diff --git a/.claude/skills/fix-issue/findings/mdl-executor.jsonl b/.claude/skills/fix-issue/findings/mdl-executor.jsonl
index d26296cf3e..ddc1de6b83 100644
--- a/.claude/skills/fix-issue/findings/mdl-executor.jsonl
+++ b/.claude/skills/fix-issue/findings/mdl-executor.jsonl
@@ -738,3 +738,6 @@
 {"area": "mdl/executor", "date": "2026-09-27", "symptom": "describe microflow printed `validation feedback $O/A message '{1} \u2026';` with no template arguments; describe -> exec stored the feedback with none", "cause": "formatAction's ValidationFeedbackAction case never read TemplateParameters, although the reader (textTemplateFromGen) and the writer both carried them", "file": "mdl/executor/cmd_microflows_format_action.go (templateArgsClause)", "insight": "A text template has two halves, the text and its parameters; check every describe case that prints one prints both. Found while switching the template form to `with ({1} = \u2026)` (ako/mxcli#751)."}
 {"area": "mdl/executor", "date": "2026-09-28", "symptom": "create or modify workflow of its own describe output renames Studio Pro's implicit activities: start1 -> Start, end1 -> End, an event sub-process end2 -> End2", "cause": "describe prints no name for the implicit start/end, branch ends, jumps or end-of-path markers, and the rebuild names them from captions", "file": "mdl/executor/workflow_carry_names.go", "fix": "Pair declared and stored flows structurally (named activities by name, unnamed ones by type ordinal, nested flows by position, event sub-processes by name) and carry the stored names before deduplication", "insight": "Carry before the CE0495 deduplication, not after, so the carried names take part in it; pair nested flows with nil slots kept, because the rebuild leaves an empty outcome's flow nil where the stored one is an empty Flow", "refs": ["ako/mxcli#743"], "test": "TestCreateOrModifyWorkflow_CarriesNamesDescribeCannotPrint"}
 {"area": "mdl/executor", "date": "2026-09-28", "symptom": "create or modify external entity declaring OrderId: String(20) on an Edm.Int64 property keeps RemoteType Edm.Int64; mx check CE6616", "cause": "carryStoredAttributeState carries RemoteType by name regardless of the declared type", "file": "mdl/executor/external_entity_remote_type.go", "fix": "Refuse under mdl 1 (MDL-V1-REMOTETYPE), warn under mdl 0", "insight": "CE6616 compares against the service's $metadata, not the stored RemoteType, so deriving RemoteType from the declared type would not fix it; measured with mx check on a TestApp copy", "refs": ["ako/mxcli#764"], "test": "TestCreateOrModifyExternalEntity_RemoteTypeMismatchRefusedUnderMdl1"}
+{"area": "mdl/executor", "date": "2026-09-28", "symptom": "describe output that lost data on replay, the part of ako/mxcli#707 that #728 left open: a user role's Description and CheckSecurity were printed as `--` comments and a user role with no module roles described as `create user role X;`, which did not parse; workflow activity, event sub-process and workflow-level annotations were `-- annotation:` comments; a consumed REST header `'Bearer ' + $Token` stored only `Bearer ` and described back as that literal; image-collection describe wrote /tmp/mxcli-preview files and printed their paths.", "cause": "Each describer printed what its grammar had no slot for as a comment: the positional user-role form had no key for the description, check-security or manageable roles; workflows had only the standalone `annotation` statement (refused by MDL-WF04) and no attached form; the REST header grammar took an expression but the writer stores a value template, so the variable was dropped; image bytes live in the model, but describe exported them to a side file rather than into the statement.", "file": "mdl/grammar/domains/MDLSecurity.g4, MDLWorkflow.g4, MDLService.g4, MDLDomainModel.g4; mdl/visitor/visitor_security.go, visitor_workflow.go, visitor_rest.go, visitor_imagecollection.go; mdl/executor/cmd_security.go, cmd_security_write.go, cmd_workflows.go, cmd_workflows_write.go, cmd_rest_clients.go, cmd_imagecollections.go; mdl/backend (SetUserRoleProperties)", "fix": "User role properties are a ( Key: value ) list (ModuleRoles, Description, ManageAllRoles, ManageableRoles, ManageUsersWithoutRoles, CheckSecurity), the list optional; the positional form is MDL-DEPR710 with an fmt --upgrade rewrite. Workflow notes are `@annotation '…'` before an activity or event sub-process and a header `annotation '…'` clause. A REST header value is the template `'Bearer {Token}'`; the expression form is MDL-DEPR711 and now builds that template. Image describe writes `Data: '<base64>'` (Format only when the bytes do not show it), the TUI preview decodes it, and a File: path resolves script-relative.", "insight": "A `--` comment in describe output is a data-loss marker, not a rendering choice: every one of these was a property the grammar could not state. Grep describers for `-- ` emits of model values before assuming a describer round-trips. For the REST header the evidence that settled the template syntax was Studio Pro's own documentation (via the MCP search_mendix_knowledge_base tool): parameters are `{name}` in the path, query, header value and body.", "test": "mdl/executor/issue707_remaining_test.go, mdl/upgrade/issue707_upgrade_test.go, cmd/mxcli/tui/image_render_test.go"}
+{"area": "mdl/executor", "date": "2026-09-28", "symptom": "re-executing the full describe of a flow whose if-merge wraps onto a new row (CxLayout.CX_VAL_Factory, CX_VAL_EmailTemplate in 02c) draws the merge-to-split flow out of the merge's right side instead of its bottom; layout flows, ELK, diff, with handles and create or modify's diff inherit it", "cause": "the flow leaving an if's closing merge had no annotation slot: describe wrote only the next split's to: top, and the top-level builder dropped an if's own @anchor(from:) (it honoured it only inside branch bodies)", "file": "mdl/executor/cmd_microflows_show_helpers.go", "fix": "describe writes the merge exit side as from: on the if's @anchor (keyed on the merge the @merge line already names); the builder hands the if's from: to the merge-out flow via nextFlowAnchor, and case/type-split branches clear a nested if's leftover nextFlowAnchor", "insight": "the canonical describe hid it: omitting the split's @position let the rebuild wrap the row, and wrapping re-derives bottom->top. Only the full description, where every node is pinned, exposed that a merge's outgoing anchor was unwritable; compare full describe -> re-exec geometry against the stored flow, not canonical", "refs": ["ako/mxcli#767"], "test": "TestDescribe_MergeExitAnchorRoundTrips"}
+{"area": "mdl/executor", "date": "2026-09-28", "symptom": "`refresh catalog full source` under `go test -race` reports two DATA RACEs in getModulesFromCache/findModule (helpers.go), reached from describeEntity in the catalog's parallel describe workers", "cause": "executorCache.modules is filled lazily with no synchronisation; the catalog runs captureDescribeParallel from a goroutine pool sharing one ExecContext.Cache, and preWarmCache warmed the hierarchy and name maps but not the module list, so several workers each listed the modules and published the slice while others read the field", "file": "mdl/executor/helpers.go (getModulesFromCache, executorCache.cachedModules), mdl/executor/executor.go (modulesMu), mdl/executor/cmd_pages_builder.go (getModules)", "fix": "Fill and invalidate the module list under executorCache.modulesMu; the page builder's getModules goes through the same cachedModules", "insight": "The race detector only reports a location pair once per process, so a -race test run with -count>1 passes on later iterations even against the unfixed code; pair it with a detector-free assertion (ListModules called once by N concurrent lookups on a slow mock). Driving the whole `refresh catalog full source` under -race also surfaces a separate race inside the ANTLR Go runtime's shared DFA (page/workflow describes parse expressions concurrently), so the regression test drives entity describes only", "refs": ["ako/mxcli#765"], "test": "TestModuleCache_ConcurrentFillListsOnce, TestParallelEntityDescribes_NoDataRace"}
diff --git a/.claude/skills/fix-issue/findings/mdl-visitor.jsonl b/.claude/skills/fix-issue/findings/mdl-visitor.jsonl
index 81eedde092..452b190a3b 100644
--- a/.claude/skills/fix-issue/findings/mdl-visitor.jsonl
+++ b/.claude/skills/fix-issue/findings/mdl-visitor.jsonl
@@ -37,3 +37,4 @@
 {"area": "mdl/visitor", "date": "2026-09-25", "symptom": "A page action's microflow argument `Flag: true and false` was stored as the expression \"trueandfalse\", `Mode: if true then 'a' else 'b'` as \"iftruethen'a'else'b'\", and a REST call parameter `$OrderId = if $x then $id else 'none'` as \"if$xthen$idelse'none'\" (measured by decoding the units on a copy of ako/TestApp). `check -p --references` passed; describe printed the fused text back", "cause": "Four sites stored an expression as text via ANTLR's ctx.GetText(), which concatenates tokens without the hidden-channel whitespace: microflowArgV3 values (page/nanoflow call arguments), contentparams values, send-rest-request WITH parameters, and a dynamic `execute database query`. Literals, `+` and a lone $currentObject are single tokens or need no spacing, so every common case looked correct", "file": "`mdl/visitor/visitor_helpers.go` (`expressionSourceText`), `mdl/visitor/visitor_page_v3.go` (`buildMicroflowArgV3`, `buildParamAssignmentV3`), `mdl/visitor/visitor_microflow_actions.go` (dynamic query, send rest params)", "insight": "**GetText() on an expression context is always a bug** — grep `Expression().*GetText()` / `expr.GetText()` in mdl/visitor; each hit either builds the AST or must use expressionSourceText (whitespace kept, MDL comments stripped). The earlier comment-leak fix moved the six microflow sites to extractExpressionText and missed these four because they lived in page/REST code, not microflow statements: fix a text-extraction defect by searching for the call, not the feature. The tell that hid it: tests used `$currentObject` and `'a' + 'b'`, both immune; a probe with `and` / `if…then` exposed all four at once. Found while writing PROPOSAL_first_class_expressions.md §5.1. Tests `visitor_expression_source_text_test.go`", "refs": ["mendixlabs/mxcli#750"]}
 {"area": "mdl/visitor", "date": "2026-09-26", "refs": ["ako/mxcli#706"], "rules": ["MDL-IDX01", "MDL-ENUMDOC01"], "symptom": "Five forms parsed and `check` printed \"Syntax OK\", then the model lost or changed them: `throw 'x';` vanished from the microflow; `Amount: float` / `currency` became String(unlimited) (Void as a microflow type) and `date` became DateTime; `create association X (from A to B, type: referenceset, storage: table)` was stored as a Reference with column storage; a `/** … */` on an enumeration value and an index name (`index Idx on (…)`, `create index Idx on E (…)`) were read and written nowhere", "cause": "Three different gaps behind one symptom: throwStatement had a grammar rule and no listener (a whole statement); buildDataType/buildMicroflowDataType end in a default return (String / Void) that the FLOAT_TYPE and CURRENCY_TYPE tokens fell into, and DATE_TYPE mapped to an ast.TypeDate the writers alias to DateTime; ExitCreateAssociationStatement read only ctx.AssociationOptions(), while the parenthesised alternative puts its options directly under the statement as `(COMMA associationOption)*`. Enumeration-value docs and index names have no home in the metamodel (EnumerationValue and Index have no such property)", "file": "`mdl/visitor/visitor_silent_drops.go` (ExitThrowStatement, EnterDataType, EnterNonListDataType, rejectParenthesisedAssociation), `mdl/executor/validate_unstored_text.go` (MDL-IDX01, MDL-ENUMDOC01); tests `mdl/visitor/silent_drops_706_test.go`, `mdl/executor/validate_unstored_text_test.go`", "insight": "**Split by what is lost: refuse when the MODEL would be wrong, warn when only WORDS are lost.** throw/types/association write a different model, so they are visitor errors with the working spelling in the message; doc comments on values and index names leave a correct model, and were used in 56 places in our own examples, so they are check warnings. **Refuse from the parse tree, not by deleting the grammar alternative**: `float`, `currency`, `date` and `throw` are also keywords-as-identifiers, so removing `| FLOAT_TYPE` from dataType would let `Amount: float` re-parse as an enumeration reference named float — the same silence again. A listener on EnterDataType covers every place a type is written (attribute, parameter, return, declare, constant, service rules) in one method; checking only the direct child token keeps `M.Currency` and `enumeration(M.Float)` legal (the control). To find these: any `if … ; return ast.DataType{Kind: …}` fall-through default in a builder is a silent-substitution site, and a grammar alternative whose sub-rules differ from its sibling's (`associationOption` vs `associationOptions`) needs its own read. Sweep: run old vs new `mxcli check` over `git ls-files '*.mdl'` and diff exit codes — it found every example that relied on the dropped forms (5 files)"}
 {"date": "2026-09-27", "area": "mdl/visitor", "symptom": "A member path after `*`, `div`, `mod` (`$a/X * $b/Y`) is stored as division: `describe` shows `$a/X * $b / Y`, and inside a list `filter` `$b / $currentObject/Y`. `mxcli check`, `mx check` and the build are all green; Mendix evaluates a different expression.", "cause": "`/` shares a precedence level with `*`, `div`, `mod` in `multiplicativeExpression` (MDLSettings.g4), so the left-associative chain parses `$a/X * $b/Y` as `(($a/X) * $b) / Y`. `buildMultiplicativeExpression` only turned `/ Member` into an AttributePathExpr when the WHOLE left side was a variable or path; here `$b` was already the right operand of the product, so the `/` stayed a BinaryExpr. The serializer then printed a spaced `/` and the filter's `qualifyIteratorAttributes` read the stranded `Y` as a bare attribute.", "file": "mdl/visitor/visitor_microflow_expression.go (attachPathToLastOperand)", "fix": "When a `/ Member` step cannot attach to the whole left side, attach it to the last operand of the preceding multiplicative BinaryExpr (`*`, `div`, `mod`, `%`, `:`): `(L op $b) / Y` becomes `L op ($b/Y)`. Mendix has no `/` division, so `/` followed by a member name is always navigation. Division by a parenthesised expression is left alone (control test).", "insight": "Fixing it where the AST is BUILT fixes every consumer at once (serializer, iterator qualification, MDL045's slash-division check), where the earlier #52 fix only taught MDL045 to tolerate the mis-nested tree. Test: `TestMemberPathAfterMultiplicativeOperatorIsStoredAsWritten` (flow builder, stored strings for sum, filter, declare, div chain) plus a control `TestSlashAfterNonPathIsNotMadeAMemberPath`. Revert check: stubbing the fix brings back all four wrong strings. A unary-minus branch was dropped because removing it failed nothing (`2 * -$b/Y` was already stored correctly).", "refs": ["#768", "#52"], "rules": []}
+{"date": "2026-09-28", "area": "mdl/visitor", "symptom": "`create view entity if not exists M.V (...) as (...)` on an existing view entity fails with \"entity already exists\" although `mxcli syntax` documents `CREATE VIEW ENTITY [IF NOT EXISTS]`; every other create kind rejected `if not exists` as a parse error.", "cause": "The grammar accepted `ifNotExists?` on all five entity alternatives, but only `ExitCreateEntityStatement`'s non-view branch read it; `buildViewEntity` built a `CreateViewEntityStmt`, which had no field for it, so the guard parsed and was dropped. A per-builder guard is the one the next builder forgets (same class as #531 for drop if exists).", "file": "mdl/visitor/visitor_create_guard.go (applyCreateGuard), mdl/executor/cmd_create_guard.go (skipExistingCreate)", "fix": "`ast.CreateGuard` embedded in every named create statement; the visitor applies `if not exists` once in ExitCreateStatement to whichever statement the create rule built (and errors if that type cannot carry it), and Registry.Dispatch probes existence and skips before the handler. Entity and association keep their in-handler check.", "insight": "Tests are driven by the grammar's own list of create kinds (createStatementKinds) plus allKnownStatements, so a new create rule fails until it carries the guard or is exempted with a reason. The executor test swaps the handler for a recorder, which isolates the guard from what each handler needs from a mock; revert check: stubbing skipExistingCreate fails all 38 existing-element cases, and the absent-element and unguarded controls keep it honest.", "refs": ["#731"], "rules": ["MDL067"]}
diff --git a/.claude/skills/mendix/alter-page/SKILL.md b/.claude/skills/mendix/alter-page/SKILL.md
index f1733e50f2..57f69e2765 100644
--- a/.claude/skills/mendix/alter-page/SKILL.md
+++ b/.claude/skills/mendix/alter-page/SKILL.md
@@ -96,7 +96,7 @@ everywhere. Removing one has its own form:
 alter page Pages.Vehicle_Overview {
   insert into vehicleListView {
     template for Pages.Motorcycle {
-      dynamictext mcLabel (content: 'Motorcycle {1}', contentparams: [{1} = Brand])
+      dynamictext mcLabel (content: 'Motorcycle {1}', contentparams: ({1} = Brand))
     }
   };
   drop template for Pages.SUV in vehicleListView
diff --git a/.claude/skills/mendix/atlas-design/SKILL.md b/.claude/skills/mendix/atlas-design/SKILL.md
index 4c2bbf48e2..53ace22414 100644
--- a/.claude/skills/mendix/atlas-design/SKILL.md
+++ b/.claude/skills/mendix/atlas-design/SKILL.md
@@ -151,9 +151,9 @@ mxcli -p app.mpr -c "describe building block Atlas_Web_Content.Card"
 ```
 ```
 {
-  container container2 (DesignProperties: ['Card style': on]) {
+  container container2 (DesignProperties: ('Card style': on)) {
     dynamictext text22 (Content: 'Card title', RenderMode: H4, Class: 'card-title',
-      DesignProperties: ['Spacing': ['margin-bottom': 'L']])
+      DesignProperties: ('Spacing': ('margin-bottom': 'L')))
   }
 }
 ```
diff --git a/.claude/skills/mendix/atlas-design/reference/building-blocks.md b/.claude/skills/mendix/atlas-design/reference/building-blocks.md
index 5440173086..eb838aaa73 100644
--- a/.claude/skills/mendix/atlas-design/reference/building-blocks.md
+++ b/.claude/skills/mendix/atlas-design/reference/building-blocks.md
@@ -63,13 +63,13 @@ create page MyModule.CardDemo
   layout: Atlas_Core.Atlas_Default
 )
 {
-  container myCard (designproperties: ['Card style': on]) {
+  container myCard (designproperties: ('Card style': on)) {
     dynamictext cardTitle
     (
       content: 'Customers',
       rendermode: H4,
       class: 'card-title',
-      designproperties: ['Spacing': ['margin-bottom': 'L']]
+      designproperties: ('Spacing': ('margin-bottom': 'L'))
     )
   }
 };
@@ -81,7 +81,7 @@ arbitrary bodies, no copy-paste of the wrapper markup.
 
 ```mdl
 create fragment SectionCard as {
-  container card1 (designproperties: ['Card style': on, 'Spacing': ['margin-bottom': 'Large']]) {
+  container card1 (designproperties: ('Card style': on, 'Spacing': ('margin-bottom': 'Large'))) {
     container cardBody (class: 'card-body') {
       slot content            -- each page's widgets land here
     }
@@ -120,7 +120,7 @@ inside; typed **parameters** vary *which entity* and *which microflow*. Declare
 
 ```mdl
 create fragment EntityCard($data: datasource, $onOpen: action) as {
-  container card1 (designproperties: ['Card style': on]) {
+  container card1 (designproperties: ('Card style': on)) {
     listview lv (datasource: $data) {
       slot content
       actionbutton open (caption: 'Open', action: $onOpen, buttonstyle: primary)
@@ -149,10 +149,10 @@ For a binding the override rule can't reach, copy the block in (`as prefix_`) an
 
 ```
 {
-  container container1 (Class: 'pageheader', DesignProperties: ['Item gap': 'None']) {
+  container container1 (Class: 'pageheader', DesignProperties: ('Item gap': 'None')) {
     dynamictext text40 (Content: 'Page header title', RenderMode: H1, Class: 'pageheader-title')
     dynamictext text39 (Content: 'Supporting text', RenderMode: Paragraph, Class: 'pageheader-subtitle',
-      DesignProperties: ['Color': 'Detail color', 'Spacing': ['margin-bottom': 'None']])
+      DesignProperties: ('Color': 'Detail color', 'Spacing': ('margin-bottom': 'None')))
   }
 }
 ```
@@ -166,14 +166,14 @@ create page MyModule.CustomersHeaderDemo
   layout: Atlas_Core.Atlas_Default
 )
 {
-  container pageHeader (class: 'pageheader', designproperties: ['Item gap': 'None']) {
+  container pageHeader (class: 'pageheader', designproperties: ('Item gap': 'None')) {
     dynamictext headerTitle (content: 'Customers', rendermode: H1, class: 'pageheader-title')
     dynamictext headerSubtitle
     (
       content: 'All active accounts',
       rendermode: Paragraph,
       class: 'pageheader-subtitle',
-      designproperties: ['Color': 'Detail color', 'Spacing': ['margin-bottom': 'None']]
+      designproperties: ('Color': 'Detail color', 'Spacing': ('margin-bottom': 'None'))
     )
   }
 };
@@ -245,13 +245,13 @@ cleanly into Studio Pro. Common mappings:
 
 | Class-style | Typed design-property equivalent |
 |---|---|
-| `class:'card'` | `designproperties: ['Card style': on]` |
-| `class:'background-primary'` | `designproperties: ['Background color': 'Brand Primary']` |
-| `class:'flex-column'` | `designproperties: ['Flex container': 'Vertical (column)']` |
-| `class:'flex-row'` | `designproperties: ['Flex container': 'Horizontal (row)']` |
-| `class:'align-x-center'` | `designproperties: ['Align items X': 'Center']` |
-| `class:'Shadow'` | `designproperties: ['Shadow': 'None' / 'Small' / …]` |
-| spacing utilities | `designproperties: ['Spacing': ['margin-bottom': 'L', 'padding-top': 'S']]` |
+| `class:'card'` | `designproperties: ('Card style': on)` |
+| `class:'background-primary'` | `designproperties: ('Background color': 'Brand Primary')` |
+| `class:'flex-column'` | `designproperties: ('Flex container': 'Vertical (column)')` |
+| `class:'flex-row'` | `designproperties: ('Flex container': 'Horizontal (row)')` |
+| `class:'align-x-center'` | `designproperties: ('Align items X': 'Center')` |
+| `class:'Shadow'` | `designproperties: ('Shadow': 'None' / 'Small' / …)` |
+| spacing utilities | `designproperties: ('Spacing': ('margin-bottom': 'L', 'padding-top': 'S'))` |
 
 **Both channels render identically at runtime** — raw `class:` is sufficient for the
 visual result today. The typed channel matters for Studio Pro round-trip and is the
diff --git a/.claude/skills/mendix/check-syntax/SKILL.md b/.claude/skills/mendix/check-syntax/SKILL.md
index e15eed2e0b..8f9dea6300 100644
--- a/.claude/skills/mendix/check-syntax/SKILL.md
+++ b/.claude/skills/mendix/check-syntax/SKILL.md
@@ -87,8 +87,10 @@ fourth — so "run it and see" is not a free experiment. `check` reports every
 conflict in the script before anything is written.
 
 Three spellings say "fine if it already exists", and none is reported:
-`create or modify`, `create or replace`, and `create … if not exists` (which
-leaves the stored element untouched rather than rewriting it). `create module M;`
+`create or modify`, `create or replace`, and `create <kind> if not exists <name>`
+(which leaves the stored element untouched rather than rewriting it; every
+`create` that names one element takes it, e.g. `create page if not exists M.P …`
+— `mxcli syntax create-if-not-exists`). `create module M;`
 is never reported either — it is a no-op when the module exists, which is what
 lets it open every script.
 
@@ -311,7 +313,7 @@ Before writing any MDL, verify these requirements:
 > **Exception — never quote `$`-prefixed variable/parameter references.** The quote
 > rule is for *bare* names (entities, attributes, associations, declared parameter
 > names). Variable and parameter **references** in expressions and widget bindings
-> stay **unquoted**: `datasource: $X`, `params: { $X: MES."Order" }`, `$currentObject`.
+> stay **unquoted**: `datasource: $X`, `params: ( $X: MES."Order" )`, `$currentObject`.
 > Quoting them (`"$X"`) breaks resolution ("parameter … references '$X' but no such
 > parameter is declared").
 >
diff --git a/.claude/skills/mendix/choose-edit-mode/SKILL.md b/.claude/skills/mendix/choose-edit-mode/SKILL.md
index f308ec52d6..933408ec63 100644
--- a/.claude/skills/mendix/choose-edit-mode/SKILL.md
+++ b/.claude/skills/mendix/choose-edit-mode/SKILL.md
@@ -42,7 +42,7 @@ Not sure who owns it? Treat it as Studio Pro-owned.
 | Association | `alter association … set …` |
 | Enumeration | `alter enumeration` (add / rename / modify / drop value) |
 | Page, snippet, layout | `alter page` / `alter snippet` / `alter layout` { set / insert / drop / replace } |
-| Workflow | `alter workflow` (set, insert after, drop / replace activity, outcomes, paths) |
+| Workflow | `alter workflow` { set / insert before / after / into / drop / replace } — activities by name or 'caption' |
 | Settings, security | `alter settings`, `alter app security`, `grant` / `revoke` |
 | Many pages at once | `update widgets … where …` (see `bulk-widget-updates`) |
 | **Microflow, nanoflow** | **none yet** |
diff --git a/.claude/skills/mendix/create-page/SKILL.md b/.claude/skills/mendix/create-page/SKILL.md
index 23214d2139..1d1d47946f 100644
--- a/.claude/skills/mendix/create-page/SKILL.md
+++ b/.claude/skills/mendix/create-page/SKILL.md
@@ -29,8 +29,8 @@ Guide for writing CREATE PAGE statements in Mendix Definition Language (MDL).
 ```sql
 create [or replace] page Module.PageName
 (
-  [params: { $ParamName: Module.EntityType | PrimitiveType, ... },]
-  [variables: { $varName: DataType = 'defaultExpression', ... },]
+  [params: ( $ParamName: Module.EntityType | PrimitiveType, ... ),]
+  [variables: ( $varName: DataType = 'defaultExpression', ... ),]
   title: 'Page Title',
   layout: Module.LayoutName,
   [url: 'page-url',]
@@ -75,7 +75,7 @@ Both are optional and can be changed later with `alter page … { set (Class: '
 | Selection binding | `datasource: selection widget` | `dataview dv (datasource: selection galleryList)` |
 | CSS class | `class: 'classes'` | `container c (class: 'card mx-spacing-top-large')` |
 | Inline style | `style: 'css'` | `container c (style: 'padding: 16px;')` |
-| Design properties | `designproperties: [...]` | `container c (designproperties: ['Spacing top': 'Large', 'full width': on])` |
+| Design properties | `designproperties: (...)` | `container c (designproperties: ('Spacing top': 'Large', 'full width': on))` |
 
 ### FOLDER Option
 
@@ -124,13 +124,13 @@ container c (style: 'background-color: #f8f9fa; padding: 16px;') { ... }
 **Design Properties** — Atlas UI structured properties (spacing, colors, toggles):
 ```sql
 -- Option property: 'Key': 'Value'
-container c (designproperties: ['Spacing top': 'Large', 'Background color': 'Brand Primary']) { ... }
+container c (designproperties: ('Spacing top': 'Large', 'Background color': 'Brand Primary')) { ... }
 
 -- Toggle property: 'Key': ON (enabled) or OFF (disabled/omitted)
-container c (designproperties: ['Full width': on]) { ... }
+container c (designproperties: ('Full width': on)) { ... }
 
 -- Multiple types combined
-actionbutton btn (caption: 'Save', designproperties: ['Size': 'Large', 'Full width': on])
+actionbutton btn (caption: 'Save', designproperties: ('Size': 'Large', 'Full width': on))
 ```
 
 **Dynamic Classes** — a Mendix expression evaluated at runtime that returns a
@@ -157,7 +157,7 @@ container ctnHero (
   class: 'card',
   style: 'border-left: 4px solid #264AE5;',
   dynamicclasses: if $currentObject/Featured then 'is-featured' else '',
-  designproperties: ['Spacing top': 'Large', 'Full width': on]
+  designproperties: ('Spacing top': 'Large', 'Full width': on)
 ) {
   dynamictext txtTitle (content: 'Styled Container', rendermode: H3)
 }
diff --git a/.claude/skills/mendix/create-page/reference/examples.md b/.claude/skills/mendix/create-page/reference/examples.md
index 65c1b431c3..0ba8361a58 100644
--- a/.claude/skills/mendix/create-page/reference/examples.md
+++ b/.claude/skills/mendix/create-page/reference/examples.md
@@ -9,7 +9,7 @@ Supporting reference for [create-page](../SKILL.md).
 ```sql
 create or replace page CRM.CustomerEdit
 (
-  params: { $Customer: CRM.Customer },
+  params: ( $Customer: CRM.Customer ),
   title: 'Edit Customer',
   layout: Atlas_Core.PopupLayout
 )
@@ -82,8 +82,8 @@ create page CRM.Customer_MasterDetail
         dynamictext heading (content: 'Customers', rendermode: H3)
         gallery customerList (datasource: database from CRM.Customer sort by Name asc, selection: single) {
           template {
-            dynamictext name (content: '{1}', contentparams: [{1} = Name], rendermode: H4)
-            dynamictext email (content: '{1}', contentparams: [{1} = Email])
+            dynamictext name (content: '{1}', contentparams: ({1} = Name), rendermode: H4)
+            dynamictext email (content: '{1}', contentparams: ({1} = Email))
           }
         }
       }
diff --git a/.claude/skills/mendix/create-page/reference/widgets.md b/.claude/skills/mendix/create-page/reference/widgets.md
index 7e75d8e763..aa73e7247b 100644
--- a/.claude/skills/mendix/create-page/reference/widgets.md
+++ b/.claude/skills/mendix/create-page/reference/widgets.md
@@ -17,13 +17,13 @@ dynamictext heading (content: 'Heading Text', rendermode: H2)
 dynamictext productName (content: '$Product.Name', rendermode: H3)
 
 -- Explicit template with page parameter binding
-dynamictext greeting (content: 'Welcome, {1}!', contentparams: [{1} = $Customer.Name])
+dynamictext greeting (content: 'Welcome, {1}!', contentparams: ({1} = $Customer.Name))
 
 -- Template with attribute from current DataView context (simple attribute name)
-dynamictext email (content: 'Email: {1}', contentparams: [{1} = Email])
+dynamictext email (content: 'Email: {1}', contentparams: ({1} = Email))
 
 -- Bind directly to an attribute of the surrounding DataView/ListView/Gallery
--- entity. `Attribute: X` is shorthand for `content: '{1}', contentparams: [{1} = X]`.
+-- entity. `Attribute: X` is shorthand for `content: '{1}', contentparams: ({1} = X)`.
 dynamictext title (Attribute: Title)
 ```
 
@@ -40,11 +40,11 @@ default (e.g. `5068.38000000`).
 
 ```sql
 -- Decimal: 2 decimals + thousands separator  ->  "5,068.38"
-dynamictext amt (content: '{1}', contentparams: [{1} = Amount format (decimalPrecision: 2, groupDigits: true)])
+dynamictext amt (content: '{1}', contentparams: ({1} = Amount format (decimalPrecision: 2, groupDigits: true)))
 
 -- DateTime: date + time, or a custom pattern
-dynamictext due  (content: '{1}', contentparams: [{1} = DueOn format (dateFormat: DateTime)])
-dynamictext day  (content: '{1}', contentparams: [{1} = DueOn format (dateFormat: Custom, customDateFormat: 'dd-MM-yyyy')])
+dynamictext due  (content: '{1}', contentparams: ({1} = DueOn format (dateFormat: DateTime)))
+dynamictext day  (content: '{1}', contentparams: ({1} = DueOn format (dateFormat: Custom, customDateFormat: 'dd-MM-yyyy')))
 ```
 
 | Format key | Applies to | Values |
@@ -198,13 +198,13 @@ name, which is why the keyword takes `for` and a qualified entity:
 ```sql
 listview vehicleListView (datasource: database from Pages.Vehicle) {
   -- the default body: used for an object no template matches
-  dynamictext defaultVehicle (content: '{1} {2}', contentparams: [{1} = Brand, {2} = Model])
+  dynamictext defaultVehicle (content: '{1} {2}', contentparams: ({1} = Brand, {2} = Model))
 
   template for Pages.Bus {
-    dynamictext busLabel (content: 'Bus, capacity {1}', contentparams: [{1} = PassengerCapacity])
+    dynamictext busLabel (content: 'Bus, capacity {1}', contentparams: ({1} = PassengerCapacity))
   }
   template for Pages.Truck {
-    dynamictext truckLabel (content: 'Truck, max load {1} kg', contentparams: [{1} = MaxLoadKg])
+    dynamictext truckLabel (content: 'Truck, max load {1} kg', contentparams: ({1} = MaxLoadKg))
   }
 }
 ```
@@ -322,7 +322,7 @@ datagrid gridName (datasource: database from Module.Entity) {
     Caption: 'Amount',
     ShowContentAs: dynamicText,
     Content: 'Amt: {1}',
-    ContentParams: [{1} = Amount format (decimalPrecision: 2, groupDigits: true)]
+    ContentParams: ({1} = Amount format (decimalPrecision: 2, groupDigits: true))
   )
   column due (attribute: DueOn, caption: 'Due')
 }
@@ -549,8 +549,8 @@ gallery galleryName (
   PhoneColumns: 1
 ) {
   template {
-    dynamictext name (content: '{1}', contentparams: [{1} = Name], rendermode: H4)
-    dynamictext email (content: '{1}', contentparams: [{1} = Email])
+    dynamictext name (content: '{1}', contentparams: ({1} = Name), rendermode: H4)
+    dynamictext email (content: '{1}', contentparams: ({1} = Email))
   }
 }
 ```
@@ -562,8 +562,8 @@ gallery productGallery (datasource: database Module.Product, selection: single)
     textfilter searchName (attribute: Name)
   }
   template {
-    dynamictext prodName (content: '{1}', contentparams: [{1} = Name], rendermode: H4)
-    dynamictext prodCode (content: 'SKU: {1}', contentparams: [{1} = Code])
+    dynamictext prodName (content: '{1}', contentparams: ({1} = Name), rendermode: H4)
+    dynamictext prodCode (content: 'SKU: {1}', contentparams: ({1} = Code))
   }
 }
 ```
@@ -658,7 +658,7 @@ Embed a reusable snippet:
 snippetcall snippetName (snippet: Module.SnippetName)
 
 -- With parameters
-snippetcall actions (snippet: Module.EntityActions, params: {entity: $Param})
+snippetcall actions (snippet: Module.EntityActions, params: (entity = $Param))
 ```
 
 **A parameter satisfied by the enclosing data context takes NO mapping.** Mendix
@@ -672,12 +672,12 @@ dataview dvOrder (datasource: $Order) {
 }
 ```
 
-`params: {Order: $currentObject}` means the same thing and produces the same
+`params: (Order = $currentObject)` means the same thing and produces the same
 (empty) mapping. Naming a real page parameter or variable produces a real
 mapping, as expected:
 
 ```sql
-snippetcall scActions (snippet: MyModule.OrderActions, params: {Order: $Order})
+snippetcall scActions (snippet: MyModule.OrderActions, params: (Order = $Order))
 ```
 
 Omitting `Params:` where the context is a *different* entity is still an error —
@@ -804,7 +804,7 @@ pluggablewidget 'com.mendix.widget.web.image.Image' cardImage (
 -- numbered placeholders + contentparams: needed for several values, or a format block
 pluggablewidget 'com.mendix.widget.web.image.Image' cardImage (
   datasource: imageUrl,
-  imageUrl: '{1}/{2}', contentparams: [{1} = BaseUrl, {2} = PictureUrl]
+  imageUrl: '{1}/{2}', contentparams: ({1} = BaseUrl, {2} = PictureUrl)
 )
 
 -- `<Name>Params`: the property's OWN parameters. `contentparams` is one list
@@ -812,8 +812,8 @@ pluggablewidget 'com.mendix.widget.web.image.Image' cardImage (
 -- `alternativeText` to different attributes; this can (ako/mxcli#575).
 pluggablewidget 'com.mendix.widget.web.image.Image' cardImage (
   datasource: imageUrl,
-  imageUrl: '{1}',        imageUrlParams: [{1} = PictureUrl],
-  alternativeText: '{1}', alternativeTextParams: [{1} = Name]
+  imageUrl: '{1}',        imageUrlParams: ({1} = PictureUrl),
+  alternativeText: '{1}', alternativeTextParams: ({1} = Name)
 )
 ```
 
@@ -911,13 +911,13 @@ container card1 (class: 'card', style: 'padding: 16px;') {
 }
 
 -- Container with design properties
-container spaced1 (designproperties: ['Spacing top': 'Large', 'Full width': on]) {
+container spaced1 (designproperties: ('Spacing top': 'Large', 'Full width': on)) {
   dynamictext text1 (content: 'Spaced full-width content')
 }
 
 -- Nested containers with combined styling
 customcontainer outer1 (class: 'section') {
-  container inner1 (class: 'card', designproperties: ['Spacing top': 'Medium']) {
+  container inner1 (class: 'card', designproperties: ('Spacing top': 'Medium')) {
     dynamictext text1 (content: 'Nested content')
   }
 }
diff --git a/.claude/skills/mendix/custom-widgets/SKILL.md b/.claude/skills/mendix/custom-widgets/SKILL.md
index 62526e3a45..83b6aac102 100644
--- a/.claude/skills/mendix/custom-widgets/SKILL.md
+++ b/.claude/skills/mendix/custom-widgets/SKILL.md
@@ -142,8 +142,8 @@ gallery galleryName (
   PhoneColumns: 1
 ) {
   template {
-    dynamictext title (content: '{1}', contentparams: [{1} = Name], rendermode: H4)
-    dynamictext info  (content: '{1}', contentparams: [{1} = Email])
+    dynamictext title (content: '{1}', contentparams: ({1} = Name), rendermode: H4)
+    dynamictext info  (content: '{1}', contentparams: ({1} = Email))
   }
   filter {
     textfilter   searchName  (attribute: Name)
@@ -456,7 +456,7 @@ Set `"templateFile": "mywidget.json"` in the .def.json. Project definitions over
 ```sql
 MYWIDGET myWidget1 (datasource: database Module.Entity, attribute: Name) {
   template content1 {
-    dynamictext label1 (content: '{1}', contentparams: [{1}=Name])
+    dynamictext label1 (content: '{1}', contentparams: ({1}=Name))
   }
 }
 ```
@@ -559,7 +559,7 @@ A `texttemplate` takes **text**, so a bare value renders the same string on ever
 row. Bind it with the property's own `<Name>Params` companion, named for
 whichever spelling the template used (`ImageUrl:` pairs with `ImageUrlParams:`)
 and taking the same `format (...)` block a `dynamictext` does — e.g.
-`headerCaption: '{1}', headerCaptionParams: [{1} = Name]`, or a Timeline's
+`headerCaption: '{1}', headerCaptionParams: ({1} = Name)`, or a Timeline's
 `title` / `description` bound separately. `contentparams:` is ONE list shared by
 every template on the widget, so it only disambiguates a widget with a single
 one; `'{AttrName}'` is the short form for one attribute. A companion whose
diff --git a/.claude/skills/mendix/database-connections/SKILL.md b/.claude/skills/mendix/database-connections/SKILL.md
index d5ebc3fd6c..eab17666e3 100644
--- a/.claude/skills/mendix/database-connections/SKILL.md
+++ b/.claude/skills/mendix/database-connections/SKILL.md
@@ -65,17 +65,22 @@ create constant MyModule.DbPassword type string
 ### Basic Connection Structure
 
 ```sql
-create database connection Module.ConnectionName
-type '<database-type>'
-connection string @Module.ConnectionStringConstant
-username @Module.UsernameConstant
-password @Module.PasswordConstant
-begin
-  -- Query definitions go here
-end;
+create database connection Module.ConnectionName (
+  Type: '<database-type>',
+  ConnectionString: @Module.ConnectionStringConstant,
+  Username: @Module.UsernameConstant,
+  Password: @Module.PasswordConstant
+) {
+  -- query definitions go here: query Name ( Sql: …, Returns: … )
+};
 ```
 
-**The `@` is not optional.** `connection string`, `username` and `password` are
+The connection's properties are in `( )` and its queries are its children, in
+`{ }` — the shape of every declarative document (R2). The old clause form
+(`type '…' connection string @… begin query … ; end`) still parses and warns
+(MDL-DEPR127); `mxcli fmt --upgrade` rewrites it.
+
+**The `@` is not optional.** `ConnectionString`, `Username` and `Password` are
 ConstantIdentifier properties — Mendix stores a *reference to a Constant
 document*, never a value. The grammar accepts a bare string there, but writing
 one produces a project that **cannot be opened at all**:
@@ -91,15 +96,15 @@ it as **MDL058** at both `check` and `exec`.
 
 ```sql
 -- WRONG — writes an unopenable .mpr
-connection string 'jdbc:postgresql://localhost:5432/app'
-username 'app'
+ConnectionString: 'jdbc:postgresql://localhost:5432/app',
+Username: 'app'
 
 -- RIGHT — declare the constant, then reference it
 create constant Module.DbUrl  type String default 'jdbc:postgresql://localhost:5432/app';
 create constant Module.DbUser type String default 'app';
 
-connection string @Module.DbUrl
-username @Module.DbUser
+ConnectionString: @Module.DbUrl,
+Username: @Module.DbUser
 ```
 
 The indirection is the point: the constant's value is per-environment, so a
@@ -111,7 +116,7 @@ These are the values Studio Pro's own connector editor offers — read out of th
 shipped bundle at `modeler/ide-client/database-connector-editor/`, identical on
 11.10.0, 11.12.1 and 11.13.0.
 
-| Database | TYPE Value | Studio Pro label |
+| Database | `Type:` value | Studio Pro label |
 |----------|------------|------------------|
 | SQL Server | `'MSSQL'` | Microsoft SQL |
 | MySQL | `'MySQL'` | MySQL |
@@ -158,42 +163,50 @@ the file system disagree about where the dependency comes from.
 **`'Redshift'` and `'SQLServer'` are not real values.** Both appeared in an
 earlier version of this table and neither is in the picker on any version
 checked. mxcli writes the type string through unchanged and **mxbuild does not
-validate it** — `type 'Redshift'` builds 0 errors and simply does not connect —
+validate it** — `Type: 'Redshift'` builds 0 errors and simply does not connect —
 so `mxcli check` warns about an unrecognised type (MDL-DB01) rather than letting
 a green build hide it.
 
 ## Query Definition Syntax
 
+A query is a child of the connection, with its properties in `( )`:
+`Sql`, `Parameters`, `Returns` and `Map`. The SQL may be a string or `$$…$$`,
+which needs no quote doubling.
+
 ### Simple Query (No Parameters)
 
 ```sql
-query QueryName
-  sql 'SELECT column1, column2 FROM table_name'
-  returns Module.EntityName;
+query QueryName (
+  Sql: 'SELECT column1, column2 FROM table_name',
+  Returns: Module.EntityName
+)
 ```
 
 ### Parameterized Query
 
 ```sql
-query QueryName
-  sql 'SELECT * FROM table_name WHERE column = {paramName}'
-  parameter paramName: string
-  returns Module.EntityName;
+query QueryName (
+  Sql: 'SELECT * FROM table_name WHERE column = {paramName}',
+  Parameters: ( paramName: string ),
+  Returns: Module.EntityName
+)
 ```
 
 ### Query with Column Mapping
 
-When database column names don't match entity attribute names:
+When database column names don't match entity attribute names, `Map` binds each
+attribute to its column — `Attribute = column`, the way a mapping side is written:
 
 ```sql
-query QueryName
-  sql 'SELECT emp_id, emp_name, dept_no FROM employees'
-  returns Module.EmployeeRecord
-  map (
-    emp_id as EmployeeId,
-    emp_name as EmployeeName,
-    dept_no as DepartmentNumber
-  );
+query QueryName (
+  Sql: 'SELECT emp_id, emp_name, dept_no FROM employees',
+  Returns: Module.EmployeeRecord,
+  Map: (
+    EmployeeId = emp_id,
+    EmployeeName = emp_name,
+    DepartmentNumber = dept_no
+  )
+)
 ```
 
 ### Supported Parameter Types
@@ -210,10 +223,10 @@ Parameters can include a test value for Studio Pro testing, or indicate they sho
 
 ```sql
 -- Test value (used in Studio Pro's Execute Query dialog)
-parameter empName: string default 'Smith'
+Parameters: ( empName: string default 'Smith' )
 
 -- Test with NULL value
-parameter optionalDate: datetime null
+Parameters: ( optionalDate: datetime null )
 ```
 
 ## Complete Examples
@@ -242,26 +255,29 @@ create non-persistent entity OracleDemo.EmpRecord (
 );
 
 -- Step 4: Create database connection
-create database connection OracleDemo.HRDatabase
-type 'Oracle'
-connection string @OracleDemo.OracleConnectionString
-username @OracleDemo.OracleUser
-password @OracleDemo.OraclePassword
-begin
-  query GetAllEmployees
-    sql 'SELECT EMPNO, ENAME, JOB, SAL, DEPTNO FROM EMP ORDER BY EMPNO'
-    returns OracleDemo.EmpRecord;
-
-  query GetEmployeeByName
-    sql 'SELECT EMPNO, ENAME, JOB, SAL, DEPTNO FROM EMP WHERE ENAME = {empName}'
-    parameter empName: string
-    returns OracleDemo.EmpRecord;
-
-  query GetHighEarners
-    sql 'SELECT EMPNO, ENAME, JOB, SAL, DEPTNO FROM EMP WHERE SAL >= {minSalary}'
-    parameter minSalary: decimal
-    returns OracleDemo.EmpRecord;
-end;
+create database connection OracleDemo.HRDatabase (
+  Type: 'Oracle',
+  ConnectionString: @OracleDemo.OracleConnectionString,
+  Username: @OracleDemo.OracleUser,
+  Password: @OracleDemo.OraclePassword
+) {
+  query GetAllEmployees (
+    Sql: 'SELECT EMPNO, ENAME, JOB, SAL, DEPTNO FROM EMP ORDER BY EMPNO',
+    Returns: OracleDemo.EmpRecord
+  )
+
+  query GetEmployeeByName (
+    Sql: 'SELECT EMPNO, ENAME, JOB, SAL, DEPTNO FROM EMP WHERE ENAME = {empName}',
+    Parameters: ( empName: string ),
+    Returns: OracleDemo.EmpRecord
+  )
+
+  query GetHighEarners (
+    Sql: 'SELECT EMPNO, ENAME, JOB, SAL, DEPTNO FROM EMP WHERE SAL >= {minSalary}',
+    Parameters: ( minSalary: decimal ),
+    Returns: OracleDemo.EmpRecord
+  )
+};
 ```
 
 ### Example 2: PostgreSQL Connection
@@ -280,33 +296,35 @@ create non-persistent entity Inventory.ProductRecord (
   Price: decimal
 );
 
-create database connection Inventory.ProductDatabase
-type 'PostgreSQL'
-connection string @Inventory.PgConnectionString
-username @Inventory.PgUser
-password @Inventory.PgPassword
-begin
-  query GetAllProducts
-    sql 'SELECT product_id, product_name, quantity, price FROM products'
-    returns Inventory.ProductRecord
-    map (
-      product_id as ProductId,
-      product_name as ProductName,
-      quantity as Quantity,
-      price as Price
-    );
-
-  query SearchProducts
-    sql 'SELECT product_id, product_name, quantity, price FROM products WHERE product_name ILIKE {searchPattern}'
-    parameter searchPattern: string
-    returns Inventory.ProductRecord
-    map (
-      product_id as ProductId,
-      product_name as ProductName,
-      quantity as Quantity,
-      price as Price
-    );
-end;
+create database connection Inventory.ProductDatabase (
+  Type: 'PostgreSQL',
+  ConnectionString: @Inventory.PgConnectionString,
+  Username: @Inventory.PgUser,
+  Password: @Inventory.PgPassword
+) {
+  query GetAllProducts (
+    Sql: 'SELECT product_id, product_name, quantity, price FROM products',
+    Returns: Inventory.ProductRecord,
+    Map: (
+      ProductId = product_id,
+      ProductName = product_name,
+      Quantity = quantity,
+      Price = price
+    )
+  )
+
+  query SearchProducts (
+    Sql: 'SELECT product_id, product_name, quantity, price FROM products WHERE product_name ILIKE {searchPattern}',
+    Parameters: ( searchPattern: string ),
+    Returns: Inventory.ProductRecord,
+    Map: (
+      ProductId = product_id,
+      ProductName = product_name,
+      Quantity = quantity,
+      Price = price
+    )
+  )
+};
 ```
 
 ## Viewing Connections
@@ -418,14 +436,15 @@ standalone JDBC harness before that.
 
 ### Parameterized Queries
 
-Pass values for query parameters defined with `parameter` in the query definition:
+Pass values for the query parameters declared in the query's `Parameters:` list:
 
 ```sql
--- Query definition (in DATABASE CONNECTION block):
---   QUERY GetDriversByNationality
---     SQL 'SELECT * FROM drivers WHERE nationality = {nation}'
---     PARAMETER nation: String
---     RETURNS Module.DriverRecord;
+-- Query definition (in the database connection's { } block):
+--   query GetDriversByNationality (
+--     Sql: 'SELECT * FROM drivers WHERE nationality = {nation}',
+--     Parameters: ( nation: String ),
+--     Returns: Module.DriverRecord
+--   )
 
 -- Microflow execution:
 $Drivers = execute database query Module.Connection.GetDriversByNationality
@@ -463,23 +482,25 @@ create constant HR.DbUrl type string default 'jdbc:postgresql://localhost:5432/h
 create constant HR.DbUser type string default 'app';
 create constant HR.DbPass type string default '';
 
-create database connection HR.MainDB
-type 'PostgreSQL'
-connection string @HR.DbUrl
-username @HR.DbUser
-password @HR.DbPass
-begin
-  query GetAllEmployees
-    sql 'SELECT emp_id, name, department FROM employees'
-    returns HR.EmployeeRecord
-    map (emp_id as EmpId, name as Name, department as Department);
-
-  query GetByDepartment
-    sql 'SELECT emp_id, name, department FROM employees WHERE department = {dept}'
-    parameter dept: string
-    returns HR.EmployeeRecord
-    map (emp_id as EmpId, name as Name, department as Department);
-end;
+create database connection HR.MainDB (
+  Type: 'PostgreSQL',
+  ConnectionString: @HR.DbUrl,
+  Username: @HR.DbUser,
+  Password: @HR.DbPass
+) {
+  query GetAllEmployees (
+    Sql: 'SELECT emp_id, name, department FROM employees',
+    Returns: HR.EmployeeRecord,
+    Map: (EmpId = emp_id, Name = name, Department = department)
+  )
+
+  query GetByDepartment (
+    Sql: 'SELECT emp_id, name, department FROM employees WHERE department = {dept}',
+    Parameters: ( dept: string ),
+    Returns: HR.EmployeeRecord,
+    Map: (EmpId = emp_id, Name = name, Department = department)
+  )
+};
 
 -- Microflow that executes the query
 create microflow HR.ACT_LoadEmployees($Department: string)
diff --git a/.claude/skills/mendix/fragments/SKILL.md b/.claude/skills/mendix/fragments/SKILL.md
index de133d3ca7..487408a169 100644
--- a/.claude/skills/mendix/fragments/SKILL.md
+++ b/.claude/skills/mendix/fragments/SKILL.md
@@ -52,7 +52,7 @@ Inside a page or snippet body:
 ```mdl
 create page Module.CustomerEdit
 (
-  params: { $Customer: Module.Customer },
+  params: ( $Customer: Module.Customer ),
   title: 'Edit Customer',
   layout: Atlas_Core.PopupLayout
 )
@@ -80,7 +80,7 @@ widgets should land, then fill it with the `use fragment X { … }` payload form
 
 ```mdl
 create fragment Card as {
-  container cardWrap (class: 'card', designproperties: ['Card style': on]) {
+  container cardWrap (class: 'card', designproperties: ('Card style': on)) {
     container cardBody (class: 'card-body') {
       slot content            -- caller's widgets are spliced in here
     }
diff --git a/.claude/skills/mendix/manage-navigation/SKILL.md b/.claude/skills/mendix/manage-navigation/SKILL.md
index 07cb796d95..4c68c074bf 100644
--- a/.claude/skills/mendix/manage-navigation/SKILL.md
+++ b/.claude/skills/mendix/manage-navigation/SKILL.md
@@ -31,7 +31,7 @@ Use when the user asks to:
 - **Offline Profiles** — An offline profile makes the app work without a connection (a PWA with a local database that syncs). It is not a different document — same properties as its online twin — but it **constrains every page it can reach**, see below.
 - **Home Page** — The default page shown after login. Can be a PAGE or MICROFLOW.
 - **Role-Based Home Pages** — Override the default home page per user role (e.g., admins see a dashboard, users see a task list).
-- **Menu Items** — Hierarchical menu tree. Each item has a caption and optionally targets a PAGE or MICROFLOW. Sub-menus nest with `menu 'caption' (...)`.
+- **Menu Items** — Hierarchical menu tree. Each item has a caption and optionally targets a PAGE or MICROFLOW. Sub-menus nest with `menu 'caption' { ... }`.
 - **Menu Documents** — A *separate* document type (`Menus$MenuDocument`) holding a reusable menu that a menu widget points at, e.g. Atlas_Core's `Phone_Menu`. Not the same thing as a profile's menu, though both are built from the same items, so the item syntax is identical. Managed with `create/describe/drop menu` — see below.
 - **Login Page** — Custom login page (optional; Mendix provides a default).
 - **Not-Found Page** — Custom 404 page (optional).
@@ -97,25 +97,29 @@ roles called `Administrator` in three modules. List the real ones with
 
 ### Full Menu Tree
 
-The `menu (...)` block replaces the entire menu. Use `menu item` for leaf items and `menu 'caption' (...)` for sub-menus:
+The menu items are the profile's children, in `{ ... }` after its clauses, like a page's widgets — no `;` between them. The block replaces the entire menu. Use `menu item 'Caption' ( OnClick: … )` for leaf items and `menu 'caption' { ... }` for sub-menus. The action is `OnClick:` in the words a page action uses: `show page M.P`, `call microflow M.F`, or `sign out`:
 
 ```sql
 create or replace navigation Responsive
   home page MyModule.Home_Web
   login page Administration.Login
-  menu (
-    menu item 'Home' page MyModule.Home_Web;
-    menu 'Orders' (
-      menu item 'All Orders' page Orders.Order_Overview;
-      menu item 'New Order' page Orders.Order_New;
-    );
-    menu 'Admin' (
-      menu item 'Users' page Administration.Account_Overview;
-      menu item 'Run Report' microflow Reports.ACT_GenerateReport;
-    );
-  );
+  {
+    menu item 'Home' ( OnClick: show page MyModule.Home_Web )
+    menu 'Orders' {
+      menu item 'All Orders' ( OnClick: show page Orders.Order_Overview )
+      menu item 'New Order' ( OnClick: show page Orders.Order_New )
+    }
+    menu 'Admin' {
+      menu item 'Users' ( OnClick: show page Administration.Account_Overview )
+      menu item 'Run Report' ( OnClick: call microflow Reports.ACT_GenerateReport )
+    }
+  };
 ```
 
+The old spelling — `menu ( menu item 'Home' page M.Home; menu 'Admin' ( … ); )`,
+the action and icon as clauses and `;` after each item — still parses and warns
+(MDL-DEPR121, MDL-DEPR122); `mxcli fmt --upgrade` rewrites it.
+
 ### Menu Icons
 
 **Give every menu item an icon.** It is optional in the grammar and `mxcli check`
@@ -125,14 +129,15 @@ shows its icon, and one without falls back to the first few characters of its
 caption — rarely enough to tell `Orders` from `Order lines`. Nothing else catches
 it. The model builds, `mx check` passes, and the menu is simply hard to use.
 
-Both `menu item` and `menu 'caption' (...)` take an `icon`, in one of three
-forms — Mendix stores three different icon **elements**, not three spellings of
-one value:
+Both `menu item` and `menu 'caption' { ... }` take an `Icon:` in their property
+list, in one of three forms — Mendix stores three different icon **elements**, not
+three spellings of one value:
 
 ```sql
-menu item 'Home'  page M.Home  icon Atlas_Core.Atlas.home;     -- icon collection
-menu item 'Close' page M.Close icon glyph 57377;               -- numeric glyph code
-menu item 'Logo'  page M.Logo  icon image M.Images.logo;       -- image collection
+menu item 'Home'  ( OnClick: show page M.Home,  Icon: Atlas_Core.Atlas.home )   -- icon collection
+menu item 'Close' ( OnClick: show page M.Close, Icon: glyph 57377 )             -- numeric glyph code
+menu item 'Logo'  ( OnClick: show page M.Logo,  Icon: image M.Images.logo )     -- image collection
+menu 'Admin' ( Icon: Atlas_Core.Atlas.user ) { … }                               -- a sub-menu's icon
 ```
 
 The **bare** form is the icon-collection icon and is what you normally want. Use
@@ -148,7 +153,7 @@ not the cause. `mxcli check` now warns (**MDL078**) against the 247 codes the
 shipped font defines, but a glyph is still an unchecked number where an icon
 collection reference is a resolved model reference. Browse the codes with `show glyphs`
 (`show glyphs like 'star'` searches by name, `describe glyph 57350` goes the
-other way), or use `icon Atlas_Core.Atlas.<name>` and list the names with
+other way), or use `Icon: Atlas_Core.Atlas.<name>` and list the names with
 `describe icon collection Atlas_Core.Atlas`.
 
