTH 2
+DESCRIBE STRUCTURE DEPTH 3
 ```
 
 <!-- TODO: annotated output at each depth level, what each level reveals -->
@@ -21,14 +21,14 @@ SHOW STRUCTURE DEPTH 3
 ## Scoping to a Module
 
 ```mdl
-SHOW STRUCTURE IN CustomerModule
+DESCRIBE STRUCTURE IN CustomerModule
 ```
 
 <!-- TODO: when scoping is useful, combining with DEPTH -->
 
 ## Demo
 
-<!-- TODO: embed YouTube demo — navigating a real project with SHOW STRUCTURE -->
+<!-- TODO: embed YouTube demo — navigating a real project with DESCRIBE STRUCTURE -->
 <!--
 <div style="position:relative;padding-bottom:56.25%;height:0;overflow:hidden;">
   <iframe style="position:absolute;top:0;left:0;width:100%;height:100%;"
@@ -43,4 +43,4 @@ SHOW STRUCTURE IN CustomerModule
 
 ## Using Structure Output with AI Assistants
 
-<!-- TODO: pasting SHOW STRUCTURE output to give an AI quick project context -->
+<!-- TODO: pasting DESCRIBE STRUCTURE output to give an AI quick project context -->
diff --git a/mdl/executor/cmd_pages_builder_v3.go b/mdl/executor/cmd_pages_builder_v3.go
index 5684370c68..78ada03811 100644
--- a/mdl/executor/cmd_pages_builder_v3.go
+++ b/mdl/executor/cmd_pages_builder_v3.go
@@ -386,7 +386,7 @@ func (pb *pageBuilder) buildWidgetV3(w *ast.WidgetV3) (pages.Widget, error) {
 		// A slot that reaches the builder was written somewhere the fragment
 		// expander doesn't reach (e.g. nested in a page container rather than a
 		// `define fragment` body). Slots are resolved during fragment expansion.
-		return nil, mdlerrors.NewValidation("`slot` is only valid inside a `define fragment` body")
+		return nil, mdlerrors.NewValidation("`slot` is only valid inside a `create fragment` body")
 	case "textbox":
 		widget, err = pb.buildTextBoxV3(w)
 	case "textarea":
@@ -2373,7 +2373,7 @@ func (pb *pageBuilder) expandIfFragment(w *ast.WidgetV3) ([]*ast.WidgetV3, error
 		// A slot marker is only meaningful inside a `define fragment` body, where
 		// it is resolved during expandFragmentRef. Reaching here means a bare
 		// `slot` was written directly in a page/snippet body.
-		return nil, mdlerrors.NewValidation("`slot` is only valid inside a `define fragment` body")
+		return nil, mdlerrors.NewValidation("`slot` is only valid inside a `create fragment` body")
 	default:
 		return []*ast.WidgetV3{w}, nil
 	}
@@ -2606,8 +2606,8 @@ func (pb *pageBuilder) expandBuildingBlockRef(w *ast.WidgetV3) ([]*ast.WidgetV3,
 		outputWidgetMDLV3(&renderCtx, rw, 1)
 	}
 
-	// Re-parse via a `define fragment` wrapper to obtain []*ast.WidgetV3.
-	src := "define fragment __bbtmp as {\n" + sb.String() + "\n};"
+	// Re-parse via a `create fragment` wrapper to obtain []*ast.WidgetV3.
+	src := "create fragment __bbtmp as {\n" + sb.String() + "\n};"
 	prog, errs := visitor.Build(src)
 	if len(errs) > 0 {
 		return nil, fmt.Errorf("use building block %s: could not expand widget tree: %v", w.Name, errs)
diff --git a/mdl/executor/cmd_rest_clients.go b/mdl/executor/cmd_rest_clients.go
index 7d50dd84dc..03545f9a71 100644
--- a/mdl/executor/cmd_rest_clients.go
+++ b/mdl/executor/cmd_rest_clients.go
@@ -674,7 +674,7 @@ func checkFileRequestBody(opDef *ast.RestOperationDef) error {
 			"  write a string body holding the literal text %q, which sends %d bytes and\n"+
 			"  still returns 200.\n"+
 			"  Binary POST lives on the microflow activity, not the client document:\n"+
-			"    rest call post '<url>' header 'ContentType' = '<type>' body binary %s/Contents\n"+
+			"    call rest service post '<url>' header 'ContentType' = '<type>' body binary %s/Contents\n"+
 			"  (Microflows$BinaryRequestHandling — the shape Studio Pro writes).",
 		target, target, len(target), target)
 }
diff --git a/mdl/executor/cmd_rest_clients_file_body_test.go b/mdl/executor/cmd_rest_clients_file_body_test.go
index 8b1e2fc232..99bebb4a07 100644
--- a/mdl/executor/cmd_rest_clients_file_body_test.go
+++ b/mdl/executor/cmd_rest_clients_file_body_test.go
@@ -33,7 +33,7 @@ func TestBuildRestClientOperation_RefusesFileRequestBody(t *testing.T) {
 	// The message must point at the route that WORKS. Binary POST is expressible
 	// on the microflow REST CALL activity (Microflows$BinaryRequestHandling);
 	// only the consumed client document has nowhere to put it.
-	for _, want := range []string{"binary", "$Doc", "rest call post", "body binary"} {
+	for _, want := range []string{"binary", "$Doc", "call rest service post", "body binary"} {
 		if !strings.Contains(err.Error(), want) {
 			t.Errorf("error should mention %q, got:\n%v", want, err)
 		}
diff --git a/mdl/executor/cmd_settings_languages.go b/mdl/executor/cmd_settings_languages.go
index 634ba1814d..613a23c58d 100644
--- a/mdl/executor/cmd_settings_languages.go
+++ b/mdl/executor/cmd_settings_languages.go
@@ -55,7 +55,7 @@ func alterSettingsLanguageAdd(ctx *ExecContext, ps *model.ProjectSettings, stmt
 	for _, l := range ps.Language.Languages {
 		if strings.EqualFold(l.Code, code) {
 			return mdlerrors.NewValidationf(
-				"language %q is already enabled in this project — use `alter settings LANGUAGE remove '%s'` to disable it, "+
+				"language %q is already enabled in this project — use `alter settings language drop '%s'` to disable it, "+
 					"or `describe settings` to see the whole list", l.Code, l.Code)
 		}
 	}
diff --git a/mdl/executor/fragment_test.go b/mdl/executor/fragment_test.go
index 525ac1cdbb..c4ff1dea98 100644
--- a/mdl/executor/fragment_test.go
+++ b/mdl/executor/fragment_test.go
@@ -489,7 +489,7 @@ func TestExpandBareSlotErrors(t *testing.T) {
 	if err == nil {
 		t.Fatal("Expected error for a bare slot outside a fragment")
 	}
-	if !strings.Contains(err.Error(), "only valid inside a `define fragment`") {
+	if !strings.Contains(err.Error(), "only valid inside a `create fragment`") {
 		t.Errorf("Unexpected error: %v", err)
 	}
 }

From c2f5b16b9602bfe54a3b42e47fd66c927546d204 Mon Sep 17 00:00:00 2001
From: Ako <andrej@koelewijn.net>
Date: Mon, 28 Sep 2026 07:36:56 +0000
Subject: [PATCH 19/35] feat(mdl): documentation, folder and caption have one
 place each (R9)

Documentation is a /** */ doc comment and the folder a 'folder' clause after
the name, on every document; a workflow activity's caption is 'caption'.
The older places keep parsing as registered aliases that build the same
statement, and fmt --upgrade moves the text:

- MDL-DEPR100: the 'comment' clause on a constant, association, JSON
  structure or image collection. A statement with both spellings keeps the
  one it stored: where the clause won, the doc comment is demoted to a plain
  /* */ comment; where the doc comment won, the clause is deleted.
- MDL-DEPR104: a workflow activity's 'comment', which sets the caption.
- MDL-DEPR105: 'Folder:' in a page, snippet, consumed REST service,
  consumed/published OData service or published REST service header. The
  grammar gains the folder clause after the name on each of them.
- MDL-DEPR106: 'Documentation:' in a regular expression, task queue or
  scheduled event property list.

describe emits the canonical forms. The JSON structure, association, regular
expression, task queue and scheduled event visitors never set
DocumentationSet, so create or modify never updated their documentation
(#1018's rule); they do now, which is also what makes the alias and the doc
comment build the same statement.

Part of #755.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 mdl/ast/ast_association.go                    |   1 -
 mdl/ast/ast_enumeration.go                    |   3 +-
 mdl/deprecation/deprecation.go                |  74 ++++++
 mdl/executor/bugfix_regression_test.go        |  23 +-
 mdl/executor/cmd_associations.go              |  29 +--
 .../cmd_associations_documentation_test.go    |  33 ++-
 mdl/executor/cmd_constants.go                 |  30 +--
 mdl/executor/cmd_jsonstructures.go            |   5 +-
 mdl/executor/cmd_odata.go                     |  20 +-
 mdl/executor/cmd_pages_describe.go            |  17 +-
 mdl/executor/cmd_published_rest.go            |  11 +-
 mdl/executor/cmd_rest_clients.go              |   9 +-
 mdl/executor/cmd_workflows.go                 |  26 +-
 mdl/executor/cmd_workflows_describe_test.go   |  20 +-
 .../describe_argument_binding_test.go         |   4 +-
 mdl/executor/validate_workflow_agent_test.go  |   2 +-
 mdl/executor/validate_workflow_rewrite.go     |   2 +-
 .../workflow_callmicroflow_caption_test.go    |   8 +-
 mdl/executor/workflow_esp_test.go             |   8 +-
 mdl/grammar/domains/MDLDomainModel.g4         |  12 +-
 mdl/grammar/domains/MDLPage.g4                |   8 +-
 mdl/grammar/domains/MDLService.g4             |   7 +
 mdl/grammar/domains/MDLWorkflow.g4            |  32 ++-
 mdl/upgrade/argument_binding_test.go          |   2 +-
 mdl/upgrade/metadata_placement_test.go        | 136 +++++++++++
 mdl/visitor/visitor_argument_binding_test.go  |   8 +-
 mdl/visitor/visitor_association.go            |  20 +-
 mdl/visitor/visitor_enumeration.go            |  13 +-
 mdl/visitor/visitor_enumeration_test.go       |   5 +-
 mdl/visitor/visitor_imagecollection.go        |   8 +-
 mdl/visitor/visitor_jsonstructure.go          |  14 +-
 mdl/visitor/visitor_metadata_placement.go     | 223 ++++++++++++++++++
 .../visitor_metadata_placement_test.go        |  46 ++++
 mdl/visitor/visitor_odata.go                  |  24 +-
 mdl/visitor/visitor_page_v3.go                |  41 +++-
 mdl/visitor/visitor_queue.go                  |  10 +-
 mdl/visitor/visitor_regularexpression.go      |  10 +-
 mdl/visitor/visitor_rest.go                   |  25 +-
 mdl/visitor/visitor_scheduledevent.go         |  10 +-
 mdl/visitor/visitor_workflow.go               | 105 ++++-----
 40 files changed, 828 insertions(+), 256 deletions(-)
 create mode 100644 mdl/upgrade/metadata_placement_test.go
 create mode 100644 mdl/visitor/visitor_metadata_placement.go
 create mode 100644 mdl/visitor/visitor_metadata_placement_test.go

diff --git a/mdl/ast/ast_association.go b/mdl/ast/ast_association.go
index ff65548034..b4e3904d74 100644
--- a/mdl/ast/ast_association.go
+++ b/mdl/ast/ast_association.go
@@ -111,7 +111,6 @@ type CreateAssociationStmt struct {
 	DeleteErrorMessage string
 	Documentation      string
 	DocumentationSet   bool // see mendixlabs/mxcli#1018: absent preserves, empty clears
-	Comment            string
 	CreateOrModify     bool // true for CREATE OR MODIFY / CREATE OR REPLACE
 	// IfNotExists is CREATE ASSOCIATION IF NOT EXISTS: skip when it already
 	// exists, leaving the stored definition untouched.
diff --git a/mdl/ast/ast_enumeration.go b/mdl/ast/ast_enumeration.go
index 94d2d5ede4..6648da5273 100644
--- a/mdl/ast/ast_enumeration.go
+++ b/mdl/ast/ast_enumeration.go
@@ -108,8 +108,7 @@ type CreateConstantStmt struct {
 	DataType         DataType
 	DefaultValue     any // The default value (can be string, number, boolean, etc.)
 	Documentation    string
-	DocumentationSet bool // see mendixlabs/mxcli#1018: absent preserves, empty clears
-	Comment          string
+	DocumentationSet bool   // see mendixlabs/mxcli#1018: absent preserves, empty clears
 	Folder           string // Folder path within module (e.g., "Resources/Constants")
 	ExposedToClient  bool
 	CreateOrModify   bool // True if CREATE OR MODIFY was used
diff --git a/mdl/deprecation/deprecation.go b/mdl/deprecation/deprecation.go
index 36f7f253e2..550037069c 100644
--- a/mdl/deprecation/deprecation.go
+++ b/mdl/deprecation/deprecation.go
@@ -157,6 +157,25 @@ const (
 	// on a text template: the placeholders bound by position (R4,
 	// ako/mxcli#751).
 	PositionalTemplateArguments = "MDL-DEPR009"
+
+	// R9 (ako/mxcli#755): where document metadata lives. Codes 100–119 are
+	// this change's block; 101–103 are left to the parallel work that took them.
+
+	// DocumentationClause is the `comment '…'` clause on a constant,
+	// association, JSON structure or image collection: the document's
+	// documentation, which every other document takes as a `/** … */` doc
+	// comment.
+	DocumentationClause = "MDL-DEPR100"
+	// WorkflowCommentCaption is a workflow activity's `comment '…'`, which sets
+	// the activity's caption, not a comment.
+	WorkflowCommentCaption = "MDL-DEPR104"
+	// FolderProperty is `Folder: '…'` in a page, snippet, consumed REST
+	// service, consumed or published OData service or published REST service
+	// header: the folder is a clause after the name on every document.
+	FolderProperty = "MDL-DEPR105"
+	// DocumentationProperty is `Documentation: '…'` in a regular expression,
+	// task queue or scheduled event property list.
+	DocumentationProperty = "MDL-DEPR106"
 )
 
 // entries is the registry. Append only: a code is never reused or renumbered,
@@ -374,6 +393,61 @@ var entries = []Entry{
 
 func init() {
 	entries = append(entries, r8Entries...)
+	entries = append(entries, r9Entries...)
+}
+
+// r9Entries are R9's (ako/mxcli#755): documentation is a `/** … */` doc
+// comment, the folder is a `folder '…'` clause, and a workflow activity's
+// caption is `caption '…'`.
+var r9Entries = []Entry{
+	{
+		Code:      DocumentationClause,
+		Old:       "create constant|association|json structure|image collection … comment '…'",
+		Canonical: "/** … */ before the statement",
+		Rewrite: Rewrite{Structural: "documentation as a doc comment: the clause is deleted and its text " +
+			"written as `/** … */` before the statement"},
+		RemovedIn: 2,
+		Note: "Documentation is a doc comment on every document. A statement that has both is reported, " +
+			"not rewritten, and so is a text a doc comment cannot hold exactly (a `*/`, blank lines, " +
+			"or space at the start or end of a line).",
+		Example:          "create constant M.ApiUrl type string default 'https://x' comment 'Base URL';",
+		CanonicalExample: "/** Base URL */\ncreate constant M.ApiUrl type string default 'https://x';",
+	},
+	{
+		Code:             WorkflowCommentCaption,
+		Old:              "<workflow activity> comment '…'",
+		Canonical:        "<workflow activity> caption '…'",
+		Rewrite:          Rewrite{Token: "comment", Replacement: "caption"},
+		RemovedIn:        2,
+		Note:             "The clause sets the caption Studio Pro shows on the activity; it was never a comment. Also on `end workflow` and an event sub-process's timer start.",
+		Example:          "create workflow M.W parameter $WorkflowContext: M.E begin notification Ready comment 'Ready'; end workflow;",
+		CanonicalExample: "create workflow M.W parameter $WorkflowContext: M.E begin notification Ready caption 'Ready'; end workflow;",
+	},
+	{
+		Code:      FolderProperty,
+		Old:       "create page|snippet|consumed rest service|… M.N (…, Folder: '…', …)",
+		Canonical: "create page|snippet|consumed rest service|… M.N folder '…' (…)",
+		Rewrite: Rewrite{Structural: "folder as a clause: the property is deleted from the list and written " +
+			"as `folder '…'` after the name"},
+		RemovedIn: 2,
+		Note: "The folder is a clause after the name on every document, as for a microflow or an enumeration. " +
+			"On a page, snippet, consumed REST service, consumed or published OData service and published " +
+			"REST service.",
+		Example:          "create page M.P (Title: 'P', Layout: Atlas_Core.Atlas_Default, Folder: 'Admin') { };",
+		CanonicalExample: "create page M.P folder 'Admin' (Title: 'P', Layout: Atlas_Core.Atlas_Default) { };",
+	},
+	{
+		Code:      DocumentationProperty,
+		Old:       "Documentation: '…' in a regular expression, task queue or scheduled event",
+		Canonical: "/** … */ before the statement",
+		Rewrite: Rewrite{Structural: "documentation as a doc comment: the property is deleted from the list and " +
+			"its text written as `/** … */` before the statement"},
+		RemovedIn: 2,
+		Note: "A statement that has both is reported, not rewritten, and so is a text a doc comment cannot " +
+			"hold exactly.",
+		Example:          "create regular expression M.Zip (Expression: '[0-9]{4}', Documentation: 'Dutch zip');",
+		CanonicalExample: "/** Dutch zip */\ncreate regular expression M.Zip (Expression: '[0-9]{4}');",
+	},
 }
 
 // r8Entries are R8's spellings (ako/mxcli#752). Kept apart from the list above
diff --git a/mdl/executor/bugfix_regression_test.go b/mdl/executor/bugfix_regression_test.go
index 0c1b4ea926..d8007e8c10 100644
--- a/mdl/executor/bugfix_regression_test.go
+++ b/mdl/executor/bugfix_regression_test.go
@@ -249,10 +249,11 @@ func TestLongType_GetTypeName(t *testing.T) {
 }
 
 // =============================================================================
-// Issue #25: DESCRIBE CONSTANT emits COMMENT field
+// Issue #25: DESCRIBE CONSTANT emits the documentation — as a doc comment
+// since R9 (ako/mxcli#755), where `comment '…'` became its deprecated alias.
 // =============================================================================
 
-// TestOutputConstantMDL_WithComment verifies DESCRIBE CONSTANT includes COMMENT clause.
+// TestOutputConstantMDL_WithComment verifies DESCRIBE CONSTANT includes the documentation.
 func TestOutputConstantMDL_WithComment(t *testing.T) {
 	buf := &bytes.Buffer{}
 	e := New(buf)
@@ -266,8 +267,11 @@ func TestOutputConstantMDL_WithComment(t *testing.T) {
 		t.Fatalf("outputConstantMDL: %v", err)
 	}
 	gotStr := buf.String()
-	if !strings.Contains(gotStr, "comment 'Maximum retry attempts'") {
-		t.Errorf("expected comment clause in output, got:\n%s", gotStr)
+	if !strings.HasPrefix(gotStr, "/**\n * Maximum retry attempts\n */\ncreate or modify constant") {
+		t.Errorf("expected a doc comment before the statement, got:\n%s", gotStr)
+	}
+	if strings.Contains(gotStr, "comment '") {
+		t.Errorf("describe emitted the deprecated comment clause:\n%s", gotStr)
 	}
 }
 
@@ -284,12 +288,13 @@ func TestOutputConstantMDL_WithoutComment(t *testing.T) {
 		t.Fatalf("outputConstantMDL: %v", err)
 	}
 	gotStr := buf.String()
-	if strings.Contains(gotStr, "comment") {
-		t.Errorf("expected no comment clause, got:\n%s", gotStr)
+	if strings.Contains(gotStr, "comment") || strings.Contains(gotStr, "/**") {
+		t.Errorf("expected no documentation, got:\n%s", gotStr)
 	}
 }
 
-// TestOutputConstantMDL_CommentEscapesSingleQuotes verifies quotes in COMMENT are escaped.
+// TestOutputConstantMDL_CommentEscapesSingleQuotes verifies a quote in the
+// documentation is written as is: a doc comment is not a string literal.
 func TestOutputConstantMDL_CommentEscapesSingleQuotes(t *testing.T) {
 	buf := &bytes.Buffer{}
 	e := New(buf)
@@ -303,8 +308,8 @@ func TestOutputConstantMDL_CommentEscapesSingleQuotes(t *testing.T) {
 		t.Fatalf("outputConstantMDL: %v", err)
 	}
 	gotStr := buf.String()
-	if !strings.Contains(gotStr, "comment 'It''s a test'") {
-		t.Errorf("expected escaped quote in comment, got:\n%s", gotStr)
+	if !strings.Contains(gotStr, " * It's a test\n") {
+		t.Errorf("expected the quote in the doc comment, got:\n%s", gotStr)
 	}
 }
 
diff --git a/mdl/executor/cmd_associations.go b/mdl/executor/cmd_associations.go
index cc3c8b16e6..7498eb41d3 100644
--- a/mdl/executor/cmd_associations.go
+++ b/mdl/executor/cmd_associations.go
@@ -716,33 +716,18 @@ func associationExists(dm *domainmodel.DomainModel, name string) bool {
 	return false
 }
 
-// associationDocumentation resolves the documentation a CREATE ASSOCIATION
-// carries, from either spelling.
-//
-// An association was the one domain-model element with no way to document it on
-// create: `comment 'text'` was accepted and dropped, and the `/** … */` doc
-// comment was dropped too — the plain-CREATE branches built the association
-// without Documentation at all, while the OR MODIFY branches beside them set it.
-// `mx check` passed, because an undocumented association is valid.
-//
-// The doc comment wins when both are present, matching the precedence the entity
-// path already uses. `comment` survives here — and only here among the CREATE
-// statements — because it is an association's only inline spelling; everywhere
-// else the doc comment already worked, so the dead option was removed instead.
 // associationDocumentationStated reports whether the statement said anything
-// about documentation — a doc comment (even an empty one) or a COMMENT clause.
-// The OR MODIFY path used `if doc != ""`, which preserved the stored value but
-// also made it unclearable; #1018's rule is that an explicitly empty comment
-// clears while an absent one preserves.
+// about documentation — a doc comment, even an empty one. The OR MODIFY path
+// used `if doc != ""`, which preserved the stored value but also made it
+// unclearable; #1018's rule is that an explicitly empty comment clears while
+// an absent one preserves. The `comment '…'` clause is folded into the doc
+// comment by the visitor (R9, where it is a deprecated alias).
 func associationDocumentationStated(s *ast.CreateAssociationStmt) bool {
-	return s.DocumentationSet || s.Comment != ""
+	return s.DocumentationSet
 }
 
 func associationDocumentation(s *ast.CreateAssociationStmt) string {
-	if s.Documentation != "" {
-		return s.Documentation
-	}
-	return s.Comment
+	return s.Documentation
 }
 
 // describeDeleteClause renders a child delete behaviour as MDL.
diff --git a/mdl/executor/cmd_associations_documentation_test.go b/mdl/executor/cmd_associations_documentation_test.go
index 1f5eb6efd6..63d3c3361a 100644
--- a/mdl/executor/cmd_associations_documentation_test.go
+++ b/mdl/executor/cmd_associations_documentation_test.go
@@ -7,6 +7,7 @@ import (
 
 	"github.com/mendixlabs/mxcli/mdl/ast"
 	"github.com/mendixlabs/mxcli/mdl/backend/mock"
+	"github.com/mendixlabs/mxcli/mdl/visitor"
 	"github.com/mendixlabs/mxcli/model"
 	"github.com/mendixlabs/mxcli/sdk/domainmodel"
 )
@@ -91,23 +92,21 @@ func TestCreateAssociationStoresTheDocComment(t *testing.T) {
 	}
 }
 
-// `comment 'text'` still works here. It is the only inline spelling an
-// association has, which is why it survived the removal that took it off every
-// other CREATE.
+// `comment 'text'` still works here. It is a deprecated alias of the doc
+// comment (R9, MDL-DEPR100): the visitor folds it into Documentation, so it is
+// parsed rather than set on the AST, which no longer has a field for it.
 func TestCreateAssociationStoresTheCommentOption(t *testing.T) {
 	ctx, created := assocCtx(t)
 
-	s := createAssocStmt()
-	s.Comment = "Links a child to its parent."
+	s := parseAssocStmt(t, "create association As.Child_Parent from As.Child to As.Parent comment 'Links a child to its parent.';")
 	assertNoError(t, execCreateAssociation(ctx, s))
 
 	got := *created
 	if got == nil {
 		t.Fatal("CreateAssociation was never called")
 	}
-	if got.Documentation != s.Comment {
-		t.Errorf("Documentation = %q, want %q — the comment option was dropped on create",
-			got.Documentation, s.Comment)
+	if got.Documentation != "Links a child to its parent." {
+		t.Errorf("Documentation = %q — the comment option was dropped on create", got.Documentation)
 	}
 }
 
@@ -116,9 +115,8 @@ func TestCreateAssociationStoresTheCommentOption(t *testing.T) {
 func TestCreateAssociationPrefersTheDocCommentOverTheOption(t *testing.T) {
 	ctx, created := assocCtx(t)
 
-	s := createAssocStmt()
-	s.Documentation = "From the doc comment."
-	s.Comment = "From the option."
+	s := parseAssocStmt(t, "/** From the doc comment. */\n"+
+		"create association As.Child_Parent from As.Child to As.Parent comment 'From the option.';")
 	assertNoError(t, execCreateAssociation(ctx, s))
 
 	if got := (*created).Documentation; got != "From the doc comment." {
@@ -126,6 +124,19 @@ func TestCreateAssociationPrefersTheDocCommentOverTheOption(t *testing.T) {
 	}
 }
 
+func parseAssocStmt(t *testing.T, src string) *ast.CreateAssociationStmt {
+	t.Helper()
+	prog, errs := visitor.Build(src)
+	if len(errs) > 0 {
+		t.Fatal(errs)
+	}
+	s, ok := prog.Statements[0].(*ast.CreateAssociationStmt)
+	if !ok {
+		t.Fatalf("got %T", prog.Statements[0])
+	}
+	return s
+}
+
 // The control: an association with neither is created with empty documentation,
 // not with something invented. Without this, "documentation is stored" could be
 // satisfied by writing a placeholder.
diff --git a/mdl/executor/cmd_constants.go b/mdl/executor/cmd_constants.go
index 172da93557..e1791b82fa 100644
--- a/mdl/executor/cmd_constants.go
+++ b/mdl/executor/cmd_constants.go
@@ -110,6 +110,10 @@ func outputConstantMDL(ctx *ExecContext, c *model.Constant, moduleName string) e
 	// Format default value based on type
 	defaultValueStr := formatDefaultValue(c.Type, c.DefaultValue)
 
+	// Documentation is a doc comment (R9); `comment '…'` is its deprecated alias.
+	if c.Documentation != "" {
+		fmt.Fprintf(ctx.Output, "/**\n * %s\n */\n", strings.ReplaceAll(c.Documentation, "\n", "\n * "))
+	}
 	fmt.Fprintf(ctx.Output, "create or modify constant %s.%s\n", moduleName, c.Name)
 	fmt.Fprintf(ctx.Output, "  type %s\n", formatConstantTypeForMDL(c.Type))
 	fmt.Fprintf(ctx.Output, "  default %s", defaultValueStr)
@@ -122,11 +126,6 @@ func outputConstantMDL(ctx *ExecContext, c *model.Constant, moduleName string) e
 		}
 	}
 
-	// Add options if present
-	if c.Documentation != "" {
-		escaped := strings.ReplaceAll(c.Documentation, "'", "''")
-		fmt.Fprintf(ctx.Output, "\n  comment '%s'", escaped)
-	}
 	if c.ExposedToClient {
 		fmt.Fprintf(ctx.Output, "\n  exposed to client")
 	}
@@ -286,15 +285,12 @@ func createConstant(ctx *ExecContext, stmt *ast.CreateConstantStmt) error {
 			modName := h.GetModuleName(modID)
 			if strings.EqualFold(modName, stmt.Name.Module) && strings.EqualFold(c.Name, stmt.Name.Name) {
 				if stmt.CreateOrModify {
-					// Update existing constant — COMMENT takes precedence over
-					// doc-comment, and a rewrite that mentioned NEITHER keeps
-					// what is stored (#1018).
-					if stmt.Comment != "" {
-						c.Documentation = stmt.Comment
-					} else {
-						c.Documentation = carriedDocumentation(
-							stmt.DocumentationSet, stmt.Documentation, c.Documentation)
-					}
+					// Update existing constant — a rewrite that states no
+					// documentation keeps what is stored (#1018). The
+					// `comment '…'` clause is folded into Documentation by
+					// the visitor (R9).
+					c.Documentation = carriedDocumentation(
+						stmt.DocumentationSet, stmt.Documentation, c.Documentation)
 					c.Type = constType
 					c.DefaultValue = defaultValue
 					c.ExposedToClient = stmt.ExposedToClient
@@ -317,11 +313,7 @@ func createConstant(ctx *ExecContext, stmt *ast.CreateConstantStmt) error {
 		}
 	}
 
-	// COMMENT 'text' takes precedence; fall back to /** */ doc-comment
-	doc := stmt.Comment
-	if doc == "" {
-		doc = stmt.Documentation
-	}
+	doc := stmt.Documentation
 
 	containerID := module.ID
 	if stmt.Folder != "" {
diff --git a/mdl/executor/cmd_jsonstructures.go b/mdl/executor/cmd_jsonstructures.go
index c2c0cd5e6f..8fa0c63deb 100644
--- a/mdl/executor/cmd_jsonstructures.go
+++ b/mdl/executor/cmd_jsonstructures.go
@@ -89,7 +89,7 @@ func describeJsonStructure(ctx *ExecContext, name ast.QualifiedName) error {
 
 	// Documentation as doc comment
 	if js.Documentation != "" {
-		fmt.Fprintf(ctx.Output, "/**\n * %s\n */\n", js.Documentation)
+		fmt.Fprintf(ctx.Output, "/**\n * %s\n */\n", strings.ReplaceAll(js.Documentation, "\n", "\n * "))
 	}
 
 	// Re-executable CREATE OR MODIFY statement
@@ -97,9 +97,6 @@ func describeJsonStructure(ctx *ExecContext, name ast.QualifiedName) error {
 	if folderPath := h.BuildFolderPath(js.ContainerID); folderPath != "" {
 		fmt.Fprintf(ctx.Output, "\n  folder '%s'", folderPath)
 	}
-	if js.Documentation != "" {
-		fmt.Fprintf(ctx.Output, "\n  comment '%s'", strings.ReplaceAll(js.Documentation, "'", "''"))
-	}
 
 	if js.JsonSnippet != "" {
 		snippet := types.PrettyPrintJSON(js.JsonSnippet)
diff --git a/mdl/executor/cmd_odata.go b/mdl/executor/cmd_odata.go
index 2130d4c290..f92c63c961 100644
--- a/mdl/executor/cmd_odata.go
+++ b/mdl/executor/cmd_odata.go
@@ -139,12 +139,14 @@ func outputConsumedODataServiceMDL(ctx *ExecContext, svc *model.ConsumedODataSer
 	// describe cannot print, so re-running this output on an existing document would silently
 	// lose Studio Pro-authored content; a plain `create` refuses instead. Switch the verb only
 	// once the rewrite's carry is proven by the round-trip harness (see #743).
-	fmt.Fprintf(ctx.Output, "create consumed odata service %s.%s (\n", moduleName, svc.Name)
-
-	var props []string
+	// The folder is a clause after the name (R9); `Folder:` is its alias.
+	folder := ""
 	if folderPath != "" {
-		props = append(props, fmt.Sprintf("  Folder: %s", mdlQuote(folderPath)))
+		folder = " folder " + mdlQuote(folderPath)
 	}
+	fmt.Fprintf(ctx.Output, "create consumed odata service %s.%s%s (\n", moduleName, svc.Name, folder)
+
+	var props []string
 	if svc.Version != "" {
 		props = append(props, fmt.Sprintf("  Version: %s", mdlQuote(svc.Version)))
 	}
@@ -335,12 +337,14 @@ func outputPublishedODataServiceMDL(ctx *ExecContext, svc *model.PublishedODataS
 	// (ExportLevel, PageSize without paging, entity-set order, CanBeEmpty), and
 	// TestTestAppRoundTrip holds it to both round-trip laws on the Studio
 	// Pro-authored services of ako/TestApp (#743).
-	fmt.Fprintf(ctx.Output, "create or modify published odata service %s.%s (\n", moduleName, svc.Name)
-
-	var props []string
+	// The folder is a clause after the name (R9); `Folder:` is its alias.
+	folder := ""
 	if folderPath != "" {
-		props = append(props, "  Folder: "+mdlQuoted(folderPath))
+		folder = " folder " + mdlQuoted(folderPath)
 	}
+	fmt.Fprintf(ctx.Output, "create or modify published odata service %s.%s%s (\n", moduleName, svc.Name, folder)
+
+	var props []string
 	if svc.Path != "" {
 		props = append(props, "  Path: "+mdlQuoted(svc.Path))
 	}
diff --git a/mdl/executor/cmd_pages_describe.go b/mdl/executor/cmd_pages_describe.go
index 61de300fab..593e94b363 100644
--- a/mdl/executor/cmd_pages_describe.go
+++ b/mdl/executor/cmd_pages_describe.go
@@ -88,6 +88,10 @@ func describePage(ctx *ExecContext, name ast.QualifiedName) error {
 
 	// V3 syntax: CREATE PAGE Module.Page (Title: '...', Layout: ..., Params: { })
 	header := fmt.Sprintf("create or modify page %s.%s", modName, foundPage.Name)
+	// The folder is a clause after the name (R9); `Folder:` is its alias.
+	if folderPath := h.BuildFolderPath(foundPage.ContainerID); folderPath != "" {
+		header += " folder " + mdlQuote(folderPath)
+	}
 	props := []string{}
 	if title != "" {
 		props = append(props, fmt.Sprintf("Title: %s", mdlQuote(title)))
@@ -98,9 +102,6 @@ func describePage(ctx *ExecContext, name ast.QualifiedName) error {
 	if foundPage.URL != "" {
 		props = append(props, fmt.Sprintf("Url: %s", mdlQuote(foundPage.URL)))
 	}
-	if folderPath := h.BuildFolderPath(foundPage.ContainerID); folderPath != "" {
-		props = append(props, fmt.Sprintf("Folder: %s", mdlQuote(folderPath)))
-	}
 	// Pop-up dimensions (issues #661, #713) — emit only non-default values so
 	// the CREATE PAGE header round-trips. Studio Pro's default is 0/0 (auto-size);
 	// an explicit non-zero value (e.g. 600) is emitted so it round-trips.
@@ -271,8 +272,11 @@ func describeSnippet(ctx *ExecContext, name ast.QualifiedName) error {
 
 	// Output CREATE SNIPPET statement (V3 syntax)
 	fmt.Fprintf(ctx.Output, "create or modify snippet %s.%s", modName, foundSnippet.Name)
-	folderPath := h.BuildFolderPath(foundSnippet.ContainerID)
-	if len(params) > 0 || folderPath != "" {
+	// The folder is a clause after the name (R9); `Folder:` is its alias.
+	if folderPath := h.BuildFolderPath(foundSnippet.ContainerID); folderPath != "" {
+		fmt.Fprintf(ctx.Output, " folder %s", mdlQuote(folderPath))
+	}
+	if len(params) > 0 {
 		snippetProps := []string{}
 		if len(params) > 0 {
 			paramParts := []string{}
@@ -282,9 +286,6 @@ func describeSnippet(ctx *ExecContext, name ast.QualifiedName) error {
 			}
 			snippetProps = append(snippetProps, fmt.Sprintf("Params: { %s }", strings.Join(paramParts, ", ")))
 		}
-		if folderPath != "" {
-			snippetProps = append(snippetProps, fmt.Sprintf("Folder: %s", mdlQuote(folderPath)))
-		}
 		fmt.Fprintf(ctx.Output, " (%s)", strings.Join(snippetProps, ", "))
 	}
 
diff --git a/mdl/executor/cmd_published_rest.go b/mdl/executor/cmd_published_rest.go
index ef85174087..40533f572a 100644
--- a/mdl/executor/cmd_published_rest.go
+++ b/mdl/executor/cmd_published_rest.go
@@ -99,7 +99,12 @@ func describePublishedRestService(ctx *ExecContext, name ast.QualifiedName) erro
 		}
 
 		// Output as re-executable MDL
-		fmt.Fprintf(ctx.Output, "create or modify published rest service %s (\n", qualifiedName)
+		// The folder is a clause after the name (R9); `Folder:` is its alias.
+		folder := ""
+		if folderPath := h.BuildFolderPath(svc.ContainerID); folderPath != "" {
+			folder = " folder " + mdlQuoted(folderPath)
+		}
+		fmt.Fprintf(ctx.Output, "create or modify published rest service %s%s (\n", qualifiedName, folder)
 		fmt.Fprintf(ctx.Output, "  Path: %s", mdlQuoted(svc.Path))
 		if svc.Version != "" {
 			fmt.Fprintf(ctx.Output, ",\n  Version: %s", mdlQuoted(svc.Version))
@@ -107,10 +112,6 @@ func describePublishedRestService(ctx *ExecContext, name ast.QualifiedName) erro
 		if svc.ServiceName != "" {
 			fmt.Fprintf(ctx.Output, ",\n  ServiceName: %s", mdlQuoted(svc.ServiceName))
 		}
-		folderPath := h.BuildFolderPath(svc.ContainerID)
-		if folderPath != "" {
-			fmt.Fprintf(ctx.Output, ",\n  Folder: %s", mdlQuoted(folderPath))
-		}
 		fmt.Fprintln(ctx.Output, "\n)")
 
 		if len(svc.Resources) > 0 {
diff --git a/mdl/executor/cmd_rest_clients.go b/mdl/executor/cmd_rest_clients.go
index 7d50dd84dc..1fa6515ef3 100644
--- a/mdl/executor/cmd_rest_clients.go
+++ b/mdl/executor/cmd_rest_clients.go
@@ -121,7 +121,14 @@ func outputConsumedRestServiceMDL(ctx *ExecContext, svc *model.ConsumedRestServi
 		outputJavadoc(w, svc.Documentation)
 	}
 
-	fmt.Fprintf(w, "create or modify consumed rest service %s.%s (\n", moduleName, svc.Name)
+	// The folder is a clause after the name (R9).
+	folder := ""
+	if h, err := getHierarchy(ctx); err == nil && h != nil {
+		if folderPath := h.BuildFolderPath(svc.ContainerID); folderPath != "" {
+			folder = " folder " + mdlQuoted(folderPath)
+		}
+	}
+	fmt.Fprintf(w, "create or modify consumed rest service %s.%s%s (\n", moduleName, svc.Name, folder)
 	fmt.Fprintf(w, "  BaseUrl: %s,\n", mdlQuoted(svc.BaseUrl))
 	if svc.Authentication == nil {
 		fmt.Fprintln(w, "  Authentication: none")
diff --git a/mdl/executor/cmd_workflows.go b/mdl/executor/cmd_workflows.go
index 241ea23493..1dc4f56f56 100644
--- a/mdl/executor/cmd_workflows.go
+++ b/mdl/executor/cmd_workflows.go
@@ -367,7 +367,7 @@ func formatEventSubProcesses(esps []*workflows.EventSubProcess, indent string) [
 				header += " as " + mdlIdent(start.Name)
 			}
 			if start.Caption != "" {
-				header += " comment " + mdlQuoted(start.Caption)
+				header += " caption " + mdlQuoted(start.Caption)
 			}
 		} else {
 			header += fmt.Sprintf(" on %s notification", trigger)
@@ -431,14 +431,14 @@ func formatFlowActivities(flow *workflows.Flow, indent string, mainFlow bool) []
 			if a.Annotation != "" {
 				actLines = append(actLines, formatAnnotation(a.Annotation, indent))
 			}
-			// Only emit `comment '...'` when it carries information the author
+			// Only emit `caption '...'` when it carries information the author
 			// wrote. buildJumpTo defaults Caption to the target name, so echoing it
 			// unconditionally rendered a plain `jump to Triage;` as
-			// `jump to Triage comment 'Triage'` — a phantom comment nobody authored
+			// `jump to Triage caption 'Triage'` — a phantom comment nobody authored
 			// (issuetracker #16). Re-applying the shorter form rebuilds the same
 			// Caption, so dropping it is lossless.
 			if caption := a.Caption; caption != "" && caption != target && caption != a.Name {
-				actLines = append(actLines, fmt.Sprintf("%sjump to %s comment %s", indent, mdlIdent(target), mdlQuoted(caption)))
+				actLines = append(actLines, fmt.Sprintf("%sjump to %s caption %s", indent, mdlIdent(target), mdlQuoted(caption)))
 			} else {
 				actLines = append(actLines, fmt.Sprintf("%sjump to %s", indent, mdlIdent(target)))
 			}
@@ -452,9 +452,9 @@ func formatFlowActivities(flow *workflows.Flow, indent string, mainFlow bool) []
 			}
 			nameClause := workflowActivityNameClause(a.Name, caption)
 			if a.DelayExpression != "" {
-				actLines = append(actLines, fmt.Sprintf("%swait for timer%s %s comment %s", indent, nameClause, mdlQuoted(a.DelayExpression), mdlQuoted(caption)))
+				actLines = append(actLines, fmt.Sprintf("%swait for timer%s %s caption %s", indent, nameClause, mdlQuoted(a.DelayExpression), mdlQuoted(caption)))
 			} else {
-				actLines = append(actLines, fmt.Sprintf("%swait for timer%s comment %s", indent, nameClause, mdlQuoted(caption)))
+				actLines = append(actLines, fmt.Sprintf("%swait for timer%s caption %s", indent, nameClause, mdlQuoted(caption)))
 			}
 		case *workflows.WaitForNotificationActivity:
 			caption := a.Caption
@@ -477,7 +477,7 @@ func formatFlowActivities(flow *workflows.Flow, indent string, mainFlow bool) []
 				line += " " + mdlIdent(a.Name)
 			}
 			if a.Caption != "" {
-				line += " comment " + mdlQuoted(a.Caption)
+				line += " caption " + mdlQuoted(a.Caption)
 			}
 			actLines = append(actLines, line)
 		case *workflows.StartWorkflowActivity:
@@ -496,7 +496,7 @@ func formatFlowActivities(flow *workflows.Flow, indent string, mainFlow bool) []
 			// `Reject -> End` as `'Reject' { }` — and that, re-executed, falls
 			// through into the main flow.
 			if a.Caption != "" && a.Caption != "End" {
-				actLines = []string{fmt.Sprintf("%send workflow comment %s", indent, mdlQuoted(a.Caption))}
+				actLines = []string{fmt.Sprintf("%send workflow caption %s", indent, mdlQuoted(a.Caption))}
 			} else {
 				actLines = []string{indent + "end workflow"}
 			}
@@ -779,7 +779,7 @@ func formatCallMicroflowTask(a *workflows.CallMicroflowTask, indent string) []st
 	if a.IsAgent {
 		verb = "call agent microflow"
 	}
-	// A caption the author set is emitted as `comment '…'`, which the grammar
+	// A caption the author set is emitted as `caption '…'`, which the grammar
 	// reads back into the caption. It used to be emitted only as a trailing
 	// `-- caption` comment, so describe → exec replaced it with the microflow's
 	// name. The derived default (the microflow's short name) carries nothing and
@@ -787,7 +787,7 @@ func formatCallMicroflowTask(a *workflows.CallMicroflowTask, indent string) []st
 	asAndComment := workflowActivityAsClause(a.Name, shortDocName(mf))
 	trailing := " -- " + caption
 	if a.Caption != "" && a.Caption != shortDocName(mf) {
-		asAndComment += " comment " + mdlQuoted(a.Caption)
+		asAndComment += " caption " + mdlQuoted(a.Caption)
 		trailing = ""
 	}
 	args, legacy := workflowCallArguments(a.ParameterMappings)
@@ -850,7 +850,7 @@ func formatCallWorkflowActivity(a *workflows.CallWorkflowActivity, indent string
 	}
 
 	args, legacy := workflowCallArguments(a.ParameterMappings)
-	lines = append(lines, fmt.Sprintf("%scall workflow %s%s%s comment %s%s", indent, wf, args,
+	lines = append(lines, fmt.Sprintf("%scall workflow %s%s%s caption %s%s", indent, wf, args,
 		workflowActivityAsClause(a.Name, shortDocName(wf)), mdlQuoted(caption), legacy))
 
 	// BoundaryEvents
@@ -896,7 +896,7 @@ func workflowActivityAsClause(name, derived string) string {
 // whose writer defaults the caption to defaultCaption and the name to the
 // caption (decision, parallel split).
 //
-// A caption the author set is emitted as `comment '…'`, which the grammar reads
+// A caption the author set is emitted as `caption '…'`, which the grammar reads
 // back into the caption. It used to be emitted only as a trailing `-- caption`
 // comment, so describe → exec replaced it with the default (ako/mxcli#707). The
 // default carries nothing and stays a plain trailing comment, as for call
@@ -906,7 +906,7 @@ func workflowCaptionClauses(name, caption, defaultCaption string) (nameClause, c
 	written := defaultCaption
 	if caption != "" && caption != defaultCaption {
 		written = caption
-		captionClause = " comment " + mdlQuoted(caption)
+		captionClause = " caption " + mdlQuoted(caption)
 	} else {
 		shown := caption
 		if shown == "" {
diff --git a/mdl/executor/cmd_workflows_describe_test.go b/mdl/executor/cmd_workflows_describe_test.go
index 69e5ab6fd0..194689e54c 100644
--- a/mdl/executor/cmd_workflows_describe_test.go
+++ b/mdl/executor/cmd_workflows_describe_test.go
@@ -85,12 +85,12 @@ func TestFormatJumpTo_CaptionCommentFormat(t *testing.T) {
 			name:    "caption used over name",
 			caption: "Go Back to Review",
 			actName: "jumpAct1",
-			want:    "jump to target1 comment 'Go Back to Review'",
+			want:    "jump to target1 caption 'Go Back to Review'",
 		},
 		{
 			// Was: fell back to the activity name and rendered
-			// `comment 'jumpAct1'`. That comment was never authored — echoing it
-			// made a plain `jump to X;` round-trip as `jump to X comment '…'`
+			// `caption 'jumpAct1'`. That comment was never authored — echoing it
+			// made a plain `jump to X;` round-trip as `jump to X caption '…'`
 			// (issuetracker #16). An absent caption must emit no comment clause.
 			name:    "no comment clause when caption empty",
 			caption: "",
@@ -110,7 +110,7 @@ func TestFormatJumpTo_CaptionCommentFormat(t *testing.T) {
 			name:    "caption with single quote escaped",
 			caption: "it's done",
 			actName: "jumpAct1",
-			want:    "jump to target1 comment 'it''s done'",
+			want:    "jump to target1 caption 'it''s done'",
 		},
 	}
 
@@ -147,7 +147,7 @@ func TestFormatWaitForTimer_CaptionCommentFormat(t *testing.T) {
 			delay:   "${PT2H}",
 			// The stored name is not derivable from the caption, so describe
 			// emits it — dropping it is what broke `jump to` (ako/mxcli#408).
-			want: "wait for timer waitAct1 '${PT2H}' comment 'Wait 2 Hours'",
+			want: "wait for timer waitAct1 '${PT2H}' caption 'Wait 2 Hours'",
 		},
 		{
 			name:    "name fallback no delay",
@@ -156,7 +156,7 @@ func TestFormatWaitForTimer_CaptionCommentFormat(t *testing.T) {
 			delay:   "",
 			// Caption falls back to the name here, so the name is derivable and
 			// the clause is suppressed: unchanged output.
-			want: "wait for timer comment 'waitAct1'",
+			want: "wait for timer caption 'waitAct1'",
 		},
 	}
 
@@ -190,13 +190,13 @@ func TestFormatCallWorkflowActivity_CaptionCommentFormat(t *testing.T) {
 			caption: "Run Sub-Workflow",
 			actName: "callWf1",
 			// callWf1 is not the called workflow's name, so it is emitted.
-			want: "call workflow Module.SubFlow as callWf1 comment 'Run Sub-Workflow'",
+			want: "call workflow Module.SubFlow as callWf1 caption 'Run Sub-Workflow'",
 		},
 		{
 			name:    "name fallback",
 			caption: "",
 			actName: "callWf1",
-			want:    "call workflow Module.SubFlow as callWf1 comment 'callWf1'",
+			want:    "call workflow Module.SubFlow as callWf1 caption 'callWf1'",
 		},
 	}
 
@@ -360,8 +360,8 @@ func TestDescribeWorkflow_NestedEndIsEmitted(t *testing.T) {
 	}
 
 	out := strings.Join(formatSingleActivity(decision, "  "), "\n")
-	if !strings.Contains(out, "end workflow comment 'Rejected';") {
-		t.Errorf("a captioned nested End must describe as `end workflow comment 'Rejected';`, got:\n%s", out)
+	if !strings.Contains(out, "end workflow caption 'Rejected';") {
+		t.Errorf("a captioned nested End must describe as `end workflow caption 'Rejected';`, got:\n%s", out)
 	}
 	if strings.Count(out, "end workflow") != 2 || !strings.Contains(out, "end workflow;") {
 		t.Errorf("a nested End with the default caption must describe as a bare `end workflow;`, got:\n%s", out)
diff --git a/mdl/executor/describe_argument_binding_test.go b/mdl/executor/describe_argument_binding_test.go
index 233097c261..98b5b903ef 100644
--- a/mdl/executor/describe_argument_binding_test.go
+++ b/mdl/executor/describe_argument_binding_test.go
@@ -82,7 +82,7 @@ func TestDescribe_WorkflowCallArguments(t *testing.T) {
 	bare.Name = "act1"
 	bare.Caption = "Go"
 	got := strings.Join(formatSingleActivity(bare, "  "), "\n")
-	if !strings.Contains(got, "call microflow M.G(Order = $WorkflowContext) as act1 comment 'Go'") {
+	if !strings.Contains(got, "call microflow M.G(Order = $WorkflowContext) as act1 caption 'Go'") {
 		t.Errorf("describe = %q", got)
 	}
 	assertCanonicalWorkflowLine(t, got, false)
@@ -96,7 +96,7 @@ func TestDescribe_WorkflowCallArguments(t *testing.T) {
 	odd.Name = "callWorkflow1"
 	odd.Caption = "Sub"
 	got = strings.Join(formatSingleActivity(odd, "  "), "\n")
-	if !strings.Contains(got, "comment 'Sub' with (Order = '") {
+	if !strings.Contains(got, "caption 'Sub' with (Order = '") {
 		t.Errorf("describe = %q", got)
 	}
 	prog := assertCanonicalWorkflowLine(t, got, true)
diff --git a/mdl/executor/validate_workflow_agent_test.go b/mdl/executor/validate_workflow_agent_test.go
index 4dd88be41f..d25eb6f952 100644
--- a/mdl/executor/validate_workflow_agent_test.go
+++ b/mdl/executor/validate_workflow_agent_test.go
@@ -77,7 +77,7 @@ func TestWorkflowAgentTask_DescribeRoundTrips(t *testing.T) {
 	out := strings.Join(formatSingleActivity(task, "  "), "\n")
 	// The caption is authored (not the microflow's name), so it is described as a
 	// comment clause, which re-executes into the caption.
-	if !strings.Contains(out, "call agent microflow workflow.InvokeAgent(workfow1context = $WorkflowContext) as aiAgentTask1 comment 'AI Agent Task'") {
+	if !strings.Contains(out, "call agent microflow workflow.InvokeAgent(workfow1context = $WorkflowContext) as aiAgentTask1 caption 'AI Agent Task'") {
 		t.Fatalf("describe = %q", out)
 	}
 	stmt := parseWorkflowStmt(t, "create workflow M.W\nbegin\n"+out+"\nend workflow;")
diff --git a/mdl/executor/validate_workflow_rewrite.go b/mdl/executor/validate_workflow_rewrite.go
index ba0c6c8f21..cfd8491794 100644
--- a/mdl/executor/validate_workflow_rewrite.go
+++ b/mdl/executor/validate_workflow_rewrite.go
@@ -82,7 +82,7 @@ func checkNoDroppedWorkflowConstructs(ctx *ExecContext, workflowID model.ID, qua
 		return mdlerrors.NewUnsupported(fmt.Sprintf(
 			"workflow %s has %d stored notification activit(ies) but this statement declares %d — rewriting it would "+
 				"delete the difference, and a notify action targeting one would target nothing.\n"+
-				"  Restate them (`notification <name> comment '…';`), which `describe workflow %s` now emits, or use "+
+				"  Restate them (`notification <name> caption '…';`), which `describe workflow %s` now emits, or use "+
 				"ALTER WORKFLOW to change one activity at a time.",
 			qualifiedName, stored, authored, qualifiedName))
 	}
diff --git a/mdl/executor/workflow_callmicroflow_caption_test.go b/mdl/executor/workflow_callmicroflow_caption_test.go
index 420aea917b..8ba29bc98d 100644
--- a/mdl/executor/workflow_callmicroflow_caption_test.go
+++ b/mdl/executor/workflow_callmicroflow_caption_test.go
@@ -20,9 +20,9 @@ func TestFormatCallMicroflow_CaptionRoundTrips(t *testing.T) {
 		name, caption, wantClause string
 		agent                     bool
 	}{
-		{"authored caption", "Summarise the order", "comment 'Summarise the order'", false},
-		{"authored caption on an agent task", "Classify", "comment 'Classify'", true},
-		{"quote escaped", "it's done", "comment 'it''s done'", false},
+		{"authored caption", "Summarise the order", "caption 'Summarise the order'", false},
+		{"authored caption on an agent task", "Classify", "caption 'Classify'", true},
+		{"quote escaped", "it's done", "caption 'it''s done'", false},
 		{"derived default is not a comment clause", "ACT_Summarise", "", false},
 	}
 	for _, c := range cases {
@@ -37,7 +37,7 @@ func TestFormatCallMicroflow_CaptionRoundTrips(t *testing.T) {
 			out := strings.Join(formatSingleActivity(task, "  "), "\n")
 
 			if c.wantClause == "" {
-				if strings.Contains(out, " comment ") {
+				if strings.Contains(out, " caption ") {
 					t.Errorf("derived caption must not become a comment clause: %q", out)
 				}
 			} else if !strings.Contains(out, c.wantClause) {
diff --git a/mdl/executor/workflow_esp_test.go b/mdl/executor/workflow_esp_test.go
index 77f996dba4..15650aea3e 100644
--- a/mdl/executor/workflow_esp_test.go
+++ b/mdl/executor/workflow_esp_test.go
@@ -11,7 +11,7 @@ import (
 )
 
 const espWorkflow = `create workflow M.W parameter $C: M.Ctx begin
-  notification received comment 'Documents received';
+  notification received caption 'Documents received';
   wait for notification waitApproval
     boundary event interrupting notification withdrawn 'Withdrawn' { end workflow; }
     boundary event non interrupting notification nudge 'Nudge' { call microflow M.Log; };
@@ -23,7 +23,7 @@ const espWorkflow = `create workflow M.W parameter $C: M.Ctx begin
     call microflow M.Log as logIt;
     jump to logIt;
   };
-  event subprocess ESP_Expire 'Expire' on interrupting timer 'addDays([%CurrentDateTime%], 30)' as expireStart comment 'After 30 days' {
+  event subprocess ESP_Expire 'Expire' on interrupting timer 'addDays([%CurrentDateTime%], 30)' as expireStart caption 'After 30 days' {
   };
 end workflow;`
 
@@ -103,12 +103,12 @@ func TestWorkflowESP_DescribeRoundTrips(t *testing.T) {
 	}
 	first := format(parseWorkflowStmt(t, espWorkflow))
 	for _, want := range []string{
-		"notification received comment 'Documents received';",
+		"notification received caption 'Documents received';",
 		"boundary event interrupting notification withdrawn 'Withdrawn'",
 		"boundary event non interrupting notification nudge 'Nudge'",
 		"event subprocess ESP_Cancel 'Cancel request' on interrupting notification cancelStart 'Cancel received' {",
 		"event subprocess ESP_Loop on non interrupting notification loopStart 'loopStart' {",
-		"event subprocess ESP_Expire 'Expire' on interrupting timer 'addDays([%CurrentDateTime%], 30)' as expireStart comment 'After 30 days' {",
+		"event subprocess ESP_Expire 'Expire' on interrupting timer 'addDays([%CurrentDateTime%], 30)' as expireStart caption 'After 30 days' {",
 		"jump to logIt;",
 	} {
 		if !strings.Contains(first, want) {
diff --git a/mdl/grammar/domains/MDLDomainModel.g4 b/mdl/grammar/domains/MDLDomainModel.g4
index 65ae1ff81e..4e1fcffa1e 100644
--- a/mdl/grammar/domains/MDLDomainModel.g4
+++ b/mdl/grammar/domains/MDLDomainModel.g4
@@ -194,7 +194,8 @@ associationOption
     | STORAGE COLON? (COLUMN | TABLE)
     | DELETE_BEHAVIOR /* @alias MDL-DEPR022 */ deleteBehavior errorMessageClause?
     | onDeleteClause
-    | COMMENT STRING_LITERAL
+    // R9: documentation is a `/** … */` doc comment before the statement.
+    | COMMENT /* @alias MDL-DEPR100 */ STRING_LITERAL
     ;
 
 // The SQL spelling. Mendix's three delete behaviours ARE SQL's referential
@@ -448,6 +449,9 @@ regularExpressionBody
     : LPAREN (regularExpressionProperty (COMMA regularExpressionProperty)* COMMA?)? RPAREN
     ;
 
+// `Documentation: '…'` is a registered alias of the `/** … */` doc comment
+// (R9) /* @alias MDL-DEPR106 */, here and in the task queue and scheduled
+// event property lists; the visitor reports it by key.
 regularExpressionProperty
     : identifierOrKeyword COLON (STRING_LITERAL | booleanLiteral | identifierOrKeyword)
     ;
@@ -510,7 +514,7 @@ imageCollectionOptions
 
 imageCollectionOption
     : EXPORT LEVEL STRING_LITERAL   // e.g. EXPORT LEVEL 'Public'
-    | COMMENT STRING_LITERAL
+    | COMMENT /* @alias MDL-DEPR100 */ STRING_LITERAL   // R9: a `/** … */` doc comment
     ;
 
 imageCollectionBody
@@ -532,7 +536,7 @@ imageName
 // =============================================================================
 
 createJsonStructureStatement
-    : JSON STRUCTURE qualifiedName (FOLDER STRING_LITERAL)? (COMMENT STRING_LITERAL)? SNIPPET (STRING_LITERAL | DOLLAR_STRING)
+    : JSON STRUCTURE qualifiedName (FOLDER STRING_LITERAL)? (COMMENT /* @alias MDL-DEPR100 */ STRING_LITERAL)? SNIPPET (STRING_LITERAL | DOLLAR_STRING)
       (CUSTOM_NAME_MAP LPAREN customNameMapping (COMMA customNameMapping)* RPAREN)?
     ;
 
@@ -948,7 +952,7 @@ constantOptions
     ;
 
 constantOption
-    : COMMENT STRING_LITERAL
+    : COMMENT /* @alias MDL-DEPR100 */ STRING_LITERAL   // R9: a `/** … */` doc comment
     | FOLDER STRING_LITERAL
     | EXPOSED TO CLIENT
     ;
diff --git a/mdl/grammar/domains/MDLPage.g4 b/mdl/grammar/domains/MDLPage.g4
index e22901c397..1fe14da41b 100644
--- a/mdl/grammar/domains/MDLPage.g4
+++ b/mdl/grammar/domains/MDLPage.g4
@@ -13,8 +13,11 @@ options { tokenVocab = MDLLexer; }
 /**
  * Creates a new page with layout, parameters, and widget content.
  */
+// R9: the folder is a clause after the name, as on every document; the
+// `Folder:` header property is a registered alias.
 createPageStatement
     : PAGE qualifiedName
+      (FOLDER STRING_LITERAL)?
       pageHeaderV3
       LBRACE pageBodyV3 RBRACE
     ;
@@ -39,6 +42,7 @@ createLayoutStatement
 
 createSnippetStatement
     : SNIPPET qualifiedName
+      (FOLDER STRING_LITERAL)?
       snippetHeaderV3?
       snippetOptions?
       LBRACE pageBodyV3 RBRACE
@@ -244,7 +248,7 @@ pageHeaderPropertyV3
     | TITLE COLON STRING_LITERAL                                     // Title: 'My Page'
     | LAYOUT COLON (qualifiedName | STRING_LITERAL)                  // Layout: Atlas_Core.Atlas_Default
     | URL COLON STRING_LITERAL                                       // Url: 'my-page'
-    | FOLDER COLON STRING_LITERAL                                    // Folder: 'Pages/Admin'
+    | FOLDER COLON /* @alias MDL-DEPR105 */ STRING_LITERAL          // Folder: 'Pages/Admin'
     | CLASS COLON STRING_LITERAL                                     // Class: 'my-page bg-primary'
     | STYLE COLON STRING_LITERAL                                     // Style: 'padding: 10px'
     | IDENTIFIER COLON propertyValueV3                               // Generic page property: PopupWidth: 800, PopupResizable: true
@@ -258,7 +262,7 @@ snippetHeaderV3
 snippetHeaderPropertyV3
     : PARAMS COLON LBRACE pageParameterList RBRACE                 // Params: { $Customer: Module.Entity } — entities only (MDL087)
     | VARIABLES_KW COLON LBRACE variableDeclarationList RBRACE     // Variables: { $show: Boolean = 'true' }
-    | FOLDER COLON STRING_LITERAL                                  // Folder: 'Snippets/Common'
+    | FOLDER COLON /* @alias MDL-DEPR105 */ STRING_LITERAL        // Folder: 'Snippets/Common'
     ;
 
 // V3 Page body. Bare widgets bind to the layout's Main placeholder; a
diff --git a/mdl/grammar/domains/MDLService.g4 b/mdl/grammar/domains/MDLService.g4
index a44bb27775..88afe5647d 100644
--- a/mdl/grammar/domains/MDLService.g4
+++ b/mdl/grammar/domains/MDLService.g4
@@ -49,8 +49,12 @@ createConfigurationStatement
 /**
  * CREATE CONSUMED REST SERVICE — property-based syntax with { } blocks.
  */
+// R9: the folder is a clause after the name. `Folder: '…'` in the property
+// list is a registered alias /* @alias MDL-DEPR105 */, here and in the
+// published REST and OData property lists; the visitor reports it by key.
 createRestClientStatement
     : consumedRestServiceKw qualifiedName
+      (FOLDER STRING_LITERAL)?
       LPAREN restClientProperty (COMMA restClientProperty)* RPAREN
       (LBRACE restClientOperation* RBRACE)?
     ;
@@ -105,6 +109,7 @@ restHttpMethod
 
 createPublishedRestServiceStatement
     : PUBLISHED REST SERVICE qualifiedName
+      (FOLDER STRING_LITERAL)?
       LPAREN publishedRestProperty (COMMA publishedRestProperty)* RPAREN
       LBRACE publishedRestResource* RBRACE
     ;
@@ -182,12 +187,14 @@ taskQueuesKw
 
 createODataClientStatement
     : consumedODataServiceKw qualifiedName
+      (FOLDER STRING_LITERAL)?
       LPAREN odataPropertyAssignment (COMMA odataPropertyAssignment)* RPAREN
       odataHeadersClause?
     ;
 
 createODataServiceStatement
     : publishedODataServiceKw qualifiedName
+      (FOLDER STRING_LITERAL)?
       LPAREN odataPropertyAssignment (COMMA odataPropertyAssignment)* RPAREN
       odataAuthenticationClause?
       (LBRACE (publishEntityBlock | publishMicroflowBlock)* RBRACE)?
diff --git a/mdl/grammar/domains/MDLWorkflow.g4 b/mdl/grammar/domains/MDLWorkflow.g4
index 296f414957..e5889661a1 100644
--- a/mdl/grammar/domains/MDLWorkflow.g4
+++ b/mdl/grammar/domains/MDLWorkflow.g4
@@ -68,7 +68,7 @@ workflowEventSubProcess
  */
 workflowEventSubProcessTrigger
     : NOTIFICATION workflowActivityName? STRING_LITERAL?
-    | TIMER STRING_LITERAL (AS workflowActivityName)? (COMMENT STRING_LITERAL)?
+    | TIMER STRING_LITERAL (AS workflowActivityName)? workflowCaption?
     ;
 
 /**