 The icon-collection form is a **qualified name** — a model reference, written
@@ -157,13 +162,13 @@ like every other reference in MDL, not a string:
 ```sql
 create or replace navigation Responsive
   home page MyModule.Home_Web
-  menu (
-    menu item 'Home' page MyModule.Home_Web icon Atlas_Core.Atlas.home;
-    menu 'Orders' icon Atlas_Core.Atlas."shopping-cart" (
-      menu item 'All Orders' page Orders.Order_Overview
-        icon Atlas_Core.Atlas."list-bullets";
-    );
-  );
+  {
+    menu item 'Home' ( OnClick: show page MyModule.Home_Web, Icon: Atlas_Core.Atlas.home )
+    menu 'Orders' ( Icon: Atlas_Core.Atlas."shopping-cart" ) {
+      menu item 'All Orders' ( OnClick: show page Orders.Order_Overview,
+        Icon: Atlas_Core.Atlas."list-bullets" )
+    }
+  };
 ```
 
 **Hyphenated names are double-quoted** (`Atlas_Core.Atlas."align-center"`) —
@@ -182,11 +187,11 @@ describe icon collection Atlas_Core.Atlas;
 *glyph* icon (a numeric character code) or an *image* icon (pointing into an
 image collection). Those are different elements with different fields, so MDL
 does not write them — and `describe navigation` reports them as a comment rather
-than emitting an `icon` clause that would silently convert one into the other on
+than emitting an `Icon:` that would silently convert one into the other on
 replay:
 
 ```
-menu item 'Close' page MyModule.Close;
+menu item 'Close' ( OnClick: show page MyModule.Close )
 -- icon System.Images.Close (Forms$ImageIcon) is not reproducible by CREATE NAVIGATION; set it in Studio Pro
 ```
 
@@ -239,7 +244,7 @@ doubled — and a stored constraint already carries Mendix's own escaping, so th
 two compose into runs of six quotes. `describe navigation` emits the bracket
 form. This is the general problem tracked as `mendixlabs/mxcli#750`.
 
-**The block replaces the stored list**, the way `menu (...)` replaces the menu.
+**The block replaces the stored list**, the way the `{ ... }` menu block replaces the menu.
 Omitting it leaves the stored configuration alone.
 
 **Ask the catalog which entities sync, rather than reading the profile.**
@@ -280,12 +285,12 @@ silently dropped.
 
 ### Clear the Menu
 
-An empty `menu ()` block removes all menu items:
+An empty `{ }` menu block removes all menu items:
 
 ```sql
 create or replace navigation Responsive
   home page MyModule.Home_Web
-  menu ();
+  {};
 ```
 
 ### Not-Found Page
@@ -317,10 +322,10 @@ describe navigation Responsive;
 create or replace navigation Responsive
   home page MyModule.Home_Web
   login page Administration.Login
-  menu (
-    menu item 'Home' page MyModule.Home_Web;
-    menu item 'New Feature' page MyModule.NewFeature;
-  );
+  {
+    menu item 'Home' ( OnClick: show page MyModule.Home_Web )
+    menu item 'New Feature' ( OnClick: show page MyModule.NewFeature )
+  };
 
 -- Step 3: Verify
 describe navigation Responsive;
@@ -370,9 +375,9 @@ create page MyModule.Home_Web
 -- Configure navigation
 create or replace navigation Responsive
   home page MyModule.Home_Web
-  menu (
-    menu item 'Home' page MyModule.Home_Web;
-  );
+  {
+    menu item 'Home' ( OnClick: show page MyModule.Home_Web )
+  };
 ```
 
 ### Adding a New Page to Navigation
@@ -387,13 +392,13 @@ describe navigation Responsive;
 create or replace navigation Responsive
   home page MyModule.Home_Web
   login page Administration.Login
-  menu (
-    menu item 'Home' page MyModule.Home_Web;
-    menu item 'Customers' page MyModule.Customer_Overview;  -- new
-    menu 'Admin' (
-      menu item 'Users' page Administration.Account_Overview;
-    );
-  );
+  {
+    menu item 'Home' ( OnClick: show page MyModule.Home_Web )
+    menu item 'Customers' ( OnClick: show page MyModule.Customer_Overview )  -- new
+    menu 'Admin' {
+      menu item 'Users' ( OnClick: show page Administration.Account_Overview )
+    }
+  };
 ```
 
 ## Menu Documents (standalone, reusable)
@@ -410,17 +415,17 @@ show navigation menu;                    -- the menu inside each profile
 describe menu Atlas_Core.Phone_Menu;     -- a standalone menu document
 ```
 
-Menu documents use the same item syntax as the profile `menu (...)` block:
+Menu documents use the same item syntax as the profile's `{ ... }` menu block:
 
 ```sql
-create or modify menu MyModule.Main_Menu (
-  menu item 'Home' page MyModule.Home_Web icon Atlas_Core.Atlas.home;
-  menu item 'Run' microflow MyModule.DoThing;
-  menu 'Admin' (
-    menu item 'Accounts' page Administration.Account_Overview;
-  );
-  menu item 'Plain';
-);
+create or modify menu MyModule.Main_Menu {
+  menu item 'Home' ( OnClick: show page MyModule.Home_Web, Icon: Atlas_Core.Atlas.home )
+  menu item 'Run' ( OnClick: call microflow MyModule.DoThing )
+  menu 'Admin' {
+    menu item 'Accounts' ( OnClick: show page Administration.Account_Overview )
+  }
+  menu item 'Plain'
+};
 
 drop menu MyModule.Main_Menu;
 ```
@@ -454,9 +459,9 @@ An offline profile is created the same way as any other:
 ```sql
 create or replace navigation TabletOffline
   home page Maintenance.Request_Overview
-  menu (
-    menu item 'Requests' page Maintenance.Request_Overview;
-  );
+  {
+    menu item 'Requests' ( OnClick: show page Maintenance.Request_Overview )
+  };
 ```
 
 Two things about it are worth knowing before you do.
@@ -503,9 +508,9 @@ stored. MDL does not author per-entity sync modes — set those in Studio Pro.
 - [ ] For an **offline** profile, no page it can reach binds an attribute across more than one association (CE6206)
 - [ ] All PAGE/MICROFLOW targets are fully qualified (`Module.Name`)
 - [ ] Role references in `for` clauses are fully qualified (`Module.Role`)
-- [ ] Every `menu item` and `menu 'caption' (...)` ends with `;`
-- [ ] Sub-menu items are wrapped in `menu 'caption' ( ... );`
-- [ ] `icon` is a qualified name (not a string); hyphenated segments are double-quoted
+- [ ] Menu items are in `{ }` with no `;` between them; sub-menu items in `menu 'caption' { ... }`
+- [ ] A menu item's action is `( OnClick: show page M.P )`, `call microflow M.F` or `sign out`
+- [ ] `Icon:` is a qualified name (not a string); hyphenated segments are double-quoted
 - [ ] The icon exists — check with `describe icon collection Module.Name`, do not guess
 - [ ] Use `describe navigation` to verify changes after applying
 - [ ] For a **menu document**, confirm you want `create menu` and not a profile menu — `show navigation menu` vs `describe menu` tells them apart
@@ -517,4 +522,4 @@ an offline navigation profile downloads **nothing** until each entity has a sync
 
 ## Menu documents (CREATE OR MODIFY/DESCRIBE/DROP MENU)
 
-standalone `Menus$MenuDocument`, the reusable menu a menu widget points at (Atlas_Core's `Phone_Menu`/`Tablet_Menu`) — **not** the menu inside a navigation profile, though both are built from the same items, so the item syntax is shared with `CREATE NAVIGATION`'s `MENU (...)` block. DESCRIBE is round-trippable. Written through gen+codec, which is load-bearing: Studio Pro's menu documents carry typed-array marker **3** on the item collection and each item's sub-items (the codec default), while the navigation writers hand-build items with marker **1** — unverified whether that is a latent navigation bug or a real difference, so navigation is left alone. Authoring is modelsdk-only; legacy refuses. Two traps: a menu item cannot open a page with required parameters (**CE1571**), and only `Forms$IconCollectionIcon` round-trips (glyph/image icons are flagged by DESCRIBE, not dropped silently)
+standalone `Menus$MenuDocument`, the reusable menu a menu widget points at (Atlas_Core's `Phone_Menu`/`Tablet_Menu`) — **not** the menu inside a navigation profile, though both are built from the same items, so the item syntax is shared with `CREATE NAVIGATION`'s `{ ... }` menu block. DESCRIBE is round-trippable. Written through gen+codec, which is load-bearing: Studio Pro's menu documents carry typed-array marker **3** on the item collection and each item's sub-items (the codec default), while the navigation writers hand-build items with marker **1** — unverified whether that is a latent navigation bug or a real difference, so navigation is left alone. Authoring is modelsdk-only; legacy refuses. Two traps: a menu item cannot open a page with required parameters (**CE1571**), and only `Forms$IconCollectionIcon` round-trips (glyph/image icons are flagged by DESCRIBE, not dropped silently)
diff --git a/.claude/skills/mendix/manage-security/SKILL.md b/.claude/skills/mendix/manage-security/SKILL.md
index 8a0df57354..57e3cfa0ac 100644
--- a/.claude/skills/mendix/manage-security/SKILL.md
+++ b/.claude/skills/mendix/manage-security/SKILL.md
@@ -385,10 +385,22 @@ grant read (EmployeeNo) on entity Docs.Employee to Docs.Viewer;   -- not Name/Bl
 
 ```sql
 -- Create with module roles
-create user role RegularUser (MyModule.User, OtherModule.Reader);
+create user role RegularUser ( ModuleRoles: (MyModule.User, OtherModule.Reader) );
 
 -- Create with manage all roles permission
-create user role SuperAdmin (MyModule.Admin) manage all roles;
+create user role SuperAdmin ( ModuleRoles: (MyModule.Admin), ManageAllRoles: true );
+
+-- Every property is optional: Description, CheckSecurity, ManageableRoles,
+-- ManageUsersWithoutRoles. `create user role Guest;` has no module roles.
+-- `create or modify` adds the listed module roles and sets only the stated
+-- properties. The positional `create user role R (M.A) manage all roles`
+-- is deprecated (MDL-DEPR710); `mxcli fmt --upgrade` rewrites it.
+create or modify user role Manager (
+  ModuleRoles: (MyModule.Manager),
+  Description: 'Approves orders',
+  ManageableRoles: (RegularUser),
+  CheckSecurity: true
+);
 
 -- Add/drop module roles
 alter user role RegularUser add module roles (MyModule.Viewer);
@@ -420,7 +432,7 @@ the important half: **whatever that role can read is the app's public surface.**
 ```sql
 -- The role anonymous visitors are given. System.User is what lets an
 -- unauthenticated session exist at all.
-create user role Anonymous (Shop.Viewer, System.User);
+create user role Anonymous ( ModuleRoles: (Shop.Viewer, System.User) );
 
 alter app security guest access on role Anonymous;
 
@@ -502,8 +514,8 @@ grant view on page Shop.Customer_Overview to Shop.User, Shop.Admin, Shop.Viewer;
 grant view on page Shop.Customer_Edit to Shop.User, Shop.Admin;
 
 -- 5. Create user roles (project-level)
-create user role AppUser (Shop.User);
-create user role AppAdmin (Shop.Admin) manage all roles;
+create user role AppUser ( ModuleRoles: (Shop.User) );
+create user role AppAdmin ( ModuleRoles: (Shop.Admin), ManageAllRoles: true );
 
 -- 6. Verify
 describe security matrix in Shop;
diff --git a/.claude/skills/mendix/master-detail-pages/SKILL.md b/.claude/skills/mendix/master-detail-pages/SKILL.md
index f60378fefc..de5266670d 100644
--- a/.claude/skills/mendix/master-detail-pages/SKILL.md
+++ b/.claude/skills/mendix/master-detail-pages/SKILL.md
@@ -28,7 +28,7 @@ create page Module.Entity_MasterDetail
       column (desktopwidth: 4) {
         gallery entityList (datasource: database Module.Entity, selection: single) {
           template {
-            dynamictext name (content: '{1}', contentparams: [{1} = Name], rendermode: H4)
+            dynamictext name (content: '{1}', contentparams: ({1} = Name), rendermode: H4)
           }
         }
       }
@@ -59,7 +59,7 @@ gallery widgetName (
 ) {
   template template1 {
     -- Widgets for each item
-    dynamictext name (content: '{1}', contentparams: [{1} = AttrName], rendermode: H4)
+    dynamictext name (content: '{1}', contentparams: ({1} = AttrName), rendermode: H4)
   }
 }
 ```
@@ -110,8 +110,8 @@ create page CRM.Customer_MasterDetail
         dynamictext heading (content: 'Customers', rendermode: H3)
         gallery customerList (datasource: database from CRM.Customer sort by Name asc, selection: single) {
           template {
-            dynamictext name (content: '{1}', contentparams: [{1} = Name], rendermode: H4)
-            dynamictext email (content: '{1}', contentparams: [{1} = Email])
+            dynamictext name (content: '{1}', contentparams: ({1} = Name), rendermode: H4)
+            dynamictext email (content: '{1}', contentparams: ({1} = Email))
           }
         }
       }
@@ -154,8 +154,8 @@ The selection binding uses widget names to connect:
 Inside Gallery templates, use `contentparams` to reference current item attributes:
 ```sql
 template template1 {
-  dynamictext name (content: '{1}', contentparams: [{1} = Name], rendermode: H4)
-  dynamictext email (content: '{1}', contentparams: [{1} = Email])
+  dynamictext name (content: '{1}', contentparams: ({1} = Name), rendermode: H4)
+  dynamictext email (content: '{1}', contentparams: ({1} = Email))
 }
 ```
 
@@ -174,7 +174,7 @@ template template1 {
 | Attribute binding | `attribute: attributename` |
 | Action binding | `action: save changes` |
 | Button style | `buttonstyle: success` |
-| Text content | `content: 'text'` with `contentparams: [{1} = attr]` |
+| Text content | `content: 'text'` with `contentparams: ({1} = attr)` |
 | Render mode | `rendermode: H4` |
 | Template content | `template template1 { ... }` |
 
diff --git a/.claude/skills/mendix/migrate-design-prototype/SKILL.md b/.claude/skills/mendix/migrate-design-prototype/SKILL.md
index d270f7a2ed..6e82e38d2c 100644
--- a/.claude/skills/mendix/migrate-design-prototype/SKILL.md
+++ b/.claude/skills/mendix/migrate-design-prototype/SKILL.md
@@ -57,7 +57,7 @@ gives you *before* hand-writing custom SCSS. In order of preference:
 2. **Atlas utility classes and typed design properties** — `class:'card'`, `class:'btn btn-primary'`,
    `spacing-inner-*`/`spacing-outer-*` for padding/margin, `flex-row`/`flex-column` +
    `align-x-*`/`align-y-*` for layout (no `layoutgrid` needed); or the typed equivalents
-   `designproperties: ['Card style': on]`, `['Background color': 'Brand Primary']`,
+   `designproperties: ('Card style': on)`, `['Background color': 'Brand Primary']`,
    `['Spacing': ['margin-bottom': 'L']]`. `mxcli check -p` validates design-property keys
    and values (MDL-WIDGET11/12) and lists the allowed values.
 3. **Brand-token retune** — build the palette with `mxcli theme create --from`
@@ -485,7 +485,7 @@ create or replace page ResourceScheduling.ResourceHeatmap (
       Class: 'ss-panel ss-heat-lv'
     ) {
       container heatRow (Class: 'ss-heat-row') {
-        dynamictext hc01 (Content: '{1}', ContentParams: [{1} = M01], Class: 'ss-heat-cell')
+        dynamictext hc01 (Content: '{1}', ContentParams: ({1} = M01), Class: 'ss-heat-cell')
       }
     }
   }
@@ -646,10 +646,10 @@ the fast index so a design migration doesn't rediscover them.
     children bind to the related entity:
     ```
     dataview dvEmp (datasource: $currentObject/Module.Entity_Related) {
-      dynamictext n (content: 'By {1}', contentparams: [{1} = Name])   -- own attr of the related entity
+      dynamictext n (content: 'By {1}', contentparams: ({1} = Name))   -- own attr of the related entity
     }
     ```
-  - An **association path** for a single inline value: `contentparams: [{1} = Entity_Related/Name]`
+  - An **association path** for a single inline value: `contentparams: ({1} = Entity_Related/Name)`
     in a `dynamictext`, or `attribute: Entity_Related/Name` on a DataGrid2 column — both persist as
     an AttributeRef over the association (use a **bare** association name; a module-qualified one is
     rejected on a column).
@@ -690,7 +690,7 @@ the fast index so a design migration doesn't rediscover them.
 - [ ] Persistent sidebar/topbar built as **navigation profile + layout + CSS**, not per-page widgets; new screens added via `CREATE OR REPLACE NAVIGATION`
 - [ ] Shell **restructured** to the design (full-height sidebar via `position:fixed` + `margin-left` offset; region sizes forced with `flex-basis`; collapse toggle hidden if unused)
 - [ ] Multi-part chrome (brand block, user chip) rendered as **inline-SVG backgrounds**; single-style chrome (labels, dots, footer) as plain `::before`/`::after`
-- [ ] Related (to-one) object attributes shown via a **nested "data from context" DataView** (full read view) or an **association path** (`contentparams: [{1} = Assoc/Attr]` / column `attribute: Assoc/Attr`) for a single inline value — both persist
+- [ ] Related (to-one) object attributes shown via a **nested "data from context" DataView** (full read view) or an **association path** (`contentparams: ({1} = Assoc/Attr)` / column `attribute: Assoc/Attr`) for a single inline value — both persist
 - [ ] A real **`docker build`** run after each slice (not just `mxcli check`) before screenshotting
 - [ ] Widgets styled with `Class:`; data-driven state via `DynamicClasses:`
 - [ ] No inline `Style:` on any DYNAMICTEXT
diff --git a/.claude/skills/mendix/migrate-k2-nintex/SKILL.md b/.claude/skills/mendix/migrate-k2-nintex/SKILL.md
index 0da04733e2..720698e619 100644
--- a/.claude/skills/mendix/migrate-k2-nintex/SKILL.md
+++ b/.claude/skills/mendix/migrate-k2-nintex/SKILL.md
@@ -180,7 +180,7 @@ SmartForms Views map to Mendix pages/snippets. The rules system (event-driven, "
 ```sql
 create page CRM.Customer_Edit
 (
-  params: { $Customer: CRM.Customer },
+  params: ( $Customer: CRM.Customer ),
   title: 'Edit Customer',
   layout: Atlas_Core.PopupLayout
 )
diff --git a/.claude/skills/mendix/overview-pages/SKILL.md b/.claude/skills/mendix/overview-pages/SKILL.md
index 3faef3acb5..9a2a11debf 100644
--- a/.claude/skills/mendix/overview-pages/SKILL.md
+++ b/.claude/skills/mendix/overview-pages/SKILL.md
@@ -41,7 +41,7 @@ create snippet Module.Entity_Menu
 ```sql
 create [or replace] snippet Module.SnippetName
 [(
-  params: { $ParamName: Module.EntityType }
+  params: ( $ParamName: Module.EntityType )
 )]
 [folder 'path']
 {
@@ -96,7 +96,7 @@ create page Module.Entity_Overview
           datasource: database Module.Entity,
           selection: Multi,
           PagingPosition: both,
-          designproperties: ['Compact': on, 'Hover': on, 'Striped': on]
+          designproperties: ('Compact': on, 'Hover': on, 'Striped': on)
         ) {
           column (attribute: Name, caption: 'Name') {
             textfilter textFilter1
@@ -124,7 +124,7 @@ Include a snippet in a page using SNIPPETCALL:
 snippetcall widgetName (snippet: Module.SnippetName)
 
 -- With parameters (for parameterized snippets):
-snippetcall widgetName (snippet: Module.SnippetName, params: {Customer: $Customer})
+snippetcall widgetName (snippet: Module.SnippetName, params: (Customer = $Customer))
 ```
 
 ### Overview Page Components
@@ -141,7 +141,7 @@ datagrid GridName (
   datasource: database from Module.Entity where [IsActive = true] sort by Name asc,
   selection: Multi,
   PagingPosition: both,
-  designproperties: ['Compact': on, 'Hover': on, 'Striped': on]
+  designproperties: ('Compact': on, 'Hover': on, 'Striped': on)
 ) {
   column (attribute: Name, caption: 'Name') {
     textfilter textFilter1
@@ -163,7 +163,7 @@ datagrid GridName (
   thing (mendixlabs/mxcli#1152)
 - `selection: Multi` - Multi-selection (`Multi`, `Single`, or omit for none)
 - `PagingPosition: both` - Pagination bar position (`top`, `bottom`, `both`)
-- `designproperties: ['Compact': on, 'Hover': on, 'Striped': on]` - Atlas design tokens
+- `designproperties: ('Compact': on, 'Hover': on, 'Striped': on)` - Atlas design tokens
 
 **Column Types:**
 - `column (attribute: attribute, caption: 'label')` - Attribute column (own-entity attribute)
@@ -236,7 +236,7 @@ Form for creating or editing a single entity. **Requires a page parameter** to r
 ```sql
 create page Module.Entity_NewEdit
 (
-  params: { $entity: Module.Entity },
+  params: ( $entity: Module.Entity ),
   title: 'Edit Entity',
   layout: Atlas_Core.PopupLayout,
   folder: 'OverviewPages'
@@ -268,7 +268,7 @@ create page Module.Entity_NewEdit
 ```sql
 create page Module.PageName
 (
-  params: { $ParamName: Module.EntityName },
+  params: ( $ParamName: Module.EntityName ),
   title: '...',
   layout: ...
 )
@@ -281,7 +281,7 @@ create page Module.PageName
 
 ### NewEdit Page Components
 
-1. **Page Parameter**: `params: { $entity: Module.Entity }` - Receives the object to edit
+1. **Page Parameter**: `params: ( $entity: Module.Entity )` - Receives the object to edit
 2. **Layout**: `Atlas_Core.PopupLayout` - Popup/modal style
 3. **DataView**: Container bound to page parameter (`datasource: $entity`)
 4. **Input Widgets**: Match entity attributes with `attribute:` property
@@ -354,7 +354,7 @@ create page MdlTemplates.Store_Overview
 ```sql
 create page MdlTemplates.Store_NewEdit
 (
-  params: { $store: MdlTemplates.Store },
+  params: ( $store: MdlTemplates.Store ),
   title: 'Edit Store',
   layout: Atlas_Core.PopupLayout,
   folder: 'OverviewPages'
@@ -407,7 +407,7 @@ Shows various input widget types:
 ```sql
 create page MdlTemplates.Car_NewEdit
 (
-  params: { $Car: MdlTemplates.Car },
+  params: ( $Car: MdlTemplates.Car ),
   title: 'Edit Car',
   layout: Atlas_Core.PopupLayout,
   folder: 'OverviewPages'
@@ -498,7 +498,7 @@ module/
 ## Parameterized Snippets
 
 Snippets can accept parameters to display context-specific data. **A snippet
-parameter must be an entity.** A primitive one (`params: { $Label: String }`) is
+parameter must be an entity.** A primitive one (`params: ( $Label: String )`) is
 refused as **MDL087**, because Mendix rejects it with **CE0046** *"Invalid data
 type 'String'."* — a *page* parameter may be a primitive, a snippet parameter may
 not. To parameterise a snippet on a value, keep the primitive on the calling
@@ -508,7 +508,7 @@ page's parameters, or pass an object and read the member inside the snippet.
 -- Create a snippet with a parameter
 create snippet Module.CustomerDetails
 (
-  params: { $Customer: Module.Customer }
+  params: ( $Customer: Module.Customer )
 )
 {
   layoutgrid detailsGrid {
@@ -521,7 +521,7 @@ create snippet Module.CustomerDetails
 }
 
 -- Use the snippet with parameter passing
-snippetcall customerDetails (snippet: Module.CustomerDetails, params: {Customer: $Customer})
+snippetcall customerDetails (snippet: Module.CustomerDetails, params: (Customer = $Customer))
 ```
 
 ## Entity Menu Snippets with NavigationList
@@ -531,7 +531,7 @@ For entity-specific action menus (Edit, Delete, etc.), use the `navigationlist`
 ```sql
 create snippet Module.Entity_Menu
 (
-  params: { $EntityParameter: Module.Entity }
+  params: ( $EntityParameter: Module.Entity )
 )
 {
   navigationlist EntityMenuNav {
@@ -604,7 +604,7 @@ create snippet Module.NavigationMenu
 -- Step 2: Create all pages (they reference the snippet via SNIPPETCALL)
 create page Module.Customer_NewEdit
 (
-  params: { $Customer: Module.Customer },
+  params: ( $Customer: Module.Customer ),
   title: 'Edit Customer',
   layout: Atlas_Core.PopupLayout
 )
diff --git a/.claude/skills/mendix/resolve-forward-references/SKILL.md b/.claude/skills/mendix/resolve-forward-references/SKILL.md
index a57a1111ec..3542a473d8 100644
--- a/.claude/skills/mendix/resolve-forward-references/SKILL.md
+++ b/.claude/skills/mendix/resolve-forward-references/SKILL.md
@@ -133,7 +133,7 @@ page must exist before the overview can reference it.
 
 create page MyModule.Customer_NewEdit
 (
-  params: { $Customer: MyModule.Customer },
+  params: ( $Customer: MyModule.Customer ),
   title: 'Edit Customer',
   layout: Atlas_Core.PopupLayout
 )
@@ -181,7 +181,7 @@ For simple cases, reordering declarations is sufficient and no placeholder is ne
 -- Page first
 create page MyModule.Order_Detail
 (
-  params: { $Order: MyModule.Order },
+  params: ( $Order: MyModule.Order ),
   title: 'Order Detail',
   layout: Atlas_Core.Atlas_Default
 )
@@ -267,7 +267,7 @@ create snippet MyModule.AppNav
 -- 2. NewEdit page (referenced by Overview's New button)
 create page MyModule.Customer_NewEdit
 (
-  params: { $Customer: MyModule.Customer },
+  params: ( $Customer: MyModule.Customer ),
   title: 'Edit Customer',
   layout: Atlas_Core.PopupLayout
 )
diff --git a/.claude/skills/mendix/rest-client/SKILL.md b/.claude/skills/mendix/rest-client/SKILL.md
index f42788c556..88ccd6542a 100644
--- a/.claude/skills/mendix/rest-client/SKILL.md
+++ b/.claude/skills/mendix/rest-client/SKILL.md
@@ -85,7 +85,7 @@ create consumed rest service Module.OpenMeteoAPI (
     method: get,
     path: '/forecast',
     query: ($latitude: decimal, $longitude: decimal, $current: string),
-    headers: ('Accept' = 'application/json'),
+    headers: ('Accept': 'application/json'),
     timeout: 30,
     response: json as $WeatherJson
   )
@@ -93,13 +93,24 @@ create consumed rest service Module.OpenMeteoAPI (
   operation PostData (
     method: post,
     path: '/submit',
-    headers: ('Content-Type' = 'application/json'),
+    headers: ('Content-Type': 'application/json'),
     body: json from $JsonPayload,
     response: none
   )
 };
 ```
 
+A header value is a template, like the path: `{Name}` is the operation
+parameter `Name`, which must be declared in `Parameters:` (CE7056 otherwise).
+
+```sql
+parameters: ($Token: string),
+headers: ('Authorization' = 'Bearer {Token}')
+```
+
+`'Bearer ' + $Token` is the old spelling of the same header (MDL-DEPR711);
+`mxcli fmt --upgrade` rewrites it. It used to store only `Bearer `.
+
 ### Authentication
 
 ```sql
@@ -421,7 +432,7 @@ create consumed rest service Module.WeatherAPI (
     method: get,
     path: '/forecast',
     query: ($latitude: decimal, $longitude: decimal, $current: string),
-    headers: ('Accept' = 'application/json'),
+    headers: ('Accept': 'application/json'),
     response: json as $Result
   )
 };
diff --git a/.claude/skills/mendix/theme-styling/SKILL.md b/.claude/skills/mendix/theme-styling/SKILL.md
index aaf19b3556..b8164731e0 100644
--- a/.claude/skills/mendix/theme-styling/SKILL.md
+++ b/.claude/skills/mendix/theme-styling/SKILL.md
@@ -367,10 +367,10 @@ Two surprises when styling a **DataGrid2** matrix/pivot (ledger finding #46):
 Keys must match the `name` field in `design-properties.json` exactly:
 ```sql
 -- CORRECT
-designproperties: ['Spacing top': 'Large']
+designproperties: ('Spacing top': 'Large')
 
 -- WRONG (case mismatch — silently ignored)
-designproperties: ['spacing top': 'Large']
+designproperties: ('spacing top': 'Large')
 ```
 
 ### Compound (Nested) Design Properties
@@ -381,11 +381,11 @@ one whose value is itself a set of sub-properties (e.g. Atlas's `Spacing` →
 `margin-top`, `margin-bottom`, …). A compound value is written as a nested list:
 
 ```sql
-designproperties: [
+designproperties: (
   'Column gap': 'Medium',                                       -- flat option
   'Cards style': ON,                                            -- flat toggle
-  'Spacing': ['margin-top': 'Large', 'margin-bottom': 'Medium'] -- compound
-]
+  'Spacing': ('margin-top': 'Large', 'margin-bottom': 'Medium') -- compound
+)
 ```
 
 Supported on the **modelsdk** (`.mpr`) and **MCP** (live Studio Pro) backends.
diff --git a/.claude/skills/mendix/write-layouts/SKILL.md b/.claude/skills/mendix/write-layouts/SKILL.md
index 2e17bccd5a..401963067b 100644
--- a/.claude/skills/mendix/write-layouts/SKILL.md
+++ b/.claude/skills/mendix/write-layouts/SKILL.md
@@ -160,9 +160,9 @@ instead of its own. The fix is a phone layout of your own whose bottom bar names
 your own menu document, not an edit to Atlas's layout:
 
 ```sql
-create or modify menu MyModule.Phone_Menu (
-  menu item 'Home' page MyModule.Home_Phone icon Atlas_Core.Atlas.home;
-);
+create or modify menu MyModule.Phone_Menu {
+  menu item 'Home' ( OnClick: show page MyModule.Home_Phone, Icon: Atlas_Core.Atlas.home )
+};
 create or replace layout MyModule.Phone_Bottom (
   layouttype: 'Phone', class: 'layout-atlas layout-atlas-phone'
 ) {
diff --git a/.claude/skills/mendix/write-microflows/reference/control-flow.md b/.claude/skills/mendix/write-microflows/reference/control-flow.md
index 563de70482..dedcf79da8 100644
--- a/.claude/skills/mendix/write-microflows/reference/control-flow.md
+++ b/.claude/skills/mendix/write-microflows/reference/control-flow.md
@@ -311,6 +311,7 @@ commit $Product;
 - **Leave `@position` out unless you are reproducing a hand-made diagram.** Without it the builder lays the flow out itself: the main line wraps onto rows past two canvas widths, a guard's branch drops into the lane below while the main line carries on above it, and a `case` of four or more branches leaves the decision in three groups so its lines do not cross. A statement with `@position` is never moved and is not measured against what is placed around it, so a few hand-placed statements in an otherwise automatic flow are what produces overlaps (mendixlabs/mxcli#1154)
 - `@position` always appears in DESCRIBE output; `@caption` only when custom; `@color` only when not Default
 - DESCRIBE MICROFLOW shows `@` annotations before their activities
+- `@anchor(from: X)` is the side the flow **leaving** a statement starts from. On an `if` that is the flow out of its closing merge (the merge has no statement of its own, just as its position rides on the if as `@merge`); the if's `to:` is its incoming flow and `true:` / `false:` its branches. `@anchor(from: bottom, to: top, …)` on an if is how DESCRIBE writes a decision whose merge drops onto the next row (#767)
 - `@start(x, y)` positions the **start event** and goes on the first statement, because the start has no statement of its own. Omit it and the start is derived — one spacing unit (160) left of the first activity, on its centre line — and a rewrite re-derives it so the start follows the activities when they move. A start that is not at the derived spot was placed by hand (in Studio Pro or with `@start`): it survives a rewrite that does not mention it, and DESCRIBE emits `@start` for it. An explicit `@start` overrides both (#951)
 - `@position(x, y)` on a **parameter** goes inside the parameter list, ahead of the parameter it places — a parameter is a stored node with its own coordinates, and this is the only annotation it takes. Omit it and the parameters form a row along the top of the canvas (200;53, 300;53, …). The `@start` rule above applies unchanged: a parameter on that derived row is re-derived on a rewrite, one anywhere else was placed by hand, survives, and is emitted by DESCRIBE (#993). Before this, a hand-aligned parameter block was moved back onto the row by any rewrite — including a describe → exec of mxcli's own output:
 
diff --git a/.claude/skills/mendix/write-workflows/SKILL.md b/.claude/skills/mendix/write-workflows/SKILL.md
index aaaa351de8..ecf8184435 100644
--- a/.claude/skills/mendix/write-workflows/SKILL.md
+++ b/.claude/skills/mendix/write-workflows/SKILL.md
@@ -161,13 +161,26 @@ begin
 end workflow;
 ```
 
-> **Do NOT use `annotation '...'` in a workflow body.** It parses, but the
-> annotation is written into the workflow's activity flow, which Mendix loads by
+**Notes** attach to an activity with `@annotation '…'` on the line before it,
+as in a microflow; the workflow's own note is the header clause
+`annotation '…'`, and an event sub-process takes `@annotation` before
+`event subprocess`. One note per activity; no other `@` annotation is accepted.
+
+```sql
+create workflow Module.Approve
+  parameter $WorkflowContext: Module.Request
+  annotation 'Started from the request form'
+begin
+  @annotation 'Escalates after two days'
+  user task review 'Review' page Module.Review_Task outcomes 'Done' { };
+end workflow;
+```
+
+> **Do NOT use a standalone `annotation '...';` statement in a workflow body.**
+> It parses, but the note is written into the activity flow, which Mendix loads by
 > constructing every child with a `Flow` parent — no annotation type takes one, so
-> the resulting `.mpr` **cannot be loaded at all**: Studio Pro will not open the
-> project and `mx check` fails before validating anything. `mxcli` now refuses the
-> statement (MDL-WF04) at both check and exec time. Keep the note as an MDL comment
-> (`-- ...`); workflow canvas annotations are not yet writable.
+> the resulting `.mpr` **cannot be loaded at all**. `mxcli` refuses it (MDL-WF04)
+> at check and exec time. Attach the note to an activity with `@annotation`.
 
 **Boundary events** attach a timer to a user task / call-microflow / wait:
 
@@ -201,8 +214,8 @@ end workflow;
   targets it, so it takes a **name** instead of a delay:
   `boundary event interrupting notification Withdrawn 'Request withdrawn' { end workflow; }`.
   The name is unique in the workflow. Only one interrupting boundary event per
-  activity, of either kind (CE6697, MDL-WF15). `alter workflow … insert boundary
-  event` cannot add one yet — restate the workflow.
+  activity, of either kind (CE6697, MDL-WF15). `alter workflow … { insert into X
+  { boundary event … } }` cannot add one yet — restate the workflow.
 - **Over MCP (`--mcp`), Studio Pro dictates how a notification path ends**, which
   mxbuild does not: an interrupting one ends in `end workflow;` (in `jump to` inside
   a parallel split), a non-interrupting one runs to its end. mxcli refuses the
@@ -248,44 +261,64 @@ drop workflow Module.ApprovalFlow;
 
 ## ALTER WORKFLOW
 
-In-place edits go through the workflow mutator — no full rewrite. Supports
-`SET` properties, and `INSERT` / `DROP` / `REPLACE` of activities, outcomes,
-parallel paths, decision conditions, and boundary events. Reference an activity
-by its name (or an auto-named one by its caption in quotes).
-
-Each operation is its **own statement** — there is no `{ … }` wrapper, and `SET`
-uses no `=` (`set display 'X'`, not `set display = 'X'`):
+In-place edits go through the workflow mutator — no full rewrite. `alter
+workflow` is the generic alter (the same shape as `alter page`): the operations
+go in `{ … }`, properties are set with `set ( Key: value )`, and a fragment is
+written exactly as in `create workflow`.
 