@@ -104,9 +104,19 @@ workflowBody
     : (workflowActivityStmt | workflowEndStmt SEMICOLON | workflowReturnStmt SEMICOLON)*
     ;
 
-/** Ends the whole workflow from inside a branch; `comment` sets the End's caption. */
+/**
+ * An activity's caption, the text Studio Pro shows on it (R9). `comment` was
+ * the first spelling: it set the caption, not a comment, which misled the
+ * reader into taking it for an annotation, so it is a registered alias.
+ */
+workflowCaption
+    : CAPTION STRING_LITERAL
+    | COMMENT /* @alias MDL-DEPR104 */ STRING_LITERAL
+    ;
+
+/** Ends the whole workflow from inside a branch; `caption` sets the End's caption. */
 workflowEndStmt
-    : END WORKFLOW (COMMENT STRING_LITERAL)?
+    : END WORKFLOW workflowCaption?
     ;
 
 /**
@@ -238,7 +248,7 @@ workflowUserTaskOutcome
  * invoked.
  */
 workflowCallMicroflowStmt
-    : CALL AGENT? MICROFLOW qualifiedName workflowCallArguments? (AS workflowActivityName)? (COMMENT STRING_LITERAL)?
+    : CALL AGENT? MICROFLOW qualifiedName workflowCallArguments? (AS workflowActivityName)? workflowCaption?
       (WITH /* @alias MDL-DEPR008 */ LPAREN workflowParameterMapping (COMMA workflowParameterMapping)* RPAREN)?
       (OUTCOMES workflowConditionOutcome+)?
       (BOUNDARY EVENT workflowBoundaryEventClause ((BOUNDARY EVENT)? workflowBoundaryEventClause)*)?
@@ -261,12 +271,12 @@ workflowParameterMapping
     ;
 
 workflowCallWorkflowStmt
-    : CALL WORKFLOW qualifiedName workflowCallArguments? (AS workflowActivityName)? (COMMENT STRING_LITERAL)?
+    : CALL WORKFLOW qualifiedName workflowCallArguments? (AS workflowActivityName)? workflowCaption?
       (WITH /* @alias MDL-DEPR008 */ LPAREN workflowParameterMapping (COMMA workflowParameterMapping)* RPAREN)?
     ;
 
 workflowDecisionStmt
-    : DECISION workflowActivityName? STRING_LITERAL? (COMMENT STRING_LITERAL)?
+    : DECISION workflowActivityName? STRING_LITERAL? workflowCaption?
       (OUTCOMES workflowConditionOutcome+)?
     ;
 
@@ -275,7 +285,7 @@ workflowConditionOutcome
     ;
 
 workflowParallelSplitStmt
-    : PARALLEL SPLIT workflowActivityName? (COMMENT STRING_LITERAL)?
+    : PARALLEL SPLIT workflowActivityName? workflowCaption?
       workflowParallelPath+
     ;
 
@@ -284,15 +294,15 @@ workflowParallelPath
     ;
 
 workflowJumpToStmt
-    : JUMP TO (IDENTIFIER | QUOTED_IDENTIFIER) (COMMENT STRING_LITERAL)?
+    : JUMP TO (IDENTIFIER | QUOTED_IDENTIFIER) workflowCaption?
     ;
 
 workflowWaitForTimerStmt
-    : WAIT FOR TIMER workflowActivityName? STRING_LITERAL? (COMMENT STRING_LITERAL)?
+    : WAIT FOR TIMER workflowActivityName? STRING_LITERAL? workflowCaption?
     ;
 
 workflowWaitForNotificationStmt
-    : WAIT FOR NOTIFICATION workflowActivityName? (COMMENT STRING_LITERAL)?
+    : WAIT FOR NOTIFICATION workflowActivityName? workflowCaption?
       (BOUNDARY EVENT workflowBoundaryEventClause ((BOUNDARY EVENT)? workflowBoundaryEventClause)*)?
     ;
 
@@ -301,7 +311,7 @@ workflowWaitForNotificationStmt
  * the point a `notify workflow … target <name>` reaches.
  */
 workflowNotificationStmt
-    : NOTIFICATION workflowActivityName? (COMMENT STRING_LITERAL)?
+    : NOTIFICATION workflowActivityName? workflowCaption?
     ;
 
 workflowAnnotationStmt
diff --git a/mdl/upgrade/argument_binding_test.go b/mdl/upgrade/argument_binding_test.go
index a28683f5fb..13670debf5 100644
--- a/mdl/upgrade/argument_binding_test.go
+++ b/mdl/upgrade/argument_binding_test.go
@@ -45,7 +45,7 @@ create page M.Q (Title: 'Q', Layout: Atlas_Core.Atlas_Default) {
   }
 };
 create workflow M.W parameter $WorkflowContext: M.E begin
-  call microflow M.G(Order = $WorkflowContext) as act1 comment 'Go';
+  call microflow M.G(Order = $WorkflowContext) as act1 caption 'Go';
 end workflow;
 `
 	res := mustUpgrade(t, src, Options{})
diff --git a/mdl/upgrade/metadata_placement_test.go b/mdl/upgrade/metadata_placement_test.go
new file mode 100644
index 0000000000..92e6a7b5e9
--- /dev/null
+++ b/mdl/upgrade/metadata_placement_test.go
@@ -0,0 +1,136 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package upgrade
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
+	"github.com/mendixlabs/mxcli/mdl/visitor"
+)
+
+// R9 (ako/mxcli#755): documentation moves into a `/** … */` doc comment before
+// the statement, the folder into a `folder '…'` clause after the name, and a
+// workflow activity's `comment` becomes `caption`. Each rewrite must build the
+// statements the original built.
+func TestUpgrade_MetadataPlacement(t *testing.T) {
+	for _, tc := range []struct {
+		name, src, want, code string
+	}{
+		{"constant comment clause",
+			"create constant M.Url type string default 'https://x'\n  comment 'Base URL';\n",
+			"/** Base URL */\ncreate constant M.Url type string default 'https://x';\n",
+			deprecation.DocumentationClause},
+		{"indented statement keeps its indent",
+			"  create constant M.Url type string default 'x' comment 'It''s the URL' exposed to client;\n",
+			"  /** It's the URL */\n  create constant M.Url type string default 'x' exposed to client;\n",
+			deprecation.DocumentationClause},
+		{"association comment clause",
+			"CREATE ASSOCIATION M.A_B FROM M.A TO M.B TYPE Reference COMMENT 'Links';\n",
+			"/** Links */\nCREATE ASSOCIATION M.A_B FROM M.A TO M.B TYPE Reference;\n",
+			deprecation.DocumentationClause},
+		{"json structure comment clause",
+			"create json structure M.J folder 'Json' comment 'Shape' snippet '{\"a\": 1}';\n",
+			"/** Shape */\ncreate json structure M.J folder 'Json' snippet '{\"a\": 1}';\n",
+			deprecation.DocumentationClause},
+		{"image collection comment clause",
+			"create image collection M.Icons export level 'Public' comment 'Icons';\n",
+			"/** Icons */\ncreate image collection M.Icons export level 'Public';\n",
+			deprecation.DocumentationClause},
+		// A statement with both spellings keeps the documentation it stored:
+		// on a constant the clause wins, so the doc comment is demoted to a
+		// plain comment and the clause becomes the doc comment; on an
+		// association the doc comment wins, so the clause is deleted.
+		{"constant with both, the clause wins",
+			"/**\n * Level 1: a constant\n */\ncreate constant M.Url type string default 'x'\ncomment 'Clause';\n",
+			"/*\n * Level 1: a constant\n */\n/** Clause */\ncreate constant M.Url type string default 'x';\n",
+			deprecation.DocumentationClause},
+		{"association with both, the doc comment wins",
+			"/** Doc */\ncreate association M.A_B from M.A to M.B comment 'Clause';\n",
+			"/** Doc */\ncreate association M.A_B from M.A to M.B;\n",
+			deprecation.DocumentationClause},
+		{"documentation property, first",
+			"create task queue M.Q (Documentation: 'Jobs', Parallelism: 2);\n",
+			"/** Jobs */\ncreate task queue M.Q (Parallelism: 2);\n",
+			deprecation.DocumentationProperty},
+		{"documentation property, last",
+			"create regular expression M.Zip (Expression: '[0-9]{4}', Documentation: 'Zip');\n",
+			"/** Zip */\ncreate regular expression M.Zip (Expression: '[0-9]{4}');\n",
+			deprecation.DocumentationProperty},
+		{"page Folder property",
+			"create page M.P (Title: 'P', Folder: 'Admin', Layout: Atlas_Core.Atlas_Default) { };\n",
+			"create page M.P folder 'Admin' (Title: 'P', Layout: Atlas_Core.Atlas_Default) { };\n",
+			deprecation.FolderProperty},
+		{"snippet Folder property",
+			"create snippet M.S (Params: { $C: M.E }, Folder: 'Common') { };\n",
+			"create snippet M.S folder 'Common' (Params: { $C: M.E }) { };\n",
+			deprecation.FolderProperty},
+		{"snippet with Folder as its only property",
+			"create snippet M.S(\n  folder: 'Snippets'\n)\n{ };\n",
+			"create snippet M.S folder 'Snippets'\n{ };\n",
+			deprecation.FolderProperty},
+		{"consumed rest service Folder property, upper case",
+			"CREATE CONSUMED REST SERVICE M.Api (BaseUrl: 'https://x', FOLDER: 'Integration', Authentication: none) { };\n",
+			"CREATE CONSUMED REST SERVICE M.Api FOLDER 'Integration' (BaseUrl: 'https://x', Authentication: none) { };\n",
+			deprecation.FolderProperty},
+		{"published rest service Folder property",
+			"create published rest service M.Api (Path: 'rest/api', Folder: 'It''s') { };\n",
+			"create published rest service M.Api folder 'It''s' (Path: 'rest/api') { };\n",
+			deprecation.FolderProperty},
+		{"consumed odata service Folder property",
+			"create consumed odata service M.Crm (Folder: 'Svc', Version: '1.0', ODataVersion: OData4, MetadataUrl: 'https://x/$metadata');\n",
+			"create consumed odata service M.Crm folder 'Svc' (Version: '1.0', ODataVersion: OData4, MetadataUrl: 'https://x/$metadata');\n",
+			deprecation.FolderProperty},
+		{"workflow comment is the caption",
+			"create workflow M.W parameter $WorkflowContext: M.E begin notification Ready COMMENT 'Ready'; end workflow;\n",
+			"create workflow M.W parameter $WorkflowContext: M.E begin notification Ready CAPTION 'Ready'; end workflow;\n",
+			deprecation.WorkflowCommentCaption},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			res := mustUpgrade(t, tc.src, Options{})
+			if res.Source != tc.want {
+				t.Fatalf("got:\n%s\nwant:\n%s", res.Source, tc.want)
+			}
+			if res.Rewritten[tc.code] != 1 {
+				t.Errorf("Rewritten = %v, want one %s", res.Rewritten, tc.code)
+			}
+			before, errs := visitor.Build(tc.src)
+			if len(errs) > 0 {
+				t.Fatal(errs)
+			}
+			after, errs := visitor.Build(res.Source)
+			if len(errs) > 0 {
+				t.Fatal(errs)
+			}
+			if !reflect.DeepEqual(before.Statements, after.Statements) {
+				t.Errorf("the rewrite changed the statement:\n before: %#v\n after:  %#v", before.Statements, after.Statements)
+			}
+			if again := mustUpgrade(t, res.Source, Options{}); again.Changed() {
+				t.Errorf("second upgrade changed the script again: %v", again.Rewritten)
+			}
+		})
+	}
+}
+
+// A use the rewrite cannot move without guessing is reported and left alone:
+// a doc comment that removing one `*` does not demote, a text a doc comment
+// cannot hold, both folder spellings, and a property that is the only one in a
+// list that may not be empty.
+func TestUpgrade_MetadataPlacementUnrewritable(t *testing.T) {
+	for _, src := range []string{
+		"/*** Doc */\ncreate constant M.Url type string default 'x' comment 'Clause';\n",
+		"create constant M.Url type string default 'x' comment 'ends with a space ';\n",
+		"create constant M.Url type string default 'x' comment 'has */ in it';\n",
+		"create page M.P folder 'A' (Title: 'P', Layout: Atlas_Core.Atlas_Default, Folder: 'B') { };\n",
+		"create task queue M.Q (Documentation: 'Only');\n",
+	} {
+		res := mustUpgrade(t, src, Options{})
+		if res.Source != src {
+			t.Errorf("rewrote what it should have reported:\n%s\n->\n%s", src, res.Source)
+		}
+		if len(res.Unrewritten) != 1 {
+			t.Errorf("%q: Unrewritten = %v, want one", src, res.Unrewritten)
+		}
+	}
+}
diff --git a/mdl/visitor/visitor_argument_binding_test.go b/mdl/visitor/visitor_argument_binding_test.go
index d5bea24706..1b6662af53 100644
--- a/mdl/visitor/visitor_argument_binding_test.go
+++ b/mdl/visitor/visitor_argument_binding_test.go
@@ -51,10 +51,10 @@ func TestArgumentBindingAliases(t *testing.T) {
 		{"data source colon", pg("listview lv (DataSource: microflow M.DS(Order: $O, Limit: 10)) { }"),
 			pg("listview lv (DataSource: microflow M.DS(Order = $O, Limit = 10)) { }"),
 			[]string{deprecation.ColonArgument, deprecation.ColonArgument}},
-		{"workflow call microflow", wf("call microflow M.G as act1 comment 'Go' with (M.G.Order = '$WorkflowContext');"),
-			wf("call microflow M.G(Order = $WorkflowContext) as act1 comment 'Go';"), []string{deprecation.WorkflowStringArgument}},
-		{"workflow call workflow", wf("call workflow M.Sub comment 'Sub' with (Order = '$WorkflowContext/M.E_Other');"),
-			wf("call workflow M.Sub(Order = $WorkflowContext/M.E_Other) comment 'Sub';"), []string{deprecation.WorkflowStringArgument}},
+		{"workflow call microflow", wf("call microflow M.G as act1 caption 'Go' with (M.G.Order = '$WorkflowContext');"),
+			wf("call microflow M.G(Order = $WorkflowContext) as act1 caption 'Go';"), []string{deprecation.WorkflowStringArgument}},
+		{"workflow call workflow", wf("call workflow M.Sub caption 'Sub' with (Order = '$WorkflowContext/M.E_Other');"),
+			wf("call workflow M.Sub(Order = $WorkflowContext/M.E_Other) caption 'Sub';"), []string{deprecation.WorkflowStringArgument}},
 		{"workflow expression with a string inside", wf("call microflow M.G with (Label = 'if $WorkflowContext/Name = ''x'' then ''a'' else ''b''');"),
 			wf("call microflow M.G(Label = if $WorkflowContext/Name = 'x' then 'a' else 'b');"), []string{deprecation.WorkflowStringArgument}},
 		{"show message objects", mf("show message 'Hi {1} {2}' type Warning objects [$N, $O/Name] blocking;"),
diff --git a/mdl/visitor/visitor_association.go b/mdl/visitor/visitor_association.go
index a009a72f5b..4a43a0959e 100644
--- a/mdl/visitor/visitor_association.go
+++ b/mdl/visitor/visitor_association.go
@@ -22,10 +22,6 @@ func (b *Builder) ExitCreateAssociationStatement(ctx *parser.CreateAssociationSt
 	}
 
 	stmt := &ast.CreateAssociationStmt{
-		// The doc comment, the same spelling every other document type uses. It
-		// was never captured here, so an association was the one domain-model
-		// element with no working way to document it on create.
-		Documentation:  findDocCommentText(ctx),
 		Name:           buildQualifiedName(names[0]),
 		Parent:         buildQualifiedName(names[1]),
 		Child:          buildQualifiedName(names[2]),
@@ -34,6 +30,11 @@ func (b *Builder) ExitCreateAssociationStatement(ctx *parser.CreateAssociationSt
 		DeleteBehavior: ast.DeleteKeepReferences,
 		IfNotExists:    ctx.IfNotExists() != nil,
 	}
+	// The doc comment, the same spelling every other document type uses. It
+	// was never captured here, so an association was the one domain-model
+	// element with no working way to document it on create. Whether one was
+	// written at all is what lets `create or modify` clear or keep (#1018).
+	stmt.Documentation, stmt.DocumentationSet = findDocComment(ctx)
 
 	// Association options
 	if opts := ctx.AssociationOptions(); opts != nil {
@@ -84,9 +85,14 @@ func (b *Builder) ExitCreateAssociationStatement(ctx *parser.CreateAssociationSt
 				stmt.DeleteErrorMessage = buildErrorMessage(msg)
 			}
 
-			// COMMENT
-			if optCtx.COMMENT() != nil && optCtx.STRING_LITERAL() != nil {
-				stmt.Comment = unquoteStringLit(optCtx.STRING_LITERAL())
+			// R9: `comment '…'` is the documentation, which a doc comment
+			// also states; the doc comment wins, as it always has.
+			if c := optCtx.COMMENT(); c != nil && optCtx.STRING_LITERAL() != nil {
+				text := unquoteStringLit(optCtx.STRING_LITERAL())
+				b.recordDocumentationClause(ctx, c.GetSymbol(), optCtx.STRING_LITERAL().GetSymbol(), text, false)
+				if !stmt.DocumentationSet {
+					stmt.Documentation, stmt.DocumentationSet = text, true
+				}
 			}
 		}
 	}
diff --git a/mdl/visitor/visitor_enumeration.go b/mdl/visitor/visitor_enumeration.go
index 5207027140..84a008155d 100644
--- a/mdl/visitor/visitor_enumeration.go
+++ b/mdl/visitor/visitor_enumeration.go
@@ -108,18 +108,22 @@ func (b *Builder) ExitCreateConstantStatement(ctx *parser.CreateConstantStatemen
 		stmt.DefaultValue = extractLiteralValue(lit)
 	}
 
+	stmt.Documentation, stmt.DocumentationSet = findDocComment(ctx)
+
 	// Handle options (COMMENT, FOLDER, EXPOSED TO CLIENT)
 	if opts := ctx.ConstantOptions(); opts != nil {
 		optsCtx := opts.(*parser.ConstantOptionsContext)
 		for _, opt := range optsCtx.AllConstantOption() {
 			optCtx := opt.(*parser.ConstantOptionContext)
-			if optCtx.COMMENT() != nil && optCtx.STRING_LITERAL() != nil {
-				stmt.Comment = unquoteStringLit(optCtx.STRING_LITERAL())
+			if c := optCtx.COMMENT(); c != nil && optCtx.STRING_LITERAL() != nil {
+				// R9: `comment '…'` is the documentation, which a doc
+				// comment also states; the clause wins, as it always has.
+				text := unquoteStringLit(optCtx.STRING_LITERAL())
+				b.recordDocumentationClause(ctx, c.GetSymbol(), optCtx.STRING_LITERAL().GetSymbol(), text, true)
+				stmt.Documentation, stmt.DocumentationSet = text, true
 			}
 			if optCtx.FOLDER() != nil && optCtx.STRING_LITERAL() != nil {
 				stmt.Folder = unquoteStringLit(optCtx.STRING_LITERAL())
-			} else if optCtx.FOLDER() != nil && optCtx.STRING_LITERAL() != nil {
-				stmt.Folder = unquoteStringLit(optCtx.STRING_LITERAL())
 			} else if optCtx.EXPOSED() != nil {
 				stmt.ExposedToClient = true
 			}
@@ -133,7 +137,6 @@ func (b *Builder) ExitCreateConstantStatement(ctx *parser.CreateConstantStatemen
 			stmt.CreateOrModify = true
 		}
 	}
-	stmt.Documentation, stmt.DocumentationSet = findDocComment(ctx)
 
 	b.statements = append(b.statements, stmt)
 }
diff --git a/mdl/visitor/visitor_enumeration_test.go b/mdl/visitor/visitor_enumeration_test.go
index 461a2fa246..d2f0513b4b 100644
--- a/mdl/visitor/visitor_enumeration_test.go
+++ b/mdl/visitor/visitor_enumeration_test.go
@@ -114,8 +114,9 @@ func TestCreateConstant(t *testing.T) {
 	if stmt.Name.Name != "MaxRetries" {
 		t.Errorf("Got name %s", stmt.Name.Name)
 	}
-	if stmt.Comment != "Max retry count" {
-		t.Errorf("Got Comment %q", stmt.Comment)
+	// `comment '…'` is the documentation (R9, a deprecated alias of the doc comment).
+	if stmt.Documentation != "Max retry count" || !stmt.DocumentationSet {
+		t.Errorf("Got Documentation %q (set %v)", stmt.Documentation, stmt.DocumentationSet)
 	}
 }
 
diff --git a/mdl/visitor/visitor_imagecollection.go b/mdl/visitor/visitor_imagecollection.go
index 59c5cd4582..6d70c5a436 100644
--- a/mdl/visitor/visitor_imagecollection.go
+++ b/mdl/visitor/visitor_imagecollection.go
@@ -27,8 +27,12 @@ func (b *Builder) ExitCreateImageCollectionStatement(ctx *parser.CreateImageColl
 			if optCtx.EXPORT() != nil && optCtx.LEVEL() != nil && optCtx.STRING_LITERAL() != nil {
 				stmt.ExportLevel = unquoteStringLit(optCtx.STRING_LITERAL())
 			}
-			if optCtx.COMMENT() != nil && optCtx.STRING_LITERAL() != nil {
-				stmt.Comment = unquoteStringLit(optCtx.STRING_LITERAL())
+			if c := optCtx.COMMENT(); c != nil && optCtx.STRING_LITERAL() != nil {
+				// R9: `comment '…'` is the documentation, which a doc
+				// comment also states; the clause wins, as it always has.
+				text := unquoteStringLit(optCtx.STRING_LITERAL())
+				b.recordDocumentationClause(ctx, c.GetSymbol(), optCtx.STRING_LITERAL().GetSymbol(), text, true)
+				stmt.Comment, stmt.DocumentationSet = text, true
 			}
 		}
 	}
diff --git a/mdl/visitor/visitor_jsonstructure.go b/mdl/visitor/visitor_jsonstructure.go
index 1f789701d5..008f271421 100644
--- a/mdl/visitor/visitor_jsonstructure.go
+++ b/mdl/visitor/visitor_jsonstructure.go
@@ -23,8 +23,15 @@ func (b *Builder) ExitCreateJsonStructureStatement(ctx *parser.CreateJsonStructu
 		stmt.Folder = unquoteStringLit(allStrings[strIdx])
 		strIdx++
 	}
-	if ctx.COMMENT() != nil && strIdx < len(allStrings) {
-		stmt.Documentation = unquoteStringLit(allStrings[strIdx])
+	// R9: documentation is a doc comment; `comment '…'` is its alias. The
+	// doc comment wins when a statement has both, as it always has.
+	stmt.Documentation, stmt.DocumentationSet = findDocComment(ctx)
+	if c := ctx.COMMENT(); c != nil && strIdx < len(allStrings) {
+		text := unquoteStringLit(allStrings[strIdx])
+		b.recordDocumentationClause(ctx, c.GetSymbol(), allStrings[strIdx].GetSymbol(), text, false)
+		if !stmt.DocumentationSet {
+			stmt.Documentation, stmt.DocumentationSet = text, true
+		}
 	}
 
 	// Parse SNIPPET value — can be STRING_LITERAL or DOLLAR_STRING.
@@ -67,9 +74,6 @@ func (b *Builder) ExitCreateJsonStructureStatement(ctx *parser.CreateJsonStructu
 			stmt.CreateOrModify = true
 		}
 	}
-	if doc := findDocCommentText(ctx); doc != "" {
-		stmt.Documentation = doc
-	}
 
 	b.statements = append(b.statements, stmt)
 }
diff --git a/mdl/visitor/visitor_metadata_placement.go b/mdl/visitor/visitor_metadata_placement.go
new file mode 100644
index 0000000000..64076c5b43
--- /dev/null
+++ b/mdl/visitor/visitor_metadata_placement.go
@@ -0,0 +1,223 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package visitor
+
+import (
+	"strings"
+
+	"github.com/antlr4-go/antlr/v4"
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
+)
+
+// R9 (PROPOSAL_mdl_beta_syntax_freeze.md §3; ADR-0010): where document
+// metadata lives. Documentation is a `/** … */` doc comment before the
+// statement, and the folder a `folder '…'` clause after the name, on every
+// document. The older places — a `comment '…'` clause, a `Documentation:` or
+// `Folder:` property — are registered aliases: they build the same statement,
+// the listeners below record them, and the rewrite moves the text to its
+// canonical place.
+
+// recordDocumentationClause records a `comment '…'` clause (MDL-DEPR100) that
+// spans kw to str inside ctx, with the rewrite that deletes it and writes its
+// text as a doc comment before the statement. wins says which of the two
+// spellings the statement's documentation is when it has both.
+func (b *Builder) recordDocumentationClause(ctx antlr.RuleContext, kw, str antlr.Token, text string, wins bool) {
+	if kw == nil || str == nil {
+		return
+	}
+	b.recordDeprecation(deprecation.DocumentationClause, kw, "")
+	del := ast.TextEdit{Start: startAfterSpace(kw), Stop: str.GetStop() + 1}
+	fix, reason := docCommentFix(ctx, del, text, wins)
+	b.fixLastDeprecation(deprecation.DocumentationClause, fix, reason)
+}
+
+// recordDocumentationProperty records a `Documentation: '…'` property
+// (MDL-DEPR106), item i of a property list, with the rewrite that deletes it
+// from the list and writes its text as a doc comment before the statement.
+// The property overrides a doc comment when a statement has both.
+func (b *Builder) recordDocumentationProperty(ctx antlr.RuleContext, items []antlr.ParserRuleContext, i int, text string) {
+	b.recordDeprecation(deprecation.DocumentationProperty, items[i].GetStart(), "")
+	del, reason := deleteListItem(items, i, nil)
+	if reason != "" {
+		b.fixLastDeprecation(deprecation.DocumentationProperty, nil, reason)
+		return
+	}
+	fix, reason := docCommentFix(ctx, del, text, true)
+	b.fixLastDeprecation(deprecation.DocumentationProperty, fix, reason)
+}
+
+// recordFolderProperty records a `Folder: '…'` property (MDL-DEPR105), item i
+// of a property list, with the rewrite that deletes it from the list and
+// writes `folder '…'` after name. clause reports that the statement also has
+// the clause, which leaves the two to be reconciled by hand. list is the whole
+// bracketed list when it is optional, so an only item goes with its brackets.
+func (b *Builder) recordFolderProperty(name antlr.ParserRuleContext, items []antlr.ParserRuleContext, i int,
+	folder string, clause bool, list antlr.ParserRuleContext) {
+	key := items[i].GetStart()
+	b.recordDeprecation(deprecation.FolderProperty, key, "")
+	if clause {
+		b.fixLastDeprecation(deprecation.FolderProperty, nil,
+			"the statement has both a `folder` clause and a `Folder:` property; delete one by hand")
+		return
+	}
+	lit, ok := stringLiteral(folder)
+	if !ok {
+		b.fixLastDeprecation(deprecation.FolderProperty, nil,
+			"the folder name has a backslash, which a string literal reads differently under each language version")
+		return
+	}
+	del, reason := deleteListItem(items, i, list)
+	if reason != "" {
+		b.fixLastDeprecation(deprecation.FolderProperty, nil, reason)
+		return
+	}
+	// The clause is a keyword, spelt in the case of the statement's own
+	// keywords; the property's key is usually `Folder`, which says nothing.
+	like := key.GetText()
+	if c := findParentCreateStatement(name); c != nil && c.CREATE() != nil {
+		like = c.CREATE().GetText()
+	}
+	ins := insertAt(name.GetStop().GetStop()+1, " "+keywordLike(like, "folder")+" "+lit)
+	b.fixLastDeprecation(deprecation.FolderProperty, &ast.Fix{Edits: []ast.TextEdit{ins, del}}, "")
+}
+
+// docCommentFix is the rewrite that applies del and writes text as a doc
+// comment before the statement ctx is part of, or the reason there is none.
+//
+// A statement that already has a doc comment keeps the meaning it has: when
+// the alias wins (wins), the doc comment was never stored, so it is demoted to
+// a plain `/* … */` comment — its text stays in the script — and the alias's
+// text becomes the doc comment; when the doc comment wins, the alias was never
+// stored, and is deleted.
+func docCommentFix(ctx antlr.RuleContext, del ast.TextEdit, text string, wins bool) (*ast.Fix, string) {
+	stmt := findParentStatement(ctx)
+	if stmt == nil || stmt.GetStart() == nil {
+		return nil, "the statement could not be located"
+	}
+	if doc := docCommentToken(ctx); doc != nil {
+		if !wins {
+			return &ast.Fix{Edits: []ast.TextEdit{del}}, ""
+		}
+		if strings.HasPrefix(doc.GetText(), "/***") {
+			return nil, "the statement also has a `/*** … */` doc comment, which cannot be demoted to a plain " +
+				"comment by removing one `*`; merge the two by hand"
+		}
+		if !docCommentHolds(text) {
+			return nil, "a doc comment cannot hold this text exactly (a `*/`, a blank line, or space at the " +
+				"start or end of a line); write the doc comment by hand"
+		}
+		demote := ast.TextEdit{Start: doc.GetStart(), Stop: doc.GetStart() + 3, Text: "/*"}
+		ins := insertAt(doc.GetStop()+1, "\n"+lineIndent(doc)+"/** "+text+" */")
+		return &ast.Fix{Edits: []ast.TextEdit{demote, ins, del}}, ""
+	}
+	if !docCommentHolds(text) {
+		return nil, "a doc comment cannot hold this text exactly (a `*/`, a blank line, or space at the " +
+			"start or end of a line); write the doc comment by hand"
+	}
+	start := stmt.GetStart()
+	sep := "\n" + lineIndent(start)
+	if !atLineStart(start) {
+		sep = " "
+	}
+	ins := insertAt(start.GetStart(), "/** "+text+" */"+sep)
+	return &ast.Fix{Edits: []ast.TextEdit{ins, del}}, ""
+}
+
+// docCommentToken is the doc comment of the statement ctx is part of, found
+// where findDocComment finds it, or nil.
+func docCommentToken(ctx antlr.RuleContext) antlr.Token {
+	if c := findParentCreateStatement(ctx); c != nil && c.DocComment() != nil {
+		return c.DocComment().GetStart()
+	}
+	if s := findParentStatement(ctx); s != nil && s.DocComment() != nil {
+		return s.DocComment().GetStart()
+	}
+	return nil
+}
+
+// docCommentHolds reports whether a `/** text */` doc comment reads back as
+// exactly text: extractDocComment trims each line and drops blank ones.
+func docCommentHolds(text string) bool {
+	return !strings.Contains(text, "*/") && extractDocComment("/** "+text+" */") == text
+}
+
+// stringLiteral quotes s as an MDL string literal that reads back as s under
+// every language version, or reports that there is none: a backslash is an
+// escape under mdl 0 and a character under mdl 1.
+func stringLiteral(s string) (string, bool) {
+	if strings.Contains(s, `\`) {
+		return "", false
+	}
+	return "'" + strings.ReplaceAll(s, "'", "''") + "'", true
+}
+
+// deleteListItem is the edit that deletes item i of a comma-separated list,
+// with the comma that separates it from its neighbour, or the reason there is
+// none. An only item goes with the brackets when the list is optional (list is
+// the bracketed list), and cannot go when it is not.
+func deleteListItem(items []antlr.ParserRuleContext, i int, list antlr.ParserRuleContext) (ast.TextEdit, string) {
+	switch {
+	case i+1 < len(items):
+		return ast.TextEdit{Start: items[i].GetStart().GetStart(), Stop: items[i+1].GetStart().GetStart()}, ""
+	case i > 0:
+		return ast.TextEdit{Start: items[i-1].GetStop().GetStop() + 1, Stop: items[i].GetStop().GetStop() + 1}, ""
+	case list != nil:
+		return ast.TextEdit{Start: startAfterSpace(list.GetStart()), Stop: list.GetStop().GetStop() + 1}, ""
+	}
+	return ast.TextEdit{}, "it is the only property in the list, which may not be empty"
+}
+
+// startAfterSpace is the offset of tok, moved back over the whitespace before
+// it, so deleting from there removes the clause and the gap that set it off.
+func startAfterSpace(tok antlr.Token) int {
+	in := tok.GetInputStream()
+	i := tok.GetStart()
+	for i > 0 && isBlank(in.GetText(i-1, i-1)) {
+		i--
+	}
+	return i
+}
+
+func isBlank(c string) bool { return c == " " || c == "\t" || c == "\r" || c == "\n" }
+
+// lineIndent is the run of spaces and tabs right before tok.
+func lineIndent(tok antlr.Token) string {
+	in := tok.GetInputStream()
+	i := tok.GetStart()
+	for i > 0 {
+		if c := in.GetText(i-1, i-1); c != " " && c != "\t" {
+			break
+		}
+		i--
+	}
+	if i == tok.GetStart() {
+		return ""
+	}
+	return in.GetText(i, tok.GetStart()-1)
+}
+
+// atLineStart reports whether only spaces and tabs precede tok on its line.
+func atLineStart(tok antlr.Token) bool {
+	in := tok.GetInputStream()
+	for i := tok.GetStart(); i > 0; i-- {
+		switch in.GetText(i-1, i-1) {
+		case " ", "\t":
+			continue
+		case "\n":
+			return true
+		}
+		return false
+	}
+	return true
+}
+
+// ruleContexts converts a generated list of rule contexts to the plain
+// interface the list helpers take.
+func ruleContexts[T antlr.ParserRuleContext](items []T) []antlr.ParserRuleContext {
+	out := make([]antlr.ParserRuleContext, len(items))
+	for i, it := range items {
+		out[i] = it
+	}
+	return out
+}
diff --git a/mdl/visitor/visitor_metadata_placement_test.go b/mdl/visitor/visitor_metadata_placement_test.go
new file mode 100644
index 0000000000..dd0b9bae0d
--- /dev/null
+++ b/mdl/visitor/visitor_metadata_placement_test.go
@@ -0,0 +1,46 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package visitor
+
+import (
+	"reflect"
+	"testing"
+)
+
+// R9 (ako/mxcli#755): a statement's documentation, however it is spelt, must
+// say that it was written. `create or modify` keeps the stored documentation
+// when a statement states none and replaces it when it states one (#1018), so
+// a doc comment whose DocumentationSet stayed false was read as "none stated"
+// and never reached the model on a rewrite — which is what the JSON structure,
+// association, regular expression, task queue and scheduled event visitors did.
+// The alias and the doc comment must build the same statement for the alias to
+// be one, so both set it.
+func TestDocumentationIsStatedWhateverItsSpelling(t *testing.T) {
+	for _, src := range []string{
+		"/** Shape */ create json structure M.J snippet '{}';",
+		"create json structure M.J comment 'Shape' snippet '{}';",
+		"/** Links */ create association M.A_B from M.A to M.B;",
+		"create association M.A_B from M.A to M.B comment 'Links';",
+		"/** Zip */ create regular expression M.Zip (Expression: 'x');",
+		"create regular expression M.Zip (Expression: 'x', Documentation: 'Zip');",
+		"/** Jobs */ create task queue M.Q (Parallelism: 2);",
+		"create task queue M.Q (Parallelism: 2, Documentation: 'Jobs');",
+		"/** Tick */ create scheduled event M.T (Microflow: M.F, Repeat: Daily);",
+		"create scheduled event M.T (Microflow: M.F, Repeat: Daily, Documentation: 'Tick');",
+		"/** Base */ create constant M.C type string default 'x';",
+		"create constant M.C type string default 'x' comment 'Base';",
+		"/** Icons */ create image collection M.I;",
+		"create image collection M.I comment 'Icons';",
+	} {
+		prog, errs := Build(src)
+		if len(errs) > 0 {
+			t.Errorf("%s: %v", src, errs)
+			continue
+		}
+		v := reflect.ValueOf(prog.Statements[0]).Elem()
+		set := v.FieldByName("DocumentationSet")
+		if !set.IsValid() || !set.Bool() {
+			t.Errorf("%s: DocumentationSet is not true on %T", src, prog.Statements[0])
+		}
+	}
+}
diff --git a/mdl/visitor/visitor_odata.go b/mdl/visitor/visitor_odata.go
index acde9fa4e6..c2626f0e1d 100644
--- a/mdl/visitor/visitor_odata.go
+++ b/mdl/visitor/visitor_odata.go
@@ -19,9 +19,14 @@ func (b *Builder) ExitCreateODataClientStatement(ctx *parser.CreateODataClientSt
 	stmt := &ast.CreateODataClientStmt{
 		Name: buildQualifiedName(ctx.QualifiedName()),
 	}
+	// `folder '…'` after the name (R9); `Folder:` in the list is its alias.
+	folderClause := ctx.STRING_LITERAL() != nil
+	if folderClause {
+		stmt.Folder = unquoteStringLit(ctx.STRING_LITERAL())
+	}
 
 	// Parse property assignments
-	for _, propCtx := range ctx.AllOdataPropertyAssignment() {
+	for i, propCtx := range ctx.AllOdataPropertyAssignment() {
 		prop := propCtx.(*parser.OdataPropertyAssignmentContext)
 		name := identifierOrKeywordText(prop.IdentifierOrKeyword())
 		value := odataAssignmentValueText(prop)
@@ -70,7 +75,10 @@ func (b *Builder) ExitCreateODataClientStatement(ctx *parser.CreateODataClientSt
 		case "proxypassword":
 			stmt.ProxyPassword = value
 		case "folder":
-			stmt.Folder = value
+			if !folderClause {
+				stmt.Folder = value
+			}
+			b.recordFolderProperty(ctx.QualifiedName(), ruleContexts(ctx.AllOdataPropertyAssignment()), i, value, folderClause, nil)
 		default:
 			stmt.UnknownProperties = append(stmt.UnknownProperties, name)
 		}
@@ -98,9 +106,14 @@ func (b *Builder) ExitCreateODataServiceStatement(ctx *parser.CreateODataService
 	stmt := &ast.CreateODataServiceStmt{
 		Name: buildQualifiedName(ctx.QualifiedName()),
 	}
+	// `folder '…'` after the name (R9); `Folder:` in the list is its alias.
+	folderClause := ctx.STRING_LITERAL() != nil
+	if folderClause {
+		stmt.Folder = unquoteStringLit(ctx.STRING_LITERAL())
+	}
 
 	// Parse property assignments
-	for _, propCtx := range ctx.AllOdataPropertyAssignment() {
+	for i, propCtx := range ctx.AllOdataPropertyAssignment() {
 		prop := propCtx.(*parser.OdataPropertyAssignmentContext)
 		name := identifierOrKeywordText(prop.IdentifierOrKeyword())
 		value := odataAssignmentValueText(prop)
@@ -127,7 +140,10 @@ func (b *Builder) ExitCreateODataServiceStatement(ctx *parser.CreateODataService
 			stmt.SupportsGraphQL = strings.EqualFold(value, "true") || strings.EqualFold(value, "yes")
 			stmt.SupportsGraphQLSet = true
 		case "folder":
-			stmt.Folder = value
+			if !folderClause {
+				stmt.Folder = value
+			}
+			b.recordFolderProperty(ctx.QualifiedName(), ruleContexts(ctx.AllOdataPropertyAssignment()), i, value, folderClause, nil)
 		default:
 			stmt.UnknownProperties = append(stmt.UnknownProperties, name)
 		}
diff --git a/mdl/visitor/visitor_page_v3.go b/mdl/visitor/visitor_page_v3.go
index 9baa27d7f5..7bcf9cacad 100644
--- a/mdl/visitor/visitor_page_v3.go
+++ b/mdl/visitor/visitor_page_v3.go
@@ -65,6 +65,11 @@ func (b *Builder) buildPageV3(ctx *parser.CreatePageStatementContext) *ast.Creat
 		}
 	}
 
+	// `folder '…'` after the name (R9); the header's `Folder:` is its alias.
+	if lit := ctx.STRING_LITERAL(); lit != nil {
+		stmt.Folder = unquoteStringLit(lit)
+	}
+
 	// Parse V3 header
 	if headerCtx := ctx.PageHeaderV3(); headerCtx != nil {
 		b.parsePageHeaderV3(headerCtx, stmt)
@@ -86,8 +91,9 @@ func (b *Builder) parsePageHeaderV3(ctx parser.IPageHeaderV3Context, stmt *ast.C
 		return
 	}
 	headerCtx := ctx.(*parser.PageHeaderV3Context)
+	page, _ := headerCtx.GetParent().(*parser.CreatePageStatementContext)
 
-	for _, propCtx := range headerCtx.AllPageHeaderPropertyV3() {
+	for i, propCtx := range headerCtx.AllPageHeaderPropertyV3() {
 		prop := propCtx.(*parser.PageHeaderPropertyV3Context)
 
 		if prop.PARAMS() != nil {
@@ -118,9 +124,15 @@ func (b *Builder) parsePageHeaderV3(ctx parser.IPageHeaderV3Context, stmt *ast.C
 				stmt.URL = unquoteStringLit(str)
 			}
 		} else if prop.FOLDER() != nil {
-			// Folder: 'Pages/Admin'
-			if str := prop.STRING_LITERAL(); str != nil {
-				stmt.Folder = unquoteStringLit(str)
+			// Folder: 'Pages/Admin' — the alias of `folder '…'` after the name
+			// (R9, MDL-DEPR105). The clause wins when both are written.
+			if str := prop.STRING_LITERAL(); str != nil && page != nil {
+				clause := page.STRING_LITERAL() != nil
+				if !clause {
+					stmt.Folder = unquoteStringLit(str)
+				}
+				b.recordFolderProperty(page.QualifiedName(), ruleContexts(headerCtx.AllPageHeaderPropertyV3()), i,
+					unquoteStringLit(str), clause, nil)
 			}
 		} else if prop.CLASS() != nil {
 			// Class: 'my-page' — page-level CSS class (issue #714)
@@ -216,6 +228,11 @@ func (b *Builder) buildSnippetV3(ctx *parser.CreateSnippetStatementContext) *ast
 		stmt.Documentation, stmt.DocumentationSet = findDocComment(ctx)
 	}
 
+	// `folder '…'` after the name (R9); the header's `Folder:` is its alias.
+	if lit := ctx.STRING_LITERAL(); lit != nil {
+		stmt.Folder = unquoteStringLit(lit)
+	}
+
 	// Parse V3 header
 	if headerCtx := ctx.SnippetHeaderV3(); headerCtx != nil {
 		b.parseSnippetHeaderV3(headerCtx, stmt)
@@ -246,8 +263,9 @@ func (b *Builder) parseSnippetHeaderV3(ctx parser.ISnippetHeaderV3Context, stmt
 		return
 	}
 	headerCtx := ctx.(*parser.SnippetHeaderV3Context)
+	snippet, _ := headerCtx.GetParent().(*parser.CreateSnippetStatementContext)
 
-	for _, propCtx := range headerCtx.AllSnippetHeaderPropertyV3() {
+	for i, propCtx := range headerCtx.AllSnippetHeaderPropertyV3() {
 		prop := propCtx.(*parser.SnippetHeaderPropertyV3Context)
 
 		if prop.PARAMS() != nil {
@@ -261,9 +279,16 @@ func (b *Builder) parseSnippetHeaderV3(ctx parser.ISnippetHeaderV3Context, stmt
 				stmt.Variables = buildVariableDeclarations(varList)
 			}
 		} else if prop.FOLDER() != nil {
-			// Folder: 'Snippets/Common'
-			if str := prop.STRING_LITERAL(); str != nil {
-				stmt.Folder = unquoteStringLit(str)
+			// Folder: 'Snippets/Common' — the alias of `folder '…'` after the
+			// name (R9, MDL-DEPR105). The clause wins when both are written.
+			if str := prop.STRING_LITERAL(); str != nil && snippet != nil {
+				clause := snippet.STRING_LITERAL() != nil
+				if !clause {
+					stmt.Folder = unquoteStringLit(str)
+				}
+				// The snippet header is optional, so an only `Folder:` goes with it.
+				b.recordFolderProperty(snippet.QualifiedName(), ruleContexts(headerCtx.AllSnippetHeaderPropertyV3()), i,
+					unquoteStringLit(str), clause, headerCtx)
 			}
 		}
 	}
diff --git a/mdl/visitor/visitor_queue.go b/mdl/visitor/visitor_queue.go
index 46a26af7e0..2b8bf1015c 100644
--- a/mdl/visitor/visitor_queue.go
+++ b/mdl/visitor/visitor_queue.go
@@ -13,9 +13,9 @@ import (
 // CREATE [OR REPLACE|MODIFY] QUEUE Module.Name ( ... ).
 func (b *Builder) ExitCreateQueueStatement(ctx *parser.CreateQueueStatementContext) {
 	stmt := &ast.CreateQueueStmt{
-		Name:          buildQualifiedName(ctx.QualifiedName()),
-		Documentation: findDocCommentText(ctx),
+		Name: buildQualifiedName(ctx.QualifiedName()),
 	}
+	stmt.Documentation, stmt.DocumentationSet = findDocComment(ctx)
 	if lit := ctx.STRING_LITERAL(); lit != nil {
 		stmt.Folder = unquoteStringLit(lit)
 	}
@@ -27,7 +27,7 @@ func (b *Builder) ExitCreateQueueStatement(ctx *parser.CreateQueueStatementConte
 
 	if body := ctx.QueueBody(); body != nil {
 		bodyCtx := body.(*parser.QueueBodyContext)
-		for _, prop := range bodyCtx.AllQueueProperty() {
+		for i, prop := range bodyCtx.AllQueueProperty() {
 			pc, ok := prop.(*parser.QueuePropertyContext)
 			if !ok || pc == nil {
 				continue
@@ -45,7 +45,9 @@ func (b *Builder) ExitCreateQueueStatement(ctx *parser.CreateQueueStatementConte
 			case "exportlevel":
 				stmt.ExportLevel = queuePropertyText(pc)
 			case "documentation":
-				stmt.Documentation = queuePropertyText(pc)
+				// R9: an alias of the doc comment, which it overrides.
+				stmt.Documentation, stmt.DocumentationSet = queuePropertyText(pc), true
+				b.recordDocumentationProperty(ctx, ruleContexts(bodyCtx.AllQueueProperty()), i, stmt.Documentation)
 			}
 		}
 	}
diff --git a/mdl/visitor/visitor_regularexpression.go b/mdl/visitor/visitor_regularexpression.go
index a02df975fa..de9e756674 100644
--- a/mdl/visitor/visitor_regularexpression.go
+++ b/mdl/visitor/visitor_regularexpression.go
@@ -13,9 +13,9 @@ import (
 // CREATE [OR REPLACE|MODIFY] REGULAR EXPRESSION Module.Name ( ... ).
 func (b *Builder) ExitCreateRegularExpressionStatement(ctx *parser.CreateRegularExpressionStatementContext) {
 	stmt := &ast.CreateRegularExpressionStmt{
-		Name:          buildQualifiedName(ctx.QualifiedName()),
-		Documentation: findDocCommentText(ctx),
+		Name: buildQualifiedName(ctx.QualifiedName()),
 	}
+	stmt.Documentation, stmt.DocumentationSet = findDocComment(ctx)
 	if lit := ctx.STRING_LITERAL(); lit != nil {
 		stmt.Folder = unquoteStringLit(lit)
 	}
@@ -27,7 +27,7 @@ func (b *Builder) ExitCreateRegularExpressionStatement(ctx *parser.CreateRegular
 
 	if body := ctx.RegularExpressionBody(); body != nil {
 		bodyCtx := body.(*parser.RegularExpressionBodyContext)
-		for _, prop := range bodyCtx.AllRegularExpressionProperty() {
+		for i, prop := range bodyCtx.AllRegularExpressionProperty() {
 			pc, ok := prop.(*parser.RegularExpressionPropertyContext)
 			if !ok || pc == nil {
 				continue
@@ -42,7 +42,9 @@ func (b *Builder) ExitCreateRegularExpressionStatement(ctx *parser.CreateRegular
 			case "exportlevel":
 				stmt.ExportLevel = regularExpressionPropertyText(pc)
 			case "documentation":
-				stmt.Documentation = regularExpressionPropertyText(pc)
+				// R9: an alias of the doc comment, which it overrides.
+				stmt.Documentation, stmt.DocumentationSet = regularExpressionPropertyText(pc), true
+				b.recordDocumentationProperty(ctx, ruleContexts(bodyCtx.AllRegularExpressionProperty()), i, stmt.Documentation)
 			}
 		}
 	}
diff --git a/mdl/visitor/visitor_rest.go b/mdl/visitor/visitor_rest.go
index 459469bac1..105e9cfefe 100644
--- a/mdl/visitor/visitor_rest.go
+++ b/mdl/visitor/visitor_rest.go
@@ -19,9 +19,14 @@ func (b *Builder) ExitCreateRestClientStatement(ctx *parser.CreateRestClientStat
 	stmt := &ast.CreateRestClientStmt{
 		Name: buildQualifiedName(ctx.QualifiedName()),
 	}
+	// `folder '…'` after the name (R9); `Folder:` in the list is its alias.
+	folderClause := ctx.STRING_LITERAL() != nil
+	if folderClause {
+		stmt.Folder = unquoteStringLit(ctx.STRING_LITERAL())
+	}
 
 	// Parse service-level properties (BaseUrl, Authentication, Folder)
-	for _, propCtx := range ctx.AllRestClientProperty() {
+	for i, propCtx := range ctx.AllRestClientProperty() {
 		pc, ok := propCtx.(*parser.RestClientPropertyContext)
 		if !ok || pc == nil {
 			continue
@@ -40,7 +45,11 @@ func (b *Builder) ExitCreateRestClientStatement(ctx *parser.CreateRestClientStat
 			}
 		case "folder":
 			if sl := pc.STRING_LITERAL(); sl != nil {
-				stmt.Folder = unquoteStringLit(sl)
+				if !folderClause {
+					stmt.Folder = unquoteStringLit(sl)
+				}
+				b.recordFolderProperty(ctx.QualifiedName(), ruleContexts(ctx.AllRestClientProperty()), i,
+					unquoteStringLit(sl), folderClause, nil)
 			}
 		case "openapi":
 			if sl := pc.STRING_LITERAL(); sl != nil {
@@ -354,6 +363,11 @@ func (b *Builder) ExitCreatePublishedRestServiceStatement(ctx *parser.CreatePubl
 	stmt := &ast.CreatePublishedRestServiceStmt{
 		Name: buildQualifiedName(ctx.QualifiedName()),
 	}
+	// `folder '…'` after the name (R9); `Folder:` in the list is its alias.
+	folderClause := ctx.STRING_LITERAL() != nil
+	if folderClause {
+		stmt.Folder = unquoteStringLit(ctx.STRING_LITERAL())
+	}
 
 	// Check for CREATE OR MODIFY (or OR REPLACE, treated identically)
 	createStmt := findParentCreateStatement(ctx)
@@ -364,7 +378,7 @@ func (b *Builder) ExitCreatePublishedRestServiceStatement(ctx *parser.CreatePubl
 	}
 
 	// Parse properties (Path, Version, ServiceName)
-	for _, propCtx := range ctx.AllPublishedRestProperty() {
+	for i, propCtx := range ctx.AllPublishedRestProperty() {
 		pc := propCtx.(*parser.PublishedRestPropertyContext)
 		key := identifierOrKeywordText(pc.IdentifierOrKeyword().(*parser.IdentifierOrKeywordContext))
 		b.checkProperty(pc, &publishedRestSchema, key, shapeString)
@@ -377,7 +391,10 @@ func (b *Builder) ExitCreatePublishedRestServiceStatement(ctx *parser.CreatePubl
 		case "servicename":
 			stmt.ServiceName = val
 		case "folder":
-			stmt.Folder = val
+			if !folderClause {
+				stmt.Folder = val
+			}
+			b.recordFolderProperty(ctx.QualifiedName(), ruleContexts(ctx.AllPublishedRestProperty()), i, val, folderClause, nil)
 		}
 	}
 
diff --git a/mdl/visitor/visitor_scheduledevent.go b/mdl/visitor/visitor_scheduledevent.go
index d412bc95cd..a01f169c3f 100644
--- a/mdl/visitor/visitor_scheduledevent.go
+++ b/mdl/visitor/visitor_scheduledevent.go
@@ -19,9 +19,9 @@ import (
 // distinguishable from an omitted one.
 func (b *Builder) ExitCreateScheduledEventStatement(ctx *parser.CreateScheduledEventStatementContext) {
 	stmt := &ast.CreateScheduledEventStmt{
-		Name:          buildQualifiedName(ctx.QualifiedName()),
-		Documentation: findDocCommentText(ctx),
+		Name: buildQualifiedName(ctx.QualifiedName()),
 	}
+	stmt.Documentation, stmt.DocumentationSet = findDocComment(ctx)
 	if lit := ctx.STRING_LITERAL(); lit != nil {
 		stmt.Folder = unquoteStringLit(lit)
 	}
@@ -33,7 +33,7 @@ func (b *Builder) ExitCreateScheduledEventStatement(ctx *parser.CreateScheduledE
 
 	if body := ctx.ScheduledEventBody(); body != nil {
 		bodyCtx := body.(*parser.ScheduledEventBodyContext)
-		for _, prop := range bodyCtx.AllScheduledEventProperty() {
+		for i, prop := range bodyCtx.AllScheduledEventProperty() {
 			pc, ok := prop.(*parser.ScheduledEventPropertyContext)
 			if !ok || pc == nil {
 				continue
@@ -82,7 +82,9 @@ func (b *Builder) ExitCreateScheduledEventStatement(ctx *parser.CreateScheduledE
 			case "exportlevel":
 				stmt.ExportLevel = val
 			case "documentation":
-				stmt.Documentation = val
+				// R9: an alias of the doc comment, which it overrides.
+				stmt.Documentation, stmt.DocumentationSet = val, true
+				b.recordDocumentationProperty(ctx, ruleContexts(bodyCtx.AllScheduledEventProperty()), i, stmt.Documentation)
 			}
 		}
 	}
diff --git a/mdl/visitor/visitor_workflow.go b/mdl/visitor/visitor_workflow.go
index 85e0ef1823..863763b216 100644
--- a/mdl/visitor/visitor_workflow.go
+++ b/mdl/visitor/visitor_workflow.go
@@ -9,6 +9,7 @@ import (
 	"github.com/antlr4-go/antlr/v4"
 
 	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
 	"github.com/mendixlabs/mxcli/mdl/grammar/parser"
 )
 
@@ -468,12 +469,10 @@ func buildWorkflowStatements(children []antlr.Tree) []ast.WorkflowActivityNode {
 	return activities
 }
 
-// buildWorkflowEnd builds `end workflow [comment '<caption>']`.
+// buildWorkflowEnd builds `end workflow [caption '<caption>']`.
 func buildWorkflowEnd(ctx *parser.WorkflowEndStmtContext) *ast.WorkflowEndNode {
 	node := &ast.WorkflowEndNode{}
-	if ctx.COMMENT() != nil && ctx.STRING_LITERAL() != nil {
-		node.Caption = unquoteStringLit(ctx.STRING_LITERAL())
-	}
+	node.Caption = workflowCaptionText(ctx.WorkflowCaption())
 	return node
 }
 
@@ -673,9 +672,7 @@ func buildWorkflowCallMicroflow(ctx parser.IWorkflowCallMicroflowStmtContext) *a
 		Microflow: buildQualifiedName(cmCtx.QualifiedName()),
 	}
 
-	if cmCtx.COMMENT() != nil && cmCtx.STRING_LITERAL() != nil {
-		node.Caption = unquoteStringLit(cmCtx.STRING_LITERAL())
-	}
+	node.Caption = workflowCaptionText(cmCtx.WorkflowCaption())
 
 	for _, outcomeCtx := range cmCtx.AllWorkflowConditionOutcome() {
 		outcome := buildWorkflowConditionOutcome(outcomeCtx)
@@ -747,9 +744,7 @@ func buildWorkflowCallWorkflow(ctx parser.IWorkflowCallWorkflowStmtContext) *ast
 		Workflow: buildQualifiedName(cwCtx.QualifiedName()),
 	}
 
-	if cwCtx.COMMENT() != nil && cwCtx.STRING_LITERAL() != nil {
-		node.Caption = unquoteStringLit(cwCtx.STRING_LITERAL())
-	}
+	node.Caption = workflowCaptionText(cwCtx.WorkflowCaption())
 
 	// Parameter mappings
 	node.ParameterMappings = buildWorkflowCallArguments(cwCtx.WorkflowCallArguments())
@@ -767,26 +762,11 @@ func buildWorkflowDecision(ctx parser.IWorkflowDecisionStmtContext) *ast.Workflo
 		Name: workflowActivityNameText(dCtx.WorkflowActivityName()),
 	}
 
-	allStrings := dCtx.AllSTRING_LITERAL()
-	stringIdx := 0
-
-	// First STRING_LITERAL is the expression (if present and COMMENT is not present or expression comes first)
-	if len(allStrings) > 0 && dCtx.COMMENT() == nil {
-		// All strings are expression
-		node.Expression = unquoteStringLit(allStrings[0])
-		stringIdx = 1
-	} else if len(allStrings) > 0 && dCtx.COMMENT() != nil {
-		// Distinguish expression from comment
-		if len(allStrings) >= 2 {
-			node.Expression = unquoteStringLit(allStrings[0])
-			node.Caption = unquoteStringLit(allStrings[1])
-		} else {
-			// Only one string with COMMENT - it's the caption
-			node.Caption = unquoteStringLit(allStrings[0])
-		}
-		stringIdx = len(allStrings)
+	// The decision's own string is its expression; the caption is in its clause.
+	if s := dCtx.STRING_LITERAL(); s != nil {
+		node.Expression = unquoteStringLit(s)
 	}
-	_ = stringIdx
+	node.Caption = workflowCaptionText(dCtx.WorkflowCaption())
 
 	for _, outcomeCtx := range dCtx.AllWorkflowConditionOutcome() {
 		outcome := buildWorkflowConditionOutcome(outcomeCtx)
@@ -825,9 +805,7 @@ func buildWorkflowParallelSplit(ctx parser.IWorkflowParallelSplitStmtContext) *a
 		Name: workflowActivityNameText(psCtx.WorkflowActivityName()),
 	}
 
-	if psCtx.COMMENT() != nil && psCtx.STRING_LITERAL() != nil {
-		node.Caption = unquoteStringLit(psCtx.STRING_LITERAL())
-	}
+	node.Caption = workflowCaptionText(psCtx.WorkflowCaption())
 
 	for _, pathCtx := range psCtx.AllWorkflowParallelPath() {
 		path := buildWorkflowParallelPath(pathCtx)
@@ -868,9 +846,7 @@ func buildWorkflowJumpTo(ctx parser.IWorkflowJumpToStmtContext) *ast.WorkflowJum
 		Target: target,
 	}
 
-	if jtCtx.COMMENT() != nil && jtCtx.STRING_LITERAL() != nil {
-		node.Caption = unquoteStringLit(jtCtx.STRING_LITERAL())
-	}
+	node.Caption = workflowCaptionText(jtCtx.WorkflowCaption())
 
 	return node
 }
@@ -882,15 +858,10 @@ func buildWorkflowWaitForTimer(ctx parser.IWorkflowWaitForTimerStmtContext) *ast
 		Name: workflowActivityNameText(wtCtx.WorkflowActivityName()),
 	}
 
-	allStrings := wtCtx.AllSTRING_LITERAL()
-	if len(allStrings) > 0 && wtCtx.COMMENT() == nil {
-		node.DelayExpression = unquoteStringLit(allStrings[0])
-	} else if len(allStrings) >= 2 && wtCtx.COMMENT() != nil {
-		node.DelayExpression = unquoteStringLit(allStrings[0])
-		node.Caption = unquoteStringLit(allStrings[1])
-	} else if len(allStrings) == 1 && wtCtx.COMMENT() != nil {
-		node.Caption = unquoteStringLit(allStrings[0])
+	if s := wtCtx.STRING_LITERAL(); s != nil {
+		node.DelayExpression = unquoteStringLit(s)
 	}
+	node.Caption = workflowCaptionText(wtCtx.WorkflowCaption())
 
 	return node
 }
@@ -902,9 +873,7 @@ func buildWorkflowWaitForNotification(ctx parser.IWorkflowWaitForNotificationStm
 		Name: workflowActivityNameText(wnCtx.WorkflowActivityName()),
 	}
 
-	if wnCtx.COMMENT() != nil && wnCtx.STRING_LITERAL() != nil {
-		node.Caption = unquoteStringLit(wnCtx.STRING_LITERAL())
-	}
+	node.Caption = workflowCaptionText(wnCtx.WorkflowCaption())
 
 	// BoundaryEvents (Issue #7)
 	for _, beCtx := range wnCtx.AllWorkflowBoundaryEventClause() {
@@ -948,19 +917,17 @@ func buildBoundaryEventNode(beCtx parser.IWorkflowBoundaryEventClauseContext) as
 	return be
 }
 
-// buildWorkflowNotification builds `notification [<name>] [comment '<caption>']`.
+// buildWorkflowNotification builds `notification [<name>] [caption '<caption>']`.
 func buildWorkflowNotification(ctx parser.IWorkflowNotificationStmtContext) *ast.WorkflowNotificationNode {
 	c := ctx.(*parser.WorkflowNotificationStmtContext)
 	node := &ast.WorkflowNotificationNode{Name: workflowActivityNameText(c.WorkflowActivityName())}
-	if c.COMMENT() != nil && c.STRING_LITERAL() != nil {
-		node.Caption = unquoteStringLit(c.STRING_LITERAL())
-	}
+	node.Caption = workflowCaptionText(c.WorkflowCaption())
 	return node
 }
 
 // buildWorkflowEventSubProcess builds `event subprocess <name> ['<caption>'] on
 // [non] interrupting notification [<start>] ['<caption>'] { … }` and its timer
-// form, `… timer '<first execution time>' [as <start>] [comment '<caption>']`.
+// form, `… timer '<first execution time>' [as <start>] [caption '<caption>']`.
 func buildWorkflowEventSubProcess(ctx parser.IWorkflowEventSubProcessContext) ast.WorkflowEventSubProcessNode {
 	c := ctx.(*parser.WorkflowEventSubProcessContext)
 	node := ast.WorkflowEventSubProcessNode{
@@ -973,17 +940,17 @@ func buildWorkflowEventSubProcess(ctx parser.IWorkflowEventSubProcessContext) as
 	if t, ok := c.WorkflowEventSubProcessTrigger().(*parser.WorkflowEventSubProcessTriggerContext); ok && t != nil {
 		node.Timer = t.TIMER() != nil
 		node.StartName = workflowActivityNameText(t.WorkflowActivityName())
-		strs := t.AllSTRING_LITERAL()
-		switch {
+		// Each alternative has one string of its own: a timer's first
+		// execution time, a notification's caption. A timer's caption is its
+		// `caption '…'` clause.
+		switch s := t.STRING_LITERAL(); {
 		case node.Timer:
-			if len(strs) > 0 {
-				node.FirstExecutionTime = unquoteStringLit(strs[0])
-			}
-			if t.COMMENT() != nil && len(strs) > 1 {
-				node.StartCaption = unquoteStringLit(strs[1])
+			if s != nil {
+				node.FirstExecutionTime = unquoteStringLit(s)
 			}
-		case len(strs) > 0:
-			node.StartCaption = unquoteStringLit(strs[0])
+			node.StartCaption = workflowCaptionText(t.WorkflowCaption())
+		case s != nil:
+			node.StartCaption = unquoteStringLit(s)
 		}
 	}
 	if body := c.WorkflowBody(); body != nil {
@@ -1066,3 +1033,21 @@ func buildWorkflowCompletionRule(ctx *parser.WorkflowCompletionClauseContext) *a
 	}
 	return r
 }
+
+// workflowCaptionText is the caption a `caption '…'` clause (or its alias
+// `comment '…'`) sets, or "" when there is none.
+func workflowCaptionText(ctx parser.IWorkflowCaptionContext) string {
+	c, ok := ctx.(*parser.WorkflowCaptionContext)
+	if !ok || c == nil || c.STRING_LITERAL() == nil {
+		return ""
+	}
+	return unquoteStringLit(c.STRING_LITERAL())
+}
+
+// ExitWorkflowCaption records `comment '…'`, the alias of an activity's
+// `caption '…'` (R9, ako/mxcli#755).
+func (b *Builder) ExitWorkflowCaption(ctx *parser.WorkflowCaptionContext) {
+	if c := ctx.COMMENT(); c != nil {
+		b.recordDeprecation(deprecation.WorkflowCommentCaption, c.GetSymbol(), "")
+	}
+}

From 9b2abb51a91d461cacebca219b8c9ed32fd652fb Mon Sep 17 00:00:00 2001
From: Ako <andrej@koelewijn.net>
Date: Mon, 28 Sep 2026 07:37:05 +0000
Subject: [PATCH 20/35] docs(mdl): R9 canonical metadata placement in skills,
 syntax and docs

Documentation as a /** */ doc comment, the folder as a clause after the name,
and 'caption' for a workflow activity's caption, in the skills, 'mxcli syntax'
entries, docs-site and the quick reference. The deprecated spellings are
named once, with their codes.

Part of #755.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../mendix/database-connections/SKILL.md      | 16 +++-----
 .../download-marketplace-content/SKILL.md     |  2 +-
 .../generate-domain-model/reference/syntax.md |  3 +-
 .../skills/mendix/odata-data-sharing/SKILL.md | 20 ++++------
 .../mendix/regular-expressions/SKILL.md       |  4 +-
 .../skills/mendix/write-workflows/SKILL.md    |  8 ++--
 cmd/mxcli/syntax/features_domain_model.go     | 12 +++---
 cmd/mxcli/syntax/features_integration.go      |  6 +--
 cmd/mxcli/syntax/features_misc.go             | 33 +++++++++------
 cmd/mxcli/syntax/features_page.go             |  8 ++--
 cmd/mxcli/syntax/features_workflow.go         | 40 ++++++++++---------
 docs-site/src/appendixes/quick-reference.md   |  8 ++--
 docs-site/src/language/image-collections.md   | 14 +++----
 docs-site/src/language/page-patterns.md       | 40 ++++++++-----------
 docs-site/src/language/page-structure.md      | 12 +++---
 docs-site/src/language/pages.md               |  6 +--
 docs-site/src/language/scheduled-events.md    |  4 +-
 docs-site/src/language/snippets.md            | 14 +++----
 docs-site/src/language/workflow-activities.md | 28 +++++++------
 .../create-image-collection.md                | 14 +++----
 .../integration/create-json-structure.md      |  6 +--
 .../reference/organization/create-folder.md   |  5 +--
 docs-site/src/reference/organization/move.md  |  7 ++--
 docs-site/src/reference/page/create-page.md   | 12 +++---
 .../src/reference/page/create-snippet.md      | 13 +++---
 docs/01-project/MDL_QUICK_REFERENCE.md        | 28 ++++++-------
 26 files changed, 175 insertions(+), 188 deletions(-)

diff --git a/.claude/skills/mendix/database-connections/SKILL.md b/.claude/skills/mendix/database-connections/SKILL.md
index aa68ec641c..438900d2a6 100644
--- a/.claude/skills/mendix/database-connections/SKILL.md
+++ b/.claude/skills/mendix/database-connections/SKILL.md
@@ -47,21 +47,17 @@ create non-persistent entity MyModule.EmployeeRecord (
 Connection credentials should be stored in constants:
 