 ```sql
-alter workflow Module.ApprovalFlow set display 'Updated Approval';
-alter workflow Module.ApprovalFlow set activity Review page Module.AltReviewPage;
-alter workflow Module.ApprovalFlow insert after Review call microflow Module.ACT_Log;
-alter workflow Module.ApprovalFlow replace activity ACT_Validate with call microflow Module.ACT_Process;
+alter workflow Module.ApprovalFlow {
+  set (Display: 'Updated Approval', DueDate: addDays([%CurrentDateTime%], 7));
+  set (Page: Module.AltReviewPage, Description: 'Check the amount') on Review;
+  set (Targeting: xpath [Active = true()]) on Review;
+  insert before Review { call microflow Module.ACT_Prepare; }
+  insert after Review { call microflow Module.ACT_Log; call microflow Module.ACT_Notify; }
+  replace ACT_Validate with { call microflow Module.ACT_Process; }
+  drop ObsoleteStep;
+};
 ```
 
-Consecutive `set`s may chain in one statement:
-`alter workflow Module.ApprovalFlow set display 'X' set description 'Y';`
-
-See `mdl-examples/doctype-tests/24-workflow-examples.mdl` for the full ALTER
-surface (insert path, drop path, insert condition, boundary events).
-
-**The INSERT op has to match the activity kind.** An activity's outcome list is
-typed, and each op writes exactly one outcome type into it:
-
-| Op | Writes | Only on |
-|----|--------|---------|
-| `insert outcome '<name>' on X { }` | `UserTaskOutcome` | a user task |
-| `insert condition '<Module.Enum.Value>' on X { }` | `…ConditionOutcome` | a decision, a call microflow |
-| `insert path on X { }` | `ParallelSplitOutcome` | a parallel split |
-| `insert boundary event on X interrupting timer <expr> { }` | a boundary event | user task, call microflow, call workflow, wait for notification |
+**Addressing an activity.** A target is the activity's **name** (`Review` —
+`describe workflow` prints every name) or its **caption** in quotes
+(`'Review the request'`); add `@n` to choose one of several matches. A name wins
+over a caption that repeats it. An ambiguous target is refused, and the error
+lists the matches (`@1 user task Review, @2 decision Review`) — mxcli never
+guesses. Every target is resolved before anything changes, so a refused
+statement leaves the workflow untouched. The flow's start activity (`start1`,
+caption `'Start'`) is addressable too, but nothing goes before it — `insert
+before start1` is refused (it would be `CE9526`); use `insert after start1`.
+
+Workflow keys: `Display`, `Description`, `ExportLevel`, `DueDate`,
+`OverviewPage`, `Parameter: $WorkflowContext: Module.Entity`. Activity keys
+(with `on <activity>`): `Page`, `Description`, `Targeting: microflow M.F` /
+`Targeting: xpath [ … ]`, `DueDate`.
+
+**Adding to an activity: `insert into`.** What goes in the braces is the
+activity's own clause, as `create workflow` writes it — and it has to match the
+activity kind, because an activity's outcome list is typed:
+
+| Fragment | Writes | Only on |
+|----------|--------|---------|
+| `insert into X { outcomes '<name>' { … } }` | `UserTaskOutcome` | a user task |
+| `insert into X { outcomes '<Module.Enum.Value>' -> { … } }` (or `true`, `false`, `default`) | `…ConditionOutcome` | a decision, a call microflow |
+| `insert into X { path { … } }` (`path n` must be the next number) | `ParallelSplitOutcome` | a parallel split |
+| `insert into X { boundary event interrupting timer <expr> { … } }` | a boundary event | user task, call microflow, call workflow, wait for notification |
 
 Aim one at the wrong kind and the outcome lands in a list that cannot hold it,
 which is **not** a build error: the project stops **loading**, so Studio Pro will
 not open it and `mx check` dies before it validates anything (ako/mxcli#415).
-mxcli refuses all of these now — at `check --references` and at `exec`, which
-call the same function — and the refusal names the op that fits the target. The
-`drop` ops are unaffected: removing a branch cannot write a wrong type, and it
-leaves an ordinary build error (`CE6686`) rather than an unloadable project.
+mxcli refuses all of these — at `check --references` and at `exec`, which call
+the same function — and the refusal names the fragment that fits the target.
+
+**Removing a member: `drop X outcome 'Reject'`**, `drop Decision1 outcome true`
+(`false`, `default`), `drop Split1 path 2`, `drop X boundary event`. Removing a
+branch cannot write a wrong type; it leaves an ordinary build error (`CE6686`)
+rather than an unloadable project.
+
+The old per-action statements (`alter workflow M.W set display 'X';`, `set
+activity X page …`, `insert outcome 'N' on X { }`, `drop path 'Path 2' on X`)
+still parse and warn `MDL-DEPR140`–`149`; `mxcli fmt --upgrade` rewrites them.
+See `mdl-examples/doctype-tests/24-workflow-examples.mdl` for the full surface.
 
 ## DESCRIBE round-trip
 
@@ -432,9 +465,9 @@ values. The full list and the System **entities** are in `system-module`.
   reset it.** An event sub-process and a workflow event handler subscribed to no
   event types are set in Studio Pro.
   `create or modify` on a workflow that holds any of them is refused with the
-  list, and so is `alter workflow … replace activity` on an activity that holds
-  one. Change such a workflow with `alter workflow … set activity …` (it edits
-  the stored document and keeps the rest) or in Studio Pro.
+  list, and so is `alter workflow … { replace X with { … } }` on an activity that holds
+  one. Change such a workflow with `alter workflow … { set ( … ) on X; }` (it
+  edits the stored document and keeps the rest) or in Studio Pro.
 
 - **`end workflow` ends the whole workflow from inside a branch** — the workflow
   counterpart of a microflow's `return`. `return;` itself is refused in a workflow
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 40db61988d..d8108fc36c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,6 +16,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - **Session commands belong to the REPL** (ako/mxcli#755, R7) — `connect`, `disconnect`, `use`, `set <key> = …`, `status`, `check`, `build`, `lint`, `debug`, `execute script`, `execute runtime`, `help` and `introspect api` need a session, not a model. Under the `mdl 1;` preview header a script that holds one is refused; without the header it runs as before and `check` / `exec` warn **MDL-V1-SESSION**. The REPL keeps accepting them. Put the session on the command line instead: `mxcli exec script.mdl -p app.mpr --json`. `exit` / `quit` are not session commands.
 - **Document types are named as Studio Pro names them** (ako/mxcli#755, R10) — `consumed rest service` (was `rest client`), `consumed odata service` (was `odata client`), `published odata service` (was `odata service`), `task queue` (was `queue`), `alter app security` (was `alter project security`) and `alter settings runtime` (was `alter settings model`), in every statement that names the type: create, alter, drop, describe, list, move, grant/revoke on a published OData service, and an external entity's `from consumed odata service`. `describe` writes the new names. **Migrating a script:** nothing breaks — the old names still parse and build the identical statement, `check` / `exec` warn **MDL-DEPR550** to **MDL-DEPR555**, and `mxcli fmt --upgrade` rewrites them. `call microflow … in queue M.Q` is a call option, not the type name, and is unchanged.
 
+- **Menus, property maps and the database connection take R2's brackets** (ako/mxcli#754, R2) — menu items are children in `{ }` with no `;` between them, and an item's action and icon are its properties: `create or modify navigation Responsive home page Shop.Home { menu item 'Home' ( OnClick: show page Shop.Home, Icon: Atlas_Core.Atlas.home ) menu 'Admin' { menu item 'Users' ( OnClick: call microflow Shop.ShowUsers ) } };`, and the same items in `create menu M.Main { … }`. The property maps are in `( )`: a page's or snippet's `Params: ( $Order: Shop.Order )` and `Variables: ( $show: Boolean = 'true' )`, `ContentParams: ({1} = Name)` (also `CaptionParams` and `<Name>Params`), `DesignProperties: ('Spacing': ('margin-top': 'Large'), 'Full width': on)`, a snippet call's arguments `Params: (Asset = $Asset)` (bound as at every call site, R4), and a REST operation's `Headers: ('Accept': 'application/json')`. A database connection is `create database connection M.Db ( Type: 'PostgreSQL', ConnectionString: @M.Url, Username: @M.User, Password: @M.Pass ) { query Q ( Sql: $$…$$, Parameters: ( p: Integer default '0' ), Returns: M.E, Map: ( Attr = column ) ) }`. `describe` prints these forms. **Migrating:** every old spelling still parses under both language versions, builds the same statement, warns (MDL-DEPR120–127) and is rewritten by `mxcli fmt --upgrade`.
+
 - **Integration documents put properties in `( )` and children in `{ }`; an `alter microflow` fragment is `begin … end`** (ako/mxcli#754, R2) — a consumed REST service's operations are `operation GetUser ( Method: get, Path: '/u/{id}', Response: none )`; an agent's attachments are `tool X ( … )`, `mcp service M.S ( … )` and `knowledge base K ( … )`, in `create agent` and `alter agent … add`; an image collection is `create image collection M.Icons { image Logo ( File: 'logo.png' ) }`; a message definition collection is `{ definition D for M.E { A, M.E_B/M.B { C } } }`, and an association may select no member (`M.E_B/M.B { }`, which describe already printed as the unparseable `()`); and `alter microflow` / `alter nanoflow` take `insert after <target> begin … end;` and `replace <target> with begin … end;`, the fragment written as the body of `create microflow` is. `describe` prints the new forms. **Migrating a script:** nothing breaks — the old brackets still parse and build the identical statement, `check` / `exec` warn **MDL-DEPR070** (operation), **MDL-DEPR071** (agent attachment), **MDL-DEPR072** (image collection), **MDL-DEPR073** (message definitions) and **MDL-DEPR074** (alter fragment), once per statement, and `mxcli fmt --upgrade` rewrites them.
 - **An entity grant names the rights first, and every XPath is written in `[ ]`** (ako/mxcli#753, R5) — `grant read *, write (Email), create on entity Shop.Order to Shop.User where [Status = 'Open'];` takes the word order of every other grant, and the constraint is bracketed like a datasource or retrieve `where`, so the quotes inside it are written once instead of doubled. A workflow user task's targeting is the same: `targeting users xpath [System.UserRoles = '[%UserRole_Manager%]']`, and `alter workflow … set activity … targeting xpath [ … ]`. Sibling predicate groups (`[a][b]`) are one constraint, kept as written. `describe entity` and `describe workflow` print the new forms; a stored constraint the bracketed grammar does not read (none in the Studio Pro-authored PedApp and TestApp fixtures) is printed in the old quoted form so the output stays re-executable. **Migrating a script:** nothing breaks — `grant Shop.User on Shop.Order (read *) where '[…]'` and `targeting xpath '[…]'` still parse and build the same rule, and `check` / `exec` warn **MDL-DEPR030** and **MDL-DEPR031**; `mxcli fmt --upgrade` rewrites both. A quoted value that is not a bracketed XPath is left in place and reported.
 - **A microflow error handler is `on error [without rollback] begin … end error`; `while` takes `begin … end while` like `loop`** (ako/mxcli#754, R2) — braces hold declarative children and imperative flow is `begin … end <keyword>`, and the error handler was the only brace block inside a microflow. `describe microflow` / `describe nanoflow` now print `commit $O on error begin … end error;` (an empty handler `… on error without rollback begin end error;`), and so do the generated test flows of `mxcli test`. Under the `mdl 1;` preview header a `while` without `begin`, or ending in a bare `end`, is an error; without the header it keeps parsing and warns **MDL-V1-WHILE**, and `mxcli fmt --upgrade --header` inserts the missing words. Measured on the Studio Pro-authored PedApp and TestApp fixtures: the round-trip harness stays green. **Migrating a script:** nothing breaks — `on error { … }` still parses, builds the identical handler, and `check` / `exec` warn **MDL-DEPR540**; `mxcli fmt --upgrade` rewrites it.
@@ -25,6 +27,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 - **`retrieve … first` binds one object; under `mdl 1;` `retrieve … limit 1` is a list of one** (ako/mxcli#734, ADR-0011) — `first` is Mendix's "First object" range in every language version, the same split as `import from mapping … first | limit n`. Under the `mdl 1;` preview header a bare `limit 1` is a Custom range, a list of one. Without the header it keeps its old meaning, the object, and `check` / `exec` warn **MDL-V1-LIMIT1**. `describe` prints the object range as `first`, so its output means the same whatever header runs it; measured on the Studio Pro-authored PedApp fixture (describe → exec keeps both ranges as stored) and with `mx check` 11.13 on a copy of a Studio Pro project (a loop over an `mdl 1` `limit 1` builds at 0 errors; the headerless script is CE0100). **MDL-RETRIEVE01** now keys on the object range the writer stores and names CE0100 for a loop. `first` on an association retrieve is refused: Mendix gives that source no range. **Migrating a script:** nothing to do — without the header every script behaves as before; replace an object-meaning `limit 1` with `first` to silence the warning and to keep the meaning under `mdl 1;`.
 
+- **`alter workflow` is on the generic ALTER** (ako/mxcli#712, ADR-0012) — `alter workflow M.W { set (Display: 'x', DueDate: …); set (Page: M.P) on ReviewOrder; insert before|after ReviewOrder { … } insert into ReviewOrder { outcomes 'Escalate' { … } } insert into split1 { path { … } } replace X with { … } drop X, ReviewOrder outcome 'Reject', split1 path 2; }`. A target is an activity's name or 'caption' with `@n`, resolved through the workflow's target resolver on both backends before anything changes; an ambiguous one is refused with the matches listed. A fragment is written exactly as in `create workflow`, so `insert after` can add several activities, and `insert before` is new. **Migrating:** the old per-action statements (`alter workflow M.W set display 'x' insert outcome 'N' on X { };`) keep parsing and warn MDL-DEPR140–149; `mxcli fmt --upgrade` rewrites them, except `drop path '<caption>'` whose caption is not `Path n`.
+
 - **`alter page`, `alter snippet` and `alter layout` are the first document types on the generic ALTER** (ako/mxcli#712, ADR-0012) — one grammar, `alter <type> Module.Name { set (Key: value) on <target>; insert before|after|into <target> { … } replace <target> with { … } drop <target>; }`, whose target is resolved by the document type (a new `backend.AlterTargetResolver`, implemented by the page mutator on the modelsdk and `--mcp` backends). Properties are written as in `create`: `set (Caption: 'Save') on btnSave`, `set (Title: 'Edit')` for the page itself. A target is a widget name, `grid.Column` or `layoutContainer.top`; a quoted-caption target or `@n` is refused on a page, whose elements have names — by `check` too, as **MDL-ALTER01**. **Migrating a script:** nothing breaks — `set Key = value`, `set Key: value` without parentheses and `drop widget a` still run and build the identical change, and `check` / `exec` warn with **MDL-DEPR101**, **MDL-DEPR102** and **MDL-DEPR103** naming the rewrite.
 
 - **`DynamicClasses` and a column's `DynamicCellClass` are written as Mendix expressions** (mendixlabs/mxcli#750) — the expression is written as-is, so the doubled-quote spelling is gone: `dynamicclasses: if $currentObject/Featured then 'is-featured' else ''`, and `dynamicclasses: 'is-featured'` is the string — the class `is-featured`. The same rule as the OData client's credentials. `create page`, `alter page … set` and `describe` all use it, and a describe → exec round trip stores identical values (measured on a Mendix 11.14.0 project). **Migrating a script:** the old spelling, the expression's text in quotes (`'if … then ''a'' else '''''`), still parses but would now store that text as a class name, so `check` and `exec` refuse it as **MDL-WIDGET33** and give the unquoted expression. An expression in any other widget property is an error rather than an empty value; a pluggable property whose schema kind is Expression (a column's `Visible`, for one) keeps the quoted form until a following change.
diff --git a/README.md b/README.md
index 56a8b4be8d..aed53b69c0 100644
--- a/README.md
+++ b/README.md
@@ -432,7 +432,7 @@ create association MyModule.Order_Product
 -- Create pages
 create page MyModule.Product_Edit
 (
-  params: { $Product: MyModule.Product },
+  params: ( $Product: MyModule.Product ),
   title: 'Edit Product',
   layout: Atlas_Core.PopupLayout
 )
diff --git a/cmd/mxcli/cmd_new_layout.go b/cmd/mxcli/cmd_new_layout.go
index 82aa3d23c7..820cfce67d 100644
--- a/cmd/mxcli/cmd_new_layout.go
+++ b/cmd/mxcli/cmd_new_layout.go
@@ -57,12 +57,12 @@ const scaffoldLayoutMDL = `create or replace layout {{.Module}}.{{.Layout}} (
     region top (class: 'region-topbar') {
       container topbarContent (
         class: 'topbar-content',
-        designproperties: [
+        designproperties: (
           'Flex container': 'Horizontal (row)',
           'Align items Y': 'Center',
           'Disable row wrap': on,
           'Grow / shrink (self)': 'Fill container (only grow)'
-        ]
+        )
       ) {
         menubar mainMenu (profile: '{{.Profile}}')
         snippetcall languageSelector (snippet: Atlas_Core.LanguageSelectorWidget)
diff --git a/cmd/mxcli/lsp_completion.go b/cmd/mxcli/lsp_completion.go
index 0c6ea087cd..5d3f575c3a 100644
--- a/cmd/mxcli/lsp_completion.go
+++ b/cmd/mxcli/lsp_completion.go
@@ -477,7 +477,7 @@ func (s *mdlServer) variableCompletionItems(docText string, linePrefix string, c
 		}
 	}
 
-	// Extract page parameter names from CREATE PAGE ... Params: { $Name: Type, ... }
+	// Extract page parameter names from CREATE PAGE ... Params: ( $Name: Type, ... )
 	paramNames := extractPageParamNames(docText)
 	for _, name := range paramNames {
 		if partial == "" || strings.HasPrefix(strings.ToUpper(name), partial) {
diff --git a/cmd/mxcli/syntax/features_integration.go b/cmd/mxcli/syntax/features_integration.go
index ee3a1699ea..44aeb9ebc0 100644
--- a/cmd/mxcli/syntax/features_integration.go
+++ b/cmd/mxcli/syntax/features_integration.go
@@ -304,7 +304,7 @@ func init() {
 			"body", "response", "mapping", "authentication",
 			"json structure", "import mapping", "export mapping",
 		},
-		Syntax:  "CREATE [OR MODIFY] CONSUMED REST SERVICE Module.Name (\n  BaseUrl: 'https://...',\n  Authentication: NONE | BASIC (...)\n)\n{\n  OPERATION Name (\n    Method: GET|POST|PUT|DELETE|PATCH,\n    Path: '/path/{param}',\n    Parameters: ($param: Type),\n    Query: ($param: Type),\n    Headers: ('Key' = 'Value'),\n    Timeout: 30,\n    Body: JSON FROM $var | MAPPING Entity { jsonField = Attribute, ... },\n    Response: JSON AS $var | MAPPING Entity { Attribute = jsonField, ... }\n  )\n};\n\n-- An operation is a child of the service, so its properties are in ( ).\n-- `OPERATION Name { ... }` is the deprecated spelling (MDL-DEPR070).\n\n-- MAPPING takes a target ENTITY plus a body listing the JSON fields; Mendix\n-- stores it inline on the operation. An existing import/export mapping\n-- document cannot be referenced here (rejected as MDL-REST01).\n-- There is no FILE request body: Mendix's consumed operation stores one of\n-- Rest$JsonBody, Rest$StringBody or Rest$ImplicitMappingBody, so a file\n-- document has nowhere to go. `Body: FILE FROM $Doc` is rejected as\n-- MDL-REST02 rather than sent as the literal text \"$Doc\" (it used to be,\n-- returning 200 with a 4-byte payload). Binary POST lives on the\n-- microflow activity: `call rest service post '<url>' body binary $Doc/Contents`.\n-- `Response: FILE AS $Doc` is unaffected — downloads work.",
+		Syntax:  "CREATE [OR MODIFY] CONSUMED REST SERVICE Module.Name (\n  BaseUrl: 'https://...',\n  Authentication: NONE | BASIC (...)\n)\n{\n  OPERATION Name (\n    Method: GET|POST|PUT|DELETE|PATCH,\n    Path: '/path/{param}',\n    Parameters: ($param: Type),\n    Query: ($param: Type),\n    Headers: ('Key': 'Value'),\n    Timeout: 30,\n    Body: JSON FROM $var | MAPPING Entity { jsonField = Attribute, ... },\n    Response: JSON AS $var | MAPPING Entity { Attribute = jsonField, ... }\n  )\n};\n\n-- An operation is a child of the service, so its properties are in ( ).\n-- `OPERATION Name { ... }` is the deprecated spelling (MDL-DEPR070).\n\n-- MAPPING takes a target ENTITY plus a body listing the JSON fields; Mendix\n-- stores it inline on the operation. An existing import/export mapping\n-- document cannot be referenced here (rejected as MDL-REST01).\n-- There is no FILE request body: Mendix's consumed operation stores one of\n-- Rest$JsonBody, Rest$StringBody or Rest$ImplicitMappingBody, so a file\n-- document has nowhere to go. `Body: FILE FROM $Doc` is rejected as\n-- MDL-REST02 rather than sent as the literal text \"$Doc\" (it used to be,\n-- returning 200 with a 4-byte payload). Binary POST lives on the\n-- microflow activity: `call rest service post '<url>' body binary $Doc/Contents`.\n-- `Response: FILE AS $Doc` is unaffected — downloads work.",
 		Example: "CREATE CONSUMED REST SERVICE Module.PetStore (\n  BaseUrl: 'https://petstore.example.com/api',\n  Authentication: NONE\n)\n{\n  OPERATION GetPet (\n    Method: GET,\n    Path: '/pets/{id}',\n    Parameters: ($id: String),\n    Query: ($verbose: String),\n    Response: MAPPING Module.Pet {\n      Name = name,\n      Status = status\n    }\n  )\n};",
 		SeeAlso: []string{"rest", "rest.published"},
 	})
@@ -411,19 +411,26 @@ func init() {
 			"jdbc", "byod", "database connector", "execute database query",
 			"postgresql", "mysql", "oracle", "snowflake", "sql server",
 		},
-		Syntax: `CREATE [OR MODIFY] DATABASE CONNECTION Module.Name [FOLDER 'path']
-  TYPE '<type>'
-  CONNECTION STRING @Module.UrlConstant
-  USERNAME @Module.UserConstant
-  PASSWORD @Module.PasswordConstant
-[BEGIN
-  QUERY <QueryName>
-    SQL $$<sql>$$
-    [PARAMETER <name>: <Type> [DEFAULT '<value>' | NULL]]
-    [RETURNS Module.Entity
-      [MAP ( <column> AS <Attribute>, ... )]]
-  ;
-END];
+		Syntax: `CREATE [OR MODIFY] DATABASE CONNECTION Module.Name [FOLDER 'path'] (
+  Type: '<type>',
+  ConnectionString: @Module.UrlConstant,
+  Username: @Module.UserConstant,
+  Password: @Module.PasswordConstant
+  [, Host: '<host>', Port: <n>, DatabaseName: '<db>']
+) [{
+  QUERY <QueryName> (
+    Sql: $$<sql>$$
+    [, Parameters: ( <name>: <Type> [DEFAULT '<value>' | NULL], ... )]
+    [, Returns: Module.Entity]
+    [, Map: ( <Attribute> = <column>, ... )]
+  )
+  ...
+}];
+
+The properties are in ( ) and the queries are children in { } (R2). The old
+clause form -- TYPE '…' CONNECTION STRING @… BEGIN QUERY … SQL … RETURNS …
+MAP (column AS Attribute); END -- still parses and warns (MDL-DEPR127);
+mxcli fmt --upgrade rewrites it.
 
 SHOW DATABASE CONNECTIONS [IN <module>];
 DESCRIBE DATABASE CONNECTION Module.Name;
@@ -432,7 +439,7 @@ DROP DATABASE CONNECTION Module.Name;
 Calling a query from a microflow:
   EXECUTE DATABASE QUERY Module.Connection.QueryName (...);
 
-TYPE is one of Studio Pro's entries — 'MSSQL', 'MySQL', 'Oracle',
+Type is one of Studio Pro's entries — 'MSSQL', 'MySQL', 'Oracle',
 'PostgreSQL', 'Snowflake' — or 'BYOD' ("bring your own driver"), which skips
 the driver-presence check and takes the connection string verbatim. Use BYOD
 for any JDBC driver Mendix has no entry for; put the driver on the classpath
@@ -442,12 +449,12 @@ build stays green and the connection simply does not work.
 
 Three traps:
 
-  1. CONNECTION STRING / USERNAME / PASSWORD must reference CONSTANTS
+  1. ConnectionString / Username / Password must reference CONSTANTS
      (@Module.Name), not literals. A literal produces a project Studio Pro
      cannot open at all: StorageLoadException "is not a valid
      ConstantIdentifier". mxcli catches it (MDL058); mxbuild does not, so the
      build is green.
-  2. USERNAME and PASSWORD must be given even when the driver needs neither.
+  2. Username and Password must be given even when the driver needs neither.
      Omitting them writes an empty constant reference, the build stays green,
      and the query fails only at run time with "Could not find value for
      constant ''".
@@ -477,22 +484,22 @@ CREATE NON-PERSISTENT ENTITY Ops.EmployeeRow (
   Name: String(100)
 );
 
-CREATE DATABASE CONNECTION Ops.Erp
-  TYPE 'PostgreSQL'
-  CONNECTION STRING @Ops.DbUrl
-  USERNAME @Ops.DbUser
-  PASSWORD @Ops.DbPass
-BEGIN
-  QUERY GetEmployees
-    SQL $$SELECT id, name FROM employees WHERE dept = {dept}$$
-    PARAMETER dept: String DEFAULT 'sales'
-    RETURNS Ops.EmployeeRow
-    MAP (
-      id AS EmployeeId,
-      name AS Name
+CREATE DATABASE CONNECTION Ops.Erp (
+  Type: 'PostgreSQL',
+  ConnectionString: @Ops.DbUrl,
+  Username: @Ops.DbUser,
+  Password: @Ops.DbPass
+) {
+  QUERY GetEmployees (
+    Sql: $$SELECT id, name FROM employees WHERE dept = {dept}$$,
+    Parameters: ( dept: String DEFAULT 'sales' ),
+    Returns: Ops.EmployeeRow,
+    Map: (
+      EmployeeId = id,
+      Name = name
     )
-  ;
-END;
+  )
+};
 
 -- A named type needs its driver declared, or the build fails with CE5278.
 ALTER MODULE Ops ADD JAR DEPENDENCY (
@@ -664,7 +671,7 @@ DESCRIBE DATABASE CONNECTION Ops.Erp;`,
 			"image collection", "create image collection", "drop image collection",
 			"export level", "image", "icon", "logo",
 		},
-		Syntax:  "SHOW IMAGE COLLECTION [IN Module];\nDESCRIBE IMAGE COLLECTION Module.Name;\n[/** documentation */]\nCREATE IMAGE COLLECTION Module.Name [FOLDER 'path']\n  [EXPORT LEVEL 'Hidden'|'Public']\n  [{ IMAGE name ( File: 'path' ) ... }];\nCREATE OR MODIFY IMAGE COLLECTION Module.Name [...];\nDROP IMAGE COLLECTION Module.Name;\n\n-- The images are the collection's children, so they are in { }, each with\n-- its properties in ( ). `( IMAGE name FROM FILE 'path', ... )` is the\n-- deprecated spelling (MDL-DEPR072).",
+		Syntax:  "SHOW IMAGE COLLECTION [IN Module];\nDESCRIBE IMAGE COLLECTION Module.Name;\n[/** documentation */]\nCREATE IMAGE COLLECTION Module.Name [FOLDER 'path']\n  [EXPORT LEVEL 'Hidden'|'Public']\n  [{ IMAGE name ( File: 'path' ) | IMAGE name ( Data: 'base64' [, Format: png] ) ... }];\nCREATE OR MODIFY IMAGE COLLECTION Module.Name [...];\nDROP IMAGE COLLECTION Module.Name;\n\n-- The images are the collection's children, so they are in { }, each with\n-- its properties in ( ). `( IMAGE name FROM FILE 'path', ... )` is the\n-- deprecated spelling (MDL-DEPR072). DESCRIBE writes each image as\n-- Data: '<base64>', so its output needs no files.",
 		Example: "/** Application icons */\nCREATE OR MODIFY IMAGE COLLECTION MyModule.AppIcons\n  EXPORT LEVEL 'Public' {\n  IMAGE logo ( File: 'assets/logo.png' )\n  IMAGE \"favicon\" ( File: 'assets/favicon.ico' )\n};\n\nDESCRIBE IMAGE COLLECTION MyModule.AppIcons;",
 		SeeAlso: []string{"integration", "icon-collection"},
 	})
@@ -683,7 +690,7 @@ DESCRIBE DATABASE CONNECTION Ops.Erp;`,
 
 	Register(SyntaxFeature{
 		Path:    "glyph",
-		Summary: "Glyph icons — the numeric codes `icon glyph <n>` accepts, and their names",
+		Summary: "Glyph icons — the numeric codes `Icon: glyph <n>` accepts, and their names",
 		Keywords: []string{
 			"glyph", "glyphs", "show glyphs", "describe glyph", "icon glyph",
 			"glyphicon", "glyph code", "menu icon", "navigation icon",
@@ -694,10 +701,10 @@ DESCRIBE DATABASE CONNECTION Ops.Erp;`,
 		Example: "-- A glyph is a character code in the Mendix glyph font, not a document in the\n" +
 			"-- project, so there is no module to scope and no connection needed.\n" +
 			"SHOW GLYPHS LIKE 'star';\n" +
-			"--   57350  star        icon glyph 57350\n" +
-			"--   57351  star-empty  icon glyph 57351\n" +
+			"--   57350  star        Icon: glyph 57350\n" +
+			"--   57351  star-empty  Icon: glyph 57351\n" +
 			"DESCRIBE GLYPH 'star';\n" +
-			"-- → then: MENU ITEM 'Favourites' PAGE M.Favourites ICON GLYPH 57350;\n" +
+			"-- → then: MENU ITEM 'Favourites' ( OnClick: SHOW PAGE M.Favourites, Icon: GLYPH 57350 )\n" +
 			"\n" +
 			"-- Prefer an icon COLLECTION reference where the icon exists there: it is a\n" +
 			"-- model reference that `check --references` resolves, while a glyph code is\n" +
diff --git a/cmd/mxcli/syntax/features_microflow.go b/cmd/mxcli/syntax/features_microflow.go
index 1026d018e5..34167d54cf 100644
--- a/cmd/mxcli/syntax/features_microflow.go
+++ b/cmd/mxcli/syntax/features_microflow.go
@@ -619,6 +619,8 @@ func init() {
 			"@anchor(from: right, to: left)        -- which SIDE each end of the outgoing flow attaches to\n" +
 			"@curve(from: (40, -90), to: (-40, 90))  -- the flow's bezier control vectors\n" +
 			"@merge(x, y)                          -- the implicit merge that closes a split\n" +
+			"@anchor(from: bottom, to: top, true: (…), false: (…))  -- on an IF: to = its incoming flow,\n" +
+			"                                      -- from = the flow leaving its closing merge\n" +
 			"@caption 'text'\n@color Green\n@annotation 'a note'\n@excluded\n" +
 			"@applyentityaccess | @applyentityaccess(false)  -- DOCUMENT-level, before CREATE MICROFLOW/RULE\n" +
 			"@annotation(id: n1, text: 'a note', position: (x, y), size: (w, h))\n" +
diff --git a/cmd/mxcli/syntax/features_misc.go b/cmd/mxcli/syntax/features_misc.go
index 43f8351f01..0e5bd004e4 100644
--- a/cmd/mxcli/syntax/features_misc.go
+++ b/cmd/mxcli/syntax/features_misc.go
@@ -89,7 +89,7 @@ func init() {
 			"-- where it does not, DESCRIBE flags the gap as a comment rather than\n" +
 			"-- producing output that looks complete.",
 		Example: "CREATE OR REPLACE MICROFLOW MyModule.ACT_Recalculate ()\nBEGIN\n  RETURN;\nEND;\n\nCREATE OR MODIFY PERSISTENT ENTITY MyModule.Customer (\n  Name: String(200)\n);",
-		SeeAlso: []string{"microflow", "domain-model.entity", "page", "document-folder"},
+		SeeAlso: []string{"microflow", "domain-model.entity", "page", "document-folder", "create-if-not-exists"},
 	})
 
 	// IF EXISTS sits on every document-level alternative of dropStatement, so it
@@ -128,6 +128,41 @@ func init() {
 		SeeAlso: []string{"create-modifiers"},
 	})
 
+	// IF NOT EXISTS sits in every create rule that names one element, and is
+	// applied once in the visitor and once in the executor's dispatch, so it is
+	// documented once here too (ako/mxcli#731, ADR-0010 R1).
+	Register(SyntaxFeature{
+		Path:    "create-if-not-exists",
+		Summary: "CREATE … IF NOT EXISTS — create an element only when it is absent",
+		Keywords: []string{
+			"if not exists", "create if not exists", "re-run", "rerun",
+			"idempotent", "already exists", "leave alone", "skip",
+		},
+		Syntax: "CREATE <document type> IF NOT EXISTS Module.Name …;\n" +
+			"CREATE MODULE IF NOT EXISTS ModuleName;\n" +
+			"CREATE USER ROLE IF NOT EXISTS Name (…);\n" +
+			"CREATE DEMO USER IF NOT EXISTS 'name' PASSWORD '…' (…);\n" +
+			"CREATE CONFIGURATION IF NOT EXISTS 'Name' (…);\n\n" +
+			"-- IF NOT EXISTS goes after the kind's keywords, before the name. When the\n" +
+			"-- element already exists the statement is SKIPPED (and says so) and the\n" +
+			"-- stored element is left exactly as it is; otherwise it creates, like a\n" +
+			"-- plain CREATE.\n" +
+			"--\n" +
+			"-- It is not CREATE OR MODIFY, which makes the stored element match the\n" +
+			"-- statement. Writing both is refused as MDL067. DESCRIBE never emits it.\n" +
+			"--\n" +
+			"-- Every CREATE that names one element accepts it. Not accepted where\n" +
+			"-- there is no one named element to test: ANNOTATION, INDEX (use ALTER\n" +
+			"-- ENTITY … ADD INDEX IF NOT EXISTS), VALIDATION RULE, NAVIGATION,\n" +
+			"-- TRANSLATIONS and EXTERNAL ENTITIES.",
+		Example: "-- seed a module once; later runs leave hand edits alone\n" +
+			"CREATE MODULE IF NOT EXISTS Shop;\n" +
+			"CREATE ENUMERATION IF NOT EXISTS Shop.Status (Open 'Open', Closed 'Closed');\n" +
+			"CREATE CONSTANT IF NOT EXISTS Shop.ApiUrl TYPE String DEFAULT 'https://api.example.com';\n" +
+			"CREATE MICROFLOW IF NOT EXISTS Shop.ACT_Init ()\nBEGIN\n  RETURN;\nEND;",
+		SeeAlso: []string{"create-modifiers", "drop-if-exists"},
+	})
+
 	// The folder clause is the other cross-cutting CREATE modifier, and gets one
 	// topic for the same reason OR MODIFY does: it applies to every document
 	// type, so documenting it in all 27 places would guarantee 27 chances to
@@ -294,10 +329,6 @@ DISCONNECT;`,
   [HOME PAGE Module.Page FOR UserRole]
   [LOGIN PAGE Module.LoginPage]
   [NOT FOUND PAGE Module.Custom404]
-  [MENU (
-    MENU ITEM 'Label' PAGE Module.Page [ICON Module.IconCollection.Name];
-    MENU 'Group' [ICON Module.IconCollection.Name] ( ... );
-  )]
   [ON SYNC ERROR THROW|CONTINUE]
   [SYNC (
     SYNC Module.Entity ONLINE;
@@ -306,7 +337,18 @@ DISCONNECT;`,
     SYNC Module.Entity NEVER;
     SYNC Module.Entity NONE;
     SYNC Module.Entity NONE PRESERVE DATA;
-  )];
+  )]
+  [{
+    MENU ITEM 'Label' [( OnClick: SHOW PAGE Module.Page | CALL MICROFLOW Module.Flow | SIGN OUT
+                        [, Icon: Module.IconCollection.Name] )]
+    MENU 'Group' [( Icon: Module.IconCollection.Name )] { ... }
+  }];
+
+-- The menu items are the profile's CHILDREN, in { } after its clauses, like a
+-- page's widgets: no ; between them, since a child ends in ) or }. An item's
+-- action is OnClick: in the words a page action uses. The old spelling,
+-- MENU ( MENU ITEM 'Label' PAGE M.P ICON I; ... ), still parses and warns
+-- (MDL-DEPR121, MDL-DEPR122); mxcli fmt --upgrade rewrites it.
 
 -- FOR takes a USER role, written BARE (FOR Administrator). User roles are
 -- project-level and have no module part; a module role is a different thing
@@ -316,10 +358,10 @@ DISCONNECT;`,
 -- UserRoleIdentifier", raised before checking runs, so there is no error code
 -- and no line number. List the real ones with LIST USER ROLES.
 --
--- ICON is a qualified name into an ICON COLLECTION (Atlas_Core.Atlas,
+-- Icon: is a qualified name into an ICON COLLECTION (Atlas_Core.Atlas,
 -- Atlas_Core.Atlas_Filled, Atlas_Core.Atlas_Styling, or your own) -- a model
 -- reference, not a string. Hyphenated Atlas names are double-quoted:
---   ICON Atlas_Core.Atlas."align-center"
+--   Icon: Atlas_Core.Atlas."align-center"
 -- Browse the available names with:
 --   SHOW ICON COLLECTION  /  DESCRIBE ICON COLLECTION Module.Name
 --
@@ -355,7 +397,7 @@ DISCONNECT;`,
 -- than a new keyword. OMITTING it leaves the stored value alone; DESCRIBE emits
 -- it only when it is not the default.
 --
--- The block REPLACES the stored list, the way MENU replaces the menu. An
+-- The block REPLACES the stored list, the way { } replaces the menu. An
 -- entity's compatibility-mode flag has no syntax and is preserved across the
 -- rewrite untouched; DESCRIBE NAVIGATION flags it rather than dropping it.
 -- An invented name ("Mobile") is an error: the runtime routes on User-Agent to
@@ -368,19 +410,20 @@ DISCONNECT;`,
   HOME PAGE MyModule.Home_Web
   HOME PAGE MyModule.AdminDashboard FOR Administrator
   LOGIN PAGE Administration.Login
-  MENU (
-    MENU ITEM 'Home' PAGE MyModule.Home_Web ICON Atlas_Core.Atlas.home;
-    MENU 'Orders' ICON Atlas_Core.Atlas."shopping-cart" (
-      MENU ITEM 'All Orders' PAGE Orders.Order_Overview ICON Atlas_Core.Atlas."list-bullets";
-      MENU ITEM 'New Order' PAGE Orders.Order_New ICON Atlas_Core.Atlas.add;
-    );
-  );
+  {
+    MENU ITEM 'Home' ( OnClick: SHOW PAGE MyModule.Home_Web, Icon: Atlas_Core.Atlas.home )
+    MENU 'Orders' ( Icon: Atlas_Core.Atlas."shopping-cart" ) {
+      MENU ITEM 'All Orders' ( OnClick: SHOW PAGE Orders.Order_Overview, Icon: Atlas_Core.Atlas."list-bullets" )
+      MENU ITEM 'New Order' ( OnClick: SHOW PAGE Orders.Order_New, Icon: Atlas_Core.Atlas.add )
+    }
+    MENU ITEM 'Log out' ( OnClick: SIGN OUT, Icon: Atlas_Core.Atlas."log-out" )
+  };
 
 CREATE OR REPLACE NAVIGATION TabletOffline
   HOME PAGE Maintenance.Request_Overview
-  MENU (
-    MENU ITEM 'Requests' PAGE Maintenance.Request_Overview;
-  );`,
+  {
+    MENU ITEM 'Requests' ( OnClick: SHOW PAGE Maintenance.Request_Overview )
+  };`,
 		SeeAlso: []string{"navigation.show"},
 	})
 
diff --git a/cmd/mxcli/syntax/features_page.go b/cmd/mxcli/syntax/features_page.go
index f2247d0169..4021ecbb34 100644
--- a/cmd/mxcli/syntax/features_page.go
+++ b/cmd/mxcli/syntax/features_page.go
@@ -12,8 +12,8 @@ func init() {
 			"page", "pages", "form", "UI", "user interface",
 			"widget", "layout", "screen",
 		},
-		Syntax:  "CREATE PAGE Module.Name [FOLDER 'FolderPath']\n  (\n    Title: 'Page Title',\n    Layout: Module.LayoutName\n    [, Params: { $Param: Module.Entity }]\n    [, Url: 'page-url']\n    [, Variables: { $var: Boolean = 'true' }]\n    [, PopupWidth: 800, PopupHeight: 480, PopupResizable: true]\n    [, PopupCloseAction: cancelButton1]\n    [, Class: 'css-class', Style: 'css: rule']\n  )\n  {\n    -- widgets\n  }",
-		Example: "CREATE PAGE MyModule.EditCustomer\n  (\n    Params: { $Customer: MyModule.Customer },\n    Title: 'Edit Customer',\n    Layout: Atlas_Core.PopupLayout,\n    Class: 'container-fluid'\n  )\n  {\n    DATAVIEW dvCustomer (DataSource: $Customer) {\n      TEXTBOX txtName (Label: 'Name', Attribute: Name)\n      FOOTER footer1 {\n        ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE CHANGES, ButtonStyle: Primary)\n        ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL CHANGES)\n      }\n    }\n  }",
+		Syntax:  "CREATE PAGE Module.Name [FOLDER 'FolderPath']\n  (\n    Title: 'Page Title',\n    Layout: Module.LayoutName\n    [, Params: ( $Param: Module.Entity )]\n    [, Url: 'page-url']\n    [, Variables: ( $var: Boolean = 'true' )]\n    [, PopupWidth: 800, PopupHeight: 480, PopupResizable: true]\n    [, PopupCloseAction: cancelButton1]\n    [, Class: 'css-class', Style: 'css: rule']\n  )\n  {\n    -- widgets\n  }",
+		Example: "CREATE PAGE MyModule.EditCustomer\n  (\n    Params: ( $Customer: MyModule.Customer ),\n    Title: 'Edit Customer',\n    Layout: Atlas_Core.PopupLayout,\n    Class: 'container-fluid'\n  )\n  {\n    DATAVIEW dvCustomer (DataSource: $Customer) {\n      TEXTBOX txtName (Label: 'Name', Attribute: Name)\n      FOOTER footer1 {\n        ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE CHANGES, ButtonStyle: Primary)\n        ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL CHANGES)\n      }\n    }\n  }",
 		SeeAlso: []string{"page.create", "page.widgets", "page.alter", "snippet"},
 	})
 
@@ -24,8 +24,8 @@ func init() {
 			"create page", "new page", "page parameters", "page variables",
 			"layout", "url", "folder",
 		},
-		Syntax:  "CREATE PAGE Module.Name [FOLDER 'FolderPath']\n  (\n    Title: 'Title',\n    Layout: Module.Layout\n    [, Params: { $P: Module.Entity, $Qty: Integer }]\n    [, Url: 'page-url']\n    [, Variables: { $showStock: Boolean = 'true' }]\n  )\n  { <widgets> }",
-		Example: "CREATE PAGE Module.Products\n  (\n    Title: 'Products',\n    Layout: Atlas_Core.Atlas_Default,\n    Url: 'products',\n    Variables: { $showStock: Boolean = 'true' }\n  )\n  {\n    DATAGRID gridProducts (DataSource: DATABASE Module.Product) {\n      COLUMN colName (Attribute: Name, Caption: 'Name')\n    }\n  }",
+		Syntax:  "CREATE PAGE Module.Name [FOLDER 'FolderPath']\n  (\n    Title: 'Title',\n    Layout: Module.Layout\n    [, Params: ( $P: Module.Entity, $Qty: Integer )]\n    [, Url: 'page-url']\n    [, Variables: ( $showStock: Boolean = 'true' )]\n  )\n  { <widgets> }",
+		Example: "CREATE PAGE Module.Products\n  (\n    Title: 'Products',\n    Layout: Atlas_Core.Atlas_Default,\n    Url: 'products',\n    Variables: ( $showStock: Boolean = 'true' )\n  )\n  {\n    DATAGRID gridProducts (DataSource: DATABASE Module.Product) {\n      COLUMN colName (Attribute: Name, Caption: 'Name')\n    }\n  }",
 		SeeAlso: []string{"page", "page.widgets", "page.datasource"},
 	})
 
@@ -151,7 +151,7 @@ CREATE PAGE Sales.Detail (Title: 'Detail', Layout: Atlas_Core.Atlas_Default) {
 			"--   The bracketed Visible: [IsActive] (attributes rooted for you) is the deprecated\n" +
 			"--   spelling, MDL-DEPR081.\n\n" +
 			"-- Actions\nACTIONBUTTON name (Caption: 'C', Action: SAVE CHANGES, ButtonStyle: Primary)\nLINKBUTTON name (Caption: 'C', Action: ...)\n\n" +
-			"-- Display\nDYNAMICTEXT name (Content: 'Hello, {1}!', ContentParams: [{1} = Name])\nTITLE name (Content: 'Heading')\nIMAGE name (Image: 'Module.Collection.ImageName')\nIMAGE name (ImageType: imageUrl, ImageUrl: 'https://…')\n" +
+			"-- Display\nDYNAMICTEXT name (Content: 'Hello, {1}!', ContentParams: ({1} = Name))\nTITLE name (Content: 'Heading')\nIMAGE name (Image: 'Module.Collection.ImageName')\nIMAGE name (ImageType: imageUrl, ImageUrl: 'https://…')\n" +
 			"--   IMAGE needs a source. Its default, `ImageType: image`, shows an entry from an\n" +
 			"--   image collection, named as three parts: Module.Collection.ImageName.\n" +
 			"--   `show image collections` lists the collections, `describe image collection\n" +
@@ -163,8 +163,8 @@ CREATE PAGE Sales.Detail (Title: 'Detail', Layout: Atlas_Core.Atlas_Default) {
 			"--   A text-template property (ImageUrl, AlternativeText, a pluggable widget's\n" +
 			"--   headerCaption/title/…) takes TEXT, so a bare value renders the same string\n" +
 			"--   on every row. Bind it with the property's own `<Name>Params` companion:\n" +
-			"IMAGE name (ImageType: imageUrl, ImageUrl: '{1}', ImageUrlParams: [{1} = PictureUrl],\n" +
-			"            AlternativeText: '{1}', AlternativeTextParams: [{1} = Name])\n" +
+			"IMAGE name (ImageType: imageUrl, ImageUrl: '{1}', ImageUrlParams: ({1} = PictureUrl),\n" +
+			"            AlternativeText: '{1}', AlternativeTextParams: ({1} = Name))\n" +
 			"--   The widget-wide `contentparams:` is one list shared by every template on the\n" +
 			"--   widget; `'{AttrName}'` is the shortest form for a single attribute.\n\n" +
 			"-- Any pluggable widget by its id (id FIRST, then the name)\nPLUGGABLEWIDGET 'com.mendix.widget.web.badge.Badge' name (value: 'x')\nCUSTOMWIDGET 'com.mendix.widget.custom.x.X' name (prop: 'x')      -- legacy spelling\n\n" +
@@ -232,12 +232,12 @@ CREATE PAGE Sales.Detail (Title: 'Detail', Layout: Atlas_Core.Atlas_Default) {
 			"template, DROP it and INSERT the new one in the same ALTER block; operations apply in\n" +
 			"order.",
 		Example: "LISTVIEW vehicleListView (DataSource: DATABASE Pages.Vehicle) {\n" +
-			"  DYNAMICTEXT defaultVehicle (Content: '{1} {2}', ContentParams: [{1} = Brand, {2} = Model])\n" +
+			"  DYNAMICTEXT defaultVehicle (Content: '{1} {2}', ContentParams: ({1} = Brand, {2} = Model))\n" +
 			"  TEMPLATE FOR Pages.Bus {\n" +
-			"    DYNAMICTEXT busLabel (Content: 'Bus, capacity {1}', ContentParams: [{1} = PassengerCapacity])\n" +
+			"    DYNAMICTEXT busLabel (Content: 'Bus, capacity {1}', ContentParams: ({1} = PassengerCapacity))\n" +
 			"  }\n" +
 			"  TEMPLATE FOR Pages.Truck {\n" +
-			"    DYNAMICTEXT truckLabel (Content: 'Truck, max load {1} kg', ContentParams: [{1} = MaxLoadKg])\n" +
+			"    DYNAMICTEXT truckLabel (Content: 'Truck, max load {1} kg', ContentParams: ({1} = MaxLoadKg))\n" +
 			"  }\n" +
 			"}",
 		SeeAlso: []string{"page.widgets", "page.datasource"},
@@ -290,7 +290,7 @@ CREATE PAGE Sales.Detail (Title: 'Detail', Layout: Atlas_Core.Atlas_Default) {
 			"popup width", "popup height", "popup resizable",
 			"drop template", "insert template", "list view template",
 		},
-		Syntax:  "ALTER PAGE Module.Name {       -- the generic ALTER: set / insert / replace / drop\n  SET (property: value) ON widgetName;  -- widget property names: any casing\n  SET ('Row size': 'Small') ON lvOrders;  -- an Atlas DESIGN property of that widget's\n                                         --   type; quoted and case-sensitive.\n                                         --   `show design properties for <type>` lists\n                                         --   them. ON/OFF for a toggle, where OFF\n                                         --   REMOVES the entry.\n                                         --   A multi-select ('Hide on') or compound\n                                         --   ('Spacing') one needs the inline\n                                         --   DesignProperties: [...] form, because a\n                                         --   SET assignment carries one value.\n  SET (Action: CALL MICROFLOW Module.MF) ON btnSave;   -- any CREATE PAGE action form\n  SET ('createFileAction': CALL MICROFLOW Module.MF) ON fileUploader1;\n                                         -- a pluggable widget's NAMED action slot,\n                                         --   by the widget's own key; refused on a\n                                         --   key that is not action-typed\n  SET (DataSource: $Param) ON dvOrder;  -- parameter/microflow/nanoflow/selection;\n                                        --   DATABASE and association are REPLACE-only,\n                                        --   and a data view takes no database source\n  SET (prop1: val1, prop2: val2) ON widgetName;\n  SET (Title: 'New Title');  -- page-level (case-sensitive): no ON\n  SET (Documentation: 'What this page is for.');\n  SET (Class: 'css-class');  -- page-level CSS class / style\n  SET (Style: 'css: rule');\n  SET (PopupWidth: 800, PopupHeight: 480, PopupResizable: true);  -- page-level pop-up\n  INSERT AFTER widgetName { <widgets> };\n  INSERT BEFORE widgetName { <widgets> };\n  INSERT INTO containerName { <widgets> };\n  DROP name1, name2;\n  DROP TEMPLATE FOR Module.Specialization IN listViewName;\n  REPLACE widgetName WITH { <widgets> };\n};\n-- A target is a widget name, or a DataGrid 2 column by what it shows:\n-- grid column(Attr), grid column('Caption'), @n when two match. The old spellings `SET p = v`,\n-- `SET p: v` (no parentheses) and `DROP WIDGET a` still run and warn\n-- (MDL-DEPR101..103).\n\n-- The BULK form: one design property on every widget of a TYPE.\nALTER PAGES [IN Module]\n  SET 'Compact' = ON, 'Striped' = ON\n  WHERE WIDGETTYPE = datagrid            -- the MDL keyword, which resolves to\n                                         --   exactly one widget id. A full id in\n                                         --   quotes works too. NOT a name: a widget\n                                         --   name is unique only within its page.\n  [DRY RUN];                             -- run this FIRST. It reports the matches\n                                         --   against a discardable copy and writes\n                                         --   nothing.",
+		Syntax:  "ALTER PAGE Module.Name {       -- the generic ALTER: set / insert / replace / drop\n  SET (property: value) ON widgetName;  -- widget property names: any casing\n  SET ('Row size': 'Small') ON lvOrders;  -- an Atlas DESIGN property of that widget's\n                                         --   type; quoted and case-sensitive.\n                                         --   `show design properties for <type>` lists\n                                         --   them. ON/OFF for a toggle, where OFF\n                                         --   REMOVES the entry.\n                                         --   A multi-select ('Hide on') or compound\n                                         --   ('Spacing') one needs the inline\n                                         --   DesignProperties: (...) form, because a\n                                         --   SET assignment carries one value.\n  SET (Action: CALL MICROFLOW Module.MF) ON btnSave;   -- any CREATE PAGE action form\n  SET ('createFileAction': CALL MICROFLOW Module.MF) ON fileUploader1;\n                                         -- a pluggable widget's NAMED action slot,\n                                         --   by the widget's own key; refused on a\n                                         --   key that is not action-typed\n  SET (DataSource: $Param) ON dvOrder;  -- parameter/microflow/nanoflow/selection;\n                                        --   DATABASE and association are REPLACE-only,\n                                        --   and a data view takes no database source\n  SET (prop1: val1, prop2: val2) ON widgetName;\n  SET (Title: 'New Title');  -- page-level (case-sensitive): no ON\n  SET (Documentation: 'What this page is for.');\n  SET (Class: 'css-class');  -- page-level CSS class / style\n  SET (Style: 'css: rule');\n  SET (PopupWidth: 800, PopupHeight: 480, PopupResizable: true);  -- page-level pop-up\n  INSERT AFTER widgetName { <widgets> };\n  INSERT BEFORE widgetName { <widgets> };\n  INSERT INTO containerName { <widgets> };\n  DROP name1, name2;\n  DROP TEMPLATE FOR Module.Specialization IN listViewName;\n  REPLACE widgetName WITH { <widgets> };\n};\n-- A target is a widget name, or a DataGrid 2 column by what it shows:\n-- grid column(Attr), grid column('Caption'), @n when two match. The old spellings `SET p = v`,\n-- `SET p: v` (no parentheses) and `DROP WIDGET a` still run and warn\n-- (MDL-DEPR101..103).\n\n-- The BULK form: one design property on every widget of a TYPE.\nALTER PAGES [IN Module]\n  SET 'Compact' = ON, 'Striped' = ON\n  WHERE WIDGETTYPE = datagrid            -- the MDL keyword, which resolves to\n                                         --   exactly one widget id. A full id in\n                                         --   quotes works too. NOT a name: a widget\n                                         --   name is unique only within its page.\n  [DRY RUN];                             -- run this FIRST. It reports the matches\n                                         --   against a discardable copy and writes\n                                         --   nothing.",
 		Example: "ALTER PAGE Module.EditPage {\n  SET (Caption: 'Save & Close', ButtonStyle: Success) ON btnSave;\n  INSERT AFTER txtName {\n    TEXTBOX txtMiddleName (Label: 'Middle Name', Attribute: MiddleName)\n  };\n  DROP txtUnused;\n};",
 		SeeAlso: []string{"page.create", "page.show", "snippet.alter"},
 	})
@@ -308,8 +308,8 @@ CREATE PAGE Sales.Detail (Title: 'Detail', Layout: Atlas_Core.Atlas_Default) {
 			"  Class: 'css-class-name'                 -- static CSS classes\n" +
 			"  Style: 'color: red; padding: 8px;'      -- inline CSS\n" +
 			"  DynamicClasses: '<expression>'          -- runtime-computed (stacks on Class)\n" +
-			"  DesignProperties: ['Spacing top': 'Large']\n" +
-			"  DesignProperties: ['Full width': ON]\n\n" +
+			"  DesignProperties: ('Spacing top': 'Large')\n" +
+			"  DesignProperties: ('Full width': ON)\n\n" +
 			"ON A PAGE THAT ALREADY EXISTS, without rewriting it:\n\n" +
 			"  ALTER STYLING ON PAGE|SNIPPET Module.Name WIDGET <widgetName>\n" +
 			"    SET (Class: 'css-class', Style: 'css', 'Design property': 'Value'|ON|OFF);\n\n" +
@@ -402,8 +402,8 @@ CREATE PAGE Sales.Detail (Title: 'Detail', Layout: Atlas_Core.Atlas_Default) {
 			"snippet", "snippets", "reusable", "snippetcall",
 			"page fragment", "component",
 		},
-		Syntax:  "CREATE SNIPPET Module.Name [FOLDER 'path']\n  [( Params: { $P: Module.Entity } )]   -- parameters are entities only\n  {\n    -- widgets (same as page)\n  }\n\n-- Embed in a page:\nSNIPPETCALL scName (Snippet: Module.SnippetName)",
-		Example: "CREATE SNIPPET MyModule.CustomerInfo (\n  Params: { $Customer: MyModule.Customer }\n)\n{\n  DATAVIEW dv (DataSource: $Customer) {\n    TEXTBOX txtName (Label: 'Name', Attribute: Name)\n    TEXTBOX txtEmail (Label: 'Email', Attribute: Email)\n  }\n}",
+		Syntax:  "CREATE SNIPPET Module.Name [FOLDER 'path']\n  [( Params: ( $P: Module.Entity ) )]   -- parameters are entities only\n  {\n    -- widgets (same as page)\n  }\n\n-- Embed in a page:\nSNIPPETCALL scName (Snippet: Module.SnippetName)",
+		Example: "CREATE SNIPPET MyModule.CustomerInfo (\n  Params: ( $Customer: MyModule.Customer )\n)\n{\n  DATAVIEW dv (DataSource: $Customer) {\n    TEXTBOX txtName (Label: 'Name', Attribute: Name)\n    TEXTBOX txtEmail (Label: 'Email', Attribute: Email)\n  }\n}",
 		SeeAlso: []string{"snippet.create", "snippet.alter", "page"},
 	})
 
@@ -420,7 +420,7 @@ CREATE PAGE Sales.Detail (Title: 'Detail', Layout: Atlas_Core.Atlas_Default) {
 		// (a PAGE parameter may be primitive; a snippet parameter may not), and
 		// the reporter of mendixlabs/mxcli#1028 reached the bug by following
 		// this line. A primitive is now refused as MDL087.
-		Syntax:  "CREATE SNIPPET Module.Name [FOLDER 'Snippets/Common']\n  [( Params: { $P: Module.Entity } )]   -- entities only; a primitive is CE0046\n  [( Variables: { $isEditable: Boolean = 'true' } )]\n  {\n    -- widgets\n  }\n\n-- To parameterise a snippet on a primitive, keep the primitive on the\n-- calling PAGE and pass an object, or read the value off an entity member.",
+		Syntax:  "CREATE SNIPPET Module.Name [FOLDER 'Snippets/Common']\n  [( Params: ( $P: Module.Entity ) )]   -- entities only; a primitive is CE0046\n  [( Variables: ( $isEditable: Boolean = 'true' ) )]\n  {\n    -- widgets\n  }\n\n-- To parameterise a snippet on a primitive, keep the primitive on the\n-- calling PAGE and pass an object, or read the value off an entity member.",
 		Example: "CREATE SNIPPET MyModule.NavigationMenu\n{\n  NAVIGATIONLIST navMenu {\n    ITEM itemCustomers (Action: SHOW PAGE MyModule.CustomerOverview) {\n      DYNAMICTEXT txtCustomers (Content: 'Customers')\n    }\n  }\n}",
 		SeeAlso: []string{"snippet", "snippet.alter", "page.widgets"},
 	})
@@ -502,9 +502,9 @@ CREATE PAGE Sales.Detail (Title: 'Detail', Layout: Atlas_Core.Atlas_Default) {
 			"}\n\n" +
 			"-- A phone layout's bottom bar, as Atlas_Core.Phone_BottomBar has it —\n" +
 			"-- a simple menu bar rendering a menu document:\n" +
-			"CREATE OR MODIFY MENU MyModule.Phone_Menu (\n" +
-			"  menu item 'Home' page MyModule.Home_Phone icon Atlas_Core.Atlas.home;\n" +
-			");\n" +
+			"CREATE OR MODIFY MENU MyModule.Phone_Menu {\n" +
+			"  menu item 'Home' ( OnClick: show page MyModule.Home_Phone, Icon: Atlas_Core.Atlas.home )\n" +
+			"};\n" +
 			"CREATE OR REPLACE LAYOUT MyModule.Phone_Bottom (\n" +
 			"  layouttype: 'Phone',\n" +
 			"  class: 'layout-atlas layout-atlas-phone'\n" +
@@ -626,20 +626,21 @@ CREATE PAGE Sales.Detail (Title: 'Detail', Layout: Atlas_Core.Atlas_Default) {
 			"create menu", "describe menu", "drop menu",
 			"menu", "menus", "menu document", "menu item",
 		},
-		Syntax: "CREATE [OR MODIFY] MENU Module.Name [FOLDER 'path'] (\n" +
-			"  MENU ITEM '<caption>' [PAGE Module.Page | MICROFLOW Module.Flow | SIGN OUT] [ICON Module.Collection.name];\n" +
-			"  MENU '<caption>' [ICON Module.Collection.name] ( <nested items> );\n" +
-			");\n" +
+		Syntax: "CREATE [OR MODIFY] MENU Module.Name [FOLDER 'path'] {\n" +
+			"  MENU ITEM '<caption>' [( [OnClick: SHOW PAGE Module.Page | CALL MICROFLOW Module.Flow | SIGN OUT]\n" +
+			"                          [, Icon: Module.Collection.name | GLYPH <n> | IMAGE Module.Images.name] )]\n" +
+			"  MENU '<caption>' [( Icon: Module.Collection.name )] { <nested items> }\n" +
+			"};\n" +
 			"DESCRIBE MENU Module.Name;\n" +
 			"DROP MENU Module.Name;",
-		Example: "CREATE OR MODIFY MENU MyModule.Main_Menu (\n" +
-			"  menu item 'Home' page MyModule.Home_Web icon Atlas_Core.Atlas.home;\n" +
-			"  menu item 'Run' microflow MyModule.DoThing;\n" +
-			"  menu 'Admin' (\n" +
-			"    menu item 'Accounts' page Administration.Account_Overview;\n" +
-			"  );\n" +
-			"  menu item 'Plain';\n" +
-			");\n\n" +
+		Example: "CREATE OR MODIFY MENU MyModule.Main_Menu {\n" +
+			"  menu item 'Home' ( OnClick: show page MyModule.Home_Web, Icon: Atlas_Core.Atlas.home )\n" +
+			"  menu item 'Run' ( OnClick: call microflow MyModule.DoThing )\n" +
+			"  menu 'Admin' {\n" +
+			"    menu item 'Accounts' ( OnClick: show page Administration.Account_Overview )\n" +
+			"  }\n" +
+			"  menu item 'Plain'\n" +
+			"};\n\n" +
 			"-- Notes:\n" +
 			"--   * A menu document is the reusable menu a menu widget points at. It is\n" +
 			"--     NOT the menu inside a navigation profile — for that use\n" +
@@ -649,8 +650,11 @@ CREATE PAGE Sales.Detail (Title: 'Detail', Layout: Atlas_Core.Atlas_Default) {
 			"--   * SIGN OUT is the log-out menu item. It needs no target and stores the\n" +
 			"--     same Forms$SignOutClientAction a sign-out BUTTON carries. Works both\n" +
 			"--     here and in a navigation profile's menu.\n" +
-			"--   * ICON names an icon collection entry. A glyph or image icon cannot be\n" +
-			"--     expressed in MDL; DESCRIBE flags those rather than dropping them silently.\n" +
+			"--   * The items are children, in { } with no ; between them (R2). The old\n" +
+			"--     spelling, ( MENU ITEM 'X' PAGE M.P ICON I; ... ), still parses and warns\n" +
+			"--     (MDL-DEPR121, MDL-DEPR122).\n" +
+			"--   * Icon: names an icon collection entry; GLYPH <n> and IMAGE M.Images.x\n" +
+			"--     write the other two icon kinds.\n" +
 			"--   * A page with required parameters cannot be opened from a menu item\n" +
 			"--     without an argument — Mendix reports CE1571.",
 		SeeAlso: []string{"navigation.create", "navigation.show", "page.show"},
@@ -666,7 +670,7 @@ CREATE PAGE Sales.Detail (Title: 'Detail', Layout: Atlas_Core.Atlas_Default) {
 			"use fragment", "template", "script scope",
 		},
 		Syntax:  "CREATE FRAGMENT Name AS { <widgets> };\nCREATE FRAGMENT Name AS { <widgets> SLOT [name] <widgets> };\nCREATE FRAGMENT Name ($d: datasource, $a: action) AS { <widgets> };\nUSE FRAGMENT Name [(args)] [AS prefix_];\nUSE FRAGMENT Name [(args)] [AS prefix_] { <payload widgets> };\nSHOW FRAGMENTS;\nDESCRIBE FRAGMENT Name;\nDESCRIBE FRAGMENT FROM PAGE Module.Page WIDGET widgetName;",
-		Example: "CREATE FRAGMENT SaveCancelFooter AS {\n  FOOTER footer1 {\n    ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE CHANGES, ButtonStyle: Primary)\n    ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL CHANGES)\n  }\n};\n\nCREATE PAGE Module.EditPage (Params: { $Param: Module.Customer }, Title: 'Edit', Layout: 'Atlas_Core.Atlas_Default') {\n  DATAVIEW dv (DataSource: $Param) {\n    TEXTBOX txtName (Label: 'Name', Attribute: Name)\n    USE FRAGMENT SaveCancelFooter\n  }\n};",
+		Example: "CREATE FRAGMENT SaveCancelFooter AS {\n  FOOTER footer1 {\n    ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE CHANGES, ButtonStyle: Primary)\n    ACTIONBUTTON btnCancel (Caption: 'Cancel', Action: CANCEL CHANGES)\n  }\n};\n\nCREATE PAGE Module.EditPage (Params: ( $Param: Module.Customer ), Title: 'Edit', Layout: 'Atlas_Core.Atlas_Default') {\n  DATAVIEW dv (DataSource: $Param) {\n    TEXTBOX txtName (Label: 'Name', Attribute: Name)\n    USE FRAGMENT SaveCancelFooter\n  }\n};",
 		SeeAlso: []string{"fragment.define", "fragment.use", "fragment.slot", "fragment.params", "snippet"},
 	})
 
@@ -689,7 +693,7 @@ CREATE PAGE Sales.Detail (Title: 'Detail', Layout: Atlas_Core.Atlas_Default) {
 			"prefix", "name conflict",
 		},
 		Syntax:  "USE FRAGMENT Name\nUSE FRAGMENT Name AS prefix_\nUSE FRAGMENT Name [AS prefix_] { <payload widgets> }",
-		Example: "-- Basic usage\nCREATE PAGE Module.Page (Params: { $Param: Module.Customer }, Title: 'Page', Layout: 'Atlas_Core.Atlas_Default') {\n  DATAVIEW dv (DataSource: $Param) {\n    USE FRAGMENT FormFields\n    USE FRAGMENT SaveCancelFooter\n  }\n};\n\n-- With prefix to avoid name conflicts\nUSE FRAGMENT SaveCancelFooter AS order_\n-- Creates: order_footer1, order_btnSave, order_btnCancel\n\n-- Fill a fragment's content slot (see fragment.slot)\nUSE FRAGMENT Card {\n  DYNAMICTEXT cardHeading (Content: 'Welcome', RenderMode: H2)\n  DYNAMICTEXT cardText (Content: 'Wrapped content')\n}",
+		Example: "-- Basic usage\nCREATE PAGE Module.Page (Params: ( $Param: Module.Customer ), Title: 'Page', Layout: 'Atlas_Core.Atlas_Default') {\n  DATAVIEW dv (DataSource: $Param) {\n    USE FRAGMENT FormFields\n    USE FRAGMENT SaveCancelFooter\n  }\n};\n\n-- With prefix to avoid name conflicts\nUSE FRAGMENT SaveCancelFooter AS order_\n-- Creates: order_footer1, order_btnSave, order_btnCancel\n\n-- Fill a fragment's content slot (see fragment.slot)\nUSE FRAGMENT Card {\n  DYNAMICTEXT cardHeading (Content: 'Welcome', RenderMode: H2)\n  DYNAMICTEXT cardText (Content: 'Wrapped content')\n}",
 		SeeAlso: []string{"fragment", "fragment.define", "fragment.slot"},
 	})
 
@@ -713,7 +717,7 @@ CREATE PAGE Sales.Detail (Title: 'Detail', Layout: Atlas_Core.Atlas_Default) {
 			"card wrapper", "reusable shell", "use fragment payload",
 		},
 		Syntax:  "-- In the definition, mark where caller content lands:\nCREATE FRAGMENT Name AS { <wrapper> SLOT [name] <wrapper> };\n-- At the use site, supply the payload in a brace block:\nUSE FRAGMENT Name [AS prefix_] { <payload widgets> }",
-		Example: "CREATE FRAGMENT Card AS {\n  CONTAINER cardWrap (Class: 'card', DesignProperties: ['Card style': on]) {\n    CONTAINER cardBody (Class: 'card-body') {\n      SLOT content\n    }\n  }\n};\n\nCREATE PAGE Module.Dashboard (Title: 'Dashboard', Layout: Atlas_Core.Atlas_Default) {\n  USE FRAGMENT Card {\n    DYNAMICTEXT cardHeading (Content: 'Welcome', RenderMode: H2)\n    DYNAMICTEXT cardText (Content: 'Any widgets can go inside the reusable Card shell')\n  }\n};\n\n-- Notes:\n--   * Slot name is optional (defaults to 'content'); one slot per fragment.\n--   * USE FRAGMENT with no payload leaves the slot empty (valid).\n--   * Supplying a payload to a slotless fragment is an error.",
+		Example: "CREATE FRAGMENT Card AS {\n  CONTAINER cardWrap (Class: 'card', DesignProperties: ('Card style': on)) {\n    CONTAINER cardBody (Class: 'card-body') {\n      SLOT content\n    }\n  }\n};\n\nCREATE PAGE Module.Dashboard (Title: 'Dashboard', Layout: Atlas_Core.Atlas_Default) {\n  USE FRAGMENT Card {\n    DYNAMICTEXT cardHeading (Content: 'Welcome', RenderMode: H2)\n    DYNAMICTEXT cardText (Content: 'Any widgets can go inside the reusable Card shell')\n  }\n};\n\n-- Notes:\n--   * Slot name is optional (defaults to 'content'); one slot per fragment.\n--   * USE FRAGMENT with no payload leaves the slot empty (valid).\n--   * Supplying a payload to a slotless fragment is an error.",
 		SeeAlso: []string{"fragment", "fragment.define", "fragment.use"},
 	})
 
diff --git a/cmd/mxcli/syntax/features_security.go b/cmd/mxcli/syntax/features_security.go
index daff85ad6f..446e5146db 100644
--- a/cmd/mxcli/syntax/features_security.go
+++ b/cmd/mxcli/syntax/features_security.go
@@ -133,8 +133,8 @@ func init() {
 			"user role", "application role", "manage roles",
 			"add module roles", "remove module roles",
 		},
-		Syntax:  "CREATE USER ROLE <name> (<role> [, ...]) [MANAGE ALL ROLES];\nALTER USER ROLE <name> ADD MODULE ROLES (<role> [, ...]);\nALTER USER ROLE <name> DROP MODULE ROLES (<role> [, ...]);\nDROP USER ROLE [IF EXISTS] <name>;",
-		Example: "CREATE USER ROLE AppAdmin (Shop.Admin, HR.Admin) MANAGE ALL ROLES;\nALTER USER ROLE AppAdmin ADD MODULE ROLES (Reporting.Viewer);",
+		Syntax:  "CREATE USER ROLE <name> [( ModuleRoles: (<role> [, ...]), Description: '<text>', ManageAllRoles: true|false, ManageableRoles: (<user role> [, ...]), ManageUsersWithoutRoles: true|false, CheckSecurity: true|false )];\nALTER USER ROLE <name> ADD MODULE ROLES (<role> [, ...]);\nALTER USER ROLE <name> DROP MODULE ROLES (<role> [, ...]);\nDROP USER ROLE [IF EXISTS] <name>;",
+		Example: "CREATE USER ROLE AppAdmin ( ModuleRoles: (Shop.Admin, HR.Admin), ManageAllRoles: true );\nALTER USER ROLE AppAdmin ADD MODULE ROLES (Reporting.Viewer);",
 		SeeAlso: []string{"security.module-role", "security.demo-user"},
 	})
 
@@ -170,7 +170,7 @@ func init() {
 			"-- build (CE0133), so ON is refused unless a role is given or already stored.\n" +
 			"-- Mendix does not check the role exists, so mxcli does — an unknown role\n" +
 			"-- would build cleanly and leave visitors with nothing.",
-		Example: "CREATE USER ROLE Anonymous (Shop.Viewer, System.User);\n" +
+		Example: "CREATE USER ROLE Anonymous ( ModuleRoles: (Shop.Viewer, System.User) );\n" +
 			"ALTER APP SECURITY GUEST ACCESS ON ROLE Anonymous;\n" +
 			"GRANT READ * ON ENTITY Shop.Product TO Shop.Viewer;",
 		SeeAlso: []string{"security.user-role", "security.project-security"},
diff --git a/cmd/mxcli/syntax/features_workflow.go b/cmd/mxcli/syntax/features_workflow.go
index b625784ee4..52060597e0 100644
--- a/cmd/mxcli/syntax/features_workflow.go
+++ b/cmd/mxcli/syntax/features_workflow.go
@@ -139,7 +139,7 @@ func init() {
 			"--   page without a WorkflowUserTask one  -> CE7412\n" +
 			"-- Other parameters may sit alongside it.",
 		Example: "-- The task page takes the task:\n" +
-			"CREATE PAGE HR.ReviewPage (\n  title: 'Review',\n  layout: Atlas_Core.Atlas_Default,\n  params: { $WorkflowUserTask: System.WorkflowUserTask }\n) { };\n\n" +
+			"CREATE PAGE HR.ReviewPage (\n  title: 'Review',\n  layout: Atlas_Core.Atlas_Default,\n  params: ( $WorkflowUserTask: System.WorkflowUserTask )\n) { };\n\n" +
 			"USER TASK ReviewTask 'Review the request'\n  PAGE HR.ReviewPage\n  TARGETING USERS XPATH [Module.Employee/Active = true()]\n  OUTCOMES 'Approve' { } 'Reject' { };",
 		SeeAlso: []string{"workflow.user-task.targeting", "workflow.multi-user-task", "workflow.create"},
 	})
@@ -411,7 +411,7 @@ func init() {
 		// 'Workflows$TimerBoundaryEvent' could not be found"). This entry showed
 		// the bare form, with 'P3D' — not a valid timer expression — as its delay.
 		// ako/view-entity-examples FINDINGS §7.
-		Syntax:     "-- inline, as a clause of a USER TASK (after OUTCOMES):\nBOUNDARY EVENT (INTERRUPTING | NON INTERRUPTING) TIMER <datetime-expression> { <activities> }\nBOUNDARY EVENT (INTERRUPTING | NON INTERRUPTING) NOTIFICATION <name> ['<caption>'] { <activities> }\n\n-- A notification boundary event (Mendix 11.11+) is triggered by `notify workflow`\n-- targeting its name, so the name is unique in the workflow. ALTER cannot insert\n-- one yet; restate the workflow instead.\n\n-- or add a timer to an existing task:\nALTER WORKFLOW <wf> INSERT BOUNDARY EVENT ON <task> (INTERRUPTING | NON INTERRUPTING) TIMER <datetime-expression> { <activities> }\n\n-- Name the kind: a bare TIMER is refused on Mendix 11 (MDL-WF07) — it writes a\n-- type the runtime cannot load. The delay is an expression that yields a\n-- DateTime, e.g. addDays([%CurrentDateTime%], 3). mxcli ends every boundary\n-- path with Mendix's end-of-path marker, so a path may end in a call; use\n-- JUMP TO to return to the task instead.",
+		Syntax:     "-- inline, as a clause of a USER TASK (after OUTCOMES):\nBOUNDARY EVENT (INTERRUPTING | NON INTERRUPTING) TIMER <datetime-expression> { <activities> }\nBOUNDARY EVENT (INTERRUPTING | NON INTERRUPTING) NOTIFICATION <name> ['<caption>'] { <activities> }\n\n-- A notification boundary event (Mendix 11.11+) is triggered by `notify workflow`\n-- targeting its name, so the name is unique in the workflow. ALTER cannot insert\n-- one yet; restate the workflow instead.\n\n-- or add a timer to an existing task:\nALTER WORKFLOW <wf> { INSERT INTO <task> { BOUNDARY EVENT (INTERRUPTING | NON INTERRUPTING) TIMER <datetime-expression> { <activities> } } };\n\n-- Name the kind: a bare TIMER is refused on Mendix 11 (MDL-WF07) — it writes a\n-- type the runtime cannot load. The delay is an expression that yields a\n-- DateTime, e.g. addDays([%CurrentDateTime%], 3). mxcli ends every boundary\n-- path with Mendix's end-of-path marker, so a path may end in a call; use\n-- JUMP TO to return to the task instead.",
 		Example:    "user task ReviewTask 'Review'\n  page Module.WF_Review\n  outcomes 'Done' { }\n  boundary event interrupting timer addDays([%CurrentDateTime%], 3) {\n    call microflow Module.WF_Escalate;\n  };",
 		MinVersion: "10.6.0",
 		SeeAlso:    []string{"workflow.user-task", "workflow.notification", "workflow.event-subprocess"},
@@ -491,25 +491,46 @@ func init() {
 		Keywords: []string{
 			"alter workflow", "modify workflow", "update workflow",
 			"add activity", "drop activity", "replace activity",
+			"insert before", "insert into", "insert outcome", "insert path",
 		},
-		// SET properties are keyword-led phrases, not `name = value` assignments:
-		// `SET DUE DATE <expr>`, `SET DISPLAY '<text>'`, `SET OVERVIEW PAGE
-		// Module.Page`. The `= ` this entry used to show does not parse.
-		// INSERT names the anchor first and the activity second — INSERT AFTER
-		// <name> <activity> — and there is no BEFORE. DROP and REPLACE take the
-		// ACTIVITY keyword. This entry previously showed the operand order
-		// reversed, advertised a BEFORE that does not exist, and omitted
-		// ACTIVITY, so none of it parsed.
+		// The generic ALTER (ADR-0012, ako/mxcli#712): the operations go in
+		// { }, a target is an activity's name or 'caption' with @n to choose one
+		// of several matches (an ambiguous one is refused with the matches
+		// listed), and a fragment is written exactly as in CREATE WORKFLOW.
+		// The old per-action forms (`SET DISPLAY '…'`, `SET ACTIVITY X …`,
+		// `INSERT OUTCOME 'x' ON X { … }`, `DROP PATH 'Path 2' ON X`) still
+		// parse and warn MDL-DEPR140-149; `mxcli fmt --upgrade` rewrites them.
 		//
-		// The four INSERT ops that add to an activity's outcome list each write
-		// ONE outcome type, and the list is typed per activity kind — INSERT
-		// OUTCOME only on a user task, INSERT PATH only on a parallel split,
-		// INSERT CONDITION only on a decision or call microflow. Aiming one at
-		// the wrong kind used to produce a project Mendix could not LOAD
-		// (ako/mxcli#415); it is refused now, but the entry documented only two
-		// of the ops, which is how an author reached for the wrong one.
-		Syntax:  "ALTER WORKFLOW Module.Name SET DISPLAY '<text>';\nALTER WORKFLOW Module.Name SET DUE DATE <expression>;\nALTER WORKFLOW Module.Name SET OVERVIEW PAGE Module.Page;\nALTER WORKFLOW Module.Name SET ACTIVITY <name> <property>;\nALTER WORKFLOW Module.Name INSERT AFTER <name> <activity>;\nALTER WORKFLOW Module.Name DROP ACTIVITY <name>;\nALTER WORKFLOW Module.Name REPLACE ACTIVITY <name> WITH <activity>;\nALTER WORKFLOW Module.Name INSERT OUTCOME '<name>' ON <user-task> { <activities> };\nALTER WORKFLOW Module.Name DROP OUTCOME '<name>' ON <activity>;\nALTER WORKFLOW Module.Name INSERT CONDITION '<Module.Enum.Value>' ON <decision|call-microflow> { <activities> };\nALTER WORKFLOW Module.Name INSERT PATH ON <parallel-split> { <activities> };\nALTER WORKFLOW Module.Name INSERT BOUNDARY EVENT ON <activity> (INTERRUPTING | NON INTERRUPTING) TIMER <datetime-expression> { <activities> };",
-		Example: "ALTER WORKFLOW HR.LeaveApproval SET DUE DATE addDays([%CurrentDateTime%], 7);\nALTER WORKFLOW HR.LeaveApproval INSERT AFTER ReviewTask\n  CALL MICROFLOW HR.NotifyHR;\nALTER WORKFLOW HR.LeaveApproval DROP ACTIVITY ObsoleteStep;\n\n-- The INSERT op has to match the activity kind: an outcome list is typed,\n-- and the wrong one is refused (it would leave a project Mendix cannot open).\nALTER WORKFLOW HR.LeaveApproval INSERT OUTCOME 'Rejected' ON ReviewTask { };\nALTER WORKFLOW HR.LeaveApproval INSERT CONDITION 'HR.Status.Urgent' ON Triage { };\nALTER WORKFLOW HR.LeaveApproval INSERT PATH ON NotifyAll { };",
+		// What `insert into` adds must fit the activity: an outcome list is
+		// typed per activity kind — a user task takes `outcomes 'x' { … }`, a
+		// decision or call microflow `outcomes <value> -> { … }`, a parallel
+		// split `path { … }`. The wrong one is refused (it would leave a project
+		// Mendix cannot LOAD, ako/mxcli#415).
+		Syntax: "ALTER WORKFLOW Module.Name {\n" +
+			"  SET ( Display: '<text>', Description: '<text>', ExportLevel: API | Hidden,\n" +
+			"        DueDate: <expression>, OverviewPage: Module.Page, Parameter: $WorkflowContext: Module.Entity );\n" +
+			"  SET ( Page: Module.Page, Description: '<text>', DueDate: <expression>,\n" +
+			"        Targeting: microflow Module.Mf | Targeting: xpath [<xpath>] ) ON <activity>;\n" +
+			"  INSERT BEFORE | AFTER <activity> { <activities> }\n" +
+			"  INSERT INTO <user-task> { OUTCOMES '<name>' { <activities> } }\n" +
+			"  INSERT INTO <decision | call-microflow> { OUTCOMES true | false | default | '<value>' -> { <activities> } }\n" +
+			"  INSERT INTO <parallel-split> { PATH [<next number>] { <activities> } }\n" +
+			"  INSERT INTO <activity> { BOUNDARY EVENT (INTERRUPTING | NON INTERRUPTING) TIMER <datetime-expression> { <activities> } }\n" +
+			"  REPLACE <activity> WITH { <activities> }\n" +
+			"  DROP <activity>, <activity> OUTCOME '<name>' | true | false | default,\n" +
+			"       <parallel-split> PATH <n>, <activity> BOUNDARY EVENT;\n" +
+			"};\n\n" +
+			"-- <activity> is a name (ReviewTask) or a caption ('Review the request'),\n" +
+			"-- optionally @n to choose one of several matches: describe workflow prints the names.",
+		Example: "alter workflow HR.LeaveApproval {\n" +
+			"  set (DueDate: addDays([%CurrentDateTime%], 7));\n" +
+			"  set (Page: HR.ReviewPage) on ReviewTask;\n" +
+			"  insert after ReviewTask { call microflow HR.NotifyHR; }\n" +
+			"  insert into ReviewTask { outcomes 'Rejected' { } }\n" +
+			"  insert into Triage { outcomes 'HR.Status.Urgent' -> { } }\n" +
+			"  insert into NotifyAll { path { } }\n" +
+			"  drop ObsoleteStep;\n" +
+			"};",
 		SeeAlso: []string{"workflow.create", "workflow.drop"},
 	})
 }
diff --git a/cmd/mxcli/tui/image_render.go b/cmd/mxcli/tui/image_render.go
index af827cc306..928aee20ac 100644
--- a/cmd/mxcli/tui/image_render.go
+++ b/cmd/mxcli/tui/image_render.go
@@ -1,10 +1,13 @@
 package tui
 
 import (
+	"crypto/sha256"
 	"encoding/base64"
+	"encoding/hex"
 	"fmt"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"strings"
 )
 
@@ -115,23 +118,62 @@ func renderImagesWithSize(paths []string, width, perImgHeight int) string {
 	return sb.String()
 }
 
-// extractImagePaths parses DESCRIBE IMAGE COLLECTION output and extracts
-// file paths from lines matching: IMAGE "name" FROM FILE '/path/to/file'
+// extractImagePaths parses DESCRIBE IMAGE COLLECTION output and returns a
+// file path per image it shows. Describe writes each image into the statement,
+// `image Name ( Data: '<base64>' )`, rather than naming a file it wrote itself
+// (ako/mxcli#707), so the preview decodes the data into its own cache file; a
+// script's `File: '<path>'` (or the old `FROM FILE '<path>'`) is used as is.
 func extractImagePaths(output string) []string {
 	var paths []string
 	for _, line := range strings.Split(output, "\n") {
 		line = strings.TrimSpace(line)
-		idx := strings.Index(line, "FROM FILE '")
-		if idx == -1 {
-			continue
+		for _, marker := range []string{"File: '", "FROM FILE '"} {
+			if v, ok := quotedAfter(line, marker); ok {
+				paths = append(paths, v)
+			}
 		}
-		rest := line[idx+len("FROM FILE '"):]
-		// Strip trailing quote and optional comma/semicolon
-		end := strings.Index(rest, "'")
-		if end == -1 {
-			continue
+		if v, ok := quotedAfter(line, "Data: '"); ok {
+			if path := previewImageFile(v); path != "" {
+				paths = append(paths, path)
+			}
 		}
-		paths = append(paths, rest[:end])
 	}
 	return paths
 }
+
+// quotedAfter returns the text between marker and the next quote in line.
+func quotedAfter(line, marker string) (string, bool) {
+	idx := strings.Index(line, marker)
+	if idx == -1 {
+		return "", false
+	}
+	rest := line[idx+len(marker):]
+	end := strings.Index(rest, "'")
+	if end == -1 {
+		return "", false
+	}
+	return rest[:end], true
+}
+
+// previewImageFile writes base64 image data to a file in the preview cache,
+// named by its content so an unchanged image is written once, and returns the
+// path; "" when the data does not decode or cannot be written.
+func previewImageFile(b64 string) string {
+	data, err := base64.StdEncoding.DecodeString(b64)
+	if err != nil || len(data) == 0 {
+		return ""
+	}
+	dir := filepath.Join(os.TempDir(), "mxcli-preview")
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		return ""
+	}
+	sum := sha256.Sum256(data)
+	path := filepath.Join(dir, hex.EncodeToString(sum[:8]))
+	if _, err := os.Stat(path); err == nil {
+		return path
+	}
+	if err := os.WriteFile(path, data, 0o644); err != nil {
+		return ""
+	}
+	return path
+}
diff --git a/cmd/mxcli/tui/image_render_test.go b/cmd/mxcli/tui/image_render_test.go
new file mode 100644
index 0000000000..542c238001
--- /dev/null
+++ b/cmd/mxcli/tui/image_render_test.go
@@ -0,0 +1,30 @@
+package tui
+
+import (
+	"bytes"
+	"encoding/base64"
+	"os"
+	"testing"
+)
+
+// Describe writes an image as `Data: '<base64>'` (ako/mxcli#707); the preview
+// decodes it into a file of its own, and still takes a script's `File:` path.
+func TestExtractImagePaths_DataAndFile(t *testing.T) {
+	t.Setenv("TMPDIR", t.TempDir())
+	img := []byte("\x89PNG\r\n\x1a\nfake")
+	out := "create or modify image collection M.Icons {\n" +
+		"  image Logo ( Data: '" + base64.StdEncoding.EncodeToString(img) + "' )\n" +
+		"  image Home ( File: 'assets/home.png' )\n" +
+		"};\n"
+	paths := extractImagePaths(out)
+	if len(paths) != 2 {
+		t.Fatalf("paths = %v, want 2", paths)
+	}
+	got, err := os.ReadFile(paths[0])
+	if err != nil || !bytes.Equal(got, img) {
+		t.Errorf("decoded image %q (%v), want %q", got, err, img)
+	}
+	if paths[1] != "assets/home.png" {
+		t.Errorf("file path = %q", paths[1])
+	}
+}
diff --git a/docs-site/src/appendixes/quick-reference.md b/docs-site/src/appendixes/quick-reference.md
index 45457b6fb8..d0e58fc783 100644
--- a/docs-site/src/appendixes/quick-reference.md
+++ b/docs-site/src/appendixes/quick-reference.md
@@ -212,7 +212,7 @@ Nested folders use `/` separator: `'Parent/Child/Grandchild'`. Missing folders a
 | Describe security matrix | `DESCRIBE SECURITY MATRIX [IN Module];` | Full access overview |
 | Create module role | `CREATE MODULE ROLE Mod.Role [DESCRIPTION 'text'];` | |
 | Drop module role | `DROP MODULE ROLE Mod.Role;` | |
-| Create user role | `CREATE USER ROLE Name (Mod.Role, ...) [MANAGE ALL ROLES];` | Aggregates module roles |
+| Create user role | `CREATE USER ROLE Name ( ModuleRoles: (Mod.Role, ...), Description: '...', ManageAllRoles: true, CheckSecurity: true );` | Aggregates module roles; every property optional |
 | Alter user role | `ALTER USER ROLE Name ADD\|DROP MODULE ROLES (Mod.Role, ...);` | |
 | Drop user role | `DROP USER ROLE [IF EXISTS] Name;` | `IF EXISTS` makes a cleanup script re-runnable |
 | Grant microflow access | `GRANT EXECUTE ON MICROFLOW Mod.MF TO Mod.Role, ...;` | |
@@ -235,6 +235,7 @@ Nested folders use `/` separator: `'Parent/Child/Grandchild'`. Missing folders a
 | Describe workflow | `DESCRIBE WORKFLOW Module.Name;` | Full MDL output |
 | Create workflow | `CREATE [OR MODIFY] WORKFLOW Module.Name PARAMETER $Ctx: Module.Entity BEGIN ... END WORKFLOW;` | See activity types below |
 | Drop workflow | `DROP WORKFLOW Module.Name;` | |
+| Alter workflow | `ALTER WORKFLOW Module.Name { SET (Key: value, ...) [ON <activity>]; INSERT BEFORE\|AFTER <activity> { ... } INSERT INTO <activity> { OUTCOMES ... \| PATH { ... } \| BOUNDARY EVENT ... } REPLACE <activity> WITH { ... } DROP <activity> [OUTCOME '<x>' \| PATH <n> \| BOUNDARY EVENT]; };` | An activity is its name or `'caption'`, `@n` for one of several matches; the old per-action form warns MDL-DEPR140–149 |
 
 **Workflow Activity Types:**
 - `USER TASK <name> '<caption>' [PAGE Mod.Page] [TARGETING MICROFLOW Mod.MF] [OUTCOMES '<out>' { } ...];`
@@ -286,12 +287,12 @@ CREATE OR REPLACE NAVIGATION Responsive
   HOME PAGE MyModule.AdminHome FOR Administrator
   LOGIN PAGE Administration.Login
   NOT FOUND PAGE MyModule.Custom404
-  MENU (
-    MENU ITEM 'Home' PAGE MyModule.Home_Web;
-    MENU 'Admin' (
-      MENU ITEM 'Users' PAGE Administration.Account_Overview;
-    );
-  );
+  {
+    MENU ITEM 'Home' ( OnClick: SHOW PAGE MyModule.Home_Web )
+    MENU 'Admin' {
+      MENU ITEM 'Users' ( OnClick: SHOW PAGE Administration.Account_Overview )
+    }
+  };
 ```
 
 ## Project Settings
@@ -349,7 +350,7 @@ MDL uses explicit property declarations for pages:
 | Element | Syntax | Example |
 |---------|-----------|---------|
 | Page properties | `(Key: value, ...)` | `(Title: 'Edit', Layout: Atlas_Core.Atlas_Default)` |
-| Page variables | `Variables: { $name: Type = 'expr' }` | `Variables: { $show: Boolean = 'true' }` |
+| Page variables | `Variables: ( $name: Type = 'expr' )` | `Variables: ( $show: Boolean = 'true' )` |
 | Widget name | Required after type | `TEXTBOX txtName (...)` |
 | Attribute binding | `Attribute: AttrName` | `TEXTBOX txt (Label: 'Name', Attribute: Name)` |
 | Variable binding | `DataSource: $Var` | `DATAVIEW dv (DataSource: $Product) { ... }` |
@@ -360,7 +361,7 @@ MDL uses explicit property declarations for pages:
 | CSS class | `Class: 'classes'` | `CONTAINER c (Class: 'card mx-spacing-top-large')` |
 | Inline style | `Style: 'css'` | `CONTAINER c (Style: 'padding: 16px;')` |
 | Dynamic classes | `DynamicClasses: 'expr'` | `CONTAINER c (DynamicClasses: if $currentObject/IsActive then 'is-active' else '')` — runtime-computed; stacks on `Class` |
-| Design properties | `DesignProperties: [...]` | `CONTAINER c (DesignProperties: ['Spacing top': 'Large', 'Full width': ON])` |
+| Design properties | `DesignProperties: (...)` | `CONTAINER c (DesignProperties: ('Spacing top': 'Large', 'Full width': ON))` |
 | Width (pixels) | `Width: integer` | `IMAGE img (Width: 200)` |
 | Height (pixels) | `Height: integer` | `IMAGE img (Height: 150)` |
 | Page size | `PageSize: integer` | `DATAGRID dg (PageSize: 25)` |
@@ -390,7 +391,7 @@ MDL uses explicit property declarations for pages:
 ```sql
 CREATE PAGE MyModule.Customer_Edit
 (
-  Params: { $Customer: MyModule.Customer },
+  Params: ( $Customer: MyModule.Customer ),
   Title: 'Edit Customer',
   Layout: Atlas_Core.PopupLayout
 )
diff --git a/docs-site/src/appendixes/sdk-equivalence.md b/docs-site/src/appendixes/sdk-equivalence.md
index fbd43c093b..c6f9d13f1f 100644
--- a/docs-site/src/appendixes/sdk-equivalence.md
+++ b/docs-site/src/appendixes/sdk-equivalence.md
@@ -56,7 +56,7 @@ The [Mendix Model SDK](https://docs.mendix.com/apidocs-mxsdk/mxsdk/) is Mendix's
 |---------------|----------------|
 | `security.ModuleRole.createIn(module)` | `CREATE MODULE ROLE Module.RoleName` |
 | Manual access rule construction | `GRANT role ON Entity (permissions)` |
-| Manual user role creation | `CREATE USER ROLE Name (ModuleRoles)` |
+| Manual user role creation | `CREATE USER ROLE Name ( ModuleRoles: (ModuleRoles) )` |
 
 ## Workflow Comparison
 
diff --git a/docs-site/src/appendixes/version-compatibility.md b/docs-site/src/appendixes/version-compatibility.md
index bb9e199d23..d51970d127 100644
--- a/docs-site/src/appendixes/version-compatibility.md
+++ b/docs-site/src/appendixes/version-compatibility.md
@@ -78,10 +78,10 @@ The tables below show exactly which features are available on each Mendix versio
 | Conditional visibility | `Visible: <expression>` | -- | -- | -- | Yes |
 | Conditional editability | `Editable: <expression>` | -- | -- | -- | Yes |
 | Responsive column widths | `TabletWidth: 6, PhoneWidth: 12` | -- | -- | -- | Yes |
-| Page parameters (entity) | `Params: { $Item: Module.Entity }` | 9.4+ | Yes | Yes | Yes |
-| Page parameters (primitive) | `Params: { $Qty: Integer }` | -- | -- | -- | 11.6+ |
-| Page variables | `Variables: { ... }` | -- | 10.20+ | 10.20+ | Yes |
-| Design properties (Atlas v3) | `DesignProperties: [...]` | -- | -- | -- | Yes |
+| Page parameters (entity) | `Params: ( $Item: Module.Entity )` | 9.4+ | Yes | Yes | Yes |
+| Page parameters (primitive) | `Params: ( $Qty: Integer )` | -- | -- | -- | 11.6+ |
+| Page variables | `Variables: ( ... )` | -- | 10.20+ | 10.20+ | Yes |
+| Design properties (Atlas v3) | `DesignProperties: (...)` | -- | -- | -- | Yes |
 
 ::: tip Widget Templates
 Pluggable widget templates are currently extracted from Mendix 11.6. When used on 10.x projects, the [MPK augmentation system](../internals/widget-templates.md) reconciles property differences. Some CE0463 ("widget definition changed") errors may still occur.
@@ -102,8 +102,8 @@ Pluggable widget templates are currently extracted from Mendix 11.6. When used o
 |---------|-----------|-------|-------|-------|-------|-------|
 | OData client | `CREATE CONSUMED ODATA SERVICE` | Yes | Yes | Yes | Yes | Yes |
 | Business events | `CREATE BUSINESS EVENT SERVICE` | Yes | Yes | Yes | Yes | Yes |
-| REST client (basic) | `CREATE CONSUMED REST SERVICE ... BEGIN ... END` | -- | Yes | Yes | Yes | Yes |
-| REST client headers | `HEADER 'Name' = 'Value'` | -- | -- | Yes | Yes | Yes |
+| REST client (basic) | `CREATE CONSUMED REST SERVICE ... ( ... ) { OPERATION ... }` | -- | Yes | Yes | Yes | Yes |
+| REST client headers | `Headers: ('Name': 'Value')` | -- | -- | Yes | Yes | Yes |
 | Database Connector | `CREATE DATABASE CONNECTION` | -- | -- | -- | Yes | Yes |
 | REST client query params | `QUERY $param: Type` | -- | -- | -- | -- | Yes |
 
diff --git a/docs-site/src/examples/crm-module.md b/docs-site/src/examples/crm-module.md
index d68f0e6d5b..bdeeb4a0dc 100644
--- a/docs-site/src/examples/crm-module.md
+++ b/docs-site/src/examples/crm-module.md
@@ -131,7 +131,7 @@ CREATE PAGE CRM.Customer_Overview (
 
 -- NewEdit page with validation
 CREATE PAGE CRM.Customer_NewEdit (
-  Params: { $Customer: CRM.Customer },
+  Params: ( $Customer: CRM.Customer ),
   Title: 'Customer',
   Layout: Atlas_Core.PopupLayout
 ) {
@@ -180,8 +180,8 @@ GRANT VIEW ON PAGE CRM.Customer_Overview TO CRM.User;
 GRANT VIEW ON PAGE CRM.Customer_NewEdit TO CRM.User;
 
 -- User roles
-CREATE OR MODIFY USER ROLE CRMUser (System.User, CRM.User);
-CREATE OR MODIFY USER ROLE CRMAdmin (System.User, CRM.Admin);
+CREATE OR MODIFY USER ROLE CRMUser ( ModuleRoles: (System.User, CRM.User) );
+CREATE OR MODIFY USER ROLE CRMAdmin ( ModuleRoles: (System.User, CRM.Admin) );
 
 -- Demo users for testing
 CREATE OR MODIFY DEMO USER 'crm_user' PASSWORD 'Password1!' (CRMUser);
diff --git a/docs-site/src/examples/data-import.md b/docs-site/src/examples/data-import.md
index c8200018db..3a2820baf1 100644
--- a/docs-site/src/examples/data-import.md
+++ b/docs-site/src/examples/data-import.md
@@ -80,18 +80,19 @@ CREATE NON-PERSISTENT ENTITY Integration.Customer (
 /
 
 -- Database connection with parameterized query
-CREATE DATABASE CONNECTION Integration.LegacyDatabase
-TYPE 'PostgreSQL'
-CONNECTION STRING @Integration.LegacyDatabase_DBSource
-USERNAME @Integration.LegacyDatabase_DBUsername
-PASSWORD @Integration.LegacyDatabase_DBPassword
-BEGIN
-  QUERY SearchCustomers
-    SQL 'SELECT name, email, balance FROM customers WHERE name ILIKE {search}'
-    PARAMETER search: String DEFAULT '%'
-    RETURNS Integration.Customer
-    MAP (name AS Name, email AS Email, balance AS Balance);
-END;
+CREATE DATABASE CONNECTION Integration.LegacyDatabase (
+  Type: 'PostgreSQL',
+  ConnectionString: @Integration.LegacyDatabase_DBSource,
+  Username: @Integration.LegacyDatabase_DBUsername,
+  Password: @Integration.LegacyDatabase_DBPassword
+) {
+  QUERY SearchCustomers (
+    Sql: 'SELECT name, email, balance FROM customers WHERE name ILIKE {search}',
+    Parameters: ( search: String DEFAULT '%' ),
+    Returns: Integration.Customer,
+    Map: (Name = name, Email = email, Balance = balance)
+  )
+};
 /
 
 -- Microflow that executes the query
diff --git a/docs-site/src/examples/master-detail.md b/docs-site/src/examples/master-detail.md
index f6e7cda13a..c250eac8ff 100644
--- a/docs-site/src/examples/master-detail.md
+++ b/docs-site/src/examples/master-detail.md
@@ -16,12 +16,12 @@ CREATE PAGE CRM.Customer_MasterDetail (
           TEMPLATE template1 {
             DYNAMICTEXT name (
               Content: '{1}',
-              ContentParams: [{1} = Name],
+              ContentParams: ({1} = Name),
               RenderMode: H4
             )
             DYNAMICTEXT email (
               Content: '{1}',
-              ContentParams: [{1} = Email]
+              ContentParams: ({1} = Email)
             )
           }
         }
diff --git a/docs-site/src/examples/rest-integration.md b/docs-site/src/examples/rest-integration.md
index b7877e754f..40d66aca05 100644
--- a/docs-site/src/examples/rest-integration.md
+++ b/docs-site/src/examples/rest-integration.md
@@ -255,7 +255,7 @@ CREATE CONSUMED REST SERVICE Integration.OrdersApi (
     Method: GET,
     Path: '/orders/{id}',
     Parameters: ($id: String),
-    Headers: ('Accept' = 'application/json'),
+    Headers: ('Accept': 'application/json'),
     Timeout: 30,
     Response: JSON AS $Result
   )
@@ -263,7 +263,7 @@ CREATE CONSUMED REST SERVICE Integration.OrdersApi (
   OPERATION CreateOrder (
     Method: POST,
     Path: '/orders',
-    Headers: ('Content-Type' = 'application/json'),
+    Headers: ('Content-Type': 'application/json'),
     Body: MAPPING Integration.OrderRequest {
       customerId = CustomerId,
       totalAmount = TotalAmount,
@@ -278,6 +278,8 @@ CREATE CONSUMED REST SERVICE Integration.OrdersApi (
 };
 ```
 
+A header value is a template, like the path: `{Token}` is the operation parameter `Token`, which the operation must declare (`Parameters: ($Token: String)`, else CE7056). An authorization header is `Headers: ('Authorization' = 'Bearer {Token}')`. The expression spelling `'Bearer ' + $Token` is deprecated (MDL-DEPR711) and `mxcli fmt --upgrade` rewrites it; it used to store only `Bearer `.
+
 Use `CREATE OR MODIFY CONSUMED REST SERVICE` to update an existing client without dropping it first:
 
 ```sql
@@ -290,7 +292,7 @@ CREATE OR MODIFY CONSUMED REST SERVICE Integration.OrdersApi (
     Method: GET,
     Path: '/orders/{id}',
     Parameters: ($id: String),
-    Headers: ('Accept' = 'application/json'),
+    Headers: ('Accept': 'application/json'),
     Timeout: 60,
     Response: JSON AS $Result
   )
diff --git a/docs-site/src/examples/security.md b/docs-site/src/examples/security.md
index 10ddba5055..90da1bf1cc 100644
--- a/docs-site/src/examples/security.md
+++ b/docs-site/src/examples/security.md
@@ -55,9 +55,9 @@ GRANT VIEW ON PAGE Sales.Admin_Dashboard TO Sales.Admin;
 User roles combine module roles from different modules into a single assignable role:
 
 ```sql
-CREATE OR MODIFY USER ROLE SalesViewer (System.User, Sales.Viewer);
-CREATE OR MODIFY USER ROLE SalesRep (System.User, Sales.User);
-CREATE OR MODIFY USER ROLE SalesManager (System.User, Sales.Admin) MANAGE ALL ROLES;
+CREATE OR MODIFY USER ROLE SalesViewer ( ModuleRoles: (System.User, Sales.Viewer) );
+CREATE OR MODIFY USER ROLE SalesRep ( ModuleRoles: (System.User, Sales.User) );
+CREATE OR MODIFY USER ROLE SalesManager ( ModuleRoles: (System.User, Sales.Admin), ManageAllRoles: true );
 ```
 
 ## Demo Users
diff --git a/docs-site/src/examples/validation.md b/docs-site/src/examples/validation.md
index 18af118bef..69a96af43a 100644
--- a/docs-site/src/examples/validation.md
+++ b/docs-site/src/examples/validation.md
@@ -72,7 +72,7 @@ The page's Save button calls the action microflow (not the validation microflow
 
 ```sql
 CREATE PAGE Sales.Order_Edit (
-  Params: { $Order: Sales.Order },
+  Params: ( $Order: Sales.Order ),
   Title: 'Order',
   Layout: Atlas_Core.PopupLayout
 ) {
diff --git a/docs-site/src/language/basics.md b/docs-site/src/language/basics.md
index 9601bd1029..0e8a42ed16 100644
--- a/docs-site/src/language/basics.md
+++ b/docs-site/src/language/basics.md
@@ -122,6 +122,18 @@ A construct with no mechanical rewrite is reported with the reason, and `fmt` re
 
 The design is in [ADR-0011](https://github.com/mendixlabs/mxcli/blob/main/docs/13-decisions/0011-mdl-language-versioning.md); `mxcli syntax language-header` has the details.
 
+## Re-runnable Creates: `or modify` and `if not exists`
+
+A plain `create` fails when the element already exists. Two guards make a script re-runnable, and they mean different things:
+
+| Statement | Element absent | Element present |
+|---|---|---|
+| `create page M.P …` | created | error — the script stops |
+| `create or modify page M.P …` | created | rewritten to match the statement (identity kept) |
+| `create page if not exists M.P …` | created | **left untouched**, reported as skipped |
+
+`if not exists` goes after the kind's keywords and before the name, on every `create` that names one element — `create microflow if not exists M.MF () …`, `create module if not exists M;`, `create user role if not exists Clerk (M.User);`, `create configuration if not exists 'Default' (…);`. It is not accepted on `annotation`, `index` (use `alter entity … add index if not exists`), `validation rule`, `navigation`, `translations` or `external entities`, which have no single named element to test. Writing `create or modify … if not exists` is refused as `MDL067`: the two guards contradict each other. `describe` never emits `if not exists`.
+
 ## Case Insensitivity
 
 All MDL **keywords** are case-insensitive. The following are equivalent:
diff --git a/docs-site/src/language/data-binding.md b/docs-site/src/language/data-binding.md
index 2200aaa89a..9abfadaa91 100644
--- a/docs-site/src/language/data-binding.md
+++ b/docs-site/src/language/data-binding.md
@@ -30,7 +30,7 @@ The simplest binding -- connects a DataView to a page parameter:
 ```sql
 CREATE PAGE MyModule.Customer_Edit
 (
-  Params: { $Customer: MyModule.Customer },
+  Params: ( $Customer: MyModule.Customer ),
   Title: 'Edit Customer',
   Layout: Atlas_Core.PopupLayout
 )
diff --git a/docs-site/src/language/document-access.md b/docs-site/src/language/document-access.md
index 16dd9e3035..9731731c79 100644
--- a/docs-site/src/language/document-access.md
+++ b/docs-site/src/language/document-access.md
@@ -94,7 +94,7 @@ GRANT EXECUTE ON MICROFLOW Shop.ACT_CreateOrder TO Shop.User, Shop.Admin;
 
 -- Create the page
 CREATE PAGE Shop.Order_Edit (
-  Params: { $Order: Shop.Order },
+  Params: ( $Order: Shop.Order ),
   Title: 'Edit Order',
   Layout: Atlas_Core.PopupLayout
 ) { ... }
diff --git a/docs-site/src/language/grant-revoke.md b/docs-site/src/language/grant-revoke.md
index 8bd921be68..123565e6cf 100644
--- a/docs-site/src/language/grant-revoke.md
+++ b/docs-site/src/language/grant-revoke.md
@@ -154,9 +154,9 @@ CREATE MODULE ROLE Shop.User DESCRIPTION 'Standard access';
 CREATE MODULE ROLE Shop.Viewer DESCRIPTION 'Read-only access';
 
 -- User roles
-CREATE USER ROLE Administrator (Shop.Admin, System.Administrator) MANAGE ALL ROLES;
-CREATE USER ROLE Employee (Shop.User);
-CREATE USER ROLE Guest (Shop.Viewer);
+CREATE USER ROLE Administrator ( ModuleRoles: (Shop.Admin, System.Administrator), ManageAllRoles: true );
+CREATE USER ROLE Employee ( ModuleRoles: (Shop.User) );
+CREATE USER ROLE Guest ( ModuleRoles: (Shop.Viewer) );
 
 -- Entity access
 GRANT CREATE, DELETE, READ *, WRITE * ON ENTITY Shop.Customer TO Shop.Admin;
diff --git a/docs-site/src/language/home-pages.md b/docs-site/src/language/home-pages.md
index 65ae2084ec..4e975f3fdc 100644
--- a/docs-site/src/language/home-pages.md
+++ b/docs-site/src/language/home-pages.md
@@ -58,24 +58,26 @@ CREATE OR REPLACE NAVIGATION Responsive
 
 ## Menus
 
-The `MENU` block defines the navigation menu as a tree of items and submenus.
+The `{ }` block after the profile's clauses defines the navigation menu as a tree of items and submenus.
 
 ### Menu Items
 
-A menu item links a label to a page:
+A menu item links a label to a page, a microflow, or sign-out, in the words a page action uses:
 
 ```sql
-MENU ITEM '<label>' PAGE <Module>.<Page>;
+MENU ITEM '<label>' ( OnClick: SHOW PAGE <Module>.<Page> )
+MENU ITEM '<label>' ( OnClick: CALL MICROFLOW <Module>.<Microflow>, Icon: <Module>.<IconCollection>.<Icon> )
+MENU ITEM '<label>' ( OnClick: SIGN OUT )
 ```
 
 ### Submenus
 
-Nest items inside a `MENU '<label>' (...)` block:
+Nest items inside a `MENU '<label>' { ... }` block:
 
 ```sql
-MENU '<label>' (
+MENU '<label>' [( Icon: <icon> )] {
   <menu-items>
-);
+}
 ```
 
 ### Complete Example
@@ -84,19 +86,19 @@ MENU '<label>' (
 CREATE OR REPLACE NAVIGATION Responsive
   HOME PAGE Shop.Home
   LOGIN PAGE Administration.Login
-  MENU (
-    MENU ITEM 'Home' PAGE Shop.Home;
-    MENU ITEM 'Products' PAGE Shop.Product_Overview;
-    MENU ITEM 'Orders' PAGE Shop.Order_Overview;
-    MENU 'Administration' (
-      MENU ITEM 'Users' PAGE Administration.Account_Overview;
-      MENU ITEM 'Roles' PAGE Administration.Role_Overview;
-      MENU 'System' (
-        MENU ITEM 'Logs' PAGE Administration.Log_Overview;
-        MENU ITEM 'Settings' PAGE Shop.Settings;
-      );
-    );
-  );
+  {
+    MENU ITEM 'Home' ( OnClick: SHOW PAGE Shop.Home )
+    MENU ITEM 'Products' ( OnClick: SHOW PAGE Shop.Product_Overview )
+    MENU ITEM 'Orders' ( OnClick: SHOW PAGE Shop.Order_Overview )
+    MENU 'Administration' {
+      MENU ITEM 'Users' ( OnClick: SHOW PAGE Administration.Account_Overview )
+      MENU ITEM 'Roles' ( OnClick: SHOW PAGE Administration.Role_Overview )
+      MENU 'System' {
+        MENU ITEM 'Logs' ( OnClick: SHOW PAGE Administration.Log_Overview )
+        MENU ITEM 'Settings' ( OnClick: SHOW PAGE Shop.Settings )
+      }
+    }
+  };
 ```
 
 ### Inspecting Menus
diff --git a/docs-site/src/language/image-collections.md b/docs-site/src/language/image-collections.md
index d56c987a84..b6faaf145b 100644
--- a/docs-site/src/language/image-collections.md
+++ b/docs-site/src/language/image-collections.md
@@ -15,7 +15,7 @@ SHOW IMAGE COLLECTION IN MyModule;
 DESCRIBE IMAGE COLLECTION MyModule.AppIcons;
 ```
 
-The `DESCRIBE` output includes the full `CREATE` statement. If the collection contains images, they are shown as `image Name ( File: 'path' )` children that can be copied and re-executed. In the TUI, images are rendered inline when the terminal supports it (Kitty, iTerm2, Sixel).
+The `DESCRIBE` output includes the full `CREATE` statement. If the collection contains images, each is written into the statement as `image Name ( Data: '<base64>' )`, so the output can be copied and re-executed without the original files. In the TUI, images are rendered inline when the terminal supports it (Kitty, iTerm2, Sixel).
 
 ## CREATE IMAGE COLLECTION
 
@@ -34,10 +34,11 @@ CREATE IMAGE COLLECTION <Module>.<Name>
 | `EXPORT LEVEL` | `'Hidden'` (internal to module) or `'Public'` (accessible from other modules) | `'Hidden'` |
 | `/** … */` | Documentation for the collection, as a doc comment before the statement (`COMMENT '…'` is its deprecated alias, `MDL-DEPR100`) | (none) |
 | `IMAGE Name ( File: '…' )` | Load an image from the filesystem into the collection | (none) |
+| `IMAGE Name ( Data: '…' [, Format: png] )` | The image itself, base64-encoded (what `DESCRIBE` writes); `Format` only when the bytes do not show it | (none) |
 
 The images are the collection's children, so they are in `{ }`, each with its properties in `( )`. The older form `( IMAGE Name FROM FILE '<path>', … )` still parses but warns (MDL-DEPR072); `mxcli fmt --upgrade` rewrites it.
 
-The image format is detected automatically from the file extension. Relative paths are resolved from the current working directory. Supported formats: PNG, SVG, GIF, JPEG, BMP, WebP.
+The image format is detected automatically from the file extension. Relative paths are resolved against the script's directory, then the current working directory. Supported formats: PNG, SVG, GIF, JPEG, BMP, WebP.
 
 ### Examples
 
diff --git a/docs-site/src/language/microflow-structure.md b/docs-site/src/language/microflow-structure.md
index 188346d276..0da444faef 100644
--- a/docs-site/src/language/microflow-structure.md
+++ b/docs-site/src/language/microflow-structure.md
@@ -170,6 +170,24 @@ was placed on purpose — in Studio Pro or with `@start` — so it survives a re
 that does not mention it, and `DESCRIBE` emits an `@start` line for it. An
 explicit `@start` overrides both.
 
+### Anchors
+
+`@anchor(from: X, to: Y)` picks the side (`top`, `right`, `bottom`, `left`) each
+end of a flow attaches to: `to` is the flow arriving at the statement, `from` the
+flow leaving it. On an `if`, `true: (from: …, to: …)` and `false: (…)` are its
+branches, and `from` is the flow leaving its closing merge — the merge has no
+statement of its own, just as its position rides on the `if` as `@merge`:
+
+```sql
+@anchor(from: bottom, to: top)
+@merge(2650, 200)
+if $Factory/Latitude = empty then
+  ...
+end if;
+```
+
+This is how `DESCRIBE` writes a decision whose merge drops onto the next row.
+
 ### Layout in `DESCRIBE` output
 
 `DESCRIBE MICROFLOW` and `DESCRIBE NANOFLOW` print a layout annotation —
diff --git a/docs-site/src/language/navigation-profiles.md b/docs-site/src/language/navigation-profiles.md
index 51779b8580..f0770be232 100644
--- a/docs-site/src/language/navigation-profiles.md
+++ b/docs-site/src/language/navigation-profiles.md
@@ -27,11 +27,15 @@ CREATE OR REPLACE NAVIGATION <Profile>
   [HOME PAGE <Module>.<Page> FOR <UserRole>]
   [LOGIN PAGE <Module>.<Page>]
   [NOT FOUND PAGE <Module>.<Page>]
-  [MENU (
+  [{
     <menu-items>
-  )]
+  }]
 ```
 
+The menu items are the profile's children, in `{ }` after its clauses and with
+no `;` between them. The old `MENU ( … )` block still parses and warns
+(MDL-DEPR121).
+
 ### Full Example
 
 ```sql
@@ -40,14 +44,14 @@ CREATE OR REPLACE NAVIGATION Responsive
   HOME PAGE MyModule.AdminHome FOR Administrator
   LOGIN PAGE Administration.Login
   NOT FOUND PAGE MyModule.Custom404
-  MENU (
-    MENU ITEM 'Home' PAGE MyModule.Home_Web;
-    MENU ITEM 'Orders' PAGE Shop.Order_Overview;
-    MENU 'Administration' (
-      MENU ITEM 'Users' PAGE Administration.Account_Overview;
-      MENU ITEM 'Settings' PAGE MyModule.Settings;
-    );
-  );
+  {
+    MENU ITEM 'Home' ( OnClick: SHOW PAGE MyModule.Home_Web )
+    MENU ITEM 'Orders' ( OnClick: SHOW PAGE Shop.Order_Overview )
+    MENU 'Administration' {
+      MENU ITEM 'Users' ( OnClick: SHOW PAGE Administration.Account_Overview )
+      MENU ITEM 'Settings' ( OnClick: SHOW PAGE MyModule.Settings )
+    }
+  };
 ```
 
 ### Minimal Example
diff --git a/docs-site/src/language/page-patterns.md b/docs-site/src/language/page-patterns.md
index 613aa6152b..e4049b3566 100644
--- a/docs-site/src/language/page-patterns.md
+++ b/docs-site/src/language/page-patterns.md
@@ -52,7 +52,7 @@ An edit page displayed as a popup dialog. Receives the entity as a page paramete
 ```sql
 CREATE PAGE MyModule.Customer_Edit FOLDER 'Customers'
 (
-  Params: { $Customer: MyModule.Customer },
+  Params: ( $Customer: MyModule.Customer ),
   Title: 'Edit Customer',
   Layout: Atlas_Core.PopupLayout
 )
@@ -78,7 +78,7 @@ A full-page detail view with sections organized using layout grids:
 ```sql
 CREATE PAGE MyModule.Customer_Detail FOLDER 'Customers'
 (
-  Params: { $Customer: MyModule.Customer },
+  Params: ( $Customer: MyModule.Customer ),
   Title: 'Customer Detail',
   Layout: Atlas_Core.Atlas_Default
 )
@@ -242,7 +242,7 @@ CREATE PAGE HR.Employee_Overview FOLDER 'Employees'
 -- 2. Edit page (popup)
 CREATE PAGE HR.Employee_Edit FOLDER 'Employees'
 (
-  Params: { $Employee: HR.Employee },
+  Params: ( $Employee: HR.Employee ),
   Title: 'Edit Employee',
   Layout: Atlas_Core.PopupLayout
 )
diff --git a/docs-site/src/language/page-structure.md b/docs-site/src/language/page-structure.md
index 1cb01e0b89..db9cef6ac4 100644
--- a/docs-site/src/language/page-structure.md
+++ b/docs-site/src/language/page-structure.md
@@ -7,10 +7,10 @@ Every MDL page has three main parts: page properties (title, layout, parameters)
 ```sql
 CREATE [OR REPLACE] PAGE <Module>.<Name> [FOLDER '<path>']
 (
-  [Params: { $Param: Module.Entity | Type [, ...] },]
+  [Params: ( $Param: Module.Entity | Type [, ...] ),]
   Title: '<title>',
   Layout: <Module.LayoutName>
-  [, Variables: { $name: Type = 'expression' [, ...] }]
+  [, Variables: ( $name: Type = 'expression' [, ...] )]
 )
 {
   <widget-tree>
@@ -41,7 +41,7 @@ Popup layouts are typically used for edit and detail pages:
 ```sql
 CREATE PAGE MyModule.Customer_Edit
 (
-  Params: { $Customer: MyModule.Customer },
+  Params: ( $Customer: MyModule.Customer ),
   Title: 'Edit Customer',
   Layout: Atlas_Core.PopupLayout
 )
@@ -62,7 +62,7 @@ Page parameters define values that must be passed when the page is opened. Param
 
 ```sql
 (
-  Params: { $Customer: MyModule.Customer },
+  Params: ( $Customer: MyModule.Customer ),
   ...
 )
 ```
@@ -71,7 +71,7 @@ Multiple parameters are comma-separated, and can mix entity and primitive types:
 
 ```sql
 (
-  Params: { $Order: Sales.Order, $Quantity: Integer, $IsNew: Boolean },
+  Params: ( $Order: Sales.Order, $Quantity: Integer, $IsNew: Boolean ),
   ...
 )
 ```
@@ -86,7 +86,7 @@ Page variables store local state (booleans, strings, etc.) that can control widg
 (
   Title: 'Product Detail',
   Layout: Atlas_Core.Atlas_Default,
-  Variables: { $showDetails: Boolean = 'true' }
+  Variables: ( $showDetails: Boolean = 'true' )
 )
 ```
 
@@ -187,7 +187,7 @@ Use the `FOLDER` clause after the name to organize pages into folders within a m
 ```sql
 CREATE PAGE MyModule.Customer_Edit FOLDER 'Customers'
 (
-  Params: { $Customer: MyModule.Customer },
+  Params: ( $Customer: MyModule.Customer ),
   Title: 'Edit Customer',
   Layout: Atlas_Core.PopupLayout
 )
diff --git a/docs-site/src/language/pages.md b/docs-site/src/language/pages.md
index 8c50a5cb7c..1e57ca6234 100644
--- a/docs-site/src/language/pages.md
+++ b/docs-site/src/language/pages.md
@@ -18,7 +18,7 @@ The basic syntax for creating a page:
 ```sql
 CREATE [OR REPLACE] PAGE <Module>.<Name> [FOLDER '<path>']
 (
-  [Params: { $Param: Module.Entity | Type [, ...] },]
+  [Params: ( $Param: Module.Entity | Type [, ...] ),]
   Title: '<title>',
   Layout: <Module.LayoutName>
   [, Class: '<css-class>', Style: '<css: rule>']
@@ -50,7 +50,7 @@ Pages can receive entity objects or primitive values as parameters from the call
 ```sql
 CREATE PAGE MyModule.Customer_Edit
 (
-  Params: { $Customer: MyModule.Customer },
+  Params: ( $Customer: MyModule.Customer ),
   Title: 'Edit Customer',
   Layout: Atlas_Core.PopupLayout
 )
@@ -70,10 +70,10 @@ CREATE PAGE MyModule.Customer_Edit
 
 | Property | Description | Example |
 |----------|-------------|---------|
-| `Params` | Page parameters (entity objects or primitives) | `Params: { $Order: Sales.Order, $Qty: Integer }` |
+| `Params` | Page parameters (entity objects or primitives) | `Params: ( $Order: Sales.Order, $Qty: Integer )` |
 | `Title` | Page title shown in the browser/tab | `Title: 'Edit Customer'` |
 | `Layout` | Layout to use for the page | `Layout: Atlas_Core.PopupLayout` |
-| `Variables` | Page-level variables for conditional logic | `Variables: { $show: Boolean = 'true' }` |
+| `Variables` | Page-level variables for conditional logic | `Variables: ( $show: Boolean = 'true' )` |
 | `Class` | CSS class applied to the page (Forms$Appearance) | `Class: 'container-fluid bg-light'` |
 | `Style` | Inline CSS style applied to the page | `Style: 'min-height: 100vh'` |
 
diff --git a/docs-site/src/language/roles.md b/docs-site/src/language/roles.md
index ae7bffb86e..bd98da4c37 100644
--- a/docs-site/src/language/roles.md
+++ b/docs-site/src/language/roles.md
@@ -40,7 +40,9 @@ A user role is a project-level role assigned to end users at login. Each user ro
 ### CREATE USER ROLE
 
 ```sql
-CREATE USER ROLE <Name> (<Module>.<Role> [, ...]) [MANAGE ALL ROLES];
+CREATE USER ROLE <Name> [( ModuleRoles: (<Module>.<Role> [, ...]), Description: '<text>',
+    ManageAllRoles: true|false, ManageableRoles: (<UserRole> [, ...]),
+    ManageUsersWithoutRoles: true|false, CheckSecurity: true|false )];
 ```
 
 The `MANAGE ALL ROLES` option allows users with this role to assign any user role to other users (typically for administrators).
@@ -49,13 +51,13 @@ Examples:
 
 ```sql
 -- Administrator with management rights
-CREATE USER ROLE AppAdmin (Shop.Admin, System.Administrator) MANAGE ALL ROLES;
+CREATE USER ROLE AppAdmin ( ModuleRoles: (Shop.Admin, System.Administrator), ManageAllRoles: true );
 
 -- Regular user
-CREATE USER ROLE AppUser (Shop.User);
+CREATE USER ROLE AppUser ( ModuleRoles: (Shop.User) );
 
 -- Read-only viewer
-CREATE USER ROLE AppViewer (Shop.Viewer);
+CREATE USER ROLE AppViewer ( ModuleRoles: (Shop.Viewer) );
 ```
 
 ### ALTER USER ROLE
@@ -90,9 +92,9 @@ CREATE MODULE ROLE Shop.User DESCRIPTION 'Standard shop access';
 CREATE MODULE ROLE Reporting.Viewer DESCRIPTION 'View reports';
 
 -- 2. User roles
-CREATE USER ROLE Administrator (Shop.Admin, Reporting.Viewer, System.Administrator) MANAGE ALL ROLES;
-CREATE USER ROLE Employee (Shop.User, Reporting.Viewer);
-CREATE USER ROLE Guest (Shop.User);
+CREATE USER ROLE Administrator ( ModuleRoles: (Shop.Admin, Reporting.Viewer, System.Administrator), ManageAllRoles: true );
+CREATE USER ROLE Employee ( ModuleRoles: (Shop.User, Reporting.Viewer) );
+CREATE USER ROLE Guest ( ModuleRoles: (Shop.User) );
 ```
 
 ## See Also
diff --git a/docs-site/src/language/security.md b/docs-site/src/language/security.md
index 1e657b61b8..883d0730d8 100644
--- a/docs-site/src/language/security.md
+++ b/docs-site/src/language/security.md
@@ -72,7 +72,7 @@ the weight -- **whatever it can read is public**.
 ```sql
 -- The role anonymous visitors are given. System.User is what lets an
 -- unauthenticated session exist at all.
-CREATE USER ROLE Anonymous (Shop.Viewer, System.User);
+CREATE USER ROLE Anonymous ( ModuleRoles: (Shop.Viewer, System.User) );
 
 ALTER APP SECURITY GUEST ACCESS ON ROLE Anonymous;
 
diff --git a/docs-site/src/language/snippets.md b/docs-site/src/language/snippets.md
index ab84382462..02cdd89b92 100644
--- a/docs-site/src/language/snippets.md
+++ b/docs-site/src/language/snippets.md
@@ -7,7 +7,7 @@ Snippets are reusable page fragments that can be embedded in multiple pages. The
 ```sql
 CREATE [OR REPLACE] SNIPPET <Module>.<Name> [FOLDER '<path>']
 [(
-  Params: { $Param: Module.Entity [, ...] }
+  Params: ( $Param: Module.Entity [, ...] )
 )]
 {
   <widget-tree>
@@ -34,7 +34,7 @@ Snippets can accept entity parameters, similar to pages:
 ```sql
 CREATE SNIPPET MyModule.CustomerCard
 (
-  Params: { $Customer: MyModule.Customer }
+  Params: ( $Customer: MyModule.Customer )
 )
 {
   CONTAINER cCard (Class: 'card') {
diff --git a/docs-site/src/language/widget-types.md b/docs-site/src/language/widget-types.md
index 13f4c41556..91c6fe49f1 100644
--- a/docs-site/src/language/widget-types.md
+++ b/docs-site/src/language/widget-types.md
@@ -70,7 +70,7 @@ CONTAINER cCard (Class: 'card mx-spacing-top-large') {
 | `Class` | CSS class names | `Class: 'card p-3'` |
 | `Style` | Inline CSS styles | `Style: 'padding: 16px;'` |
 | `DynamicClasses` | Runtime-computed CSS classes (expression; stacks on `Class`) | `DynamicClasses: if $currentObject/IsActive then 'is-active' else ''` |
-| `DesignProperties` | Design property values | `DesignProperties: ['Spacing top': 'Large']` |
+| `DesignProperties` | Design property values | `DesignProperties: ('Spacing top': 'Large')` |
 
 ### CUSTOMCONTAINER
 
@@ -167,13 +167,13 @@ has no name, hence `TEMPLATE FOR <entity>`:
 ```sql
 LISTVIEW vehicleListView (DataSource: DATABASE Pages.Vehicle) {
   -- the default body, used for an object no template matches
-  DYNAMICTEXT defaultVehicle (Content: '{1} {2}', ContentParams: [{1} = Brand, {2} = Model])
+  DYNAMICTEXT defaultVehicle (Content: '{1} {2}', ContentParams: ({1} = Brand, {2} = Model))
 
   TEMPLATE FOR Pages.Bus {
-    DYNAMICTEXT busLabel (Content: 'Bus, capacity {1}', ContentParams: [{1} = PassengerCapacity])
+    DYNAMICTEXT busLabel (Content: 'Bus, capacity {1}', ContentParams: ({1} = PassengerCapacity))
   }
   TEMPLATE FOR Pages.Truck {
-    DYNAMICTEXT truckLabel (Content: 'Truck, max load {1} kg', ContentParams: [{1} = MaxLoadKg])
+    DYNAMICTEXT truckLabel (Content: 'Truck, max load {1} kg', ContentParams: ({1} = MaxLoadKg))
   }
 }
 ```
@@ -540,8 +540,8 @@ Bind one with the property's own `<Name>Params` companion:
 ```sql
 image cardImage (
   ImageType: imageUrl,
-  ImageUrl: '{1}',        ImageUrlParams: [{1} = PictureUrl],
-  AlternativeText: '{1}', AlternativeTextParams: [{1} = Name]
+  ImageUrl: '{1}',        ImageUrlParams: ({1} = PictureUrl),
+  AlternativeText: '{1}', AlternativeTextParams: ({1} = Name)
 )
 ```
 
@@ -558,7 +558,7 @@ Two shorter spellings remain:
 | Spelling | Use it for |
 |----------|-----------|
 | `'{AttrName}'` | one attribute, no formatting block |
-| `contentparams: [...]` | a widget with a **single** text template — it is one list shared by every template on the widget |
+| `contentparams: (...)` | a widget with a **single** text template — it is one list shared by every template on the widget |
 
 Every `{N}` needs a matching parameter (Mendix rejects a shortfall with
 `CE0720`), and parameters with no `{N}` to fill are reported as MDL-WIDGET21
@@ -573,7 +573,7 @@ These properties are shared across many widget types:
 | `Class` | CSS class names | `Class: 'card p-3'` |
 | `Style` | Inline CSS styles | `Style: 'margin-top: 8px;'` |
 | `DynamicClasses` | Runtime-computed CSS classes (expression; stacks on `Class`) | `DynamicClasses: if $currentObject/IsActive then 'is-active' else ''` |
-| `DesignProperties` | Atlas design properties | `DesignProperties: ['Spacing top': 'Large', 'Full width': ON]` |
+| `DesignProperties` | Atlas design properties | `DesignProperties: ('Spacing top': 'Large', 'Full width': ON)` |
 | `Visible` | Visibility expression | `Visible: '$showSection'` |
 | `Editable` | Editability mode | `Editable: ReadOnly` |
 
diff --git a/docs-site/src/language/workflow-activities.md b/docs-site/src/language/workflow-activities.md
index 6217b44381..85fc0cf2a6 100644
--- a/docs-site/src/language/workflow-activities.md
+++ b/docs-site/src/language/workflow-activities.md
@@ -248,7 +248,7 @@ USER TASK Review 'Review'
   };
 ```
 
-An activity may carry only one interrupting boundary event (CE6697). `ALTER WORKFLOW … INSERT BOUNDARY EVENT` cannot add a notification boundary event yet.
+An activity may carry only one interrupting boundary event (CE6697). `ALTER WORKFLOW … { INSERT INTO <activity> { BOUNDARY EVENT … } }` cannot add a notification boundary event yet.
 
 A microflow reaches any of these with `NOTIFY WORKFLOW`, naming the element:
 
@@ -297,6 +297,28 @@ END;
 
 Typically used inside an outcome block to stop the workflow after a rejection or cancellation.
 
+## Notes (annotations)
+
+Studio Pro's notes attach to an activity. Write one as `@annotation '…'` on the
+line before the activity, as in a microflow; an event sub-process takes it before
+`EVENT SUBPROCESS`, and the note on the workflow itself is the header clause
+`ANNOTATION '…'`:
+
+```sql
+CREATE WORKFLOW Module.Approve
+  PARAMETER $WorkflowContext: Module.Request
+  ANNOTATION 'Started from the request form'
+BEGIN
+  @annotation 'Escalates after two days'
+  USER TASK Review 'Review' PAGE Module.Review_Task OUTCOMES 'Done' { };
+END WORKFLOW;
+```
+
+An activity takes one note, and no other `@` annotation. `DESCRIBE WORKFLOW`
+writes them the same way, so a replay keeps them. A standalone
+`ANNOTATION '…';` statement in the body is refused (MDL-WF04): Mendix cannot
+load a note placed in the activity flow.
+
 ## Summary Table
 
 | Activity | Purpose | Pauses Workflow? |
diff --git a/docs-site/src/reference/image-collection/create-image-collection.md b/docs-site/src/reference/image-collection/create-image-collection.md
index e50e81d6fc..0c1b30eea2 100644
--- a/docs-site/src/reference/image-collection/create-image-collection.md
+++ b/docs-site/src/reference/image-collection/create-image-collection.md
@@ -7,6 +7,7 @@
         [EXPORT LEVEL 'Hidden' | 'Public']
         [{
             IMAGE image_name ( File: 'path' )
+            IMAGE image_name ( Data: 'base64' [, Format: png | jpg | gif | svg | bmp | webp] )
             ...
         }];
 
@@ -26,7 +27,10 @@ Creates a new image collection in the specified module. `OR MODIFY` updates an e
 : Documentation text for the collection, as a doc comment before the statement. The `COMMENT '…'` clause is its deprecated alias (`MDL-DEPR100`).
 
 **IMAGE name ( File: 'path' )**
-: Loads an image from a file on disk. The path is relative to the current working directory. Supported formats: PNG, SVG, GIF, JPEG, BMP, WebP. A name that is not a plain identifier is written as a quoted identifier (`"logo-dark"`).
+: Loads an image from a file on disk. A relative path is resolved against the script's directory, then the current working directory. Supported formats: PNG, SVG, GIF, JPEG, BMP, WebP, taken from the file extension. A name that is not a plain identifier is written as a quoted identifier (`"logo-dark"`).
+
+**IMAGE name ( Data: 'base64', Format: fmt )**
+: The image itself, base64-encoded. This is what `DESCRIBE IMAGE COLLECTION` writes, so its output replays anywhere without the files it came from. `Format` is needed only when the bytes do not show it (PNG, JPEG, GIF, BMP and WebP signatures, and SVG markup, are recognised).
 
 The images are the collection's children, so they are in `{ }`, each with its properties in `( )`. The older form `( IMAGE name FROM FILE 'path', … )` still parses but warns (MDL-DEPR072); `mxcli fmt --upgrade` rewrites it.
 
diff --git a/docs-site/src/reference/image-collection/show-describe-image-collection.md b/docs-site/src/reference/image-collection/show-describe-image-collection.md
index fdb559a060..10245003fd 100644
--- a/docs-site/src/reference/image-collection/show-describe-image-collection.md
+++ b/docs-site/src/reference/image-collection/show-describe-image-collection.md
@@ -40,7 +40,7 @@ SHOW IMAGE COLLECTION IN MyModule;
 DESCRIBE IMAGE COLLECTION MyModule.AppIcons;
 ```
 
-The output includes the complete `CREATE` statement with all `IMAGE ... FROM FILE` entries, which can be copied and re-executed.
+The output is the complete `CREATE OR MODIFY` statement, each image written into it as `IMAGE name ( Data: '<base64>' )`, so it can be copied and re-executed on any machine. `DESCRIBE` writes no files.
 