 ```sql
--- Connection string (JDBC URL)
+/** JDBC connection string for external database */
 create constant MyModule.DbConnectionString type string
-  default 'jdbc:oracle:thin:@//hostname:1521/SERVICENAME'
-  comment 'JDBC connection string for external database';
+  default 'jdbc:oracle:thin:@//hostname:1521/SERVICENAME';
 
--- Username
+/** Database username */
 create constant MyModule.DbUsername type string
-  default 'app_user'
-  comment 'Database username';
+  default 'app_user';
 
--- Password (use PRIVATE for local development)
+/** Database password - inject via environment variable in production */
 create constant MyModule.DbPassword type string
-  default ''
-  comment 'Database password - inject via environment variable in production'
-  PRIVATE;
+  default '';
 ```
 
 ## Database Connection Syntax
diff --git a/.claude/skills/mendix/download-marketplace-content/SKILL.md b/.claude/skills/mendix/download-marketplace-content/SKILL.md
index e76434a269..3c592c8d73 100644
--- a/.claude/skills/mendix/download-marketplace-content/SKILL.md
+++ b/.claude/skills/mendix/download-marketplace-content/SKILL.md
@@ -300,7 +300,7 @@ DESCRIBE renders imperfectly — a snippet whose body comes out `{ }`, a buildin
 block under "Building blocks are read-only; they cannot be created via MDL" — and
 two imperfect renderings can differ for reasons that have nothing to do with you.
 Those are reported `unknown`, never `changed`, and `--save-edits` refuses to write
-them: replaying `create or modify snippet X (Folder: 'Web') { }` would **empty**
+them: replaying `create or modify snippet X folder 'Web' { }` would **empty**
 the snippet.
 
 **Read `verified`, not just `locallyModified`.** An element that cannot be described is
diff --git a/.claude/skills/mendix/generate-domain-model/reference/syntax.md b/.claude/skills/mendix/generate-domain-model/reference/syntax.md
index 1c110a047d..ae9f9fe011 100644
--- a/.claude/skills/mendix/generate-domain-model/reference/syntax.md
+++ b/.claude/skills/mendix/generate-domain-model/reference/syntax.md
@@ -474,8 +474,7 @@ create association Module.EntityWithFK_ReferencedEntity
 from Module.EntityWithFK to Module.ReferencedEntity
 type reference
 owner default
-on delete set null
-comment 'Additional documentation';
+on delete set null;
 ```
 
 **Idempotency**: plain `create association` is **not** idempotent — re-running it
diff --git a/.claude/skills/mendix/odata-data-sharing/SKILL.md b/.claude/skills/mendix/odata-data-sharing/SKILL.md
index b38a891e72..85184e622a 100644
--- a/.claude/skills/mendix/odata-data-sharing/SKILL.md
+++ b/.claude/skills/mendix/odata-data-sharing/SKILL.md
@@ -202,31 +202,27 @@ Use the `Folder` property to organize OData documents within modules.
 
 ```sql
 -- Format 1: HTTP(S) URL
-create consumed odata service ProductClient.ProductDataApiClient (
+create consumed odata service ProductClient.ProductDataApiClient folder 'Integration/ProductAPI' (
   ODataVersion: OData4,
-  MetadataUrl: 'https://api.example.com/odata/v4/$metadata',
-  Folder: 'Integration/ProductAPI'
+  MetadataUrl: 'https://api.example.com/odata/v4/$metadata'
 );
 
 -- Format 2: Absolute file:// URI
-create consumed odata service ProductClient.ProductDataApiClient (
+create consumed odata service ProductClient.ProductDataApiClient folder 'Integration/ProductAPI' (
   ODataVersion: OData4,
-  MetadataUrl: 'file:///Users/team/contracts/productdataapi.xml',
-  Folder: 'Integration/ProductAPI'
+  MetadataUrl: 'file:///Users/team/contracts/productdataapi.xml'
 );
 
 -- Format 3a: Relative path with ./
-create consumed odata service ProductClient.ProductDataApiClient (
+create consumed odata service ProductClient.ProductDataApiClient folder 'Integration/ProductAPI' (
   ODataVersion: OData4,
-  MetadataUrl: './metadata/productdataapi.xml',
-  Folder: 'Integration/ProductAPI'
+  MetadataUrl: './metadata/productdataapi.xml'
 );
 
 -- Format 3b: Relative path without ./
-create consumed odata service ProductClient.ProductDataApiClient (
+create consumed odata service ProductClient.ProductDataApiClient folder 'Integration/ProductAPI' (
   ODataVersion: OData4,
-  MetadataUrl: 'metadata/productdataapi.xml',
-  Folder: 'Integration/ProductAPI'
+  MetadataUrl: 'metadata/productdataapi.xml'
 );
 
 create published odata service ProductApi.ProductDataApi (
diff --git a/.claude/skills/mendix/regular-expressions/SKILL.md b/.claude/skills/mendix/regular-expressions/SKILL.md
index 0f70dd8847..8cfe16e0a8 100644
--- a/.claude/skills/mendix/regular-expressions/SKILL.md
+++ b/.claude/skills/mendix/regular-expressions/SKILL.md
@@ -23,9 +23,9 @@ list regular expressions;
 list regular expressions in Val;
 describe regular expression Val.EmailAddress;   -- re-executable MDL
 
+/** A, not too restrictive, email address regular expression */
 create regular expression Val.EmailAddress (
-  Expression: '\w+((-|\+|\.)\w+)*@\w+([\.-]?\w+)*(\.\w{2,})+',
-  Documentation: 'A, not too restrictive, email address regular expression'
+  Expression: '\w+((-|\+|\.)\w+)*@\w+([\.-]?\w+)*(\.\w{2,})+'
 );
 
 drop regular expression Val.EmailAddress;
diff --git a/.claude/skills/mendix/write-workflows/SKILL.md b/.claude/skills/mendix/write-workflows/SKILL.md
index bce603c6df..cbc00ae669 100644
--- a/.claude/skills/mendix/write-workflows/SKILL.md
+++ b/.claude/skills/mendix/write-workflows/SKILL.md
@@ -139,7 +139,7 @@ begin
 
   -- An intermediate notification event (Mendix 11.11+): what `notify workflow`
   -- targets by name
-  notification DocumentsReceived comment 'Documents received';
+  notification DocumentsReceived caption 'Documents received';
 
   -- Loop back, or stop the whole workflow, from inside an outcome. A `jump to`
   -- and an `end workflow` must each END their path, so neither can close the
@@ -148,11 +148,11 @@ begin
     page Module.ReviewPage
     outcomes
       'Redo'   { jump to Review; }
-      'Cancel' { end workflow comment 'Cancelled'; }
+      'Cancel' { end workflow caption 'Cancelled'; }
       'Done'   { };
 
   -- Call a sub-workflow
-  call workflow Module.SubProcess as callWorkflow1 comment 'delegate';
+  call workflow Module.SubProcess as callWorkflow1 caption 'delegate';
 end workflow;
 ```
 
@@ -444,7 +444,7 @@ values. The full list and the System **entities** are in `system-module`.
     reaches the end of the workflow needs no `end workflow`.
   - The main flow needs none: the body's closing `end workflow` is its End.
   An outcome left **empty** does not stop anything — it rejoins the main flow.
-  `comment '…'` sets the End's caption, as on every workflow activity.
+  `caption '…'` sets the End's caption, as on every workflow activity (`comment '…'` is its deprecated alias, MDL-DEPR104).
 
 - **A multi-user task says who must respond and how their outcomes decide**:
   `participants all | <n> | <n> percent`, `decide by …` and `await all users`,
diff --git a/cmd/mxcli/syntax/features_domain_model.go b/cmd/mxcli/syntax/features_domain_model.go
index 8f094e8420..387d2ac5e2 100644
--- a/cmd/mxcli/syntax/features_domain_model.go
+++ b/cmd/mxcli/syntax/features_domain_model.go
@@ -287,7 +287,7 @@ func init() {
 			"many-to-one", "many-to-many", "foreign key",
 			"owner", "delete behavior",
 		},
-		Syntax:  "[@anchor(from: (x, y), to: (x, y))]\nCREATE [OR MODIFY] ASSOCIATION Module.Name\n  FROM Module.FromEntity TO Module.ToEntity\n  TYPE Reference|ReferenceSet\n  [OWNER Default|Both]\n  [ON DELETE CASCADE|RESTRICT|SET NULL [ERROR MESSAGE 'text']]\n  [COMMENT 'text'];\nALTER ASSOCIATION Module.Name SET ANCHOR FROM (x, y) TO (x, y);\nDROP ASSOCIATION Module.Name;\n\nOR MODIFY: updates type/owner/delete behavior in-place, preserves UUID.\n\n@anchor sets the LINE ANCHORS — where the connector attaches to each entity box\nin the domain model editor — as a PERCENTAGE of the box (0..100, whole numbers).\n`from` is the FROM entity's box, `to` the TO entity's: (0, 50) is the middle of\nthe left edge, (100, 50) the right, (50, 100) the bottom centre. Omitting an end\nPRESERVES what is stored, so a CREATE OR MODIFY about something else never\nflattens a hand-tuned line. Cross-module associations have no anchors.\n\nDROP reconciles the entity access rules that named the association, and is\nREFUSED while a message definition still exposes it (that one cannot be\nreconciled -- removing the member would change a published contract). The\nrefusal prints the `alter message definition ... drop member` statement for\neach definition, ready to run.",
+		Syntax:  "[@anchor(from: (x, y), to: (x, y))]\nCREATE [OR MODIFY] ASSOCIATION Module.Name\n  FROM Module.FromEntity TO Module.ToEntity\n  TYPE Reference|ReferenceSet\n  [OWNER Default|Both]\n  [ON DELETE CASCADE|RESTRICT|SET NULL [ERROR MESSAGE 'text']];\n-- Documentation: the /** … */ doc comment before the statement\n-- (COMMENT 'text' is its deprecated alias, MDL-DEPR100).\nALTER ASSOCIATION Module.Name SET ANCHOR FROM (x, y) TO (x, y);\nDROP ASSOCIATION Module.Name;\n\nOR MODIFY: updates type/owner/delete behavior in-place, preserves UUID.\n\n@anchor sets the LINE ANCHORS — where the connector attaches to each entity box\nin the domain model editor — as a PERCENTAGE of the box (0..100, whole numbers).\n`from` is the FROM entity's box, `to` the TO entity's: (0, 50) is the middle of\nthe left edge, (100, 50) the right, (50, 100) the bottom centre. Omitting an end\nPRESERVES what is stored, so a CREATE OR MODIFY about something else never\nflattens a hand-tuned line. Cross-module associations have no anchors.\n\nDROP reconciles the entity access rules that named the association, and is\nREFUSED while a message definition still exposes it (that one cannot be\nreconciled -- removing the member would change a published contract). The\nrefusal prints the `alter message definition ... drop member` statement for\neach definition, ready to run.",
 		Example: "-- Many-to-one\nCREATE ASSOCIATION Shop.Order_Customer\n  FROM Shop.Order TO Shop.Customer\n  TYPE Reference\n  OWNER Default\n  ON DELETE SET NULL;\n\n-- Many-to-many\nCREATE ASSOCIATION Shop.Product_Tag\n  FROM Shop.Product TO Shop.Tag\n  TYPE ReferenceSet\n  OWNER Both;\n\n-- Line leaving the bottom of Order and entering the top of Customer\n@anchor(from: (50, 100), to: (50, 0))\nCREATE ASSOCIATION Shop.Order_Customer\n  FROM Shop.Order TO Shop.Customer;\n\n-- Retune the line without restating the association\nALTER ASSOCIATION Shop.Order_Customer SET ANCHOR FROM (0, 54) TO (100, 54);",
 		SeeAlso: []string{"domain-model.association.create", "domain-model.association.anchor", "domain-model.association.delete-behavior"},
 	})
@@ -300,7 +300,7 @@ func init() {
 			"reference set", "junction table", "foreign key",
 			"owner default", "owner both", "storage column", "storage table",
 		},
-		Syntax:  "CREATE [OR MODIFY] ASSOCIATION Module.AssociationName\n  FROM Module.FromEntity TO Module.ToEntity\n  TYPE Reference|ReferenceSet\n  [OWNER Default|Both]\n  [STORAGE COLUMN|TABLE]\n  [ON DELETE CASCADE|RESTRICT|SET NULL [ERROR MESSAGE 'text']]\n  [COMMENT 'text'];\n\nDirection:\n  FROM = entity holding the FK (the \"many\" side)\n  TO   = entity being referenced (the \"one\" side)\n\nTypes:\n  Reference    = Many-to-one (FK column on FROM table)\n  ReferenceSet = Many-to-many (junction table)\n\nOR MODIFY: updates in-place, preserves UUID. Safe to re-run.",
+		Syntax:  "CREATE [OR MODIFY] ASSOCIATION Module.AssociationName\n  FROM Module.FromEntity TO Module.ToEntity\n  TYPE Reference|ReferenceSet\n  [OWNER Default|Both]\n  [STORAGE COLUMN|TABLE]\n  [ON DELETE CASCADE|RESTRICT|SET NULL [ERROR MESSAGE 'text']];\n\nDocumentation: the /** … */ doc comment before the statement\n(COMMENT 'text' is its deprecated alias, MDL-DEPR100).\n\nDirection:\n  FROM = entity holding the FK (the \"many\" side)\n  TO   = entity being referenced (the \"one\" side)\n\nTypes:\n  Reference    = Many-to-one (FK column on FROM table)\n  ReferenceSet = Many-to-many (junction table)\n\nOR MODIFY: updates in-place, preserves UUID. Safe to re-run.",
 		Example: "-- Many-to-one with delete behavior\nCREATE ASSOCIATION Shop.Order_Customer\n  FROM Shop.Order TO Shop.Customer\n  TYPE Reference\n  OWNER Default\n  ON DELETE RESTRICT;\n\n-- Many-to-many\nCREATE ASSOCIATION Shop.Product_Tag\n  FROM Shop.Product TO Shop.Tag\n  TYPE ReferenceSet\n  OWNER Both;\n\n-- Idempotent update\nCREATE OR MODIFY ASSOCIATION Shop.Order_Customer\n  FROM Shop.Order TO Shop.Customer\n  TYPE Reference\n  OWNER Default\n  ON DELETE CASCADE;",
 		SeeAlso: []string{"domain-model.association.delete-behavior", "domain-model.entity.create"},
 	})
@@ -405,8 +405,8 @@ func init() {
 			"constant", "configuration", "config value",
 			"create constant", "setting",
 		},
-		Syntax:  "CREATE CONSTANT Module.Name TYPE DataType DEFAULT value [COMMENT 'text'];\nCREATE OR MODIFY CONSTANT Module.Name TYPE DataType DEFAULT value;\n\nSHOW CONSTANTS;\nDESCRIBE CONSTANT Module.Name;\nDROP CONSTANT Module.Name;",
-		Example: "CREATE CONSTANT MyModule.ApiBaseUrl\n  TYPE String\n  DEFAULT 'https://api.example.com/v1';\n\nCREATE CONSTANT MyModule.MaxRetries\n  TYPE Integer\n  DEFAULT 3\n  COMMENT 'Maximum API retry attempts';",
+		Syntax:  "[/** documentation */]\nCREATE CONSTANT Module.Name TYPE DataType DEFAULT value;\nCREATE OR MODIFY CONSTANT Module.Name TYPE DataType DEFAULT value;\n\nSHOW CONSTANTS;\nDESCRIBE CONSTANT Module.Name;\nDROP CONSTANT Module.Name;",
+		Example: "CREATE CONSTANT MyModule.ApiBaseUrl\n  TYPE String\n  DEFAULT 'https://api.example.com/v1';\n\n/** Maximum API retry attempts */\nCREATE CONSTANT MyModule.MaxRetries\n  TYPE Integer\n  DEFAULT 3;",
 		SeeAlso: []string{"domain-model.constant.create"},
 	})
 
@@ -418,7 +418,7 @@ func init() {
 			"show constants", "constant values", "modify constant",
 			"string constant", "integer constant", "boolean constant",
 		},
-		Syntax: "CREATE CONSTANT Module.Name\n  TYPE String|Integer|Long|Decimal|Boolean|DateTime\n  DEFAULT value\n  [COMMENT 'description'];\n\nCREATE OR MODIFY CONSTANT Module.Name\n  TYPE DataType DEFAULT value [COMMENT 'text'];\n\nSHOW CONSTANTS;\nSHOW CONSTANTS IN <module>;\nSHOW CONSTANT VALUES;\nDESCRIBE CONSTANT Module.Name;\nDROP CONSTANT Module.Name;\n\nRemove override:\n  ALTER SETTINGS DROP CONSTANT 'Module.Name' IN CONFIGURATION 'cfg';\n\n" +
+		Syntax: "[/** description */]\nCREATE CONSTANT Module.Name\n  TYPE String|Integer|Long|Decimal|Boolean|DateTime\n  DEFAULT value;\n\nCREATE OR MODIFY CONSTANT Module.Name\n  TYPE DataType DEFAULT value;\n\n-- Documentation is the /** … */ doc comment; COMMENT 'text' is its\n-- deprecated alias (MDL-DEPR100).\n\nSHOW CONSTANTS;\nSHOW CONSTANTS IN <module>;\nSHOW CONSTANT VALUES;\nDESCRIBE CONSTANT Module.Name;\nDROP CONSTANT Module.Name;\n\nRemove override:\n  ALTER SETTINGS DROP CONSTANT 'Module.Name' IN CONFIGURATION 'cfg';\n\n" +
 			"Shared vs private values:\n" +
 			"  A per-configuration override holds either a SHARED value (stored in the\n" +
 			"  model, so in version control — every developer gets it) or a PRIVATE one\n" +
@@ -430,7 +430,7 @@ func init() {
 			"  SHOW CONSTANT VALUES reports it as (private); DESCRIBE SETTINGS reports it\n" +
 			"  as a comment, not a re-executable statement. DROP CONSTANT still works.\n" +
 			"  Change a constant to a shared value in Studio Pro.",
-		Example: "CREATE CONSTANT MyModule.ApiBaseUrl\n  TYPE String\n  DEFAULT 'https://api.example.com/v1';\n\nCREATE CONSTANT MyModule.MaxRetries\n  TYPE Integer DEFAULT 3\n  COMMENT 'Maximum number of API retry attempts';\n\nCREATE CONSTANT MyModule.EnableDebug\n  TYPE Boolean DEFAULT false;\n\nCREATE OR MODIFY CONSTANT MyModule.ApiBaseUrl\n  TYPE String\n  DEFAULT 'https://api.staging.example.com/v2';",
+		Example: "CREATE CONSTANT MyModule.ApiBaseUrl\n  TYPE String\n  DEFAULT 'https://api.example.com/v1';\n\n/** Maximum number of API retry attempts */\nCREATE CONSTANT MyModule.MaxRetries\n  TYPE Integer DEFAULT 3;\n\nCREATE CONSTANT MyModule.EnableDebug\n  TYPE Boolean DEFAULT false;\n\nCREATE OR MODIFY CONSTANT MyModule.ApiBaseUrl\n  TYPE String\n  DEFAULT 'https://api.staging.example.com/v2';",
 		SeeAlso: []string{"domain-model.constant"},
 	})
 
diff --git a/cmd/mxcli/syntax/features_integration.go b/cmd/mxcli/syntax/features_integration.go
index e1a662c6ec..63f46ee8b2 100644
--- a/cmd/mxcli/syntax/features_integration.go
+++ b/cmd/mxcli/syntax/features_integration.go
@@ -637,7 +637,7 @@ DESCRIBE DATABASE CONNECTION Ops.Erp;`,
 			"json structure", "create json structure", "drop json structure",
 			"snippet", "schema", "json schema",
 		},
-		Syntax: "SHOW JSON STRUCTURES [IN Module];\nDESCRIBE JSON STRUCTURE Module.Name;\nCREATE JSON STRUCTURE Module.Name [FOLDER 'path'] [COMMENT 'text'] SNIPPET '{ ... }'\n  [CUSTOM NAME MAP (\n    'jsonKey' AS 'CustomName',       -- rename the element that key reaches\n    ITEM OF 'arrayKey' AS 'Name',    -- name the ARRAY's item element\n    ITEM OF 'Root' AS 'Name'         -- ... of a ROOT-level array\n  )];\nCREATE OR MODIFY JSON STRUCTURE Module.Name SNIPPET '{ ... }';\nDROP JSON STRUCTURE Module.Name;\n\n" +
+		Syntax: "SHOW JSON STRUCTURES [IN Module];\nDESCRIBE JSON STRUCTURE Module.Name;\n[/** documentation */]\nCREATE JSON STRUCTURE Module.Name [FOLDER 'path'] SNIPPET '{ ... }'\n  [CUSTOM NAME MAP (\n    'jsonKey' AS 'CustomName',       -- rename the element that key reaches\n    ITEM OF 'arrayKey' AS 'Name',    -- name the ARRAY's item element\n    ITEM OF 'Root' AS 'Name'         -- ... of a ROOT-level array\n  )];\nCREATE OR MODIFY JSON STRUCTURE Module.Name SNIPPET '{ ... }';\nDROP JSON STRUCTURE Module.Name;\n\n" +
 			"An array's item is the anonymous [...] entry, so it has no JSON key and the\n" +
 			"plain form cannot reach it — ITEM OF addresses it by the array's key, and\n" +
 			"names a primitive array's wrapper too. Left unnamed an item keeps its\n" +
@@ -657,8 +657,8 @@ DESCRIBE DATABASE CONNECTION Ops.Erp;`,
 			"image collection", "create image collection", "drop image collection",
 			"export level", "image", "icon", "logo",
 		},
-		Syntax:  "SHOW IMAGE COLLECTION [IN Module];\nDESCRIBE IMAGE COLLECTION Module.Name;\nCREATE IMAGE COLLECTION Module.Name [FOLDER 'path']\n  [EXPORT LEVEL 'Hidden'|'Public']\n  [COMMENT 'text']\n  [(IMAGE name FROM FILE 'path', ...)];\nCREATE OR MODIFY IMAGE COLLECTION Module.Name [...];\nDROP IMAGE COLLECTION Module.Name;",
-		Example: "CREATE OR MODIFY IMAGE COLLECTION MyModule.AppIcons\n  EXPORT LEVEL 'Public'\n  COMMENT 'Application icons' (\n  IMAGE logo FROM FILE 'assets/logo.png',\n  IMAGE \"favicon\" FROM FILE 'assets/favicon.ico'\n);\n\nDESCRIBE IMAGE COLLECTION MyModule.AppIcons;",
+		Syntax:  "SHOW IMAGE COLLECTION [IN Module];\nDESCRIBE IMAGE COLLECTION Module.Name;\n[/** documentation */]\nCREATE IMAGE COLLECTION Module.Name [FOLDER 'path']\n  [EXPORT LEVEL 'Hidden'|'Public']\n  [(IMAGE name FROM FILE 'path', ...)];\nCREATE OR MODIFY IMAGE COLLECTION Module.Name [...];\nDROP IMAGE COLLECTION Module.Name;",
+		Example: "/** Application icons */\nCREATE OR MODIFY IMAGE COLLECTION MyModule.AppIcons\n  EXPORT LEVEL 'Public' (\n  IMAGE logo FROM FILE 'assets/logo.png',\n  IMAGE \"favicon\" FROM FILE 'assets/favicon.ico'\n);\n\nDESCRIBE IMAGE COLLECTION MyModule.AppIcons;",
 		SeeAlso: []string{"integration", "icon-collection"},
 	})
 
diff --git a/cmd/mxcli/syntax/features_misc.go b/cmd/mxcli/syntax/features_misc.go
index 88869064a7..ea8549dfe2 100644
--- a/cmd/mxcli/syntax/features_misc.go
+++ b/cmd/mxcli/syntax/features_misc.go
@@ -29,8 +29,9 @@ func init() {
 			"-- every statement ends with ';' and '/' is not a terminator; '' is the\n" +
 			"-- only string escape, so a backslash is an ordinary character; and an\n" +
 			"-- unknown or mis-shaped property key in a REST, business event or agent\n" +
-			"-- property list is an error. A trailing comma is allowed in every\n" +
-			"-- bracketed list, with or without the header.\n" +
+			"-- property list is an error; and a session command (connect, set format,\n" +
+			"-- status, help, …) in a script is an error (MDL-V1-SESSION). A trailing\n" +
+			"-- comma is allowed in every bracketed list, with or without the header.\n" +
 			"--\n" +
 			"-- A script's meaning never depends on which mxcli release runs it: a\n" +
 			"-- change of meaning applies only under the version that introduces it.\n" +
@@ -43,7 +44,8 @@ func init() {
 			"-- and writes list operations one statement per activity. It refuses, and\n" +
 			"-- says why, when a construct has no rewrite: an unknown or mis-shaped\n" +
 			"-- property (MDL-V1-PROP/PROPVALUE), `create or replace view entity`\n" +
-			"-- (MDL-V1-REPLACE01), a nested list operation, find/contains on a variable\n" +
+			"-- (MDL-V1-REPLACE01), a session command in a script (MDL-V1-SESSION), a\n" +
+			"-- nested list operation, find/contains on a variable\n" +
 			"-- whose type the script does not state, and an escaped line break inside\n" +
 			"-- an expression.\n" +
 			"-- `mxcli fmt --upgrade` alone rewrites deprecated spellings (MDL-DEPRnnn).",
@@ -140,9 +142,12 @@ func init() {
 		},
 		Syntax: "-- Every document type takes a folder clause on CREATE. Where it goes\n" +
 			"-- depends on the statement's shape:\n" +
-			"--   Pages, snippets       Folder: 'path'   a property, inside the parentheses\n" +
-			"--   Microflows, nanoflows FOLDER 'path'    a keyword, before BEGIN\n" +
-			"--   Everything else       FOLDER 'path'    a keyword, after the qualified name\n" +
+			"--   Microflows, nanoflows FOLDER 'path'    after the signature, before BEGIN\n" +
+			"--   Everything else       FOLDER 'path'    after the qualified name\n" +
+			"--                                          (pages and snippets included)\n" +
+			"--\n" +
+			"-- The Folder: 'path' property that pages, snippets and REST/OData services\n" +
+			"-- also take is a deprecated alias (MDL-DEPR105); fmt --upgrade moves it.\n" +
 			"--\n" +
 			"-- Missing folders in the path are created. Nested paths use '/'.\n" +
 			"--\n" +
@@ -158,10 +163,9 @@ func init() {
 			"  WITH JSON STRUCTURE MyModule.JSON_Order {\n" +
 			"    CREATE MyModule.Order { Id = id }\n" +
 			"  };\n\n" +
-			"CREATE PAGE MyModule.OrderList\n" +
+			"CREATE PAGE MyModule.OrderList FOLDER 'Orders'\n" +
 			"  (\n" +
 			"    Title: 'Orders',\n" +
-			"    Folder: 'Orders',\n" +
 			"    Layout: Atlas_Core.Atlas_Default\n" +
 			"  )\n" +
 			"  {\n" +
@@ -670,12 +674,15 @@ DROP TASK QUEUE Ops.Mail;`,
 			"create regular expression", "drop regular expression", "describe regular expression",
 			"show regular expressions", "email regex", "match",
 		},
-		Syntax: `CREATE [OR MODIFY] REGULAR EXPRESSION Module.Name [FOLDER 'path'] (
+		Syntax: `[/** <documentation> */]
+CREATE [OR MODIFY] REGULAR EXPRESSION Module.Name [FOLDER 'path'] (
   Expression: '<pattern>',
-  [Documentation: '<text>',]
   [ExportLevel: Hidden|Public,]
 );
 
+-- Documentation is the doc comment; the Documentation: '<text>' property is
+-- its deprecated alias (MDL-DEPR106).
+
 SHOW REGULAR EXPRESSIONS [IN <module>];
 LIST REGULAR EXPRESSIONS [IN <module>];
 DESCRIBE REGULAR EXPRESSION Module.Name;
@@ -695,9 +702,9 @@ notes that it could not verify it — it does not call it invalid.
 