 ## See Also
 
diff --git a/docs-site/src/reference/navigation/alter-navigation.md b/docs-site/src/reference/navigation/alter-navigation.md
index a416715e22..709966edaa 100644
--- a/docs-site/src/reference/navigation/alter-navigation.md
+++ b/docs-site/src/reference/navigation/alter-navigation.md
@@ -8,13 +8,13 @@ CREATE OR REPLACE NAVIGATION profile
     [ HOME PAGE module.PageName FOR UserRole ]
     [ LOGIN PAGE module.PageName ]
     [ NOT FOUND PAGE module.PageName ]
-    [ MENU (
-        menu_items
-    ) ]
     [ ON SYNC ERROR { THROW | CONTINUE } ]
     [ SYNC (
         sync_rules
     ) ]
+    [ {
+        menu_items
+    } ]
 ```
 
 ## Description
@@ -44,9 +44,11 @@ download anything.
 
 ### Menu Items
 
-Menu items form a hierarchy. Top-level items appear in the main navigation bar. Nested submenus are created with the `MENU 'label' ( ... )` syntax.
+Menu items form a hierarchy. They are the profile's children, in `{ ... }` after its clauses, like a page's widgets. Top-level items appear in the main navigation bar. Nested submenus are created with the `MENU 'label' { ... }` syntax.
+
+Each `MENU ITEM` specifies a label and, in its property list, an action and an icon: `MENU ITEM 'Home' ( OnClick: SHOW PAGE M.Home, Icon: Atlas_Core.Atlas.home )`. A child ends in `)` or `}`, so no separator is written between items.
 
-Each `MENU ITEM` specifies a label and a target page. Menu items are terminated with semicolons.
+The old spelling — `MENU ( MENU ITEM 'Home' PAGE M.Home; … )` — still parses and warns (MDL-DEPR121, MDL-DEPR122); `mxcli fmt --upgrade` rewrites it.
 
 ## Parameters
 
@@ -69,13 +71,13 @@ Each `MENU ITEM` specifies a label and a target page. Menu items are terminated
 `NOT FOUND PAGE module.PageName`
 :   Optional custom 404 page shown when a requested page is not found.
 
-`MENU ( menu_items )`
-:   Optional menu structure. Contains `MENU ITEM` and nested `MENU` entries.
+`{ menu_items }`
+:   Optional menu structure. Contains `MENU ITEM` and nested `MENU` entries. An empty `{ }` clears the menu; omitting the block leaves it alone.
 
-`MENU ITEM 'label' PAGE module.PageName`
-:   A leaf menu item that navigates to a page.
+`MENU ITEM 'label' ( OnClick: action, Icon: icon )`
+:   A leaf menu item. `OnClick` is `SHOW PAGE module.PageName`, `CALL MICROFLOW module.Microflow` or `SIGN OUT`; `Icon` is `Module.Collection.icon`, `GLYPH n` or `IMAGE Module.Images.name`. Both are optional.
 
-`MENU 'label' ( ... )`
+`MENU 'label' [( Icon: icon )] { ... }`
 :   A submenu containing nested menu items and/or further submenus.
 
 ### Offline Synchronization
@@ -144,14 +146,14 @@ CREATE OR REPLACE NAVIGATION Responsive
     HOME PAGE MyModule.AdminHome FOR Administrator
     LOGIN PAGE Administration.Login
     NOT FOUND PAGE MyModule.Custom404
-    MENU (
-        MENU ITEM 'Home' PAGE MyModule.Home_Web;
-        MENU 'Admin' (
-            MENU ITEM 'Users' PAGE Administration.Account_Overview;
-            MENU ITEM 'Settings' PAGE MyModule.Settings;
-        );
-        MENU ITEM 'About' PAGE MyModule.About;
-    );
+    {
+        MENU ITEM 'Home' ( OnClick: SHOW PAGE MyModule.Home_Web )
+        MENU 'Admin' {
+            MENU ITEM 'Users' ( OnClick: SHOW PAGE Administration.Account_Overview )
+            MENU ITEM 'Settings' ( OnClick: SHOW PAGE MyModule.Settings )
+        }
+        MENU ITEM 'About' ( OnClick: SHOW PAGE MyModule.About )
+    };
 ```
 
 Native mobile navigation:
@@ -159,11 +161,11 @@ Native mobile navigation:
 ```sql
 CREATE OR REPLACE NAVIGATION NativePhone
     HOME PAGE Mobile.Dashboard
-    MENU (
-        MENU ITEM 'Home' PAGE Mobile.Dashboard;
-        MENU ITEM 'Tasks' PAGE Mobile.TaskList;
-        MENU ITEM 'Profile' PAGE Mobile.UserProfile;
-    );
+    {
+        MENU ITEM 'Home' ( OnClick: SHOW PAGE Mobile.Dashboard )
+        MENU ITEM 'Tasks' ( OnClick: SHOW PAGE Mobile.TaskList )
+        MENU ITEM 'Profile' ( OnClick: SHOW PAGE Mobile.UserProfile )
+    };
 ```
 
 ## See Also
diff --git a/docs-site/src/reference/navigation/menu.md b/docs-site/src/reference/navigation/menu.md
index 667f786664..c86dea5b14 100644
--- a/docs-site/src/reference/navigation/menu.md
+++ b/docs-site/src/reference/navigation/menu.md
@@ -3,7 +3,7 @@
 ## Synopsis
 
 ```sql
-CREATE [ OR MODIFY ] MENU module.name [ FOLDER 'folder_path' ] ( menu_item [ menu_item ... ] )
+CREATE [ OR MODIFY ] MENU module.name [ FOLDER 'folder_path' ] { menu_item [ menu_item ... ] }
 DESCRIBE MENU module.name
 DROP MENU module.name
 ```
@@ -11,8 +11,8 @@ DROP MENU module.name
 Where each `menu_item` is one of:
 
 ```sql
-MENU ITEM 'caption' [ PAGE module.page | MICROFLOW module.microflow ] [ ICON module.collection.icon ] ;
-MENU 'caption' [ ICON module.collection.icon ] ( nested_items ) ;
+MENU ITEM 'caption' [ ( [ OnClick: SHOW PAGE module.page | CALL MICROFLOW module.microflow | SIGN OUT ] [, Icon: module.collection.icon ] ) ]
+MENU 'caption' [ ( Icon: module.collection.icon ) ] { nested_items }
 ```
 
 ## Description
@@ -23,7 +23,7 @@ menu widget on a page points at. Atlas_Core ships two of them, `Phone_Menu` and
 
 A menu document is **not** the menu inside a navigation profile, although the two
 are easy to confuse: both are built from the same menu items, which is why the item
-syntax here is identical to the `MENU (...)` block of
+syntax here is identical to the `{ ... }` menu block of
 [ALTER NAVIGATION](alter-navigation.md). They differ in where they live and how they
 are read:
 
@@ -54,37 +54,44 @@ a fixed point.
 `'caption'`
 :   The item's label, in single quotes.
 
-`PAGE` / `MICROFLOW`
-:   Optional target opened when the item is clicked. An item with neither is inert
-    (stored as `Forms$NoAction`), which is normal for an item that only groups
-    sub-items.
+`OnClick:`
+:   Optional action run when the item is clicked, in the words a page action uses:
+    `show page M.P`, `call microflow M.F` or `sign out`. An item without one is
+    inert (stored as `Forms$NoAction`), which is normal for an item that only
+    groups sub-items.
 
-`ICON`
+`Icon:`
 :   Optional icon, given as a qualified name into an icon collection — not a string.
     Hyphenated segments are double-quoted: `Atlas_Core.Atlas."layout-2"`.
+    `glyph <code>` and `image Module.Images.name` write the other two icon kinds.
+
+The items are children, in `{ }` with no separator between them (R2). The old
+spelling — items in `( )`, each ending in `;`, with `PAGE`/`MICROFLOW`/`ICON`
+clauses after the caption — still parses and warns (MDL-DEPR121, MDL-DEPR122);
+`mxcli fmt --upgrade` rewrites it.
 
 ## Examples
 
 Create a menu with a nested sub-menu:
 
 ```sql
-CREATE MENU MyModule.Main_Menu (
-  menu item 'Home' page MyModule.Home_Web icon Atlas_Core.Atlas.home;
-  menu item 'Run' microflow MyModule.DoThing;
-  menu 'Admin' (
-    menu item 'Accounts' page Administration.Account_Overview;
-  );
-  menu item 'Plain';
-);
+CREATE MENU MyModule.Main_Menu {
+  menu item 'Home' ( OnClick: show page MyModule.Home_Web, Icon: Atlas_Core.Atlas.home )
+  menu item 'Run' ( OnClick: call microflow MyModule.DoThing )
+  menu 'Admin' {
+    menu item 'Accounts' ( OnClick: show page Administration.Account_Overview )
+  }
+  menu item 'Plain'
+};
 ```
 
 Replace its contents (the two omitted items are removed):
 
 ```sql
-CREATE OR MODIFY MENU MyModule.Main_Menu (
-  menu item 'Home' page MyModule.Home_Web icon Atlas_Core.Atlas.home;
-  menu item 'Run' microflow MyModule.DoThing;
-);
+CREATE OR MODIFY MENU MyModule.Main_Menu {
+  menu item 'Home' ( OnClick: show page MyModule.Home_Web, Icon: Atlas_Core.Atlas.home )
+  menu item 'Run' ( OnClick: call microflow MyModule.DoThing )
+};
 ```
 
 Read one back — including Atlas's own:
diff --git a/docs-site/src/reference/page/create-page.md b/docs-site/src/reference/page/create-page.md
index 76a107d861..4eeb4c6f85 100644
--- a/docs-site/src/reference/page/create-page.md
+++ b/docs-site/src/reference/page/create-page.md
@@ -5,10 +5,10 @@
 ```sql
 CREATE [ OR REPLACE ] PAGE module.Name [ FOLDER 'path' ]
 (
-    [ Params: { $param : Module.Entity | Type [, ...] }, ]
+    [ Params: ( $param : Module.Entity | Type [, ...] ), ]
     Title: 'title',
     Layout: Module.LayoutName
-    [, Variables: { $name : type = 'expression' [, ...] } ]
+    [, Variables: ( $name : type = 'expression' [, ...] ) ]
 )
 {
     widget_tree
@@ -192,14 +192,14 @@ These properties are available on most widget types:
 | `DynamicClasses` | Runtime-computed CSS classes (expression; stacks on `Class`) | `DynamicClasses: if $currentObject/IsActive then 'is-active' else ''` |
 | `Editable` | Edit control | `Editable: NEVER` or `Editable: ALWAYS` |
 | `Visible` | Visibility expression | `Visible: '$showField'` |
-| `DesignProperties` | Atlas design properties | `DesignProperties: ['Spacing top': 'Large']` |
+| `DesignProperties` | Atlas design properties | `DesignProperties: ('Spacing top': 'Large')` |
 
 ## Parameters
 
 `module.Name`
 :   The qualified name of the page (`Module.PageName`). The module must already exist.
 
-`Params: { ... }`
+`Params: ( ... )`
 :   Optional page parameters. Each parameter has a `$`-prefixed name and an entity type.
 
 `Title: 'title'`
@@ -211,7 +211,7 @@ These properties are available on most widget types:
 `FOLDER 'path'`
 :   Optional folder within the module, as a clause after the name. Nested folders use `/`. The `Folder: 'path'` property is its deprecated alias (`MDL-DEPR105`).
 
-`Variables: { ... }`
+`Variables: ( ... )`
 :   Optional page variables with type and default expression.
 
 ## Examples
@@ -221,7 +221,7 @@ Edit page with a data view and form fields:
 ```sql
 CREATE PAGE MyModule.Customer_Edit
 (
-    Params: { $Customer: MyModule.Customer },
+    Params: ( $Customer: MyModule.Customer ),
     Title: 'Edit Customer',
     Layout: Atlas_Core.PopupLayout
 )
@@ -293,7 +293,7 @@ Page with snippet call:
 ```sql
 CREATE PAGE MyModule.Customer_Detail
 (
-    Params: { $Customer: MyModule.Customer },
+    Params: ( $Customer: MyModule.Customer ),
     Title: 'Customer Detail',
     Layout: Atlas_Core.Atlas_Default
 )
@@ -339,10 +339,10 @@ Page with page variables and conditional visibility:
 ```sql
 CREATE PAGE MyModule.AdvancedForm
 (
-    Params: { $Item: MyModule.Item },
+    Params: ( $Item: MyModule.Item ),
     Title: 'Advanced Form',
     Layout: Atlas_Core.Atlas_Default,
-    Variables: { $showAdvanced: Boolean = 'false' }
+    Variables: ( $showAdvanced: Boolean = 'false' )
 )
 {
     DATAVIEW dvItem (DataSource: $Item) {
diff --git a/docs-site/src/reference/page/create-snippet.md b/docs-site/src/reference/page/create-snippet.md
index 0147256ef0..39b07e991d 100644
--- a/docs-site/src/reference/page/create-snippet.md
+++ b/docs-site/src/reference/page/create-snippet.md
@@ -5,7 +5,7 @@
 ```sql
 CREATE [ OR REPLACE ] SNIPPET module.Name [ FOLDER 'path' ]
 [(
-    Params: { $param : Module.Entity | Type [, ...] }
+    Params: ( $param : Module.Entity | Type [, ...] )
 )]
 {
     widget_tree
@@ -33,7 +33,7 @@ The optional `Folder` property places the snippet in a subfolder within the modu
 `module.Name`
 :   The qualified name of the snippet (`Module.SnippetName`). The module must already exist.
 
-`Params: { ... }`
+`Params: ( ... )`
 :   Optional snippet parameters. Each parameter has a `$`-prefixed name and an
     **entity** type (`Module.Entity`).
 
@@ -54,7 +54,7 @@ Simple snippet with a header:
 ```sql
 CREATE SNIPPET MyModule.CustomerHeader
 (
-    Params: { $Customer: MyModule.Customer }
+    Params: ( $Customer: MyModule.Customer )
 )
 {
     CONTAINER cntHeader (Class: 'card-header') {
@@ -69,7 +69,7 @@ Snippet with form fields:
 ```sql
 CREATE SNIPPET MyModule.AddressFields
 (
-    Params: { $Address: MyModule.Address }
+    Params: ( $Address: MyModule.Address )
 )
 {
     TEXTBOX txtStreet (Label: 'Street', Attribute: Street)
@@ -95,7 +95,7 @@ Embedding a snippet in a page:
 ```sql
 CREATE PAGE MyModule.Customer_Edit
 (
-    Params: { $Customer: MyModule.Customer },
+    Params: ( $Customer: MyModule.Customer ),
     Title: 'Edit Customer',
     Layout: Atlas_Core.PopupLayout
 )
diff --git a/docs-site/src/reference/query/describe-page.md b/docs-site/src/reference/query/describe-page.md
index 183914a47a..90adca97d5 100644
--- a/docs-site/src/reference/query/describe-page.md
+++ b/docs-site/src/reference/query/describe-page.md
@@ -30,7 +30,7 @@ Example output:
 ```sql
 CREATE PAGE Sales.Customer_Edit
 (
-  Params: { $Customer: Sales.Customer },
+  Params: ( $Customer: Sales.Customer ),
   Title: 'Edit Customer',
   Layout: Atlas_Core.PopupLayout
 )
diff --git a/docs-site/src/reference/security/create-user-role.md b/docs-site/src/reference/security/create-user-role.md
index f1a8118232..15c8f9abaf 100644
--- a/docs-site/src/reference/security/create-user-role.md
+++ b/docs-site/src/reference/security/create-user-role.md
@@ -3,50 +3,71 @@
 ## Synopsis
 
 ```sql
-CREATE USER ROLE Name ( module.Role [, ...] ) [ MANAGE ALL ROLES ]
+CREATE [ OR MODIFY ] USER ROLE Name [ (
+    ModuleRoles: ( module.Role [, ...] ),
+    Description: 'text',
+    ManageAllRoles: true | false,
+    ManageableRoles: ( UserRole [, ...] ),
+    ManageUsersWithoutRoles: true | false,
+    CheckSecurity: true | false
+) ]
 ```
 
 ## Description
 
-Creates a project-level user role that aggregates one or more module roles. User roles are assigned to end users (either directly or via demo users) and determine the combined set of permissions across all modules.
+Creates a project-level user role that aggregates module roles. User roles are assigned to end users (either directly or via demo users) and determine the combined set of permissions across all modules.
 
 A user role name must be unique at the project level. It is not qualified with a module name because user roles span multiple modules.
 
-The optional `MANAGE ALL ROLES` clause grants the user role the ability to manage all other user roles in the application. This is typically reserved for administrator roles.
+The properties are a `( Key: value )` list. Every property is optional, and so is the list: `CREATE USER ROLE Guest;` creates a role with no module roles. A property left out gets Mendix's default on a new role, and keeps its stored value under `CREATE OR MODIFY`. `CREATE OR MODIFY` adds the listed module roles to the ones the role already has; use `ALTER USER ROLE … DROP MODULE ROLES` to take one away.
+
+The positional form `CREATE USER ROLE Name (module.Role, ...) [MANAGE ALL ROLES]` is deprecated (MDL-DEPR710). It still parses, and `mxcli fmt --upgrade` rewrites it.
 
 ## Parameters
 
 `Name`
 :   The name of the user role. Not module-qualified. Must be unique among all user roles in the project.
 
-`module.Role [, ...]`
-:   A comma-separated list of module roles to include. Each module role is specified as a qualified name (`Module.RoleName`). The module roles must already exist.
+`ModuleRoles`
+:   The module roles the user role includes, each a qualified name (`Module.RoleName`). The module roles must already exist.
+
+`Description`
+:   The role's description, as Studio Pro shows it.
+
+`ManageAllRoles`
+:   When `true`, users with this role can manage (assign/unassign) all user roles in the application. Typically reserved for administrator roles.
+
+`ManageableRoles`
+:   The user roles users with this role can manage, when `ManageAllRoles` is not `true`.
+
+`ManageUsersWithoutRoles`
+:   When `true`, users with this role can also manage users that have no role.
 
-`MANAGE ALL ROLES`
-:   Optional. When specified, users with this role can manage (assign/unassign) all user roles in the application.
+`CheckSecurity`
+:   Studio Pro's "Check security" setting for the role.
 
 ## Examples
 
 Create an administrator role with management privileges:
 
 ```sql
-CREATE USER ROLE AppAdmin (Shop.Admin, System.Administrator) MANAGE ALL ROLES;
+CREATE USER ROLE AppAdmin ( ModuleRoles: (Shop.Admin, System.Administrator), ManageAllRoles: true );
 ```
 
 Create a regular user role:
 
 ```sql
-CREATE USER ROLE AppUser (Shop.User, Notifications.Viewer);
+CREATE USER ROLE AppUser ( ModuleRoles: (Shop.User, Notifications.Viewer) );
 ```
 
-Create a role that spans multiple modules:
+Create a role that spans multiple modules, with a description:
 
 ```sql
 CREATE USER ROLE SalesManager (
-    Sales.Manager,
-    Inventory.Viewer,
-    Reports.User,
-    Administration.User
+    ModuleRoles: (Sales.Manager, Inventory.Viewer, Reports.User, Administration.User),
+    Description: 'Runs the sales team',
+    ManageableRoles: (SalesRep),
+    CheckSecurity: true
 );
 ```
 
diff --git a/docs-site/src/tutorial/create-page.md b/docs-site/src/tutorial/create-page.md
index 706f26a98f..2a43f585c8 100644
--- a/docs-site/src/tutorial/create-page.md
+++ b/docs-site/src/tutorial/create-page.md
@@ -74,7 +74,7 @@ Edit pages use a **DataView** to display and edit a single object. The object is
 ```sql
 CREATE PAGE MyModule.Product_Edit
 (
-    Params: { $Product: MyModule.Product },
+    Params: ( $Product: MyModule.Product ),
     Title: 'Edit Product',
     Layout: Atlas_Core.PopupLayout
 )
@@ -96,7 +96,7 @@ Key differences from the overview page:
 
 | Part | Meaning |
 |------|---------|
-| `Params: { $Product: MyModule.Product }` | The page expects a `Product` object to be passed when opened |
+| `Params: ( $Product: MyModule.Product )` | The page expects a `Product` object to be passed when opened |
 | `Layout: Atlas_Core.PopupLayout` | Uses a popup/dialog layout instead of a full page |
 | `DATAVIEW dvProduct (DataSource: $Product)` | Binds to the page parameter |
 | `TEXTBOX`, `CHECKBOX` | Input widgets bound to entity attributes |
diff --git a/docs-site/src/tutorial/describe-search.md b/docs-site/src/tutorial/describe-search.md
index 28ac6c3915..a785fa2279 100644
--- a/docs-site/src/tutorial/describe-search.md
+++ b/docs-site/src/tutorial/describe-search.md
@@ -82,7 +82,7 @@ Example output:
 ```sql
 CREATE PAGE MyFirstModule.Customer_Edit
 (
-  Params: { $Customer: MyFirstModule.Customer },
+  Params: ( $Customer: MyFirstModule.Customer ),
   Title: 'Edit Customer',
   Layout: Atlas_Core.PopupLayout
 )
diff --git a/docs/01-project/CASE_STUDY_MxGraphStudioDemo.md b/docs/01-project/CASE_STUDY_MxGraphStudioDemo.md
index 70a58eca30..5252d45b6f 100644
--- a/docs/01-project/CASE_STUDY_MxGraphStudioDemo.md
+++ b/docs/01-project/CASE_STUDY_MxGraphStudioDemo.md
@@ -61,7 +61,7 @@ navigation: Responsive -> Main.Home_Web -> buttons to OdataPlm pages
 | ComboBox | `combobox` | Supported |
 | Navigation profiles | `create or replace navigation` | Supported |
 | Constants | `create constant` | Supported |
-| Page parameters | `params: { $Var: entity }` | Supported |
+| Page parameters | `params: ( $Var: entity )` | Supported |
 | Show page actions | `action: show_page Module.Page` | Supported |
 | Save/Cancel actions | `action: save_changes / cancel_changes` | Supported |
 | Consumed OData clients | `create consumed odata service` | Supported |
@@ -346,7 +346,7 @@ create page OdataPlm.Customer_Overview
 
 ```sql
 create page OdataPlm.Customer_NewEdit
-(title: 'Edit Customer', layout: Atlas_Core.PopupLayout, params: { $Customer: OdataPlm.Customer })
+(title: 'Edit Customer', layout: Atlas_Core.PopupLayout, params: ( $Customer: OdataPlm.Customer ))
 {
   layoutgrid layoutGrid1 {
     row row1 {
@@ -421,7 +421,7 @@ create page OdataPlm.Address_Overview
 
 ```sql
 create page OdataPlm.Address_NewEdit
-(title: 'Edit Address', layout: Atlas_Core.PopupLayout, params: { $Address: OdataPlm.Address })
+(title: 'Edit Address', layout: Atlas_Core.PopupLayout, params: ( $Address: OdataPlm.Address ))
 {
   layoutgrid layoutGrid1 {
     row row1 {
@@ -521,9 +521,9 @@ create page Main.Home_Web
 ```sql
 create or replace navigation Responsive
   home page Main.Home_Web
-  menu (
-    menu item 'Home' page Main.Home_Web;
-  )
+  {
+    menu item 'Home' ( OnClick: show page Main.Home_Web )
+  }
 ;
 ```
 
diff --git a/docs/01-project/MDL_QUICK_REFERENCE.md b/docs/01-project/MDL_QUICK_REFERENCE.md
index 3ccdf2301b..bf6bc6fd52 100644
--- a/docs/01-project/MDL_QUICK_REFERENCE.md
+++ b/docs/01-project/MDL_QUICK_REFERENCE.md
@@ -114,7 +114,7 @@ Modifies an existing entity without full replacement.
 | Rename attribute | `alter entity Module.Name rename attribute OldName to NewName;` | Also rewrites stored references (microflow members, page widgets, validation/access rules) and XPath constraints. Microflow expressions are free text and are **not** rewritten |
 | Add index | `alter entity Module.Name add index [if not exists] [name] [on] (Col1 [asc\|desc], ...);` | `on` is optional (SQL-like). **Without `if not exists`, re-running is an error** — a second identical index fails the build with CE0072 |
 | Document an association | `/** What it links. */`<br>`create association Mod.C_P from Mod.C to Mod.P;` | Documentation is a doc comment, as on every document. `... comment 'What it links.'` still parses as a deprecated alias (`MDL-DEPR100`, also on constants, JSON structures and image collections); the doc comment wins when both are present |
-| Create if absent | `create entity if not exists Module.Name (...);`<br>`create association if not exists Module.Assoc from ... to ...;` | Skips when it already exists, leaving the stored definition untouched. Unlike `create or modify`, which rebuilds the element from the statement and drops any attribute the statement omits — `mxcli check … -p app.mpr --references` warns about that as **MDL087**, naming the members the script removes without restating them |
+| Create if absent | `create entity if not exists Module.Name (...);`<br>`create association if not exists Module.Assoc from ... to ...;` | Every `create` that names one element takes the same guard, after the kind's keywords (`create page if not exists M.P …`, `create module if not exists M;`) — see `mxcli syntax create-if-not-exists`. Skips when it already exists, leaving the stored definition untouched. Unlike `create or modify`, which rebuilds the element from the statement and drops any attribute the statement omits — `mxcli check … -p app.mpr --references` warns about that as **MDL087**, naming the members the script removes without restating them |
 | Add index (SQL form) | `create index IdxName on Module.Name (Col1 [asc\|desc], ...);` | Same effect as `alter entity … add index`. The index name is accepted and not stored — a Mendix index is identified by its columns — so `check` warns (MDL-IDX01); prefer `alter entity … add index (…)` |
 | Drop index | `alter entity Module.Name drop index [if exists] (Col1 [asc\|desc], ...);` | Selected by its columns — a Mendix index stores no name, so the columns are its identity, and they are what `describe entity` prints. The legacy positional form `drop index idx1` still works but shifts when an earlier index is dropped |
 | Add event handler | `alter entity Module.Name add event handler on before commit call Mod.MF($currentObject) [raise error];` | `($currentObject)` or `()`, RAISE ERROR only on BEFORE |
@@ -126,9 +126,10 @@ Modifies an existing entity without full replacement.
 | Add attribute to every entity | `alter entities [in Module] add attribute [if not exists] attr: type [, ...] [where persistent\|non-persistent];` | The bulk form — one statement instead of one per entity. **ADD ATTRIBUTE only**: drop/rename aimed at a set are destructive by a typo. A **view** entity matches neither persistence filter. **Without `in`**, the sweep skips System and every Marketplace module (and says which) — an upgrade replaces those and would take the attribute with it |
 
 > **Re-running domain scripts.** `IF NOT EXISTS` / `IF EXISTS` make an individual
-> create/add/drop a no-op when already applied — accepted on `create entity`,
-> `create association`, `add attribute`, `add index`, `add event handler` and
-> their drops. A script built from guarded statements re-runs to a byte-identical
+> create/add/drop a no-op when already applied — accepted on every `create` that
+> names one element (entity, association, microflow, page, enumeration, module,
+> role, …), on `add attribute`, `add index`, `add event handler`, and on their
+> drops. A script built from guarded statements re-runs to a byte-identical
 > project.
 >
 > Prefer them to `CREATE OR MODIFY`, which is not the same thing: `or modify`
@@ -569,7 +570,8 @@ it is for pages.
 | Close page | `close page;` | |
 | Download file | `download file $FileDocument [show in browser];` | Streams a `System.FileDocument` |
 | Show message | `show message 'text' [type Information\|Warning\|Error] [with ({1} = $a, {2} = $b)] [blocking];` | `blocking` halts the client until the user dismisses it — Studio Pro's checkbox. It goes after the `with` list and before `on error`. `with ({1} = $a, {2} = $b)` is the deprecated spelling of the list (MDL-DEPR009). Without it, a describe → exec round trip turned a blocking message into a non-blocking one (16 microflows measured) |
-| Database connection credentials | `connection string @Mod.Const`, `username @Mod.Const`, `password @Mod.Const` | Constant **references** only. A literal writes an unopenable project — MDL058 |
+| Database connection | `create database connection Mod.Db ( Type: 'PostgreSQL', ConnectionString: @Mod.Url, Username: @Mod.User, Password: @Mod.Pass ) { query Q ( Sql: $$…$$, Parameters: ( p: Integer default '0' ), Returns: Mod.E, Map: ( Attr = column ) ) }` | Properties in `( )`, queries as children in `{ }` (R2). The clause form with `begin … end` still parses and warns (MDL-DEPR127) |
+| Database connection credentials | `ConnectionString: @Mod.Const`, `Username: @Mod.Const`, `Password: @Mod.Const` | Constant **references** only. A literal writes an unopenable project — MDL058 |
 | Synchronize (nanoflow only) | `synchronize all;` / `synchronize unsynchronized;` / `synchronize $Obj, $List;` | Offline sync. `unsynchronized` needs Mendix 9.4+. In a microflow this is MDL057 / CE0009 |
 | Validation | `validation feedback $entity/attribute message 'message {1}' [with ({1} = $a)];` | Requires attribute path + MESSAGE |
 | Log | `log [info\|warning\|error] [node 'name'] 'message';` | Level `info` and node `'Application'` are the defaults; `describe` leaves them out |
@@ -581,6 +583,7 @@ it is for pages.
 | Unknown annotation | — | **MDL059**. An annotation that parses and does nothing loses whatever it was meant to express, so a name the target does not read is refused — on a statement *and* before a `create`. Covers a typo (`@applyentityacces`), an annotation on a document kind that reads none (`@excluded` on a queue), and an activity annotation written at document level. The message names what that document does accept |
 | Parameter position | `@position(x, y)` before a parameter, **inside** the `( … )` list | The only annotation a parameter takes. Omit it and parameters form a row at 200;53, 300;53, …; a parameter off that row is treated as hand-placed, survives a rewrite, and is emitted by DESCRIBE (#993) |
 | Start event | `@start(x, y)` | Canvas position of the start, on the **first** statement. Omit it and the start is placed one spacing unit left of the first activity and MOVES with it on a rewrite; a start that is not at that derived spot is treated as hand-placed, survives a rewrite, and is emitted by DESCRIBE (#951) |
+| Flow anchors | `@anchor(from: bottom, to: top)`; on an `if` also `true: (from: …, to: …)`, `false: (…)` | The side each end of a flow attaches to: `to` = the flow arriving, `from` = the flow leaving. On an `if`, `from` is the flow out of its closing **merge**, which has no statement of its own (#767) |
 | Caption | `@caption 'text'` | Custom caption (before activity). A decision with no `@caption` is captioned with its condition, so `describe` prints none for one whose caption is its condition |
 | Color | `@color Green` | Background color (before activity) |
 | Annotation | `@annotation 'text'` | Visual note attached to next activity. **Repeatable** — an activity can carry several, and each is its own note |
@@ -669,7 +672,7 @@ Nested folders use `/` separator: `'Parent/Child/Grandchild'`. Missing folders a
 | Describe security matrix | `describe security matrix [in module];` | Full access overview |
 | Create module role | `create [or modify] module role Mod.Role [description 'text'];` | `or modify` updates an existing role instead of failing, so a security script can be re-run |
 | Drop module role | `drop module role Mod.Role;` | |
-| Create user role | `create user role Name (Mod.Role, ...) [manage all roles];` | Aggregates module roles |
+| Create user role | `create user role Name ( ModuleRoles: (Mod.Role, ...), Description: '...', ManageAllRoles: true, CheckSecurity: true );` | Aggregates module roles; every property optional, `create user role Name;` has none |
 | Alter user role | `alter user role Name add\|drop module roles (Mod.Role, ...);` | |
 | Drop user role | `drop user role [if exists] Name;` | `if exists` makes a cleanup script re-runnable |
 | Grant microflow access | `grant execute on microflow Mod.MF to Mod.Role, ...;` | |
@@ -812,70 +815,53 @@ end workflow;
 
 ## ALTER WORKFLOW
 
-Modify an existing workflow's properties, activities, outcomes, paths, conditions, and boundary events without full replacement.
+Modify an existing workflow's properties, activities, outcomes, paths, conditions, and boundary events without full replacement. It is the generic alter (the same shape as `alter page`): operations in `{ }`, properties in `set ( Key: value )`, fragments written exactly as in `create workflow`.
 
 | Operation | Syntax | Notes |
 |-----------|--------|-------|
-| Set display name | `set display 'name'` | Workflow-level display name |
-| Set description | `set description 'text'` | Workflow-level description |
-| Set export level | `set export level api\|Hidden` | Visibility level |
-| Set due date | `set due date <expr>` | Workflow-level due date expression |
-| Set overview page | `set overview page Module.Page` | Workflow overview page |
-| Set parameter | `set parameter $Var: Module.Entity` | Workflow context parameter |
-| Set activity page | `set activity name page Module.Page` | Change user task page |
-| Set activity description | `set activity name description 'text'` | Activity description |
-| Set activity targeting | `set activity name targeting [users\|groups] microflow Module.MF` | Target user/group assignment |
-| Set activity XPath | `set activity name targeting xpath [<xpath>]` | XPath targeting, in brackets; the quoted `xpath '[…]'` warns MDL-DEPR031 |
-| Set activity due date | `set activity name due date <expr>` | Activity-level due date |
-| Insert activity | `insert after name call microflow Module.MF` | Insert after named activity |
-| Drop activity | `drop activity name` | Remove activity by name |
-| Replace activity | `replace activity name with activity` | Replace activity in-place |
-| Insert outcome | `insert outcome 'name' on activity { body }` | Add outcome to user task/decision |
-| Drop outcome | `drop outcome 'name' on activity` | Remove outcome |
-| Insert path | `insert path on activity { body }` | Add path to parallel split |
-| Drop path | `drop path 'name' on activity` | Remove parallel split path |
-| Insert condition | `insert condition 'name' on activity { body }` | Add decision branch |
-| Drop condition | `drop condition 'name' on activity` | Remove decision branch |
-| Insert boundary event | `insert boundary event on activity interrupting timer [<expr>] { body }` | Add boundary timer |
-| Drop boundary event | `drop boundary event on activity` | Remove boundary event |
-
-**Activity references** can be identifiers (`ReviewOrder`) or string literals (`'Review the order'`). Use `@N` suffix for positional disambiguation when multiple activities share a name (e.g., `ACT_Process@2`).
-
-**Multiple actions** can be combined in a single ALTER statement.
+| Set workflow properties | `set (Display: 'name', Description: 'text', ExportLevel: API, DueDate: <expr>, OverviewPage: Module.Page, Parameter: $WorkflowContext: Module.Entity);` | Any subset of the keys |
+| Set activity properties | `set (Page: Module.Page, Description: 'text', DueDate: <expr>) on activity;` | User task page, description, due date |
+| Set activity targeting | `set (Targeting: microflow Module.MF) on activity;` / `set (Targeting: xpath [<xpath>]) on activity;` | XPath in brackets; the quoted `xpath '[…]'` warns MDL-DEPR031 |
+| Insert activities | `insert after activity { … }` / `insert before activity { … }` | One or more activities, as in `create workflow` |
+| Replace activity | `replace activity with { … }` | Replace in place |
+| Drop activity | `drop activity;` | Several targets separated by commas |
+| Insert user-task outcome | `insert into activity { outcomes 'name' { body } }` | User task only |
+| Insert decision outcome | `insert into activity { outcomes 'Module.Enum.Value' -> { body } }` (or `true`, `false`, `default`) | Decision or call microflow |
+| Insert path | `insert into activity { path { body } }` | Parallel split; `path n` must be the next number |
+| Insert boundary event | `insert into activity { boundary event interrupting timer <expr> { body } }` | Boundary timer |
+| Drop outcome | `drop activity outcome 'name';` / `drop activity outcome true;` | `true`, `false`, `default` for a decision's Boolean or default outcome |
+| Drop path | `drop activity path 2;` | Parallel split path by number |
+| Drop boundary event | `drop activity boundary event;` | Removes the activity's first boundary event |
+
+**Activity references** are names (`ReviewOrder`) or captions in quotes (`'Review the order'`). Add `@n` to choose one of several matches (`ACT_Process@2`); without it a name wins over a caption that repeats it, and an ambiguous reference is refused with the matches listed. Every target is resolved before anything changes.
+
+The old one-action-per-clause form (`alter workflow M.W set display 'x' insert outcome 'N' on X { };`) still parses and warns MDL-DEPR140–149; `mxcli fmt --upgrade` rewrites it.
 
 **Example:**
 ```sql
--- Set workflow-level properties
-alter workflow Module.OrderApproval
-  set display 'Updated Order Approval'
-  set description 'Updated description';
-
--- Modify an activity
-alter workflow Module.OrderApproval
-  set activity ReviewOrder page Module.AlternatePage;
-
--- Insert and drop activities
-alter workflow Module.OrderApproval
-  insert after ReviewOrder call microflow Module.ACT_Escalate;
-alter workflow Module.OrderApproval
-  drop activity ACT_Notify@1;
-
--- Manage outcomes on a user task
-alter workflow Module.OrderApproval
-  insert outcome 'Escalate' on ReviewOrder {
-    call microflow Module.ACT_Review;
-  };
-alter workflow Module.OrderApproval
-  drop outcome 'Hold' on ReviewOrder;
-
--- Boundary events
-alter workflow Module.OrderApproval
-  insert boundary event on ReviewOrder interrupting timer addHours([%CurrentDateTime%], 2) {
-    call microflow Module.ACT_BoundaryHandler;
-    jump to ReviewOrder;
-  };
-alter workflow Module.OrderApproval
-  drop boundary event on ReviewOrder;
+alter workflow Module.OrderApproval {
+  -- workflow-level properties
+  set (Display: 'Updated Order Approval', Description: 'Updated description');
+
+  -- an activity's properties
+  set (Page: Module.AlternatePage) on ReviewOrder;
+
+  -- insert and drop activities
+  insert after ReviewOrder { call microflow Module.ACT_Escalate; }
+  drop ACT_Notify@1;
+
+  -- outcomes on a user task
+  insert into ReviewOrder { outcomes 'Escalate' { call microflow Module.ACT_Review; } }
+  drop ReviewOrder outcome 'Hold';
+
+  -- boundary events
+  insert into ReviewOrder {
+    boundary event interrupting timer addHours([%CurrentDateTime%], 2) {
+      call microflow Module.ACT_BoundaryHandler;
+      jump to ReviewOrder;
+    }
+  }
+};
 ```
 
 **Tip:** Run `describe workflow Module.Name` first to see activity names.
@@ -904,6 +890,12 @@ alter workflow Module.OrderApproval
 | Profile kinds | `Responsive` · `Phone` · `Tablet` · `ResponsiveOffline` · `PhoneOffline` · `TabletOffline` | A closed set. An invented name (`Mobile`) is an error, not a new profile: the runtime routes on User-Agent to Mendix's own kinds. Native profiles are a different document type and are not creatable |
 | Offline profiles | `create or replace navigation TabletOffline ...;` | Same properties as the online twin, but every page the profile can reach may bind an attribute across **at most one** association hop (**CE6206**). Creating one reports the documents that already exceed that |
 
+Menu items are the profile's children, in `{ }` after its clauses, with no `;`
+between them: `menu item 'Caption' ( OnClick: show page M.P, Icon: … )`, where
+`OnClick` is `show page M.P`, `call microflow M.F` or `sign out`, and a sub-menu
+is `menu 'Caption' [( Icon: … )] { … }`. The old `menu ( menu item 'X' page M.P; )`
+spelling still parses and warns (MDL-DEPR121, MDL-DEPR122).
+
 **Navigation Example:**
 ```sql
 create or replace navigation Responsive
@@ -911,12 +903,12 @@ create or replace navigation Responsive
   home page MyModule.AdminHome for Administrator
   login page Administration.Login
   not found page MyModule.Custom404
-  menu (
-    menu item 'Home' page MyModule.Home_Web icon Atlas_Core.Atlas.home;
-    menu 'Admin' icon Atlas_Core.Atlas."align-center" (
-      menu item 'Users' page Administration.Account_Overview;
-    );
-  );
+  {
+    menu item 'Home' ( OnClick: show page MyModule.Home_Web, Icon: Atlas_Core.Atlas.home )
+    menu 'Admin' ( Icon: Atlas_Core.Atlas."align-center" ) {
+      menu item 'Users' ( OnClick: show page Administration.Account_Overview )
+    }
+  };
 ```
 
 **An item with no icon is reported (MDL077, a warning).** The navigation sidebar
@@ -924,10 +916,10 @@ collapses to an icon rail, and that is the state most users leave it in: a
 collapsed item shows its icon, and one without falls back to the first few
 characters of its caption — rarely enough to tell `Orders` from `Order lines`.
 The menu still builds and `mx check` passes, so the only symptom is in a browser.
-The rule covers every item at every depth, in both `create navigation`'s `menu`
-block and `create menu`, and needs no project.
+The rule covers every item at every depth, in both `create navigation`'s `{ }`
+menu block and `create menu`, and needs no project.
 
-`icon` is optional and is a **qualified name** into an **icon collection** —
+`Icon:` is optional and is a **qualified name** into an **icon collection** —
 `Atlas_Core.Atlas`, `Atlas_Core.Atlas_Filled`, `Atlas_Core.Atlas_Styling`, or one
 of your own — written like any other model reference. Hyphenated Atlas names
 (`align-center`) are double-quoted, the same way a keyword-colliding name is:
@@ -942,9 +934,9 @@ name at all:
 
 | form | element | holds |
 |------|---------|-------|
-| `icon Atlas_Core.Atlas.home` | `Forms$IconCollectionIcon` | a name in an icon collection |
-| `icon glyph 57377` | `Forms$GlyphIcon` | a numeric character code |
-| `icon image MyModule.Images.logo` | `Forms$ImageIcon` | a name in an image collection |
+| `Icon: Atlas_Core.Atlas.home` | `Forms$IconCollectionIcon` | a name in an icon collection |
+| `Icon: glyph 57377` | `Forms$GlyphIcon` | a numeric character code |
+| `Icon: image MyModule.Images.logo` | `Forms$ImageIcon` | a name in an image collection |
 
 **Browse the glyph codes with `show glyphs`.** A glyph is a character code in a
 font, not a document in the project, so there is nothing to scope with `IN` and
@@ -1124,8 +1116,8 @@ property's own `<Name>Params` companion:
 ```sql
 image cardImage (
   ImageType: imageUrl,
-  ImageUrl: '{1}',        ImageUrlParams: [{1} = PictureUrl],
-  AlternativeText: '{1}', AlternativeTextParams: [{1} = Name]
+  ImageUrl: '{1}',        ImageUrlParams: ({1} = PictureUrl),
+  AlternativeText: '{1}', AlternativeTextParams: ({1} = Name)
 );
 ```
 
@@ -1168,7 +1160,7 @@ create consumed rest service Module.Api (
     path: '/items/{id}',
     parameters: ($id: string),
     query: ($filter: string),
-    headers: ('Accept' = 'application/json'),
+    headers: ('Accept': 'application/json'),
     timeout: 30,
     response: json as $Result
   )
@@ -1176,7 +1168,7 @@ create consumed rest service Module.Api (
   operation CreateItem (
     method: post,
     path: '/items',
-    headers: ('Content-Type' = 'application/json'),
+    headers: ('Content-Type': 'application/json'),
     body: mapping Module.ItemRequest {
       name = Name,
       price = Price,
@@ -1453,7 +1445,10 @@ MDL uses explicit property declarations for pages:
 | Pop-up close button | `PopupCloseAction: <widgetName>` | `(Layout: Atlas_Core.PopupLayout, PopupCloseAction: cancelButton1)` — names a widget on this page. Not carried from the stored document on a rewrite: the statement rebuilds the widget tree, so a carried name could dangle |
 | DataView read-only style | `ReadOnlyStyle: Inherit\|Control\|Text` | `dataview dv (datasource: $O, ReadOnlyStyle: Text)` — a DataView's own, distinct from a checkbox's. **Control** is Studio Pro's default here, not Inherit |
 | Page CSS class / style | `Class: 'css-class', Style: 'css: rule'` | `(Title: 'Home', Class: 'container-fluid bg-light', Style: 'min-height: 100vh')` — the page's Appearance |
-| Page variables | `variables: { $name: type = 'expr' }` | `variables: { $show: boolean = 'true' }` |
+| Page variables | `variables: ( $name: type = 'expr' )` | `variables: ( $show: boolean = 'true' )` |
+| Page parameters | `params: ( $name: type, … )` | `params: ( $Order: Shop.Order )` — a map, in `( )`; `params: { … }` is the deprecated spelling (MDL-DEPR123) |
+| Snippet call arguments | `snippetcall s (snippet: M.S, params: (Param = $var))` | Bound as at every call site, `Param = value` (R4). `params: {$Param: $var}` is deprecated (MDL-DEPR126) |
+| Text template parameters | `contentparams: ({1} = expr, …)` | Also `captionparams:` and a pluggable widget's `<Name>Params:`. `[…]` is deprecated (MDL-DEPR124) |
 | Repeated widget entries | `<container> <name> ( … )` **in the widget body** | A repeatable property (FileUploader `allowedFileFormats`, HTML Element `attributes`, a chart's `series`) is a block, never a property value. `attributes: [(attributeName: 'x')]` is **MDL-WIDGET27** — it used to check clean, exec, and vanish from storage. `describe widget type <name> -p app.mpr` lists the container keywords |
 | Data grid 2 column filter | `column (attribute: A) { textfilter f }` | **Inside the column's braces.** `column (…) filter { … }` is the GALLERY form — the grammar reads it as a column with no body plus a sibling `filter` widget, which the grid has nowhere to put; it used to be dropped on write and is now **MDL-WIDGET30**. A grid-wide filter bar is `controlbar`; a gallery spells that same slot `filter`. Match the filter to the column's type (String → `textfilter`, number → `numberfilter`, DateTime → `datefilter`, Enumeration **and Boolean** → `dropdownfilter` — the drop-down filter's own attribute types are Enum and Boolean, and a Boolean column filters Yes/No). A column may carry a **custom-content widget AND a filter**: `content` and `filter` are separate slots, so `column (attribute: IsActive) { checkbox cb (Editable: Never, ReadOnlyStyle: Control) dropdownfilter ddf }` renders checkbox cells and still filters |
 | Widget with nowhere to go | any widget in a pluggable widget's body | A child matching no container, slot or `template` catch-all is **MDL-WIDGET30** at check time and refused by `exec`. `describe widget type <name> -p app.mpr` lists what the parent declares. Needs the parent's definition, so it is silent without `-p` |
@@ -1480,7 +1475,7 @@ MDL uses explicit property declarations for pages:
 | CSS class | `class: 'classes'` | `container c (class: 'card mx-spacing-top-large')` |
 | Inline style | `style: 'css'` | `container c (style: 'padding: 16px;')` |
 | Dynamic classes | `dynamicclasses: 'expr'` | `container c (dynamicclasses: if $currentObject/IsActive then 'is-active' else '')` — runtime-computed classes; stacks on `class` |
-| Design properties | `designproperties: [...]` | `container c (designproperties: ['Spacing top': 'Large', 'full width': on])` |
+| Design properties | `designproperties: (...)` | `container c (designproperties: ('Spacing top': 'Large', 'full width': on))` — a map, in `( )`; a compound one nests: `('Spacing': ('margin-top': 'L'))`. `[…]` is deprecated (MDL-DEPR125) |
 | Width (pixels) | `width: integer` | `image img (width: 200)` |
 | Height (pixels) | `height: integer` | `image img (height: 150)` |
 | Page size | `PageSize: integer` | `datagrid dg (PageSize: 25)` |
@@ -1498,7 +1493,7 @@ MDL uses explicit property declarations for pages:
 | Drop layout | `drop layout [if exists] Module.Name;` | Pages still bound to it are named in a warning and the drop proceeds; left dropped they fail **CE1613**, which names the *page* |
 | Declare a placeholder | `placeholder Main` | **No body.** Exactly one must be named `Main` — mxbuild enforces it (**CE0848**/**CE0849**), and names must be unique (**CE0495**). `placeholder X { … }` is the page-side form and declares nothing (MDL083) |
 | Alter layout | `alter layout Module.Name { <alter-page operations> };` | Edits the stored document, so widgets MDL cannot spell survive. Refused for a Marketplace target |
-| Set a design property | `alter page Module.Page { set ('Row size': 'Small') on lvOrders; };` | An Atlas design property of that widget's **type** — quoted, case-sensitive; `show design properties for <type>` lists them. `on`/`off` for a toggle, where `off` removes the entry. Same document `alter styling` writes. A **multi-select** (`Hide on`) or **compound** (`Spacing`) property needs the inline `DesignProperties: [...]` form, since a `set` assignment carries one value |
+| Set a design property | `alter page Module.Page { set ('Row size': 'Small') on lvOrders; };` | An Atlas design property of that widget's **type** — quoted, case-sensitive; `show design properties for <type>` lists them. `on`/`off` for a toggle, where `off` removes the entry. Same document `alter styling` writes. A **multi-select** (`Hide on`) or **compound** (`Spacing`) property needs the inline `DesignProperties: (...)` form, since a `set` assignment carries one value |
 | Restyle one widget | `alter styling on page Module.Page widget w set (Class: 'card', 'Full width': on);` | `set Class = …, 'P' = on` (no parentheses, `=`) warns MDL-DEPR062 |
 | Repoint one page | `alter page Module.Page { set Layout = Module.Layout [map (Old as New, …)]; };` | Rewrites the layout reference **and** every placeholder binding |
 | Set a design property on every widget of a type | `alter pages [in <module>] set 'Compact' = on, 'Striped' = on where widgettype = datagrid [dry run];` | The house-style sweep. `widgettype` takes the **MDL keyword**, which resolves to exactly one widget id — a `like '%datagrid%'` predicate also matches the data grid's *filter* widgets. Never a widget **name**: a name is unique only within its page. `dry run` previews against a discardable copy. A sweep that matches widgets and writes none of them exits non-zero |
@@ -1524,10 +1519,10 @@ MDL uses explicit property declarations for pages:
 | Describe snippet | `describe snippet Module.Name;` | Round-trippable MDL output |
 | List building blocks | `show building blocks [in module];` | Read-only; cannot be authored via MDL |
 | Describe building block | `describe building block Module.Name;` | Informational (header comment + widget tree), not a `create` statement |
-| Create menu | `create [or modify] menu Module.Name [folder 'path'] ( <items> );` | Standalone `Menus$MenuDocument`. Full replacement: the item list is the document's complete contents |
+| Create menu | `create [or modify] menu Module.Name [folder 'path'] { <items> };` | Standalone `Menus$MenuDocument`. Full replacement: the item list is the document's complete contents |
 | Describe menu | `describe menu Module.Name;` | Round-trippable MDL. Not the navigation-profile menu — see `show navigation menu` |
 | Drop menu | `drop menu [if exists] Module.Name;` | |
-| Create menu | `create [or modify] menu Module.Name [folder 'path'] ( <items> );` | Standalone `Menus$MenuDocument`. Full replacement: the item list is the document's complete contents |
+| Create menu | `create [or modify] menu Module.Name [folder 'path'] { <items> };` | Standalone `Menus$MenuDocument`. Full replacement: the item list is the document's complete contents |
 | Describe menu | `describe menu Module.Name;` | Round-trippable MDL. Not the navigation-profile menu — see `show navigation menu` |
 | Drop menu | `drop menu [if exists] Module.Name;` | |
 
@@ -1553,7 +1548,7 @@ MDL uses explicit property declarations for pages:
 ```sql
 create page MyModule.Customer_Edit
 (
-  params: { $Customer: MyModule.Customer },
+  params: ( $Customer: MyModule.Customer ),
   title: 'Edit Customer',
   layout: Atlas_Core.PopupLayout
 )
@@ -1600,13 +1595,13 @@ own body already renders objects no template matches.
 
 ```sql
 listview vehicleListView (DataSource: database from Pages.Vehicle) {
-  dynamictext defaultVehicle (Content: '{1}', ContentParams: [{1} = Brand])
+  dynamictext defaultVehicle (Content: '{1}', ContentParams: ({1} = Brand))
 
   template for Pages.Bus {
-    dynamictext busLabel (Content: 'Bus, capacity {1}', ContentParams: [{1} = PassengerCapacity])
+    dynamictext busLabel (Content: 'Bus, capacity {1}', ContentParams: ({1} = PassengerCapacity))
   }
   template for Pages.Truck {
-    dynamictext truckLabel (Content: 'Truck, max load {1} kg', ContentParams: [{1} = MaxLoadKg])
+    dynamictext truckLabel (Content: 'Truck, max load {1} kg', ContentParams: ({1} = MaxLoadKg))
   }
 }
 ```
@@ -1653,8 +1648,8 @@ A column cannot bind the association itself: `column c (attribute: Order_Custome
 
 **DynamicText parameter formatting** — append a `format (…)` block to a content parameter (the `format` keyword is required):
 ```sql
-dynamictext amt (content: '{1}', contentparams: [{1} = Amount format (decimalPrecision: 2, groupDigits: true)])
-dynamictext due (content: '{1}', contentparams: [{1} = DueOn  format (dateFormat: DateTime)])
+dynamictext amt (content: '{1}', contentparams: ({1} = Amount format (decimalPrecision: 2, groupDigits: true)))
+dynamictext due (content: '{1}', contentparams: ({1} = DueOn  format (dateFormat: DateTime)))
 ```
 Keys: `decimalPrecision` (int), `groupDigits` (bool), `dateFormat` (`Date`|`DateTime`|`Time`|`Custom`), `customDateFormat` (pattern, with `dateFormat: Custom`), `enumFormat` (`Text`|`Image`).
 
diff --git a/docs/03-development/LEGACY_ENGINE_KNOWN_ISSUES.md b/docs/03-development/LEGACY_ENGINE_KNOWN_ISSUES.md
index de0f7debac..8bd3b937bc 100644
--- a/docs/03-development/LEGACY_ENGINE_KNOWN_ISSUES.md
+++ b/docs/03-development/LEGACY_ENGINE_KNOWN_ISSUES.md
@@ -66,7 +66,7 @@ When a legacy issue is encountered:
 
 - **Symptom:** a widget binding that navigates an association to an attribute —
   a DataGrid2 column `attribute: Assoc/Attr`, or a `dynamictext`/`datagrid`
-  `contentparams: [{1} = Module.Assoc/Attr]` — is written by legacy as a flat
+  `contentparams: ({1} = Module.Assoc/Attr)` — is written by legacy as a flat
   attribute reference with no association step, so `mx check` fails with
   **CE1365** "Attribute 'Module.Dest.Attr' is not an attribute of entity
   'Module.Context'" (the destination attribute resolved against the context
diff --git a/docs/03-development/STRING_TEMPLATE_SYNTAX.md b/docs/03-development/STRING_TEMPLATE_SYNTAX.md
index c3e5a20282..465626e129 100644
--- a/docs/03-development/STRING_TEMPLATE_SYNTAX.md
+++ b/docs/03-development/STRING_TEMPLATE_SYNTAX.md
@@ -202,7 +202,7 @@ When referencing a page parameter's attribute (e.g., `$Product.Name` where `$Pro
 MDL:
   content: '$Product.Name'
   -- or explicit --
-  content: 'Product: {1}', contentparams: [$Product.Name]
+  content: 'Product: {1}', contentparams: ({1} = $Product.Name)
 