 Bind a pattern to an attribute with CREATE VALIDATION RULE — see
 'mxcli syntax validation-rule'.`,
-		Example: `CREATE REGULAR EXPRESSION Val.EmailAddress (
-  Expression: '\w+((-|\+|\.)\w+)*@\w+([\.-]?\w+)*(\.\w{2,})+',
-  Documentation: 'A, not too restrictive, email address regular expression'
+		Example: `/** A, not too restrictive, email address regular expression */
+CREATE REGULAR EXPRESSION Val.EmailAddress (
+  Expression: '\w+((-|\+|\.)\w+)*@\w+([\.-]?\w+)*(\.\w{2,})+'
 );
 
 CREATE REGULAR EXPRESSION Val.Identifier (
diff --git a/cmd/mxcli/syntax/features_page.go b/cmd/mxcli/syntax/features_page.go
index 81e6b357bd..a99134995d 100644
--- a/cmd/mxcli/syntax/features_page.go
+++ b/cmd/mxcli/syntax/features_page.go
@@ -12,7 +12,7 @@ func init() {
 			"page", "pages", "form", "UI", "user interface",
 			"widget", "layout", "screen",
 		},
-		Syntax:  "CREATE PAGE Module.Name\n  (\n    Title: 'Page Title',\n    Layout: Module.LayoutName\n    [, Params: { $Param: Module.Entity }]\n    [, Url: 'page-url']\n    [, Folder: 'FolderPath']\n    [, Variables: { $var: Boolean = 'true' }]\n    [, PopupWidth: 800, PopupHeight: 480, PopupResizable: true]\n    [, PopupCloseAction: cancelButton1]\n    [, Class: 'css-class', Style: 'css: rule']\n  )\n  {\n    -- widgets\n  }",
+		Syntax:  "CREATE PAGE Module.Name [FOLDER 'FolderPath']\n  (\n    Title: 'Page Title',\n    Layout: Module.LayoutName\n    [, Params: { $Param: Module.Entity }]\n    [, Url: 'page-url']\n    [, Variables: { $var: Boolean = 'true' }]\n    [, PopupWidth: 800, PopupHeight: 480, PopupResizable: true]\n    [, PopupCloseAction: cancelButton1]\n    [, Class: 'css-class', Style: 'css: rule']\n  )\n  {\n    -- widgets\n  }",
 		Example: "CREATE PAGE MyModule.EditCustomer\n  (\n    Params: { $Customer: MyModule.Customer },\n    Title: 'Edit Customer',\n    Layout: Atlas_Core.PopupLayout,\n    Class: 'container-fluid'\n  )\n  {\n    DATAVIEW dvCustomer (DataSource: $Customer) {\n      TEXTBOX txtName (Label: 'Name', Attribute: Name)\n      FOOTER footer1 {\n        ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE CHANGES, ButtonStyle: Primary)\n        ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL CHANGES)\n      }\n    }\n  }",
 		SeeAlso: []string{"page.create", "page.widgets", "page.alter", "snippet"},
 	})
@@ -24,7 +24,7 @@ func init() {
 			"create page", "new page", "page parameters", "page variables",
 			"layout", "url", "folder",
 		},
-		Syntax:  "CREATE PAGE Module.Name\n  (\n    Title: 'Title',\n    Layout: Module.Layout\n    [, Params: { $P: Module.Entity, $Qty: Integer }]\n    [, Url: 'page-url']\n    [, Folder: 'FolderPath']\n    [, Variables: { $showStock: Boolean = 'true' }]\n  )\n  { <widgets> }",
+		Syntax:  "CREATE PAGE Module.Name [FOLDER 'FolderPath']\n  (\n    Title: 'Title',\n    Layout: Module.Layout\n    [, Params: { $P: Module.Entity, $Qty: Integer }]\n    [, Url: 'page-url']\n    [, Variables: { $showStock: Boolean = 'true' }]\n  )\n  { <widgets> }",
 		Example: "CREATE PAGE Module.Products\n  (\n    Title: 'Products',\n    Layout: Atlas_Core.Atlas_Default,\n    Url: 'products',\n    Variables: { $showStock: Boolean = 'true' }\n  )\n  {\n    DATAGRID gridProducts (DataSource: DATABASE Module.Product) {\n      COLUMN colName (Attribute: Name, Caption: 'Name')\n    }\n  }",
 		SeeAlso: []string{"page", "page.widgets", "page.datasource"},
 	})
@@ -394,7 +394,7 @@ CREATE PAGE Sales.Detail (Title: 'Detail', Layout: Atlas_Core.Atlas_Default) {
 			"snippet", "snippets", "reusable", "snippetcall",
 			"page fragment", "component",
 		},
-		Syntax:  "CREATE SNIPPET Module.Name\n  [( Params: { $P: Module.Entity }, Folder: 'path' )]   -- parameters are entities only\n  {\n    -- widgets (same as page)\n  }\n\n-- Embed in a page:\nSNIPPETCALL scName (Snippet: Module.SnippetName)",
+		Syntax:  "CREATE SNIPPET Module.Name [FOLDER 'path']\n  [( Params: { $P: Module.Entity } )]   -- parameters are entities only\n  {\n    -- widgets (same as page)\n  }\n\n-- Embed in a page:\nSNIPPETCALL scName (Snippet: Module.SnippetName)",
 		Example: "CREATE SNIPPET MyModule.CustomerInfo (\n  Params: { $Customer: MyModule.Customer }\n)\n{\n  DATAVIEW dv (DataSource: $Customer) {\n    TEXTBOX txtName (Label: 'Name', Attribute: Name)\n    TEXTBOX txtEmail (Label: 'Email', Attribute: Email)\n  }\n}",
 		SeeAlso: []string{"snippet.create", "snippet.alter", "page"},
 	})
@@ -412,7 +412,7 @@ CREATE PAGE Sales.Detail (Title: 'Detail', Layout: Atlas_Core.Atlas_Default) {
 		// (a PAGE parameter may be primitive; a snippet parameter may not), and
 		// the reporter of mendixlabs/mxcli#1028 reached the bug by following
 		// this line. A primitive is now refused as MDL087.
-		Syntax:  "CREATE SNIPPET Module.Name\n  [( Params: { $P: Module.Entity } )]   -- entities only; a primitive is CE0046\n  [( Variables: { $isEditable: Boolean = 'true' } )]\n  [( Folder: 'Snippets/Common' )]\n  {\n    -- widgets\n  }\n\n-- To parameterise a snippet on a primitive, keep the primitive on the\n-- calling PAGE and pass an object, or read the value off an entity member.",
+		Syntax:  "CREATE SNIPPET Module.Name [FOLDER 'Snippets/Common']\n  [( Params: { $P: Module.Entity } )]   -- entities only; a primitive is CE0046\n  [( Variables: { $isEditable: Boolean = 'true' } )]\n  {\n    -- widgets\n  }\n\n-- To parameterise a snippet on a primitive, keep the primitive on the\n-- calling PAGE and pass an object, or read the value off an entity member.",
 		Example: "CREATE SNIPPET MyModule.NavigationMenu\n{\n  NAVIGATIONLIST navMenu {\n    ITEM itemCustomers (Action: SHOW PAGE MyModule.CustomerOverview) {\n      DYNAMICTEXT txtCustomers (Content: 'Customers')\n    }\n  }\n}",
 		SeeAlso: []string{"snippet", "snippet.alter", "page.widgets"},
 	})
diff --git a/cmd/mxcli/syntax/features_workflow.go b/cmd/mxcli/syntax/features_workflow.go
index 2c813ce03c..ccef9d72b5 100644
--- a/cmd/mxcli/syntax/features_workflow.go
+++ b/cmd/mxcli/syntax/features_workflow.go
@@ -237,10 +237,10 @@ func init() {
 		// cannot open. This entry taught 'Under 1000' / 'Over 1000' — both of
 		// which corrupt the model (ako/mxcli#1031, ako/mxcli#1065).
 		Syntax: "-- Boolean decision:\n" +
-			"DECISION [<name>] '<boolean-expression>' [COMMENT '<text>']\n  OUTCOMES TRUE -> { <activities> } FALSE -> { <activities> };\n\n" +
+			"DECISION [<name>] '<boolean-expression>' [CAPTION '<text>']\n  OUTCOMES TRUE -> { <activities> } FALSE -> { <activities> };\n\n" +
 			"-- Enumeration decision — each outcome is a QUALIFIED enum value,\n" +
 			"-- plus one '' outcome for 'none of the above' (without it: CE6686):\n" +
-			"DECISION [<name>] '<enum-expression>' [COMMENT '<text>']\n  OUTCOMES 'Module.Enumeration.Value' -> { <activities> } ... '' -> { };",
+			"DECISION [<name>] '<enum-expression>' [CAPTION '<text>']\n  OUTCOMES 'Module.Enumeration.Value' -> { <activities> } ... '' -> { };",
 		Example: "-- Boolean\nDECISION decision1 '$WorkflowContext/Amount > 1000'\n  OUTCOMES\n    TRUE -> {\n      USER TASK ManagerApproval 'Manager must approve'\n        OUTCOMES 'OK' { };\n    }\n    FALSE -> { };\n\n" +
 			"-- Enumeration: the value must be Module.Enumeration.Value.\n-- A bare 'Approved' makes the project UNLOADABLE, not merely invalid.\nDECISION decision2 '$WorkflowContext/Status'\n  OUTCOMES\n    'Sales.ENUM_Status.Approved' -> { }\n    'Sales.ENUM_Status.Rejected' -> { }\n    '' -> { };",
 		SeeAlso: []string{"workflow.create", "workflow.parallel-split"},
@@ -253,7 +253,7 @@ func init() {
 			"parallel", "concurrent", "split", "fork", "join",
 			"parallel gateway", "AND",
 		},
-		Syntax:  "PARALLEL SPLIT [<name>] [COMMENT '<text>']\n  PATH 1 { <activities> }\n  PATH 2 { <activities> };",
+		Syntax:  "PARALLEL SPLIT [<name>] [CAPTION '<text>']\n  PATH 1 { <activities> }\n  PATH 2 { <activities> };",
 		Example: "PARALLEL SPLIT\n  PATH 1 {\n    USER TASK LegalReview 'Legal review'\n      OUTCOMES 'Done' { };\n  }\n  PATH 2 {\n    USER TASK TechReview 'Technical review'\n      OUTCOMES 'Done' { };\n  };",
 		SeeAlso: []string{"workflow.decision", "workflow.create"},
 	})
@@ -267,12 +267,14 @@ func init() {
 		},
 		// R4 (ako/mxcli#751): arguments are bound as at every call site, right
 		// after the callee, the expression bare. The older `WITH (P = '<expr>')`
-		// after the comment is the deprecated alias MDL-DEPR008.
-		Syntax: "CALL MICROFLOW Module.MF[(<Param> = <expression>, ...)] [AS <name>] [COMMENT '<text>']\n" +
+		// after the caption is the deprecated alias MDL-DEPR008.
+		Syntax: "CALL MICROFLOW Module.MF[(<Param> = <expression>, ...)] [AS <name>] [CAPTION '<text>']\n" +
 			"  [OUTCOMES '<outcome>' -> { <activities> } ...];\n\n" +
 			"-- WITH (<Param> = '<expression>'), the expression in a string, is the\n" +
-			"-- deprecated spelling of the argument list (MDL-DEPR008).",
-		Example: "CALL MICROFLOW HR.SendNotification\n  COMMENT 'Notify manager';\n\n-- Arguments are named by their BARE parameter name:\nCALL MICROFLOW HR.Escalate(Request = $WorkflowContext) AS callMicroflow1;",
+			"-- deprecated spelling of the argument list (MDL-DEPR008).\n" +
+			"-- CAPTION sets the caption the activity shows; COMMENT '<text>', its old\n" +
+			"-- spelling on every workflow activity, is a deprecated alias (MDL-DEPR104).",
+		Example: "CALL MICROFLOW HR.SendNotification\n  CAPTION 'Notify manager';\n\n-- Arguments are named by their BARE parameter name:\nCALL MICROFLOW HR.Escalate(Request = $WorkflowContext) AS callMicroflow1;",
 		SeeAlso: []string{"workflow.create", "workflow.call-workflow", "workflow.ai-agent-task"},
 	})
 
@@ -286,7 +288,7 @@ func init() {
 		// Measured on mxbuild 11.13.0 against the same activity written as a call
 		// microflow: the only difference in what builds is CE1590 for a microflow
 		// with no parameters.
-		Syntax: "CALL AGENT MICROFLOW Module.MF[(<Param> = <expression>, ...)] [AS <name>] [COMMENT '<text>']\n" +
+		Syntax: "CALL AGENT MICROFLOW Module.MF[(<Param> = <expression>, ...)] [AS <name>] [CAPTION '<text>']\n" +
 			"  [OUTCOMES <true|false|'Module.Enum.Value'|''> -> { <activities> } ...]\n" +
 			"  [BOUNDARY EVENT ...];\n\n" +
 			"-- The same statement as CALL MICROFLOW, stored as an AI agent task. The microflow\n" +
@@ -296,7 +298,7 @@ func init() {
 		Example: "CREATE MICROFLOW HR.ACT_ClassifyRequest ($Request: HR.LeaveRequest)\n" +
 			"RETURNS Boolean AS $Urgent\nBEGIN\n  -- call the agent here\n  RETURN false;\nEND;\n\n" +
 			"CALL AGENT MICROFLOW HR.ACT_ClassifyRequest(Request = $WorkflowContext) AS aiAgentTask1\n" +
-			"  COMMENT 'Classify the request'\n" +
+			"  CAPTION 'Classify the request'\n" +
 			"  OUTCOMES true -> { USER TASK Expedite 'Expedite' PAGE HR.TaskPage OUTCOMES 'Done' { }; }\n" +
 			"           false -> { };",
 		SeeAlso: []string{"workflow.call-microflow", "agents"},
@@ -308,8 +310,8 @@ func init() {
 		Keywords: []string{
 			"call workflow", "sub-workflow", "nested workflow",
 		},
-		Syntax:  "CALL WORKFLOW Module.WF[(<Param> = <expression>, ...)] [AS <name>] [COMMENT '<text>'];",
-		Example: "CALL WORKFLOW HR.SubApproval COMMENT 'Delegate to sub-process';\n\nCALL WORKFLOW HR.SubApproval(Request = $WorkflowContext) AS callWf1;",
+		Syntax:  "CALL WORKFLOW Module.WF[(<Param> = <expression>, ...)] [AS <name>] [CAPTION '<text>'];",
+		Example: "CALL WORKFLOW HR.SubApproval CAPTION 'Delegate to sub-process';\n\nCALL WORKFLOW HR.SubApproval(Request = $WorkflowContext) AS callWf1;",
 		SeeAlso: []string{"workflow.create", "workflow.call-microflow"},
 	})
 
@@ -324,7 +326,7 @@ func init() {
 		// activities by type and ordinal regardless of caption (decision1,
 		// split1, callMicroflow1); mxcli derives a name when none is given, which
 		// is why an explicit one matters when reproducing a stored workflow.
-		Syntax: "JUMP TO <activity-name> [COMMENT '<text>'];\n\n" +
+		Syntax: "JUMP TO <activity-name> [CAPTION '<text>'];\n\n" +
 			"-- name the target so the jump resolves:\n" +
 			"DECISION <name> ['<caption>'] ...\nPARALLEL SPLIT <name> ...\n" +
 			"WAIT FOR TIMER <name> ...\nWAIT FOR NOTIFICATION <name>\n" +
@@ -344,7 +346,7 @@ func init() {
 		},
 		// Every placement rule below is an mxbuild measurement (11.13.0), not a
 		// reading of the error text. See docs/11-proposals/PROPOSAL_workflow_end_activity.md.
-		Syntax: "end workflow [comment '<caption>'];\n\n" +
+		Syntax: "end workflow [caption '<caption>'];\n\n" +
 			"-- Legal as the LAST statement of a user-task outcome, a decision branch,\n" +
 			"-- a call-microflow outcome or an interrupting boundary-event path, at any depth.\n" +
 			"-- It ends the WHOLE workflow, not the block it is written in.\n" +
@@ -356,17 +358,17 @@ func init() {
 			"--   `return;` — a microflow's spelling                            MDL-WF11\n" +
 			"--\n" +
 			"-- The main flow needs none: the body's own closing `end workflow` is its End.\n" +
-			"-- `comment` sets the End's caption on the canvas. An End is not a jump target.",
+			"-- `caption` sets the End's caption on the canvas. An End is not a jump target.",
 		Example: "USER TASK Review 'Review the request'\n" +
 			"  PAGE HR.ReviewPage\n" +
 			"  OUTCOMES\n" +
 			"    'Approve' { }\n" +
 			"    'Reject' {\n" +
 			"      CALL MICROFLOW HR.ACT_NotifyRejected;\n" +
-			"      END WORKFLOW COMMENT 'Rejected';\n" +
+			"      END WORKFLOW CAPTION 'Rejected';\n" +
 			"    }\n" +
 			"  BOUNDARY EVENT INTERRUPTING TIMER 'addDays([%CurrentDateTime%], 5)' {\n" +
-			"    END WORKFLOW COMMENT 'Expired';\n" +
+			"    END WORKFLOW CAPTION 'Expired';\n" +
 			"  };",
 		SeeAlso: []string{"workflow.user-task", "workflow.decision", "workflow.boundary-event", "workflow.jump-to"},
 	})
@@ -425,7 +427,7 @@ func init() {
 			"  ON (INTERRUPTING | NON INTERRUPTING) NOTIFICATION [<start>] ['<start caption>']\n" +
 			"  { <activities> };\n" +
 			"EVENT SUBPROCESS <name> ['<caption>']\n" +
-			"  ON (INTERRUPTING | NON INTERRUPTING) TIMER '<first-execution-time>' [AS <start>] [COMMENT '<start caption>']\n" +
+			"  ON (INTERRUPTING | NON INTERRUPTING) TIMER '<first-execution-time>' [AS <start>] [CAPTION '<start caption>']\n" +
 			"  { <activities> };\n\n" +
 			"-- Interrupting cancels every active path first; non-interrupting runs alongside.\n" +
 			"-- A notification start is what `notify workflow` targets. The body's End is\n" +
@@ -454,11 +456,11 @@ func init() {
 		Keywords: []string{
 			"notification", "notification activity", "intermediate event", "notify",
 		},
-		Syntax: "NOTIFICATION [<name>] [COMMENT '<caption>'];\n\n" +
+		Syntax: "NOTIFICATION [<name>] [CAPTION '<caption>'];\n\n" +
 			"-- The point a `notify workflow` action reaches (Workflows$NotificationActivity,\n" +
 			"-- Mendix 11.11+). `wait for notification` is the older activity for the same\n" +
 			"-- purpose and works on every version.",
-		Example:    "notification DocumentsReceived comment 'Documents received';",
+		Example:    "notification DocumentsReceived caption 'Documents received';",
 		MinVersion: "11.11.0",
 		SeeAlso:    []string{"workflow.event-subprocess", "workflow.boundary-event", "workflow.notify"},
 	})
diff --git a/docs-site/src/appendixes/quick-reference.md b/docs-site/src/appendixes/quick-reference.md
index 9ced9a4d4a..adc1d926c6 100644
--- a/docs-site/src/appendixes/quick-reference.md
+++ b/docs-site/src/appendixes/quick-reference.md
@@ -188,10 +188,10 @@ AUTHENTICATION Basic, Session
 | Statement | Syntax | Notes |
 |-----------|--------|-------|
 | Microflow folder | `FOLDER 'path'` (before BEGIN) | `CREATE MICROFLOW ... FOLDER 'ACT' BEGIN ... END;` |
-| Page folder | `Folder: 'path'` (in properties) | `CREATE PAGE ... (Folder: 'Pages/Detail') { ... }` |
+| Page folder | `FOLDER 'path'` (after the name) | `CREATE PAGE ... FOLDER 'Pages/Detail' (...) { ... }` |
 | Move to folder | `MOVE <doctype> Module.Name TO FOLDER 'path';` | Folders created automatically. Any top-level doctype, spelled as `DESCRIBE` spells it |
 | Move a mapping / structure | `MOVE IMPORT MAPPING\|EXPORT MAPPING\|JSON STRUCTURE Module.Name TO FOLDER 'path';` | |
-| Place while creating | `CREATE <doctype> Module.Name FOLDER 'path' ...` | Every doctype. Pages/snippets use `Folder: 'path'` as a property; microflows/nanoflows a keyword before `BEGIN` |
+| Place while creating | `CREATE <doctype> Module.Name FOLDER 'path' ...` | Every doctype: a clause after the name (after the signature on microflows/nanoflows, before `BEGIN`). The `Folder: 'path'` property on pages, snippets and REST/OData services is a deprecated alias (`MDL-DEPR105`) |
 | Place an existing document | `CREATE OR MODIFY ... FOLDER 'path' ...` | Moves it; omitting the clause leaves placement alone |
 | Move to module root | `MOVE PAGE Module.Name TO Module;` | Removes from folder |
 | Move across modules | `MOVE PAGE Old.Name TO NewModule;` | **Breaks by-name references** -- use `LIST IMPACT OF` first |
@@ -238,8 +238,8 @@ Nested folders use `/` separator: `'Parent/Child/Grandchild'`. Missing folders a
 
 **Workflow Activity Types:**
 - `USER TASK <name> '<caption>' [PAGE Mod.Page] [TARGETING MICROFLOW Mod.MF] [OUTCOMES '<out>' { } ...];`
-- `CALL MICROFLOW Mod.MF [COMMENT '<text>'] [OUTCOMES '<out>' { } ...];`
-- `CALL WORKFLOW Mod.WF [COMMENT '<text>'];`
+- `CALL MICROFLOW Mod.MF [CAPTION '<text>'] [OUTCOMES '<out>' { } ...];`
+- `CALL WORKFLOW Mod.WF [CAPTION '<text>'];`
 - `DECISION ['<caption>'] OUTCOMES '<out>' { } ...;`
 - `PARALLEL SPLIT PATH 1 { } PATH 2 { };`
 - `JUMP TO <activity-name>;`
diff --git a/docs-site/src/language/image-collections.md b/docs-site/src/language/image-collections.md
index 8ffe7fb4a5..f5adc11bd9 100644
--- a/docs-site/src/language/image-collections.md
+++ b/docs-site/src/language/image-collections.md
@@ -20,9 +20,9 @@ The `DESCRIBE` output includes the full `CREATE` statement. If the collection co
 ## CREATE IMAGE COLLECTION
 
 ```sql
+[/** <description> */]
 CREATE IMAGE COLLECTION <Module>.<Name>
   [EXPORT LEVEL 'Hidden'|'Public']
-  [COMMENT '<description>']
   [(
     IMAGE <Name> FROM FILE '<path>',
     ...
@@ -32,7 +32,7 @@ CREATE IMAGE COLLECTION <Module>.<Name>
 | Option | Description | Default |
 |--------|-------------|---------|
 | `EXPORT LEVEL` | `'Hidden'` (internal to module) or `'Public'` (accessible from other modules) | `'Hidden'` |
-| `COMMENT` | Documentation for the collection | (none) |
+| `/** … */` | Documentation for the collection, as a doc comment before the statement (`COMMENT '…'` is its deprecated alias, `MDL-DEPR100`) | (none) |
 | `IMAGE Name FROM FILE` | Load an image from the filesystem into the collection | (none) |
 
 The image format is detected automatically from the file extension. Relative paths are resolved from the current working directory. Supported formats: PNG, SVG, GIF, JPEG, BMP, WebP.
@@ -46,9 +46,9 @@ CREATE IMAGE COLLECTION MyModule.AppIcons;
 -- With export level
 CREATE IMAGE COLLECTION MyModule.SharedIcons EXPORT LEVEL 'Public';
 
--- With comment
-CREATE IMAGE COLLECTION MyModule.StatusIcons
-  COMMENT 'Icons for order and task status indicators';
+-- With documentation
+/** Icons for order and task status indicators */
+CREATE IMAGE COLLECTION MyModule.StatusIcons;
 
 -- With images from files
 CREATE IMAGE COLLECTION MyModule.NavigationIcons (
@@ -57,9 +57,9 @@ CREATE IMAGE COLLECTION MyModule.NavigationIcons (
 );
 
 -- All options combined
+/** Company branding assets */
 CREATE IMAGE COLLECTION MyModule.BrandAssets
-  EXPORT LEVEL 'Public'
-  COMMENT 'Company branding assets' (
+  EXPORT LEVEL 'Public' (
   IMAGE logo_dark FROM FILE 'assets/logo-dark.png',
   IMAGE logo_light FROM FILE 'assets/logo-light.png'
 );
diff --git a/docs-site/src/language/page-patterns.md b/docs-site/src/language/page-patterns.md
index 92a6caaad3..613aa6152b 100644
--- a/docs-site/src/language/page-patterns.md
+++ b/docs-site/src/language/page-patterns.md
@@ -7,11 +7,10 @@ This page collects frequently used page patterns: overview/list pages, edit page
 An overview page displays a list of entities with a control bar for creating, editing, and deleting records. Clicking a row opens the edit page.
 
 ```sql
-CREATE PAGE MyModule.Customer_Overview
+CREATE PAGE MyModule.Customer_Overview FOLDER 'Customers'
 (
   Title: 'Customers',
-  Layout: Atlas_Core.Atlas_Default,
-  Folder: 'Customers'
+  Layout: Atlas_Core.Atlas_Default
 )
 {
   DATAGRID dgCustomers (DataSource: DATABASE MyModule.Customer, PageSize: 20) {
@@ -51,12 +50,11 @@ END;
 An edit page displayed as a popup dialog. Receives the entity as a page parameter:
 
 ```sql
-CREATE PAGE MyModule.Customer_Edit
+CREATE PAGE MyModule.Customer_Edit FOLDER 'Customers'
 (
   Params: { $Customer: MyModule.Customer },
   Title: 'Edit Customer',
-  Layout: Atlas_Core.PopupLayout,
-  Folder: 'Customers'
+  Layout: Atlas_Core.PopupLayout
 )
 {
   DATAVIEW dvCustomer (DataSource: $Customer) {
@@ -78,12 +76,11 @@ CREATE PAGE MyModule.Customer_Edit
 A full-page detail view with sections organized using layout grids:
 
 ```sql
-CREATE PAGE MyModule.Customer_Detail
+CREATE PAGE MyModule.Customer_Detail FOLDER 'Customers'
 (
   Params: { $Customer: MyModule.Customer },
   Title: 'Customer Detail',
-  Layout: Atlas_Core.Atlas_Default,
-  Folder: 'Customers'
+  Layout: Atlas_Core.Atlas_Default
 )
 {
   DATAVIEW dvCustomer (DataSource: $Customer) {
@@ -123,11 +120,10 @@ A master-detail page shows a list on one side and the selected item's details on
 ### Side-by-Side Layout
 
 ```sql
-CREATE PAGE MyModule.Product_MasterDetail
+CREATE PAGE MyModule.Product_MasterDetail FOLDER 'Products'
 (
   Title: 'Products',
-  Layout: Atlas_Core.Atlas_Default,
-  Folder: 'Products'
+  Layout: Atlas_Core.Atlas_Default
 )
 {
   LAYOUTGRID gridMain {
@@ -167,11 +163,10 @@ CREATE PAGE MyModule.Product_MasterDetail
 A master-detail pattern where selecting an entity also shows its related child entities via an association:
 
 ```sql
-CREATE PAGE MyModule.Order_MasterDetail
+CREATE PAGE MyModule.Order_MasterDetail FOLDER 'Orders'
 (
   Title: 'Orders',
-  Layout: Atlas_Core.Atlas_Default,
-  Folder: 'Orders'
+  Layout: Atlas_Core.Atlas_Default
 )
 {
   LAYOUTGRID gridMain {
@@ -222,11 +217,10 @@ Here is a concise CRUD set for an `Employee` entity:
 
 ```sql
 -- 1. Overview page
-CREATE PAGE HR.Employee_Overview
+CREATE PAGE HR.Employee_Overview FOLDER 'Employees'
 (
   Title: 'Employees',
-  Layout: Atlas_Core.Atlas_Default,
-  Folder: 'Employees'
+  Layout: Atlas_Core.Atlas_Default
 )
 {
   DATAGRID dgEmployees (DataSource: DATABASE HR.Employee, PageSize: 20) {
@@ -246,12 +240,11 @@ CREATE PAGE HR.Employee_Overview
 }
 
 -- 2. Edit page (popup)
-CREATE PAGE HR.Employee_Edit
+CREATE PAGE HR.Employee_Edit FOLDER 'Employees'
 (
   Params: { $Employee: HR.Employee },
   Title: 'Edit Employee',
-  Layout: Atlas_Core.PopupLayout,
-  Folder: 'Employees'
+  Layout: Atlas_Core.PopupLayout
 )
 {
   DATAVIEW dvEmployee (DataSource: $Employee) {
@@ -283,11 +276,10 @@ END;
 A dashboard page using layout grids to arrange multiple data sections:
 
 ```sql
-CREATE PAGE MyModule.Dashboard
+CREATE PAGE MyModule.Dashboard FOLDER 'Dashboard'
 (
   Title: 'Dashboard',
-  Layout: Atlas_Core.Atlas_Default,
-  Folder: 'Dashboard'
+  Layout: Atlas_Core.Atlas_Default
 )
 {
   LAYOUTGRID gridDash {
diff --git a/docs-site/src/language/page-structure.md b/docs-site/src/language/page-structure.md
index c19c54f8ae..1cb01e0b89 100644
--- a/docs-site/src/language/page-structure.md
+++ b/docs-site/src/language/page-structure.md
@@ -5,12 +5,11 @@ Every MDL page has three main parts: page properties (title, layout, parameters)
 ## CREATE PAGE Syntax
 
 ```sql
-CREATE [OR REPLACE] PAGE <Module>.<Name>
+CREATE [OR REPLACE] PAGE <Module>.<Name> [FOLDER '<path>']
 (
   [Params: { $Param: Module.Entity | Type [, ...] },]
   Title: '<title>',
   Layout: <Module.LayoutName>
-  [, Folder: '<path>']
   [, Variables: { $name: Type = 'expression' [, ...] }]
 )
 {
@@ -183,22 +182,21 @@ The widget tree is a nested hierarchy. Container widgets hold child widgets with
 
 ## Folder Organization
 
-Use the `Folder` property to organize pages into folders within a module:
+Use the `FOLDER` clause after the name to organize pages into folders within a module:
 
 ```sql
-CREATE PAGE MyModule.Customer_Edit
+CREATE PAGE MyModule.Customer_Edit FOLDER 'Customers'
 (
   Params: { $Customer: MyModule.Customer },
   Title: 'Edit Customer',
-  Layout: Atlas_Core.PopupLayout,
-  Folder: 'Customers'
+  Layout: Atlas_Core.PopupLayout
 )
 {
   ...
 }
 ```
 
-Nested folders use `/` separators: `Folder: 'Pages/Customers/Detail'`. Missing folders are auto-created.
+Nested folders use `/` separators: `FOLDER 'Pages/Customers/Detail'`. Missing folders are auto-created. The `Folder: '…'` property is a deprecated alias of the clause (`MDL-DEPR105`).
 
 ## See Also
 
diff --git a/docs-site/src/language/pages.md b/docs-site/src/language/pages.md
index 05b8715dd1..4f34f34e1a 100644
--- a/docs-site/src/language/pages.md
+++ b/docs-site/src/language/pages.md
@@ -16,12 +16,11 @@ Pages define the user interface of a Mendix application. Each page consists of a
 The basic syntax for creating a page:
 
 ```sql
-CREATE [OR REPLACE] PAGE <Module>.<Name>
+CREATE [OR REPLACE] PAGE <Module>.<Name> [FOLDER '<path>']
 (
   [Params: { $Param: Module.Entity | Type [, ...] },]
   Title: '<title>',
   Layout: <Module.LayoutName>
-  [, Folder: '<path>']
   [, Class: '<css-class>', Style: '<css: rule>']
 )
 {
@@ -74,11 +73,12 @@ CREATE PAGE MyModule.Customer_Edit
 | `Params` | Page parameters (entity objects or primitives) | `Params: { $Order: Sales.Order, $Qty: Integer }` |
 | `Title` | Page title shown in the browser/tab | `Title: 'Edit Customer'` |
 | `Layout` | Layout to use for the page | `Layout: Atlas_Core.PopupLayout` |
-| `Folder` | Organizational folder within the module | `Folder: 'Pages/Customers'` |
 | `Variables` | Page-level variables for conditional logic | `Variables: { $show: Boolean = 'true' }` |
 | `Class` | CSS class applied to the page (Forms$Appearance) | `Class: 'container-fluid bg-light'` |
 | `Style` | Inline CSS style applied to the page | `Style: 'min-height: 100vh'` |
 
+The folder is a clause after the name, not a property: `CREATE PAGE MyModule.Customer_Edit FOLDER 'Pages/Customers' (…)`. The `Folder: '…'` property still parses as a deprecated alias (`MDL-DEPR105`); `mxcli fmt --upgrade` moves it.
+
 ## Widget Properties
 
 ### Responsive Column Widths
diff --git a/docs-site/src/language/scheduled-events.md b/docs-site/src/language/scheduled-events.md
index 74333d6692..37a10a11c2 100644
--- a/docs-site/src/language/scheduled-events.md
+++ b/docs-site/src/language/scheduled-events.md
@@ -146,10 +146,10 @@ repeat, and `CREATE OR MODIFY` carries whatever is stored through untouched.
 A task queue bounds how many instances of a queued microflow call run at once.
 
 ```sql
+[/** <documentation> */]
 CREATE [OR MODIFY] TASK QUEUE <Module>.<Name> [(
   Parallelism: <expression>,
-  ClusterWide: true|false,
-  Documentation: '<text>'
+  ClusterWide: true|false
 )];
 
 LIST TASK QUEUES [IN <Module>];
diff --git a/docs-site/src/language/snippets.md b/docs-site/src/language/snippets.md
index 8469362269..f73654d6af 100644
--- a/docs-site/src/language/snippets.md
+++ b/docs-site/src/language/snippets.md
@@ -5,11 +5,10 @@ Snippets are reusable page fragments that can be embedded in multiple pages. The
 ## CREATE SNIPPET
 
 ```sql
-CREATE [OR REPLACE] SNIPPET <Module>.<Name>
-(
-  [Params: { $Param: Module.Entity [, ...] },]
-  [Folder: '<path>']
-)
+CREATE [OR REPLACE] SNIPPET <Module>.<Name> [FOLDER '<path>']
+[(
+  Params: { $Param: Module.Entity [, ...] }
+)]
 {
   <widget-tree>
 }
@@ -20,10 +19,7 @@ CREATE [OR REPLACE] SNIPPET <Module>.<Name>
 A snippet without parameters:
 
 ```sql
-CREATE SNIPPET MyModule.Footer
-(
-  Folder: 'Snippets'
-)
+CREATE SNIPPET MyModule.Footer FOLDER 'Snippets'
 {
   CONTAINER cFooter (Class: 'app-footer') {
     DYNAMICTEXT txtCopyright (Content: '2024 My Company. All rights reserved.')
diff --git a/docs-site/src/language/workflow-activities.md b/docs-site/src/language/workflow-activities.md
index bc2e58e63b..0f4f3b8721 100644
--- a/docs-site/src/language/workflow-activities.md
+++ b/docs-site/src/language/workflow-activities.md
@@ -80,35 +80,39 @@ builds and never completes.
 
 ## Call Microflow
 
-Execute a microflow as part of the workflow. Optionally specify a comment and outcomes:
+Execute a microflow as part of the workflow. Optionally specify a caption and outcomes:
 
 ```sql
-CALL MICROFLOW <Module>.<Name> [(<Param> = <expression>, ...)] [COMMENT '<text>']
+CALL MICROFLOW <Module>.<Name> [(<Param> = <expression>, ...)] [CAPTION '<text>']
   [OUTCOMES '<outcome>' { <activities> } ...];
 ```
 
 Example:
 
 ```sql
-CALL MICROFLOW HR.ACT_SendNotification COMMENT 'Notify the applicant';
-CALL MICROFLOW HR.ACT_Escalate(Request = $WorkflowContext) COMMENT 'Escalate';
+CALL MICROFLOW HR.ACT_SendNotification CAPTION 'Notify the applicant';
+CALL MICROFLOW HR.ACT_Escalate(Request = $WorkflowContext) CAPTION 'Escalate';
 ```
 
 Arguments are bound like every other call in MDL: `Param = expression` right
 after the callee, the expression written bare. The older spelling after the
-comment, `WITH (Param = '<expression>')` with the expression inside a string,
+caption, `WITH (Param = '<expression>')` with the expression inside a string,
 still parses with the same meaning but is deprecated (MDL-DEPR008);
 `mxcli fmt --upgrade` rewrites it.
 
+`CAPTION '…'` sets the caption Studio Pro shows on the activity, on every workflow
+activity. It used to be spelt `COMMENT '…'`, which still parses as a deprecated
+alias (MDL-DEPR104) — it was never a comment.
+
 ## AI Agent Task
 
 A step that runs an AI agent (Mendix 11.9 or later). It is written like `CALL
-MICROFLOW` with `AGENT` added, and takes the same name, comment, parameter
+MICROFLOW` with `AGENT` added, and takes the same name, caption, parameter
 mappings, outcomes and boundary events. The microflow is where the agent is
 invoked — build agents with the Studio Pro Agent Editor, or `CREATE AGENT`.
 
 ```sql
-CALL AGENT MICROFLOW <Module>.<Name> [(<Param> = <expression>, ...)] [AS <name>] [COMMENT '<text>']
+CALL AGENT MICROFLOW <Module>.<Name> [(<Param> = <expression>, ...)] [AS <name>] [CAPTION '<text>']
   [OUTCOMES <true|false|'Module.Enum.Value'|''> -> { <activities> } ...];
 ```
 
@@ -116,7 +120,7 @@ Example — branch on the agent's answer:
 
 ```sql
 CALL AGENT MICROFLOW HR.ACT_ClassifyRequest(Request = $WorkflowContext) AS aiAgentTask1
-  COMMENT 'Classify the request'
+  CAPTION 'Classify the request'
   OUTCOMES true -> {
     USER TASK Expedite 'Expedite the request' PAGE HR.TaskPage OUTCOMES 'Done' { };
   } false -> { };
@@ -131,13 +135,13 @@ branch with `OUTCOMES`; return nothing for a single path.
 Start a sub-workflow:
 
 ```sql
-CALL WORKFLOW <Module>.<Name> [(<Param> = <expression>, ...)] [COMMENT '<text>'];
+CALL WORKFLOW <Module>.<Name> [(<Param> = <expression>, ...)] [CAPTION '<text>'];
 ```
 
 Example:
 
 ```sql
-CALL WORKFLOW HR.BackgroundCheck COMMENT 'Run background check sub-process';
+CALL WORKFLOW HR.BackgroundCheck CAPTION 'Run background check sub-process';
 ```
 
 ## Decision
@@ -228,7 +232,7 @@ WAIT FOR NOTIFICATION;
 An intermediate notification event (Mendix 11.11+): the point a `NOTIFY WORKFLOW` action targets by name.
 
 ```sql
-NOTIFICATION [<name>] [COMMENT '<caption>'];
+NOTIFICATION [<name>] [CAPTION '<caption>'];
 ```
 
 A **notification boundary event** attaches the same trigger to a user task, call microflow or wait. It takes a name instead of a timer delay:
@@ -262,7 +266,7 @@ EVENT SUBPROCESS <name> ['<caption>']
   { <activities> };
 
 EVENT SUBPROCESS <name> ['<caption>']
-  ON (INTERRUPTING | NON INTERRUPTING) TIMER '<first-execution-time>' [AS <start>] [COMMENT '<start caption>']
+  ON (INTERRUPTING | NON INTERRUPTING) TIMER '<first-execution-time>' [AS <start>] [CAPTION '<start caption>']
   { <activities> };
 ```
 
diff --git a/docs-site/src/reference/image-collection/create-image-collection.md b/docs-site/src/reference/image-collection/create-image-collection.md
index f4ea3f697c..b0f8b951d0 100644
--- a/docs-site/src/reference/image-collection/create-image-collection.md
+++ b/docs-site/src/reference/image-collection/create-image-collection.md
@@ -2,9 +2,9 @@
 
 ## Synopsis
 
+    [/** description */]
     CREATE [OR MODIFY] IMAGE COLLECTION module.name
         [EXPORT LEVEL 'Hidden' | 'Public']
-        [COMMENT 'description']
         [(
             IMAGE 'image_name' FROM FILE 'path',
             ...
@@ -22,8 +22,8 @@ Creates a new image collection in the specified module. `OR MODIFY` updates an e
 **EXPORT LEVEL**
 : Controls visibility from other modules. `'Hidden'` (default) restricts access to the owning module. `'Public'` makes images available to other modules.
 
-**COMMENT**
-: Documentation text for the collection.
+**`/** … */`**
+: Documentation text for the collection, as a doc comment before the statement. The `COMMENT '…'` clause is its deprecated alias (`MDL-DEPR100`).
 
 **IMAGE 'name' FROM FILE 'path'**
 : Loads an image from a file on disk. The path is relative to the current working directory. Supported formats: PNG, SVG, GIF, JPEG, BMP, WebP.
@@ -39,9 +39,9 @@ CREATE IMAGE COLLECTION MyModule.AppIcons;
 ### Public collection with description
 
 ```sql
+/** Shared icons for all modules */
 CREATE IMAGE COLLECTION MyModule.SharedIcons
-    EXPORT LEVEL 'Public'
-    COMMENT 'Shared icons for all modules';
+    EXPORT LEVEL 'Public';
 ```
 
 ### Collection with images
@@ -57,9 +57,9 @@ CREATE IMAGE COLLECTION MyModule.NavigationIcons (
 ### All options combined
 
 ```sql
+/** Company branding assets */
 CREATE IMAGE COLLECTION MyModule.BrandAssets
-    EXPORT LEVEL 'Public'
-    COMMENT 'Company branding assets' (
+    EXPORT LEVEL 'Public' (
     IMAGE 'logo-dark' FROM FILE 'assets/logo-dark.png',
     IMAGE 'logo-light' FROM FILE 'assets/logo-light.png'
 );
diff --git a/docs-site/src/reference/integration/create-json-structure.md b/docs-site/src/reference/integration/create-json-structure.md
index 70eae1c975..e526c20732 100644
--- a/docs-site/src/reference/integration/create-json-structure.md
+++ b/docs-site/src/reference/integration/create-json-structure.md
@@ -3,9 +3,9 @@
 ## Synopsis
 
 ```sql
+[ /** description */ ]
 CREATE [ OR MODIFY ] JSON STRUCTURE module.Name
     [ FOLDER 'folder/path' ]
-    [ COMMENT 'description' ]
     SNIPPET 'json_sample'
     [ CUSTOM_NAME_MAP ( 'jsonKey' AS 'AttributeName' [, ...] ) ]
 ```
@@ -28,8 +28,8 @@ The optional `CUSTOM_NAME_MAP` clause overrides the attribute names generated fr
 `FOLDER 'folder/path'`
 :   Optional. Places the document in the specified Studio Pro folder (forward-slash separated), creating missing folders in the path. On `CREATE OR MODIFY` this **moves** an existing document; omitting the clause leaves placement alone rather than returning the document to the module root. See [MOVE](../organization/move.md).
 
-`COMMENT 'description'`
-:   Optional. A description for the JSON structure document.
+`/** description */`
+:   Optional. The documentation of the JSON structure document, as a doc comment before the statement. The `COMMENT 'description'` clause is its deprecated alias (`MDL-DEPR100`).
 
 `SNIPPET 'json_sample'`
 :   A representative JSON document. Must be a valid JSON string. The sample defines field names and types. Multi-line snippets can use `$$...$$` quoting.
diff --git a/docs-site/src/reference/organization/create-folder.md b/docs-site/src/reference/organization/create-folder.md
index 199ac4c4f0..fadadb4ec9 100644
--- a/docs-site/src/reference/organization/create-folder.md
+++ b/docs-site/src/reference/organization/create-folder.md
@@ -45,11 +45,10 @@ END;
 ### Use a folder when creating a page
 
 ```sql
-CREATE PAGE MyModule.Order_Edit
+CREATE PAGE MyModule.Order_Edit FOLDER 'Orders'
 (
   Title: 'Edit Order',
-  Layout: Atlas_Core.PopupLayout,
-  Folder: 'Orders'
+  Layout: Atlas_Core.PopupLayout
 )
 {
   CONTAINER main {}
diff --git a/docs-site/src/reference/organization/move.md b/docs-site/src/reference/organization/move.md
index 29c5755441..8281ea177a 100644
--- a/docs-site/src/reference/organization/move.md
+++ b/docs-site/src/reference/organization/move.md
@@ -89,9 +89,10 @@ MOVE JSON STRUCTURE MyModule.JSON_Order TO FOLDER 'Private/JSON structures';
 ### Place a document while creating it
 
 Every document type takes a `FOLDER` clause on `CREATE`, so a document can be
-placed by the statement that creates it. On pages and snippets it is a property
-(`Folder: 'path'`); on microflows and nanoflows a keyword before `BEGIN`; on
-everything else a keyword straight after the qualified name:
+placed by the statement that creates it. On microflows and nanoflows it follows
+the signature, before `BEGIN`; on everything else, pages and snippets included, it
+follows the qualified name straight away. The `Folder: 'path'` property that pages,
+snippets and REST/OData services also take is a deprecated alias (`MDL-DEPR105`):
 
 ```sql
 CREATE OR MODIFY JSON STRUCTURE MyModule.JSON_Order
diff --git a/docs-site/src/reference/page/create-page.md b/docs-site/src/reference/page/create-page.md
index 925df9d77c..76a107d861 100644
--- a/docs-site/src/reference/page/create-page.md
+++ b/docs-site/src/reference/page/create-page.md
@@ -3,12 +3,11 @@
 ## Synopsis
 
 ```sql
-CREATE [ OR REPLACE ] PAGE module.Name
+CREATE [ OR REPLACE ] PAGE module.Name [ FOLDER 'path' ]
 (
     [ Params: { $param : Module.Entity | Type [, ...] }, ]
     Title: 'title',
     Layout: Module.LayoutName
-    [, Folder: 'path' ]
     [, Variables: { $name : type = 'expression' [, ...] } ]
 )
 {
@@ -209,8 +208,8 @@ These properties are available on most widget types:
 `Layout: Module.LayoutName`
 :   The page layout. Must reference an existing layout. Required.
 
-`Folder: 'path'`
-:   Optional folder within the module. Nested folders use `/`.
+`FOLDER 'path'`
+:   Optional folder within the module, as a clause after the name. Nested folders use `/`. The `Folder: 'path'` property is its deprecated alias (`MDL-DEPR105`).
 
 `Variables: { ... }`
 :   Optional page variables with type and default expression.
@@ -243,11 +242,10 @@ CREATE PAGE MyModule.Customer_Edit
 Overview page with a data grid:
 
 ```sql
-CREATE PAGE Sales.Order_Overview
+CREATE PAGE Sales.Order_Overview FOLDER 'Orders'
 (
     Title: 'Orders',
-    Layout: Atlas_Core.Atlas_Default,
-    Folder: 'Orders'
+    Layout: Atlas_Core.Atlas_Default
 )
 {
     DATAGRID dgOrders (DataSource: DATABASE Sales.Order, PageSize: 20) {
diff --git a/docs-site/src/reference/page/create-snippet.md b/docs-site/src/reference/page/create-snippet.md
index 2dce807b13..0147256ef0 100644
--- a/docs-site/src/reference/page/create-snippet.md
+++ b/docs-site/src/reference/page/create-snippet.md
@@ -3,11 +3,10 @@
 ## Synopsis
 
 ```sql
-CREATE [ OR REPLACE ] SNIPPET module.Name
-(
-    [ Params: { $param : Module.Entity | Type [, ...] } ]
-    [, Folder: 'path' ]
-)
+CREATE [ OR REPLACE ] SNIPPET module.Name [ FOLDER 'path' ]
+[(
+    Params: { $param : Module.Entity | Type [, ...] }
+)]
 {
     widget_tree
 }
@@ -45,8 +44,8 @@ The optional `Folder` property places the snippet in a subfolder within the modu
     on a value, keep the primitive on the calling page's parameters, or pass an
     object and read the member inside the snippet.
 
-`Folder: 'path'`
-:   Optional folder path within the module.
+`FOLDER 'path'`
+:   Optional folder path within the module, as a clause after the name. The `Folder: 'path'` property is its deprecated alias (`MDL-DEPR105`).
 
 ## Examples
 
diff --git a/docs/01-project/MDL_QUICK_REFERENCE.md b/docs/01-project/MDL_QUICK_REFERENCE.md
index 589970e633..156208da5e 100644
--- a/docs/01-project/MDL_QUICK_REFERENCE.md
+++ b/docs/01-project/MDL_QUICK_REFERENCE.md
@@ -113,7 +113,7 @@ Modifies an existing entity without full replacement.
 | Modify attributes | `alter entity Module.Name modify (attr: NewType [constraints]);` | Change type/constraints |
 | Rename attribute | `alter entity Module.Name rename attribute OldName to NewName;` | Also rewrites stored references (microflow members, page widgets, validation/access rules) and XPath constraints. Microflow expressions are free text and are **not** rewritten |
 | Add index | `alter entity Module.Name add index [if not exists] [name] [on] (Col1 [asc\|desc], ...);` | `on` is optional (SQL-like). **Without `if not exists`, re-running is an error** — a second identical index fails the build with CE0072 |
-| Document an association | `/** What it links. */`<br>`create association Mod.C_P from Mod.C to Mod.P;`<br>or `... to Mod.P comment 'What it links.';` | Both spellings work on create; the doc comment wins when both are present. `comment` survives here — and only here among the CREATE statements — because it is an association's **only inline** spelling |
+| Document an association | `/** What it links. */`<br>`create association Mod.C_P from Mod.C to Mod.P;` | Documentation is a doc comment, as on every document. `... comment 'What it links.'` still parses as a deprecated alias (`MDL-DEPR100`, also on constants, JSON structures and image collections); the doc comment wins when both are present |
 | Create if absent | `create entity if not exists Module.Name (...);`<br>`create association if not exists Module.Assoc from ... to ...;` | Skips when it already exists, leaving the stored definition untouched. Unlike `create or modify`, which rebuilds the element from the statement and drops any attribute the statement omits — `mxcli check … -p app.mpr --references` warns about that as **MDL087**, naming the members the script removes without restating them |
 | Add index (SQL form) | `create index IdxName on Module.Name (Col1 [asc\|desc], ...);` | Same effect as `alter entity … add index`. The index name is accepted and not stored — a Mendix index is identified by its columns — so `check` warns (MDL-IDX01); prefer `alter entity … add index (…)` |
 | Drop index | `alter entity Module.Name drop index [if exists] (Col1 [asc\|desc], ...);` | Selected by its columns — a Mendix index stores no name, so the columns are its identity, and they are what `describe entity` prints. The legacy positional form `drop index idx1` still works but shifts when an earlier index is dropped |
@@ -275,9 +275,9 @@ Required rule.
 
 **Example:**
 ```sql
+/** A, not too restrictive, email address regular expression */
 create regular expression Val.EmailAddress (
-  Expression: '\w+((-|\+|\.)\w+)*@\w+([\.-]?\w+)*(\.\w{2,})+',
-  Documentation: 'A, not too restrictive, email address regular expression'
+  Expression: '\w+((-|\+|\.)\w+)*@\w+([\.-]?\w+)*(\.\w{2,})+'
 );
 
 -- .NET lookbehind: legal in Mendix, not verifiable by mxcli
@@ -722,21 +722,22 @@ mandatory and a misplaced clause failed with a token error
   - A **targeting microflow** takes exactly `System.Workflow` + the context entity (or a generalization of it), in either order — anything else is CE6677. Users targeting returns a list of `System.User`, groups a list of `System.WorkflowGroup`.
   - An **on-created microflow** takes exactly `System.WorkflowUserTask` + the context entity, in either order (CE6683), and returns nothing (CE5012).
   - `check --references` reports these before anything is written; `exec` refuses the workflow statement itself (Mendix 11+).
-- `call microflow Mod.MF[(<Param> = <expr>, ...)] [as <name>] [comment '<text>'] [outcomes '<out>' -> { } ...];`
-- `call agent microflow Mod.MF [as <name>] [comment '<text>'] [with (<Param> = '<expr>', ...)] [outcomes … -> { } ...];` — an **AI agent task** (Mendix 11.9+): the call-microflow statement stored as `Workflows$AIAgentTaskActivity`. Its microflow must take at least one parameter (CE1590).
-- `call workflow Mod.WF[(<Param> = <expr>, ...)] [as <name>] [comment '<text>'];`
+- `call microflow Mod.MF[(<Param> = <expr>, ...)] [as <name>] [caption '<text>'] [outcomes '<out>' -> { } ...];`
+- `call agent microflow Mod.MF [as <name>] [caption '<text>'] [with (<Param> = '<expr>', ...)] [outcomes … -> { } ...];` — an **AI agent task** (Mendix 11.9+): the call-microflow statement stored as `Workflows$AIAgentTaskActivity`. Its microflow must take at least one parameter (CE1590).
+- `call workflow Mod.WF[(<Param> = <expr>, ...)] [as <name>] [caption '<text>'];`
 - `decision [<name>] ['<expression>'] outcomes <true|false|'Module.Enum.Value'> -> { } ...;`
 - `parallel split [<name>] path 1 { } path 2 { };`
 - `jump to <activity-name>;`
 - `wait for timer [<name>] ['<expr>'];`
 - `wait for notification [<name>];`
-- `notification [<name>] [comment '<caption>'];` — an intermediate notification event (Mendix 11.11+)
-- `end workflow [comment '<caption>'];` — only inside a `{ }` block; ends the whole workflow
+- `notification [<name>] [caption '<caption>'];` — an intermediate notification event (Mendix 11.11+)
+- `end workflow [caption '<caption>'];` — only inside a `{ }` block; ends the whole workflow
+- `caption '…'` sets the caption Studio Pro shows on an activity; `comment '…'`, the old spelling, is a deprecated alias (`MDL-DEPR104`)
 - Boundary events, after `outcomes`: `boundary event [non] interrupting timer '<expr>' { … }` or `boundary event [non] interrupting notification <name> ['<caption>'] { … }` (11.11+). One interrupting event per activity (CE6697, MDL-WF15).
 
 **Notifying a workflow** (a microflow statement): `[$Notified =] notify workflow $Workflow target Module.Workflow.ElementName;` — the element is a notification-started event sub-process's start, a notification activity, a notification boundary event or a wait for notification, and mxcli resolves which. The target is required (CE0166, MDL-WF16).
 
-**Event sub-processes**, after the main body: `event subprocess <name> ['<caption>'] on [non] interrupting notification [<start>] ['<caption>'] { … };` (11.8+) or `… on [non] interrupting timer '<first-execution-time>' [as <start>] [comment '<caption>'] { … };` (11.13+). The body's End is implicit; a `jump to` stays in its own sub-process (CE6682, MDL-WF05); a timer needs its expression (CE0126, MDL-WF14).
+**Event sub-processes**, after the main body: `event subprocess <name> ['<caption>'] on [non] interrupting notification [<start>] ['<caption>'] { … };` (11.8+) or `… on [non] interrupting timer '<first-execution-time>' [as <start>] [caption '<caption>'] { … };` (11.13+). The body's End is implicit; a `jump to` stays in its own sub-process (CE6682, MDL-WF05); a timer needs its expression (CE0126, MDL-WF14).
 