 BSON:
   {
diff --git a/docs/05-mdl-specification/01-language-reference.md b/docs/05-mdl-specification/01-language-reference.md
index 7a898a2c5e..4e5681a836 100644
--- a/docs/05-mdl-specification/01-language-reference.md
+++ b/docs/05-mdl-specification/01-language-reference.md
@@ -762,7 +762,7 @@ Creates a page with a widget tree.
 ```sql
 create [or replace] page <qualified-name>
 (
-  [params: { $Param: Module.Entity | type [, ...] },]
+  [params: ( $Param: Module.Entity | type [, ...] ),]
   title: '<title>',
   layout: <Module.LayoutName>
   [, folder: '<path>']
@@ -788,7 +788,7 @@ WIDGET_TYPE widgetName (Property: value, ...) [{ children }]
 ```sql
 create page MyModule.Customer_Edit
 (
-  params: { $Customer: MyModule.Customer },
+  params: ( $Customer: MyModule.Customer ),
   title: 'Edit Customer',
   layout: Atlas_Core.PopupLayout
 )
@@ -1226,26 +1226,30 @@ create or replace navigation <profile>
   [home page Module.AdminHome for AdminUserRole]
   [login page Module.LoginPage]
   [not found page Module.Custom404]
-  [menu (
-    menu item 'Label' page Module.Page;
-    menu 'Submenu' (
-      menu item 'Label' page Module.Page;
-    );
-  )]
+  [{
+    menu item 'Label' ( OnClick: show page Module.Page [, Icon: <icon>] )
+    menu 'Submenu' [( Icon: <icon> )] {
+      menu item 'Label' ( OnClick: call microflow Module.Flow )
+    }
+  }]
 ```
 
+Menu items are the profile's children, in `{ }` with no separator. `OnClick` is
+`show page`, `call microflow` or `sign out`. The old `menu ( menu item 'Label' page
+Module.Page; )` still parses and warns (MDL-DEPR121, MDL-DEPR122).
+
 **Example:**
 ```sql
 create or replace navigation Responsive
   home page MyModule.Home_Web
   home page MyModule.AdminHome for Administrator
   login page Administration.Login
-  menu (
-    menu item 'Home' page MyModule.Home_Web;
-    menu 'Admin' (
-      menu item 'Users' page Administration.Account_Overview;
-    );
-  );
+  {
+    menu item 'Home' ( OnClick: show page MyModule.Home_Web )
+    menu 'Admin' {
+      menu item 'Users' ( OnClick: show page Administration.Account_Overview )
+    }
+  };
 ```
 
 ---
diff --git a/docs/11-proposals/PROPOSAL_mdl_beta_syntax_freeze.md b/docs/11-proposals/PROPOSAL_mdl_beta_syntax_freeze.md
index d17f698abc..8c15617fa5 100644
--- a/docs/11-proposals/PROPOSAL_mdl_beta_syntax_freeze.md
+++ b/docs/11-proposals/PROPOSAL_mdl_beta_syntax_freeze.md
@@ -151,6 +151,7 @@ What would change:
 - `while` makes both `begin` and `end while` optional. Make both required, the same as `loop`.
 - The `split type` body becomes mandatory.
 - *Decided in ako/mxcli#754:* an `alter microflow` / `alter nanoflow` fragment is imperative content, so it is `begin … end`, not `{ … }`: `insert after $X begin … end;`, `replace <target> with begin … end;`. The fragment is written exactly as the body of `create microflow` is (ADR-0012). The operations around it are the alter's declarative children and stay in the alter's `{ }`. The brace fragment is a deprecated alias (MDL-DEPR074).
+- *Decided in ako/mxcli#754:* the remaining brackets. Menu items are `{ }` children with no separator, and an item's action and icon are its properties, `menu item 'X' ( OnClick: show page M.P, Icon: I )`; a navigation profile's items are its own `{ }` children after its clauses. The profile's clauses (`home page … for …`, `login page`, `sync ( … )`) stay clauses for now. A map's separator is the one R3/R4 gives its entries: `Params: ( $P: M.E )` and `DesignProperties: ( 'k': 'v' )` set properties with `:`, while text-template parameters `ContentParams: ({1} = e)` and a snippet call's arguments `Params: (P = $v)` bind values with `=`. A database connection is `( Type: '…', ConnectionString: @M.C, … ) { query Q ( Sql: …, Parameters: ( p: T [default '…' | null] ), Returns: M.E, Map: ( Attr = column ) ) }` — the column map binds an attribute like a mapping side. Old spellings: MDL-DEPR120–127.
 
 **Before** — properties in braces, children in parentheses, menu items separated by `;`, braces inside a microflow:
 
diff --git a/mdl-examples/bug-tests/1024-boundary-event-jump-to.mdl b/mdl-examples/bug-tests/1024-boundary-event-jump-to.mdl
index b58bb01991..a04b219e13 100644
--- a/mdl-examples/bug-tests/1024-boundary-event-jump-to.mdl
+++ b/mdl-examples/bug-tests/1024-boundary-event-jump-to.mdl
@@ -21,7 +21,7 @@ create module Probe;
 create persistent entity Probe.Ctx ( Code: string(50) );
 
 create page Probe."WF_TaskPage" (
-  params: { $Task: System.WorkflowUserTask },
+  params: ( $Task: System.WorkflowUserTask ),
   title: 'Task', layout: Atlas_Core.Atlas_Default
 ) {
   layoutgrid g { row r { column c (desktopwidth: 12) {
diff --git a/mdl-examples/bug-tests/1028-snippet-primitive-parameter.fail.mdl b/mdl-examples/bug-tests/1028-snippet-primitive-parameter.fail.mdl
index 761aa98a3e..290302d205 100644
--- a/mdl-examples/bug-tests/1028-snippet-primitive-parameter.fail.mdl
+++ b/mdl-examples/bug-tests/1028-snippet-primitive-parameter.fail.mdl
@@ -13,6 +13,6 @@
 
 create module F1028;
 
-create snippet F1028.SNIPPET_Label ( params: { $Label: string } ) {
+create snippet F1028.SNIPPET_Label ( params: ( $Label: string ) ) {
   dynamictext dt (content: $Label)
 }
diff --git a/mdl-examples/bug-tests/1028-snippet-primitive-parameter.mdl b/mdl-examples/bug-tests/1028-snippet-primitive-parameter.mdl
index 4a09f14a17..ee61ab1555 100644
--- a/mdl-examples/bug-tests/1028-snippet-primitive-parameter.mdl
+++ b/mdl-examples/bug-tests/1028-snippet-primitive-parameter.mdl
@@ -42,7 +42,7 @@ create persistent entity S1028.Order (Code: String(20), Label: String(100));
 -- The reported snippet, in the shape Mendix accepts: the value travels on an
 -- object. `create snippet S1028.SNIPPET_Label ( params: { $Label: string } )`
 -- is refused as MDL087 — see 1028-snippet-primitive-parameter.fail.mdl.
-create snippet S1028.SNIPPET_Label ( params: { $Order: S1028.Order } ) {
+create snippet S1028.SNIPPET_Label ( params: ( $Order: S1028.Order ) ) {
   layoutgrid gl { row rl { column cl (desktopwidth: autofill) {
     dataview dvLabel (datasource: $Order) {
       textbox tbLabel (attribute: Label, label: 'Label')
@@ -55,7 +55,7 @@ create snippet S1028.SNIPPET_Label ( params: { $Order: S1028.Order } ) {
 -- Pro's type is the single "Integer/Long"), so `describe` re-emits it as
 -- Integer — which is why this page is here rather than only in a unit test.
 create page S1028.PagePrimitives (
-  params: {
+  params: (
     $Order: S1028.Order,
     $Label: String,
     $Count: Long,
@@ -63,10 +63,10 @@ create page S1028.PagePrimitives (
     $Amount: Decimal,
     $Active: Boolean,
     $Due: DateTime
-  },
+  ),
   title: 'Primitives', layout: Atlas_Core.Atlas_Default
 ) {
   layoutgrid g { row r { column c (desktopwidth: 12) {
-    snippetcall scLabel (snippet: S1028.SNIPPET_Label, params: {Order: $Order})
+    snippetcall scLabel (snippet: S1028.SNIPPET_Label, params: (Order = $Order))
   } } }
 }
diff --git a/mdl-examples/bug-tests/1029-showpage-arg-with-context.mdl b/mdl-examples/bug-tests/1029-showpage-arg-with-context.mdl
index dd856a2ee6..079b8025e1 100644
--- a/mdl-examples/bug-tests/1029-showpage-arg-with-context.mdl
+++ b/mdl-examples/bug-tests/1029-showpage-arg-with-context.mdl
@@ -16,7 +16,7 @@ create persistent entity Probe1029Ok.Item (
 );
 
 create page Probe1029Ok.Detail (
-  params: { $Item: Probe1029Ok.Item },
+  params: ( $Item: Probe1029Ok.Item ),
   title: 'Detail',
   layout: Atlas_Core.Atlas_Default
 ) {
@@ -39,7 +39,7 @@ create page Probe1029Ok.Plain (
 -- Inside a data view: the argument names the context object, under either
 -- spelling. This is the documented form in create-page.md.
 create page Probe1029Ok.Ok (
-  params: { $SomeRef: Probe1029Ok.Item },
+  params: ( $SomeRef: Probe1029Ok.Item ),
   title: 'Ok',
   layout: Atlas_Core.Atlas_Default
 ) {
diff --git a/mdl-examples/bug-tests/1029-showpage-arg-without-context.fail.mdl b/mdl-examples/bug-tests/1029-showpage-arg-without-context.fail.mdl
index cf0b997ad2..82d90e4afa 100644
--- a/mdl-examples/bug-tests/1029-showpage-arg-without-context.fail.mdl
+++ b/mdl-examples/bug-tests/1029-showpage-arg-without-context.fail.mdl
@@ -24,7 +24,7 @@ create persistent entity Probe1029.Item (
 );
 
 create page Probe1029.Detail (
-  params: { $Item: Probe1029.Item },
+  params: ( $Item: Probe1029.Item ),
   title: 'Detail',
   layout: Atlas_Core.Atlas_Default
 ) {
@@ -34,7 +34,7 @@ create page Probe1029.Detail (
 };
 
 create page Probe1029.List (
-  params: { $SomeRef: Probe1029.Item },
+  params: ( $SomeRef: Probe1029.Item ),
   title: 'List',
   layout: Atlas_Core.Atlas_Default
 ) {
diff --git a/mdl-examples/bug-tests/1032-alter-page-set-database-datasource.mdl b/mdl-examples/bug-tests/1032-alter-page-set-database-datasource.mdl
index b05a7bebb5..6127b76c4d 100644
--- a/mdl-examples/bug-tests/1032-alter-page-set-database-datasource.mdl
+++ b/mdl-examples/bug-tests/1032-alter-page-set-database-datasource.mdl
@@ -49,7 +49,7 @@ begin
 end;
 
 create page P1032.CustomerPage (
-  params: { $Customer: P1032.Customer },
+  params: ( $Customer: P1032.Customer ),
   title: 'Customer',
   layout: Atlas_Core.Atlas_Default
 ) {
diff --git a/mdl-examples/bug-tests/1076-alter-page-selection-and-flow-scope.mdl b/mdl-examples/bug-tests/1076-alter-page-selection-and-flow-scope.mdl
index 731507270d..a3ee65c0e5 100644
--- a/mdl-examples/bug-tests/1076-alter-page-selection-and-flow-scope.mdl
+++ b/mdl-examples/bug-tests/1076-alter-page-selection-and-flow-scope.mdl
@@ -64,14 +64,14 @@ end;
 -- ---------------------------------------------------------------------------
 create or replace page BugTest1076.Dashboard_View
 ( Title: 'Dashboard', Layout: Atlas_Core.Atlas_Default,
-  Params: { $Dashboard: BugTest1076.Dashboard } )
+  Params: ( $Dashboard: BugTest1076.Dashboard ) )
 {
   dataview dvDashboard (datasource: $Dashboard) {
     listview lvVersions (datasource: association BugTest1076.DashboardVersion_Dashboard) {
-      dynamictext txtRow (content: '{1}', ContentParams: [{1} = PeriodLabel])
+      dynamictext txtRow (content: '{1}', ContentParams: ({1} = PeriodLabel))
     }
     dataview dvSelected (datasource: selection lvVersions) {
-      dynamictext txtPreviewPeriod (content: 'Period: {1}', ContentParams: [{1} = PeriodLabel])
+      dynamictext txtPreviewPeriod (content: 'Period: {1}', ContentParams: ({1} = PeriodLabel))
     }
   }
 }
@@ -79,7 +79,7 @@ create or replace page BugTest1076.Dashboard_View
 
 alter page BugTest1076.Dashboard_View {
   replace txtPreviewPeriod with {
-    dynamictext txtPreviewPeriod (content: 'Preview {1}', ContentParams: [{1} = PeriodLabel])
+    dynamictext txtPreviewPeriod (content: 'Preview {1}', ContentParams: ({1} = PeriodLabel))
   }
 }
 /
@@ -87,7 +87,7 @@ alter page BugTest1076.Dashboard_View {
 -- INSERT INTO the selection data view takes the same scope as REPLACE.
 alter page BugTest1076.Dashboard_View {
   insert into dvSelected {
-    dynamictext txtPreviewProbe (content: 'P {1}', ContentParams: [{1} = PeriodLabel])
+    dynamictext txtPreviewProbe (content: 'P {1}', ContentParams: ({1} = PeriodLabel))
   }
 }
 /
@@ -102,7 +102,7 @@ create or replace page BugTest1076.Page_MfGallery
   gallery galMf (datasource: microflow BugTest1076.DS_Items) {
     template t1 {
       container ctnCard {
-        dynamictext txtName (content: '{1}', ContentParams: [{1} = Name])
+        dynamictext txtName (content: '{1}', ContentParams: ({1} = Name))
       }
     }
   }
@@ -112,7 +112,7 @@ create or replace page BugTest1076.Page_MfGallery
 alter page BugTest1076.Page_MfGallery {
   replace txtName with {
     container ctnWrap {
-      dynamictext txtName2 (content: '{1}', ContentParams: [{1} = Name])
+      dynamictext txtName2 (content: '{1}', ContentParams: ({1} = Name))
     }
   }
 }
@@ -120,7 +120,7 @@ alter page BugTest1076.Page_MfGallery {
 
 alter page BugTest1076.Page_MfGallery {
   insert after txtName2 {
-    dynamictext txtNameProbe (content: 'Q {1}', ContentParams: [{1} = Name])
+    dynamictext txtNameProbe (content: 'Q {1}', ContentParams: ({1} = Name))
   }
 }
 /
@@ -134,18 +134,18 @@ create or replace page BugTest1076.Page_SelGallery
 {
   gallery galItems (datasource: database BugTest1076.Item) {
     template t1 {
-      dynamictext txtCard (content: '{1}', ContentParams: [{1} = Name])
+      dynamictext txtCard (content: '{1}', ContentParams: ({1} = Name))
     }
   }
   dataview dvSel (datasource: selection galItems) {
-    dynamictext txtSel (content: 'S {1}', ContentParams: [{1} = Name])
+    dynamictext txtSel (content: 'S {1}', ContentParams: ({1} = Name))
   }
 }
 /
 
 alter page BugTest1076.Page_SelGallery {
   replace txtSel with {
-    dynamictext txtSel (content: 'S2 {1}', ContentParams: [{1} = Name])
+    dynamictext txtSel (content: 'S2 {1}', ContentParams: ({1} = Name))
   }
 }
 /
diff --git a/mdl-examples/bug-tests/1113-database-query-type-enum.mdl b/mdl-examples/bug-tests/1113-database-query-type-enum.mdl
index fe12b06be2..ee042daf86 100644
--- a/mdl-examples/bug-tests/1113-database-query-type-enum.mdl
+++ b/mdl-examples/bug-tests/1113-database-query-type-enum.mdl
@@ -43,21 +43,21 @@ create constant DbType.Dsn type string
 create constant DbType.User type string default 'demo';
 create constant DbType.Pass type string default '';
 
-create database connection DbType.Warehouse
-type 'PostgreSQL'
-connection string @DbType.Dsn
-username @DbType.User
-password @DbType.Pass
-begin
+create database connection DbType.Warehouse (
+  Type: 'PostgreSQL',
+  ConnectionString: @DbType.Dsn,
+  Username: @DbType.User,
+  Password: @DbType.Pass
+) {
   -- Reads: stored as Type = 'Select' on 11.13+.
-  query ListOrders
-    sql 'SELECT orderId, customer, total FROM orders ORDER BY orderId';
+  query ListOrders (
+    Sql: 'SELECT orderId, customer, total FROM orders ORDER BY orderId' )
 
   -- Writes: stored as Type = 'NonSelect'. The legacy integer could not express
   -- this distinction at all.
-  query ArchiveOrders
-    sql 'UPDATE orders SET archived = true WHERE total = 0';
-end;
+  query ArchiveOrders (
+    Sql: 'UPDATE orders SET archived = true WHERE total = 0' )
+};
 
 -- The activity is where CE5277 surfaced, so the repro needs one.
 create microflow DbType.MF_ListOrders()
diff --git a/mdl-examples/bug-tests/112-combobox-enum-ce0463-widget-version.mdl b/mdl-examples/bug-tests/112-combobox-enum-ce0463-widget-version.mdl
index 6bee3a2dbc..a8ec909d47 100644
--- a/mdl-examples/bug-tests/112-combobox-enum-ce0463-widget-version.mdl
+++ b/mdl-examples/bug-tests/112-combobox-enum-ce0463-widget-version.mdl
@@ -62,7 +62,7 @@ create entity CBBug112.Boat (
 /
 
 create or replace page CBBug112.Boat_NewEdit (
-  params: { $Boat: CBBug112.Boat },
+  params: ( $Boat: CBBug112.Boat ),
   layout: Atlas_Core.Atlas_Default
 ) {
   dataview boatDV (DataSource: $Boat) {
diff --git a/mdl-examples/bug-tests/1121-page-parameters-on-mendix-10.mdl b/mdl-examples/bug-tests/1121-page-parameters-on-mendix-10.mdl
index a530dabbd0..c3421fef41 100644
--- a/mdl-examples/bug-tests/1121-page-parameters-on-mendix-10.mdl
+++ b/mdl-examples/bug-tests/1121-page-parameters-on-mendix-10.mdl
@@ -39,7 +39,7 @@ CREATE PERSISTENT ENTITY Bug1121.Item (
 CREATE OR REPLACE PAGE Bug1121.Item_Edit (
   Title: 'Edit item',
   Layout: Atlas_Core.PopupLayout,
-  Params: { $Item: Bug1121.Item }
+  Params: ( $Item: Bug1121.Item )
 ) {
   layoutgrid lg {
     row r {
diff --git a/mdl-examples/bug-tests/114-quoted-reserved-page-params.mdl b/mdl-examples/bug-tests/114-quoted-reserved-page-params.mdl
index 5db074a4f5..516d5559c9 100644
--- a/mdl-examples/bug-tests/114-quoted-reserved-page-params.mdl
+++ b/mdl-examples/bug-tests/114-quoted-reserved-page-params.mdl
@@ -28,7 +28,7 @@ create page BugTest114.P_Edit
 (
   title: 'Edit',
   layout: Atlas_Core.Atlas_Default,
-  params: { "List": BugTest114.Order }
+  params: ( "List": BugTest114.Order )
 )
 {
   container c {
@@ -39,7 +39,7 @@ create page BugTest114.P_Edit
 -- Snippet with a reserved-keyword parameter name, quoted.
 create snippet BugTest114.Snip
 (
-  params: { "Template": BugTest114.Order }
+  params: ( "Template": BugTest114.Order )
 )
 {
   container c2 {
diff --git a/mdl-examples/bug-tests/1140-flow-arg-page-parameter.mdl b/mdl-examples/bug-tests/1140-flow-arg-page-parameter.mdl
index 8513739e9a..fe86186b26 100644
--- a/mdl-examples/bug-tests/1140-flow-arg-page-parameter.mdl
+++ b/mdl-examples/bug-tests/1140-flow-arg-page-parameter.mdl
@@ -80,8 +80,8 @@ end;
 create or replace page CustomModule.PANEL_BufferDefinition_Edit (
   Title: 'Edit',
   Layout: CustomModule.App_Default,
-  Params: { $Dto: CustomModule.UpdateBufferDefinition,
-            $BufferDefinition: CustomModule.BufferDefinition }
+  Params: ( $Dto: CustomModule.UpdateBufferDefinition,
+            $BufferDefinition: CustomModule.BufferDefinition )
 ) {
   placeholder Main {
     dataview dvEdit (DataSource: $Dto, FormOrientation: Vertical) {
@@ -119,7 +119,7 @@ end;
 create or replace page CustomModule.PANEL_Controls (
   Title: 'Controls',
   Layout: CustomModule.App_Default,
-  Params: { $Row: CustomModule.BufferDefinition }
+  Params: ( $Row: CustomModule.BufferDefinition )
 ) {
   placeholder Main {
     listview lvRows (DataSource: DATABASE CustomModule.BufferDefinition) {
diff --git a/mdl-examples/bug-tests/1199-fileuploader-describe-named-datasource.mdl b/mdl-examples/bug-tests/1199-fileuploader-describe-named-datasource.mdl
index 874d671142..8b2be04f30 100644
--- a/mdl-examples/bug-tests/1199-fileuploader-describe-named-datasource.mdl
+++ b/mdl-examples/bug-tests/1199-fileuploader-describe-named-datasource.mdl
@@ -27,7 +27,7 @@ create association Uploads.UploadedFile_UploadRequest from Uploads.UploadedFile
 create nanoflow Uploads.NF_CreateFile ( $Request: Uploads.UploadRequest ) begin end
 
 create or replace page Uploads.UploadRequest_NewEdit (Title: 'Upload', Layout: Atlas_Core.Atlas_Default,
-  Params: { $Request: Uploads.UploadRequest })
+  Params: ( $Request: Uploads.UploadRequest ))
 {
   DATAVIEW dv (DataSource: $Request) {
     pluggablewidget 'com.mendix.widget.web.fileuploader.FileUploader' upFiles (
diff --git a/mdl-examples/bug-tests/1200-mpk-action-variables.mdl b/mdl-examples/bug-tests/1200-mpk-action-variables.mdl
index f218f9e27e..d30494d868 100644
--- a/mdl-examples/bug-tests/1200-mpk-action-variables.mdl
+++ b/mdl-examples/bug-tests/1200-mpk-action-variables.mdl
@@ -16,7 +16,7 @@ create module Sig;
 create persistent entity Sig.Request ( SignatureData: string(unlimited) );
 
 create or replace page Sig.Sign_Edit (Title: 'Sign', Layout: Atlas_Core.Atlas_Default,
-  Params: { $Request: Sig.Request })
+  Params: ( $Request: Sig.Request ))
 {
   DATAVIEW dv (DataSource: $Request) {
     pluggablewidget 'com.mendix.widget.web.signature.Signature' sig1 ()
diff --git a/mdl-examples/bug-tests/200-basic-auth-rest-client.mdl b/mdl-examples/bug-tests/200-basic-auth-rest-client.mdl
index 46535c4f3f..4c6e062773 100644
--- a/mdl-examples/bug-tests/200-basic-auth-rest-client.mdl
+++ b/mdl-examples/bug-tests/200-basic-auth-rest-client.mdl
@@ -49,7 +49,7 @@ create rest client AuthTest.HttpBinAuthAPI (
   operation CheckAuth (
     method: get,
     path: '/basic-auth/testuser/testpass123!',
-    headers: ('Accept' = 'application/json'),
+    headers: ('Accept': 'application/json'),
     timeout: 30,
     response: none
   )
diff --git a/mdl-examples/bug-tests/254-slider-custom-tooltip.mdl b/mdl-examples/bug-tests/254-slider-custom-tooltip.mdl
index ad85754943..adc2d6ee25 100644
--- a/mdl-examples/bug-tests/254-slider-custom-tooltip.mdl
+++ b/mdl-examples/bug-tests/254-slider-custom-tooltip.mdl
@@ -54,7 +54,7 @@ create or replace page T254.P_Num (Title: 'Num', Layout: Atlas_Core.Atlas_Defaul
   LISTVIEW lv (DataSource: DATABASE T254.Reading) {
     pluggablewidget 'com.mendix.widget.custom.slider.Slider' sl (
       Attribute: Score, tooltipType: 'customText',
-      tooltip: 'Score is {1}', contentparams: [{1} = Score])
+      tooltip: 'Score is {1}', contentparams: ({1} = Score))
   }
 }
 
diff --git a/mdl-examples/bug-tests/295-showpage-null-variable.mdl b/mdl-examples/bug-tests/295-showpage-null-variable.mdl
index 0fd2eb67f3..06cc977834 100644
--- a/mdl-examples/bug-tests/295-showpage-null-variable.mdl
+++ b/mdl-examples/bug-tests/295-showpage-null-variable.mdl
@@ -24,7 +24,7 @@ CREATE PAGE bug295.Product_Detail (
   -- (flagged by MDL-PAGE20); this page takes $Product.
   Url: 'Product_Detail/{Product}',
   layout: Atlas_Core.Atlas_Default,
-  Params: { $Product: bug295.Product }
+  Params: ( $Product: bug295.Product )
 ) {
   DATAVIEW dv1 (DataSource: $Product) {
     DYNAMICTEXT txt1 (Content: '$Product/Name')
diff --git a/mdl-examples/bug-tests/295-showpage-parameter-mapping-validity.mdl b/mdl-examples/bug-tests/295-showpage-parameter-mapping-validity.mdl
index ee81fea8b3..cdb1bc559e 100644
--- a/mdl-examples/bug-tests/295-showpage-parameter-mapping-validity.mdl
+++ b/mdl-examples/bug-tests/295-showpage-parameter-mapping-validity.mdl
@@ -36,9 +36,9 @@ create entity BugTest295.Product (
 
 create page BugTest295.Product_Detail
 (
-  params: {
+  params: (
     $Product: BugTest295.Product
-  },
+  ),
   title: 'Product Detail',
   layout: Atlas_Core.Atlas_Default
 )
diff --git a/mdl-examples/bug-tests/55-alter-page-insert-assoc-binding.mdl b/mdl-examples/bug-tests/55-alter-page-insert-assoc-binding.mdl
index 8323cd9152..4ed6b94144 100644
--- a/mdl-examples/bug-tests/55-alter-page-insert-assoc-binding.mdl
+++ b/mdl-examples/bug-tests/55-alter-page-insert-assoc-binding.mdl
@@ -33,7 +33,7 @@ create association MyFirstModule.WeekRow_Week
 /
 
 create or replace page MyFirstModule.WeekTimesheet
-( Title: 'Week', Layout: Atlas_Core.Atlas_Default, Params: { $Week: MyFirstModule.Week } )
+( Title: 'Week', Layout: Atlas_Core.Atlas_Default, Params: ( $Week: MyFirstModule.Week ) )
 {
   dataview dvWeek (datasource: $Week) {
     dynamictext hLabel (content: 'Week')
diff --git a/mdl-examples/bug-tests/554-dataview-form-orientation.mdl b/mdl-examples/bug-tests/554-dataview-form-orientation.mdl
index cbcb943ce6..5ab341ecf0 100644
--- a/mdl-examples/bug-tests/554-dataview-form-orientation.mdl
+++ b/mdl-examples/bug-tests/554-dataview-form-orientation.mdl
@@ -33,7 +33,7 @@ CREATE PERSISTENT ENTITY Bug554.Customer (
 CREATE OR REPLACE PAGE Bug554.PageVertical (
   Title: 'Vertical form',
   Layout: Atlas_Core.PopupLayout,
-  Params: { $Customer: Bug554.Customer }
+  Params: ( $Customer: Bug554.Customer )
 ) {
   layoutgrid lg {
     row r {
@@ -49,7 +49,7 @@ CREATE OR REPLACE PAGE Bug554.PageVertical (
 CREATE OR REPLACE PAGE Bug554.PageHorizontal (
   Title: 'Horizontal form',
   Layout: Atlas_Core.PopupLayout,
-  Params: { $Customer: Bug554.Customer }
+  Params: ( $Customer: Bug554.Customer )
 ) {
   layoutgrid lg {
     row r {
@@ -65,7 +65,7 @@ CREATE OR REPLACE PAGE Bug554.PageHorizontal (
 CREATE OR REPLACE PAGE Bug554.PageLabelWidth5 (
   Title: 'LabelWidth=5',
   Layout: Atlas_Core.PopupLayout,
-  Params: { $Customer: Bug554.Customer }
+  Params: ( $Customer: Bug554.Customer )
 ) {
   layoutgrid lg {
     row r {
diff --git a/mdl-examples/bug-tests/56-show-page-currentobject-arg.mdl b/mdl-examples/bug-tests/56-show-page-currentobject-arg.mdl
index b785a7421e..b0c5beee1e 100644
--- a/mdl-examples/bug-tests/56-show-page-currentobject-arg.mdl
+++ b/mdl-examples/bug-tests/56-show-page-currentobject-arg.mdl
@@ -39,7 +39,7 @@
 create entity MyFirstModule.Entry ( Label: String );
 /
 create or replace page MyFirstModule.EditEntry
-( Title: 'Edit', Layout: Atlas_Core.Atlas_Default, Params: { $Entry: MyFirstModule.Entry } )
+( Title: 'Edit', Layout: Atlas_Core.Atlas_Default, Params: ( $Entry: MyFirstModule.Entry ) )
 {
   dataview dv (datasource: $Entry) { dynamictext t (content: 'Edit') }
 }
diff --git a/mdl-examples/bug-tests/572-use-fragment-in-alter-page.mdl b/mdl-examples/bug-tests/572-use-fragment-in-alter-page.mdl
index f8f16c29e4..89c43000ca 100644
--- a/mdl-examples/bug-tests/572-use-fragment-in-alter-page.mdl
+++ b/mdl-examples/bug-tests/572-use-fragment-in-alter-page.mdl
@@ -28,7 +28,7 @@ define fragment SaveCancelFooter as {
 
 create page FragAlter.ServiceRequest_NewEdit
 (
-  params: { $ServiceRequest: FragAlter.ServiceRequest },
+  params: ( $ServiceRequest: FragAlter.ServiceRequest ),
   title: 'Service Request',
   layout: Atlas_Core.PopupLayout
 )
diff --git a/mdl-examples/bug-tests/573-simple-menu-bar.mdl b/mdl-examples/bug-tests/573-simple-menu-bar.mdl
index 30829c64b5..ce4ea3e30f 100644
--- a/mdl-examples/bug-tests/573-simple-menu-bar.mdl
+++ b/mdl-examples/bug-tests/573-simple-menu-bar.mdl
@@ -21,11 +21,11 @@
 
 create module Bug573;
 
-create or modify menu Bug573.Bottom_Menu (
-  menu item 'Home' icon Atlas_Core.Atlas.home;
-  menu item 'Agenda' icon Atlas_Core.Atlas.calendar;
-  menu item 'Profile' icon Atlas_Core.Atlas.user;
-);
+create or modify menu Bug573.Bottom_Menu {
+  menu item 'Home' ( Icon: Atlas_Core.Atlas.home )
+  menu item 'Agenda' ( Icon: Atlas_Core.Atlas.calendar )
+  menu item 'Profile' ( Icon: Atlas_Core.Atlas.user )
+};
 
 create or replace layout Bug573.Phone_Bottom (
   layouttype: 'Phone',
diff --git a/mdl-examples/bug-tests/574-widget-property-visibility.mdl b/mdl-examples/bug-tests/574-widget-property-visibility.mdl
index a4bed3aa08..1049fb46b6 100644
--- a/mdl-examples/bug-tests/574-widget-property-visibility.mdl
+++ b/mdl-examples/bug-tests/574-widget-property-visibility.mdl
@@ -57,10 +57,10 @@ create or replace page Issue574.TimelineCustom (
     customVisualization: true
   ) {
     container customTitle {
-      dynamictext tlTitle (content: '{1}', rendermode: H4, contentparams: [{1} = Title])
+      dynamictext tlTitle (content: '{1}', rendermode: H4, contentparams: ({1} = Title))
     }
     container customDescription {
-      dynamictext tlDesc (content: '{1}', contentparams: [{1} = Description])
+      dynamictext tlDesc (content: '{1}', contentparams: ({1} = Description))
     }
   }
 }
diff --git a/mdl-examples/bug-tests/576-datasource-bare-entity-shorthand.mdl b/mdl-examples/bug-tests/576-datasource-bare-entity-shorthand.mdl
index 88f203a7dc..230ab8a520 100644
--- a/mdl-examples/bug-tests/576-datasource-bare-entity-shorthand.mdl
+++ b/mdl-examples/bug-tests/576-datasource-bare-entity-shorthand.mdl
@@ -21,7 +21,7 @@ create persistent entity bug576.Car (
   Name: string(200)
 );
 
-create page bug576.Detail (Title: 'Car', Layout: Atlas_Core.Atlas_Default, Params: { $Car: bug576.Car }) {
+create page bug576.Detail (Title: 'Car', Layout: Atlas_Core.Atlas_Default, Params: ( $Car: bug576.Car )) {
   dataview dvCar (DataSource: $Car) {
     textbox txtName (Label: 'Name', Attribute: Name)
   }
diff --git a/mdl-examples/bug-tests/619-quoted-reserved-emitter-names.mdl b/mdl-examples/bug-tests/619-quoted-reserved-emitter-names.mdl
index 3aa3c04e34..d9e2346c94 100644
--- a/mdl-examples/bug-tests/619-quoted-reserved-emitter-names.mdl
+++ b/mdl-examples/bug-tests/619-quoted-reserved-emitter-names.mdl
@@ -53,7 +53,7 @@ create entity BugTest619b.OrderContext;
 create page BugTest619b.TaskPage (
   title: 'Task Page',
   layout: Atlas_Core.Atlas_Default,
-  params: { $WorkflowUserTask: System.WorkflowUserTask }
+  params: ( $WorkflowUserTask: System.WorkflowUserTask )
 ) { };
 
 create workflow BugTest619b.ReservedWF
diff --git a/mdl-examples/bug-tests/627-container-visible-expression.mdl b/mdl-examples/bug-tests/627-container-visible-expression.mdl
index 5d77c66fc2..41b0820bf7 100644
--- a/mdl-examples/bug-tests/627-container-visible-expression.mdl
+++ b/mdl-examples/bug-tests/627-container-visible-expression.mdl
@@ -32,7 +32,7 @@ create page MyFirstModule.P_Vis
 (
   Title: 'Conditional Visibility',
   Layout: Atlas_Core.Atlas_Default,
-  Params: { $Customer: MyFirstModule.Customer }
+  Params: ( $Customer: MyFirstModule.Customer )
 )
 {
   dataview dv (datasource: $Customer) {
diff --git a/mdl-examples/bug-tests/631-listview-inputs-not-editable.mdl b/mdl-examples/bug-tests/631-listview-inputs-not-editable.mdl
index af83366bf3..1d0931573e 100644
--- a/mdl-examples/bug-tests/631-listview-inputs-not-editable.mdl
+++ b/mdl-examples/bug-tests/631-listview-inputs-not-editable.mdl
@@ -55,7 +55,7 @@ create or replace page Lv631.P_Inputs
 
   -- No inputs at all: quiet.
   listview lvDisplay (datasource: database Lv631.Thing) {
-    dynamictext dtDisplay (content: '{1}', contentparams: [{1} = Name])
+    dynamictext dtDisplay (content: '{1}', contentparams: ({1} = Name))
   }
 }
 /
diff --git a/mdl-examples/bug-tests/632-button-captionparams-bare-attribute.mdl b/mdl-examples/bug-tests/632-button-captionparams-bare-attribute.mdl
index 5fd55c5d13..0fcbe90baa 100644
--- a/mdl-examples/bug-tests/632-button-captionparams-bare-attribute.mdl
+++ b/mdl-examples/bug-tests/632-button-captionparams-bare-attribute.mdl
@@ -47,18 +47,18 @@ create persistent entity Bug632.Order (
 create page Bug632.OrderDetail (
   title: 'Order',
   layout: Atlas_Core.Atlas_Default,
-  params: { $o: Bug632.Order }
+  params: ( $o: Bug632.Order )
 ) {
   dataview dv (datasource: $o) {
     -- quoted literal: stays a literal
-    actionbutton b1 (caption: 'Save {1}', captionparams: [{1} = 'order'], action: save_changes)
+    actionbutton b1 (caption: 'Save {1}', captionparams: ({1} = 'order'), action: save_changes)
     -- bare attribute: binds Bug632.Order.Title (was the literal 'Title')
-    actionbutton b2 (caption: 'Save {1}', captionparams: [{1} = Title], action: save_changes)
+    actionbutton b2 (caption: 'Save {1}', captionparams: ({1} = Title), action: save_changes)
     -- parameter-qualified attribute
-    actionbutton b3 (caption: 'Save {1}', captionparams: [{1} = $o.Title], action: save_changes)
+    actionbutton b3 (caption: 'Save {1}', captionparams: ({1} = $o.Title), action: save_changes)
     -- non-string bare attribute
-    linkbutton b4 (caption: 'Order #{1}', captionparams: [{1} = Num], action: save_changes)
+    linkbutton b4 (caption: 'Order #{1}', captionparams: ({1} = Num), action: save_changes)
     -- the workaround from the report, for comparison: binds the same way
-    dynamictext t1 (content: 'Save {1}', contentparams: [{1} = Title])
+    dynamictext t1 (content: 'Save {1}', contentparams: ({1} = Title))
   }
 }
diff --git a/mdl-examples/bug-tests/643-combobox-datasource-by-name.fail.mdl b/mdl-examples/bug-tests/643-combobox-datasource-by-name.fail.mdl
index c31fad2bb1..33f0289e2e 100644
--- a/mdl-examples/bug-tests/643-combobox-datasource-by-name.fail.mdl
+++ b/mdl-examples/bug-tests/643-combobox-datasource-by-name.fail.mdl
@@ -21,7 +21,7 @@ create page Administration.MxfCombo
 (
   title: 'T',
   layout: Atlas_Core.Atlas_Default,
-  params: { $Obj: Administration.AccountPasswordData }
+  params: ( $Obj: Administration.AccountPasswordData )
 )
 {
   dataview dv (datasource: $Obj) {
diff --git a/mdl-examples/bug-tests/662-inherited-association-module-qualifier.mdl b/mdl-examples/bug-tests/662-inherited-association-module-qualifier.mdl
index 89328439d4..3a7f51d208 100644
--- a/mdl-examples/bug-tests/662-inherited-association-module-qualifier.mdl
+++ b/mdl-examples/bug-tests/662-inherited-association-module-qualifier.mdl
@@ -32,7 +32,7 @@ create entity MyFirstModule.Member extends System.User (
 /
 
 create or replace page MyFirstModule.Member_Edit
-( Title: 'Member', Layout: Atlas_Core.Atlas_Default, Params: { $Member: MyFirstModule.Member } )
+( Title: 'Member', Layout: Atlas_Core.Atlas_Default, Params: ( $Member: MyFirstModule.Member ) )
 {
   dataview dv (datasource: $Member) {
     textbox txtName (label: 'Full name', attribute: FullName)
diff --git a/mdl-examples/bug-tests/664-combobox-expression-caption.mdl b/mdl-examples/bug-tests/664-combobox-expression-caption.mdl
index 986dd9dcdf..76f3659bb3 100644
--- a/mdl-examples/bug-tests/664-combobox-expression-caption.mdl
+++ b/mdl-examples/bug-tests/664-combobox-expression-caption.mdl
@@ -27,7 +27,7 @@ create association MyFirstModule.Office_Region from MyFirstModule.Office to MyFi
 /
 
 create or replace page MyFirstModule.Office_Edit
-( Title: 'Office', Layout: Atlas_Core.Atlas_Default, Params: { $Office: MyFirstModule.Office } )
+( Title: 'Office', Layout: Atlas_Core.Atlas_Default, Params: ( $Office: MyFirstModule.Office ) )
 {
   dataview dv (datasource: $Office) {
     combobox cmbRegion (
diff --git a/mdl-examples/bug-tests/680-enum-literal-conditional-visibility.mdl b/mdl-examples/bug-tests/680-enum-literal-conditional-visibility.mdl
index 12ed18e0cd..638a2bc681 100644
--- a/mdl-examples/bug-tests/680-enum-literal-conditional-visibility.mdl
+++ b/mdl-examples/bug-tests/680-enum-literal-conditional-visibility.mdl
@@ -36,7 +36,7 @@ create page BugTest680.Dashboard
 (
   title: 'Dashboard',
   layout: Atlas_Core.Atlas_Default,
-  params: { $Equip: BugTest680.Equip }
+  params: ( $Equip: BugTest680.Equip )
 )
 {
   dataview dv (datasource: $Equip) {
diff --git a/mdl-examples/bug-tests/713-popup-zero-dimensions.mdl b/mdl-examples/bug-tests/713-popup-zero-dimensions.mdl
index 39038e45de..8cdaa372ed 100644
--- a/mdl-examples/bug-tests/713-popup-zero-dimensions.mdl
+++ b/mdl-examples/bug-tests/713-popup-zero-dimensions.mdl
@@ -34,7 +34,7 @@ CREATE OR REPLACE PAGE Bug713.ThingPopupAuto (
   Layout: Atlas_Core.PopupLayout,
   PopupWidth: 0,
   PopupHeight: 0,
-  Params: { $Thing: Bug713.Thing }
+  Params: ( $Thing: Bug713.Thing )
 ) {
   dataview dv (DataSource: $Thing) {
     textbox tb (Label: 'Name', Attribute: Name)
@@ -47,7 +47,7 @@ CREATE OR REPLACE PAGE Bug713.ThingPopupFixed (
   Layout: Atlas_Core.PopupLayout,
   PopupWidth: 800,
   PopupHeight: 480,
-  Params: { $Thing: Bug713.Thing }
+  Params: ( $Thing: Bug713.Thing )
 ) {
   dataview dv (DataSource: $Thing) {
     textbox tb (Label: 'Name', Attribute: Name)
diff --git a/mdl-examples/bug-tests/716-widget-package-upgrade.mdl b/mdl-examples/bug-tests/716-widget-package-upgrade.mdl
index 76ed802bfc..324adcf29a 100644
--- a/mdl-examples/bug-tests/716-widget-package-upgrade.mdl
+++ b/mdl-examples/bug-tests/716-widget-package-upgrade.mdl
@@ -68,7 +68,7 @@ create page W716.Overview
   ) {
     template tpl1 {
       container ctnCard (Class: 'card') {
-        dynamictext txtName (Content: '{1}', ContentParams: [{1} = Name])
+        dynamictext txtName (Content: '{1}', ContentParams: ({1} = Name))
       }
     }
   }
diff --git a/mdl-examples/bug-tests/762-813-dataview-properties.mdl b/mdl-examples/bug-tests/762-813-dataview-properties.mdl
index 2d75b9780d..f3bbf4d994 100644
--- a/mdl-examples/bug-tests/762-813-dataview-properties.mdl
+++ b/mdl-examples/bug-tests/762-813-dataview-properties.mdl
@@ -36,7 +36,7 @@ create persistent entity Issue762.Thing (
 create or replace page Issue762.DVTest (
   title: 'DataView properties',
   Layout: Atlas_Core.Atlas_Default,
-  params: { $Thing: Issue762.Thing }
+  params: ( $Thing: Issue762.Thing )
 )
 {
   container c1 {
diff --git a/mdl-examples/bug-tests/795-datagrid-microflow-datasource-describe.mdl b/mdl-examples/bug-tests/795-datagrid-microflow-datasource-describe.mdl
index e577d90f4b..bdcfa34b4c 100644
--- a/mdl-examples/bug-tests/795-datagrid-microflow-datasource-describe.mdl
+++ b/mdl-examples/bug-tests/795-datagrid-microflow-datasource-describe.mdl
@@ -64,7 +64,7 @@ create or replace page Issue795.ProbeGallery (
 ) {
   gallery galMicroflow (datasource: microflow Issue795.GetBuckets) {
     template template1 {
-      dynamictext txtKey (content: '{1}', contentparams: [{1} = BucketKey])
+      dynamictext txtKey (content: '{1}', contentparams: ({1} = BucketKey))
     }
   }
 }
diff --git a/mdl-examples/bug-tests/843-rest-response-mapping.mdl b/mdl-examples/bug-tests/843-rest-response-mapping.mdl
index c1d0bdb048..13032ed7cf 100644
--- a/mdl-examples/bug-tests/843-rest-response-mapping.mdl
+++ b/mdl-examples/bug-tests/843-rest-response-mapping.mdl
@@ -46,7 +46,7 @@ create rest client ZZB."MESSlice" (
     Path: '/routes/{id}',
     Parameters: ($id: String),
     Query: ($page: String, $pageSize: String),
-    Headers: ('X-Tenant-Id' = 'demo-tenant-01'),
+    Headers: ('X-Tenant-Id': 'demo-tenant-01'),
     Timeout: 300,
     -- The clause names the target ENTITY and maps JSON fields onto it. Mendix
     -- stores this inline on the operation; it is not a reference to an import
diff --git a/mdl-examples/bug-tests/851-alter-page-conditional-attribute.mdl b/mdl-examples/bug-tests/851-alter-page-conditional-attribute.mdl
index b746ce0197..45067555dc 100644
--- a/mdl-examples/bug-tests/851-alter-page-conditional-attribute.mdl
+++ b/mdl-examples/bug-tests/851-alter-page-conditional-attribute.mdl
@@ -32,7 +32,7 @@ CREATE OR MODIFY PERSISTENT ENTITY Bug851.Thing (
 
 -- Reference: the CREATE path, which was already correct.
 CREATE OR REPLACE PAGE Bug851.PageCreated (
-  Params: { $currentObject: Bug851.Thing },
+  Params: ( $currentObject: Bug851.Thing ),
   Title: 'Conditional settings via CREATE',
   Layout: Atlas_Core.Atlas_Default
 ) {
@@ -48,7 +48,7 @@ CREATE OR REPLACE PAGE Bug851.PageCreated (
 
 -- The regression: the same two settings applied through ALTER.
 CREATE OR REPLACE PAGE Bug851.PageAltered (
-  Params: { $currentObject: Bug851.Thing },
+  Params: ( $currentObject: Bug851.Thing ),
   Title: 'Conditional settings via ALTER',
   Layout: Atlas_Core.Atlas_Default
 ) {
diff --git a/mdl-examples/bug-tests/852-conditional-keyword-functions.mdl b/mdl-examples/bug-tests/852-conditional-keyword-functions.mdl
index 6e5e9791c8..7776c51338 100644
--- a/mdl-examples/bug-tests/852-conditional-keyword-functions.mdl
+++ b/mdl-examples/bug-tests/852-conditional-keyword-functions.mdl
@@ -37,7 +37,7 @@ CREATE OR MODIFY PERSISTENT ENTITY Bug852.Thing (
 );
 
 CREATE OR REPLACE PAGE Bug852.PageConditionals (
-  Params: { $currentObject: Bug852.Thing },
+  Params: ( $currentObject: Bug852.Thing ),
   Title: 'Conditionals using keyword-named functions',
   Layout: Atlas_Core.Atlas_Default
 ) {
diff --git a/mdl-examples/bug-tests/854-assoc-datasource-qualified-name.mdl b/mdl-examples/bug-tests/854-assoc-datasource-qualified-name.mdl
index ab29cf1b62..cdab4239cb 100644
--- a/mdl-examples/bug-tests/854-assoc-datasource-qualified-name.mdl
+++ b/mdl-examples/bug-tests/854-assoc-datasource-qualified-name.mdl
@@ -46,7 +46,7 @@ create association M854A.Order_Note from M854A.Order to M854A.Note type Referenc
 create association M854A.Order_Line from M854A.Order to M854B.Line type ReferenceSet;
 
 create page M854A.OrderDetail (
-  Params: { $Order: M854A.Order },
+  Params: ( $Order: M854A.Order ),
   Title: 'Order Detail',
   Layout: Atlas_Core.Atlas_Default
 ) {
diff --git a/mdl-examples/bug-tests/855-alter-page-set-parameter-datasource.mdl b/mdl-examples/bug-tests/855-alter-page-set-parameter-datasource.mdl
index bdcc7b0850..1df031bc6f 100644
--- a/mdl-examples/bug-tests/855-alter-page-set-parameter-datasource.mdl
+++ b/mdl-examples/bug-tests/855-alter-page-set-parameter-datasource.mdl
@@ -39,7 +39,7 @@ begin
 end;
 
 create page P855.OrderPage (
-  params: { $Order: P855.Order },
+  params: ( $Order: P855.Order ),
   title: 'Order',
   layout: Atlas_Core.Atlas_Default
 ) {
diff --git a/mdl-examples/bug-tests/863-execute-database-query-describe.mdl b/mdl-examples/bug-tests/863-execute-database-query-describe.mdl
index 87ee2d77d9..8b860c3991 100644
--- a/mdl-examples/bug-tests/863-execute-database-query-describe.mdl
+++ b/mdl-examples/bug-tests/863-execute-database-query-describe.mdl
@@ -42,17 +42,18 @@ create constant DbQ863.DbUrl  type String default 'jdbc:postgresql://localhost:5
 create constant DbQ863.DbUser type String default 'app';
 create constant DbQ863.DbPass type String default 'secret';
 
-create database connection DbQ863.Conn
-  type 'PostgreSQL'
-  connection string @DbQ863.DbUrl
-  username @DbQ863.DbUser
-  password @DbQ863.DbPass
-begin
-  query GetRows
-    sql 'select n from rows where status = $Status'
-    parameter Status: String
-    returns DbQ863.Row map (n as N);
-end;
+create database connection DbQ863.Conn (
+  Type: 'PostgreSQL',
+  ConnectionString: @DbQ863.DbUrl,
+  Username: @DbQ863.DbUser,
+  Password: @DbQ863.DbPass
+) {
+  query GetRows (
+    Sql: 'select n from rows where status = $Status',
+    Parameters: ( Status: String ),
+    Returns: DbQ863.Row, Map: (N = n)
+  )
+};
 
 create microflow DbQ863.MF_Query ($Status: String)
 begin
diff --git a/mdl-examples/bug-tests/868-snippetcall-context-parameter.mdl b/mdl-examples/bug-tests/868-snippetcall-context-parameter.mdl
index ec8e489e14..47ccbde043 100644
--- a/mdl-examples/bug-tests/868-snippetcall-context-parameter.mdl
+++ b/mdl-examples/bug-tests/868-snippetcall-context-parameter.mdl
@@ -30,7 +30,7 @@
 create module S868;
 create persistent entity S868.Order (Code: String(20));
 
-create snippet S868.OrderActions ( params: { $Order: S868.Order } ) {
+create snippet S868.OrderActions ( params: ( $Order: S868.Order ) ) {
   dataview dvInner (datasource: $Order) {
     textbox tbCode (attribute: Code, label: 'Code')
   }
@@ -38,7 +38,7 @@ create snippet S868.OrderActions ( params: { $Order: S868.Order } ) {
 
 -- A: Params omitted, call sits inside a DataView on the parameter's entity
 create page S868.PageOmitted (
-  params: { $Order: S868.Order }, title: 'A', layout: Atlas_Core.Atlas_Default
+  params: ( $Order: S868.Order ), title: 'A', layout: Atlas_Core.Atlas_Default
 ) {
   layoutgrid g { row r { column c (desktopwidth: 12) {
     dataview dvOrder (datasource: $Order) {
@@ -49,20 +49,20 @@ create page S868.PageOmitted (
 
 -- B: $currentObject named explicitly — same meaning, same output
 create page S868.PageCurrentObject (
-  params: { $Order: S868.Order }, title: 'B', layout: Atlas_Core.Atlas_Default
+  params: ( $Order: S868.Order ), title: 'B', layout: Atlas_Core.Atlas_Default
 ) {
   layoutgrid g { row r { column c (desktopwidth: 12) {
     dataview dvOrder (datasource: $Order) {
-      snippetcall scActions (snippet: S868.OrderActions, params: {Order: $currentObject})
+      snippetcall scActions (snippet: S868.OrderActions, params: (Order = $currentObject))
     }
   } } }
 }
 
 -- C: a real page parameter — the form that already worked
 create page S868.PageRealParam (
-  params: { $Order: S868.Order }, title: 'C', layout: Atlas_Core.Atlas_Default
+  params: ( $Order: S868.Order ), title: 'C', layout: Atlas_Core.Atlas_Default
 ) {
   layoutgrid g { row r { column c (desktopwidth: 12) {
-    snippetcall scActions (snippet: S868.OrderActions, params: {Order: $Order})
+    snippetcall scActions (snippet: S868.OrderActions, params: (Order = $Order))
   } } }
 }
diff --git a/mdl-examples/bug-tests/928-widget-binding-gaps.mdl b/mdl-examples/bug-tests/928-widget-binding-gaps.mdl
index ba2ce80513..4d8cad844d 100644
--- a/mdl-examples/bug-tests/928-widget-binding-gaps.mdl
+++ b/mdl-examples/bug-tests/928-widget-binding-gaps.mdl
@@ -46,12 +46,12 @@ create or modify page BugTest928.Catalogue (
 
     -- The control: a built-in widget with the same syntax. This always worked,
     -- and is what showed the defect was specific to the pluggable path.
-    DYNAMICTEXT dt ( Content: '{1}', ContentParams: [{1} = PictureUrl] )
+    DYNAMICTEXT dt ( Content: '{1}', ContentParams: ({1} = PictureUrl) )
 
     -- Bug 1, the reported form: numeric placeholder + explicit contentparams.
     PLUGGABLEWIDGET 'com.mendix.widget.web.image.Image' cardImage (
       datasource: imageUrl,
-      imageUrl: '{1}', contentparams: [{1} = PictureUrl]
+      imageUrl: '{1}', contentparams: ({1} = PictureUrl)
     )
 
     -- The same binding in the `{AttrName}` spelling, which already worked and
diff --git a/mdl-examples/bug-tests/928-widget-binding-warnings.mdl b/mdl-examples/bug-tests/928-widget-binding-warnings.mdl
index f1792c110d..0e25fcc67d 100644
--- a/mdl-examples/bug-tests/928-widget-binding-warnings.mdl
+++ b/mdl-examples/bug-tests/928-widget-binding-warnings.mdl
@@ -43,7 +43,7 @@ create or modify page BugTest928.Warnings (
     -- MDL-WIDGET21: parameters with no placeholder to fill.
     PLUGGABLEWIDGET 'com.mendix.widget.web.image.Image' imgNoPlaceholder (
       datasource: imageUrl,
-      imageUrl: 'static.png', contentparams: [{1} = PictureUrl]
+      imageUrl: 'static.png', contentparams: ({1} = PictureUrl)
     )
   }
 }
diff --git a/mdl-examples/bug-tests/935-customcontent-column-entity-context.mdl b/mdl-examples/bug-tests/935-customcontent-column-entity-context.mdl
index 018f17e1e5..a9047bc0ef 100644
--- a/mdl-examples/bug-tests/935-customcontent-column-entity-context.mdl
+++ b/mdl-examples/bug-tests/935-customcontent-column-entity-context.mdl
@@ -57,7 +57,7 @@ create or replace page Sample.Order_Overview (
     column colNo (caption: 'Order', attribute: OrderNo)
     column colCust (caption: 'Customer', ShowContentAs: customContent) {
       container ctnCust {
-        dynamictext txtCust (content: '{1}', contentparams: [{1} = Sample.Order_Customer/Sample.Customer_Country/CountryName])
+        dynamictext txtCust (content: '{1}', contentparams: ({1} = Sample.Order_Customer/Sample.Customer_Country/CountryName))
       }
     }
   }
@@ -69,6 +69,6 @@ create or replace page Sample.Order_Overview (
 -- context bug.
 alter page Sample.Order_Overview {
   insert into ctnCust {
-    dynamictext txtCust2 (content: '{1}', contentparams: [{1} = Sample.Order_Customer/Sample.Customer_Country/CountryName])
+    dynamictext txtCust2 (content: '{1}', contentparams: ({1} = Sample.Order_Customer/Sample.Customer_Country/CountryName))
   }
 };
diff --git a/mdl-examples/bug-tests/939-showpage-argument-ignored.mdl b/mdl-examples/bug-tests/939-showpage-argument-ignored.mdl
index 1ac6069973..174fd4db6a 100644
--- a/mdl-examples/bug-tests/939-showpage-argument-ignored.mdl
+++ b/mdl-examples/bug-tests/939-showpage-argument-ignored.mdl
@@ -17,7 +17,7 @@ create or modify entity PgArg.Car (
 create or modify page PgArg.Detail (
   Title: 'Detail',
   Layout: Atlas_Core.Atlas_Default,
-  Params: { $Car: PgArg.Car }
+  Params: ( $Car: PgArg.Car )
 ) {
   dataview dvDetail (DataSource: $Car) {
     textbox tbName (Attribute: Name)
@@ -42,7 +42,7 @@ create or modify page PgArg.Overview (
 create or modify page PgArg.Caller (
   Title: 'Caller',
   Layout: Atlas_Core.Atlas_Default,
-  Params: { $Car: PgArg.Car }
+  Params: ( $Car: PgArg.Car )
 ) {
   dataview dvCar (DataSource: $Car) {
     actionbutton btnGo (
diff --git a/mdl-examples/bug-tests/941-describe-page-datasources.mdl b/mdl-examples/bug-tests/941-describe-page-datasources.mdl
index 860cb1fbe5..89f51ba39f 100644
--- a/mdl-examples/bug-tests/941-describe-page-datasources.mdl
+++ b/mdl-examples/bug-tests/941-describe-page-datasources.mdl
@@ -40,7 +40,7 @@ end;
 -- the listview's survived. Both are in one page so the asymmetry is visible.
 create or modify page Bug941.PgContext
   ( Title: 'Context sources', Layout: Atlas_Core.PopupLayout,
-    Params: { $Bucket: Bug941.Bucket } )
+    Params: ( $Bucket: Bug941.Bucket ) )
 {
   dataview dvBucket (DataSource: $Bucket) {
     listview lvAssoc (DataSource: $currentObject/Bug941.Item_Bucket) {
diff --git a/mdl-examples/bug-tests/956-fileuploader-six-action-slots.mdl b/mdl-examples/bug-tests/956-fileuploader-six-action-slots.mdl
index 7f21a423e0..f183240d8c 100644
--- a/mdl-examples/bug-tests/956-fileuploader-six-action-slots.mdl
+++ b/mdl-examples/bug-tests/956-fileuploader-six-action-slots.mdl
@@ -73,7 +73,7 @@ end
 -- Page 1 — uploadMode: files. Visible slots: createFileAction,
 -- onUploadSuccessFile, onUploadFailureFile.
 create or replace page FU.P_Files (Title: 'Files', Layout: Atlas_Core.Atlas_Default,
-  Params: { $Ctx: FU.UploadCtx })
+  Params: ( $Ctx: FU.UploadCtx ))
 {
   DATAVIEW dv (DataSource: $Ctx) {
     pluggablewidget 'com.mendix.widget.web.fileuploader.FileUploader' fu (
@@ -88,7 +88,7 @@ create or replace page FU.P_Files (Title: 'Files', Layout: Atlas_Core.Atlas_Defa
 
 -- Page 2 — uploadMode: images. The other half of the pairs.
 create or replace page FU.P_Images (Title: 'Images', Layout: Atlas_Core.Atlas_Default,
-  Params: { $Ctx: FU.UploadCtx })
+  Params: ( $Ctx: FU.UploadCtx ))
 {
   DATAVIEW dv (DataSource: $Ctx) {
     pluggablewidget 'com.mendix.widget.web.fileuploader.FileUploader' fu (
diff --git a/mdl-examples/bug-tests/978-gallery-slot-names-not-duplicates.mdl b/mdl-examples/bug-tests/978-gallery-slot-names-not-duplicates.mdl
index 41e1ce3a76..445349ff49 100644
--- a/mdl-examples/bug-tests/978-gallery-slot-names-not-duplicates.mdl
+++ b/mdl-examples/bug-tests/978-gallery-slot-names-not-duplicates.mdl
@@ -31,15 +31,15 @@ create page MyFirstModule.Bug978Galleries (
   layout: Atlas_Core.Atlas_Default
 ) {
   gallery g1 (datasource: database MyFirstModule.Bug978Item) {
-    template template1 { dynamictext t1 (content: '{1}', contentparams: [{1} = Name]) }
+    template template1 { dynamictext t1 (content: '{1}', contentparams: ({1} = Name)) }
   }
   gallery g2 (datasource: database MyFirstModule.Bug978Item) {
-    template template1 { dynamictext t2 (content: '{1}', contentparams: [{1} = Name]) }
+    template template1 { dynamictext t2 (content: '{1}', contentparams: ({1} = Name)) }
   }
   gallery g3 (datasource: database MyFirstModule.Bug978Item) {
-    template template1 { dynamictext t3 (content: '{1}', contentparams: [{1} = Name]) }
+    template template1 { dynamictext t3 (content: '{1}', contentparams: ({1} = Name)) }
   }
   gallery g4 (datasource: database MyFirstModule.Bug978Item) {
-    template template1 { dynamictext t4 (content: '{1}', contentparams: [{1} = Name]) }
+    template template1 { dynamictext t4 (content: '{1}', contentparams: ({1} = Name)) }
   }
 }
diff --git a/mdl-examples/bug-tests/989-navigation-title-override.mdl b/mdl-examples/bug-tests/989-navigation-title-override.mdl
index f21ec53dd2..479ccb5c19 100644
--- a/mdl-examples/bug-tests/989-navigation-title-override.mdl
+++ b/mdl-examples/bug-tests/989-navigation-title-override.mdl
@@ -121,13 +121,13 @@ create page Issue989.NavLogin (
 create or replace navigation Responsive
   home page Issue989.NavHome
   login page Issue989.NavLogin
-  menu (
-    menu item 'Home' page Issue989.NavHome;
-    menu 'Admin' (
-      menu item 'Reports' page Issue989.NavReports;
-      menu item 'Settings' page Issue989.NavSettings;
-    );
-  );
+  {
+    menu item 'Home' ( OnClick: show page Issue989.NavHome )
+    menu 'Admin' {
+      menu item 'Reports' ( OnClick: show page Issue989.NavReports )
+      menu item 'Settings' ( OnClick: show page Issue989.NavSettings )
+    }
+  };
 
 -- A microflow action and a sub-menu container write Forms$MicroflowAction /
 -- Forms$NoAction, which carry no FormSettings -- included so the TextTemplate
@@ -141,13 +141,13 @@ end;
 create or replace navigation Responsive
   home page Issue989.NavHome
   login page Issue989.NavLogin
-  menu (
-    menu item 'Home' page Issue989.NavHome;
-    menu item 'Run' microflow Issue989.DoNothing;
-    menu 'Admin' (
-      menu item 'Reports' page Issue989.NavReports;
-      menu item 'Settings' page Issue989.NavSettings;
-    );
-  );
+  {
+    menu item 'Home' ( OnClick: show page Issue989.NavHome )
+    menu item 'Run' ( OnClick: call microflow Issue989.DoNothing )
+    menu 'Admin' {
+      menu item 'Reports' ( OnClick: show page Issue989.NavReports )
+      menu item 'Settings' ( OnClick: show page Issue989.NavSettings )
+    }
+  };
 
 describe navigation Responsive;
diff --git a/mdl-examples/bug-tests/alter-page-bare-attributeref-refused.mdl b/mdl-examples/bug-tests/alter-page-bare-attributeref-refused.mdl
index 1a44751049..bb5a7967f8 100644
--- a/mdl-examples/bug-tests/alter-page-bare-attributeref-refused.mdl
+++ b/mdl-examples/bug-tests/alter-page-bare-attributeref-refused.mdl
@@ -50,7 +50,7 @@ alter page MyFirstModule.AlterBareDraft_Example {
     image imgQualified (
       ImageType: imageUrl,
       ImageUrl: '{1}',
-      ImageUrlParams: [{1} = MyFirstModule.AlterBareDraft.PictureUrl]
+      ImageUrlParams: ({1} = MyFirstModule.AlterBareDraft.PictureUrl)
     )
   }
 };
diff --git a/mdl-examples/bug-tests/alter-page-lowercase-set-on-builtin.mdl b/mdl-examples/bug-tests/alter-page-lowercase-set-on-builtin.mdl
index 4d2ab2b30b..8ed9f42aab 100644
--- a/mdl-examples/bug-tests/alter-page-lowercase-set-on-builtin.mdl
+++ b/mdl-examples/bug-tests/alter-page-lowercase-set-on-builtin.mdl
@@ -41,7 +41,7 @@ create or replace page MyFirstModule.P_LowerSet
 (
   Title: 'Lowercase Set',
   Layout: Atlas_Core.Atlas_Default,
-  Params: { $Row: MyFirstModule.Row }
+  Params: ( $Row: MyFirstModule.Row )
 )
 {
   dataview dv (datasource: $Row) {
diff --git a/mdl-examples/bug-tests/alter-page-unscoped-insert-bindings.mdl b/mdl-examples/bug-tests/alter-page-unscoped-insert-bindings.mdl
index 24c0891e8d..3b7c00a418 100644
--- a/mdl-examples/bug-tests/alter-page-unscoped-insert-bindings.mdl
+++ b/mdl-examples/bug-tests/alter-page-unscoped-insert-bindings.mdl
@@ -39,7 +39,7 @@ create persistent entity BugTestAlterScope.Draft (
 @excluded
 create or modify page BugTestAlterScope.Draft_Example
 ( Title: 'Draft (example)', Layout: Atlas_Core.Atlas_Default,
-  Params: { $Draft: BugTestAlterScope.Draft } )
+  Params: ( $Draft: BugTestAlterScope.Draft ) )
 {
   container ctTop {
     dynamictext txtIntro (Content: 'Example')
@@ -62,7 +62,7 @@ create or modify page BugTestAlterScope.Draft_Example
 -- Inside the data view whose flow is missing: the binding must be qualified.
 alter page BugTestAlterScope.Draft_Example {
   insert after txtSubject {
-    dynamictext txtEcho (Content: 'About: {1}', ContentParams: [{1} = BugTestAlterScope.Draft.Subject])
+    dynamictext txtEcho (Content: 'About: {1}', ContentParams: ({1} = BugTestAlterScope.Draft.Subject))
   }
 };
 /
@@ -70,7 +70,7 @@ alter page BugTestAlterScope.Draft_Example {
 -- Inside a data view whose entity is known: a bare name is fine.
 alter page BugTestAlterScope.Draft_Example {
   insert after txtSubject2 {
-    dynamictext txtEcho2 (Content: 'About: {1}', ContentParams: [{1} = Subject])
+    dynamictext txtEcho2 (Content: 'About: {1}', ContentParams: ({1} = Subject))
   }
 };
 /
diff --git a/mdl-examples/bug-tests/alter-styling-renamed-design-property.mdl b/mdl-examples/bug-tests/alter-styling-renamed-design-property.mdl
index df6f1812df..678db40845 100644
--- a/mdl-examples/bug-tests/alter-styling-renamed-design-property.mdl
+++ b/mdl-examples/bug-tests/alter-styling-renamed-design-property.mdl
@@ -36,7 +36,7 @@ create or replace page MyFirstModule.StylingRenamed_Test
 -- The current name, written the way the warning says: 0 errors.
 alter page MyFirstModule.StylingRenamed_Test {
   replace cntBody with {
-    container cntBody (DesignProperties: ['Spacing': ['margin-bottom': 'M']]) {
+    container cntBody (DesignProperties: ('Spacing': ('margin-bottom': 'M'))) {
       dynamictext txtSpaced (Content: 'Hello')
     }
   }
diff --git a/mdl-examples/bug-tests/alterpage-527-set-documentation.mdl b/mdl-examples/bug-tests/alterpage-527-set-documentation.mdl
index d34247b19a..11aca8658f 100644
--- a/mdl-examples/bug-tests/alterpage-527-set-documentation.mdl
+++ b/mdl-examples/bug-tests/alterpage-527-set-documentation.mdl
@@ -30,7 +30,7 @@ create persistent entity Issue527.ServiceRequest (
  */
 create or replace page Issue527.ServiceRequest_Triage (
   title: 'Triage',
-  params: { $Request: Issue527.ServiceRequest }
+  params: ( $Request: Issue527.ServiceRequest )
 )
 {
   dataview dvMain (datasource: $Request) {
diff --git a/mdl-examples/bug-tests/assoc-datasource-modelsdk.mdl b/mdl-examples/bug-tests/assoc-datasource-modelsdk.mdl
index ae87fc0c3f..197e17aa66 100644
--- a/mdl-examples/bug-tests/assoc-datasource-modelsdk.mdl
+++ b/mdl-examples/bug-tests/assoc-datasource-modelsdk.mdl
@@ -40,7 +40,7 @@ create association MyFirstModule.Expense_Employee
   from MyFirstModule.Expense to MyFirstModule.Employee;
 
 create or replace page MyFirstModule.MasterDetail
-( Title: 'Master Detail', Layout: Atlas_Core.Atlas_Default, Params: { $Employee: MyFirstModule.Employee } )
+( Title: 'Master Detail', Layout: Atlas_Core.Atlas_Default, Params: ( $Employee: MyFirstModule.Employee ) )
 {
   dataview dvEmp (datasource: $Employee) {
     dynamictext hName (content: 'Employee')
diff --git a/mdl-examples/bug-tests/assoc-datasource-page-level.mdl b/mdl-examples/bug-tests/assoc-datasource-page-level.mdl
index 60ec8c3719..b746dbf58e 100644
--- a/mdl-examples/bug-tests/assoc-datasource-page-level.mdl
+++ b/mdl-examples/bug-tests/assoc-datasource-page-level.mdl
@@ -49,7 +49,7 @@ create or modify association AssocDS.Order_Customer
 -- association is traversed from is `$Customer`. This is the reported case.
 create or replace page AssocDS.P_PageLevel
 (
-  params: { $Customer: AssocDS.Customer },
+  params: ( $Customer: AssocDS.Customer ),
   title: 'Orders for a customer',
   layout: Atlas_Core.Atlas_Default
 )
@@ -65,7 +65,7 @@ create or replace page AssocDS.P_PageLevel
 -- named, and leaves the enclosing-entity path alone.
 create or replace page AssocDS.P_InDataView
 (
-  params: { $Customer: AssocDS.Customer },
+  params: ( $Customer: AssocDS.Customer ),
   title: 'Same thing, enclosed',
   layout: Atlas_Core.Atlas_Default
 )
@@ -90,7 +90,7 @@ create or replace page AssocDS.P_InDataView
 -- reason.
 create or replace page AssocDS.P_Reverse
 (
-  params: { $Order: AssocDS.Order },
+  params: ( $Order: AssocDS.Order ),
   title: 'The other way',
   layout: Atlas_Core.Atlas_Default
 )
diff --git a/mdl-examples/bug-tests/bug1-widget-action-param-mapping.mdl b/mdl-examples/bug-tests/bug1-widget-action-param-mapping.mdl
index c4de39f4e5..06ad8a5e8b 100644
--- a/mdl-examples/bug-tests/bug1-widget-action-param-mapping.mdl
+++ b/mdl-examples/bug-tests/bug1-widget-action-param-mapping.mdl
@@ -35,7 +35,7 @@ create microflow BugOne.ACT_Edit ($Form: BugOne.ExpenseForm)
 /
 
 create or replace page BugOne.P
-( params: { $Form: BugOne.ExpenseForm }, title: 'Bug 1', layout: Atlas_Core.Atlas_Default )
+( params: ( $Form: BugOne.ExpenseForm ), title: 'Bug 1', layout: Atlas_Core.Atlas_Default )
 {
   dataview dv (datasource: $Form) {
     actionbutton b1 (Caption: 'Submit', Action: microflow BugOne.ACT_Submit(Form: $Form))
diff --git a/mdl-examples/bug-tests/bug2-modelsdk-nanoflow-widget-action.mdl b/mdl-examples/bug-tests/bug2-modelsdk-nanoflow-widget-action.mdl
index b62754c5bb..87574d3b0f 100644
--- a/mdl-examples/bug-tests/bug2-modelsdk-nanoflow-widget-action.mdl
+++ b/mdl-examples/bug-tests/bug2-modelsdk-nanoflow-widget-action.mdl
@@ -23,7 +23,7 @@ create nanoflow  Bug2.NAV_Test ( Form: Bug2.Expense ) begin end
 create microflow Bug2.ACT_Test ( Form: Bug2.Expense ) begin end
 
 create or replace page Bug2.P (
-  params: { $Form: Bug2.Expense },
+  params: ( $Form: Bug2.Expense ),
   title: 'x',
   layout: Atlas_Core.Atlas_Default
 ) {
diff --git a/mdl-examples/bug-tests/bug3-contentparam-inherited-association.mdl b/mdl-examples/bug-tests/bug3-contentparam-inherited-association.mdl
index 8de34405c6..847843ed7a 100644
--- a/mdl-examples/bug-tests/bug3-contentparam-inherited-association.mdl
+++ b/mdl-examples/bug-tests/bug3-contentparam-inherited-association.mdl
@@ -41,7 +41,7 @@ create or replace page MyFirstModule.InheritedAssocPage
         datagrid dg (DataSource: database from MyFirstModule.SpecialExpense, Selection: Single) {
           column colEmp (Caption: 'Employee') {
             dynamictext dEmp (content: 'Submitted by {1}',
-              contentparams: [{1} = MyFirstModule.Expense_Employee/Name])
+              contentparams: ({1} = MyFirstModule.Expense_Employee/Name))
           }
         }
       }
diff --git a/mdl-examples/bug-tests/bug8-datagrid-gallery-sort-desc.mdl b/mdl-examples/bug-tests/bug8-datagrid-gallery-sort-desc.mdl
index 763b308066..187d65b2fc 100644
--- a/mdl-examples/bug-tests/bug8-datagrid-gallery-sort-desc.mdl
+++ b/mdl-examples/bug-tests/bug8-datagrid-gallery-sort-desc.mdl
@@ -45,7 +45,7 @@ create page BugTests.Bug8Sort (
           DataSource: database from Administration.Account sort by "Email" desc
         ) {
           template tpl1 {
-            dynamictext t1 (Content: '{1}', ContentParams: [{1} = Email])
+            dynamictext t1 (Content: '{1}', ContentParams: ({1} = Email))
           }
         }
       }
diff --git a/mdl-examples/bug-tests/captrack-10-sign-out-menu-item.mdl b/mdl-examples/bug-tests/captrack-10-sign-out-menu-item.mdl
index 5a12bbb900..5417897bbd 100644
--- a/mdl-examples/bug-tests/captrack-10-sign-out-menu-item.mdl
+++ b/mdl-examples/bug-tests/captrack-10-sign-out-menu-item.mdl
@@ -37,18 +37,18 @@ create or replace page SignOutMenu.Home (Title: 'Home', Layout: Atlas_Core.Atlas
 }
 /
 
-create or modify menu SignOutMenu.Account_Menu (
-  menu item 'Home' page SignOutMenu.Home;
+create or modify menu SignOutMenu.Account_Menu {
+  menu item 'Home' ( OnClick: show page SignOutMenu.Home )
 
   -- The item that could not be spelled.
-  menu item 'Sign out' sign_out;
+  menu item 'Sign out' ( OnClick: sign_out )
 
   -- SIGN_OUT names no target, so it must not disturb the qualified-name list it
   -- shares with PAGE/MICROFLOW and ICON — an icon after it still lands as one.
-  menu item 'Log out' sign_out icon Atlas_Core.Atlas.home;
+  menu item 'Log out' ( OnClick: sign_out, Icon: Atlas_Core.Atlas.home )
 
   -- CONTROL: an item with no action must stay actionless. A conversion that
   -- stamped every actionless item as sign-out would look correct above.
-  menu item 'Plain';
-);
+  menu item 'Plain'
+};
 /
diff --git a/mdl-examples/bug-tests/compound-design-property-marker.mdl b/mdl-examples/bug-tests/compound-design-property-marker.mdl
index 79d35eb1bc..1ffeed6f17 100644
--- a/mdl-examples/bug-tests/compound-design-property-marker.mdl
+++ b/mdl-examples/bug-tests/compound-design-property-marker.mdl
@@ -32,7 +32,7 @@ create page BugCompoundDPMarker.SpacingPage (
   title: 'Spacing Page',
   layout: Atlas_Core.Atlas_Default
 ) {
-  container container1 (designproperties: ['Spacing': ['margin-bottom': 'None']]) {
+  container container1 (designproperties: ('Spacing': ('margin-bottom': 'None'))) {
     dynamictext text1 (content: 'Spaced')
   }
 }
diff --git a/mdl-examples/bug-tests/compound-designproperties.mdl b/mdl-examples/bug-tests/compound-designproperties.mdl
index d78532bd0e..3bbf2411d4 100644
--- a/mdl-examples/bug-tests/compound-designproperties.mdl
+++ b/mdl-examples/bug-tests/compound-designproperties.mdl
@@ -20,10 +20,10 @@ create page BugCompoundDP.SpacingCard (
   title: 'Spacing Card',
   layout: Atlas_Core.Atlas_Default
 ) {
-  container card1 (designproperties: [
+  container card1 (designproperties: (
     'Card style': on,
-    'Spacing': ['margin-bottom': 'Large', 'margin-top': 'Medium']
-  ]) {
+    'Spacing': ('margin-bottom': 'Large', 'margin-top': 'Medium')
+  )) {
     dynamictext title1 (content: 'Title', rendermode: H4, class: 'card-title')
   }
 }
diff --git a/mdl-examples/bug-tests/contentparam-expression-rejected.fail.mdl b/mdl-examples/bug-tests/contentparam-expression-rejected.fail.mdl
index 3c447a02e1..43b4e6599e 100644
--- a/mdl-examples/bug-tests/contentparam-expression-rejected.fail.mdl
+++ b/mdl-examples/bug-tests/contentparam-expression-rejected.fail.mdl
@@ -28,11 +28,11 @@ create or replace page MyFirstModule.ReportPage
 (
   Title: 'Report',
   Layout: Atlas_Core.Atlas_Default,
-  Params: { $Report: MyFirstModule.Report }
+  Params: ( $Report: MyFirstModule.Report )
 )
 {
   dataview dv (datasource: $Report) {
     -- Expression in a data-binding slot → MDL-WIDGET14 (CE1613 in Studio Pro).
-    dynamictext dImport (content: 'Last import: {1}', contentparams: [{1} = formatDateTime($currentObject/LastImport, 'd MMM yyyy')])
+    dynamictext dImport (content: 'Last import: {1}', contentparams: ({1} = formatDateTime($currentObject/LastImport, 'd MMM yyyy')))
   }
 }
diff --git a/mdl-examples/bug-tests/datagrid-filter-block-dropped-silently.mdl b/mdl-examples/bug-tests/datagrid-filter-block-dropped-silently.mdl
index b66ce5f921..daaae5089d 100644
--- a/mdl-examples/bug-tests/datagrid-filter-block-dropped-silently.mdl
+++ b/mdl-examples/bug-tests/datagrid-filter-block-dropped-silently.mdl
@@ -90,7 +90,7 @@ create page VFilterDrop.MeterGallery (
       textfilter fGalCode (attribute: MeterCode)
     }
     template galTemplate {
-      dynamictext txtCode (content: '{1}', contentparams: [{1} = MeterCode])
+      dynamictext txtCode (content: '{1}', contentparams: ({1} = MeterCode))
     }
   }
 }
diff --git a/mdl-examples/bug-tests/datagrid2-custom-content-column.mdl b/mdl-examples/bug-tests/datagrid2-custom-content-column.mdl
index 6745f66568..d9a709a707 100644
--- a/mdl-examples/bug-tests/datagrid2-custom-content-column.mdl
+++ b/mdl-examples/bug-tests/datagrid2-custom-content-column.mdl
@@ -40,7 +40,7 @@ create or replace page MyFirstModule.DGOverview
     column colDesc (caption: 'Description', attribute: Description)
     -- custom content: a dynamictext binding an attribute over an association
     column colEmployee (caption: 'Submitted by') {
-      dynamictext dtEmp (content: '{1}', contentparams: [{1} = MyFirstModule.Expense_Employee/Name])
+      dynamictext dtEmp (content: '{1}', contentparams: ({1} = MyFirstModule.Expense_Employee/Name))
     }
     -- custom content: an action button
     column colOpen (caption: 'Actions') {
diff --git a/mdl-examples/bug-tests/dataview-context-association-source.mdl b/mdl-examples/bug-tests/dataview-context-association-source.mdl
index 272895b82a..495a4ea8c3 100644
--- a/mdl-examples/bug-tests/dataview-context-association-source.mdl
+++ b/mdl-examples/bug-tests/dataview-context-association-source.mdl
@@ -36,7 +36,7 @@ create association MyFirstModule.Expense_Employee
   from MyFirstModule.Expense to MyFirstModule.Employee;
 
 create or replace page MyFirstModule.Expense_NewEdit
-( Title: 'Expense', Layout: Atlas_Core.Atlas_Default, Params: { $Expense: MyFirstModule.Expense } )
+( Title: 'Expense', Layout: Atlas_Core.Atlas_Default, Params: ( $Expense: MyFirstModule.Expense ) )
 {
   dataview dvExpense (datasource: $Expense) {
     textbox tbDesc (label: 'Description', attribute: Description)
diff --git a/mdl-examples/bug-tests/dataview-database-source-rejected.fail.mdl b/mdl-examples/bug-tests/dataview-database-source-rejected.fail.mdl
index 16d238b441..8069987100 100644
--- a/mdl-examples/bug-tests/dataview-database-source-rejected.fail.mdl
+++ b/mdl-examples/bug-tests/dataview-database-source-rejected.fail.mdl
@@ -22,6 +22,6 @@ create or replace page MyFirstModule.BadDatabaseDataView
 ( Title: 'Bad', Layout: Atlas_Core.Atlas_Default )
 {
   dataview dvBad (datasource: database from MyFirstModule.Expense) {
-    dynamictext t (content: 'by {1}', contentparams: [{1} = MyFirstModule.Expense_Employee/Name])
+    dynamictext t (content: 'by {1}', contentparams: ({1} = MyFirstModule.Expense_Employee/Name))
   }
 }
diff --git a/mdl-examples/bug-tests/dbconn-literal-credentials.fail.mdl b/mdl-examples/bug-tests/dbconn-literal-credentials.fail.mdl
index 78bd77231c..d5bcdaee52 100644
--- a/mdl-examples/bug-tests/dbconn-literal-credentials.fail.mdl
+++ b/mdl-examples/bug-tests/dbconn-literal-credentials.fail.mdl
@@ -21,8 +21,9 @@
 
 create module BadConn;
 
-create database connection BadConn.Conn
-  type 'PostgreSQL'
-  connection string 'jdbc:postgresql://localhost:5432/app'
-  username 'app'
-  password 'secret';
+create database connection BadConn.Conn (
+  Type: 'PostgreSQL',
+  ConnectionString: 'jdbc:postgresql://localhost:5432/app',
+  Username: 'app',
+  Password: 'secret'
+);
diff --git a/mdl-examples/bug-tests/describe-dynamictext-nonstring-attribute.mdl b/mdl-examples/bug-tests/describe-dynamictext-nonstring-attribute.mdl
index f562aff05e..058946b13a 100644
--- a/mdl-examples/bug-tests/describe-dynamictext-nonstring-attribute.mdl
+++ b/mdl-examples/bug-tests/describe-dynamictext-nonstring-attribute.mdl
@@ -33,7 +33,7 @@ create or replace page MyFirstModule.P_NonStringRT
 (
   Title: 'Non-string round-trip',
   Layout: Atlas_Core.Atlas_Default,
-  Params: { $Counter: MyFirstModule.Counter }
+  Params: ( $Counter: MyFirstModule.Counter )
 )
 {
   dataview dv (datasource: $Counter) {
diff --git a/mdl-examples/bug-tests/describe-label-widget.mdl b/mdl-examples/bug-tests/describe-label-widget.mdl
index d5dd628641..6b9070db40 100644
--- a/mdl-examples/bug-tests/describe-label-widget.mdl
+++ b/mdl-examples/bug-tests/describe-label-widget.mdl
@@ -27,7 +27,7 @@ create or replace page MyFirstModule.LabelWidget_Test
 {
   label lblPlain (Content: 'Attachment')
   label lblStyled (Content: 'Provisioned elsewhere', Class: 'alert alert-warning', Style: 'width:100%;')
-  label lblSpaced (Content: 'Spaced', Class: 'text-semibold', DesignProperties: ['Spacing': ['margin-bottom': 'None']])
+  label lblSpaced (Content: 'Spaced', Class: 'text-semibold', DesignProperties: ('Spacing': ('margin-bottom': 'None')))
 }
 /
 
diff --git a/mdl-examples/bug-tests/describe-roundtrip-705-carried-properties.mdl b/mdl-examples/bug-tests/describe-roundtrip-705-carried-properties.mdl
index 8185d8c443..5c0146a894 100644
--- a/mdl-examples/bug-tests/describe-roundtrip-705-carried-properties.mdl
+++ b/mdl-examples/bug-tests/describe-roundtrip-705-carried-properties.mdl
@@ -44,7 +44,7 @@ CREATE OR REPLACE SNIPPET Bug705.SN_Header {
 CREATE OR REPLACE PAGE Bug705.Note_Edit (
   Title: 'Edit note',
   Layout: Atlas_Core.PopupLayout,
-  Params: { $Note: Bug705.Note }
+  Params: ( $Note: Bug705.Note )
 ) {
   layoutgrid lgBody {
     row r1 {
diff --git a/mdl-examples/bug-tests/design-property-keyword-mappings.mdl b/mdl-examples/bug-tests/design-property-keyword-mappings.mdl
index c62cf8d055..e6e5b30f81 100644
--- a/mdl-examples/bug-tests/design-property-keyword-mappings.mdl
+++ b/mdl-examples/bug-tests/design-property-keyword-mappings.mdl
@@ -36,24 +36,24 @@ create or replace page MyFirstModule.DesignPropKeywords_Test
 ( Title: 'Design property keyword mappings', Layout: Atlas_Core.Atlas_Default )
 {
   container c1 {
-    groupbox gbCustom (Caption: 'Custom', DesignProperties: ['Style': '#ff0000', 'Callout style': on]) {
+    groupbox gbCustom (Caption: 'Custom', DesignProperties: ('Style': '#ff0000', 'Callout style': on)) {
       dynamictext t1 (Content: 'x')
     }
-    groupbox gbSwatch (Caption: 'Swatch', DesignProperties: ['Style': 'Brand Primary']) {
+    groupbox gbSwatch (Caption: 'Swatch', DesignProperties: ('Style': 'Brand Primary')) {
       dynamictext t2 (Content: 'y')
     }
-    tabcontainer tc1 (DesignProperties: ['Style': 'Pills', 'Tab position': 'Center', 'Justify': on]) {
+    tabcontainer tc1 (DesignProperties: ('Style': 'Pills', 'Tab position': 'Center', 'Justify': on)) {
       tabpage tp1 (Caption: 'One') {
         dynamictext t3 (Content: 'z')
       }
     }
-    navigationtree nt1 (profile: 'Responsive', DesignProperties: ['Hide icons': on])
-    row r1 (DesignProperties: ['Background color': '#00ff00']) {
+    navigationtree nt1 (profile: 'Responsive', DesignProperties: ('Hide icons': on))
+    row r1 (DesignProperties: ('Background color': '#00ff00')) {
       column rc1 {
         dynamictext t4 (Content: 'r')
       }
     }
-    column k1 (DesignProperties: ['Background color': '#0000ff', 'Card style': on]) {
+    column k1 (DesignProperties: ('Background color': '#0000ff', 'Card style': on)) {
       dynamictext t5 (Content: 'k')
     }
   }
diff --git a/mdl-examples/bug-tests/dynamictext-contentparam-association.mdl b/mdl-examples/bug-tests/dynamictext-contentparam-association.mdl
index 5af8518fcd..b34ab57856 100644
--- a/mdl-examples/bug-tests/dynamictext-contentparam-association.mdl
+++ b/mdl-examples/bug-tests/dynamictext-contentparam-association.mdl
@@ -47,12 +47,12 @@ create or replace page MyFirstModule.ExpensePage
 (
   Title: 'Expense',
   Layout: Atlas_Core.Atlas_Default,
-  Params: { $Expense: MyFirstModule.Expense }
+  Params: ( $Expense: MyFirstModule.Expense )
 )
 {
   dataview dv (datasource: $Expense) {
     -- Association-navigated template parameter (the fixed case).
-    dynamictext dEmp (content: 'Submitted by {1}', contentparams: [{1} = MyFirstModule.Expense_Employee/Name])
+    dynamictext dEmp (content: 'Submitted by {1}', contentparams: ({1} = MyFirstModule.Expense_Employee/Name))
   }
 }
 
diff --git a/mdl-examples/bug-tests/excluded-page-unresolved-flow-qualified-bindings.mdl b/mdl-examples/bug-tests/excluded-page-unresolved-flow-qualified-bindings.mdl
index 37b8d32ae1..bc6732b5a1 100644
--- a/mdl-examples/bug-tests/excluded-page-unresolved-flow-qualified-bindings.mdl
+++ b/mdl-examples/bug-tests/excluded-page-unresolved-flow-qualified-bindings.mdl
@@ -35,7 +35,7 @@ create or modify page MyFirstModule.FeedbackDraft_Example
 {
   dataview dv (DataSource: nanoflow MyFirstModule.DS_MissingForm) {
     textbox txtSubject (Label: 'Subject', Attribute: MyFirstModule.FeedbackDraft.Subject)
-    dynamictext txtEcho (Content: 'About: {1}', ContentParams: [{1} = MyFirstModule.FeedbackDraft.Subject])
+    dynamictext txtEcho (Content: 'About: {1}', ContentParams: ({1} = MyFirstModule.FeedbackDraft.Subject))
     textbox txtEmail (
       Label: 'Email',
       Attribute: MyFirstModule.FeedbackDraft.Email,
diff --git a/mdl-examples/bug-tests/expr-quoted-identifiers.mdl b/mdl-examples/bug-tests/expr-quoted-identifiers.mdl
index f7b4309907..36c9c726e0 100644
--- a/mdl-examples/bug-tests/expr-quoted-identifiers.mdl
+++ b/mdl-examples/bug-tests/expr-quoted-identifiers.mdl
@@ -55,10 +55,10 @@ end
 
 -- 1b/1c — quoted attributes in widget contentparams and visibility expressions.
 create or replace page MyFirstModule.P_Expense
-( Title: 'Expense', Layout: Atlas_Core.Atlas_Default, Params: { $Expense: MyFirstModule.Expense } )
+( Title: 'Expense', Layout: Atlas_Core.Atlas_Default, Params: ( $Expense: MyFirstModule.Expense ) )
 {
   dataview dv (datasource: $Expense) {
-    dynamictext qAmount (content: '{1}', contentparams: [{1} = "Amount"])
+    dynamictext qAmount (content: '{1}', contentparams: ({1} = "Amount"))
     dynamictext qReview (content: 'Needs review', visible: [ "Amount" > 1000 ])
   }
 }
@@ -68,7 +68,7 @@ create or replace page MyFirstModule.P_Queue
 ( Title: 'Queue', Layout: Atlas_Core.Atlas_Default )
 {
   gallery galQueue (datasource: database from MyFirstModule.Expense where [ "Status" = 'Submitted' ]) {
-    dynamictext qStatus (content: '{1}', contentparams: [{1} = "Status"])
+    dynamictext qStatus (content: '{1}', contentparams: ({1} = "Status"))
   }
 }
 
diff --git a/mdl-examples/bug-tests/expression-text-keyword-operators.mdl b/mdl-examples/bug-tests/expression-text-keyword-operators.mdl
index 57f2a7a104..78c5e7210d 100644
--- a/mdl-examples/bug-tests/expression-text-keyword-operators.mdl
+++ b/mdl-examples/bug-tests/expression-text-keyword-operators.mdl
@@ -23,6 +23,6 @@ end;
 
 create page BugExpr.P (title: 'P', layout: Atlas_Core.Atlas_Default) {
   actionbutton b (caption: 'Go', action: microflow BugExpr.ACT(Flag: true and false, Mode: if true then 'a' else 'b'))
-  dynamictext t (content: 'x {1}', contentparams: [{1} = if true then 'a' else 'b'])
+  dynamictext t (content: 'x {1}', contentparams: ({1} = if true then 'a' else 'b'))
 }
 /
diff --git a/mdl-examples/bug-tests/gallery-1035-paging-position-enum.mdl b/mdl-examples/bug-tests/gallery-1035-paging-position-enum.mdl
index 1d88e5ff37..56fb4a9e7a 100644
--- a/mdl-examples/bug-tests/gallery-1035-paging-position-enum.mdl
+++ b/mdl-examples/bug-tests/gallery-1035-paging-position-enum.mdl
@@ -57,7 +57,7 @@ create or replace page Bug1035.P_LoadMore (
   Layout: Atlas_Core.Atlas_Default
 ) {
   gallery gLoadMore ( DataSource: database from Bug1035.Item, pagination: 'loadMore' ) {
-    template t { dynamictext d (Content: '{1}', ContentParams: [{1} = Name]) }
+    template t { dynamictext d (Content: '{1}', ContentParams: ({1} = Name)) }
   }
 }
 
@@ -66,7 +66,7 @@ create or replace page Bug1035.P_VirtualScrolling (
   Layout: Atlas_Core.Atlas_Default
 ) {
   gallery gVirtual ( DataSource: database from Bug1035.Item, pagination: 'virtualScrolling' ) {
-    template t { dynamictext d (Content: '{1}', ContentParams: [{1} = Name]) }
+    template t { dynamictext d (Content: '{1}', ContentParams: ({1} = Name)) }
   }
 }
 
@@ -77,6 +77,6 @@ create or replace page Bug1035.P_Buttons (
   Layout: Atlas_Core.Atlas_Default
 ) {
   gallery gButtons ( DataSource: database from Bug1035.Item, pagination: 'buttons' ) {
-    template t { dynamictext d (Content: '{1}', ContentParams: [{1} = Name]) }
+    template t { dynamictext d (Content: '{1}', ContentParams: ({1} = Name)) }
   }
 }
diff --git a/mdl-examples/bug-tests/icon-reference-validation.mdl b/mdl-examples/bug-tests/icon-reference-validation.mdl
index 184a9ba016..1c5fb12797 100644
--- a/mdl-examples/bug-tests/icon-reference-validation.mdl
+++ b/mdl-examples/bug-tests/icon-reference-validation.mdl
@@ -55,9 +55,9 @@ create page ICONREF.IconPage ( Title: 'Icons', Layout: 'Atlas_Core.Atlas_Default
 -- (Hyphenated names are double-quoted in this position: Atlas_Core.Atlas."shopping-cart")
 create or replace navigation Responsive
   HOME PAGE ICONREF.IconPage
-  MENU (
-    MENU ITEM 'Home' PAGE ICONREF.IconPage ICON Atlas_Core.Atlas.home;
-    MENU 'Group' ICON Atlas_Core.Atlas."shopping-cart" (
-      MENU ITEM 'Edit' PAGE ICONREF.IconPage ICON Atlas_Core.Atlas_Filled.pencil;
-    );
-  );
+  {
+    MENU ITEM 'Home' ( OnClick: SHOW PAGE ICONREF.IconPage, Icon: Atlas_Core.Atlas.home )
+    MENU 'Group' ( Icon: Atlas_Core.Atlas."shopping-cart" ) {
+      MENU ITEM 'Edit' ( OnClick: SHOW PAGE ICONREF.IconPage, Icon: Atlas_Core.Atlas_Filled.pencil )
+    }
+  };
diff --git a/mdl-examples/bug-tests/icon-refs-1008-placeholder-snippet-layout-menu.mdl b/mdl-examples/bug-tests/icon-refs-1008-placeholder-snippet-layout-menu.mdl
index 5489f56ed9..32a2cf89ad 100644
--- a/mdl-examples/bug-tests/icon-refs-1008-placeholder-snippet-layout-menu.mdl
+++ b/mdl-examples/bug-tests/icon-refs-1008-placeholder-snippet-layout-menu.mdl
@@ -87,11 +87,11 @@ create or replace layout Icon1008.AppFrame
 
 -- 4. A standalone menu document, sub-items included — the same NavMenuItemDef a
 --    navigation profile's menu uses, which is why it needs the same recursion.
-create or modify menu Icon1008.Main_Menu (
-  menu item 'Home' page Icon1008.PlaceholderPage
-    icon Atlas_Core.Atlas_Filled.home;
-  menu 'More' icon Atlas_Core.Atlas_Filled.home (
-    menu item 'Edit' page Icon1008.PlaceholderPage
-      icon Atlas_Core.Atlas_Filled.pencil;
-  );
-);
+create or modify menu Icon1008.Main_Menu {
+  menu item 'Home' ( OnClick: show page Icon1008.PlaceholderPage,
+    Icon: Atlas_Core.Atlas_Filled.home )
+  menu 'More' ( Icon: Atlas_Core.Atlas_Filled.home ) {
+    menu item 'Edit' ( OnClick: show page Icon1008.PlaceholderPage,
+      Icon: Atlas_Core.Atlas_Filled.pencil )
+  }
+};
diff --git a/mdl-examples/bug-tests/input-binding-without-context.mdl b/mdl-examples/bug-tests/input-binding-without-context.mdl
index f819cdba67..570d2f74bf 100644
--- a/mdl-examples/bug-tests/input-binding-without-context.mdl
+++ b/mdl-examples/bug-tests/input-binding-without-context.mdl
@@ -13,7 +13,7 @@ create persistent entity ProbeInBindOk.Person (
 );
 
 create page ProbeInBindOk.Edit (
-  params: { $P: ProbeInBindOk.Person },
+  params: ( $P: ProbeInBindOk.Person ),
   title: 'Edit',
   layout: Atlas_Core.Atlas_Default
 ) {
@@ -41,7 +41,7 @@ create page ProbeInBindOk.Edit (
 
 -- A snippet binds through a data view over its parameter, exactly as a page does.
 create snippet ProbeInBindOk.PersonFields (
-  params: { $P: ProbeInBindOk.Person }
+  params: ( $P: ProbeInBindOk.Person )
 ) {
   dataview sdv (DataSource: $P) {
     textbox sName (Attribute: FullName)
diff --git a/mdl-examples/bug-tests/it-14-assoc-destination-entity.mdl b/mdl-examples/bug-tests/it-14-assoc-destination-entity.mdl
index 4c2b13b665..d7e04dfe32 100644
--- a/mdl-examples/bug-tests/it-14-assoc-destination-entity.mdl
+++ b/mdl-examples/bug-tests/it-14-assoc-destination-entity.mdl
@@ -38,13 +38,13 @@ create association IT14.Issue_Workflow from IT14.Issue to System.Workflow;
 create page IT14.TaskPage (
   Title: 'Task',
   Layout: Atlas_Core.Atlas_Default,
-  Params: { $Task: System.WorkflowUserTask }
+  Params: ( $Task: System.WorkflowUserTask )
 ) {
   layoutgrid g { row r { column c (DesktopWidth: 12) {
     dataview dvWf (datasource: $Task/System.WorkflowUserTask_Workflow) {
       -- Explicit destination: required when the association ends in System.
       gallery galIssue (datasource: $currentObject/IT14.Issue_Workflow/IT14.Issue) {
-        dynamictext t (Content: '{1}', ContentParams: [{1} = Title])
+        dynamictext t (Content: '{1}', ContentParams: ({1} = Title))
       }
     }
   } } }
diff --git a/mdl-examples/bug-tests/it-19-cross-module-attribute-path.mdl b/mdl-examples/bug-tests/it-19-cross-module-attribute-path.mdl
index 55295d839c..8c6e837c2f 100644
--- a/mdl-examples/bug-tests/it-19-cross-module-attribute-path.mdl
+++ b/mdl-examples/bug-tests/it-19-cross-module-attribute-path.mdl
@@ -64,7 +64,7 @@ create or replace page IT19.IssuePage
 (
   Title: 'Issue',
   Layout: Atlas_Core.Atlas_Default,
-  Params: { $Issue: IT19.Issue }
+  Params: ( $Issue: IT19.Issue )
 )
 {
   DATAVIEW dvIssue (DataSource: $Issue) {
diff --git a/mdl-examples/bug-tests/label-design-properties-check.mdl b/mdl-examples/bug-tests/label-design-properties-check.mdl
index edb103395d..480a8a075f 100644
--- a/mdl-examples/bug-tests/label-design-properties-check.mdl
+++ b/mdl-examples/bug-tests/label-design-properties-check.mdl
@@ -28,8 +28,8 @@ create or replace page MyFirstModule.LabelDesignProps_Test
 ( Title: 'Label design properties', Layout: Atlas_Core.Atlas_Default )
 {
   container c1 {
-    label lblOpt (Content: 'Option', DesignProperties: ['Style': 'Brand Primary', 'Align self': 'Left'])
-    label lblSpaced (Content: 'Spaced', DesignProperties: ['Spacing': ['margin-bottom': 'M'], 'Hide on': ['Phone': on]])
+    label lblOpt (Content: 'Option', DesignProperties: ('Style': 'Brand Primary', 'Align self': 'Left'))
+    label lblSpaced (Content: 'Spaced', DesignProperties: ('Spacing': ('margin-bottom': 'M'), 'Hide on': ('Phone': on)))
   }
 }
 /
diff --git a/mdl-examples/bug-tests/language-970-authoring-language.mdl b/mdl-examples/bug-tests/language-970-authoring-language.mdl
index e6d3de02e0..cd57c876fb 100644
--- a/mdl-examples/bug-tests/language-970-authoring-language.mdl
+++ b/mdl-examples/bug-tests/language-970-authoring-language.mdl
@@ -57,7 +57,7 @@ create or replace page MyFirstModule.Issue970Writers
   (
     Title: 'SchrijverTitel',
     Layout: Atlas_Core.Atlas_Default,
-    Params: { $Item: MyFirstModule.Issue970Ent }
+    Params: ( $Item: MyFirstModule.Issue970Ent )
   )
   {
     -- a Label reaches the writer as a bare string (pages.TextBox.Label is a string)
@@ -75,8 +75,8 @@ create or replace page MyFirstModule.Issue970Writers
 -- navigation and menu-document captions are creations, not edits
 create or replace navigation Responsive
   home page MyFirstModule.Issue970Writers
-  menu ( menu item 'Startpagina' page MyFirstModule.Issue970Writers; );
+  { menu item 'Startpagina' ( OnClick: show page MyFirstModule.Issue970Writers ) };
 
-create or modify menu MyFirstModule.Issue970Menu (
-  menu item 'Overzicht' page MyFirstModule.Issue970Writers;
-);
+create or modify menu MyFirstModule.Issue970Menu {
+  menu item 'Overzicht' ( OnClick: show page MyFirstModule.Issue970Writers )
+};
diff --git a/mdl-examples/bug-tests/ledger-147-datasource-arg-data-context.mdl b/mdl-examples/bug-tests/ledger-147-datasource-arg-data-context.mdl
index 7868637ec9..8af56fbf93 100644
--- a/mdl-examples/bug-tests/ledger-147-datasource-arg-data-context.mdl
+++ b/mdl-examples/bug-tests/ledger-147-datasource-arg-data-context.mdl
@@ -100,7 +100,7 @@ create or modify page DS147.TopLevelBad
 -- message names the type that is actually in context.
 create or modify page DS147.NestedWrongType
   ( Title: 'Nested in a mismatched context', Layout: Atlas_Core.Atlas_Default,
-    Params: { $Row: DS147.Row } )
+    Params: ( $Row: DS147.Row ) )
   {
     DATAVIEW dvRow (DataSource: $Row) {
       DATAGRID dgWrong (DataSource: MICROFLOW DS147.DS_Rows) {
@@ -114,7 +114,7 @@ create or modify page DS147.NestedWrongType
 -- the fix is "enclosing data context", not "in scope".
 create or modify page DS147.ParamInScope
   ( Title: 'Page parameter of the exact type', Layout: Atlas_Core.Atlas_Default,
-    Params: { $Ctx: DS147.ReportContext } )
+    Params: ( $Ctx: DS147.ReportContext ) )
   {
     DATAGRID dgParamScope (DataSource: MICROFLOW DS147.DS_Rows) {
       COLUMN colParam (Attribute: Label, Caption: 'Label')
diff --git a/mdl-examples/bug-tests/ledger-27-consecutive-dynamictext.mdl b/mdl-examples/bug-tests/ledger-27-consecutive-dynamictext.mdl
index cb6850a43f..a5c77cbc99 100644
--- a/mdl-examples/bug-tests/ledger-27-consecutive-dynamictext.mdl
+++ b/mdl-examples/bug-tests/ledger-27-consecutive-dynamictext.mdl
@@ -41,24 +41,24 @@ create or replace page MyModule.SummaryPage
 (
   Title: 'Summary',
   Layout: Atlas_Core.Atlas_Default,
-  Params: { $Summary: MyModule.Summary }
+  Params: ( $Summary: MyModule.Summary )
 )
 {
   dataview dv (datasource: $Summary) {
     -- Text-mode pair fuses → flagged
     container box {
-      dynamictext dMonth (content: 'This month: {1}', contentparams: [{1} = Amount])
-      dynamictext dImport (content: 'Last import: {1}', contentparams: [{1} = LastImport])
+      dynamictext dMonth (content: 'This month: {1}', contentparams: ({1} = Amount))
+      dynamictext dImport (content: 'Last import: {1}', contentparams: ({1} = LastImport))
     }
     -- Paragraph-mode pair ALSO fuses (renders inline) → flagged (#29)
     container paras {
-      dynamictext pMonth (content: 'This month: {1}', RenderMode: Paragraph, contentparams: [{1} = Amount])
-      dynamictext pImport (content: 'Last import: {1}', RenderMode: Paragraph, contentparams: [{1} = LastImport])
+      dynamictext pMonth (content: 'This month: {1}', RenderMode: Paragraph, contentparams: ({1} = Amount))
+      dynamictext pImport (content: 'Last import: {1}', RenderMode: Paragraph, contentparams: ({1} = LastImport))
     }
     -- Heading (block-level) + subtitle does NOT fuse → not flagged
     container heads {
-      dynamictext hTitle (content: 'Summary {1}', RenderMode: H2, contentparams: [{1} = Amount])
-      dynamictext hSub (content: 'as of {1}', contentparams: [{1} = LastImport])
+      dynamictext hTitle (content: 'Summary {1}', RenderMode: H2, contentparams: ({1} = Amount))
+      dynamictext hSub (content: 'as of {1}', contentparams: ({1} = LastImport))
     }
   }
 }
diff --git a/mdl-examples/bug-tests/ledger-75-dynamictext-formatting.mdl b/mdl-examples/bug-tests/ledger-75-dynamictext-formatting.mdl
index 003fa7f6a0..512f70314d 100644
--- a/mdl-examples/bug-tests/ledger-75-dynamictext-formatting.mdl
+++ b/mdl-examples/bug-tests/ledger-75-dynamictext-formatting.mdl
@@ -40,12 +40,12 @@ create page Ledger.LineItems (
           -- Decimal with 2 decimals and a thousands separator.
           dynamictext txtAmount (
             Content: '{1}',
-            ContentParams: [{1} = Amount format (decimalPrecision: 2, groupDigits: true)]
+            ContentParams: ({1} = Amount format (decimalPrecision: 2, groupDigits: true))
           )
           -- DateTime shown with date + time.
           dynamictext txtDue (
             Content: '{1}',
-            ContentParams: [{1} = DueOn format (dateFormat: DateTime)]
+            ContentParams: ({1} = DueOn format (dateFormat: DateTime))
           )
         }
       }
diff --git a/mdl-examples/bug-tests/ledger-77-datagrid-dynamictext-column.mdl b/mdl-examples/bug-tests/ledger-77-datagrid-dynamictext-column.mdl
index ff46f25c97..fdd16b67d2 100644
--- a/mdl-examples/bug-tests/ledger-77-datagrid-dynamictext-column.mdl
+++ b/mdl-examples/bug-tests/ledger-77-datagrid-dynamictext-column.mdl
@@ -46,7 +46,7 @@ create page Ledger.LineItemsGrid (
             Caption: 'Amount',
             ShowContentAs: dynamicText,
             Content: 'Amt: {1}',
-            ContentParams: [{1} = Amount format (decimalPrecision: 2, groupDigits: true)]
+            ContentParams: ({1} = Amount format (decimalPrecision: 2, groupDigits: true))
           )
           -- Plain attribute column for contrast.
           column due (Attribute: DueOn, Caption: 'Due')
diff --git a/mdl-examples/bug-tests/ledger-78-datagrid-column-addressing.mdl b/mdl-examples/bug-tests/ledger-78-datagrid-column-addressing.mdl
index a5ad46d042..e5f7bd1d6b 100644
--- a/mdl-examples/bug-tests/ledger-78-datagrid-column-addressing.mdl
+++ b/mdl-examples/bug-tests/ledger-78-datagrid-column-addressing.mdl
@@ -29,7 +29,7 @@ create or replace page Ledger.Grid78 (Title: 'Grid', Layout: Atlas_Core.Atlas_De
       -- attribute column → derived name is the attribute leaf: "Merchant"
       column colMerchant (attribute: Merchant, caption: 'Store')
       -- dynamic-text column → derived name is the caption: "Who"
-      column colAmount (ShowContentAs: dynamicText, caption: 'Who', Content: '{1}', ContentParams: [{1} = Amount])
+      column colAmount (ShowContentAs: dynamicText, caption: 'Who', Content: '{1}', ContentParams: ({1} = Amount))
     }
   } } }
 }
diff --git a/mdl-examples/bug-tests/listview-database-source-searchrefs.mdl b/mdl-examples/bug-tests/listview-database-source-searchrefs.mdl
index d677e3e77a..64a7e54d93 100644
--- a/mdl-examples/bug-tests/listview-database-source-searchrefs.mdl
+++ b/mdl-examples/bug-tests/listview-database-source-searchrefs.mdl
@@ -44,6 +44,6 @@ create page MyFirstModule.LvSearchRefs (
   Layout: Atlas_Core.Atlas_Default
 ) {
   listview lvTrips (datasource: database from MyFirstModule.Trip sort by Name asc) {
-    dynamictext dtName (content: '{1}', contentparams: [{1} = Name])
+    dynamictext dtName (content: '{1}', contentparams: ({1} = Name))
   }
 }
diff --git a/mdl-examples/bug-tests/listwidget-reverse-assoc-specialization.mdl b/mdl-examples/bug-tests/listwidget-reverse-assoc-specialization.mdl
index 1b366c4eb7..a79b4a20af 100644
--- a/mdl-examples/bug-tests/listwidget-reverse-assoc-specialization.mdl
+++ b/mdl-examples/bug-tests/listwidget-reverse-assoc-specialization.mdl
@@ -36,7 +36,7 @@ create or modify page RA.SubDetail
   (
     Title: 'Sub detail',
     Layout: Atlas_Core.Atlas_Default,
-    Params: { $Sub: RA.Sub, $Base: RA.Base, $Note: RA.Note }
+    Params: ( $Sub: RA.Sub, $Base: RA.Base, $Note: RA.Note )
   )
   {
     LAYOUTGRID lgMain {
diff --git a/mdl-examples/bug-tests/maint2-call-workflow-multiline-mapping.mdl b/mdl-examples/bug-tests/maint2-call-workflow-multiline-mapping.mdl
index 06b7b6ffde..80fe4f81d2 100644
--- a/mdl-examples/bug-tests/maint2-call-workflow-multiline-mapping.mdl
+++ b/mdl-examples/bug-tests/maint2-call-workflow-multiline-mapping.mdl
@@ -20,7 +20,7 @@ create module role WFA.User;
 create persistent entity WFA.Request ( Code: string(50) );
 
 create page WFA."TaskPage" (
-  params: { $Task: System.WorkflowUserTask },
+  params: ( $Task: System.WorkflowUserTask ),
   title: 'Task', layout: Atlas_Core.Atlas_Default
 ) {
   layoutgrid g { row r { column c (desktopwidth: 12) {
diff --git a/mdl-examples/bug-tests/maint2-datasource-arguments.mdl b/mdl-examples/bug-tests/maint2-datasource-arguments.mdl
index 9bff2c3863..87d74f4b89 100644
--- a/mdl-examples/bug-tests/maint2-datasource-arguments.mdl
+++ b/mdl-examples/bug-tests/maint2-datasource-arguments.mdl
@@ -49,7 +49,7 @@ create page DSArgs."P_Requests" (
 };
 
 create page DSArgs."P_TaskRequests" (
-  params: { $Task: DSArgs.Task },
+  params: ( $Task: DSArgs.Task ),
   Title: 'Task requests',
   Layout: Atlas_Core.Atlas_Default
 ) {
diff --git a/mdl-examples/bug-tests/maint2-editable-never-create-page.mdl b/mdl-examples/bug-tests/maint2-editable-never-create-page.mdl
index b629a9ade6..507b04e0cb 100644
--- a/mdl-examples/bug-tests/maint2-editable-never-create-page.mdl
+++ b/mdl-examples/bug-tests/maint2-editable-never-create-page.mdl
@@ -28,7 +28,7 @@ create entity if not exists MaintTwo.WorkOrder (
 create or replace page MaintTwo.WorkOrder_View (
   Title: 'Work order',
   Layout: Atlas_Core.Atlas_Default,
-  Params: { $WorkOrder: MaintTwo.WorkOrder }
+  Params: ( $WorkOrder: MaintTwo.WorkOrder )
 ) {
   layoutgrid lg {
     row r1 {
diff --git a/mdl-examples/bug-tests/microflow-1152-sort-association-path.mdl b/mdl-examples/bug-tests/microflow-1152-sort-association-path.mdl
index 1bd4925306..7359e6c09b 100644
--- a/mdl-examples/bug-tests/microflow-1152-sort-association-path.mdl
+++ b/mdl-examples/bug-tests/microflow-1152-sort-association-path.mdl
@@ -68,6 +68,6 @@ create or replace page Sort1152.Orders_Overview (
 ) {
   listview lvOrders (datasource: database from Sort1152.Order
       sort by Sort1152.Order_BillTo/City asc) {
-    dynamictext txtNo (content: '{1}', contentparams: [{1} = OrderNo])
+    dynamictext txtNo (content: '{1}', contentparams: ({1} = OrderNo))
   }
 }
diff --git a/mdl-examples/bug-tests/navigation-describe-profile-pages.mdl b/mdl-examples/bug-tests/navigation-describe-profile-pages.mdl
index 7d4753da38..ca6f7575c3 100644
--- a/mdl-examples/bug-tests/navigation-describe-profile-pages.mdl
+++ b/mdl-examples/bug-tests/navigation-describe-profile-pages.mdl
@@ -56,9 +56,9 @@ create or replace navigation Responsive
   home page NavRT.Home
   login page NavRT.SignIn
   not found page NavRT.Missing
-  menu (
-    menu item 'Home' page NavRT.Home;
-  );
+  {
+    menu item 'Home' ( OnClick: show page NavRT.Home )
+  };
 
 -- Must print all three clauses. Before the fix, on the default engine, only
 -- `home page` came back.
diff --git a/mdl-examples/bug-tests/navigation-glyph-code.mdl b/mdl-examples/bug-tests/navigation-glyph-code.mdl
index c63b6d5cff..bdaa726c84 100644
--- a/mdl-examples/bug-tests/navigation-glyph-code.mdl
+++ b/mdl-examples/bug-tests/navigation-glyph-code.mdl
@@ -1,7 +1,7 @@
 -- `icon glyph <n>` with a code the Mendix glyph font does not define broke the
 -- build, blaming a document nobody had touched (ako/CapTrackV4 007, R2).
 --
---   menu item 'Overview' page M.P icon glyph 57562;
+--   menu item 'Overview' ( OnClick: show page M.P, Icon: glyph 57562 )
 --   mxcli check -> passed
 --   mx check    -> 0 errors
 --   mxbuild --target=deploy ->
@@ -70,24 +70,24 @@ CREATE OR REPLACE PAGE GlyphNav.PG_Home ( Title: 'Home', Layout: Atlas_Core.Atla
 
 -- THE REPORTED CASE. 57562 is past the font's last icon (57952 / 0xE260) with
 -- nothing in between, so mxbuild's lookup throws.
-create or modify menu GlyphNav.MENU_Bad (
-  menu item 'Overview' page GlyphNav.PG_Home icon glyph 57562;
-)
+create or modify menu GlyphNav.MENU_Bad {
+  menu item 'Overview' ( OnClick: show page GlyphNav.PG_Home, Icon: glyph 57562 )
+}
 /
 
 -- CONTROL: the code the blank app itself ships. A rule that flagged glyphs in
 -- general would reject this, and every working navigation with it.
-create or modify menu GlyphNav.MENU_Good (
-  menu item 'Overview' page GlyphNav.PG_Home icon glyph 57377;
-)
+create or modify menu GlyphNav.MENU_Good {
+  menu item 'Overview' ( OnClick: show page GlyphNav.PG_Home, Icon: glyph 57377 )
+}
 /
 
 -- CONTROL: the spelling that avoids the whole problem. An icon collection entry
 -- is resolved by `check --references`, so a wrong NAME is caught immediately
 -- where a wrong NUMBER never was.
-create or modify menu GlyphNav.MENU_Collection (
-  menu item 'Overview' page GlyphNav.PG_Home icon Atlas_Core.Atlas.dashboard;
-)
+create or modify menu GlyphNav.MENU_Collection {
+  menu item 'Overview' ( OnClick: show page GlyphNav.PG_Home, Icon: Atlas_Core.Atlas.dashboard )
+}
 /
 
 -- The browsing commands, which is how the code above is meant to be found.
diff --git a/mdl-examples/bug-tests/navigation-icon-variants.mdl b/mdl-examples/bug-tests/navigation-icon-variants.mdl
index 5811a8d8e9..23f8ca3680 100644
--- a/mdl-examples/bug-tests/navigation-icon-variants.mdl
+++ b/mdl-examples/bug-tests/navigation-icon-variants.mdl
@@ -44,22 +44,22 @@ create page NavIconVariants.Logo ( Title: 'Logo', Layout: Atlas_Core.Atlas_Defau
 