 **Workflow event handlers.** `on workflow events (UserTaskStarted, UserTaskEnded)
 microflow Mod.MF as 'Task audit'` in the header runs the microflow for each listed
@@ -1100,7 +1101,7 @@ Respond in {{Language}}.$$,
 |-----------|--------|-------|
 | Show collections | `show image collection [in module];` | List all or filter by module |
 | Describe collection | `describe image collection Module.Name;` | Full MDL output with embedded images |
-| Create collection | `create image collection Module.Name [folder 'path'] [export level 'Hidden'\|'Public'] [comment 'text'] [(image Name from file 'path', ...)];` | With or without images |
+| Create collection | `[/** text */] create image collection Module.Name [folder 'path'] [export level 'Hidden'\|'Public'] [(image Name from file 'path', ...)];` | With or without images. `comment 'text'` is a deprecated alias of the doc comment (`MDL-DEPR100`) |
 | Create or modify | `create or modify image collection Module.Name [...];` | Preserves UUID — preferred for AI agents |
 | Drop collection | `drop image collection [if exists] Module.Name;` | Removes collection and all embedded images |
 | Show an image on a page | `image imgLogo (Image: 'Module.Collection.ImageName');` | Three-part name, like an icon reference. `describe image collection` lists the names |
@@ -1236,11 +1237,10 @@ Operations, path/query parameters, headers, request body, response type, resourc
 | Revoke access | `revoke access on published rest service Module.Name from Module.Role, ...;` | |
 
 ```sql
-create published rest service Module.MyAPI (
+create published rest service Module.MyAPI folder 'Integration/REST' (
   path: 'rest/api/v1',
   version: '1.0.0',
-  ServiceName: 'My API',
-  folder: 'Integration/REST'
+  ServiceName: 'My API'
 )
 {
   resource 'orders' {
@@ -1293,7 +1293,7 @@ source json '{"latitude": 51.9, "current": {"temp": 12.8}}'
 |-----------|--------|-------|
 | Show structures | `show json structures [in module];` | List all or filter by module |
 | Describe structure | `describe json structure Module.Name;` | Re-executable CREATE OR MODIFY + element tree |
-| Create structure | `create json structure Module.Name [comment 'text'] snippet '...json...';` | Element tree auto-built from snippet |
+| Create structure | `[/** text */] create json structure Module.Name [folder 'path'] snippet '...json...';` | Element tree auto-built from snippet. `comment 'text'` is a deprecated alias of the doc comment (`MDL-DEPR100`) |
 | Create (multi-line) | `create json structure Module.Name snippet $${ "key": "value" }$$;` | Dollar-quoted snippet for readability |
 | Create or modify | `create or modify json structure Module.Name snippet '...';` | Preserves UUID — preferred for AI agents |
 | Create with name map | `create json structure Module.Name snippet '...' CUSTOM NAME map ('jsonKey' as 'CustomName', ...);` | Override auto-generated ExposedNames |

From d23529011fafe3073cf70c37dad0eda51cc8faf1 Mon Sep 17 00:00:00 2001
From: Ako <andrej@koelewijn.net>
Date: Mon, 28 Sep 2026 08:15:45 +0000
Subject: [PATCH 21/35] fix(workflow): create or modify carries what describe
 cannot print (#743)

Outcomes always store a Flow and a PersistentId, activities store the
Studio Pro layout default 0;0, an empty EventSubProcesses list is written
on 11.8+, and the stored names of the implicit activities (start1, end1,
...) are carried onto the rebuild.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 mdl/backend/modelsdk/workflow_carry_test.go | 117 ++++++++++++++
 mdl/backend/modelsdk/workflow_write.go      | 122 +++++++++-----
 mdl/executor/cmd_workflows_write.go         |  23 ++-
 mdl/executor/workflow_carry_names.go        | 167 ++++++++++++++++++++
 mdl/executor/workflow_carry_names_test.go   | 130 +++++++++++++++
 modelsdk/codec/encoder.go                   |   2 +-
 6 files changed, 517 insertions(+), 44 deletions(-)
 create mode 100644 mdl/backend/modelsdk/workflow_carry_test.go
 create mode 100644 mdl/executor/workflow_carry_names.go
 create mode 100644 mdl/executor/workflow_carry_names_test.go

diff --git a/mdl/backend/modelsdk/workflow_carry_test.go b/mdl/backend/modelsdk/workflow_carry_test.go
new file mode 100644
index 0000000000..df2bf26b19
--- /dev/null
+++ b/mdl/backend/modelsdk/workflow_carry_test.go
@@ -0,0 +1,117 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package modelsdkbackend
+
+import (
+	"testing"
+
+	"go.mongodb.org/mongo-driver/v2/bson"
+
+	"github.com/mendixlabs/mxcli/mdl/types"
+	"github.com/mendixlabs/mxcli/sdk/workflows"
+)
+
+// Running a Studio Pro-authored workflow's own describe output as `create or
+// modify` rewrote what Studio Pro stores and describe cannot print (#743,
+// ako/TestApp workflow.Workflow1 and Workflow1_2, Mendix 11.14.0):
+//   - every outcome stores a Flow, empty when the outcome leads nowhere
+//     (Workflows$Outcome.flow is Required), and a VoidConditionOutcome stores a
+//     PersistentId like every other outcome — both were dropped;
+//   - every activity stores RelativeMiddlePoint and Size "0;0" — written as "";
+//   - EventSubProcesses is stored empty ([2]) on a workflow that has none —
+//     omitted.
+
+func encodeWorkflowFor(t *testing.T, wf *workflows.Workflow, pv *types.ProjectVersion) bson.Raw {
+	t.Helper()
+	raw, err := encodeWorkflow(wf, pv)
+	if err != nil {
+		t.Fatalf("encode: %v", err)
+	}
+	return raw
+}
+
+func v11(minor int) *types.ProjectVersion {
+	return &types.ProjectVersion{MajorVersion: 11, MinorVersion: minor}
+}
+
+// activityDoc returns the i-th element of a typed array (index 0 is the marker).
+func arrayDoc(t *testing.T, v bson.RawValue, i int) bson.Raw {
+	t.Helper()
+	vals, err := v.Array().Values()
+	if err != nil || len(vals) <= i {
+		t.Fatalf("array %v has no element %d", v, i)
+	}
+	return vals[i].Document()
+}
+
+func outcomeWorkflow() *workflows.Workflow {
+	return &workflows.Workflow{
+		Name:      "WF",
+		Parameter: &workflows.WorkflowParameter{EntityRef: "M.Ctx"},
+		Flow: &workflows.Flow{Activities: []workflows.WorkflowActivity{
+			&workflows.StartWorkflowActivity{BaseWorkflowActivity: workflows.BaseWorkflowActivity{Name: "start1", Caption: "Start"}},
+			&workflows.CallMicroflowTask{
+				BaseWorkflowActivity: workflows.BaseWorkflowActivity{Name: "aiAgentTask1", Caption: "AI Agent Task"},
+				IsAgent:              true,
+				Microflow:            "M.InvokeAgent",
+				Outcomes:             []workflows.ConditionOutcome{&workflows.VoidConditionOutcome{}},
+			},
+			&workflows.UserTask{
+				BaseWorkflowActivity: workflows.BaseWorkflowActivity{Name: "userTask1", Caption: "User Task"},
+				Page:                 "M.TaskPage",
+				Outcomes:             []*workflows.UserTaskOutcome{{Value: "Good"}},
+			},
+			&workflows.EndWorkflowActivity{BaseWorkflowActivity: workflows.BaseWorkflowActivity{Name: "end1", Caption: "End"}},
+		}},
+	}
+}
+
+func TestWorkflowToGen_EveryOutcomeStoresAFlow(t *testing.T) {
+	raw := encodeWorkflowFor(t, outcomeWorkflow(), v11(14))
+	acts := raw.Lookup("Flow", "Activities")
+
+	void := arrayDoc(t, arrayDoc(t, acts, 2).Lookup("Outcomes"), 1)
+	if _, err := void.LookupErr("Flow", "Activities"); err != nil {
+		t.Errorf("a VoidConditionOutcome with no activities stores no Flow: %v", void)
+	}
+	if _, err := void.LookupErr("PersistentId"); err != nil {
+		t.Errorf("a VoidConditionOutcome stores no PersistentId: %v", void)
+	}
+
+	user := arrayDoc(t, arrayDoc(t, acts, 3).Lookup("Outcomes"), 1)
+	if _, err := user.LookupErr("Flow", "Activities"); err != nil {
+		t.Errorf("a UserTaskOutcome with no activities stores no Flow: %v", user)
+	}
+}
+
+func TestWorkflowToGen_ActivityLayoutIsTheStudioProDefault(t *testing.T) {
+	raw := encodeWorkflowFor(t, outcomeWorkflow(), v11(14))
+	acts := raw.Lookup("Flow", "Activities")
+	for i := 1; i <= 4; i++ {
+		act := arrayDoc(t, acts, i)
+		for _, key := range []string{"RelativeMiddlePoint", "Size"} {
+			if got, _ := act.Lookup(key).StringValueOK(); got != "0;0" {
+				t.Errorf("activity %d %s = %q, want \"0;0\" (what Studio Pro stores)", i, key, got)
+			}
+		}
+	}
+}
+
+func TestWorkflowEncoder_EmptyEventSubProcessesFromMendix118(t *testing.T) {
+	wf := outcomeWorkflow()
+	v, err := encodeWorkflowFor(t, wf, v11(14)).LookupErr("EventSubProcesses")
+	if err != nil {
+		t.Fatal("a workflow with no event sub-processes stores no EventSubProcesses on 11.14; Studio Pro stores [2]")
+	}
+	vals, _ := v.Array().Values()
+	if len(vals) != 1 || vals[0].Int32() != 2 {
+		t.Errorf("EventSubProcesses = %v, want [2]", v)
+	}
+	// Control: the property only exists from 11.8.0, and a key the project's
+	// metamodel does not declare makes the document unopenable in Studio Pro.
+	for _, pv := range []*types.ProjectVersion{v11(7), nil} {
+		if _, err := encodeWorkflowFor(t, wf, pv).LookupErr("EventSubProcesses"); err == nil {
+			t.Errorf("EventSubProcesses written for project version %v, which does not declare it", pv)
+		}
+	}
+}
diff --git a/mdl/backend/modelsdk/workflow_write.go b/mdl/backend/modelsdk/workflow_write.go
index e3587917b0..cb74ad351a 100644
--- a/mdl/backend/modelsdk/workflow_write.go
+++ b/mdl/backend/modelsdk/workflow_write.go
@@ -5,6 +5,7 @@ package modelsdkbackend
 import (
 	"fmt"
 
+	"github.com/mendixlabs/mxcli/mdl/types"
 	"github.com/mendixlabs/mxcli/model"
 	"github.com/mendixlabs/mxcli/modelsdk/codec"
 	"github.com/mendixlabs/mxcli/modelsdk/element"
@@ -53,8 +54,11 @@ func init() {
 
 	// Mandatory empty-list markers + null PartProperties, keyed per $Type. Empty
 	// marker-2 lists rely on these (an empty addPartList would default to marker 3).
+	// EventSubProcesses empties as [2]: Studio Pro 11.14 stores it on a workflow
+	// that has none (ako/TestApp). encodeWorkflow suppresses the empty list for a
+	// project that does not declare the property (before 11.8.0).
 	codec.RegisterTypeDefaults("Workflows$Workflow", codec.TypeDefaults{
-		MandatoryListMarkers: map[string]int32{"OnWorkflowEvent": 2},
+		MandatoryListMarkers: map[string]int32{"OnWorkflowEvent": 2, "EventSubProcesses": 2},
 		NullFields:           []string{"WorkflowMetaData", "Annotation", "AdminPage"},
 	})
 	codec.RegisterTypeDefaults("Workflows$Flow", codec.TypeDefaults{
@@ -130,7 +134,10 @@ const (
 // useCallMicroflowActivityName reports whether the target project is Mendix 11.9+
 // and therefore expects the CallMicroflowActivity storage name.
 func (b *Backend) useCallMicroflowActivityName() bool {
-	pv := b.ProjectVersion()
+	return usesCallMicroflowActivityName(b.ProjectVersion())
+}
+
+func usesCallMicroflowActivityName(pv *types.ProjectVersion) bool {
 	return pv != nil && pv.IsAtLeast(11, 9)
 }
 
@@ -163,9 +170,7 @@ func (b *Backend) CreateWorkflow(wf *workflows.Workflow) error {
 		wf.ID = model.ID(mmpr.GenerateID())
 	}
 	wf.TypeName = "Workflows$Workflow"
-	g := workflowToGen(wf)
-	applyCallMicroflowStorageName(g, b.useCallMicroflowActivityName())
-	contents, err := (&codec.Encoder{}).Encode(g)
+	contents, err := encodeWorkflow(wf, b.ProjectVersion())
 	if err != nil {
 		return fmt.Errorf("CreateWorkflow: encode: %w", err)
 	}
@@ -181,15 +186,47 @@ func (b *Backend) UpdateWorkflow(wf *workflows.Workflow) error {
 		return fmt.Errorf("UpdateWorkflow: not connected for writing")
 	}
 	wf.TypeName = "Workflows$Workflow"
-	g := workflowToGen(wf)
-	applyCallMicroflowStorageName(g, b.useCallMicroflowActivityName())
-	contents, err := (&codec.Encoder{}).Encode(g)
+	contents, err := encodeWorkflow(wf, b.ProjectVersion())
 	if err != nil {
 		return fmt.Errorf("UpdateWorkflow: encode: %w", err)
 	}
 	return b.writer.UpdateRawUnit(string(wf.ID), contents)
 }
 
+// workflowEventSubProcessesMajor/Minor is the version that introduced
+// Workflows$Workflow.eventSubProcesses (modelsdk/gen/workflows/version.go).
+const workflowEventSubProcessesMajor, workflowEventSubProcessesMinor = 11, 8
+
+// encodeWorkflow builds and serializes a workflow for a project of this
+// version. CreateWorkflow and UpdateWorkflow both go through it, so a version
+// guard cannot be applied on one path and forgotten on the other.
+//
+// An empty EventSubProcesses list is what Studio Pro stores on a workflow with
+// none (ako/TestApp, 11.14.0); omitting it made every rewrite of a Studio Pro
+// workflow delete the key (#743). It is written only when the project declares
+// the property: a key the project's metamodel does not know makes the document
+// unopenable in Studio Pro, and mxbuild does not catch it (see
+// codec.Encoder.OmitKeys). An unreadable version omits it, like the page guards.
+func encodeWorkflow(wf *workflows.Workflow, pv *types.ProjectVersion) ([]byte, error) {
+	g := workflowToGen(wf)
+	applyCallMicroflowStorageName(g, usesCallMicroflowActivityName(pv))
+	enc := &codec.Encoder{}
+	if len(wf.EventSubProcesses) == 0 && !workflowSupportsEventSubProcesses(pv) {
+		// Only the empty default is suppressed: event sub-processes the script
+		// declares are written whatever the version (the feature check refuses
+		// them on an older project before this is reached).
+		enc.OmitKeys = map[string]map[string]bool{"Workflows$Workflow": {"EventSubProcesses": true}}
+	}
+	return enc.Encode(g)
+}
+
+// workflowSupportsEventSubProcesses reports whether the project declares
+// Workflows$Workflow.eventSubProcesses, introduced in 11.8.0
+// (modelsdk/gen/workflows/version.go).
+func workflowSupportsEventSubProcesses(pv *types.ProjectVersion) bool {
+	return pv != nil && pv.IsAtLeast(11, 8)
+}
+
 // DeleteWorkflow removes a workflow unit by ID.
 func (b *Backend) DeleteWorkflow(id model.ID) error {
 	if b.writer == nil {
@@ -214,8 +251,8 @@ func workflowToGen(wf *workflows.Workflow) element.Element {
 	}
 	addStr(g, "Documentation", wf.Documentation)
 	addStr(g, "DueDate", wf.DueDate)
-	// EventSubProcesses: a marker-2 list. Studio Pro 11.14 writes it empty too,
-	// but the property only exists from 11.8, so an empty one is not invented.
+	// EventSubProcesses: a marker-2 list, written empty through the Studio Pro
+	// defaults when there are none; workflowEncoder omits it before 11.8.
 	if len(wf.EventSubProcesses) > 0 {
 		esps := make([]element.Element, 0, len(wf.EventSubProcesses))
 		for _, esp := range wf.EventSubProcesses {
@@ -396,8 +433,8 @@ func userTaskToGen(a *workflows.UserTask) element.Element {
 		addPartList(g, "Outcomes", outcomes)
 	}
 	addFreshPersistentID(g)
-	addStr(g, "RelativeMiddlePoint", "")
-	addStr(g, "Size", "")
+	addStr(g, "RelativeMiddlePoint", workflowZeroPoint)
+	addStr(g, "Size", workflowZeroPoint)
 	addPart(g, "TaskDescription", workflowStringTemplate(a.TaskDescription))
 	taskName := a.TaskName
 	if taskName == "" {
@@ -519,8 +556,8 @@ func callMicroflowTaskToGen(a *workflows.CallMicroflowTask) element.Element {
 		addPartList(g, "ParameterMappings", mappings)
 	}
 	addFreshPersistentID(g)
-	addStr(g, "RelativeMiddlePoint", "")
-	addStr(g, "Size", "")
+	addStr(g, "RelativeMiddlePoint", workflowZeroPoint)
+	addStr(g, "Size", workflowZeroPoint)
 	return g
 }
 
@@ -539,8 +576,8 @@ func callWorkflowActivityToGen(a *workflows.CallWorkflowActivity) element.Elemen
 		addPartList(g, "ParameterMappings", mappings)
 	}
 	addFreshPersistentID(g)
-	addStr(g, "RelativeMiddlePoint", "")
-	addStr(g, "Size", "")
+	addStr(g, "RelativeMiddlePoint", workflowZeroPoint)
+	addStr(g, "Size", workflowZeroPoint)
 	addStr(g, "Workflow", a.Workflow)
 	return g
 }
@@ -571,10 +608,7 @@ func parallelSplitToGen(a *workflows.ParallelSplitActivity) element.Element {
 	outcomes := make([]element.Element, 0, len(a.Outcomes))
 	for _, o := range a.Outcomes {
 		oc := newElem("Workflows$ParallelSplitOutcome", string(o.ID))
-		if o.Flow != nil {
-			flow := flowToGen(o.Flow)
-			addPart(oc, "Flow", flow)
-		}
+		addPart(oc, "Flow", outcomeFlowToGen(o.Flow))
 		addFreshPersistentID(oc)
 		outcomes = append(outcomes, oc)
 	}
@@ -613,8 +647,8 @@ func waitForNotificationToGen(a *workflows.WaitForNotificationActivity) element.
 	addStr(g, "Caption", a.Caption)
 	addStr(g, "Name", a.Name)
 	addFreshPersistentID(g)
-	addStr(g, "RelativeMiddlePoint", "")
-	addStr(g, "Size", "")
+	addStr(g, "RelativeMiddlePoint", workflowZeroPoint)
+	addStr(g, "Size", workflowZeroPoint)
 	return g
 }
 
@@ -631,16 +665,14 @@ func annotationActivityToGen(a *workflows.WorkflowAnnotationActivity) element.El
 	g := newElem("Workflows$Annotation", activityID(&a.BaseWorkflowActivity))
 	addStr(g, "Description", a.Description)
 	addFreshPersistentID(g)
-	addStr(g, "RelativeMiddlePoint", "")
-	addStr(g, "Size", "")
+	addStr(g, "RelativeMiddlePoint", workflowZeroPoint)
+	addStr(g, "Size", workflowZeroPoint)
 	return g
 }
 
 func userTaskOutcomeToGen(o *workflows.UserTaskOutcome) element.Element {
 	g := newElem("Workflows$UserTaskOutcome", string(o.ID))
-	if o.Flow != nil {
-		addPart(g, "Flow", flowToGen(o.Flow))
-	}
+	addPart(g, "Flow", outcomeFlowToGen(o.Flow))
 	addFreshPersistentID(g)
 	addStr(g, "Value", o.Value)
 	return g
@@ -650,23 +682,21 @@ func conditionOutcomeToGen(outcome workflows.ConditionOutcome) element.Element {
 	switch o := outcome.(type) {
 	case *workflows.BooleanConditionOutcome:
 		g := newElem("Workflows$BooleanConditionOutcome", outcomeID(o.ID))
+		addPart(g, "Flow", outcomeFlowToGen(o.Flow))
+		addFreshPersistentID(g)
 		addBool(g, "Value", o.Value)
-		if o.Flow != nil {
-			addPart(g, "Flow", flowToGen(o.Flow))
-		}
 		return g
 	case *workflows.EnumerationValueConditionOutcome:
 		g := newElem("Workflows$EnumerationValueConditionOutcome", outcomeID(o.ID))
+		addPart(g, "Flow", outcomeFlowToGen(o.Flow))
+		addFreshPersistentID(g)
 		addStr(g, "Value", o.Value)
-		if o.Flow != nil {
-			addPart(g, "Flow", flowToGen(o.Flow))
-		}
 		return g
 	case *workflows.VoidConditionOutcome:
 		g := newElem("Workflows$VoidConditionOutcome", outcomeID(o.ID))
-		if o.Flow != nil {
-			addPart(g, "Flow", flowToGen(o.Flow))
-		}
+		addPart(g, "Flow", outcomeFlowToGen(o.Flow))
+		// Workflows$Outcome.persistentId (10.21.0), as on every other outcome.
+		addFreshPersistentID(g)
 		return g
 	default:
 		return nil
@@ -769,8 +799,24 @@ func addActivityBaseFields(g *element.Base, annotation string) {
 		addPart(g, "Annotation", annotationElem(annotation))
 	}
 	addFreshPersistentID(g)
-	addStr(g, "RelativeMiddlePoint", "")
-	addStr(g, "Size", "")
+	addStr(g, "RelativeMiddlePoint", workflowZeroPoint)
+	addStr(g, "Size", workflowZeroPoint)
+}
+
+// workflowZeroPoint is the RelativeMiddlePoint and Size Studio Pro stores on
+// every workflow activity (measured on ako/TestApp, 11.14.0: 14 of 14). The
+// workflow editor lays activities out itself; an empty string is not a point.
+const workflowZeroPoint = "0;0"
+
+// outcomeFlowToGen is an outcome's Flow. Workflows$Outcome.flow is Required, and
+// Studio Pro stores an empty Flow on an outcome that leads nowhere (ako/TestApp,
+// 11.14.0, every UserTaskOutcome and VoidConditionOutcome); omitting it made
+// every rewrite of a Studio Pro workflow drop them (#743).
+func outcomeFlowToGen(flow *workflows.Flow) element.Element {
+	if flow == nil {
+		flow = &workflows.Flow{}
+	}
+	return flowToGen(flow)
 }
 
 // addFreshPersistentID emits PersistentId as a fresh binary-UUID value (the
diff --git a/mdl/executor/cmd_workflows_write.go b/mdl/executor/cmd_workflows_write.go
index 0a4d97f92d..435bc0373a 100644
--- a/mdl/executor/cmd_workflows_write.go
+++ b/mdl/executor/cmd_workflows_write.go
@@ -119,6 +119,7 @@ func execCreateWorkflow(ctx *ExecContext, s *ast.CreateWorkflowStmt) error {
 	existingExcluded := false
 	var existingDocumentation string
 	var existingHandlers []*workflows.WorkflowEventHandler
+	var existingWf *workflows.Workflow
 	haveExistingWf := false
 	if existing, ok := pickLive(existingWorkflows,
 		func(w *workflows.Workflow) bool {
@@ -127,17 +128,18 @@ func execCreateWorkflow(ctx *ExecContext, s *ast.CreateWorkflowStmt) error {
 		func(w *workflows.Workflow) bool { return w.Excluded },
 	); ok {
 		if !s.CreateOrModify {
-			// Not "use create or modify": that rewrite does not yet carry what
-			// describe cannot print (event sub-processes, outcome flows, activity
-			// names) and would lose Studio Pro-authored content (#743).
-			return mdlerrors.NewAlreadyExistsMsg("workflow", s.Name.Module+"."+s.Name.Name, "workflow '"+s.Name.Module+"."+s.Name.Name+"' already exists — use 'alter workflow "+s.Name.Module+"."+s.Name.Name+" ...' to change it; "+
-				"'create or modify workflow' rewrites the whole workflow and does not yet keep everything Studio Pro stores (event sub-processes, outcome flows)")
+			// The rewrite carries what describe cannot print (#743), so it is the
+			// advice again, as for every other document type.
+			qn := s.Name.Module + "." + s.Name.Name
+			return mdlerrors.NewAlreadyExistsMsg("workflow", qn, "workflow '"+qn+"' already exists "+
+				"(use create or modify to update it, or 'alter workflow "+qn+" ...' to change one activity)")
 		}
 		existingID = existing.ID
 		existingExcluded = existing.Excluded
 		existingContainer = existing.ContainerID
 		existingDocumentation = existing.Documentation
 		existingHandlers = existing.EventHandlers
+		existingWf = existing
 		haveExistingWf = true
 
 		// Refuse a rewrite that would delete a stored construct this statement
@@ -223,6 +225,17 @@ func execCreateWorkflow(ctx *ExecContext, s *ast.CreateWorkflowStmt) error {
 		named = append(named, esp.Flow.Activities...)
 	}
 
+	// Carry the stored names of the activities describe cannot name (the
+	// implicit start and ends, jumps) before deduplicating, so the carried names
+	// take part in it (#743).
+	if existingWf != nil {
+		mainFlow := append(append([]workflows.WorkflowActivity{startAct}, userActivities...), endAct)
+		if existingWf.Flow != nil {
+			carryWorkflowActivityNames(mainFlow, existingWf.Flow.Activities)
+		}
+		carryEventSubProcessActivityNames(wf.EventSubProcesses, existingWf.EventSubProcesses)
+	}
+
 	// Deduplicate activity names to avoid CE0495
 	// The implicit Start and End take part: an `end workflow` inside a branch is
 	// named after its caption, "End" by default, and colliding with the main
diff --git a/mdl/executor/workflow_carry_names.go b/mdl/executor/workflow_carry_names.go
new file mode 100644
index 0000000000..2441b252da
--- /dev/null
+++ b/mdl/executor/workflow_carry_names.go
@@ -0,0 +1,167 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package executor
+
+import (
+	"fmt"
+
+	"github.com/mendixlabs/mxcli/sdk/workflows"
+)
+
+// Studio Pro names a workflow's implicit activities itself — start1, end1,
+// end2, … — and describe prints no name for them: the main flow's start and
+// end are implied by `begin … end workflow`, an `end workflow` in a branch and
+// the end of an event sub-process have no name clause, and neither do a jump or
+// the end-of-path markers. `create or modify` rebuilt them as Start, End, End2,
+// so running a Studio Pro workflow's own describe output renamed every one of
+// them (#743, ako/TestApp workflow.Workflow1). ADR-0012: what the statement
+// cannot state is carried from what is stored.
+//
+// The pairing is structural. Within a pair of corresponding flows, an activity
+// the statement names is paired with the stored activity of that name and type;
+// an activity it cannot name is paired with the stored activity of the same
+// type at the same ordinal among that type (the first End with the first End).
+// The flows nested in a paired activity — outcomes, then boundary events — are
+// paired by position when both sides have the same number of them. Anything
+// that does not pair keeps the name the rebuild gives it, and the
+// deduplication that runs afterwards still holds every name to CE0495.
+
+// carryWorkflowActivityNames carries the stored names of the activities in
+// declared that describe cannot name, and recurses into the flows nested in
+// every activity that pairs.
+func carryWorkflowActivityNames(declared, stored []workflows.WorkflowActivity) {
+	named := map[string]workflows.WorkflowActivity{}
+	unnamed := map[string][]workflows.WorkflowActivity{}
+	for _, a := range stored {
+		if a == nil {
+			continue
+		}
+		if unnamedWorkflowActivity(a) {
+			k := fmt.Sprintf("%T", a)
+			unnamed[k] = append(unnamed[k], a)
+		} else if a.GetName() != "" {
+			named[a.GetName()] = a
+		}
+	}
+	ordinal := map[string]int{}
+	for _, a := range declared {
+		if a == nil {
+			continue
+		}
+		var match workflows.WorkflowActivity
+		k := fmt.Sprintf("%T", a)
+		if unnamedWorkflowActivity(a) {
+			i := ordinal[k]
+			ordinal[k]++
+			if i < len(unnamed[k]) {
+				match = unnamed[k][i]
+				if n := match.GetName(); n != "" {
+					a.SetName(n)
+				}
+			}
+		} else if m, ok := named[a.GetName()]; ok && fmt.Sprintf("%T", m) == k {
+			match = m
+		}
+		if match == nil {
+			continue
+		}
+		d, s := workflowFlowSlots(a), workflowFlowSlots(match)
+		if len(d) != len(s) {
+			continue
+		}
+		for i := range d {
+			if d[i] != nil && s[i] != nil {
+				carryWorkflowActivityNames(d[i].Activities, s[i].Activities)
+			}
+		}
+	}
+}
+
+// carryEventSubProcessActivityNames pairs event sub-processes by name, which
+// describe prints, and carries the names inside each.
+func carryEventSubProcessActivityNames(declared, stored []*workflows.EventSubProcess) {
+	byName := map[string]*workflows.EventSubProcess{}
+	for _, esp := range stored {
+		if esp != nil && esp.Name != "" {
+			byName[esp.Name] = esp
+		}
+	}
+	for _, esp := range declared {
+		if esp == nil || esp.Flow == nil {
+			continue
+		}
+		if s, ok := byName[esp.Name]; ok && s.Flow != nil {
+			carryWorkflowActivityNames(esp.Flow.Activities, s.Flow.Activities)
+		}
+	}
+}
+
+// unnamedWorkflowActivity reports whether describe prints no name for act, so
+// the statement cannot state it.
+func unnamedWorkflowActivity(act workflows.WorkflowActivity) bool {
+	switch act.(type) {
+	case *workflows.StartWorkflowActivity, *workflows.EndWorkflowActivity,
+		*workflows.EndOfParallelSplitPathActivity, *workflows.EndOfBoundaryEventPathActivity,
+		*workflows.JumpToActivity:
+		return true
+	}
+	return false
+}
+
+// workflowFlowSlots lists the flows nested in act in a fixed order — outcomes,
+// then boundary events — keeping an absent flow as nil so the two sides of a
+// pair line up by position. nestedFlows skips absent flows, which suits a walk
+// but not a pairing: the rebuild leaves an empty outcome's flow nil where the
+// stored one has an empty Flow.
+func workflowFlowSlots(act workflows.WorkflowActivity) []*workflows.Flow {
+	var flows []*workflows.Flow
+	conditions := func(outcomes []workflows.ConditionOutcome) {
+		for _, o := range outcomes {
+			if o == nil {
+				flows = append(flows, nil)
+				continue
+			}
+			flows = append(flows, o.GetFlow())
+		}
+	}
+	boundary := func(events []*workflows.BoundaryEvent) {
+		for _, be := range events {
+			if be == nil {
+				flows = append(flows, nil)
+				continue
+			}
+			flows = append(flows, be.Flow)
+		}
+	}
+	switch a := act.(type) {
+	case *workflows.CallMicroflowTask:
+		conditions(a.Outcomes)
+		boundary(a.BoundaryEvents)
+	case *workflows.SystemTask:
+		conditions(a.Outcomes)
+	case *workflows.ExclusiveSplitActivity:
+		conditions(a.Outcomes)
+	case *workflows.UserTask:
+		for _, o := range a.Outcomes {
+			if o == nil {
+				flows = append(flows, nil)
+				continue
+			}
+			flows = append(flows, o.Flow)
+		}
+		boundary(a.BoundaryEvents)
+	case *workflows.ParallelSplitActivity:
+		for _, o := range a.Outcomes {
+			if o == nil {
+				flows = append(flows, nil)
+				continue
+			}
+			flows = append(flows, o.Flow)
+		}
+	case *workflows.CallWorkflowActivity:
+		boundary(a.BoundaryEvents)
+	case *workflows.WaitForNotificationActivity:
+		boundary(a.BoundaryEvents)
+	}
+	return flows
+}
diff --git a/mdl/executor/workflow_carry_names_test.go b/mdl/executor/workflow_carry_names_test.go
new file mode 100644
index 0000000000..35edd6d6d5
--- /dev/null
+++ b/mdl/executor/workflow_carry_names_test.go
@@ -0,0 +1,130 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package executor
+
+import (
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/backend/mock"
+	"github.com/mendixlabs/mxcli/model"
+	"github.com/mendixlabs/mxcli/sdk/pages"
+	"github.com/mendixlabs/mxcli/sdk/workflows"
+)
+
+// describe prints no name for a workflow's implicit activities — the main
+// flow's start and end, the end of an event sub-process, an `end workflow` in a
+// branch — so `create or modify` rebuilt them as Start, End, End2, ... Studio
+// Pro names them start1, end1, end2 (ako/TestApp workflow.Workflow1, #743), and
+// every rewrite of its own describe output renamed them. The rewrite carries the
+// stored name of each activity the statement cannot name.
+
+func storedNamedWorkflow(mod *model.Module) *workflows.Workflow {
+	act := func(a workflows.WorkflowActivity) workflows.WorkflowActivity { return a }
+	base := func(name, caption string) workflows.BaseWorkflowActivity {
+		return workflows.BaseWorkflowActivity{Name: name, Caption: caption}
+	}
+	return &workflows.Workflow{
+		BaseElement: model.BaseElement{ID: nextID("wf")},
+		ContainerID: mod.ID,
+		Name:        "Approve",
+		Flow: &workflows.Flow{Activities: []workflows.WorkflowActivity{
+			act(&workflows.StartWorkflowActivity{BaseWorkflowActivity: base("start1", "Start")}),
+			act(&workflows.UserTask{
+				BaseWorkflowActivity: base("userTask1", "Review"),
+				Outcomes: []*workflows.UserTaskOutcome{
+					{Value: "Reject", Flow: &workflows.Flow{Activities: []workflows.WorkflowActivity{
+						act(&workflows.EndWorkflowActivity{BaseWorkflowActivity: base("end3", "End")}),
+					}}},
+					{Value: "Approve", Flow: &workflows.Flow{}},
+				},
+			}),
+			act(&workflows.EndWorkflowActivity{BaseWorkflowActivity: base("end1", "End")}),
+		}},
+		EventSubProcesses: []*workflows.EventSubProcess{{
+			Name: "eventSubProcess1",
+			Flow: &workflows.Flow{Activities: []workflows.WorkflowActivity{
+				act(&workflows.EventSubProcessStartActivity{BaseWorkflowActivity: base("espStart", "Wait"), Interrupting: true}),
+				act(&workflows.EndWorkflowActivity{BaseWorkflowActivity: base("end2", "End")}),
+			}},
+		}},
+	}
+}
+
+const namedWorkflowRewrite = `create or modify workflow MyModule.Approve
+begin
+  user task userTask1 'Review'
+    page MyModule.P
+    outcomes
+      'Reject' { end workflow; }
+      'Approve' { };
+  event subprocess eventSubProcess1 on interrupting notification espStart 'Wait' {
+  };
+end workflow;`
+
+func rewriteStoredWorkflow(t *testing.T, stored *workflows.Workflow, mod *model.Module, script string) *workflows.Workflow {
+	t.Helper()
+	h := mkHierarchy(mod)
+	withContainer(h, stored.ContainerID, mod.ID)
+	var written *workflows.Workflow
+	mb := &mock.MockBackend{
+		IsConnectedFunc:   func() bool { return true },
+		ListModulesFunc:   func() ([]*model.Module, error) { return []*model.Module{mod}, nil },
+		ListWorkflowsFunc: func() ([]*workflows.Workflow, error) { return []*workflows.Workflow{stored}, nil },
+		ListPagesFunc:     func() ([]*pages.Page, error) { return []*pages.Page{mkPage(mod.ID, "P")}, nil },
+		UpdateWorkflowFunc: func(wf *workflows.Workflow) error {
+			written = wf
+			return nil
+		},
+	}
+	ctx, _ := newMockCtx(t, withBackend(mb), withHierarchy(h))
+	prog := parseMDL(t, script)
+	if err := execCreateWorkflow(ctx, prog.Statements[0].(*ast.CreateWorkflowStmt)); err != nil {
+		t.Fatalf("create or modify: %v", err)
+	}
+	if written == nil {
+		t.Fatal("nothing was written")
+	}
+	return written
+}
+
+func TestCreateOrModifyWorkflow_CarriesNamesDescribeCannotPrint(t *testing.T) {
+	mod := mkModule("MyModule")
+	got := rewriteStoredWorkflow(t, storedNamedWorkflow(mod), mod, namedWorkflowRewrite)
+
+	acts := got.Flow.Activities
+	if n := acts[0].GetName(); n != "start1" {
+		t.Errorf("main start = %q, want the stored start1", n)
+	}
+	if n := acts[len(acts)-1].GetName(); n != "end1" {
+		t.Errorf("main end = %q, want the stored end1", n)
+	}
+	task, ok := acts[1].(*workflows.UserTask)
+	if !ok {
+		t.Fatalf("activity 1 is %T, want the user task", acts[1])
+	}
+	if f := task.Outcomes[0].Flow; f == nil || len(f.Activities) != 1 || f.Activities[0].GetName() != "end3" {
+		t.Errorf("the end in outcome 'Reject' was not named end3: %+v", f)
+	}
+	if len(got.EventSubProcesses) != 1 {
+		t.Fatalf("event sub-processes = %d, want 1", len(got.EventSubProcesses))
+	}
+	espActs := got.EventSubProcesses[0].Flow.Activities
+	if n := espActs[len(espActs)-1].GetName(); n != "end2" {
+		t.Errorf("event sub-process end = %q, want the stored end2", n)
+	}
+}
+
+// Control: with nothing stored under those names (a workflow mxcli wrote), the
+// rebuild names the implicit activities as it always did.
+func TestCreateOrModifyWorkflow_ImplicitNamesWithoutStoredNames(t *testing.T) {
+	mod := mkModule("MyModule")
+	stored := storedNamedWorkflow(mod)
+	stored.Flow = nil
+	stored.EventSubProcesses = nil
+	got := rewriteStoredWorkflow(t, stored, mod, namedWorkflowRewrite)
+	acts := got.Flow.Activities
+	if acts[0].GetName() != "Start" || acts[len(acts)-1].GetName() != "End" {
+		t.Errorf("main flow names = %q … %q, want Start … End", acts[0].GetName(), acts[len(acts)-1].GetName())
+	}
+}
diff --git a/modelsdk/codec/encoder.go b/modelsdk/codec/encoder.go
index de03353d8d..1585510f53 100644
--- a/modelsdk/codec/encoder.go
+++ b/modelsdk/codec/encoder.go
@@ -194,7 +194,7 @@ func (e *Encoder) buildDoc(elem element.Element) (bson.D, error) {
 				}
 				sort.Strings(names)
 				for _, name := range names {
-					if !emitted[name] {
+					if !emitted[name] && !e.omits(elem.TypeName(), name) {
 						doc = append(doc, bson.E{Key: name, Value: bson.A{d.MandatoryListMarkers[name]}})
 					}
 				}

From a91eb69cd07026b2da17f1ba387153a28590dce4 Mon Sep 17 00:00:00 2001
From: Ako <andrej@koelewijn.net>
Date: Mon, 28 Sep 2026 08:15:51 +0000
Subject: [PATCH 22/35] fix(odata client): create or modify carries the stored
 document (#743)

UpdateConsumedODataService lays the encoded service over the stored one,
keeping UseQuerySegment, the icon, CustomLocationTemplate, list markers and
the keys Studio Pro stores empty.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../modelsdk/odata_client_carry_test.go       | 167 ++++++++++++++++++
 mdl/backend/modelsdk/odata_write.go           | 137 ++++++++++++++
 2 files changed, 304 insertions(+)
 create mode 100644 mdl/backend/modelsdk/odata_client_carry_test.go

diff --git a/mdl/backend/modelsdk/odata_client_carry_test.go b/mdl/backend/modelsdk/odata_client_carry_test.go
new file mode 100644
index 0000000000..bba6c318a6
--- /dev/null
+++ b/mdl/backend/modelsdk/odata_client_carry_test.go
@@ -0,0 +1,167 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package modelsdkbackend
+
+import (
+	"testing"
+
+	"go.mongodb.org/mongo-driver/v2/bson"
+
+	"github.com/mendixlabs/mxcli/model"
+	"github.com/mendixlabs/mxcli/modelsdk/codec"
+)
+
+// Running `create or modify consumed odata service` over a Studio Pro-authored
+// client (ako/TestApp: Clients.OrderODataClient, Odata.Bug1073, Mendix 11.14.0)
+// rewrote UseQuerySegment true -> false, deleted the Icon, the catalog, proxy and
+// microflow keys Studio Pro stores empty, the HttpConfiguration's
+// CustomLocationTemplate, and re-marked the empty lists (#743). The model holds
+// none of these, so the rewrite carries them from the stored document.
+
+// storedStudioProClient is Clients.OrderODataClient as ako/TestApp stores it,
+// less its $metadata.
+func storedStudioProClient(t *testing.T) []byte {
+	t.Helper()
+	id := func(b byte) bson.Binary {
+		return bson.Binary{Subtype: 0, Data: []byte{b, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15}}
+	}
+	doc := bson.D{
+		{Key: "$ID", Value: id(1)},
+		{Key: "$Type", Value: "Rest$ConsumedODataService"},
+		{Key: "ApplicationId", Value: ""},
+		{Key: "CatalogUrl", Value: ""},
+		{Key: "ConfigurationEntityMicroflow", Value: ""},
+		{Key: "Description", Value: ""},
+		{Key: "Documentation", Value: ""},
+		{Key: "EndpointId", Value: ""},
+		{Key: "EnvironmentType", Value: "Unknown"},
+		{Key: "ErrorHandlingMicroflow", Value: "Clients.HandleError"},
+		{Key: "Excluded", Value: false},
+		{Key: "ExportLevel", Value: "Hidden"},
+		{Key: "HeaderListMicroflow", Value: ""},
+		{Key: "HttpConfiguration", Value: bson.D{
+			{Key: "$ID", Value: id(2)},
+			{Key: "$Type", Value: "Microflows$HttpConfiguration"},
+			{Key: "ClientCertificate", Value: ""},
+			{Key: "CustomLocation", Value: "@Clients.OrderODataClient_Location"},
+			{Key: "CustomLocationTemplate", Value: nil},
+			{Key: "HttpAuthenticationPassword", Value: "'1'"},
+			{Key: "HttpAuthenticationUserName", Value: "'MxAdmin'"},
+			{Key: "HttpHeaderEntries", Value: bson.A{int32(3)}},
+			{Key: "HttpMethod", Value: "Post"},
+			{Key: "OverrideLocation", Value: false},
+			{Key: "UseHttpAuthentication", Value: true},
+		}},
+		{Key: "Icon", Value: bson.Binary{Subtype: 0, Data: []byte{0x89, 'P', 'N', 'G'}}},
+		{Key: "LastUpdated", Value: ""},
+		{Key: "MetadataHash", Value: "713d"},
+		{Key: "MetadataReferences", Value: bson.A{int32(3)}},
+		{Key: "MetadataUrl", Value: "file:///tmp/$metadata.xml"},
+		{Key: "MinimumMxVersion", Value: ""},
+		{Key: "Name", Value: "OrderODataClient"},
+		{Key: "ODataVersion", Value: "OData4"},
+		{Key: "ProxyHost", Value: ""},
+		{Key: "ProxyPassword", Value: ""},
+		{Key: "ProxyPort", Value: ""},
+		{Key: "ProxyType", Value: "DefaultProxy"},
+		{Key: "ProxyUsername", Value: ""},
+		{Key: "RecommendedMxVersion", Value: ""},
+		{Key: "ServiceName", Value: "OrderODataClient"},
+		{Key: "TimeoutExpression", Value: "300"},
+		{Key: "UseQuerySegment", Value: true},
+		{Key: "Validated", Value: false},
+		{Key: "ValidatedEntities", Value: bson.A{int32(1)}},
+		{Key: "Version", Value: ""},
+	}
+	raw, err := bson.Marshal(doc)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return raw
+}
+
+// readStoredClient is the model the reader makes of that document.
+func readStoredClient() *model.ConsumedODataService {
+	return &model.ConsumedODataService{
+		BaseElement:            model.BaseElement{ID: "01000000-0000-0000-0000-000000000000"},
+		Name:                   "OrderODataClient",
+		ServiceName:            "OrderODataClient",
+		ODataVersion:           "OData4",
+		MetadataUrl:            "file:///tmp/$metadata.xml",
+		MetadataHash:           "713d",
+		TimeoutExpression:      "300",
+		ProxyType:              "DefaultProxy",
+		EnvironmentType:        "Unknown",
+		ErrorHandlingMicroflow: "Clients.HandleError",
+		HttpConfiguration: &model.HttpConfiguration{
+			UseAuthentication: true,
+			Username:          "'MxAdmin'",
+			Password:          "'1'",
+			HttpMethod:        "Post",
+			CustomLocation:    "@Clients.OrderODataClient_Location",
+		},
+	}
+}
+
+func rewriteClient(t *testing.T, svc *model.ConsumedODataService) bson.Raw {
+	t.Helper()
+	fresh, err := (&codec.Encoder{}).Encode(consumedODataServiceToGen(svc, "ConfigurationEntityMicroflow", "HeaderListMicroflow"))
+	if err != nil {
+		t.Fatalf("encode: %v", err)
+	}
+	out, err := carryStoredConsumedODataService(storedStudioProClient(t), fresh,
+		consumedODataOptionalKeys("ConfigurationEntityMicroflow", "HeaderListMicroflow"))
+	if err != nil {
+		t.Fatalf("carry: %v", err)
+	}
+	return out
+}
+
+func TestConsumedODataServiceRewrite_CarriesWhatTheModelDoesNotHold(t *testing.T) {
+	got := rewriteClient(t, readStoredClient())
+	stored := bson.Raw(storedStudioProClient(t))
+	for _, path := range [][]string{
+		{"UseQuerySegment"}, {"Icon"}, {"ExportLevel"},
+		{"ApplicationId"}, {"EndpointId"}, {"CatalogUrl"}, {"ConfigurationEntityMicroflow"}, {"HeaderListMicroflow"},
+		{"ProxyHost"}, {"ProxyPort"}, {"ProxyUsername"}, {"ProxyPassword"},
+		{"MetadataReferences"}, {"ValidatedEntities"},
+		{"HttpConfiguration", "CustomLocationTemplate"}, {"HttpConfiguration", "HttpHeaderEntries"},
+	} {
+		want := stored.Lookup(path...)
+		v, err := got.LookupErr(path...)
+		if err != nil {
+			t.Errorf("%v: dropped (stored %v)", path, want)
+			continue
+		}
+		if !v.Equal(want) {
+			t.Errorf("%v = %v, stored %v", path, v, want)
+		}
+	}
+}
+
+// What the model does hold is the statement's: a changed value, a cleared
+// microflow and a declared header are written, not the stored ones.
+func TestConsumedODataServiceRewrite_ModelValuesWin(t *testing.T) {
+	svc := readStoredClient()
+	svc.TimeoutExpression = "60"
+	svc.ErrorHandlingMicroflow = ""
+	svc.HttpConfiguration.HeaderEntries = []*model.HttpHeaderEntry{{Key: "X-Trace", Value: "'1'"}}
+	got := rewriteClient(t, svc)
+
+	if s, _ := got.Lookup("TimeoutExpression").StringValueOK(); s != "60" {
+		t.Errorf("TimeoutExpression = %q, want the declared 60", s)
+	}
+	if s, ok := got.Lookup("ErrorHandlingMicroflow").StringValueOK(); !ok || s != "" {
+		t.Errorf("a cleared ErrorHandlingMicroflow = %v, want \"\"", got.Lookup("ErrorHandlingMicroflow"))
+	}
+	vals, err := got.Lookup("HttpConfiguration", "HttpHeaderEntries").Array().Values()
+	if err != nil || len(vals) != 2 {
+		t.Fatalf("HttpHeaderEntries = %v, want [3, entry]", got.Lookup("HttpConfiguration", "HttpHeaderEntries"))
+	}
+	if m, _ := vals[0].Int32OK(); m != 3 {
+		t.Errorf("header marker = %v, want 3", vals[0])
+	}
+	if k, _ := vals[1].Document().Lookup("Key").StringValueOK(); k != "X-Trace" {
+		t.Errorf("header = %v, want X-Trace", vals[1])
+	}
+}
diff --git a/mdl/backend/modelsdk/odata_write.go b/mdl/backend/modelsdk/odata_write.go
index 3081932ab5..adf0d2a2c2 100644
--- a/mdl/backend/modelsdk/odata_write.go
+++ b/mdl/backend/modelsdk/odata_write.go
@@ -6,6 +6,8 @@ import (
 	"fmt"
 	"strings"
 
+	"go.mongodb.org/mongo-driver/v2/bson"
+
 	"github.com/mendixlabs/mxcli/model"
 	"github.com/mendixlabs/mxcli/modelsdk/codec"
 	"github.com/mendixlabs/mxcli/modelsdk/element"
@@ -79,9 +81,144 @@ func (b *Backend) UpdateConsumedODataService(svc *model.ConsumedODataService) er
 	if err != nil {
 		return fmt.Errorf("UpdateConsumedODataService: encode: %w", err)
 	}
+	stored, err := b.GetRawUnitBytes(svc.ID)
+	if err != nil {
+		return fmt.Errorf("UpdateConsumedODataService: read stored service: %w", err)
+	}
+	if len(stored) > 0 {
+		configKey, headersKey := b.microflowKeys()
+		contents, err = carryStoredConsumedODataService(stored, contents, consumedODataOptionalKeys(configKey, headersKey))
+		if err != nil {
+			return fmt.Errorf("UpdateConsumedODataService: carry stored properties: %w", err)
+		}
+	}
 	return b.writer.UpdateRawUnit(string(svc.ID), contents)
 }
 
+// consumedODataStoredWins are the keys consumedODataServiceToGen writes as fixed
+// placeholders rather than from the model: the stored value is kept. Studio Pro
+// stores UseQuerySegment true on a client it creates (ako/TestApp), and a
+// rewrite reset it to false (#743).
+var consumedODataStoredWins = map[string]bool{
+	"UseQuerySegment":      true,
+	"ExportLevel":          true,
+	"LastUpdated":          true,
+	"MinimumMxVersion":     true,
+	"RecommendedMxVersion": true,
+	"MetadataReferences":   true,
+	"ValidatedEntities":    true,
+}
+
+// consumedODataOptionalKeys are the keys the writer emits only when the model
+// holds a value (addStrIf). Studio Pro stores them as "" when unset, so a key
+// the fresh document omits is written "" when it is stored — which also keeps a
+// value the statement cleared cleared, where carrying the stored one would undo
+// the change.
+func consumedODataOptionalKeys(configKey, headersKey string) map[string]bool {
+	return map[string]bool{
+		configKey: true, headersKey: true, "ErrorHandlingMicroflow": true,
+		"ProxyHost": true, "ProxyPort": true, "ProxyUsername": true, "ProxyPassword": true,
+		"ApplicationId": true, "EndpointId": true, "CatalogUrl": true, "EnvironmentType": true,
+	}
+}
+
+// carryStoredConsumedODataService lays the freshly encoded service over the
+// stored one (ADR-0012: carry or refuse). The model holds only part of what
+// Studio Pro stores on a Rest$ConsumedODataService — the Icon, UseQuerySegment,
+// the empty catalog and proxy keys, the HttpConfiguration's
+// CustomLocationTemplate — and the document is written wholesale, so a key the
+// writer does not produce was deleted by every rewrite (#743).
+//
+// The result is the stored document with each key the fresh one writes set to
+// the fresh value, except:
+//   - consumedODataStoredWins keys keep the stored value;
+//   - an optional key the fresh document omits is written "" when stored;
+//   - the HttpConfiguration part is laid over the stored part the same way;
+//   - a list keeps the stored marker, with the fresh elements.
+//
+// Keys the fresh document adds are appended after the stored ones.
+func carryStoredConsumedODataService(stored, fresh []byte, optional map[string]bool) ([]byte, error) {
+	var s, f bson.D
+	if err := bson.Unmarshal(stored, &s); err != nil {
+		return nil, fmt.Errorf("decode stored: %w", err)
+	}
+	if err := bson.Unmarshal(fresh, &f); err != nil {
+		return nil, fmt.Errorf("decode fresh: %w", err)
+	}
+	out := overlayStoredDoc(s, f, func(key string) bool { return consumedODataStoredWins[key] })
+	for i, e := range out {
+		if optional[e.Key] && !docHasKey(f, e.Key) {
+			if _, isString := e.Value.(string); isString {
+				out[i].Value = ""
+			}
+		}
+		if e.Key == "HttpConfiguration" {
+			sp, sok := docValue(s, e.Key).(bson.D)
+			fp, fok := docValue(f, e.Key).(bson.D)
+			if sok && fok {
+				out[i].Value = overlayStoredDoc(sp, fp, func(string) bool { return false })
+			}
+		}
+	}
+	return bson.Marshal(out)
+}
+
+// overlayStoredDoc returns stored with every key of fresh laid over it, except
+// the keys storedWins keeps. A list takes the fresh elements after the stored
+// marker: the marker is how Studio Pro types the array, and an empty list the
+// writer re-marks is a change nothing asked for.
+func overlayStoredDoc(stored, fresh bson.D, storedWins func(string) bool) bson.D {
+	out := make(bson.D, 0, len(stored)+len(fresh))
+	for _, e := range stored {
+		if storedWins(e.Key) || !docHasKey(fresh, e.Key) {
+			out = append(out, e)
+			continue
+		}
+		out = append(out, bson.E{Key: e.Key, Value: keepListMarker(e.Value, docValue(fresh, e.Key))})
+	}
+	for _, e := range fresh {
+		if !docHasKey(stored, e.Key) {
+			out = append(out, e)
+		}
+	}
+	return out
+}
+
+// keepListMarker returns fresh with the stored list's leading marker when both
+// are lists that start with one; any other value is fresh unchanged.
+func keepListMarker(stored, fresh any) any {
+	sa, ok1 := stored.(bson.A)
+	fa, ok2 := fresh.(bson.A)
+	if !ok1 || !ok2 || len(sa) == 0 || len(fa) == 0 {
+		return fresh
+	}
+	sm, ok1 := sa[0].(int32)
+	_, ok2 = fa[0].(int32)
+	if !ok1 || !ok2 {
+		return fresh
+	}
+	out := append(bson.A{sm}, fa[1:]...)
+	return out
+}
+
+func docHasKey(d bson.D, key string) bool {
+	for _, e := range d {
+		if e.Key == key {
+			return true
+		}
+	}
+	return false
+}
+
+func docValue(d bson.D, key string) any {
+	for _, e := range d {
+		if e.Key == key {
+			return e.Value
+		}
+	}
+	return nil
+}
+
 func (b *Backend) DeleteConsumedODataService(id model.ID) error {
 	if b.writer == nil {
 		return fmt.Errorf("DeleteConsumedODataService: not connected for writing")

From b3b26716400944ff30222f704757a6c4fb252ebd Mon Sep 17 00:00:00 2001
From: Ako <andrej@koelewijn.net>
Date: Mon, 28 Sep 2026 08:15:51 +0000
Subject: [PATCH 23/35] fix(domain model): write every NoGeneralization
 system-attribute flag (#721 B, #743)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 mdl/backend/modelsdk/domainmodel_write.go     | 22 ++++-----
 .../modelsdk/generalization_flags_test.go     | 46 +++++++++++++++++++
 2 files changed, 54 insertions(+), 14 deletions(-)
 create mode 100644 mdl/backend/modelsdk/generalization_flags_test.go

diff --git a/mdl/backend/modelsdk/domainmodel_write.go b/mdl/backend/modelsdk/domainmodel_write.go
index 0fef7bd671..aa380a5646 100644
--- a/mdl/backend/modelsdk/domainmodel_write.go
+++ b/mdl/backend/modelsdk/domainmodel_write.go
@@ -268,20 +268,14 @@ func entityToGen(e *domainmodel.Entity, moduleName string, major int) *genDm.Ent
 	} else {
 		ng := genDm.NewNoGeneralization()
 		ng.SetPersistable(e.Persistable)
-		// Legacy omits the system-attribute flags when false, so only set the
-		// true ones to keep the BSON in parity.
-		if e.HasOwner {
-			ng.SetHasOwner(true)
-		}
-		if e.HasChangedBy {
-			ng.SetHasChangedBy(true)
-		}
-		if e.HasCreatedDate {
-			ng.SetHasCreatedDate(true)
-		}
-		if e.HasChangedDate {
-			ng.SetHasChangedDate(true)
-		}
+		// All four system-attribute flags, false ones included: Studio Pro stores
+		// every one (ako/TestApp 11.14.0, PedApp 11.13.0). Writing only the true
+		// ones, as the legacy serializer did, deleted the false flags on every
+		// rewrite of a Studio Pro domain model (#721 B, #743).
+		ng.SetHasOwner(e.HasOwner)
+		ng.SetHasChangedBy(e.HasChangedBy)
+		ng.SetHasCreatedDate(e.HasCreatedDate)
+		ng.SetHasChangedDate(e.HasChangedDate)
 		out.SetGeneralization(ng)
 	}
 
diff --git a/mdl/backend/modelsdk/generalization_flags_test.go b/mdl/backend/modelsdk/generalization_flags_test.go
new file mode 100644
index 0000000000..872f2e2d69
--- /dev/null
+++ b/mdl/backend/modelsdk/generalization_flags_test.go
@@ -0,0 +1,46 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package modelsdkbackend
+
+import (
+	"testing"
+
+	"go.mongodb.org/mongo-driver/v2/bson"
+
+	"github.com/mendixlabs/mxcli/modelsdk/codec"
+	"github.com/mendixlabs/mxcli/sdk/domainmodel"
+)
+
+// Studio Pro stores all four system-attribute flags of an entity's
+// NoGeneralization, false ones included (ako/TestApp, Mendix 11.14.0:
+// Clients.Orders and Odata.Devices; PedApp, 11.13.0). The writer set only the
+// true ones, so every rewrite of a Studio Pro domain model deleted the false
+// flags (#721 B), and a Studio Pro external entity could not keep its own
+// describe output unchanged (#743).
+func TestEntityToGen_WritesEveryGeneralizationFlag(t *testing.T) {
+	for _, c := range []struct {
+		e    domainmodel.Entity
+		want map[string]bool
+	}{
+		{domainmodel.Entity{Name: "Orders"}, map[string]bool{
+			"HasChangedByAttr": false, "HasChangedDateAttr": false, "HasCreatedDateAttr": false, "HasOwnerAttr": false}},
+		{domainmodel.Entity{Name: "Audited", Persistable: true, HasOwner: true, HasChangedDate: true}, map[string]bool{
+			"HasChangedByAttr": false, "HasChangedDateAttr": true, "HasCreatedDateAttr": false, "HasOwnerAttr": true}},
+	} {
+		raw, err := (&codec.Encoder{}).Encode(entityToGen(&c.e, "M", 11))
+		if err != nil {
+			t.Fatalf("encode: %v", err)
+		}
+		g := bson.Raw(raw).Lookup("MaybeGeneralization").Document()
+		for key, want := range c.want {
+			v, err := g.LookupErr(key)
+			if err != nil {
+				t.Errorf("%s: %s not written (Studio Pro stores it)", c.e.Name, key)
+				continue
+			}
+			if got, _ := v.BooleanOK(); got != want {
+				t.Errorf("%s: %s = %v, want %v", c.e.Name, key, got, want)
+			}
+		}
+	}
+}

From 4505530bfaade944861ef22cbc94d1253262d64d Mon Sep 17 00:00:00 2001
From: Ako <andrej@koelewijn.net>
Date: Mon, 28 Sep 2026 08:15:51 +0000
Subject: [PATCH 24/35] fix(external entity): refuse a declared type the
 service does not publish under mdl 1 (#764)

Under mdl 0 it still writes and warns MDL-V1-REMOTETYPE.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 mdl/executor/cmd_odata.go                     |   3 +
 mdl/executor/external_entity_remote_type.go   |  89 ++++++++++++++
 .../external_entity_remote_type_test.go       | 109 ++++++++++++++++++
 3 files changed, 201 insertions(+)
 create mode 100644 mdl/executor/external_entity_remote_type.go
 create mode 100644 mdl/executor/external_entity_remote_type_test.go

diff --git a/mdl/executor/cmd_odata.go b/mdl/executor/cmd_odata.go
index 2130d4c290..eabf9dccb8 100644
--- a/mdl/executor/cmd_odata.go
+++ b/mdl/executor/cmd_odata.go
@@ -926,6 +926,9 @@ func execCreateExternalEntity(ctx *ExecContext, s *ast.CreateExternalEntityStmt)
 					}
 				}
 			}
+			if err := checkRemoteTypes(ctx, s.Name.String(), existingEntity, attrs); err != nil {
+				return err
+			}
 			carryStoredAttributeState(existingEntity, attrs)
 			existingEntity.Attributes = attrs
 		}
diff --git a/mdl/executor/external_entity_remote_type.go b/mdl/executor/external_entity_remote_type.go
new file mode 100644
index 0000000000..23b779492d
--- /dev/null
+++ b/mdl/executor/external_entity_remote_type.go
@@ -0,0 +1,89 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package executor
+
+import (
+	"fmt"
+	"strings"
+
+	mdlerrors "github.com/mendixlabs/mxcli/mdl/errors"
+	"github.com/mendixlabs/mxcli/mdl/langver"
+	"github.com/mendixlabs/mxcli/mdl/types"
+	"github.com/mendixlabs/mxcli/sdk/domainmodel"
+)
+
+// remoteTypeChangeRefused is the language change for ako/mxcli#764: a mapped
+// attribute of an external entity declared with a type the service does not
+// publish. The type is the service contract's — Studio Pro offers no way to
+// change it, and mx check reports CE6616 against the service's $metadata, not
+// against the stored RemoteType — so deriving a RemoteType from the declared
+// type would only move the mismatch. Under mdl 1 the statement is refused.
+var remoteTypeChangeRefused = langver.Change{
+	Code:  "MDL-V1-REMOTETYPE",
+	Since: langver.V1,
+	Old: "`create or modify external entity` writes a mapped attribute with the declared type and keeps the " +
+		"service's RemoteType, which mx check reports as CE6616",
+	New: "a refusal that names the attribute and the type the service publishes, with nothing written",
+}
+
+// remoteTypeMismatches lists, for each declared attribute that maps a stored
+// OData property, a declared type the property's Edm type does not map to. A
+// RemoteType outside the Edm primitives (an enumeration type, say) is not
+// judged: its mapping is not the Edm table's.
+func remoteTypeMismatches(stored *domainmodel.Entity, declared []*domainmodel.Attribute) []string {
+	byName := make(map[string]*domainmodel.Attribute, len(stored.Attributes))
+	for _, a := range stored.Attributes {
+		if a != nil {
+			byName[a.Name] = a
+		}
+	}
+	var out []string
+	for _, a := range declared {
+		if a == nil || a.Type == nil {
+			continue
+		}
+		old, ok := byName[a.Name]
+		if !ok || old.RemoteName == "" || !knownEdmPrimitive(old.RemoteType) {
+			continue
+		}
+		want := edmToDomainModelAttrType(&types.EdmProperty{Type: old.RemoteType}, false).GetTypeName()
+		if got := a.Type.GetTypeName(); got != want {
+			out = append(out, fmt.Sprintf("%s is declared %s, but the service publishes it as %s, which maps to %s",
+				a.Name, got, old.RemoteType, want))
+		}
+	}
+	return out
+}
+
+// knownEdmPrimitive reports whether t is an Edm type edmToDomainModelAttrType
+// maps explicitly, rather than through its String fallback.
+func knownEdmPrimitive(t string) bool {
+	switch t {
+	case "Edm.String", "Edm.Int32", "Edm.Int16", "Edm.Byte", "Edm.SByte", "Edm.Int64",
+		"Edm.Decimal", "Edm.Double", "Edm.Single", "Edm.Boolean",
+		"Edm.DateTime", "Edm.DateTimeOffset", "Edm.Date", "Edm.Guid", "Edm.Binary":
+		return true
+	}
+	return false
+}
+
+// checkRemoteTypes refuses (mdl 1) or warns about (mdl 0) the declared
+// attributes whose type the service does not publish.
+func checkRemoteTypes(ctx *ExecContext, qualifiedName string, stored *domainmodel.Entity, declared []*domainmodel.Attribute) error {
+	mism := remoteTypeMismatches(stored, declared)
+	if len(mism) == 0 {
+		return nil
+	}
+	if remoteTypeChangeRefused.Applies(ctx.LanguageVersion) {
+		return mdlerrors.NewValidation(fmt.Sprintf(
+			"create or modify external entity %s: an external entity's attribute types come from the OData service, "+
+				"and this statement declares others:\n  - %s\n"+
+				"Nothing was written: mx check would report CE6616 for each. Declare the type the service publishes, "+
+				"or leave the attribute out to remove it.",
+			qualifiedName, strings.Join(mism, "\n  - ")))
+	}
+	fmt.Fprintf(ctx.progress(), "Warning [%s]: external entity %s: %s. %s\n",
+		remoteTypeChangeRefused.Code, qualifiedName, strings.Join(mism, "; "),
+		remoteTypeChangeRefused.Warning(ctx.LanguageVersion))
+	return nil
+}
diff --git a/mdl/executor/external_entity_remote_type_test.go b/mdl/executor/external_entity_remote_type_test.go
new file mode 100644
index 0000000000..e6c945d67c
--- /dev/null
+++ b/mdl/executor/external_entity_remote_type_test.go
@@ -0,0 +1,109 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package executor
+
+import (
+	"bytes"
+	"strings"
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/backend/mock"
+	"github.com/mendixlabs/mxcli/mdl/langver"
+	"github.com/mendixlabs/mxcli/model"
+	"github.com/mendixlabs/mxcli/sdk/domainmodel"
+)
+
+// `create or modify external entity` carried an attribute's stored RemoteType by
+// name even when the statement declared another type: `OrderId: String(20)` kept
+// Edm.Int64, and mx check then reported CE6616 "Attribute 'OrderId' is of type
+// 'String' which is not the same as property type in the OData service which is
+// 'Edm.Int64'" (measured on ako/TestApp, 11.14.0; ako/mxcli#764). The type of a
+// mapped attribute is the service contract's, not the script's, so deriving a
+// RemoteType from the declared type would only move the mismatch. Under mdl 1 the
+// statement is refused, with nothing written; under mdl 0 it keeps writing, as
+// it did, and warns MDL-V1-REMOTETYPE (ADR-0011: a new refusal applies only
+// under the header that opts into it).
+
+func remoteTypeCtx(t *testing.T, v langver.Version) (*ExecContext, *bytes.Buffer, **domainmodel.Entity) {
+	t.Helper()
+	mod := mkModule("Clients")
+	h := mkHierarchy(mod)
+	svc := &model.ConsumedODataService{BaseElement: model.BaseElement{ID: nextID("cos")}, ContainerID: mod.ID, Name: "OrderODataClient"}
+	withContainer(h, svc.ContainerID, mod.ID)
+	existing := &domainmodel.Entity{
+		BaseElement:       model.BaseElement{ID: nextID("ent")},
+		Name:              "Orders",
+		Source:            "Rest$ODataRemoteEntitySource",
+		RemoteServiceName: "Clients.OrderODataClient",
+		RemoteEntitySet:   "Orders",
+		Attributes: []*domainmodel.Attribute{{
+			BaseElement: model.BaseElement{ID: "stored-attr-id"},
+			Name:        "OrderId",
+			Type:        &domainmodel.LongAttributeType{},
+			RemoteName:  "OrderId", RemoteType: "Edm.Int64", Filterable: true,
+		}},
+	}
+	dm := &domainmodel.DomainModel{BaseElement: model.BaseElement{ID: nextID("dm")}, ContainerID: mod.ID, Entities: []*domainmodel.Entity{existing}}
+	var updated *domainmodel.Entity
+	mb := &mock.MockBackend{
+		IsConnectedFunc:               func() bool { return true },
+		ListModulesFunc:               func() ([]*model.Module, error) { return []*model.Module{mod}, nil },
+		GetDomainModelFunc:            func(model.ID) (*domainmodel.DomainModel, error) { return dm, nil },
+		ListConsumedODataServicesFunc: func() ([]*model.ConsumedODataService, error) { return []*model.ConsumedODataService{svc}, nil },
+		UpdateEntityFunc:              func(_ model.ID, e *domainmodel.Entity) error { updated = e; return nil },
+	}
+	ctx, buf := newMockCtx(t, withBackend(mb), withHierarchy(h))
+	ctx.LanguageVersion = v
+	return ctx, buf, &updated
+}
+
+func orderIDStmt(kind ast.DataTypeKind, length int) *ast.CreateExternalEntityStmt {
+	return &ast.CreateExternalEntityStmt{
+		Name:           ast.QualifiedName{Module: "Clients", Name: "Orders"},
+		ServiceRef:     ast.QualifiedName{Module: "Clients", Name: "OrderODataClient"},
+		Attributes:     []ast.Attribute{{Name: "OrderId", Type: ast.DataType{Kind: kind, Length: length}}},
+		CreateOrModify: true,
+	}
+}
+
+func TestCreateOrModifyExternalEntity_RemoteTypeMismatchRefusedUnderMdl1(t *testing.T) {
+	ctx, _, updated := remoteTypeCtx(t, langver.V1)
+	err := execCreateExternalEntity(ctx, orderIDStmt(ast.TypeString, 20))
+	if err == nil {
+		t.Fatal("a declared type the service does not publish was written under mdl 1")
+	}
+	for _, want := range []string{"OrderId", "Edm.Int64", "Long"} {
+		if !strings.Contains(err.Error(), want) {
+			t.Errorf("the refusal does not name %q: %v", want, err)
+		}
+	}
+	if *updated != nil {
+		t.Error("the refused statement wrote the entity")
+	}
+}
+
+func TestCreateOrModifyExternalEntity_RemoteTypeMismatchWarnsUnderMdl0(t *testing.T) {
+	ctx, buf, updated := remoteTypeCtx(t, langver.V0)
+	assertNoError(t, execCreateExternalEntity(ctx, orderIDStmt(ast.TypeString, 20)))
+	if *updated == nil {
+		t.Fatal("mdl 0 no longer writes the statement")
+	}
+	if !strings.Contains(buf.String(), "MDL-V1-REMOTETYPE") {
+		t.Errorf("no MDL-V1-REMOTETYPE warning under mdl 0:\n%s", buf.String())
+	}
+}
+
+// Control: the type the service publishes is carried without a word.
+func TestCreateOrModifyExternalEntity_MatchingTypeCarriesRemoteType(t *testing.T) {
+	for _, v := range []langver.Version{langver.V0, langver.V1} {
+		ctx, buf, updated := remoteTypeCtx(t, v)
+		assertNoError(t, execCreateExternalEntity(ctx, orderIDStmt(ast.TypeLong, 0)))
+		if *updated == nil || (*updated).Attributes[0].RemoteType != "Edm.Int64" {
+			t.Errorf("%s: RemoteType not carried: %+v", v, *updated)
+		}
+		if strings.Contains(buf.String(), "MDL-V1-REMOTETYPE") {
+			t.Errorf("%s: warned on a matching type:\n%s", v, buf.String())
+		}
+	}
+}

From 7e5c5ea679d53b76dbbf3ad13b28a3abd5d8a066 Mon Sep 17 00:00:00 2001
From: Ako <andrej@koelewijn.net>
Date: Mon, 28 Sep 2026 08:17:07 +0000
Subject: [PATCH 25/35] describe workflow, consumed odata service and external
 entity as create or modify (#743)

Their rewrites now keep TestApp's documents unchanged, so describe emits
create or modify and a plain create of an existing workflow or client
recommends it again. Strikes the #743 entries and the 27 entries the
generalization flags fixed from the TestApp allowlist.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../fix-issue/findings/mdl-backend.jsonl      |  3 ++
 .../fix-issue/findings/mdl-executor.jsonl     |  2 +
 .../skills/mendix/odata-data-sharing/SKILL.md |  9 ++++
 .../skills/mendix/write-workflows/SKILL.md    |  6 ++-
 mdl/executor/cmd_odata.go                     | 25 ++++-----
 mdl/executor/cmd_odata_mock_test.go           |  4 +-
 mdl/executor/cmd_workflows.go                 | 10 ++--
 mdl/executor/cmd_workflows_mock_test.go       |  4 +-
 mdl/executor/refusal_advice_743_test.go       | 29 ++++++-----
 mdl/roundtrip/allowlist_test.go               | 16 +++---
 mdl/roundtrip/testapp_allowlist_test.go       | 52 +++----------------
 .../testapp_create_or_modify_test.go          | 19 ++++---
 12 files changed, 81 insertions(+), 98 deletions(-)

diff --git a/.claude/skills/fix-issue/findings/mdl-backend.jsonl b/.claude/skills/fix-issue/findings/mdl-backend.jsonl
index 05b065e863..0fbc50353e 100644
--- a/.claude/skills/fix-issue/findings/mdl-backend.jsonl
+++ b/.claude/skills/fix-issue/findings/mdl-backend.jsonl
@@ -138,3 +138,6 @@
 {"area": "mdl/backend", "date": "2026-09-26", "symptom": "describe → exec of a nanoflow detaches every annotation from its activity (AnnotationFlows 3 → 0, so the next describe prints the notes as free-floating) and deletes ExportLevel, UseListParameterByReference and ReturnVariableName; MarkAsUsed is cleared. Rules drop their annotation flows too", "cause": "nanoflowToGen and ruleToGen never wrote ObjectCollection.AnnotationFlows (microflowToGen did), and nanoflowToGen never set the three header keys; nanoflowFromGen did not read ReturnVariableName or MarkAsUsed and the builder hardcoded MarkAsUsed false", "file": "mdl/backend/modelsdk/nanoflow_write.go, rule_write.go, microflow.go; mdl/executor/cmd_microflows_build.go", "insight": "Three flow flavours share the object/flow converters but each has its own top-level writer, and each dropped a different subset — grep every *ToGen for the same list loop, not just the reported one. For keys with no MDL spelling and unknown version floors (Nanoflow.ExportLevel, UseListParameterByReference), carry ONLY the keys the stored unit has: nothing was ever written on create, Studio Pro fills an absent key, and an undeclared one makes the unit unopenable", "refs": ["ako/mxcli#705"]}
 {"area": "mdl/backend", "date": "2026-09-27", "symptom": "Running unchanged `describe user role` output (create or modify user role) rewrites Security$ProjectSecurity: /UserRoles[0] marker 2 -> 3; same for DemoUsers on a demo-user rewrite", "cause": "The encoder's default PartList marker is 3; Studio Pro writes 2 for ProjectSecurity.UserRoles and .DemoUsers (PedApp, TestApp, expr-checker agree). An untouched list passes through raw, so it only shows once an element in it is rewritten", "file": "mdl/backend/modelsdk/security_write.go", "insight": "A marker bug hides until the first rewrite of an element in that list; census the stored marker per (owner $Type, key) across Studio Pro fixtures and register it with RegisterPropertyListMarker", "refs": ["ako/mxcli#731"]}
 {"area": "mdl/backend", "date": "2026-09-27", "symptom": "Any write of a domain model (even rewriting a sibling entity) drops LocalizeDate from every DateTime attribute in the unit; external entity rewrites also rewrite Source/Key/Parts marker 2 -> 3", "cause": "attributeTypeToGen emitted DateTimeAttributeType without LocalizeDate and attributeTypeFromGen never read it; Rest$ODataKeyPart had no registered list marker so the encoder default 3 applied", "file": "mdl/backend/modelsdk/domainmodel.go, domainmodel_write.go", "insight": "A whole-unit rewrite re-serializes every sibling from the struct, so a property the struct cannot hold is lost on EVERY entity of the module, not just the edited one. Absent LocalizeDate means Mendix's default true (mxcli wrote it absent for years), so the reader must map absent to true or the fix would unlocalize every mxcli-authored DateTime. Only a Studio Pro fixture with DateTime attributes (TestApp) shows it", "refs": ["ako/mxcli#743"]}
+{"area": "mdl/backend", "date": "2026-09-28", "symptom": "create or modify consumed odata service over a Studio Pro client: UseQuerySegment true -> false, Icon, CustomLocationTemplate and the empty ApplicationId/EndpointId/CatalogUrl/proxy/microflow keys deleted, MetadataReferences [3] -> [0], ValidatedEntities [1] -> [0]", "cause": "consumedODataServiceToGen writes the document wholesale from a model that holds none of these; placeholders (UseQuerySegment false, ExportLevel Hidden) and addStrIf-omitted empties replaced what Studio Pro stored", "file": "mdl/backend/modelsdk/odata_write.go (carryStoredConsumedODataService)", "fix": "UpdateConsumedODataService lays the fresh document over the stored one: placeholder keys keep the stored value, an omitted optional key is written \"\" when stored (so a cleared value stays cleared), lists keep the stored marker", "insight": "When the model is a strict subset of the stored document, overlay onto the stored bytes rather than growing the model field by field; but an optional key the writer omits must become \"\" rather than be carried, or clearing it through alter silently stops working", "refs": ["ako/mxcli#743"], "test": "TestConsumedODataServiceRewrite_CarriesWhatTheModelDoesNotHold"}
+{"area": "mdl/backend", "date": "2026-09-28", "symptom": "Rewriting a Studio Pro workflow drops the empty Flow and the PersistentId of every outcome that leads nowhere, writes RelativeMiddlePoint/Size \"\" where Studio Pro stores \"0;0\", and deletes an empty EventSubProcesses [2]", "cause": "The writer added an outcome's Flow only when non-nil (Workflows$Outcome.flow is Required), gave condition outcomes no PersistentId, and omitted an empty EventSubProcesses list because the property is version-floored (11.8)", "file": "mdl/backend/modelsdk/workflow_write.go (encodeWorkflow, outcomeFlowToGen)", "fix": "Always write an outcome Flow; PersistentId on every outcome; \"0;0\" layout; empty EventSubProcesses via MandatoryListMarkers, suppressed through Encoder.OmitKeys below 11.8 only when the workflow has none (MandatoryListMarkers now honours OmitKeys)", "insight": "Encoder.OmitKeys suppresses a key whatever it holds, so version-floor only the empty default: suppressing the key outright would drop declared sub-processes on a project whose version could not be read", "refs": ["ako/mxcli#743"], "test": "TestWorkflowToGen_EveryOutcomeStoresAFlow"}
+{"area": "mdl/backend", "date": "2026-09-28", "symptom": "Every domain-model rewrite deletes MaybeGeneralization HasOwnerAttr/HasChangedByAttr/HasCreatedDateAttr/HasChangedDateAttr = false on Studio Pro entities (#721 B)", "cause": "entityToGen set only the true flags, for parity with the legacy serializer", "file": "mdl/backend/modelsdk/domainmodel_write.go", "fix": "Write all four flags", "insight": "Legacy-writer parity is not Studio Pro parity; the flags were the last getput loss of a Studio Pro external entity, which is why it surfaced in #743", "refs": ["ako/mxcli#721", "ako/mxcli#743"], "test": "TestEntityToGen_WritesEveryGeneralizationFlag"}
diff --git a/.claude/skills/fix-issue/findings/mdl-executor.jsonl b/.claude/skills/fix-issue/findings/mdl-executor.jsonl
index d05e03d1d6..d26296cf3e 100644
--- a/.claude/skills/fix-issue/findings/mdl-executor.jsonl
+++ b/.claude/skills/fix-issue/findings/mdl-executor.jsonl
@@ -736,3 +736,5 @@
 {"area": "mdl/executor", "date": "2026-09-27", "symptom": "Running an external entity's describe output (create or modify external entity, either form) turns each attribute's Rest$ODataMappedValue into a DomainModels$StoredValue (RemoteName/RemoteType/Filterable... gone), re-mints attribute $IDs on the `from odata client` form, and rewrites String(36) as unlimited", "cause": "Both rewrite paths rebuilt attributes from the AST, which has no spelling for the OData mapping; the `from odata client` path minted fresh IDs; describe external entity printed GetTypeName() (`String`) instead of formatAttributeType", "file": "mdl/executor/cmd_entities.go (carryStoredAttributeState), cmd_odata.go", "insight": "Carry per attribute by name what the statement cannot spell, in the shared merge, and enumerate every path that rebuilds attributes: there were two statements for one document kind", "refs": ["ako/mxcli#743"]}
 {"area": "mdl/executor", "date": "2026-09-27", "symptom": "create or modify odata service over a Studio Pro service: EntitySet PageSize 10000 -> 0, entity sets reordered, member CanBeEmpty recomputed, ExportLevel deleted, AuthenticationTypes marker 1 -> 3", "cause": "The modify path rebuilt entity types/sets from the publish block (no spelling for PageSize without paging, set order, CanBeEmpty); the model had no ExportLevel; the writer used a marker-3 list copied from the legacy writer, not Studio Pro", "file": "mdl/executor/cmd_odata.go (carryPublishedEntityState), mdl/backend/modelsdk/odata_write.go", "insight": "Parity with the legacy writer is not evidence of what Studio Pro writes; measure markers on a Studio Pro fixture. A probe that runs describe output with the verb rewritten to create or modify (mdl/roundtrip TestTestAppCreateOrModifyProbe) shows what a verb switch would lose before switching it", "refs": ["ako/mxcli#743"]}
 {"area": "mdl/executor", "date": "2026-09-27", "symptom": "describe microflow printed `validation feedback $O/A message '{1} \u2026';` with no template arguments; describe -> exec stored the feedback with none", "cause": "formatAction's ValidationFeedbackAction case never read TemplateParameters, although the reader (textTemplateFromGen) and the writer both carried them", "file": "mdl/executor/cmd_microflows_format_action.go (templateArgsClause)", "insight": "A text template has two halves, the text and its parameters; check every describe case that prints one prints both. Found while switching the template form to `with ({1} = \u2026)` (ako/mxcli#751)."}
+{"area": "mdl/executor", "date": "2026-09-28", "symptom": "create or modify workflow of its own describe output renames Studio Pro's implicit activities: start1 -> Start, end1 -> End, an event sub-process end2 -> End2", "cause": "describe prints no name for the implicit start/end, branch ends, jumps or end-of-path markers, and the rebuild names them from captions", "file": "mdl/executor/workflow_carry_names.go", "fix": "Pair declared and stored flows structurally (named activities by name, unnamed ones by type ordinal, nested flows by position, event sub-processes by name) and carry the stored names before deduplication", "insight": "Carry before the CE0495 deduplication, not after, so the carried names take part in it; pair nested flows with nil slots kept, because the rebuild leaves an empty outcome's flow nil where the stored one is an empty Flow", "refs": ["ako/mxcli#743"], "test": "TestCreateOrModifyWorkflow_CarriesNamesDescribeCannotPrint"}
+{"area": "mdl/executor", "date": "2026-09-28", "symptom": "create or modify external entity declaring OrderId: String(20) on an Edm.Int64 property keeps RemoteType Edm.Int64; mx check CE6616", "cause": "carryStoredAttributeState carries RemoteType by name regardless of the declared type", "file": "mdl/executor/external_entity_remote_type.go", "fix": "Refuse under mdl 1 (MDL-V1-REMOTETYPE), warn under mdl 0", "insight": "CE6616 compares against the service's $metadata, not the stored RemoteType, so deriving RemoteType from the declared type would not fix it; measured with mx check on a TestApp copy", "refs": ["ako/mxcli#764"], "test": "TestCreateOrModifyExternalEntity_RemoteTypeMismatchRefusedUnderMdl1"}
diff --git a/.claude/skills/mendix/odata-data-sharing/SKILL.md b/.claude/skills/mendix/odata-data-sharing/SKILL.md
index b38a891e72..b6184523f4 100644
--- a/.claude/skills/mendix/odata-data-sharing/SKILL.md
+++ b/.claude/skills/mendix/odata-data-sharing/SKILL.md
@@ -84,6 +84,15 @@ refresh — that invalidates the client ID the existing external entities point
 Note that `ALTER CONSUMED ODATA SERVICE SET MetadataUrl = …` does *not* re-fetch. Use
 `CREATE OR MODIFY` when the contract is what changed.
 
+`describe` prints a client and an external entity as `create or modify …`, and
+re-running that output changes nothing: the rewrite keeps what it cannot print
+(the client's icon, UseQuerySegment, the catalog and proxy settings; each
+attribute's OData mapping). An external entity's attribute **types** are the
+service's, not the script's: declaring another (`OrderId: String(20)` for an
+`Edm.Int64` property) is CE6616 in mx check. Under `mdl 1` that statement is
+refused with nothing written; without the header it still writes, with warning
+`MDL-V1-REMOTETYPE`.
+
 **Use Cases for Local Metadata:**
 - **Offline development** — no network access required
 - **Testing and CI/CD** — reproducible builds with metadata snapshots
diff --git a/.claude/skills/mendix/write-workflows/SKILL.md b/.claude/skills/mendix/write-workflows/SKILL.md
index bce603c6df..4b6885a690 100644
--- a/.claude/skills/mendix/write-workflows/SKILL.md
+++ b/.claude/skills/mendix/write-workflows/SKILL.md
@@ -289,7 +289,11 @@ tasks, decisions, splits, jump-to targets, wait activities and boundary events
 all come back as statements (not comments). You can learn the exact syntax by
 describing a Studio-Pro-authored workflow, and `describe → drop → exec`
 reproduces a workflow that builds. (The implicit start/end activities are
-omitted, as they are re-synthesised on create.)
+omitted, as they are re-synthesised on create.) `describe` prints
+`create or modify workflow`, and re-running it on the workflow it came from
+changes nothing: the rewrite keeps the stored names of the activities MDL cannot
+name (Studio Pro's `start1`, `end1`, …), the empty flow of an outcome that leads
+nowhere, and the empty event sub-process list.
 
 That is for learning the syntax and for workflows your scripts own. **To change an
 existing Studio Pro workflow, use `alter workflow`**, never drop → exec: that
diff --git a/mdl/executor/cmd_odata.go b/mdl/executor/cmd_odata.go
index eabf9dccb8..3838c89e08 100644
--- a/mdl/executor/cmd_odata.go
+++ b/mdl/executor/cmd_odata.go
@@ -134,12 +134,10 @@ func outputConsumedODataServiceMDL(ctx *ExecContext, svc *model.ConsumedODataSer
 		outputJavadoc(ctx.Output, svc.Description)
 	}
 
-	// describe keeps a plain `create` here, not `create or modify` (ADR-0012: carry or refuse,
-	// never silently drop). A `create or modify` rewrite of this type does not yet carry what
-	// describe cannot print, so re-running this output on an existing document would silently
-	// lose Studio Pro-authored content; a plain `create` refuses instead. Switch the verb only
-	// once the rewrite's carry is proven by the round-trip harness (see #743).
-	fmt.Fprintf(ctx.Output, "create consumed odata service %s.%s (\n", moduleName, svc.Name)
+	// `create or modify`: the rewrite carries what describe cannot print (the icon,
+	// UseQuerySegment, the catalog and proxy keys, see carryStoredConsumedODataService),
+	// proven on ako/TestApp's clients by the round-trip harness (#743).
+	fmt.Fprintf(ctx.Output, "create or modify consumed odata service %s.%s (\n", moduleName, svc.Name)
 
 	var props []string
 	if folderPath != "" {
@@ -775,8 +773,9 @@ func outputExternalEntityMDL(ctx *ExecContext, entity *domainmodel.Entity, modul
 		outputJavadoc(ctx.Output, entity.Documentation)
 	}
 
-	// Plain `create` on purpose; see describeODataClient.
-	fmt.Fprintf(ctx.Output, "create external entity %s.%s\n", moduleName, entity.Name)
+	// `create or modify`: the rewrite keeps each stored attribute's identity and
+	// OData mapping by name (#743), proven on ako/TestApp by the round-trip harness.
+	fmt.Fprintf(ctx.Output, "create or modify external entity %s.%s\n", moduleName, entity.Name)
 	fmt.Fprintf(ctx.Output, "from consumed odata service %s\n", entity.RemoteServiceName)
 	fmt.Fprintln(ctx.Output, "(")
 
@@ -1135,13 +1134,11 @@ func createODataClient(ctx *ExecContext, stmt *ast.CreateODataClientStmt) error
 					}
 					return nil
 				}
-				// Not "use create or modify": that rewrite does not yet carry what
-				// describe cannot print and would lose Studio Pro-authored
-				// settings (#743).
+				// The rewrite carries what describe cannot print (#743), so it is
+				// the advice again, as for every other document type.
 				return mdlerrors.NewAlreadyExistsMsg("OData client", modName+"."+svc.Name, fmt.Sprintf(
-					"OData client already exists: %s.%s — use 'alter consumed odata service %s.%s set ...' to change it; "+
-						"'create or modify consumed odata service' rewrites the whole client and does not yet keep everything Studio Pro stores "+
-						"(UseQuerySegment, catalog, proxy and microflow settings, icon)", modName, svc.Name, modName, svc.Name))
+					"OData client already exists: %s.%s (use create or modify to update it, or "+
+						"'alter consumed odata service %s.%s set ...' to change one property)", modName, svc.Name, modName, svc.Name))
 			}
 		}
 	}
diff --git a/mdl/executor/cmd_odata_mock_test.go b/mdl/executor/cmd_odata_mock_test.go
index 18b331dacd..a8e2647fba 100644
--- a/mdl/executor/cmd_odata_mock_test.go
+++ b/mdl/executor/cmd_odata_mock_test.go
@@ -95,8 +95,8 @@ func TestDescribeODataClient_Mock(t *testing.T) {
 	assertNoError(t, describeODataClient(ctx, ast.QualifiedName{Module: "MyModule", Name: "PetStoreClient"}))
 
 	out := buf.String()
-	assertContainsStr(t, out, "create consumed odata service")
-	assertNotContainsStr(t, out, "create or modify odata client") // safe refusal until its carry is proven (ADR-0012)
+	// The rewrite carries what describe cannot print, proven on ako/TestApp (#743).
+	assertContainsStr(t, out, "create or modify consumed odata service MyModule.PetStoreClient")
 	assertContainsStr(t, out, "MyModule.PetStoreClient")
 	assertContainsStr(t, out, "https://example.com/$metadata")
 	assertContainsStr(t, out, "2.0")
diff --git a/mdl/executor/cmd_workflows.go b/mdl/executor/cmd_workflows.go
index 241ea23493..b265f32827 100644
--- a/mdl/executor/cmd_workflows.go
+++ b/mdl/executor/cmd_workflows.go
@@ -186,12 +186,10 @@ func describeWorkflowToString(ctx *ExecContext, name ast.QualifiedName) (string,
 	}
 	lines = append(lines, "")
 
-	// describe keeps a plain `create` here, not `create or modify` (ADR-0012: carry or refuse,
-	// never silently drop). A `create or modify` rewrite of this type does not yet carry what
-	// describe cannot print, so re-running this output on an existing document would silently
-	// lose Studio Pro-authored content; a plain `create` refuses instead. Switch the verb only
-	// once the rewrite's carry is proven by the round-trip harness (see #743).
-	lines = append(lines, fmt.Sprintf("create workflow %s", qualifiedName))
+	// `create or modify`: the rewrite carries what describe cannot print (the names
+	// of the implicit activities, empty outcome flows, event sub-processes), proven
+	// on ako/TestApp's workflows by the round-trip harness (#743).
+	lines = append(lines, fmt.Sprintf("create or modify workflow %s", qualifiedName))
 	if clause := describeFolderClause(ctx, targetWf.ContainerID); clause != "" {
 		lines = append(lines, "  "+strings.TrimSpace(clause))
 	}
diff --git a/mdl/executor/cmd_workflows_mock_test.go b/mdl/executor/cmd_workflows_mock_test.go
index 5b5e6ae3cd..6b1689ef52 100644
--- a/mdl/executor/cmd_workflows_mock_test.go
+++ b/mdl/executor/cmd_workflows_mock_test.go
@@ -49,8 +49,8 @@ func TestDescribeWorkflow_Mock(t *testing.T) {
 
 	out := buf.String()
 	assertTerminated(t, out) // #744
-	assertContainsStr(t, out, "create workflow")
-	assertNotContainsStr(t, out, "create or modify workflow") // safe refusal until its carry is proven (ADR-0012)
+	// The rewrite carries what describe cannot print, proven on ako/TestApp (#743).
+	assertContainsStr(t, out, "create or modify workflow")
 	assertContainsStr(t, out, "Sales.ApproveOrder")
 
 	// Roundtrip: DESCRIBE output must be parseable as valid MDL (issue #478)
diff --git a/mdl/executor/refusal_advice_743_test.go b/mdl/executor/refusal_advice_743_test.go
index 5474a046cf..c2225ebf7f 100644
--- a/mdl/executor/refusal_advice_743_test.go
+++ b/mdl/executor/refusal_advice_743_test.go
@@ -12,14 +12,15 @@ import (
 	"github.com/mendixlabs/mxcli/sdk/workflows"
 )
 
-// A plain `create` of an existing workflow or OData client is refused, and the
-// refusal used to say "use create or modify". For these two types that is the
-// rewrite that loses Studio Pro-authored content (#743: event sub-processes and
-// outcome flows of a workflow; UseQuerySegment, the catalog, proxy and microflow
-// settings and the icon of an OData client). Until the carry lands the advice
-// points to `alter` and says why.
+// A plain `create` of an existing workflow or OData client is refused. While
+// `create or modify` lost Studio Pro-authored content for these two types (#743:
+// event sub-processes, outcome flows and activity names of a workflow;
+// UseQuerySegment, the catalog, proxy and microflow settings and the icon of an
+// OData client) the refusal pointed to `alter` instead. The rewrite now carries
+// them, so the refusal recommends it, as for every other type, and still names
+// `alter` for a one-part change.
 
-func assertSafeAdvice(t *testing.T, err error, alter string) {
+func assertCreateOrModifyAdvice(t *testing.T, err error, alter string) {
 	t.Helper()
 	if err == nil {
 		t.Fatal("a plain create of an existing document was not refused")
@@ -28,15 +29,15 @@ func assertSafeAdvice(t *testing.T, err error, alter string) {
 	if !strings.Contains(msg, "already exists") {
 		t.Fatalf("unexpected error: %v", err)
 	}
+	if !strings.Contains(msg, "use create or modify to update") {
+		t.Errorf("the refusal does not recommend create or modify: %s", msg)
+	}
 	if !strings.Contains(msg, alter) {
 		t.Errorf("the refusal does not point to %q: %s", alter, msg)
 	}
-	if strings.Contains(msg, "use create or modify to") {
-		t.Errorf("the refusal still recommends the lossy rewrite: %s", msg)
-	}
 }
 
-func TestCreateODataClient_ExistsAdvisesAlter(t *testing.T) {
+func TestCreateODataClient_ExistsAdvisesCreateOrModify(t *testing.T) {
 	mod := mkModule("MyModule")
 	existing := &model.ConsumedODataService{BaseElement: model.BaseElement{ID: nextID("cos")}, ContainerID: mod.ID, Name: "Api"}
 	h := mkHierarchy(mod)
@@ -51,10 +52,10 @@ func TestCreateODataClient_ExistsAdvisesAlter(t *testing.T) {
 	}
 	ctx, _ := newMockCtx(t, withBackend(mb), withHierarchy(h))
 	prog := parseMDL(t, "create consumed odata service MyModule.Api (\n  ODataVersion: OData4,\n  MetadataUrl: 'https://example.com/odata/$metadata'\n);")
-	assertSafeAdvice(t, createODataClient(ctx, prog.Statements[0].(*ast.CreateODataClientStmt)), "alter consumed odata service")
+	assertCreateOrModifyAdvice(t, createODataClient(ctx, prog.Statements[0].(*ast.CreateODataClientStmt)), "alter consumed odata service")
 }
 
-func TestCreateWorkflow_ExistsAdvisesAlter(t *testing.T) {
+func TestCreateWorkflow_ExistsAdvisesCreateOrModify(t *testing.T) {
 	mod := mkModule("MyModule")
 	existing := &workflows.Workflow{BaseElement: model.BaseElement{ID: nextID("wf")}, ContainerID: mod.ID, Name: "Approve"}
 	h := mkHierarchy(mod)
@@ -66,5 +67,5 @@ func TestCreateWorkflow_ExistsAdvisesAlter(t *testing.T) {
 	}
 	ctx, _ := newMockCtx(t, withBackend(mb), withHierarchy(h))
 	prog := parseMDL(t, "create workflow MyModule.Approve\nbegin\nend workflow;")
-	assertSafeAdvice(t, execCreateWorkflow(ctx, prog.Statements[0].(*ast.CreateWorkflowStmt)), "alter workflow")
+	assertCreateOrModifyAdvice(t, execCreateWorkflow(ctx, prog.Statements[0].(*ast.CreateWorkflowStmt)), "alter workflow")
 }
diff --git a/mdl/roundtrip/allowlist_test.go b/mdl/roundtrip/allowlist_test.go
index 9ca591be73..6198ac2cb7 100644
--- a/mdl/roundtrip/allowlist_test.go
+++ b/mdl/roundtrip/allowlist_test.go
@@ -25,7 +25,7 @@ package roundtrip
 // so that whoever merges second strikes them.
 var knownFailures = map[string]knownFailure{
 	// Plain `create` where `create or modify` is needed (#705 item 5).
-	"association Administration.AccountPasswordData_Account": {laws: []law{lawGetPut}, issue: "#721", why: "domain-model rewrite drops empty MemberAccess keys and default-false HasChanged* flags (#721 B); storage now carried (#704/#705)"},
+	"association Administration.AccountPasswordData_Account": {laws: []law{lawGetPut}, issue: "#721", why: "domain-model rewrite drops empty MemberAccess keys (#721 B; the default-false HasChanged* flags are written since #743); storage now carried (#704/#705)"},
 
 	// #721 G: describe output that does not parse.
 	"building block Atlas_Web_Content.Alert":                              {laws: []law{lawParse}, issue: "#721", why: "read-only, but describe prints a widget body that does not parse (#721 G)"},
@@ -94,13 +94,13 @@ var knownFailures = map[string]knownFailure{
 	"javascript action WebActions.TakePicture":                            {laws: []law{lawParse}, issue: "#721", why: "a parameter comma is printed after its -- comment (#721 G)"},
 
 	// #721 B: entities.
-	"entity Administration.Account":             {laws: []law{lawGetPut}, issue: "#721", why: "access-rule member pointers and generalization flags dropped (#721 B)"},
-	"entity Administration.AccountPasswordData": {laws: []law{lawGetPut}, issue: "#721", why: "access-rule member pointers and generalization flags dropped (#721 B)"},
-	"entity Atlas_Web_Content.LoginContext":     {laws: []law{lawGetPut}, issue: "#721", why: "access-rule member pointers and generalization flags dropped (#721 B)"},
-	"entity FeedbackModule.Feedback":            {laws: []law{lawGetPut}, issue: "#721", why: "access-rule member pointers and generalization flags dropped (#721 B)"},
-	"entity FeedbackModule.ResponseHelper":      {laws: []law{lawGetPut}, issue: "#721", why: "access-rule member pointers and generalization flags dropped (#721 B)"},
-	"entity NanoflowCommons.Geolocation":        {laws: []law{lawGetPut}, issue: "#721", why: "access-rule member pointers and generalization flags dropped (#721 B)"},
-	"entity NanoflowCommons.Position":           {laws: []law{lawGetPut}, issue: "#721", why: "access-rule member pointers and generalization flags dropped (#721 B)"},
+	"entity Administration.Account":             {laws: []law{lawGetPut}, issue: "#721", why: "access-rule member pointers dropped (#721 B); the generalization flags are written since #743"},
+	"entity Administration.AccountPasswordData": {laws: []law{lawGetPut}, issue: "#721", why: "access-rule member pointers dropped (#721 B); the generalization flags are written since #743"},
+	"entity Atlas_Web_Content.LoginContext":     {laws: []law{lawGetPut}, issue: "#721", why: "access-rule member pointers dropped (#721 B); the generalization flags are written since #743"},
+	"entity FeedbackModule.Feedback":            {laws: []law{lawGetPut}, issue: "#721", why: "access-rule member pointers dropped (#721 B); the generalization flags are written since #743"},
+	"entity FeedbackModule.ResponseHelper":      {laws: []law{lawGetPut}, issue: "#721", why: "access-rule member pointers dropped (#721 B); the generalization flags are written since #743"},
+	"entity NanoflowCommons.Geolocation":        {laws: []law{lawGetPut}, issue: "#721", why: "access-rule member pointers dropped (#721 B); the generalization flags are written since #743"},
+	"entity NanoflowCommons.Position":           {laws: []law{lawGetPut}, issue: "#721", why: "access-rule member pointers dropped (#721 B); the generalization flags are written since #743"},
 
 	// #721 E: menus.
 	"menu Atlas_Core.Phone_Menu":  {laws: []law{lawGetPut}, issue: "#721", why: "nested menu items dropped (#721 E)"},
diff --git a/mdl/roundtrip/testapp_allowlist_test.go b/mdl/roundtrip/testapp_allowlist_test.go
index 37fd30109a..a49dac1f56 100644
--- a/mdl/roundtrip/testapp_allowlist_test.go
+++ b/mdl/roundtrip/testapp_allowlist_test.go
@@ -9,23 +9,17 @@ package roundtrip
 // rules are those of knownFailures in allowlist_test.go.
 //
 // Measured on 2026-09-27 at TestApp 11a8fca, when TestApp joined the harness
-// (#743): 142 of 775 documents keep both laws. The #743 entries are the three
-// kinds whose describe still prints a plain `create`; their `create or modify`
-// rewrites are measured by TestTestAppCreateOrModifyProbe. Everything else is
-// the #721 classes on a larger fixture and has not been triaged per document.
+// (#743): 142 of 775 documents keep both laws. Everything listed is the #721
+// classes on a larger fixture and has not been triaged per document. The #743
+// entries (workflows, OData clients and external entities, whose describe
+// printed a plain `create`) were struck when their rewrites learned to carry
+// what describe cannot print, and the false generalization flags #721 B
+// dropped struck 27 entity and association entries with them.
 var testAppKnownFailures = map[string]knownFailure{
 	"association Administration.AccountPasswordData_Account":                          {laws: []law{lawGetPut}, issue: "#721", why: "association: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
-	"association Clients.Customer_Order":                                              {laws: []law{lawGetPut}, issue: "#721", why: "association: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
-	"association Clients.OrderLine_Order":                                             {laws: []law{lawGetPut}, issue: "#721", why: "association: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
-	"association Clients.Order_GetCustomerOrdersResponse":                             {laws: []law{lawGetPut}, issue: "#721", why: "association: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
-	"association Clients.Order_SaveOrder":                                             {laws: []law{lawGetPut}, issue: "#721", why: "association: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
-	"association Clients.Product_OrderLine":                                           {laws: []law{lawGetPut}, issue: "#721", why: "association: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
 	"association Mappings.OrderLine_Order":                                            {laws: []law{lawGetPut}, issue: "#721", why: "association: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
 	"association Mappings.OrderLine_Product":                                          {laws: []law{lawGetPut}, issue: "#721", why: "association: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
 	"association Mappings.Order_Customer":                                             {laws: []law{lawGetPut}, issue: "#721", why: "association: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
-	"association Rules.BusinessRule_RuleCategory":                                     {laws: []law{lawGetPut}, issue: "#721", why: "association: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
-	"association Rules.RuleAction_BusinessRule":                                       {laws: []law{lawGetPut}, issue: "#721", why: "association: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
-	"association Rules.RuleExecutionLog_BusinessRule":                                 {laws: []law{lawGetPut}, issue: "#721", why: "association: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
 	"association ViewAssociations.persistent_order":                                   {laws: []law{lawExec}, issue: "#721", why: "association: breaks exec on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
 	"association WorkflowCommons.CleanupHelper_WorkflowDefinition":                    {laws: []law{lawGetPut}, issue: "#721", why: "association: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
 	"association WorkflowCommons.ConflictReasonGroup_Workflow":                        {laws: []law{lawGetPut}, issue: "#721", why: "association: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
@@ -128,32 +122,14 @@ var testAppKnownFailures = map[string]knownFailure{
 	"entity Administration.Account":                                                   {laws: []law{lawGetPut}, issue: "#721", why: "entity: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
 	"entity Administration.AccountPasswordData":                                       {laws: []law{lawGetPut}, issue: "#721", why: "entity: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
 	"entity Atlas_Web_Content.LoginContext":                                           {laws: []law{lawGetPut}, issue: "#721", why: "entity: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
-	"entity Clients.Customer":                                                         {laws: []law{lawGetPut}, issue: "#721", why: "entity: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
-	"entity Clients.GetCustomerOrdersResponse":                                        {laws: []law{lawGetPut}, issue: "#721", why: "entity: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
-	"entity Clients.Order":                                                            {laws: []law{lawGetPut}, issue: "#721", why: "entity: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
-	"entity Clients.OrderLine":                                                        {laws: []law{lawGetPut}, issue: "#721", why: "entity: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
-	"entity Clients.Orders":                                                           {laws: []law{lawGetPut}, issue: "#721", why: "entity: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
-	"entity Clients.Product":                                                          {laws: []law{lawGetPut}, issue: "#721", why: "entity: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
-	"entity Clients.Root":                                                             {laws: []law{lawGetPut}, issue: "#721", why: "entity: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
-	"entity Clients.SaveOrder":                                                        {laws: []law{lawGetPut}, issue: "#721", why: "entity: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
 	"entity FeedbackModule.Feedback":                                                  {laws: []law{lawGetPut}, issue: "#721", why: "entity: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
 	"entity FeedbackModule.ResponseHelper":                                            {laws: []law{lawGetPut}, issue: "#721", why: "entity: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
 	"entity Mappings.Customer":                                                        {laws: []law{lawGetPut}, issue: "#721", why: "entity: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
-	"entity Mappings.Item":                                                            {laws: []law{lawGetPut}, issue: "#721", why: "entity: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
 	"entity Mappings.Order":                                                           {laws: []law{lawGetPut}, issue: "#721", why: "entity: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
 	"entity Mappings.OrderLine":                                                       {laws: []law{lawGetPut}, issue: "#721", why: "entity: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
 	"entity Mappings.Product":                                                         {laws: []law{lawGetPut}, issue: "#721", why: "entity: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
-	"entity MyFirstModule.Car":                                                        {laws: []law{lawGetPut}, issue: "#721", why: "entity: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
-	"entity MyFirstModule.VCar":                                                       {laws: []law{lawGetPut}, issue: "#721", why: "entity: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
 	"entity NanoflowCommons.Geolocation":                                              {laws: []law{lawGetPut}, issue: "#721", why: "entity: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
 	"entity NanoflowCommons.Position":                                                 {laws: []law{lawGetPut}, issue: "#721", why: "entity: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
-	"entity Odata.Devices":                                                            {laws: []law{lawGetPut}, issue: "#721", why: "entity: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
-	"entity Pages.Vehicle":                                                            {laws: []law{lawGetPut}, issue: "#721", why: "entity: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
-	"entity Rules.BusinessRule":                                                       {laws: []law{lawGetPut}, issue: "#721", why: "entity: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
-	"entity Rules.RuleAction":                                                         {laws: []law{lawGetPut}, issue: "#721", why: "entity: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
-	"entity Rules.RuleCategory":                                                       {laws: []law{lawGetPut}, issue: "#721", why: "entity: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
-	"entity Rules.RuleExecutionLog":                                                   {laws: []law{lawGetPut}, issue: "#721", why: "entity: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
-	"entity ViewAssociations.OrdersVE":                                                {laws: []law{lawGetPut}, issue: "#721", why: "entity: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
 	"entity WorkflowCommons.AssignmentHelper":                                         {laws: []law{lawGetPut}, issue: "#721", why: "entity: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
 	"entity WorkflowCommons.AuditTrailViewer":                                         {laws: []law{lawGetPut}, issue: "#721", why: "entity: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
 	"entity WorkflowCommons.CleanupHelper":                                            {laws: []law{lawGetPut}, issue: "#721", why: "entity: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
@@ -189,12 +165,9 @@ var testAppKnownFailures = map[string]knownFailure{
 	"entity WorkflowCommons.WorkflowTaskDetail":                                       {laws: []law{lawGetPut}, issue: "#721", why: "entity: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
 	"entity WorkflowCommons.WorkflowUserTaskView":                                     {laws: []law{lawExec}, issue: "#721", why: "entity: breaks exec on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
 	"entity WorkflowCommons.WorkflowView":                                             {laws: []law{lawExec}, issue: "#721", why: "entity: breaks exec on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
-	"entity workflow.workfow1context":                                                 {laws: []law{lawGetPut}, issue: "#721", why: "entity: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
 	"enumeration WorkflowCommons.Enum_NotificationArea_RenderAs":                      {laws: []law{lawGetPut}, issue: "#721", why: "enumeration: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
 	"export mapping Clients.SoapOrderExportMapping":                                   {laws: []law{lawGetPut}, issue: "#721", why: "export mapping: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
 	"export mapping Services.OrdersExportMapping":                                     {laws: []law{lawGetPut}, issue: "#721", why: "export mapping: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
-	"external entity Clients.Orders":                                                  {laws: []law{lawExec}, issue: "#743", why: "describe external entity prints a plain create, refused on the existing entity; its create or modify probe leaves only #721 B"},
-	"external entity Odata.Devices":                                                   {laws: []law{lawExec}, issue: "#743", why: "describe external entity prints a plain create, refused on the existing entity; its create or modify probe leaves only #721 B"},
 	"import mapping Clients.SoapCustomerOrdersImportMapping":                          {laws: []law{lawGetPut}, issue: "#721", why: "import mapping: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
 	"import mapping Clients.SoapOrdersImportMapping":                                  {laws: []law{lawGetPut}, issue: "#721", why: "import mapping: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
 	"javascript action DataWidgets.Reset_All_Filters":                                 {laws: []law{lawParse}, issue: "#721", why: "javascript action: breaks parse on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
@@ -225,8 +198,6 @@ var testAppKnownFailures = map[string]knownFailure{
 	"menu Atlas_Core.Tablet_Menu":                                                     {laws: []law{lawGetPut}, issue: "#721", why: "menu: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
 	"microflow WorkflowCommons.SUB_WorkflowTask_AverageHandlingTime":                  {laws: []law{lawParse}, issue: "#721", why: "microflow: breaks parse on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
 	"microflow WorkflowCommons.SUB_Workflow_AverageHandlingTime":                      {laws: []law{lawParse}, issue: "#721", why: "microflow: breaks parse on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
-	"odata client Clients.OrderODataClient":                                           {laws: []law{lawExec}, issue: "#743", why: "plain create refused until the rewrite carries UseQuerySegment, catalog, proxy and microflow settings and the icon"},
-	"odata client Odata.Bug1073":                                                      {laws: []law{lawExec}, issue: "#743", why: "plain create refused until the rewrite carries UseQuerySegment, catalog, proxy and microflow settings and the icon"},
 	"page Administration.Account_Edit":                                                {laws: []law{lawGetPut}, issue: "#721", why: "page: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
 	"page Administration.Account_New":                                                 {laws: []law{lawGetPut}, issue: "#721", why: "page: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
 	"page Administration.Account_Overview":                                            {laws: []law{lawGetPut}, issue: "#721", why: "page: breaks getput on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
@@ -386,18 +357,9 @@ var testAppKnownFailures = map[string]knownFailure{
 	"snippet WorkflowCommons.Snip_Workflow_TaskTimeLineOnly":                          {laws: []law{lawExec}, issue: "#721", why: "snippet: breaks exec on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
 	"snippet WorkflowCommons.Snip_Workflow_TaskTimeline":                              {laws: []law{lawExec}, issue: "#721", why: "snippet: breaks exec on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
 	"snippet WorkflowCommons.Snip_Workflow_TaskTimeline_WithoutName":                  {laws: []law{lawExec}, issue: "#721", why: "snippet: breaks exec on TestApp, measured when it joined the harness (#743); not yet triaged into #721's classes"},
-	"workflow workflow.Workflow1":                                                     {laws: []law{lawExec}, issue: "#743", why: "plain create refused until the rewrite carries event sub-processes, outcome flows and activity names"},
-	"workflow workflow.Workflow1_2":                                                   {laws: []law{lawExec}, issue: "#743", why: "plain create refused until the rewrite carries event sub-processes, outcome flows and activity names"},
 }
 
 // createOrModifyProbeKnownFailures is the allowlist of
 // TestTestAppCreateOrModifyProbe. It may only shrink; a kind switches its
 // describe verb once none of its documents is listed here.
-var createOrModifyProbeKnownFailures = map[string]knownFailure{
-	"external entity Clients.Orders":        {laws: []law{lawGetPut}, issue: "#721", why: "only the NoGeneralization HasXAttr=false flags are dropped (#721 B)"},
-	"external entity Odata.Devices":         {laws: []law{lawGetPut}, issue: "#721", why: "only the NoGeneralization HasXAttr=false flags are dropped (#721 B)"},
-	"odata client Clients.OrderODataClient": {laws: []law{lawGetPut}, issue: "#743", why: "UseQuerySegment, ApplicationId, EndpointId, CatalogUrl, Icon, proxy and microflow settings dropped; list markers"},
-	"odata client Odata.Bug1073":            {laws: []law{lawGetPut}, issue: "#743", why: "UseQuerySegment, ApplicationId, EndpointId, CatalogUrl, Icon, proxy and microflow settings dropped; list markers"},
-	"workflow workflow.Workflow1":           {laws: []law{lawGetPut}, issue: "#743", why: "event sub-processes, outcome flows, activity names and sizes dropped"},
-	"workflow workflow.Workflow1_2":         {laws: []law{lawGetPut}, issue: "#743", why: "event sub-processes, outcome flows, activity names and sizes dropped"},
-}
+var createOrModifyProbeKnownFailures = map[string]knownFailure{}
diff --git a/mdl/roundtrip/testapp_create_or_modify_test.go b/mdl/roundtrip/testapp_create_or_modify_test.go
index a9c87dd7b3..bd43e978c0 100644
--- a/mdl/roundtrip/testapp_create_or_modify_test.go
+++ b/mdl/roundtrip/testapp_create_or_modify_test.go
@@ -23,12 +23,13 @@ import (
 //
 // `odata service` switched in #743: its probe passed on all three TestApp
 // services once the rewrite carried ExportLevel, PageSize, the entity-set order
-// and CanBeEmpty.
-var deferredVerbKinds = map[string]bool{
-	"workflow":        true,
-	"odata client":    true,
-	"external entity": true,
-}
+// and CanBeEmpty. `workflow`, `odata client` and `external entity` switched
+// once theirs passed too: the names of a workflow's implicit activities, empty
+// outcome flows and the empty EventSubProcesses list; a client's icon,
+// UseQuerySegment and the keys Studio Pro stores empty; an entity's false
+// generalization flags. No kind is deferred now; the probe stays for the next
+// kind whose describe has to keep a plain `create`.
+var deferredVerbKinds = map[string]bool{}
 
 // createOrModifyProbeKnownFailures lives in testapp_allowlist_test.go.
 
@@ -48,6 +49,12 @@ func TestTestAppCreateOrModifyProbe(t *testing.T) {
 	h := newFixtureHarness(t, testApp)
 	defer h.close()
 
+	if len(deferredVerbKinds) == 0 {
+		if len(createOrModifyProbeKnownFailures) > 0 {
+			t.Errorf("createOrModifyProbeKnownFailures lists %d document(s), but no kind is deferred — remove them", len(createOrModifyProbeKnownFailures))
+		}
+		t.Skip("no kind's describe prints a plain `create`; TestTestAppRoundTrip covers every kind")
+	}
 	probed := 0
 	seen := map[string]bool{}
 	for _, d := range h.documents() {

From ddea174a4b528a594434a57160ac561b770c1424 Mon Sep 17 00:00:00 2001
From: Ako <andrej@koelewijn.net>
Date: Mon, 28 Sep 2026 08:26:41 +0000
Subject: [PATCH 26/35] test(roundtrip): describe never emits R9's deprecated
 spellings

TestPedApp/TestAppDescribeUsesCanonicalSpellings now also fail on
MDL-DEPR100/104/105/106. Control: with the old page describe (Folder: in
the header) the PedApp run reports 38 uses of MDL-DEPR105.

Part of #755.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 mdl/roundtrip/describe_canonical_spelling_test.go | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/mdl/roundtrip/describe_canonical_spelling_test.go b/mdl/roundtrip/describe_canonical_spelling_test.go
index b284a3b0b9..87ccbc666f 100644
--- a/mdl/roundtrip/describe_canonical_spelling_test.go
+++ b/mdl/roundtrip/describe_canonical_spelling_test.go
@@ -62,13 +62,19 @@ func describeUsesCanonicalSpellings(t *testing.T, fx fixture) {
 	}
 }
 
-// r8Codes are the registry codes R8 (#752) owns.
+// r8Codes are the registry codes R8 (#752) owns, and R9's (#755): describe
+// writes documentation as a doc comment, the folder as a clause and a workflow
+// activity's caption as `caption`.
 var r8Codes = map[string]bool{
 	deprecation.PageActionWord:         true,
 	deprecation.ErrorMessageKeyword:    true,
 	deprecation.DeleteBehaviorClause:   true,
 	deprecation.ReferenceSetUnderscore: true,
 	deprecation.ReturnsNone:            true,
+	deprecation.DocumentationClause:    true,
+	deprecation.WorkflowCommentCaption: true,
+	deprecation.FolderProperty:         true,
+	deprecation.DocumentationProperty:  true,
 }
 
 func firstDifferentLine(a, b string) string {

From 684d7197a6d27907499310662cf3e723b9134e9e Mon Sep 17 00:00:00 2001
From: Ako <andrej@koelewijn.net>
Date: Mon, 28 Sep 2026 08:26:58 +0000
Subject: [PATCH 27/35] docs: changelog for R7 and R9 (#755)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3c0e773a25..889e0b119b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ### Changed
 
+- **Documentation is a `/** … */` doc comment, the folder a `folder '…'` clause after the name, and a workflow activity's caption `caption '…'`** (ako/mxcli#755, R9) — on every document. A page, snippet, consumed REST service, consumed or published OData service and published REST service take `create page M.P folder 'Admin' (…)`; `describe` writes the clause, and for a consumed REST service it now writes the folder at all. `describe constant` and `describe json structure` write the documentation as a doc comment only. A workflow's `call microflow … caption 'Notify'`, `notification Ready caption 'Ready'` and `end workflow caption 'Done'` name what the clause always set. Measured on the Studio Pro-authored PedApp and TestApp fixtures: the round-trip harness stays green, and describe emits none of the old spellings. **Migrating a script:** nothing breaks — `comment '…'` on a constant, association, JSON structure or image collection (**MDL-DEPR100**), a workflow activity's `comment '…'` (**MDL-DEPR104**), `Folder: '…'` in those headers (**MDL-DEPR105**) and `Documentation: '…'` in a regular expression, task queue or scheduled event (**MDL-DEPR106**) still parse and build the same statement, `check` / `exec` warn, and `mxcli fmt --upgrade` moves the text; a statement that has both spellings keeps the one it stored. `create or modify` of a JSON structure, association, regular expression, task queue or scheduled event now updates its documentation when the statement states one; before, it kept the stored text.
+- **Session commands belong to the REPL** (ako/mxcli#755, R7) — `connect`, `disconnect`, `use`, `set <key> = …`, `status`, `check`, `build`, `lint`, `debug`, `execute script`, `execute runtime`, `help` and `introspect api` need a session, not a model. Under the `mdl 1;` preview header a script that holds one is refused; without the header it runs as before and `check` / `exec` warn **MDL-V1-SESSION**. The REPL keeps accepting them. Put the session on the command line instead: `mxcli exec script.mdl -p app.mpr --json`. `exit` / `quit` are not session commands.
+
 - **Document types are named as Studio Pro names them** (ako/mxcli#755, R10) — `consumed rest service` (was `rest client`), `consumed odata service` (was `odata client`), `published odata service` (was `odata service`), `task queue` (was `queue`), `alter app security` (was `alter project security`) and `alter settings runtime` (was `alter settings model`), in every statement that names the type: create, alter, drop, describe, list, move, grant/revoke on a published OData service, and an external entity's `from consumed odata service`. `describe` writes the new names. **Migrating a script:** nothing breaks — the old names still parse and build the identical statement, `check` / `exec` warn **MDL-DEPR550** to **MDL-DEPR555**, and `mxcli fmt --upgrade` rewrites them. `call microflow … in queue M.Q` is a call option, not the type name, and is unchanged.
 
 - **An entity grant names the rights first, and every XPath is written in `[ ]`** (ako/mxcli#753, R5) — `grant read *, write (Email), create on entity Shop.Order to Shop.User where [Status = 'Open'];` takes the word order of every other grant, and the constraint is bracketed like a datasource or retrieve `where`, so the quotes inside it are written once instead of doubled. A workflow user task's targeting is the same: `targeting users xpath [System.UserRoles = '[%UserRole_Manager%]']`, and `alter workflow … set activity … targeting xpath [ … ]`. Sibling predicate groups (`[a][b]`) are one constraint, kept as written. `describe entity` and `describe workflow` print the new forms; a stored constraint the bracketed grammar does not read (none in the Studio Pro-authored PedApp and TestApp fixtures) is printed in the old quoted form so the output stays re-executable. **Migrating a script:** nothing breaks — `grant Shop.User on Shop.Order (read *) where '[…]'` and `targeting xpath '[…]'` still parse and build the same rule, and `check` / `exec` warn **MDL-DEPR030** and **MDL-DEPR031**; `mxcli fmt --upgrade` rewrites both. A quoted value that is not a bracketed XPath is left in place and reported. `revoke` keeps its current form for now.
@@ -26,6 +29,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ### Fixed
 
+- **A misspelt statement keyword parsed as a help topic** (ako/mxcli#755, R7) — `helpStatement` accepted any word, so `craete module Foo;` parsed without error and did nothing, and `craete entity M.E (…)` reported its error at the `(`. Only `help`, `exit` and `quit` start that statement now, and a statement that starts with an unknown word is reported at the word: `unknown statement 'craete' — did you mean 'create'?`.
 - **Keyword operators were fused in some stored expressions** — a page action's microflow argument `Flag: $a and $b` was stored as `$aand$b`, `if $x then 'a' else 'b'` as `if$xthen'a'else'b'`; the same in `contentparams` values, `send rest request … with (…)` parameters and a dynamic `execute database query`. Those four places took the expression's text without its whitespace; literals, `+` and `$currentObject` were unaffected, which is why it went unnoticed, and `check --references` passed. Measured by decoding the stored units on a Mendix 11.14.0 project. The expression is now stored as written, with MDL comments removed, as the microflow expression sites already did.
 - **An input bound to an attribute outside any data container was written with no binding** — `textbox t (Attribute: FullName)` at the top of a page (or of a snippet, or inside a plain container) has no entity to qualify the name with, and the writer stored it as `AttributeRef: null`. Plain `check` passed, `exec --no-check` and `alter page … insert` at page level said success, and mxbuild 11.13.0 failed the page with CE0544 "This widget can only function inside a data context" + CE7005 (text box, text area, date picker, check box, radio buttons, drop-down), CE0402 (dynamic text `Attribute:`) or CE0642 (combo box). A qualified attribute there is stored and fails the same way (CE0544 / CE2421 / CE1365 / CE7247 "Move this widget into a data container"). `Attribute: $P/Name` and `Attribute: $currentObject/Name` never parsed as an attribute path and were dropped even inside a data view. `check` now reports all three as **MDL-WIDGET34** (no project needed), and the page builder refuses them with the widget named, so nothing is written; `alter page` refuses a bare name it has no entity for. Place the widget in a data view, list view, gallery or data grid and bind the attribute by name.
 - **An expression property written in brackets was silently dropped** (mendixlabs/mxcli#750) — `dynamicclasses: [ if $currentObject/Featured then 'a' else 'b' ]`, the spelling #750 proposes, parsed as a list that no writer reads: `check` was clean, `exec` said `Created page`, and the widget was stored with no dynamic class. `alter page … set DynamicClasses = [ … ]` said `Altered page` and changed nothing, and a column's `DynamicCellClass` stored the list's text — tokens fused, `[if$x/Ythen'a'else'b']` — as its expression. Measured on a copy of a Mendix 11.14.0 project with the pre-fix binary. `mxcli check` now reports **MDL-WIDGET32** for `DynamicClasses` and `DynamicCellClass` written as a list (no project needed), and ALTER refuses it, so `check -p` reports that too. Write the expression quoted.

From 3320ec52638878868c42fc900b587fa821c4985c Mon Sep 17 00:00:00 2001
From: Ako <andrej@koelewijn.net>
Date: Mon, 28 Sep 2026 08:27:18 +0000
Subject: [PATCH 28/35] chore(findings): helpStatement catch-all swallowed
 misspelt keywords (#755)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .claude/skills/fix-issue/findings/mdl-grammar.jsonl | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.claude/skills/fix-issue/findings/mdl-grammar.jsonl b/.claude/skills/fix-issue/findings/mdl-grammar.jsonl
index fcafec92cc..08c61bbc86 100644
--- a/.claude/skills/fix-issue/findings/mdl-grammar.jsonl
+++ b/.claude/skills/fix-issue/findings/mdl-grammar.jsonl
@@ -63,3 +63,4 @@
 {"area": "mdl/grammar", "date": "2026-09-23", "symptom": "`alter page M.P { set 'createFileAction' = microflow M.ACT_CreateFile on fileUploader1; };` (quoted or bare key) fails to parse: `line 2:37 extraneous input 'MyModule' expecting {DROP, ADD, SET, INSERT, REPLACE, '}'}` — a pluggable widget's NAMED action slot, writable on CREATE PAGE since #956, could only be retargeted by REPLACEing the whole widget", "cause": "`alterPageAssignment` special-cased `Action = actionExprV3` and sent every other key to `propertyValueV3`, which has no `microflow <name>` form. Below the grammar there was also no route: `SetWidgetProperty` would have stringified an action into `PrimitiveValue`, and `SetWidgetAction` writes the built-in click action, not a pluggable slot", "file": "`mdl/grammar/MDLParser.g4` (`alterPageAssignment`: `STRING_LITERAL|identifierOrKeyword EQUALS actionExprV3`), `mdl/visitor/visitor_alter_page.go` (keeps the author's key), `mdl/executor/cmd_alter_page.go` (`applySetPropertyMutator` routes any `*ast.ActionV3` not keyed `Action`), `mdl/backend/pagemutator/mutator.go` (`SetWidgetNamedAction`); tests `mdl/visitor/visitor_alter_page_named_action_test.go`, `mdl/backend/pagemutator/mutator_named_action_test.go`, `mdl/executor/alter_set_named_action_test.go`; example `mdl-examples/bug-tests/995-alter-page-set-named-action-slot.mdl`", "insight": "**Decide action-slot-ness by the stored PropertyType's `ValueType.Type == \"Action\"`, never by the presence of `Value.Action`** — every WidgetValue carries an Action (a NoAction by default) whatever its type, so a field-presence check would \"succeed\" writing into an Integer and change nothing. Unlike CREATE, ALTER has no datasource overlap to yield to (DataSource is its own alternative), so the action alternative goes before the scalar ones and `microflow M.X` parses straight to an action — no DataSourceV3 conversion. The check-time probe (validate_alter_set.go) dry-runs the same setter, so the wrong-type refusal surfaced at `check -p --references` for free. Measured on 11.12.1: set on a DataGrid 2 with Selection unset (slot hidden) also passed `mx check` at 0 errors — the CE0463 in #956's notes was 11.13.0, so ALTER does not yet run MDL-WIDGET10; don't assume either way without a build on the target version", "refs": ["mendixlabs/mxcli#995", "mendixlabs/mxcli#956"]}
 {"area": "mdl/grammar", "date": "2026-09-24", "symptom": "`DROP PAGE IF EXISTS FieldService.Stub;` -> `line 1:13 extraneous input 'EXISTS' expecting the start of a statement`. No document-level DROP (35 alternatives: entity through folder) accepted IF EXISTS, so any script that dropped something was one-shot and the drop had to be deleted after its first run (ako/mxcli#531, ChipCoV3, 11.14.0).", "cause": "`dropStatement` in MDLParser.g4 never applied the existing `ifExists` rule; only sub-document drops (attribute, index, enum value) and the two security drops had it, each added one statement at a time with its own AST field and handler branch.", "file": "`mdl/grammar/MDLParser.g4` (dropStatement); `mdl/ast/ast_drop.go` (DropGuard embedded in 35 Drop*Stmt); `mdl/visitor/visitor_entity.go` (ExitDropStatement sets it once, via defer); `mdl/executor/registry.go` (Dispatch turns NotFoundError into a skip); `mdl/executor/validate.go` (check --references skips guarded drops); tests `mdl/executor/drop_if_exists_test.go`; example `mdl-examples/bug-tests/531-drop-if-exists.mdl`", "insight": "The per-statement recipe the previous IF EXISTS fixes used (field + handler branch) would have been 35 copies, and the next doctype would miss it. What made one central guard safe was a measurement, not an assumption: a table test driving every bare DROP at a missing target through the registry showed all 35 handlers already return mdlerrors.NotFoundError, and only at lookup, before any mutation — so Dispatch can key on that type and let every other error through. Keep that bare-form table test: it is what breaks if a new drop handler reports 'not found' with fmt.Errorf. Mock pitfall on the way: MockBackend's Get*ByQualifiedName defaults to (nil, nil), which the real backend never returns for a missing document — mirror its 'not found' error or the handler dereferences nil. And check --references resolved a drop's MODULE, so a guarded drop in a missing module passed exec but failed check until validateWithContext skipped it too."}
 {"area": "mdl/grammar", "date": "2026-09-25", "symptom": "`create java action \u2026(EntityType: entity <String> not null, \u2026)` failed with \"mismatched input 'String' expecting IDENTIFIER\"; Studio Pro accepts a type parameter named after a primitive, so such an action could not be authored, and DESCRIBE of a Studio Pro-authored one printed `returns String`, which re-parses as the primitive.", "cause": "dataType's `ENTITY LESS_THAN IDENTIFIER GREATER_THAN` excluded keyword tokens, and the describer emitted type-parameter names bare where a bare keyword means something else.", "file": "mdl/grammar/domains/MDLDomainModel.g4, mdl/executor/cmd_javaactions.go (formatCodeActionTypeParameterRef)", "insight": "Two halves of one round trip: the declaration slot needed identifierOrKeyword, and the *reference* slots needed no grammar change at all \u2014 a quoted `\"String\"` already parses as a bare qualifiedName, which isTypeParamRef resolves, while unquoted `String` stays the primitive. So the fix on the output side is mdlIdent (which lexes the name with the real lexer) on every type-parameter name DESCRIBE prints. Prove it with a describe \u2192 exec into a second module \u2192 describe diff, not by eyeballing one DESCRIBE.", "refs": ["mendixlabs/mxcli#1183"]}
+{"area": "mdl/grammar", "date": "2026-09-28", "symptom": "A misspelt statement keyword was not an error. `craete module Foo;` and `dorp entity M.E;` parsed cleanly and did nothing (0 statements, exit 0); `craete persistent entity Shop.Note (Text: string(200));` reported `extraneous input '('` at column 35 instead of at the typo.", "cause": "`helpStatement: IDENTIFIER (helpTopicWord (DOT? helpTopicWord)*)?` is a utilityStatement alternative, so ANY statement starting with an IDENTIFIER matched it, the rest of the words as the topic; ExitHelpStatement then built nothing for a word other than help/?/exit/quit. The rule is the grammar's catch-all (the #1025 comment already warned it swallows from other statements); a typo is just the case where there is no other statement.", "file": "`mdl/grammar/MDLParser.g4` (`@parser::members` IsHelpWord), `mdl/grammar/domains/MDLSettings.g4` (semantic predicate on helpStatement), `mdl/visitor/visitor_unknown_statement.go` (\"unknown statement 'x' — did you mean 'y'?\" when the parser is still in statement/program and ANTLR names the one word), test `mdl/visitor/visitor_session_commands_test.go`", "insight": "A catch-all alternative that the visitor filters (`switch word { case \"help\": … }`) is a silent no-op for everything it does not list: move the filter INTO the grammar as a predicate (`{IsHelpWord(p.GetTokenStream().LT(1).GetText())}?`), so the parser, not the visitor, rejects. The words stay IDENTIFIERs — reserving HELP/EXIT/QUIT as tokens would take them away as names everywhere a bare IDENTIFIER is accepted. The generated parser imports no `strings`, so fold case by hand in @members. With the predicate the error lands at the word as `no viable alternative at input 'craete'`, and the listener can rewrite exactly that message when the recognizer's context is StatementContext/ProgramContext. Proof: without the predicate the test reports 3 of 4 inputs parsing to zero statements.", "refs": ["ako/mxcli#755", "mendixlabs/mxcli#1025"]}

From bab54999b3e9bd435fb144c2f4aa686f4c25f673 Mon Sep 17 00:00:00 2001
From: Ako <andrej@koelewijn.net>
Date: Mon, 28 Sep 2026 08:58:38 +0000
Subject: [PATCH 29/35] fix(describe): a constant or JSON structure
 documentation with */ keeps the comment clause (#755)

R9 moved the documentation of a constant into a doc comment. A text with
`*/` in it ends the doc comment early, so describe emitted a statement that
no longer parses, where the comment clause before held any text. Describe
now keeps the deprecated clause for exactly that text, for constants and JSON
structures. Blank lines and edge whitespace keep the doc comment's
normalisation, as for every other document: falling back for them would put
the deprecated spelling into describe of Studio Pro content (TestApp's
WorkflowCommons constants) and fail the canonical-spelling gate.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 mdl/executor/bugfix_regression_test.go       | 34 +++++++++++++++++
 mdl/executor/cmd_constants.go                | 16 +++++++-
 mdl/executor/cmd_jsonstructures.go           | 13 ++++++-
 mdl/executor/cmd_jsonstructures_mock_test.go | 40 ++++++++++++++++++++
 4 files changed, 99 insertions(+), 4 deletions(-)

diff --git a/mdl/executor/bugfix_regression_test.go b/mdl/executor/bugfix_regression_test.go
index d8007e8c10..8e0c57cfaf 100644
--- a/mdl/executor/bugfix_regression_test.go
+++ b/mdl/executor/bugfix_regression_test.go
@@ -313,6 +313,40 @@ func TestOutputConstantMDL_CommentEscapesSingleQuotes(t *testing.T) {
 	}
 }
 
+// TestOutputConstantMDL_DocumentationWithCommentEnd: a documentation text
+// with `*/` in it ends a doc comment early, so describe keeps the deprecated
+// `comment '…'` clause for it rather than emit a statement that no longer
+// parses (R9 moved the constant's documentation into a doc comment; before,
+// the clause held any text). The control is an ordinary text.
+func TestOutputConstantMDL_DocumentationWithCommentEnd(t *testing.T) {
+	for _, doc := range []string{"ends */ here", "plain text", "two\nlines"} {
+		buf := &bytes.Buffer{}
+		e := New(buf)
+		c := &model.Constant{
+			Name:          "K",
+			Type:          model.ConstantDataType{Kind: "String"},
+			DefaultValue:  "'x'",
+			Documentation: doc,
+		}
+		if err := e.outputConstantMDL(c, "M"); err != nil {
+			t.Fatalf("outputConstantMDL: %v", err)
+		}
+		prog, errs := visitor.Build(buf.String())
+		if len(errs) > 0 {
+			t.Fatalf("describe of documentation %q does not parse: %v\n%s", doc, errs, buf.String())
+		}
+		var got *ast.CreateConstantStmt
+		for _, s := range prog.Statements {
+			if cs, ok := s.(*ast.CreateConstantStmt); ok {
+				got = cs
+			}
+		}
+		if got == nil || got.Documentation != doc {
+			t.Errorf("documentation %q did not read back; got %+v from:\n%s", doc, got, buf.String())
+		}
+	}
+}
+
 // =============================================================================
 // Issue #26: Date type distinct from DateTime
 // =============================================================================
diff --git a/mdl/executor/cmd_constants.go b/mdl/executor/cmd_constants.go
index e1791b82fa..d9eb3ccb5e 100644
--- a/mdl/executor/cmd_constants.go
+++ b/mdl/executor/cmd_constants.go
@@ -110,9 +110,18 @@ func outputConstantMDL(ctx *ExecContext, c *model.Constant, moduleName string) e
 	// Format default value based on type
 	defaultValueStr := formatDefaultValue(c.Type, c.DefaultValue)
 
-	// Documentation is a doc comment (R9); `comment '…'` is its deprecated alias.
+	// Documentation is a doc comment (R9); `comment '…'` is its deprecated
+	// alias, kept for a text with `*/` in it, which would end a doc comment
+	// early and leave a statement that does not parse. (A doc comment also
+	// trims each line and drops blank ones, as for every other document; that
+	// normalisation is accepted here, as it is there.)
+	docClause := false
 	if c.Documentation != "" {
-		fmt.Fprintf(ctx.Output, "/**\n * %s\n */\n", strings.ReplaceAll(c.Documentation, "\n", "\n * "))
+		if !strings.Contains(c.Documentation, "*/") {
+			fmt.Fprintf(ctx.Output, "/**\n * %s\n */\n", strings.ReplaceAll(c.Documentation, "\n", "\n * "))
+		} else {
+			docClause = true
+		}
 	}
 	fmt.Fprintf(ctx.Output, "create or modify constant %s.%s\n", moduleName, c.Name)
 	fmt.Fprintf(ctx.Output, "  type %s\n", formatConstantTypeForMDL(c.Type))
@@ -126,6 +135,9 @@ func outputConstantMDL(ctx *ExecContext, c *model.Constant, moduleName string) e
 		}
 	}
 
+	if docClause {
+		fmt.Fprintf(ctx.Output, "\n  comment '%s'", strings.ReplaceAll(c.Documentation, "'", "''"))
+	}
 	if c.ExposedToClient {
 		fmt.Fprintf(ctx.Output, "\n  exposed to client")
 	}
diff --git a/mdl/executor/cmd_jsonstructures.go b/mdl/executor/cmd_jsonstructures.go
index 8fa0c63deb..e2e1e244e6 100644
--- a/mdl/executor/cmd_jsonstructures.go
+++ b/mdl/executor/cmd_jsonstructures.go
@@ -87,9 +87,15 @@ func describeJsonStructure(ctx *ExecContext, name ast.QualifiedName) error {
 
 	qualifiedName := fmt.Sprintf("%s.%s", modName, js.Name)
 
-	// Documentation as doc comment
+	// Documentation as doc comment (R9). A text with `*/` in it would end the
+	// doc comment early, so it keeps the deprecated `comment '…'` clause.
+	docClause := false
 	if js.Documentation != "" {
-		fmt.Fprintf(ctx.Output, "/**\n * %s\n */\n", strings.ReplaceAll(js.Documentation, "\n", "\n * "))
+		if !strings.Contains(js.Documentation, "*/") {
+			fmt.Fprintf(ctx.Output, "/**\n * %s\n */\n", strings.ReplaceAll(js.Documentation, "\n", "\n * "))
+		} else {
+			docClause = true
+		}
 	}
 
 	// Re-executable CREATE OR MODIFY statement
@@ -97,6 +103,9 @@ func describeJsonStructure(ctx *ExecContext, name ast.QualifiedName) error {
 	if folderPath := h.BuildFolderPath(js.ContainerID); folderPath != "" {
 		fmt.Fprintf(ctx.Output, "\n  folder '%s'", folderPath)
 	}
+	if docClause {
+		fmt.Fprintf(ctx.Output, "\n  comment '%s'", strings.ReplaceAll(js.Documentation, "'", "''"))
+	}
 
 	if js.JsonSnippet != "" {
 		snippet := types.PrettyPrintJSON(js.JsonSnippet)
diff --git a/mdl/executor/cmd_jsonstructures_mock_test.go b/mdl/executor/cmd_jsonstructures_mock_test.go
index 0b47109e09..3374cf7fbf 100644
--- a/mdl/executor/cmd_jsonstructures_mock_test.go
+++ b/mdl/executor/cmd_jsonstructures_mock_test.go
@@ -8,6 +8,7 @@ import (
 	"github.com/mendixlabs/mxcli/mdl/ast"
 	"github.com/mendixlabs/mxcli/mdl/backend/mock"
 	"github.com/mendixlabs/mxcli/mdl/types"
+	"github.com/mendixlabs/mxcli/mdl/visitor"
 	"github.com/mendixlabs/mxcli/model"
 )
 
@@ -87,6 +88,45 @@ func TestDescribeJsonStructure_Mock(t *testing.T) {
 	assertContainsStr(t, buf.String(), "create or modify json structure")
 }
 
+// TestDescribeJsonStructure_DocumentationWithCommentEnd: R9 made the doc
+// comment the one spelling describe emits, but a text with `*/` in it ends a
+// doc comment early. Describe keeps the `comment '…'` clause for it, so the
+// statement parses and the documentation reads back unchanged. The control is
+// an ordinary text.
+func TestDescribeJsonStructure_DocumentationWithCommentEnd(t *testing.T) {
+	for _, doc := range []string{"ends */ here", "plain text"} {
+		mod := mkModule("OrderMgmt")
+		js := &types.JsonStructure{
+			BaseElement:   model.BaseElement{ID: nextID("js")},
+			ContainerID:   mod.ID,
+			Name:          "OrderSchema",
+			Documentation: doc,
+			JsonSnippet:   `{"a":1}`,
+		}
+		h := mkHierarchy(mod)
+		withContainer(h, js.ContainerID, mod.ID)
+		mb := &mock.MockBackend{
+			IsConnectedFunc:        func() bool { return true },
+			ListJsonStructuresFunc: func() ([]*types.JsonStructure, error) { return []*types.JsonStructure{js}, nil },
+		}
+		ctx, buf := newMockCtx(t, withBackend(mb), withHierarchy(h))
+		assertNoError(t, describeJsonStructure(ctx, ast.QualifiedName{Module: "OrderMgmt", Name: "OrderSchema"}))
+		prog, errs := visitor.Build(buf.String())
+		if len(errs) > 0 {
+			t.Fatalf("describe of documentation %q does not parse: %v\n%s", doc, errs, buf.String())
+		}
+		var got *ast.CreateJsonStructureStmt
+		for _, s := range prog.Statements {
+			if cs, ok := s.(*ast.CreateJsonStructureStmt); ok {
+				got = cs
+			}
+		}
+		if got == nil || got.Documentation != doc {
+			t.Errorf("documentation %q did not read back; got %+v from:\n%s", doc, got, buf.String())
+		}
+	}
+}
+
 func TestDescribeJsonStructure_NotFound(t *testing.T) {
 	mod := mkModule("OrderMgmt")
 	h := mkHierarchy(mod)

From b518ae72272541d050915a0085beeb4469398382 Mon Sep 17 00:00:00 2001
From: Ako <andrej@koelewijn.net>
Date: Mon, 28 Sep 2026 09:07:58 +0000
Subject: [PATCH 30/35] fix(grammar): an unknown statement word is an error
 only under mdl 1 (R7, ADR-0011)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The helpStatement predicate made a statement that starts with an unknown
word an error under every language version. Under mdl 0 such a statement
parsed as a help topic and did nothing, so a script that ran before stopped
running: CI's skill check failed on three `create constant … default ''
PRIVATE;` in the database-connections skill, whose `PRIVATE;` was one.
ADR-0011 applies a new rejection only under the header.

The predicate now also admits any word when the script is not mdl 1
(IsMdl1Parse: the header is scanned before lexing, and an mdl 1 script is
lexed from a StrictEscapeStream). The visitor keeps building nothing for it
and warns MDL-V1-UNKNOWN, which fmt --upgrade --header lists as unrewritable:
which keyword was meant cannot be guessed. Under mdl 1 the error is at the
word, as before.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../fix-issue/findings/mdl-grammar.jsonl      |  1 +
 CHANGELOG.md                                  |  2 +-
 cmd/mxcli/syntax/features_misc.go             |  7 +++-
 docs-site/src/language/basics.md              |  3 +-
 docs/01-project/MDL_QUICK_REFERENCE.md        |  2 +-
 mdl/grammar/MDLParser.g4                      |  8 ++++
 mdl/grammar/domains/MDLSettings.g4            | 11 ++---
 mdl/upgrade/gated.go                          |  2 +
 mdl/upgrade/gated_test.go                     |  4 +-
 mdl/visitor/visitor_query.go                  |  4 ++
 mdl/visitor/visitor_session_commands_test.go  | 41 +++++++++++++++++--
 mdl/visitor/visitor_unknown_statement.go      | 27 ++++++++++++
 mdl/visitor/visitor_upgrade_fixes.go          |  2 +-
 13 files changed, 98 insertions(+), 16 deletions(-)

diff --git a/.claude/skills/fix-issue/findings/mdl-grammar.jsonl b/.claude/skills/fix-issue/findings/mdl-grammar.jsonl
index 08c61bbc86..4c48ed99ec 100644
--- a/.claude/skills/fix-issue/findings/mdl-grammar.jsonl
+++ b/.claude/skills/fix-issue/findings/mdl-grammar.jsonl
@@ -64,3 +64,4 @@
 {"area": "mdl/grammar", "date": "2026-09-24", "symptom": "`DROP PAGE IF EXISTS FieldService.Stub;` -> `line 1:13 extraneous input 'EXISTS' expecting the start of a statement`. No document-level DROP (35 alternatives: entity through folder) accepted IF EXISTS, so any script that dropped something was one-shot and the drop had to be deleted after its first run (ako/mxcli#531, ChipCoV3, 11.14.0).", "cause": "`dropStatement` in MDLParser.g4 never applied the existing `ifExists` rule; only sub-document drops (attribute, index, enum value) and the two security drops had it, each added one statement at a time with its own AST field and handler branch.", "file": "`mdl/grammar/MDLParser.g4` (dropStatement); `mdl/ast/ast_drop.go` (DropGuard embedded in 35 Drop*Stmt); `mdl/visitor/visitor_entity.go` (ExitDropStatement sets it once, via defer); `mdl/executor/registry.go` (Dispatch turns NotFoundError into a skip); `mdl/executor/validate.go` (check --references skips guarded drops); tests `mdl/executor/drop_if_exists_test.go`; example `mdl-examples/bug-tests/531-drop-if-exists.mdl`", "insight": "The per-statement recipe the previous IF EXISTS fixes used (field + handler branch) would have been 35 copies, and the next doctype would miss it. What made one central guard safe was a measurement, not an assumption: a table test driving every bare DROP at a missing target through the registry showed all 35 handlers already return mdlerrors.NotFoundError, and only at lookup, before any mutation — so Dispatch can key on that type and let every other error through. Keep that bare-form table test: it is what breaks if a new drop handler reports 'not found' with fmt.Errorf. Mock pitfall on the way: MockBackend's Get*ByQualifiedName defaults to (nil, nil), which the real backend never returns for a missing document — mirror its 'not found' error or the handler dereferences nil. And check --references resolved a drop's MODULE, so a guarded drop in a missing module passed exec but failed check until validateWithContext skipped it too."}
 {"area": "mdl/grammar", "date": "2026-09-25", "symptom": "`create java action \u2026(EntityType: entity <String> not null, \u2026)` failed with \"mismatched input 'String' expecting IDENTIFIER\"; Studio Pro accepts a type parameter named after a primitive, so such an action could not be authored, and DESCRIBE of a Studio Pro-authored one printed `returns String`, which re-parses as the primitive.", "cause": "dataType's `ENTITY LESS_THAN IDENTIFIER GREATER_THAN` excluded keyword tokens, and the describer emitted type-parameter names bare where a bare keyword means something else.", "file": "mdl/grammar/domains/MDLDomainModel.g4, mdl/executor/cmd_javaactions.go (formatCodeActionTypeParameterRef)", "insight": "Two halves of one round trip: the declaration slot needed identifierOrKeyword, and the *reference* slots needed no grammar change at all \u2014 a quoted `\"String\"` already parses as a bare qualifiedName, which isTypeParamRef resolves, while unquoted `String` stays the primitive. So the fix on the output side is mdlIdent (which lexes the name with the real lexer) on every type-parameter name DESCRIBE prints. Prove it with a describe \u2192 exec into a second module \u2192 describe diff, not by eyeballing one DESCRIBE.", "refs": ["mendixlabs/mxcli#1183"]}
 {"area": "mdl/grammar", "date": "2026-09-28", "symptom": "A misspelt statement keyword was not an error. `craete module Foo;` and `dorp entity M.E;` parsed cleanly and did nothing (0 statements, exit 0); `craete persistent entity Shop.Note (Text: string(200));` reported `extraneous input '('` at column 35 instead of at the typo.", "cause": "`helpStatement: IDENTIFIER (helpTopicWord (DOT? helpTopicWord)*)?` is a utilityStatement alternative, so ANY statement starting with an IDENTIFIER matched it, the rest of the words as the topic; ExitHelpStatement then built nothing for a word other than help/?/exit/quit. The rule is the grammar's catch-all (the #1025 comment already warned it swallows from other statements); a typo is just the case where there is no other statement.", "file": "`mdl/grammar/MDLParser.g4` (`@parser::members` IsHelpWord), `mdl/grammar/domains/MDLSettings.g4` (semantic predicate on helpStatement), `mdl/visitor/visitor_unknown_statement.go` (\"unknown statement 'x' — did you mean 'y'?\" when the parser is still in statement/program and ANTLR names the one word), test `mdl/visitor/visitor_session_commands_test.go`", "insight": "A catch-all alternative that the visitor filters (`switch word { case \"help\": … }`) is a silent no-op for everything it does not list: move the filter INTO the grammar as a predicate (`{IsHelpWord(p.GetTokenStream().LT(1).GetText())}?`), so the parser, not the visitor, rejects. The words stay IDENTIFIERs — reserving HELP/EXIT/QUIT as tokens would take them away as names everywhere a bare IDENTIFIER is accepted. The generated parser imports no `strings`, so fold case by hand in @members. With the predicate the error lands at the word as `no viable alternative at input 'craete'`, and the listener can rewrite exactly that message when the recognizer's context is StatementContext/ProgramContext. Proof: without the predicate the test reports 3 of 4 inputs parsing to zero statements.", "refs": ["ako/mxcli#755", "mendixlabs/mxcli#1025"]}
+{"area": "mdl/grammar", "date": "2026-09-28", "symptom": "After the helpStatement predicate (R7) made a statement starting with an unknown word an error under every language version, CI's skill check failed on `create constant … default '' PRIVATE;` in the database-connections skill: `PRIVATE;` had always parsed as a help statement and done nothing, so a script following the skill that ran under mdl 0 stopped running.", "cause": "Turning a silent no-op into an error is a new rejection of text accepted today, which ADR-0011 applies only under `mdl 1`. The predicate was ungated because \"the old parse built nothing\" — but a script that ran and built nothing for one line still ran.", "file": "`mdl/grammar/MDLParser.g4` (IsMdl1Parse), `mdl/grammar/domains/MDLSettings.g4` (predicate `IsHelpWord(...) || !IsMdl1Parse(p)`), `mdl/visitor/visitor_unknown_statement.go` (MDL-V1-UNKNOWN), `mdl/upgrade/gated.go` (unrewritable), test `TestMisspeltStatementKeywordWarnsUnderMdl0`", "insight": "A grammar predicate can be gated by language version without parser state: the `mdl <n>;` header is scanned before lexing and an mdl 1 script is lexed from a StrictEscapeStream, so `HasStrictEscapes(p.GetTokenStream().GetTokenSource().GetInputStream())` tells the predicate the version before the header node is ever visited. Before calling a no-op-to-error change ungated, grep the repo's own skills and examples for the no-op: `scripts/check-skill-mdl.sh` found three in one skill.", "refs": ["ako/mxcli#755", "ako/mxcli#780"]}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 889e0b119b..4c7043a656 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -29,7 +29,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ### Fixed
 
-- **A misspelt statement keyword parsed as a help topic** (ako/mxcli#755, R7) — `helpStatement` accepted any word, so `craete module Foo;` parsed without error and did nothing, and `craete entity M.E (…)` reported its error at the `(`. Only `help`, `exit` and `quit` start that statement now, and a statement that starts with an unknown word is reported at the word: `unknown statement 'craete' — did you mean 'create'?`.
+- **A misspelt statement keyword parsed as a help topic** (ako/mxcli#755, R7) — `helpStatement` accepted any word, so `craete module Foo;` parsed without error and did nothing, and `craete entity M.E (…)` reported its error at the `(`. Under `mdl 1;` only `help`, `exit` and `quit` start that statement, and a statement that starts with an unknown word is reported at the word: `unknown statement 'craete' — did you mean 'create'?`. Without the header such a statement still does nothing, as before, and warns **MDL-V1-UNKNOWN** — a stray `PRIVATE;` the database-connections skill taught after `create constant … default ''` was one.
 - **Keyword operators were fused in some stored expressions** — a page action's microflow argument `Flag: $a and $b` was stored as `$aand$b`, `if $x then 'a' else 'b'` as `if$xthen'a'else'b'`; the same in `contentparams` values, `send rest request … with (…)` parameters and a dynamic `execute database query`. Those four places took the expression's text without its whitespace; literals, `+` and `$currentObject` were unaffected, which is why it went unnoticed, and `check --references` passed. Measured by decoding the stored units on a Mendix 11.14.0 project. The expression is now stored as written, with MDL comments removed, as the microflow expression sites already did.
 - **An input bound to an attribute outside any data container was written with no binding** — `textbox t (Attribute: FullName)` at the top of a page (or of a snippet, or inside a plain container) has no entity to qualify the name with, and the writer stored it as `AttributeRef: null`. Plain `check` passed, `exec --no-check` and `alter page … insert` at page level said success, and mxbuild 11.13.0 failed the page with CE0544 "This widget can only function inside a data context" + CE7005 (text box, text area, date picker, check box, radio buttons, drop-down), CE0402 (dynamic text `Attribute:`) or CE0642 (combo box). A qualified attribute there is stored and fails the same way (CE0544 / CE2421 / CE1365 / CE7247 "Move this widget into a data container"). `Attribute: $P/Name` and `Attribute: $currentObject/Name` never parsed as an attribute path and were dropped even inside a data view. `check` now reports all three as **MDL-WIDGET34** (no project needed), and the page builder refuses them with the widget named, so nothing is written; `alter page` refuses a bare name it has no entity for. Place the widget in a data view, list view, gallery or data grid and bind the attribute by name.
 - **An expression property written in brackets was silently dropped** (mendixlabs/mxcli#750) — `dynamicclasses: [ if $currentObject/Featured then 'a' else 'b' ]`, the spelling #750 proposes, parsed as a list that no writer reads: `check` was clean, `exec` said `Created page`, and the widget was stored with no dynamic class. `alter page … set DynamicClasses = [ … ]` said `Altered page` and changed nothing, and a column's `DynamicCellClass` stored the list's text — tokens fused, `[if$x/Ythen'a'else'b']` — as its expression. Measured on a copy of a Mendix 11.14.0 project with the pre-fix binary. `mxcli check` now reports **MDL-WIDGET32** for `DynamicClasses` and `DynamicCellClass` written as a list (no project needed), and ALTER refuses it, so `check -p` reports that too. Write the expression quoted.
diff --git a/cmd/mxcli/syntax/features_misc.go b/cmd/mxcli/syntax/features_misc.go
index ea8549dfe2..0404bd01fe 100644
--- a/cmd/mxcli/syntax/features_misc.go
+++ b/cmd/mxcli/syntax/features_misc.go
@@ -29,8 +29,10 @@ func init() {
 			"-- every statement ends with ';' and '/' is not a terminator; '' is the\n" +
 			"-- only string escape, so a backslash is an ordinary character; and an\n" +
 			"-- unknown or mis-shaped property key in a REST, business event or agent\n" +
-			"-- property list is an error; and a session command (connect, set format,\n" +
-			"-- status, help, …) in a script is an error (MDL-V1-SESSION). A trailing\n" +
+			"-- property list is an error; a session command (connect, set format,\n" +
+			"-- status, help, …) in a script is an error (MDL-V1-SESSION); and a\n" +
+			"-- statement that starts with an unknown word (`craete …`) is an error at\n" +
+			"-- the word, where mdl 0 did nothing with it (MDL-V1-UNKNOWN). A trailing\n" +
 			"-- comma is allowed in every bracketed list, with or without the header.\n" +
 			"--\n" +
 			"-- A script's meaning never depends on which mxcli release runs it: a\n" +
@@ -45,6 +47,7 @@ func init() {
 			"-- says why, when a construct has no rewrite: an unknown or mis-shaped\n" +
 			"-- property (MDL-V1-PROP/PROPVALUE), `create or replace view entity`\n" +
 			"-- (MDL-V1-REPLACE01), a session command in a script (MDL-V1-SESSION), a\n" +
+			"-- statement that starts with an unknown word (MDL-V1-UNKNOWN), a\n" +
 			"-- nested list operation, find/contains on a variable\n" +
 			"-- whose type the script does not state, and an escaped line break inside\n" +
 			"-- an expression.\n" +
diff --git a/docs-site/src/language/basics.md b/docs-site/src/language/basics.md
index e98cddc21b..04e09ad843 100644
--- a/docs-site/src/language/basics.md
+++ b/docs-site/src/language/basics.md
@@ -79,6 +79,7 @@ What `mdl 1` makes strict (each is a warning without the header, with the code s
 | In a REST client, published REST service, business event service, model, knowledge base, consumed MCP service or agent, an unknown property key is an error that names the key it most likely meant, and so is a value its key does not take (`Response: json from $X`). | The property is ignored, or read by its shape as before; `MDL-V1-PROP` / `MDL-V1-PROPVALUE`. |
 | A `while` loop is `while <condition> begin … end while;`; leaving out `begin`, or the `while` after `end`, is an error. | Accepted; `MDL-V1-WHILE`. |
 | A session command — `connect`, `disconnect`, `use`, `set format = …`, `status`, `check`, `build`, `lint`, `debug`, `execute script`, `execute runtime`, `help`, `introspect api` — is an error in a script. Type it at the REPL, or use the command-line flag (`mxcli exec script.mdl -p app.mpr --json`). The REPL keeps accepting them. | Runs as before; `MDL-V1-SESSION`. |
+| A statement that starts with an unknown word (`craete module Foo;`, a stray `PRIVATE;`) is an error at the word: `unknown statement 'craete' — did you mean 'create'?`. | Does nothing, as before; `MDL-V1-UNKNOWN`. |
 
 ### Upgrading a script: `mxcli fmt --upgrade`
 
@@ -103,7 +104,7 @@ mxcli fmt --upgrade --header -w script.mdl  # also add `mdl 1;`
 | `MDL-V1-REPLACE02` | `create or replace user role` / `demo user` becomes a plain `create` |
 | `MDL-V1-WHILE` | inserts the missing `begin` after a `while` condition and `while` after its `end` |
 
-A construct with no mechanical rewrite is reported with the reason, and `fmt` refuses to add the header rather than change the script's meaning: an unknown or mis-shaped property (`MDL-V1-PROP`, `MDL-V1-PROPVALUE`), `create or replace view entity` (`MDL-V1-REPLACE01`), a session command in a script (`MDL-V1-SESSION`: move it to the command line or the REPL), a nested list operation such as `count(filter(…))`, `find`/`contains` on a variable whose type the script does not state, and an escaped line break (`\n`) inside an expression. While `mdl 1` is a preview, the header is added only when asked. Running `fmt --upgrade` on its own output changes nothing.
+A construct with no mechanical rewrite is reported with the reason, and `fmt` refuses to add the header rather than change the script's meaning: an unknown or mis-shaped property (`MDL-V1-PROP`, `MDL-V1-PROPVALUE`), `create or replace view entity` (`MDL-V1-REPLACE01`), a session command in a script (`MDL-V1-SESSION`: move it to the command line or the REPL), a statement that starts with an unknown word (`MDL-V1-UNKNOWN`: correct the keyword or delete it), a nested list operation such as `count(filter(…))`, `find`/`contains` on a variable whose type the script does not state, and an escaped line break (`\n`) inside an expression. While `mdl 1` is a preview, the header is added only when asked. Running `fmt --upgrade` on its own output changes nothing.
 
 The design is in [ADR-0011](https://github.com/mendixlabs/mxcli/blob/main/docs/13-decisions/0011-mdl-language-versioning.md); `mxcli syntax language-header` has the details.
 
diff --git a/docs/01-project/MDL_QUICK_REFERENCE.md b/docs/01-project/MDL_QUICK_REFERENCE.md
index 156208da5e..b82c397a53 100644
--- a/docs/01-project/MDL_QUICK_REFERENCE.md
+++ b/docs/01-project/MDL_QUICK_REFERENCE.md
@@ -15,7 +15,7 @@ create persistent entity Sales.Customer ( Name: String(200) );
 
 ## Session commands — the REPL, not a script
 
-`connect`, `disconnect`, `use`, `set format = …`, `status`, `check`, `build`, `lint`, `debug`, `execute script`, `execute runtime`, `help` and `introspect api` set up or inspect the session. Type them at the REPL, or use the command-line flags; a `.mdl` script holds model statements only. Under `mdl 1;` a session command in a script is an error; without the header it runs and warns `MDL-V1-SESSION`. `exit` / `quit` are not session commands.
+`connect`, `disconnect`, `use`, `set format = …`, `status`, `check`, `build`, `lint`, `debug`, `execute script`, `execute runtime`, `help` and `introspect api` set up or inspect the session. Type them at the REPL, or use the command-line flags; a `.mdl` script holds model statements only. Under `mdl 1;` a session command in a script is an error; without the header it runs and warns `MDL-V1-SESSION`. `exit` / `quit` are not session commands. A statement that starts with an unknown word (`craete module Foo;`) is an error at the word under `mdl 1;`; without the header it does nothing, as before, and warns `MDL-V1-UNKNOWN`.
 
 ```bash
 mxcli exec changes.mdl -p app.mpr --json     # not: connect local 'app.mpr'; set format = json; in the script
diff --git a/mdl/grammar/MDLParser.g4 b/mdl/grammar/MDLParser.g4
index 24bc7b5127..41cf884a1b 100644
--- a/mdl/grammar/MDLParser.g4
+++ b/mdl/grammar/MDLParser.g4
@@ -42,6 +42,14 @@ func IsHelpWord(word string) bool {
 	}
 	return false
 }
+
+// IsMdl1Parse reports whether p reads a script written in mdl 1 or later. The
+// `mdl <n>;` header is scanned before lexing, and a script under mdl 1 is
+// lexed from a StrictEscapeStream (MDLLexer.g4); the stream is how that
+// decision reaches a predicate, which runs before the header is visited.
+func IsMdl1Parse(p *MDLParser) bool {
+	return HasStrictEscapes(p.GetTokenStream().GetTokenSource().GetInputStream())
+}
 }
 
 import
diff --git a/mdl/grammar/domains/MDLSettings.g4 b/mdl/grammar/domains/MDLSettings.g4
index cc0475bac3..cb40899054 100644
--- a/mdl/grammar/domains/MDLSettings.g4
+++ b/mdl/grammar/domains/MDLSettings.g4
@@ -283,11 +283,12 @@ linkMapping
  * CREATE MODULE ROLE alternative wins as it did before.
  */
 helpStatement
-    // Only `help`, `exit` and `quit` start one (IsHelpWord, MDLParser.g4).
-    // Without the predicate every IDENTIFIER did, so `craete entity M.E;`
-    // was a help statement with a topic, parsed without error and dropped
-    // (ako/mxcli#755, R7).
-    : {IsHelpWord(p.GetTokenStream().LT(1).GetText())}?
+    // Under mdl 1 only `help`, `exit` and `quit` start one (IsHelpWord,
+    // MDLParser.g4). Without the predicate every IDENTIFIER did, so `craete
+    // entity M.E;` was a help statement with a topic, parsed without error and
+    // dropped (ako/mxcli#755, R7). The rejection is new, so under mdl 0 the
+    // rule still takes any word and the visitor warns (ADR-0011).
+    : {IsHelpWord(p.GetTokenStream().LT(1).GetText()) || !IsMdl1Parse(p)}?
       IDENTIFIER (helpTopicWord (DOT? helpTopicWord)*)?  // HELP [topic]
     ;
 
diff --git a/mdl/upgrade/gated.go b/mdl/upgrade/gated.go
index 38dffc32f2..e11abd4a63 100644
--- a/mdl/upgrade/gated.go
+++ b/mdl/upgrade/gated.go
@@ -47,6 +47,8 @@ var unrewritable = map[string]string{
 	"MDL-V1-REPLACE01": "`create or replace view entity` drops and recreates the view entity under mdl 0, " +
 		"which no mdl 1 statement does: write `create or modify view entity` to keep its identity, or " +
 		"`drop entity` then `create view entity` to discard it",
+	"MDL-V1-UNKNOWN": "a statement that starts with an unknown word does nothing under mdl 0 and is an error " +
+		"under mdl 1; which keyword was meant cannot be guessed, so correct it or delete the statement by hand",
 	"MDL-V1-SESSION": "a session command (`connect`, `set format`, `status`, `help`, …) is refused in an mdl 1 " +
 		"script, and no model statement does what it does: move it out of the script, to the command line " +
 		"(`-p app.mpr` to connect, `--json` for the output format) or the REPL",
diff --git a/mdl/upgrade/gated_test.go b/mdl/upgrade/gated_test.go
index 7ffb34e58c..71ec0945b1 100644
--- a/mdl/upgrade/gated_test.go
+++ b/mdl/upgrade/gated_test.go
@@ -189,8 +189,10 @@ func TestUpgrade_ListCallFormToStatementForm(t *testing.T) {
 func TestGatedRegistryIsComplete(t *testing.T) {
 	// MDL-V1-SESSION (R7, ako/mxcli#755) was added with its change: moving a
 	// session command out of a script is a decision about how the script is run.
+	// MDL-V1-UNKNOWN (R7, ako/mxcli#755) likewise: which keyword a misspelt
+	// word was meant to be cannot be guessed.
 	pinned := map[string]bool{"MDL-V1-PROP": true, "MDL-V1-PROPVALUE": true, "MDL-V1-REPLACE01": true,
-		"MDL-V1-SESSION": true}
+		"MDL-V1-SESSION": true, "MDL-V1-UNKNOWN": true}
 	known := map[string]bool{}
 	for _, c := range visitor.LanguageChanges() {
 		known[c.Code] = true
diff --git a/mdl/visitor/visitor_query.go b/mdl/visitor/visitor_query.go
index aac02877eb..3d66514a17 100644
--- a/mdl/visitor/visitor_query.go
+++ b/mdl/visitor/visitor_query.go
@@ -1371,6 +1371,10 @@ func (b *Builder) ExitHelpStatement(ctx *parser.HelpStatementContext) {
 			b.statements = append(b.statements, stmt)
 		case "exit", "quit":
 			b.statements = append(b.statements, &ast.ExitStmt{})
+		default:
+			// Only under mdl 0 does the grammar take another word here: the
+			// statement builds nothing, as it always has, and warns.
+			b.noteUnknownStatementWord(ctx, id.GetText())
 		}
 	}
 }
diff --git a/mdl/visitor/visitor_session_commands_test.go b/mdl/visitor/visitor_session_commands_test.go
index fe4ef609b4..08c21d451b 100644
--- a/mdl/visitor/visitor_session_commands_test.go
+++ b/mdl/visitor/visitor_session_commands_test.go
@@ -13,7 +13,8 @@ import (
 // grammar's catch-all, so a misspelt statement keyword was a HELP statement.
 // `craete module Foo;` parsed cleanly into nothing at all — the visitor dropped
 // a help statement whose word was not help/exit/quit — and `craete entity
-// M.E (…)` reported its error at the `(`, far from the typo.
+// M.E (…)` reported its error at the `(`, far from the typo. Under mdl 1 the
+// word is an error, reported where it is.
 func TestMisspeltStatementKeywordIsAnErrorAtTheWord(t *testing.T) {
 	for _, tc := range []struct {
 		input string
@@ -24,15 +25,15 @@ func TestMisspeltStatementKeywordIsAnErrorAtTheWord(t *testing.T) {
 		{"craete persistent entity Shop.Note (Text: string(200));", "create"},
 		{"descibe entity M.E;", "describe"},
 	} {
-		prog, errs := Build(tc.input)
+		prog, errs := Build("mdl 1;\n" + tc.input)
 		if len(errs) == 0 {
 			t.Errorf("%q: parsed without error into %d statement(s); a misspelt keyword must be an error",
 				tc.input, len(prog.Statements))
 			continue
 		}
 		first := errs[0].Error()
-		if !strings.HasPrefix(first, "line 1:0 ") {
-			t.Errorf("%q: first error is not at the misspelt word (line 1:0): %s", tc.input, first)
+		if !strings.HasPrefix(first, "line 2:0 ") {
+			t.Errorf("%q: first error is not at the misspelt word (line 2:0): %s", tc.input, first)
 		}
 		word := strings.Fields(tc.input)[0]
 		want := "unknown statement '" + word + "' — did you mean '" + tc.near + "'?"
@@ -42,6 +43,38 @@ func TestMisspeltStatementKeywordIsAnErrorAtTheWord(t *testing.T) {
 	}
 }
 
+// ADR-0011: the rejection is new, so it applies only under mdl 1. Without the
+// header a statement the catch-all accepted — it built nothing — still parses
+// into nothing, and warns MDL-V1-UNKNOWN; one it did not accept is the error it
+// always was. Scripts following a skill that taught `… default ” PRIVATE;`
+// ran under mdl 0, the `PRIVATE;` being such a statement.
+func TestMisspeltStatementKeywordWarnsUnderMdl0(t *testing.T) {
+	for _, in := range []string{"craete module Foo;", "PRIVATE;", "descibe entity M.E;"} {
+		prog, errs := Build("create module A;\n" + in + "\ncreate module B;")
+		if len(errs) > 0 {
+			t.Errorf("%q: an error under mdl 0: %v", in, errs)
+			continue
+		}
+		if len(prog.Statements) != 2 {
+			t.Errorf("%q: %d statements, want the two around it", in, len(prog.Statements))
+		}
+		var note *ast.LanguageNote
+		for i := range prog.LanguageNotes {
+			if prog.LanguageNotes[i].Code == "MDL-V1-UNKNOWN" {
+				note = &prog.LanguageNotes[i]
+			}
+		}
+		if note == nil || note.Line != 2 || !strings.Contains(note.Message, strings.Fields(strings.TrimSuffix(in, ";"))[0]) {
+			t.Errorf("%q: want an MDL-V1-UNKNOWN warning on line 2 naming the word, got %+v", in, prog.LanguageNotes)
+		}
+	}
+	// Control: a misspelt statement the catch-all never accepted was an error
+	// under mdl 0 before, and stays one.
+	if _, errs := Build("craete persistent entity Shop.Note (Text: string(200));"); len(errs) == 0 {
+		t.Error("a misspelt create with a body parsed under mdl 0")
+	}
+}
+
 // The words the rule exists for still parse, with and without a topic, in any
 // letter case.
 func TestSessionWordsStillParse(t *testing.T) {
diff --git a/mdl/visitor/visitor_unknown_statement.go b/mdl/visitor/visitor_unknown_statement.go
index 6f301f9dd1..6d75a9944f 100644
--- a/mdl/visitor/visitor_unknown_statement.go
+++ b/mdl/visitor/visitor_unknown_statement.go
@@ -7,6 +7,7 @@ import (
 
 	"github.com/antlr4-go/antlr/v4"
 	"github.com/mendixlabs/mxcli/mdl/grammar/parser"
+	"github.com/mendixlabs/mxcli/mdl/langver"
 	"github.com/mendixlabs/mxcli/mdl/suggest"
 )
 
@@ -51,3 +52,29 @@ func unknownStatementMessage(word string) string {
 	}
 	return msg + " — a statement starts with a keyword such as create, alter, drop, describe or list"
 }
+
+// unknownStatementWordIsAnError is the new rejection of a statement that
+// starts with an unknown word (R7). Under mdl 0 the help statement took any
+// word, so `craete module Foo;` or a stray `PRIVATE;` parsed into nothing; a
+// committed script that ran under mdl 0 keeps running (ADR-0011).
+var unknownStatementWordIsAnError = langver.Change{
+	Code:  "MDL-V1-UNKNOWN",
+	Since: langver.V1,
+	Old:   "a statement that starts with an unknown word does nothing",
+	New:   "an error at the word: correct the misspelt keyword, or delete the statement",
+}
+
+// noteUnknownStatementWord warns about a statement the mdl 0 grammar took as a
+// help statement because it starts with an unknown word. Under mdl 1 the
+// grammar refuses it, so this is reached only without the header; should it be
+// reached under mdl 1, it is the error the grammar gives.
+func (b *Builder) noteUnknownStatementWord(ctx antlr.ParserRuleContext, word string) {
+	if b.gate(unknownStatementWordIsAnError, ctx) {
+		b.addError(fmt.Errorf("line %d:%d %s", ctx.GetStart().GetLine(), ctx.GetStart().GetColumn(),
+			unknownStatementMessage(word)))
+		return
+	}
+	if n := len(b.langNotes); n > 0 && b.langNotes[n-1].Code == unknownStatementWordIsAnError.Code {
+		b.langNotes[n-1].Message = unknownStatementMessage(word) + ": " + b.langNotes[n-1].Message
+	}
+}
diff --git a/mdl/visitor/visitor_upgrade_fixes.go b/mdl/visitor/visitor_upgrade_fixes.go
index a6a669d8d0..ce8aa2488f 100644
--- a/mdl/visitor/visitor_upgrade_fixes.go
+++ b/mdl/visitor/visitor_upgrade_fixes.go
@@ -31,7 +31,7 @@ func LanguageChanges() []langver.Change {
 	return []langver.Change{
 		semicolonRequired, slashIsNotATerminator, backslashIsLiteral, limitOneIsAList,
 		listCallForm, setIsMandatory, viewEntityReplaceIsModify, roleReplaceIsModify, whileBlockRequired,
-		unknownPropertyKey, misshapedPropertyValue, sessionCommandInScript,
+		unknownPropertyKey, misshapedPropertyValue, sessionCommandInScript, unknownStatementWordIsAnError,
 	}
 }
 

From 6d681d28a86d905bfada34b7143ea9c86f3e7647 Mon Sep 17 00:00:00 2001
From: Ako <andrej@koelewijn.net>
Date: Mon, 28 Sep 2026 09:07:58 +0000
Subject: [PATCH 31/35] docs(skills): drop the PRIVATE flag the
 database-connections skill taught (#755)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`create constant … default '' PRIVATE;` never set anything: `PRIVATE;`
parsed as a separate help statement and did nothing, which R7 now reports.
MDL has no private flag on a constant; the advice is to leave the default
empty and set the value per environment.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .claude/skills/mendix/database-connections/SKILL.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.claude/skills/mendix/database-connections/SKILL.md b/.claude/skills/mendix/database-connections/SKILL.md
index 438900d2a6..d5ebc3fd6c 100644
--- a/.claude/skills/mendix/database-connections/SKILL.md
+++ b/.claude/skills/mendix/database-connections/SKILL.md
@@ -230,7 +230,7 @@ create constant OracleDemo.OracleConnectionString type string
 
 create constant OracleDemo.OracleUser type string default 'scott';
 
-create constant OracleDemo.OraclePassword type string default 'tiger' PRIVATE;
+create constant OracleDemo.OraclePassword type string default 'tiger';
 
 -- Step 3: Create non-persistent entity for results
 create non-persistent entity OracleDemo.EmpRecord (
@@ -271,7 +271,7 @@ create constant Inventory.PgConnectionString type string
   default 'jdbc:postgresql://localhost:5432/inventory_db';
 
 create constant Inventory.PgUser type string default 'inventory_app';
-create constant Inventory.PgPassword type string default '' PRIVATE;
+create constant Inventory.PgPassword type string default '';
 
 create non-persistent entity Inventory.ProductRecord (
   ProductId: integer,
@@ -329,7 +329,7 @@ describe database connection MyModule.MyDatabase;
 - Use `MX_Module_ConstantName` environment variables in production
 
 ### 2. Credential Security
-- Use `PRIVATE` flag for password constants during development
+- Leave a password constant's default empty (`default ''`) and set the value per environment; MDL has no private flag, and a trailing `PRIVATE` was never read
 - Never commit real passwords to version control
 - Inject credentials via CI/CD pipelines in production
 
@@ -461,7 +461,7 @@ create non-persistent entity HR.EmployeeRecord (
 
 create constant HR.DbUrl type string default 'jdbc:postgresql://localhost:5432/hrdb';
 create constant HR.DbUser type string default 'app';
-create constant HR.DbPass type string default '' PRIVATE;
+create constant HR.DbPass type string default '';
 
 create database connection HR.MainDB
 type 'PostgreSQL'

From 2fa0d670440120d244aa3406cf852e8af65596da Mon Sep 17 00:00:00 2001
From: Ako <andrej@koelewijn.net>
Date: Mon, 28 Sep 2026 09:19:39 +0000
Subject: [PATCH 32/35] test(odata client): pin the stored-document carry in
 UpdateConsumedODataService (#743)

The overlay's tests call carryStoredConsumedODataService directly, so
dropping its call from the write path left the unit suite green. This test
goes through UpdateConsumedODataService on a fixture and fails with the
call removed (UseQuerySegment reset, Icon dropped).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../odata_client_carry_wiring_test.go         | 83 +++++++++++++++++++
 1 file changed, 83 insertions(+)
 create mode 100644 mdl/backend/modelsdk/odata_client_carry_wiring_test.go

diff --git a/mdl/backend/modelsdk/odata_client_carry_wiring_test.go b/mdl/backend/modelsdk/odata_client_carry_wiring_test.go
new file mode 100644
index 0000000000..8e6ea6866d
--- /dev/null
+++ b/mdl/backend/modelsdk/odata_client_carry_wiring_test.go
@@ -0,0 +1,83 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package modelsdkbackend
+
+import (
+	"testing"
+
+	"go.mongodb.org/mongo-driver/bson"
+
+	"github.com/mendixlabs/mxcli/mdl/backend/bsonnav"
+	"github.com/mendixlabs/mxcli/model"
+)
+
+// TestUpdateConsumedODataService_CarriesStoredDocument pins the wiring of
+// carryStoredConsumedODataService into UpdateConsumedODataService (#743). The
+// overlay's own tests call it directly, so without this one the call could be
+// dropped from the write path and only the integration round trip would see it.
+func TestUpdateConsumedODataService_CarriesStoredDocument(t *testing.T) {
+	b := New()
+	if err := b.Connect(copyFixture(t)); err != nil {
+		t.Fatalf("connect: %v", err)
+	}
+	t.Cleanup(func() { _ = b.Disconnect() })
+	mod, err := b.GetModuleByName("MyFirstModule")
+	if err != nil || mod == nil {
+		t.Fatalf("GetModuleByName: %v", err)
+	}
+	svc := &model.ConsumedODataService{
+		ContainerID:       mod.ID,
+		Name:              "ZzClient",
+		ServiceName:       "ZzClient",
+		ODataVersion:      "OData4",
+		TimeoutExpression: "300",
+		ProxyType:         "DefaultProxy",
+	}
+	if err := b.CreateConsumedODataService(svc); err != nil {
+		t.Fatalf("CreateConsumedODataService: %v", err)
+	}
+
+	// Stand in for a Studio Pro client: UseQuerySegment true and an Icon, neither
+	// of which the model holds.
+	raw, err := b.reader.GetRawUnitBytes(string(svc.ID))
+	if err != nil {
+		t.Fatalf("GetRawUnitBytes: %v", err)
+	}
+	var d bson.D
+	if err := bson.Unmarshal(raw, &d); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	bsonnav.DSet(d, "UseQuerySegment", true)
+	d = append(d, bson.E{Key: "Icon", Value: []byte{0x89, 'P', 'N', 'G'}})
+	out, err := bson.Marshal(d)
+	if err != nil {
+		t.Fatalf("marshal: %v", err)
+	}
+	if err := b.writer.UpdateRawUnit(string(svc.ID), out); err != nil {
+		t.Fatalf("UpdateRawUnit: %v", err)
+	}
+
+	svc.TimeoutExpression = "60"
+	if err := b.UpdateConsumedODataService(svc); err != nil {
+		t.Fatalf("UpdateConsumedODataService: %v", err)
+	}
+
+	raw, err = b.reader.GetRawUnitBytes(string(svc.ID))
+	if err != nil {
+		t.Fatalf("GetRawUnitBytes: %v", err)
+	}
+	var after bson.D
+	if err := bson.Unmarshal(raw, &after); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if v, _ := bsonnav.DGet(after, "UseQuerySegment").(bool); !v {
+		t.Errorf("UseQuerySegment = %v, want the stored true", bsonnav.DGet(after, "UseQuerySegment"))
+	}
+	if bsonnav.DGet(after, "Icon") == nil {
+		t.Errorf("Icon dropped by the rewrite")
+	}
+	// Control: the authored change still lands.
+	if got := bsonnav.DGetString(after, "TimeoutExpression"); got != "60" {
+		t.Errorf("TimeoutExpression = %q, want the declared 60", got)
+	}
+}

From 0e7ecc03094d91fce647a54747ed0392fbb1a0bd Mon Sep 17 00:00:00 2001
From: Ako <andrej@koelewijn.net>
Date: Mon, 28 Sep 2026 09:27:48 +0000
Subject: [PATCH 33/35] merge: one CHANGELOG entry for the #753 grant change
 (#777's revision)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md | 1 -
 1 file changed, 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 41eba3ad07..66dd9388c3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,7 +15,6 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - **Document types are named as Studio Pro names them** (ako/mxcli#755, R10) — `consumed rest service` (was `rest client`), `consumed odata service` (was `odata client`), `published odata service` (was `odata service`), `task queue` (was `queue`), `alter app security` (was `alter project security`) and `alter settings runtime` (was `alter settings model`), in every statement that names the type: create, alter, drop, describe, list, move, grant/revoke on a published OData service, and an external entity's `from consumed odata service`. `describe` writes the new names. **Migrating a script:** nothing breaks — the old names still parse and build the identical statement, `check` / `exec` warn **MDL-DEPR550** to **MDL-DEPR555**, and `mxcli fmt --upgrade` rewrites them. `call microflow … in queue M.Q` is a call option, not the type name, and is unchanged.
 
 - **Integration documents put properties in `( )` and children in `{ }`; an `alter microflow` fragment is `begin … end`** (ako/mxcli#754, R2) — a consumed REST service's operations are `operation GetUser ( Method: get, Path: '/u/{id}', Response: none )`; an agent's attachments are `tool X ( … )`, `mcp service M.S ( … )` and `knowledge base K ( … )`, in `create agent` and `alter agent … add`; an image collection is `create image collection M.Icons { image Logo ( File: 'logo.png' ) }`; a message definition collection is `{ definition D for M.E { A, M.E_B/M.B { C } } }`, and an association may select no member (`M.E_B/M.B { }`, which describe already printed as the unparseable `()`); and `alter microflow` / `alter nanoflow` take `insert after <target> begin … end;` and `replace <target> with begin … end;`, the fragment written as the body of `create microflow` is. `describe` prints the new forms. **Migrating a script:** nothing breaks — the old brackets still parse and build the identical statement, `check` / `exec` warn **MDL-DEPR070** (operation), **MDL-DEPR071** (agent attachment), **MDL-DEPR072** (image collection), **MDL-DEPR073** (message definitions) and **MDL-DEPR074** (alter fragment), once per statement, and `mxcli fmt --upgrade` rewrites them.
-- **An entity grant names the rights first, and every XPath is written in `[ ]`** (ako/mxcli#753, R5) — `grant read *, write (Email), create on entity Shop.Order to Shop.User where [Status = 'Open'];` takes the word order of every other grant, and the constraint is bracketed like a datasource or retrieve `where`, so the quotes inside it are written once instead of doubled. A workflow user task's targeting is the same: `targeting users xpath [System.UserRoles = '[%UserRole_Manager%]']`, and `alter workflow … set activity … targeting xpath [ … ]`. Sibling predicate groups (`[a][b]`) are one constraint, kept as written. `describe entity` and `describe workflow` print the new forms; a stored constraint the bracketed grammar does not read (none in the Studio Pro-authored PedApp and TestApp fixtures) is printed in the old quoted form so the output stays re-executable. **Migrating a script:** nothing breaks — `grant Shop.User on Shop.Order (read *) where '[…]'` and `targeting xpath '[…]'` still parse and build the same rule, and `check` / `exec` warn **MDL-DEPR030** and **MDL-DEPR031**; `mxcli fmt --upgrade` rewrites both. A quoted value that is not a bracketed XPath is left in place and reported. `revoke` keeps its current form for now.
 - **An entity grant names the rights first, and every XPath is written in `[ ]`** (ako/mxcli#753, R5) — `grant read *, write (Email), create on entity Shop.Order to Shop.User where [Status = 'Open'];` takes the word order of every other grant, and the constraint is bracketed like a datasource or retrieve `where`, so the quotes inside it are written once instead of doubled. A workflow user task's targeting is the same: `targeting users xpath [System.UserRoles = '[%UserRole_Manager%]']`, and `alter workflow … set activity … targeting xpath [ … ]`. Sibling predicate groups (`[a][b]`) are one constraint, kept as written. `describe entity` and `describe workflow` print the new forms; a stored constraint the bracketed grammar does not read (none in the Studio Pro-authored PedApp and TestApp fixtures) is printed in the old quoted form so the output stays re-executable. **Migrating a script:** nothing breaks — `grant Shop.User on Shop.Order (read *) where '[…]'` and `targeting xpath '[…]'` still parse and build the same rule, and `check` / `exec` warn **MDL-DEPR030** and **MDL-DEPR031**; `mxcli fmt --upgrade` rewrites both. A quoted value that is not a bracketed XPath is left in place and reported.
 - **A microflow error handler is `on error [without rollback] begin … end error`; `while` takes `begin … end while` like `loop`** (ako/mxcli#754, R2) — braces hold declarative children and imperative flow is `begin … end <keyword>`, and the error handler was the only brace block inside a microflow. `describe microflow` / `describe nanoflow` now print `commit $O on error begin … end error;` (an empty handler `… on error without rollback begin end error;`), and so do the generated test flows of `mxcli test`. Under the `mdl 1;` preview header a `while` without `begin`, or ending in a bare `end`, is an error; without the header it keeps parsing and warns **MDL-V1-WHILE**, and `mxcli fmt --upgrade --header` inserts the missing words. Measured on the Studio Pro-authored PedApp and TestApp fixtures: the round-trip harness stays green. **Migrating a script:** nothing breaks — `on error { … }` still parses, builds the identical handler, and `check` / `exec` warn **MDL-DEPR540**; `mxcli fmt --upgrade` rewrites it.
 - **One argument form at every call site: `Param = expression`; one text-template form: `with ({1} = …)`** (ako/mxcli#751, R3/R4) — `call microflow`/`nanoflow`/`java action`/…, `execute database query`, `send rest request`, `show page`, and page/button actions and microflow/nanoflow data sources all bind an argument as `Order = $Order`, with no `$` on the parameter name and `=` rather than `:`. A workflow's `call microflow` / `call workflow` takes its arguments the same way, right after the callee, as bare expressions: `call microflow Shop.ACT_Process(Order = $WorkflowContext) as act1 comment 'Process'`. `show message` and `validation feedback` take `with ({1} = $a, {2} = $b)`, like `log` and the REST templates. `describe` writes these forms; it also writes a validation feedback's template arguments, which it used to drop, so describe → exec lost them. Measured on a copy of the Studio Pro-authored TestApp (Mendix 11.14.0): a script in the new forms and the same script in the old forms describe identically, and `mx check` reports 0 errors. **Migrating a script:** nothing breaks — `$Param = e` (**MDL-DEPR006**), `Param: e` (**MDL-DEPR007**), a workflow's `with (Param = '<expression>')` (**MDL-DEPR008**, same meaning: the string's content is the expression) and `objects [..]` / `parameters [..]` (**MDL-DEPR009**) still parse and build the same model, `check` / `exec` warn, and `mxcli fmt --upgrade` rewrites them. A workflow string whose content does not read back as the same bare expression is left in place and reported, and `describe` keeps the string form for such a stored expression.

From dd977eea06fd91b7e1823d208e287184c2027c1e Mon Sep 17 00:00:00 2001
From: Ako <andrej@koelewijn.net>
Date: Mon, 28 Sep 2026 09:37:36 +0000
Subject: [PATCH 34/35] Revert "fix(grammar): an unknown statement word is an
 error only under mdl 1"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A misspelt statement keyword (`craete entity …`) used to parse as a help
statement and build nothing. Rejecting it changes no script's meaning: it
is the same class as the dead grammar #706 removed ungated (proposal §5
items 7-8, forms that never worked). Gating it behind mdl 1 also left REPL
typos silent, because a REPL line never carries a header. So it is an
error at the word under both versions again, as bf0d1d38 had it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../fix-issue/findings/mdl-grammar.jsonl      |  1 -
 CHANGELOG.md                                  |  2 +-
 cmd/mxcli/syntax/features_misc.go             |  7 +---
 docs-site/src/language/basics.md              |  3 +-
 docs/01-project/MDL_QUICK_REFERENCE.md        |  2 +-
 mdl/grammar/MDLParser.g4                      |  8 ----
 mdl/grammar/domains/MDLSettings.g4            | 11 +++--
 mdl/upgrade/gated.go                          |  2 -
 mdl/upgrade/gated_test.go                     |  4 +-
 mdl/visitor/visitor_query.go                  |  4 --
 mdl/visitor/visitor_session_commands_test.go  | 41 ++-----------------
 mdl/visitor/visitor_unknown_statement.go      | 27 ------------
 mdl/visitor/visitor_upgrade_fixes.go          |  2 +-
 13 files changed, 16 insertions(+), 98 deletions(-)

diff --git a/.claude/skills/fix-issue/findings/mdl-grammar.jsonl b/.claude/skills/fix-issue/findings/mdl-grammar.jsonl
index 4c48ed99ec..08c61bbc86 100644
--- a/.claude/skills/fix-issue/findings/mdl-grammar.jsonl
+++ b/.claude/skills/fix-issue/findings/mdl-grammar.jsonl
@@ -64,4 +64,3 @@
 {"area": "mdl/grammar", "date": "2026-09-24", "symptom": "`DROP PAGE IF EXISTS FieldService.Stub;` -> `line 1:13 extraneous input 'EXISTS' expecting the start of a statement`. No document-level DROP (35 alternatives: entity through folder) accepted IF EXISTS, so any script that dropped something was one-shot and the drop had to be deleted after its first run (ako/mxcli#531, ChipCoV3, 11.14.0).", "cause": "`dropStatement` in MDLParser.g4 never applied the existing `ifExists` rule; only sub-document drops (attribute, index, enum value) and the two security drops had it, each added one statement at a time with its own AST field and handler branch.", "file": "`mdl/grammar/MDLParser.g4` (dropStatement); `mdl/ast/ast_drop.go` (DropGuard embedded in 35 Drop*Stmt); `mdl/visitor/visitor_entity.go` (ExitDropStatement sets it once, via defer); `mdl/executor/registry.go` (Dispatch turns NotFoundError into a skip); `mdl/executor/validate.go` (check --references skips guarded drops); tests `mdl/executor/drop_if_exists_test.go`; example `mdl-examples/bug-tests/531-drop-if-exists.mdl`", "insight": "The per-statement recipe the previous IF EXISTS fixes used (field + handler branch) would have been 35 copies, and the next doctype would miss it. What made one central guard safe was a measurement, not an assumption: a table test driving every bare DROP at a missing target through the registry showed all 35 handlers already return mdlerrors.NotFoundError, and only at lookup, before any mutation — so Dispatch can key on that type and let every other error through. Keep that bare-form table test: it is what breaks if a new drop handler reports 'not found' with fmt.Errorf. Mock pitfall on the way: MockBackend's Get*ByQualifiedName defaults to (nil, nil), which the real backend never returns for a missing document — mirror its 'not found' error or the handler dereferences nil. And check --references resolved a drop's MODULE, so a guarded drop in a missing module passed exec but failed check until validateWithContext skipped it too."}
 {"area": "mdl/grammar", "date": "2026-09-25", "symptom": "`create java action \u2026(EntityType: entity <String> not null, \u2026)` failed with \"mismatched input 'String' expecting IDENTIFIER\"; Studio Pro accepts a type parameter named after a primitive, so such an action could not be authored, and DESCRIBE of a Studio Pro-authored one printed `returns String`, which re-parses as the primitive.", "cause": "dataType's `ENTITY LESS_THAN IDENTIFIER GREATER_THAN` excluded keyword tokens, and the describer emitted type-parameter names bare where a bare keyword means something else.", "file": "mdl/grammar/domains/MDLDomainModel.g4, mdl/executor/cmd_javaactions.go (formatCodeActionTypeParameterRef)", "insight": "Two halves of one round trip: the declaration slot needed identifierOrKeyword, and the *reference* slots needed no grammar change at all \u2014 a quoted `\"String\"` already parses as a bare qualifiedName, which isTypeParamRef resolves, while unquoted `String` stays the primitive. So the fix on the output side is mdlIdent (which lexes the name with the real lexer) on every type-parameter name DESCRIBE prints. Prove it with a describe \u2192 exec into a second module \u2192 describe diff, not by eyeballing one DESCRIBE.", "refs": ["mendixlabs/mxcli#1183"]}
 {"area": "mdl/grammar", "date": "2026-09-28", "symptom": "A misspelt statement keyword was not an error. `craete module Foo;` and `dorp entity M.E;` parsed cleanly and did nothing (0 statements, exit 0); `craete persistent entity Shop.Note (Text: string(200));` reported `extraneous input '('` at column 35 instead of at the typo.", "cause": "`helpStatement: IDENTIFIER (helpTopicWord (DOT? helpTopicWord)*)?` is a utilityStatement alternative, so ANY statement starting with an IDENTIFIER matched it, the rest of the words as the topic; ExitHelpStatement then built nothing for a word other than help/?/exit/quit. The rule is the grammar's catch-all (the #1025 comment already warned it swallows from other statements); a typo is just the case where there is no other statement.", "file": "`mdl/grammar/MDLParser.g4` (`@parser::members` IsHelpWord), `mdl/grammar/domains/MDLSettings.g4` (semantic predicate on helpStatement), `mdl/visitor/visitor_unknown_statement.go` (\"unknown statement 'x' — did you mean 'y'?\" when the parser is still in statement/program and ANTLR names the one word), test `mdl/visitor/visitor_session_commands_test.go`", "insight": "A catch-all alternative that the visitor filters (`switch word { case \"help\": … }`) is a silent no-op for everything it does not list: move the filter INTO the grammar as a predicate (`{IsHelpWord(p.GetTokenStream().LT(1).GetText())}?`), so the parser, not the visitor, rejects. The words stay IDENTIFIERs — reserving HELP/EXIT/QUIT as tokens would take them away as names everywhere a bare IDENTIFIER is accepted. The generated parser imports no `strings`, so fold case by hand in @members. With the predicate the error lands at the word as `no viable alternative at input 'craete'`, and the listener can rewrite exactly that message when the recognizer's context is StatementContext/ProgramContext. Proof: without the predicate the test reports 3 of 4 inputs parsing to zero statements.", "refs": ["ako/mxcli#755", "mendixlabs/mxcli#1025"]}
-{"area": "mdl/grammar", "date": "2026-09-28", "symptom": "After the helpStatement predicate (R7) made a statement starting with an unknown word an error under every language version, CI's skill check failed on `create constant … default '' PRIVATE;` in the database-connections skill: `PRIVATE;` had always parsed as a help statement and done nothing, so a script following the skill that ran under mdl 0 stopped running.", "cause": "Turning a silent no-op into an error is a new rejection of text accepted today, which ADR-0011 applies only under `mdl 1`. The predicate was ungated because \"the old parse built nothing\" — but a script that ran and built nothing for one line still ran.", "file": "`mdl/grammar/MDLParser.g4` (IsMdl1Parse), `mdl/grammar/domains/MDLSettings.g4` (predicate `IsHelpWord(...) || !IsMdl1Parse(p)`), `mdl/visitor/visitor_unknown_statement.go` (MDL-V1-UNKNOWN), `mdl/upgrade/gated.go` (unrewritable), test `TestMisspeltStatementKeywordWarnsUnderMdl0`", "insight": "A grammar predicate can be gated by language version without parser state: the `mdl <n>;` header is scanned before lexing and an mdl 1 script is lexed from a StrictEscapeStream, so `HasStrictEscapes(p.GetTokenStream().GetTokenSource().GetInputStream())` tells the predicate the version before the header node is ever visited. Before calling a no-op-to-error change ungated, grep the repo's own skills and examples for the no-op: `scripts/check-skill-mdl.sh` found three in one skill.", "refs": ["ako/mxcli#755", "ako/mxcli#780"]}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0698a4e437..40db61988d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -33,7 +33,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ### Fixed
 
-- **A misspelt statement keyword parsed as a help topic** (ako/mxcli#755, R7) — `helpStatement` accepted any word, so `craete module Foo;` parsed without error and did nothing, and `craete entity M.E (…)` reported its error at the `(`. Under `mdl 1;` only `help`, `exit` and `quit` start that statement, and a statement that starts with an unknown word is reported at the word: `unknown statement 'craete' — did you mean 'create'?`. Without the header such a statement still does nothing, as before, and warns **MDL-V1-UNKNOWN** — a stray `PRIVATE;` the database-connections skill taught after `create constant … default ''` was one.
+- **A misspelt statement keyword parsed as a help topic** (ako/mxcli#755, R7) — `helpStatement` accepted any word, so `craete module Foo;` parsed without error and did nothing, and `craete entity M.E (…)` reported its error at the `(`. Only `help`, `exit` and `quit` start that statement now, and a statement that starts with an unknown word is reported at the word: `unknown statement 'craete' — did you mean 'create'?`.
 - **Keyword operators were fused in some stored expressions** — a page action's microflow argument `Flag: $a and $b` was stored as `$aand$b`, `if $x then 'a' else 'b'` as `if$xthen'a'else'b'`; the same in `contentparams` values, `send rest request … with (…)` parameters and a dynamic `execute database query`. Those four places took the expression's text without its whitespace; literals, `+` and `$currentObject` were unaffected, which is why it went unnoticed, and `check --references` passed. Measured by decoding the stored units on a Mendix 11.14.0 project. The expression is now stored as written, with MDL comments removed, as the microflow expression sites already did.
 - **An input bound to an attribute outside any data container was written with no binding** — `textbox t (Attribute: FullName)` at the top of a page (or of a snippet, or inside a plain container) has no entity to qualify the name with, and the writer stored it as `AttributeRef: null`. Plain `check` passed, `exec --no-check` and `alter page … insert` at page level said success, and mxbuild 11.13.0 failed the page with CE0544 "This widget can only function inside a data context" + CE7005 (text box, text area, date picker, check box, radio buttons, drop-down), CE0402 (dynamic text `Attribute:`) or CE0642 (combo box). A qualified attribute there is stored and fails the same way (CE0544 / CE2421 / CE1365 / CE7247 "Move this widget into a data container"). `Attribute: $P/Name` and `Attribute: $currentObject/Name` never parsed as an attribute path and were dropped even inside a data view. `check` now reports all three as **MDL-WIDGET34** (no project needed), and the page builder refuses them with the widget named, so nothing is written; `alter page` refuses a bare name it has no entity for. Place the widget in a data view, list view, gallery or data grid and bind the attribute by name.
 - **An expression property written in brackets was silently dropped** (mendixlabs/mxcli#750) — `dynamicclasses: [ if $currentObject/Featured then 'a' else 'b' ]`, the spelling #750 proposes, parsed as a list that no writer reads: `check` was clean, `exec` said `Created page`, and the widget was stored with no dynamic class. `alter page … set DynamicClasses = [ … ]` said `Altered page` and changed nothing, and a column's `DynamicCellClass` stored the list's text — tokens fused, `[if$x/Ythen'a'else'b']` — as its expression. Measured on a copy of a Mendix 11.14.0 project with the pre-fix binary. `mxcli check` now reports **MDL-WIDGET32** for `DynamicClasses` and `DynamicCellClass` written as a list (no project needed), and ALTER refuses it, so `check -p` reports that too. Write the expression quoted.
diff --git a/cmd/mxcli/syntax/features_misc.go b/cmd/mxcli/syntax/features_misc.go
index e0a1372bd2..43f8351f01 100644
--- a/cmd/mxcli/syntax/features_misc.go
+++ b/cmd/mxcli/syntax/features_misc.go
@@ -29,10 +29,8 @@ func init() {
 			"-- every statement ends with ';' and '/' is not a terminator; '' is the\n" +
 			"-- only string escape, so a backslash is an ordinary character; and an\n" +
 			"-- unknown or mis-shaped property key in a REST, business event or agent\n" +
-			"-- property list is an error; a session command (connect, set format,\n" +
-			"-- status, help, …) in a script is an error (MDL-V1-SESSION); and a\n" +
-			"-- statement that starts with an unknown word (`craete …`) is an error at\n" +
-			"-- the word, where mdl 0 did nothing with it (MDL-V1-UNKNOWN). A trailing\n" +
+			"-- property list is an error; and a session command (connect, set format,\n" +
+			"-- status, help, …) in a script is an error (MDL-V1-SESSION). A trailing\n" +
 			"-- comma is allowed in every bracketed list, with or without the header.\n" +
 			"--\n" +
 			"-- A script's meaning never depends on which mxcli release runs it: a\n" +
@@ -47,7 +45,6 @@ func init() {
 			"-- says why, when a construct has no rewrite: an unknown or mis-shaped\n" +
 			"-- property (MDL-V1-PROP/PROPVALUE), `create or replace view entity`\n" +
 			"-- (MDL-V1-REPLACE01), a session command in a script (MDL-V1-SESSION), a\n" +
-			"-- statement that starts with an unknown word (MDL-V1-UNKNOWN), a\n" +
 			"-- nested list operation, find/contains on a variable\n" +
 			"-- whose type the script does not state, and an escaped line break inside\n" +
 			"-- an expression.\n" +
diff --git a/docs-site/src/language/basics.md b/docs-site/src/language/basics.md
index 25f8e3f559..9601bd1029 100644
--- a/docs-site/src/language/basics.md
+++ b/docs-site/src/language/basics.md
@@ -94,7 +94,6 @@ What `mdl 1` makes strict (each is a warning without the header, with the code s
 | In a REST client, published REST service, business event service, model, knowledge base, consumed MCP service or agent, an unknown property key is an error that names the key it most likely meant, and so is a value its key does not take (`Response: json from $X`). | The property is ignored, or read by its shape as before; `MDL-V1-PROP` / `MDL-V1-PROPVALUE`. |
 | A `while` loop is `while <condition> begin … end while;`; leaving out `begin`, or the `while` after `end`, is an error. | Accepted; `MDL-V1-WHILE`. |
 | A session command — `connect`, `disconnect`, `use`, `set format = …`, `status`, `check`, `build`, `lint`, `debug`, `execute script`, `execute runtime`, `help`, `introspect api` — is an error in a script. Type it at the REPL, or use the command-line flag (`mxcli exec script.mdl -p app.mpr --json`). The REPL keeps accepting them. | Runs as before; `MDL-V1-SESSION`. |
-| A statement that starts with an unknown word (`craete module Foo;`, a stray `PRIVATE;`) is an error at the word: `unknown statement 'craete' — did you mean 'create'?`. | Does nothing, as before; `MDL-V1-UNKNOWN`. |
 
 ### Upgrading a script: `mxcli fmt --upgrade`
 
@@ -119,7 +118,7 @@ mxcli fmt --upgrade --header -w script.mdl  # also add `mdl 1;`
 | `MDL-V1-REPLACE02` | `create or replace user role` / `demo user` becomes a plain `create` |
 | `MDL-V1-WHILE` | inserts the missing `begin` after a `while` condition and `while` after its `end` |
 
-A construct with no mechanical rewrite is reported with the reason, and `fmt` refuses to add the header rather than change the script's meaning: an unknown or mis-shaped property (`MDL-V1-PROP`, `MDL-V1-PROPVALUE`), `create or replace view entity` (`MDL-V1-REPLACE01`), a session command in a script (`MDL-V1-SESSION`: move it to the command line or the REPL), a statement that starts with an unknown word (`MDL-V1-UNKNOWN`: correct the keyword or delete it), a nested list operation such as `count(filter(…))`, `find`/`contains` on a variable whose type the script does not state, and an escaped line break (`\n`) inside an expression. While `mdl 1` is a preview, the header is added only when asked. Running `fmt --upgrade` on its own output changes nothing.
+A construct with no mechanical rewrite is reported with the reason, and `fmt` refuses to add the header rather than change the script's meaning: an unknown or mis-shaped property (`MDL-V1-PROP`, `MDL-V1-PROPVALUE`), `create or replace view entity` (`MDL-V1-REPLACE01`), a session command in a script (`MDL-V1-SESSION`: move it to the command line or the REPL), a nested list operation such as `count(filter(…))`, `find`/`contains` on a variable whose type the script does not state, and an escaped line break (`\n`) inside an expression. While `mdl 1` is a preview, the header is added only when asked. Running `fmt --upgrade` on its own output changes nothing.
 
 The design is in [ADR-0011](https://github.com/mendixlabs/mxcli/blob/main/docs/13-decisions/0011-mdl-language-versioning.md); `mxcli syntax language-header` has the details.
 
diff --git a/docs/01-project/MDL_QUICK_REFERENCE.md b/docs/01-project/MDL_QUICK_REFERENCE.md
index 324e84a927..d906b76f7f 100644
--- a/docs/01-project/MDL_QUICK_REFERENCE.md
+++ b/docs/01-project/MDL_QUICK_REFERENCE.md
@@ -15,7 +15,7 @@ create persistent entity Sales.Customer ( Name: String(200) );
 
 ## Session commands — the REPL, not a script
 
-`connect`, `disconnect`, `use`, `set format = …`, `status`, `check`, `build`, `lint`, `debug`, `execute script`, `execute runtime`, `help` and `introspect api` set up or inspect the session. Type them at the REPL, or use the command-line flags; a `.mdl` script holds model statements only. Under `mdl 1;` a session command in a script is an error; without the header it runs and warns `MDL-V1-SESSION`. `exit` / `quit` are not session commands. A statement that starts with an unknown word (`craete module Foo;`) is an error at the word under `mdl 1;`; without the header it does nothing, as before, and warns `MDL-V1-UNKNOWN`.
+`connect`, `disconnect`, `use`, `set format = …`, `status`, `check`, `build`, `lint`, `debug`, `execute script`, `execute runtime`, `help` and `introspect api` set up or inspect the session. Type them at the REPL, or use the command-line flags; a `.mdl` script holds model statements only. Under `mdl 1;` a session command in a script is an error; without the header it runs and warns `MDL-V1-SESSION`. `exit` / `quit` are not session commands.
 
 ```bash
 mxcli exec changes.mdl -p app.mpr --json     # not: connect local 'app.mpr'; set format = json; in the script
diff --git a/mdl/grammar/MDLParser.g4 b/mdl/grammar/MDLParser.g4
index a579c163a8..6c619c70a8 100644
--- a/mdl/grammar/MDLParser.g4
+++ b/mdl/grammar/MDLParser.g4
@@ -42,14 +42,6 @@ func IsHelpWord(word string) bool {
 	}
 	return false
 }
-
-// IsMdl1Parse reports whether p reads a script written in mdl 1 or later. The
-// `mdl <n>;` header is scanned before lexing, and a script under mdl 1 is
-// lexed from a StrictEscapeStream (MDLLexer.g4); the stream is how that
-// decision reaches a predicate, which runs before the header is visited.
-func IsMdl1Parse(p *MDLParser) bool {
-	return HasStrictEscapes(p.GetTokenStream().GetTokenSource().GetInputStream())
-}
 }
 
 import
diff --git a/mdl/grammar/domains/MDLSettings.g4 b/mdl/grammar/domains/MDLSettings.g4
index 5349217023..49cfa82254 100644
--- a/mdl/grammar/domains/MDLSettings.g4
+++ b/mdl/grammar/domains/MDLSettings.g4
@@ -298,12 +298,11 @@ linkMapping
  * CREATE MODULE ROLE alternative wins as it did before.
  */
 helpStatement
-    // Under mdl 1 only `help`, `exit` and `quit` start one (IsHelpWord,
-    // MDLParser.g4). Without the predicate every IDENTIFIER did, so `craete
-    // entity M.E;` was a help statement with a topic, parsed without error and
-    // dropped (ako/mxcli#755, R7). The rejection is new, so under mdl 0 the
-    // rule still takes any word and the visitor warns (ADR-0011).
-    : {IsHelpWord(p.GetTokenStream().LT(1).GetText()) || !IsMdl1Parse(p)}?
+    // Only `help`, `exit` and `quit` start one (IsHelpWord, MDLParser.g4).
+    // Without the predicate every IDENTIFIER did, so `craete entity M.E;`
+    // was a help statement with a topic, parsed without error and dropped
+    // (ako/mxcli#755, R7).
+    : {IsHelpWord(p.GetTokenStream().LT(1).GetText())}?
       IDENTIFIER (helpTopicWord (DOT? helpTopicWord)*)?  // HELP [topic]
     ;
 
diff --git a/mdl/upgrade/gated.go b/mdl/upgrade/gated.go
index e11abd4a63..38dffc32f2 100644
--- a/mdl/upgrade/gated.go
+++ b/mdl/upgrade/gated.go
@@ -47,8 +47,6 @@ var unrewritable = map[string]string{
 	"MDL-V1-REPLACE01": "`create or replace view entity` drops and recreates the view entity under mdl 0, " +
 		"which no mdl 1 statement does: write `create or modify view entity` to keep its identity, or " +
 		"`drop entity` then `create view entity` to discard it",
-	"MDL-V1-UNKNOWN": "a statement that starts with an unknown word does nothing under mdl 0 and is an error " +
-		"under mdl 1; which keyword was meant cannot be guessed, so correct it or delete the statement by hand",
 	"MDL-V1-SESSION": "a session command (`connect`, `set format`, `status`, `help`, …) is refused in an mdl 1 " +
 		"script, and no model statement does what it does: move it out of the script, to the command line " +
 		"(`-p app.mpr` to connect, `--json` for the output format) or the REPL",
diff --git a/mdl/upgrade/gated_test.go b/mdl/upgrade/gated_test.go
index 71ec0945b1..7ffb34e58c 100644
--- a/mdl/upgrade/gated_test.go
+++ b/mdl/upgrade/gated_test.go
@@ -189,10 +189,8 @@ func TestUpgrade_ListCallFormToStatementForm(t *testing.T) {
 func TestGatedRegistryIsComplete(t *testing.T) {
 	// MDL-V1-SESSION (R7, ako/mxcli#755) was added with its change: moving a
 	// session command out of a script is a decision about how the script is run.
-	// MDL-V1-UNKNOWN (R7, ako/mxcli#755) likewise: which keyword a misspelt
-	// word was meant to be cannot be guessed.
 	pinned := map[string]bool{"MDL-V1-PROP": true, "MDL-V1-PROPVALUE": true, "MDL-V1-REPLACE01": true,
-		"MDL-V1-SESSION": true, "MDL-V1-UNKNOWN": true}
+		"MDL-V1-SESSION": true}
 	known := map[string]bool{}
 	for _, c := range visitor.LanguageChanges() {
 		known[c.Code] = true
diff --git a/mdl/visitor/visitor_query.go b/mdl/visitor/visitor_query.go
index 1398657395..bc40bc1b57 100644
--- a/mdl/visitor/visitor_query.go
+++ b/mdl/visitor/visitor_query.go
@@ -1379,10 +1379,6 @@ func (b *Builder) ExitHelpStatement(ctx *parser.HelpStatementContext) {
 			b.statements = append(b.statements, stmt)
 		case "exit", "quit":
 			b.statements = append(b.statements, &ast.ExitStmt{})
-		default:
-			// Only under mdl 0 does the grammar take another word here: the
-			// statement builds nothing, as it always has, and warns.
-			b.noteUnknownStatementWord(ctx, id.GetText())
 		}
 	}
 }
diff --git a/mdl/visitor/visitor_session_commands_test.go b/mdl/visitor/visitor_session_commands_test.go
index 08c21d451b..fe4ef609b4 100644
--- a/mdl/visitor/visitor_session_commands_test.go
+++ b/mdl/visitor/visitor_session_commands_test.go
@@ -13,8 +13,7 @@ import (
 // grammar's catch-all, so a misspelt statement keyword was a HELP statement.
 // `craete module Foo;` parsed cleanly into nothing at all — the visitor dropped
 // a help statement whose word was not help/exit/quit — and `craete entity
-// M.E (…)` reported its error at the `(`, far from the typo. Under mdl 1 the
-// word is an error, reported where it is.
+// M.E (…)` reported its error at the `(`, far from the typo.
 func TestMisspeltStatementKeywordIsAnErrorAtTheWord(t *testing.T) {
 	for _, tc := range []struct {
 		input string
@@ -25,15 +24,15 @@ func TestMisspeltStatementKeywordIsAnErrorAtTheWord(t *testing.T) {
 		{"craete persistent entity Shop.Note (Text: string(200));", "create"},
 		{"descibe entity M.E;", "describe"},
 	} {
-		prog, errs := Build("mdl 1;\n" + tc.input)
+		prog, errs := Build(tc.input)
 		if len(errs) == 0 {
 			t.Errorf("%q: parsed without error into %d statement(s); a misspelt keyword must be an error",
 				tc.input, len(prog.Statements))
 			continue
 		}
 		first := errs[0].Error()
-		if !strings.HasPrefix(first, "line 2:0 ") {
-			t.Errorf("%q: first error is not at the misspelt word (line 2:0): %s", tc.input, first)
+		if !strings.HasPrefix(first, "line 1:0 ") {
+			t.Errorf("%q: first error is not at the misspelt word (line 1:0): %s", tc.input, first)
 		}
 		word := strings.Fields(tc.input)[0]
 		want := "unknown statement '" + word + "' — did you mean '" + tc.near + "'?"
@@ -43,38 +42,6 @@ func TestMisspeltStatementKeywordIsAnErrorAtTheWord(t *testing.T) {
 	}
 }
 
-// ADR-0011: the rejection is new, so it applies only under mdl 1. Without the
-// header a statement the catch-all accepted — it built nothing — still parses
-// into nothing, and warns MDL-V1-UNKNOWN; one it did not accept is the error it
-// always was. Scripts following a skill that taught `… default ” PRIVATE;`
-// ran under mdl 0, the `PRIVATE;` being such a statement.
-func TestMisspeltStatementKeywordWarnsUnderMdl0(t *testing.T) {
-	for _, in := range []string{"craete module Foo;", "PRIVATE;", "descibe entity M.E;"} {
-		prog, errs := Build("create module A;\n" + in + "\ncreate module B;")
-		if len(errs) > 0 {
-			t.Errorf("%q: an error under mdl 0: %v", in, errs)
-			continue
-		}
-		if len(prog.Statements) != 2 {
-			t.Errorf("%q: %d statements, want the two around it", in, len(prog.Statements))
-		}
-		var note *ast.LanguageNote
-		for i := range prog.LanguageNotes {
-			if prog.LanguageNotes[i].Code == "MDL-V1-UNKNOWN" {
-				note = &prog.LanguageNotes[i]
-			}
-		}
-		if note == nil || note.Line != 2 || !strings.Contains(note.Message, strings.Fields(strings.TrimSuffix(in, ";"))[0]) {
-			t.Errorf("%q: want an MDL-V1-UNKNOWN warning on line 2 naming the word, got %+v", in, prog.LanguageNotes)
-		}
-	}
-	// Control: a misspelt statement the catch-all never accepted was an error
-	// under mdl 0 before, and stays one.
-	if _, errs := Build("craete persistent entity Shop.Note (Text: string(200));"); len(errs) == 0 {
-		t.Error("a misspelt create with a body parsed under mdl 0")
-	}
-}
-
 // The words the rule exists for still parse, with and without a topic, in any
 // letter case.
 func TestSessionWordsStillParse(t *testing.T) {
diff --git a/mdl/visitor/visitor_unknown_statement.go b/mdl/visitor/visitor_unknown_statement.go
index 6d75a9944f..6f301f9dd1 100644
--- a/mdl/visitor/visitor_unknown_statement.go
+++ b/mdl/visitor/visitor_unknown_statement.go
@@ -7,7 +7,6 @@ import (
 
 	"github.com/antlr4-go/antlr/v4"
 	"github.com/mendixlabs/mxcli/mdl/grammar/parser"
-	"github.com/mendixlabs/mxcli/mdl/langver"
 	"github.com/mendixlabs/mxcli/mdl/suggest"
 )
 
@@ -52,29 +51,3 @@ func unknownStatementMessage(word string) string {
 	}
 	return msg + " — a statement starts with a keyword such as create, alter, drop, describe or list"
 }
-
-// unknownStatementWordIsAnError is the new rejection of a statement that
-// starts with an unknown word (R7). Under mdl 0 the help statement took any
-// word, so `craete module Foo;` or a stray `PRIVATE;` parsed into nothing; a
-// committed script that ran under mdl 0 keeps running (ADR-0011).
-var unknownStatementWordIsAnError = langver.Change{
-	Code:  "MDL-V1-UNKNOWN",
-	Since: langver.V1,
-	Old:   "a statement that starts with an unknown word does nothing",
-	New:   "an error at the word: correct the misspelt keyword, or delete the statement",
-}
-
-// noteUnknownStatementWord warns about a statement the mdl 0 grammar took as a
-// help statement because it starts with an unknown word. Under mdl 1 the
-// grammar refuses it, so this is reached only without the header; should it be
-// reached under mdl 1, it is the error the grammar gives.
-func (b *Builder) noteUnknownStatementWord(ctx antlr.ParserRuleContext, word string) {
-	if b.gate(unknownStatementWordIsAnError, ctx) {
-		b.addError(fmt.Errorf("line %d:%d %s", ctx.GetStart().GetLine(), ctx.GetStart().GetColumn(),
-			unknownStatementMessage(word)))
-		return
-	}
-	if n := len(b.langNotes); n > 0 && b.langNotes[n-1].Code == unknownStatementWordIsAnError.Code {
-		b.langNotes[n-1].Message = unknownStatementMessage(word) + ": " + b.langNotes[n-1].Message
-	}
-}
diff --git a/mdl/visitor/visitor_upgrade_fixes.go b/mdl/visitor/visitor_upgrade_fixes.go
index ce8aa2488f..a6a669d8d0 100644
--- a/mdl/visitor/visitor_upgrade_fixes.go
+++ b/mdl/visitor/visitor_upgrade_fixes.go
@@ -31,7 +31,7 @@ func LanguageChanges() []langver.Change {
 	return []langver.Change{
 		semicolonRequired, slashIsNotATerminator, backslashIsLiteral, limitOneIsAList,
 		listCallForm, setIsMandatory, viewEntityReplaceIsModify, roleReplaceIsModify, whileBlockRequired,
-		unknownPropertyKey, misshapedPropertyValue, sessionCommandInScript, unknownStatementWordIsAnError,
+		unknownPropertyKey, misshapedPropertyValue, sessionCommandInScript,
 	}
 }
 

From 6f89f4dc072a365b8d78d8227a8970e1206bf5d4 Mon Sep 17 00:00:00 2001
From: Ako <andrej@koelewijn.net>
Date: Mon, 28 Sep 2026 09:40:25 +0000
Subject: [PATCH 35/35] test: describe writes a workflow activity's caption as
 caption (R9) in the bare-expression tests

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 mdl/executor/describe_workflow_expressions_test.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/mdl/executor/describe_workflow_expressions_test.go b/mdl/executor/describe_workflow_expressions_test.go
index 8a5ff455e1..6870bfff37 100644
--- a/mdl/executor/describe_workflow_expressions_test.go
+++ b/mdl/executor/describe_workflow_expressions_test.go
@@ -41,7 +41,7 @@ func TestDescribeWorkflow_DecisionExpressionIsBare(t *testing.T) {
 		quoted                    bool
 	}{
 		{"decision1", "Large order?", "$WorkflowContext/Total > 1000",
-			"decision decision1 $WorkflowContext/Total > 1000 comment 'Large order?'", false},
+			"decision decision1 $WorkflowContext/Total > 1000 caption 'Large order?'", false},
 		{"BigOrder", "BigOrder", "toLowerCase($WorkflowContext/Name) = 'big'",
 			"decision toLowerCase($WorkflowContext/Name) = 'big'", false},
 		// Written after no name, `Total` would be read as the name: the name
@@ -71,7 +71,7 @@ func TestDescribeWorkflow_TimersAndDueDatesAreBare(t *testing.T) {
 	timer := &workflows.WaitForTimerActivity{DelayExpression: "addHours([%CurrentDateTime%], 1)"}
 	timer.Name, timer.Caption = "wait1", "Wait"
 	out, prog := describedWorkflowActivity(t, timer)
-	if !strings.Contains(out, "wait for timer wait1 addHours([%CurrentDateTime%], 1) comment 'Wait'") {
+	if !strings.Contains(out, "wait for timer wait1 addHours([%CurrentDateTime%], 1) caption 'Wait'") {
 		t.Errorf("describe wrote:\n%s", out)
 	}
 	if len(prog.Deprecations) != 0 {