 create or replace navigation Responsive
   home page NavIconVariants.Home
-  menu (
+  {
     -- Forms$IconCollectionIcon — the bare form, unchanged
-    menu item 'Home' page NavIconVariants.Home icon Atlas_Core.Atlas.home;
+    menu item 'Home' ( OnClick: show page NavIconVariants.Home, Icon: Atlas_Core.Atlas.home )
     -- Forms$GlyphIcon — the numeric character code IS the glyph's identity
-    menu item 'Close' page NavIconVariants.Close icon glyph 57377;
+    menu item 'Close' ( OnClick: show page NavIconVariants.Close, Icon: glyph 57377 )
     -- Forms$ImageIcon — an image collection, a different document
-    menu item 'Logo' page NavIconVariants.Logo icon image NavIconVariants.Images.logo;
+    menu item 'Logo' ( OnClick: show page NavIconVariants.Logo, Icon: image NavIconVariants.Images.logo )
     -- A submenu takes any of the three too; it sits on the collapsed icon rail
-    menu 'Admin' icon glyph 57345 (
-      menu item 'Users' page NavIconVariants.Home icon Atlas_Core.Atlas.user;
-    );
-  );
+    menu 'Admin' ( Icon: glyph 57345 ) {
+      menu item 'Users' ( OnClick: show page NavIconVariants.Home, Icon: Atlas_Core.Atlas.user )
+    }
+  };
 
 -- The same item syntax serves a standalone menu document, which is why one AST
 -- node backs both and the two cannot diverge.
-create or modify menu NavIconVariants.Main_Menu (
-  menu item 'Home' page NavIconVariants.Home icon Atlas_Core.Atlas.home;
-  menu item 'Close' page NavIconVariants.Close icon glyph 57377;
-);
+create or modify menu NavIconVariants.Main_Menu {
+  menu item 'Home' ( OnClick: show page NavIconVariants.Home, Icon: Atlas_Core.Atlas.home )
+  menu item 'Close' ( OnClick: show page NavIconVariants.Close, Icon: glyph 57377 )
+};
diff --git a/mdl-examples/bug-tests/navigation-menu-item-icons.mdl b/mdl-examples/bug-tests/navigation-menu-item-icons.mdl
index d435fa9639..d683a0380b 100644
--- a/mdl-examples/bug-tests/navigation-menu-item-icons.mdl
+++ b/mdl-examples/bug-tests/navigation-menu-item-icons.mdl
@@ -34,17 +34,17 @@ create page NavIcons.Users ( Title: 'Users', Layout: Atlas_Core.Atlas_Default )
 -- collapsed rail, so it needs one most of all.
 create or replace navigation Responsive
   home page NavIcons.Home
-  menu (
-    menu item 'Home' page NavIcons.Home icon Atlas_Core.Atlas.home;
-    menu item 'Orders' page NavIcons.Orders icon Atlas_Core.Atlas."shopping-cart";
-    menu 'Admin' icon Atlas_Core.Atlas.cog (
-      menu item 'Users' page NavIcons.Users icon Atlas_Core.Atlas.user;
-    );
-  );
+  {
+    menu item 'Home' ( OnClick: show page NavIcons.Home, Icon: Atlas_Core.Atlas.home )
+    menu item 'Orders' ( OnClick: show page NavIcons.Orders, Icon: Atlas_Core.Atlas."shopping-cart" )
+    menu 'Admin' ( Icon: Atlas_Core.Atlas.cog ) {
+      menu item 'Users' ( OnClick: show page NavIcons.Users, Icon: Atlas_Core.Atlas.user )
+    }
+  };
 
 -- A standalone menu document carries the same items and gets the same rule:
 -- CREATE MENU and CREATE NAVIGATION share one AST node so they cannot diverge.
-create or modify menu NavIcons.Main_Menu (
-  menu item 'Home' page NavIcons.Home icon Atlas_Core.Atlas.home;
-  menu item 'Orders' page NavIcons.Orders icon Atlas_Core.Atlas."shopping-cart";
-);
+create or modify menu NavIcons.Main_Menu {
+  menu item 'Home' ( OnClick: show page NavIcons.Home, Icon: Atlas_Core.Atlas.home )
+  menu item 'Orders' ( OnClick: show page NavIcons.Orders, Icon: Atlas_Core.Atlas."shopping-cart" )
+};
diff --git a/mdl-examples/bug-tests/nested-fragment-expansion.mdl b/mdl-examples/bug-tests/nested-fragment-expansion.mdl
index 24fb409426..41c5e5f73b 100644
--- a/mdl-examples/bug-tests/nested-fragment-expansion.mdl
+++ b/mdl-examples/bug-tests/nested-fragment-expansion.mdl
@@ -17,7 +17,7 @@ create persistent entity NestFrag.Order (
 
 -- A slotted card shell reused inside a layout container.
 define fragment Card as {
-  container cardWrap (class: 'card', designproperties: ['Card style': on]) {
+  container cardWrap (class: 'card', designproperties: ('Card style': on)) {
     container cardBody (class: 'card-body') {
       slot content
     }
diff --git a/mdl-examples/bug-tests/odata-574-session-auth-csrf.mdl b/mdl-examples/bug-tests/odata-574-session-auth-csrf.mdl
index d8a533ec47..4ee0b50388 100644
--- a/mdl-examples/bug-tests/odata-574-session-auth-csrf.mdl
+++ b/mdl-examples/bug-tests/odata-574-session-auth-csrf.mdl
@@ -43,7 +43,7 @@ alter project security level production;
 alter project security demo users on;
 
 create or modify module role MyFirstModule.User;
-create or modify user role ApiUser (MyFirstModule.User, System.User);
+create or modify user role ApiUser ( ModuleRoles: (MyFirstModule.User, System.User) );
 
 create or modify entity MyFirstModule.Row (
   -- CE6624: an OData key attribute needs a unique validation rule.
diff --git a/mdl-examples/bug-tests/open-link-dynamic-address.mdl b/mdl-examples/bug-tests/open-link-dynamic-address.mdl
index e55a97b392..2206eec89f 100644
--- a/mdl-examples/bug-tests/open-link-dynamic-address.mdl
+++ b/mdl-examples/bug-tests/open-link-dynamic-address.mdl
@@ -33,7 +33,7 @@ create entity MyFirstModule.LinkTarget (
 /
 
 create or replace page MyFirstModule.LinkTarget_View
-( Title: 'Link', Layout: Atlas_Core.Atlas_Default, Params: { $LinkTarget: MyFirstModule.LinkTarget } )
+( Title: 'Link', Layout: Atlas_Core.Atlas_Default, Params: ( $LinkTarget: MyFirstModule.LinkTarget ) )
 {
   dataview dv (datasource: $LinkTarget) {
     actionbutton btnStatic (Caption: 'Docs', Action: open_link 'https://docs.mendix.com')
diff --git a/mdl-examples/bug-tests/page-header-version-floored-keys.mdl b/mdl-examples/bug-tests/page-header-version-floored-keys.mdl
index dc9dfc700d..01c36c8e90 100644
--- a/mdl-examples/bug-tests/page-header-version-floored-keys.mdl
+++ b/mdl-examples/bug-tests/page-header-version-floored-keys.mdl
@@ -28,7 +28,7 @@ CREATE PERSISTENT ENTITY KeyTest.Item (
 CREATE OR REPLACE PAGE KeyTest.Item_Edit (
   Title: 'Edit item',
   Layout: Atlas_Core.PopupLayout,
-  Params: { $Item: KeyTest.Item }
+  Params: ( $Item: KeyTest.Item )
 ) {
   layoutgrid lg {
     row r {
diff --git a/mdl-examples/bug-tests/page-variable-bindings.mdl b/mdl-examples/bug-tests/page-variable-bindings.mdl
index 8b4f45af5d..f6034f95c5 100644
--- a/mdl-examples/bug-tests/page-variable-bindings.mdl
+++ b/mdl-examples/bug-tests/page-variable-bindings.mdl
@@ -43,16 +43,16 @@ create or modify page PV.VarPage
   (
     Title: 'Var page',
     Layout: Atlas_Core.Atlas_Default,
-    Params: { $Thing: PV.Thing },
-    Variables: {
+    Params: ( $Thing: PV.Thing ),
+    Variables: (
       $Filter: Enumeration(PV.ENUM_Status) = 'PV.ENUM_Status.Open',
       $Show: Boolean = 'true',
       $Label: String = '''hello'''
-    }
+    )
   )
   {
     DATAVIEW dvThing (DataSource: $Thing) {
-      DYNAMICTEXT dtA (Content: 'Label is {1}', ContentParams: [{1} = $Label])
+      DYNAMICTEXT dtA (Content: 'Label is {1}', ContentParams: ({1} = $Label))
       TEXTBOX txtTitle (Label: 'Title', Attribute: Title)
     }
   };
diff --git a/mdl-examples/bug-tests/pages-529-input-attribute-over-association.mdl b/mdl-examples/bug-tests/pages-529-input-attribute-over-association.mdl
index 490c595c22..8b98389282 100644
--- a/mdl-examples/bug-tests/pages-529-input-attribute-over-association.mdl
+++ b/mdl-examples/bug-tests/pages-529-input-attribute-over-association.mdl
@@ -55,7 +55,7 @@ create association Issue529.RuleAction_BusinessRule
 create or replace page Issue529.RuleAction_NewEdit (
   title: 'Edit Rule Action',
   layout: Atlas_Core.PopupLayout,
-  params: { $RuleAction: Issue529.RuleAction }
+  params: ( $RuleAction: Issue529.RuleAction )
 )
 {
   -- Wrapped in a layout grid, as the Studio Pro reference page is (MPR010).
diff --git a/mdl-examples/bug-tests/pages-541-roundtrip-property-drift.mdl b/mdl-examples/bug-tests/pages-541-roundtrip-property-drift.mdl
index 5fc9218df1..3568a3c074 100644
--- a/mdl-examples/bug-tests/pages-541-roundtrip-property-drift.mdl
+++ b/mdl-examples/bug-tests/pages-541-roundtrip-property-drift.mdl
@@ -73,7 +73,7 @@ create association Issue541.RuleAction_BusinessRule
 create or replace page Issue541.RuleAction_NewEdit (
   title: 'Edit Rule Action',
   layout: Atlas_Core.PopupLayout,
-  params: { $RuleAction: Issue541.RuleAction }
+  params: ( $RuleAction: Issue541.RuleAction )
 )
 {
   layoutgrid layoutGrid1 {
diff --git a/mdl-examples/bug-tests/pages-550-describe-input-properties.mdl b/mdl-examples/bug-tests/pages-550-describe-input-properties.mdl
index 03f616bdd8..59457e8cda 100644
--- a/mdl-examples/bug-tests/pages-550-describe-input-properties.mdl
+++ b/mdl-examples/bug-tests/pages-550-describe-input-properties.mdl
@@ -55,7 +55,7 @@ end
 create or replace page Issue550.ChangePasswordForm (
   title: 'Change Password',
   layout: Atlas_Core.PopupLayout,
-  params: { $Account: Issue550.Account },
+  params: ( $Account: Issue550.Account ),
   -- Names the widget whose action closes the pop-up. Written as "" before.
   PopupCloseAction: cancelButton1
 )
diff --git a/mdl-examples/bug-tests/pages-552-list-widget-row-action.mdl b/mdl-examples/bug-tests/pages-552-list-widget-row-action.mdl
index 2e5a031981..55c4512a5d 100644
--- a/mdl-examples/bug-tests/pages-552-list-widget-row-action.mdl
+++ b/mdl-examples/bug-tests/pages-552-list-widget-row-action.mdl
@@ -19,7 +19,7 @@ create entity Mod.Car (
   Name: String(100)
 );
 
-create page Mod.Detail (Title: 'Car', Layout: Atlas_Core.Atlas_Default, Params: { $Car: Mod.Car }) {
+create page Mod.Detail (Title: 'Car', Layout: Atlas_Core.Atlas_Default, Params: ( $Car: Mod.Car )) {
   dataview dvCar (DataSource: $Car) {
     textbox tbName (Label: 'Name', Attribute: Name)
   }
@@ -41,7 +41,7 @@ create page Mod.List (Title: 'Cars', Layout: Atlas_Core.Atlas_Default) {
     DataSource: DATABASE Mod.Car,
     onClick: SHOW_PAGE Mod.Detail(Car: $currentObject)
   ) {
-    dynamictext dtName (Content: '{1}', ContentParams: [{1} = Name])
+    dynamictext dtName (Content: '{1}', ContentParams: ({1} = Name))
   }
 };
 
diff --git a/mdl-examples/bug-tests/pluggable-child-slot-container.mdl b/mdl-examples/bug-tests/pluggable-child-slot-container.mdl
index 4de5d47095..def8cbace3 100644
--- a/mdl-examples/bug-tests/pluggable-child-slot-container.mdl
+++ b/mdl-examples/bug-tests/pluggable-child-slot-container.mdl
@@ -44,7 +44,7 @@ create or replace page ChildSlot.Home ( layout: Atlas_Core.Atlas_Default ) {
     showIcon: 'left'
   ) {
     container children {
-      dynamictext treeChildText (content: 'Score: {1}', contentparams: [{1} = Score])
+      dynamictext treeChildText (content: 'Score: {1}', contentparams: ({1} = Score))
     }
   }
 }
diff --git a/mdl-examples/bug-tests/pluggable-texttemplate-content.mdl b/mdl-examples/bug-tests/pluggable-texttemplate-content.mdl
index f96bd0b7f0..fea55ac2ba 100644
--- a/mdl-examples/bug-tests/pluggable-texttemplate-content.mdl
+++ b/mdl-examples/bug-tests/pluggable-texttemplate-content.mdl
@@ -57,7 +57,7 @@ create or replace page TTContent.Home ( layout: Atlas_Core.Atlas_Default ) {
 /
 -- Badge: value is a textTemplate (rendered inside a data view context).
 create or replace page TTContent.Detail (
-  params: { $Item: TTContent.DemoItem },
+  params: ( $Item: TTContent.DemoItem ),
   layout: Atlas_Core.Atlas_Default
 ) {
   dataview dv (DataSource: $Item) {
diff --git a/mdl-examples/bug-tests/refs-graph-members-enums-workflows.mdl b/mdl-examples/bug-tests/refs-graph-members-enums-workflows.mdl
index 00c2c61497..a0c7b9cb56 100644
--- a/mdl-examples/bug-tests/refs-graph-members-enums-workflows.mdl
+++ b/mdl-examples/bug-tests/refs-graph-members-enums-workflows.mdl
@@ -90,7 +90,7 @@ end;
 
 create page RefsGraph.Machine_Details
 (
-  params: { $Machine: RefsGraph.Machine },
+  params: ( $Machine: RefsGraph.Machine ),
   title: 'Machine',
   layout: Atlas_Core.Atlas_Default
 )
diff --git a/mdl-examples/bug-tests/renamed-design-property-legacy-names.mdl b/mdl-examples/bug-tests/renamed-design-property-legacy-names.mdl
index d65c87e36c..1905684f81 100644
--- a/mdl-examples/bug-tests/renamed-design-property-legacy-names.mdl
+++ b/mdl-examples/bug-tests/renamed-design-property-legacy-names.mdl
@@ -39,8 +39,8 @@ create page BugRenamedDesignProp.LegacyNames (
   title: 'Legacy Names',
   layout: Atlas_Core.Atlas_Default
 ) {
-  container container1 (designproperties: ['Align content': 'Right align as a row', 'Spacing bottom': 'Outer medium']) {
-    dynamictext text1 (content: 'Legacy', designproperties: ['Spacing top': 'Outer small', 'Font Weight': 'Light'])
+  container container1 (designproperties: ('Align content': 'Right align as a row', 'Spacing bottom': 'Outer medium')) {
+    dynamictext text1 (content: 'Legacy', designproperties: ('Spacing top': 'Outer small', 'Font Weight': 'Light'))
   }
 }
 
@@ -48,7 +48,7 @@ create page BugRenamedDesignProp.CurrentNames (
   title: 'Current Names',
   layout: Atlas_Core.Atlas_Default
 ) {
-  container container1 (designproperties: ['Align content (deprecated)': 'Right align as a row', 'Spacing': ['margin-bottom': 'M']]) {
-    dynamictext text1 (content: 'Current', designproperties: ['Spacing': ['margin-top': 'S'], 'Weight': 'Light'])
+  container container1 (designproperties: ('Align content (deprecated)': 'Right align as a row', 'Spacing': ('margin-bottom': 'M'))) {
+    dynamictext text1 (content: 'Current', designproperties: ('Spacing': ('margin-top': 'S'), 'Weight': 'Light'))
   }
 }
diff --git a/mdl-examples/bug-tests/security-554-autoowner-access-rule.mdl b/mdl-examples/bug-tests/security-554-autoowner-access-rule.mdl
index cfd431d515..6f70390e45 100644
--- a/mdl-examples/bug-tests/security-554-autoowner-access-rule.mdl
+++ b/mdl-examples/bug-tests/security-554-autoowner-access-rule.mdl
@@ -30,7 +30,7 @@ alter project security level production;
 create module Sec554;
 
 create module role Sec554.Administrator;
-create or modify user role Administrator (Sec554.Administrator, System.User);
+create or modify user role Administrator ( ModuleRoles: (Sec554.Administrator, System.User) );
 
 -- The owner half.
 create persistent entity Sec554.Fab (
diff --git a/mdl-examples/bug-tests/security-587-system-member-access.mdl b/mdl-examples/bug-tests/security-587-system-member-access.mdl
index 2411d5661e..e7c66f8ba5 100644
--- a/mdl-examples/bug-tests/security-587-system-member-access.mdl
+++ b/mdl-examples/bug-tests/security-587-system-member-access.mdl
@@ -102,9 +102,9 @@ grant view on page Sec.Home to Sec.Viewer, Sec.Admin;
 
 create or replace navigation Responsive
   home page Sec.Home
-  menu (
-    menu item 'Home' page Sec.Home icon glyph 57377;
-  )
+  {
+    menu item 'Home' ( OnClick: show page Sec.Home, Icon: glyph 57377 )
+  }
 ;
 
 -- The control is the ROLE, not the build: Administrator sees both names in list
diff --git a/mdl-examples/bug-tests/snippetcall-missing-params.mdl b/mdl-examples/bug-tests/snippetcall-missing-params.mdl
index ab0c82b327..0c006682b2 100644
--- a/mdl-examples/bug-tests/snippetcall-missing-params.mdl
+++ b/mdl-examples/bug-tests/snippetcall-missing-params.mdl
@@ -9,7 +9,7 @@
 --   SNIPPETCALL call1 (Snippet: Mod.MySnippet, Params: {Asset: $Asset})
 
 CREATE SNIPPET Mod.MySnippet (
-  Params: { $Asset: Mod.Asset },
+  Params: ( $Asset: Mod.Asset ),
   Folder: 'Snippets'
 ) {
   DYNAMICTEXT txt1 (Content: 'Hello')
diff --git a/mdl-examples/bug-tests/styling-509-511-alter-styling-design-properties.mdl b/mdl-examples/bug-tests/styling-509-511-alter-styling-design-properties.mdl
index 603c2abef9..a46607c2af 100644
--- a/mdl-examples/bug-tests/styling-509-511-alter-styling-design-properties.mdl
+++ b/mdl-examples/bug-tests/styling-509-511-alter-styling-design-properties.mdl
@@ -43,7 +43,7 @@ create or replace page MyFirstModule.HideOn (
 ) {
   listview lvH (
     DataSource: database from MyFirstModule.Thing,
-    DesignProperties: ['Hide on': ['Phone': on, 'Tablet': on]]
+    DesignProperties: ('Hide on': ('Phone': on, 'Tablet': on))
   ) {
     dynamictext dt (Content: 'x')
   }
diff --git a/mdl-examples/bug-tests/textbox-placeholder-onchange.mdl b/mdl-examples/bug-tests/textbox-placeholder-onchange.mdl
index 4118163c4f..0fa6c4ec3c 100644
--- a/mdl-examples/bug-tests/textbox-placeholder-onchange.mdl
+++ b/mdl-examples/bug-tests/textbox-placeholder-onchange.mdl
@@ -35,7 +35,7 @@ create or replace page MyFirstModule.P_Search
 (
   Title: 'Search',
   Layout: Atlas_Core.Atlas_Default,
-  Params: { $Filter: MyFirstModule.Filter }
+  Params: ( $Filter: MyFirstModule.Filter )
 )
 {
   layoutgrid grid {
diff --git a/mdl-examples/bug-tests/traceops-23-combobox-association.mdl b/mdl-examples/bug-tests/traceops-23-combobox-association.mdl
index 5492dc850f..9d06c599e7 100644
--- a/mdl-examples/bug-tests/traceops-23-combobox-association.mdl
+++ b/mdl-examples/bug-tests/traceops-23-combobox-association.mdl
@@ -27,7 +27,7 @@ create association MyFirstModule.Order_Customer
 /
 
 create or replace page MyFirstModule.OrderEdit
-( Title: 'Order', Layout: Atlas_Core.Atlas_Default, Params: { $Order: MyFirstModule.Order } )
+( Title: 'Order', Layout: Atlas_Core.Atlas_Default, Params: ( $Order: MyFirstModule.Order ) )
 {
   dataview dv (datasource: $Order) {
     -- Complete association combobox — builds clean.
diff --git a/mdl-examples/bug-tests/typed-design-properties.mdl b/mdl-examples/bug-tests/typed-design-properties.mdl
index 159428e64b..9eaef0ae6d 100644
--- a/mdl-examples/bug-tests/typed-design-properties.mdl
+++ b/mdl-examples/bug-tests/typed-design-properties.mdl
@@ -10,11 +10,11 @@ create page TypedDP.Home (
   title: 'Home',
   layout: Atlas_Core.Atlas_Default
 ) {
-  container hero (designproperties: [
+  container hero (designproperties: (
     'Background color': 'Brand Primary',
     'Card style': on,
-    'Spacing': ['margin-bottom': 'Large']
-  ]) {
+    'Spacing': ('margin-bottom': 'Large')
+  )) {
     dynamictext t1 (content: 'Welcome', rendermode: H2)
   }
 }
diff --git a/mdl-examples/bug-tests/visible-based-on-attribute-value.mdl b/mdl-examples/bug-tests/visible-based-on-attribute-value.mdl
index 0237a16092..9e18862f4f 100644
--- a/mdl-examples/bug-tests/visible-based-on-attribute-value.mdl
+++ b/mdl-examples/bug-tests/visible-based-on-attribute-value.mdl
@@ -31,7 +31,7 @@ create entity MyFirstModule.Job (
 /
 
 create or replace page MyFirstModule.Job_View
-( Title: 'Job', Layout: Atlas_Core.Atlas_Default, Params: { $Job: MyFirstModule.Job } )
+( Title: 'Job', Layout: Atlas_Core.Atlas_Default, Params: ( $Job: MyFirstModule.Job ) )
 {
   dataview dv (datasource: $Job) {
     textbox txtTitle (Label: 'Title', Attribute: Title, Visible: IsUrgent in (true))
diff --git a/mdl-examples/bug-tests/wf-415-alter-outcome-activity-kind.mdl b/mdl-examples/bug-tests/wf-415-alter-outcome-activity-kind.mdl
index fa6e7fa13d..bac14e7ded 100644
--- a/mdl-examples/bug-tests/wf-415-alter-outcome-activity-kind.mdl
+++ b/mdl-examples/bug-tests/wf-415-alter-outcome-activity-kind.mdl
@@ -42,7 +42,7 @@ create page WF415.TaskPage
   (
     Title: 'Task',
     Layout: Atlas_Core.Atlas_Default,
-    Params: { $TaskPageParam: System.WorkflowUserTask }
+    Params: ( $TaskPageParam: System.WorkflowUserTask )
   )
   {
     CONTAINER c1 { }
diff --git a/mdl-examples/bug-tests/widget-arg-keyword-param-names.mdl b/mdl-examples/bug-tests/widget-arg-keyword-param-names.mdl
index e9167b8b88..865b7edd81 100644
--- a/mdl-examples/bug-tests/widget-arg-keyword-param-names.mdl
+++ b/mdl-examples/bug-tests/widget-arg-keyword-param-names.mdl
@@ -37,7 +37,7 @@ create or replace page MyFirstModule.P_KwArg
 (
   Title: 'Keyword Arg Names',
   Layout: Atlas_Core.Atlas_Default,
-  Params: { $Item: MyFirstModule.Item }
+  Params: ( $Item: MyFirstModule.Item )
 )
 {
   dataview dv (datasource: $Item) {
diff --git a/mdl-examples/bug-tests/widget-dynamicclasses.mdl b/mdl-examples/bug-tests/widget-dynamicclasses.mdl
index 82ce02a553..f08864f5c6 100644
--- a/mdl-examples/bug-tests/widget-dynamicclasses.mdl
+++ b/mdl-examples/bug-tests/widget-dynamicclasses.mdl
@@ -32,7 +32,7 @@ create or replace page MyFirstModule.P_DynClass
 (
   Title: 'Dynamic Classes',
   Layout: Atlas_Core.Atlas_Default,
-  Params: { $Boat: MyFirstModule.Boat }
+  Params: ( $Boat: MyFirstModule.Boat )
 )
 {
   dataview dv (datasource: $Boat) {
diff --git a/mdl-examples/bug-tests/widget-member-refs-resolved-at-check.mdl b/mdl-examples/bug-tests/widget-member-refs-resolved-at-check.mdl
index f28e93ff4e..182285f7e0 100644
--- a/mdl-examples/bug-tests/widget-member-refs-resolved-at-check.mdl
+++ b/mdl-examples/bug-tests/widget-member-refs-resolved-at-check.mdl
@@ -103,13 +103,13 @@ create or replace page WidgetRefs.P_List
 -- association path to one. No `$variable/` root.
 create or replace page WidgetRefs.P_Detail
 (
-  params: { $Order: WidgetRefs.Order },
+  params: ( $Order: WidgetRefs.Order ),
   title: 'Order',
   layout: Atlas_Core.Atlas_Default
 )
 {
   dataview dvOrder (datasource: $Order) {
-    dynamictext dtNo (Content: 'Order {1}', ContentParams: [{1} = OrderNo])
+    dynamictext dtNo (Content: 'Order {1}', ContentParams: ({1} = OrderNo))
 
     -- An association path is LEGAL here — it is an attribute reached over an
     -- association, stored as AttributeRef plus steps. Two segments, not three:
@@ -119,7 +119,7 @@ create or replace page WidgetRefs.P_Detail
     -- assumed.
     dynamictext dtCust (
       Content: 'for {1}',
-      ContentParams: [{1} = WidgetRefs.Order_Customer/Name]
+      ContentParams: ({1} = WidgetRefs.Order_Customer/Name)
     )
 
     -- And `$currentObject/` IS stripped when an association path follows, so
@@ -127,7 +127,7 @@ create or replace page WidgetRefs.P_Detail
     -- report it — the control that keeps MDL-WIDGET24 honest.
     dynamictext dtCust2 (
       Content: 'also {1}',
-      ContentParams: [{1} = $currentObject/WidgetRefs.Order_Customer/Name]
+      ContentParams: ({1} = $currentObject/WidgetRefs.Order_Customer/Name)
     )
   }
 }
diff --git a/mdl-examples/bug-tests/widget-visible-expression.mdl b/mdl-examples/bug-tests/widget-visible-expression.mdl
index 7550f418e0..bf5957a319 100644
--- a/mdl-examples/bug-tests/widget-visible-expression.mdl
+++ b/mdl-examples/bug-tests/widget-visible-expression.mdl
@@ -36,7 +36,7 @@
 create entity MyFirstModule.Vessel ( Name: String, Active: Boolean );
 
 create or replace page MyFirstModule.P_VisString
-( Title: 'Visible string form', Layout: Atlas_Core.Atlas_Default, Params: { $Vessel: MyFirstModule.Vessel } )
+( Title: 'Visible string form', Layout: Atlas_Core.Atlas_Default, Params: ( $Vessel: MyFirstModule.Vessel ) )
 {
   dataview dv (datasource: $Vessel) {
     -- expression as a quoted string (root in $currentObject yourself)
diff --git a/mdl-examples/bug-tests/widgets-1109-named-widget-datasources.mdl b/mdl-examples/bug-tests/widgets-1109-named-widget-datasources.mdl
index c464dda07d..07ed53adaf 100644
--- a/mdl-examples/bug-tests/widgets-1109-named-widget-datasources.mdl
+++ b/mdl-examples/bug-tests/widgets-1109-named-widget-datasources.mdl
@@ -36,7 +36,7 @@ create association NamedDS.Order_Customer
 create or replace page NamedDS.Order_Edit (
   Title: 'Named datasource mapping',
   Layout: Atlas_Core.Atlas_Default,
-  Params: { $Order: NamedDS.Order }
+  Params: ( $Order: NamedDS.Order )
 ) {
   dataview orderView (DataSource: $Order) {
     combobox customer (
diff --git a/mdl-examples/bug-tests/widgets-575-texttemplate-params-companion.mdl b/mdl-examples/bug-tests/widgets-575-texttemplate-params-companion.mdl
index 5762ff4d47..e9cc157dd4 100644
--- a/mdl-examples/bug-tests/widgets-575-texttemplate-params-companion.mdl
+++ b/mdl-examples/bug-tests/widgets-575-texttemplate-params-companion.mdl
@@ -77,14 +77,14 @@ create or modify page Bug575.Catalogue (
 
     -- The control: a built-in widget whose parameters always bound. It has one
     -- template, so the widget-wide contentparams was never ambiguous for it.
-    DYNAMICTEXT dt ( Content: '{1}', ContentParams: [{1} = Name] )
+    DYNAMICTEXT dt ( Content: '{1}', ContentParams: ({1} = Name) )
 
     -- The fix, in the schema-key spelling: each template names its own
     -- parameters, so the two bind DIFFERENT attributes.
     PLUGGABLEWIDGET 'com.mendix.widget.web.image.Image' cardImage (
       datasource: imageUrl,
-      imageUrl: '{1}',        imageUrlParams: [{1} = PictureUrl],
-      alternativeText: '{1}', alternativeTextParams: [{1} = Name]
+      imageUrl: '{1}',        imageUrlParams: ({1} = PictureUrl),
+      alternativeText: '{1}', alternativeTextParams: ({1} = Name)
     )
 
     -- The same, in the source-name spelling the def.json also accepts. This
@@ -92,8 +92,8 @@ create or modify page Bug575.Catalogue (
     -- #928 wired only into the schema-key path.
     PLUGGABLEWIDGET 'com.mendix.widget.web.image.Image' cardImage2 (
       datasource: imageUrl,
-      ImageUrl: '{1}',        ImageUrlParams: [{1} = PictureUrl],
-      AlternativeText: '{1}', AlternativeTextParams: [{1} = Name]
+      ImageUrl: '{1}',        ImageUrlParams: ({1} = PictureUrl),
+      AlternativeText: '{1}', AlternativeTextParams: ({1} = Name)
     )
 
     -- Unchanged: the widget-wide contentparams remains the fallback for a
@@ -101,7 +101,7 @@ create or modify page Bug575.Catalogue (
     -- untouched.
     PLUGGABLEWIDGET 'com.mendix.widget.web.image.Image' cardImage3 (
       datasource: imageUrl,
-      imageUrl: '{1}', contentparams: [{1} = PictureUrl]
+      imageUrl: '{1}', contentparams: ({1} = PictureUrl)
     )
   }
 }
@@ -118,7 +118,7 @@ create or modify page Bug575.Tree (
   TREENODE tnProduct (
     datasource: DATABASE Bug575.Product,
     headerType: 'text',
-    headerCaption: '{1}', headerCaptionParams: [{1} = Name]
+    headerCaption: '{1}', headerCaptionParams: ({1} = Name)
   )
 
   -- Three templates on one widget, of which two are bound to DIFFERENT
@@ -127,8 +127,8 @@ create or modify page Bug575.Tree (
   TIMELINE tl (
     data: DATABASE Bug575.Product,
     groupEvents: false,
-    title: '{1}',       titleParams: [{1} = Name],
-    description: '{1}', descriptionParams: [{1} = PictureUrl]
+    title: '{1}',       titleParams: ({1} = Name),
+    description: '{1}', descriptionParams: ({1} = PictureUrl)
   )
 }
 /
diff --git a/mdl-examples/bug-tests/widgets-deprecated-builtins.mdl b/mdl-examples/bug-tests/widgets-deprecated-builtins.mdl
index 5c4c96fdd1..62d9c83fa7 100644
--- a/mdl-examples/bug-tests/widgets-deprecated-builtins.mdl
+++ b/mdl-examples/bug-tests/widgets-deprecated-builtins.mdl
@@ -32,7 +32,7 @@ create or modify entity WidgetProbe.Ticket (
 
 create or replace page WidgetProbe.PDeprecatedWidgets
 (
-  params: { $Ticket: WidgetProbe.Ticket },
+  params: ( $Ticket: WidgetProbe.Ticket ),
   title: 'Deprecated built-in widgets',
   layout: Atlas_Core.Atlas_Default
 )
diff --git a/mdl-examples/bug-tests/workflow-408-describe-roundtrip.mdl b/mdl-examples/bug-tests/workflow-408-describe-roundtrip.mdl
index e2d2b4bb2b..293597c5d9 100644
--- a/mdl-examples/bug-tests/workflow-408-describe-roundtrip.mdl
+++ b/mdl-examples/bug-tests/workflow-408-describe-roundtrip.mdl
@@ -32,7 +32,7 @@ create entity WF408.Order (
 create page WF408.ReworkPage (
   title: 'Rework',
   layout: Atlas_Core.Atlas_Default,
-  params: { $WorkflowUserTask: System.WorkflowUserTask }
+  params: ( $WorkflowUserTask: System.WorkflowUserTask )
 ) {
   layoutgrid g1 {
     row r1 {
diff --git a/mdl-examples/bug-tests/workflow-586-clause-order-canonical.mdl b/mdl-examples/bug-tests/workflow-586-clause-order-canonical.mdl
index 165dd72f9e..73657f3e05 100644
--- a/mdl-examples/bug-tests/workflow-586-clause-order-canonical.mdl
+++ b/mdl-examples/bug-tests/workflow-586-clause-order-canonical.mdl
@@ -20,7 +20,7 @@ create entity WF586.Request (
 create page WF586.TaskPage (
   title: 'Task',
   layout: Atlas_Core.Atlas_Default,
-  params: { $WorkflowUserTask: System.WorkflowUserTask }
+  params: ( $WorkflowUserTask: System.WorkflowUserTask )
 ) {
   layoutgrid g1 {
     row r1 {
diff --git a/mdl-examples/bug-tests/workflow-586-clause-order.mdl b/mdl-examples/bug-tests/workflow-586-clause-order.mdl
index 2a6b07ad98..2d5d4a5fb8 100644
--- a/mdl-examples/bug-tests/workflow-586-clause-order.mdl
+++ b/mdl-examples/bug-tests/workflow-586-clause-order.mdl
@@ -38,7 +38,7 @@ create entity WF586.Request (
 create page WF586.TaskPage (
   title: 'Task',
   layout: Atlas_Core.Atlas_Default,
-  params: { $WorkflowUserTask: System.WorkflowUserTask }
+  params: ( $WorkflowUserTask: System.WorkflowUserTask )
 ) {
   layoutgrid g1 {
     row r1 {
diff --git a/mdl-examples/bug-tests/workflow-586b-overview-page-dropped.mdl b/mdl-examples/bug-tests/workflow-586b-overview-page-dropped.mdl
index c86f9a8281..381b796286 100644
--- a/mdl-examples/bug-tests/workflow-586b-overview-page-dropped.mdl
+++ b/mdl-examples/bug-tests/workflow-586b-overview-page-dropped.mdl
@@ -48,7 +48,7 @@ create entity WF586B.Request (
 create page WF586B.Overview (
   title: 'Requests',
   layout: Atlas_Core.Atlas_Default,
-  params: { $Workflow: System.Workflow }
+  params: ( $Workflow: System.Workflow )
 ) {
   layoutgrid g1 {
     row r1 {
@@ -63,7 +63,7 @@ create page WF586B.Overview (
 create page WF586B.TaskPage (
   title: 'Task',
   layout: Atlas_Core.Atlas_Default,
-  params: { $WorkflowUserTask: System.WorkflowUserTask }
+  params: ( $WorkflowUserTask: System.WorkflowUserTask )
 ) {
   layoutgrid g1 {
     row r1 {
diff --git a/mdl-examples/bug-tests/workflow-actions-describe.mdl b/mdl-examples/bug-tests/workflow-actions-describe.mdl
index b9b9687a64..44af5f3787 100644
--- a/mdl-examples/bug-tests/workflow-actions-describe.mdl
+++ b/mdl-examples/bug-tests/workflow-actions-describe.mdl
@@ -36,7 +36,7 @@ create module W;
 create persistent entity W.Order (Code: String(20));
 
 create page W.ReviewPage (
-  params: { $Task: System.WorkflowUserTask },
+  params: ( $Task: System.WorkflowUserTask ),
   title: 'Review', layout: Atlas_Core.Atlas_Default
 ) {
   layoutgrid g { row r { column c (desktopwidth: 12) {
diff --git a/mdl-examples/bug-tests/workflow-end-activity.mdl b/mdl-examples/bug-tests/workflow-end-activity.mdl
index 27da19602e..3b3e75c436 100644
--- a/mdl-examples/bug-tests/workflow-end-activity.mdl
+++ b/mdl-examples/bug-tests/workflow-end-activity.mdl
@@ -26,7 +26,7 @@ create persistent entity WFEND.Request (
 create page WFEND.TaskPage (
   title: 'Task',
   layout: Atlas_Core.Atlas_Default,
-  params: { $WorkflowUserTask: System.WorkflowUserTask }
+  params: ( $WorkflowUserTask: System.WorkflowUserTask )
 ) {
   layoutgrid g1 { row r1 { column c1 (desktopwidth: 12) { dynamictext t1 (content: 'Task') } } }
 }
diff --git a/mdl-examples/bug-tests/workflow-end-every-path-ends.fail.mdl b/mdl-examples/bug-tests/workflow-end-every-path-ends.fail.mdl
index 862bf08a1b..a46d4dd576 100644
--- a/mdl-examples/bug-tests/workflow-end-every-path-ends.fail.mdl
+++ b/mdl-examples/bug-tests/workflow-end-every-path-ends.fail.mdl
@@ -8,7 +8,7 @@
 -- last.
 
 create persistent entity WFEND.Ctx ( Title: string(50) );
-create page WFEND.TaskPage ( title: 'T', layout: Atlas_Core.Atlas_Default, params: { $WorkflowUserTask: System.WorkflowUserTask } ) { };
+create page WFEND.TaskPage ( title: 'T', layout: Atlas_Core.Atlas_Default, params: ( $WorkflowUserTask: System.WorkflowUserTask ) ) { };
 
 create workflow WFEND.EveryPathEnds parameter $Ctx: WFEND.Ctx
 begin
diff --git a/mdl-examples/bug-tests/workflow-end-in-parallel-split.fail.mdl b/mdl-examples/bug-tests/workflow-end-in-parallel-split.fail.mdl
index 8e7a92d072..d16f7a1754 100644
--- a/mdl-examples/bug-tests/workflow-end-in-parallel-split.fail.mdl
+++ b/mdl-examples/bug-tests/workflow-end-in-parallel-split.fail.mdl
@@ -6,7 +6,7 @@
 -- directly in a path and in an outcome nested inside one.
 
 create persistent entity WFEND.Ctx ( Title: string(50) );
-create page WFEND.TaskPage ( title: 'T', layout: Atlas_Core.Atlas_Default, params: { $WorkflowUserTask: System.WorkflowUserTask } ) { };
+create page WFEND.TaskPage ( title: 'T', layout: Atlas_Core.Atlas_Default, params: ( $WorkflowUserTask: System.WorkflowUserTask ) ) { };
 
 create workflow WFEND.EndInSplit parameter $Ctx: WFEND.Ctx
 begin
diff --git a/mdl-examples/bug-tests/workflow-end-not-last.fail.mdl b/mdl-examples/bug-tests/workflow-end-not-last.fail.mdl
index 673ef3388b..f2c6bd8a11 100644
--- a/mdl-examples/bug-tests/workflow-end-not-last.fail.mdl
+++ b/mdl-examples/bug-tests/workflow-end-not-last.fail.mdl
@@ -5,7 +5,7 @@
 -- what follows. Measured on mxbuild 11.13.0.
 
 create persistent entity WFEND.Ctx ( Title: string(50) );
-create page WFEND.TaskPage ( title: 'T', layout: Atlas_Core.Atlas_Default, params: { $WorkflowUserTask: System.WorkflowUserTask } ) { };
+create page WFEND.TaskPage ( title: 'T', layout: Atlas_Core.Atlas_Default, params: ( $WorkflowUserTask: System.WorkflowUserTask ) ) { };
 
 create workflow WFEND.EndNotLast parameter $Ctx: WFEND.Ctx
 begin
diff --git a/mdl-examples/bug-tests/workflow-return-in-workflow.fail.mdl b/mdl-examples/bug-tests/workflow-return-in-workflow.fail.mdl
index b942fd0195..66186307e3 100644
--- a/mdl-examples/bug-tests/workflow-return-in-workflow.fail.mdl
+++ b/mdl-examples/bug-tests/workflow-return-in-workflow.fail.mdl
@@ -7,7 +7,7 @@
 -- rather than the block it is written in.
 
 create persistent entity WFEND.Ctx ( Title: string(50) );
-create page WFEND.TaskPage ( title: 'T', layout: Atlas_Core.Atlas_Default, params: { $WorkflowUserTask: System.WorkflowUserTask } ) { };
+create page WFEND.TaskPage ( title: 'T', layout: Atlas_Core.Atlas_Default, params: ( $WorkflowUserTask: System.WorkflowUserTask ) ) { };
 
 create workflow WFEND.ReturnInWorkflow parameter $Ctx: WFEND.Ctx
 begin
diff --git a/mdl-examples/bug-tests/workflow-task-page-and-targeting-signatures.mdl b/mdl-examples/bug-tests/workflow-task-page-and-targeting-signatures.mdl
index 35555ef956..9ce923e7b3 100644
--- a/mdl-examples/bug-tests/workflow-task-page-and-targeting-signatures.mdl
+++ b/mdl-examples/bug-tests/workflow-task-page-and-targeting-signatures.mdl
@@ -46,7 +46,7 @@ create persistent entity WFSIG.UrgentRequest extends WFSIG.Request ( Reason: str
 create page WFSIG.ReviewPage (
   title: 'Review',
   layout: Atlas_Core.Atlas_Default,
-  params: { $WorkflowUserTask: System.WorkflowUserTask, $Request: WFSIG.Request }
+  params: ( $WorkflowUserTask: System.WorkflowUserTask, $Request: WFSIG.Request )
 ) {
   layoutgrid g1 { row r1 { column c1 (desktopwidth: 12) { dynamictext t1 (content: 'Review') } } }
 }
diff --git a/mdl-examples/bug-tests/workflow-wait-for-notification-boundary.mdl b/mdl-examples/bug-tests/workflow-wait-for-notification-boundary.mdl
index 4625f7b75b..3ce001d9b7 100644
--- a/mdl-examples/bug-tests/workflow-wait-for-notification-boundary.mdl
+++ b/mdl-examples/bug-tests/workflow-wait-for-notification-boundary.mdl
@@ -26,7 +26,7 @@ create persistent entity WFWN.Request ( Title: string(100) );
 create page WFWN.TaskPage (
   title: 'Task',
   layout: Atlas_Core.Atlas_Default,
-  params: { $WorkflowUserTask: System.WorkflowUserTask }
+  params: ( $WorkflowUserTask: System.WorkflowUserTask )
 ) {
   layoutgrid g1 { row r1 { column c1 (desktopwidth: 12) { dynamictext t1 (content: 'Task') } } }
 }
diff --git a/mdl-examples/bug-tests/xpath-assoc-path-expansion.mdl b/mdl-examples/bug-tests/xpath-assoc-path-expansion.mdl
index a19844a19a..12f197c477 100644
--- a/mdl-examples/bug-tests/xpath-assoc-path-expansion.mdl
+++ b/mdl-examples/bug-tests/xpath-assoc-path-expansion.mdl
@@ -38,7 +38,7 @@ create association Travel.Trip_Day from Travel.Day to Travel.Trip;
 create association Travel.Day_Activity from Travel.Activity to Travel.Day;
 /
 create or replace page Travel.Trip_Detail (
-  params: { $Trip: Travel.Trip },
+  params: ( $Trip: Travel.Trip ),
   layout: Atlas_Core.Atlas_Default
 ) {
   -- one-hop reverse association (already worked; must stay working)
diff --git a/mdl-examples/doctype-tests/02-microflow-examples.mdl b/mdl-examples/doctype-tests/02-microflow-examples.mdl
index 74c6a5f562..4f3425979b 100644
--- a/mdl-examples/doctype-tests/02-microflow-examples.mdl
+++ b/mdl-examples/doctype-tests/02-microflow-examples.mdl
@@ -2687,9 +2687,9 @@ end;
  */
 create page MfTest.ProductDetail
 (
-  params: {
+  params: (
     $Product: MfTest.Product
-  },
+  ),
   title: 'Product Detail',
   layout: Atlas_Core.Atlas_Default
 )
diff --git a/mdl-examples/doctype-tests/03-page-examples.mdl b/mdl-examples/doctype-tests/03-page-examples.mdl
index f137e8efe3..f8e2807086 100644
--- a/mdl-examples/doctype-tests/03-page-examples.mdl
+++ b/mdl-examples/doctype-tests/03-page-examples.mdl
@@ -188,15 +188,15 @@ create page PgTest.P003_1_Nested_LayoutGrid_Dynamic_Text_Page
     }
     row row3 {
       column col3a (desktopwidth: autofill) {
-        actionbutton btnSave1 (caption: 'Save {1}', captionparams: [{1} = 'Hello'], action: save_changes, buttonstyle: primary)
+        actionbutton btnSave1 (caption: 'Save {1}', captionparams: ({1} = 'Hello'), action: save_changes, buttonstyle: primary)
       }
       column col3b (desktopwidth: autofill) {
-        actionbutton btnSave2 (caption: 'Cancel {1}', captionparams: [{1} = 'Hello'], action: cancel_changes, buttonstyle: default)
+        actionbutton btnSave2 (caption: 'Cancel {1}', captionparams: ({1} = 'Hello'), action: cancel_changes, buttonstyle: default)
       }
     }
     row row4 {
       column col4 (desktopwidth: autofill) {
-        dynamictext text5 (content: 'Just some H4 header: {1}', contentparams: [{1} = 'Hello'], rendermode: H4)
+        dynamictext text5 (content: 'Just some H4 header: {1}', contentparams: ({1} = 'Hello'), rendermode: H4)
       }
     }
   }
@@ -242,7 +242,7 @@ create page PgTest.P005_OrderEdit
     }
     row row2 {
       column col2a (desktopwidth: 6) {
-        actionbutton btnSave (caption: 'Save {1}', captionparams: [{1} = 'Hello'], action: save_changes, buttonstyle: primary)
+        actionbutton btnSave (caption: 'Save {1}', captionparams: ({1} = 'Hello'), action: save_changes, buttonstyle: primary)
       }
       column col2b (desktopwidth: 6) {
         actionbutton btnCancel (caption: 'Cancel', action: cancel_changes)
@@ -261,9 +261,9 @@ create page PgTest.P005_OrderEdit
  */
 create page PgTest.P006_DataForm
 (
-  params: {
+  params: (
     $Customer: PgTest.Customer
-  },
+  ),
   title: 'Edit Customer',
   layout: Atlas_Core.Atlas_Default,
   url: 'p006_dataform/{Customer/Name}',
@@ -298,7 +298,7 @@ create page PgTest.P006_DataForm
     row row3 {
       column col3a (desktopwidth: 6) { }
       column col3b (desktopwidth: 6) {
-        actionbutton btnSave (caption: 'Save {1}', captionparams: [{1} = 'abc'], action: save_changes, buttonstyle: primary)
+        actionbutton btnSave (caption: 'Save {1}', captionparams: ({1} = 'abc'), action: save_changes, buttonstyle: primary)
       }
     }
   }
@@ -433,7 +433,7 @@ create page PgTest.P008_Product_Overview
     row row1 {
       column col1 (desktopwidth: 12) {
         dynamictext textIntro (content: 'P008_Product_Overview', rendermode: H3)
-        dynamictext textIntro2 (content: 'P008_Product_Overview: {1}', contentparams: [{1}='abc'], rendermode: H3)
+        dynamictext textIntro2 (content: 'P008_Product_Overview: {1}', contentparams: ({1}='abc'), rendermode: H3)
       }
     }
     row row2 {
@@ -582,9 +582,9 @@ create page PgTest.P010_Product_Sorted_filtered_styled_2 (
     datasource:  database from PgTest.Product where (IsActive = true() and contains(Code, 'a') and Price > 10) or (Stock < 2) sort by PgTest.Product.Name asc, PgTest.Product.Price desc, 
     PageSize: 10, 
     PagingPosition: both, 
-    designproperties: ['Compact': on, 'Striped': on, 'Hover': on, 'Borders': 'Horizontal']
+    designproperties: ('Compact': on, 'Striped': on, 'Hover': on, 'Borders': 'Horizontal')
   ) {
-    column colName (attribute: Name, caption: 'Product Name', Alignment: left, WrapText: false, designproperties: ['Compact': on, 'Striped': on, 'Hover': on, 'Borders': 'Horizontal'])
+    column colName (attribute: Name, caption: 'Product Name', Alignment: left, WrapText: false, designproperties: ('Compact': on, 'Striped': on, 'Hover': on, 'Borders': 'Horizontal'))
     column colCode (attribute: Code, caption: 'SKU')
     column colPrice (attribute: Price, caption: 'Unit Price', Alignment: right, WrapText: false)
     column colStock (attribute: Stock, caption: 'Available', Alignment: right, WrapText: false)
@@ -617,9 +617,9 @@ create page PgTest.P010_Product_Microflow_DataSource (
     datasource: microflow PgTest.P010_DSO_GetProducts ,
     PageSize: 10, 
     PagingPosition: both, 
-    designproperties: ['Compact': on, 'Striped': on, 'Hover': on, 'Borders': 'Horizontal']
+    designproperties: ('Compact': on, 'Striped': on, 'Hover': on, 'Borders': 'Horizontal')
   ) {
-    column colName (attribute: Name, caption: 'Product Name', Alignment: left, WrapText: false, designproperties: ['Compact': on, 'Striped': on, 'Hover': on, 'Borders': 'Horizontal'])
+    column colName (attribute: Name, caption: 'Product Name', Alignment: left, WrapText: false, designproperties: ('Compact': on, 'Striped': on, 'Hover': on, 'Borders': 'Horizontal'))
     column colCode (attribute: Code, caption: 'SKU')
     column colPrice (attribute: Price, caption: 'Unit Price', Alignment: right, WrapText: false)
     column colStock (attribute: Stock, caption: 'Available', Alignment: right, WrapText: false)
@@ -641,9 +641,9 @@ create page PgTest.P010_Product_Microflow_DataSource (
  */
 create page PgTest.P011_DataGrid_ControlBar_Dummy
 (
-  params: {
+  params: (
     $Product: PgTest.Product
-  },
+  ),
   title: 'Edit Product',
   layout: Atlas_Core.PopupLayout,
   folder: 'DataGrid'
@@ -653,7 +653,7 @@ create page PgTest.P011_DataGrid_ControlBar_Dummy
     row row1 {
       column col1 (desktopwidth: 12) {
         dynamictext textIntro (content: 'Dummy', rendermode: H3)
-        dynamictext textIntro2 (content: 'Dummy: {1}', contentparams: [{1}=$Product.Name], rendermode: H3)
+        dynamictext textIntro2 (content: 'Dummy: {1}', contentparams: ({1}=$Product.Name), rendermode: H3)
       }
     }
   }
@@ -666,10 +666,10 @@ create page PgTest.P011_DataGrid_ControlBar_Dummy
  */
 create page PgTest.P011_DataGrid_ControlBar_Dummy_2
 (
-  params: {
+  params: (
     $Product1: PgTest.Product,
     $Product2: PgTest.Product
-  },
+  ),
   title: 'Edit Product',
   layout: Atlas_Core.PopupLayout,
   folder: 'DataGrid'
@@ -679,8 +679,8 @@ create page PgTest.P011_DataGrid_ControlBar_Dummy_2
     row row1 {
       column col1 (desktopwidth: 12) {
         dynamictext textIntro1 (content: 'Dummy', rendermode: H3)
-        dynamictext textIntro2 (content: 'Dummy: {1}, {2}', contentparams: [{1}=$Product1.Name, {2}=$Product1.Code], rendermode: paragraph)
-        dynamictext textIntro3 (content: 'Dummy: {1}, {2}', contentparams: [{1}=$Product2.Name, {2}=$Product2.Code], rendermode: text)
+        dynamictext textIntro2 (content: 'Dummy: {1}, {2}', contentparams: ({1}=$Product1.Name, {2}=$Product1.Code), rendermode: paragraph)
+        dynamictext textIntro3 (content: 'Dummy: {1}, {2}', contentparams: ({1}=$Product2.Name, {2}=$Product2.Code), rendermode: text)
       }
     }
   }
@@ -728,9 +728,9 @@ create page PgTest.P011_DataGrid_ControlBar
  */
 create page PgTest.P012_Product_Manage_Edit
 (
-  params: {
+  params: (
     $Product: PgTest.Product
-  },
+  ),
   title: 'Edit Product',
   layout: Atlas_Core.PopupLayout,
   folder: 'DataGrid'
@@ -771,7 +771,7 @@ create page PgTest.P012_Product_Manage
     row row1 {
       column col1 (desktopwidth: 12) {
         dynamictext textIntro (content: 'P008_Product_Overview', rendermode: H3)
-        dynamictext textIntro2 (content: 'P008_Product_Overview: {1}', contentparams: [{1}='abc'], rendermode: H3)
+        dynamictext textIntro2 (content: 'P008_Product_Overview: {1}', contentparams: ({1}='abc'), rendermode: H3)
       }
     }
     row row2 {
@@ -1031,7 +1031,7 @@ create page PgTest.P013e_ControlBar_Container_Action
 create or replace page PgTest.P014_Product_Edit (
   title: 'Edit Product',
   layout: Atlas_Core.PopupLayout,
-  params: { $Product: PgTest.Product },
+  params: ( $Product: PgTest.Product ),
   folder: 'DataView'
 ) {
   dataview ProductForm (datasource: $Product) {
@@ -1058,9 +1058,9 @@ create or replace page PgTest.P014_Product_Edit (
  */
 create page PgTest.P015_Product_EditFull
 (
-  params: {
+  params: (
     $Product: PgTest.Product
-  },
+  ),
   title: 'Edit Product Details',
   layout: Atlas_Core.PopupLayout,
   folder: 'DataView'
@@ -1114,7 +1114,7 @@ create page PgTest.P015_Product_EditFull
 create or replace page PgTest.P018_DataView_FormOrientation_Vertical (
   title: 'Vertical Form',
   layout: Atlas_Core.PopupLayout,
-  params: { $Product: PgTest.Product },
+  params: ( $Product: PgTest.Product ),
   folder: 'DataView'
 ) {
   dataview ProductForm (datasource: $Product, FormOrientation: Vertical) {
@@ -1135,7 +1135,7 @@ create or replace page PgTest.P018_DataView_FormOrientation_Vertical (
 create or replace page PgTest.P018_DataView_FormOrientation_Horizontal (
   title: 'Horizontal Form',
   layout: Atlas_Core.PopupLayout,
-  params: { $Product: PgTest.Product },
+  params: ( $Product: PgTest.Product ),
   folder: 'DataView'
 ) {
   dataview ProductForm (datasource: $Product, FormOrientation: Horizontal) {
@@ -1156,7 +1156,7 @@ create or replace page PgTest.P018_DataView_FormOrientation_Horizontal (
 create or replace page PgTest.P018_DataView_LabelWidth (
   title: 'Custom Label Width',
   layout: Atlas_Core.PopupLayout,
-  params: { $Product: PgTest.Product },
+  params: ( $Product: PgTest.Product ),
   folder: 'DataView'
 ) {
   dataview ProductForm (datasource: $Product, LabelWidth: 5) {
@@ -1219,9 +1219,9 @@ create snippet PgTest.NavigationMenuList(
  */
 create or replace snippet PgTest.CustomerInfo
 (
-  params: {
+  params: (
     $Customer: PgTest.Customer
-  },
+  ),
   folder: 'Snippets'
 )
 {
@@ -1247,9 +1247,9 @@ create or replace snippet PgTest.CustomerInfo
  */
 create snippet PgTest.CustomerSidebar
 (
-  params: {
+  params: (
     $Customer: PgTest.Customer
-  },
+  ),
   folder: 'Snippets'
 )
 {
@@ -1392,17 +1392,18 @@ create page PgTest.P016_Page_With_Snippet
  * Page that calls a parameterized snippet with Params: mapping.
  * Demonstrates fix for issue #291: SNIPPETCALL with Params syntax.
  *
- * Two forms are accepted:
- *   Params: {Customer: $Customer}   -- bare parameter name (keywords OK)
- *   Params: {$Customer: $Customer}  -- dollar-prefixed parameter name
+ * A snippet call binds its arguments as every call does (R4), in the ( ) of a
+ * map (R2):
+ *   Params: (Customer = $Customer)  -- parameter name without `$` (keywords OK)
+ * The old brace map, {$Customer: $Customer}, still parses and warns (MDL-DEPR126).
  */
 create or replace page PgTest.P017_SnippetCall_With_Params
 (
   title: 'Customer Detail with Snippet',
   layout: Atlas_Core.Atlas_Default,
-  params: {
+  params: (
     $Customer: PgTest.Customer
-  },
+  ),
   url: 'p017_snippet_with_params/{Customer/Name}',
   folder: 'Snippets'
 )
@@ -1413,14 +1414,14 @@ create or replace page PgTest.P017_SnippetCall_With_Params
         -- Call CustomerInfo snippet — bare parameter name form
         snippetcall customerInfoSnippet (
           snippet: PgTest.CustomerInfo,
-          params: {Customer: $Customer}
+          params: (Customer = $Customer)
         )
       }
       column col2 (desktopwidth: 4) {
         -- Call CustomerSidebar snippet — dollar-prefixed parameter name form
         snippetcall sidebarSnippet (
           snippet: PgTest.CustomerSidebar,
-          params: {$Customer: $Customer}
+          params: (Customer = $Customer)
         )
       }
     }
@@ -1480,9 +1481,9 @@ create page PgTest.P019_Gallery_Simple
           selection: single
         ) {
           template template1 {
-            dynamictext custName (content: '{1}',contentparams:[{1}=Name], rendermode: H4)
-            dynamictext custEmail (content: '{1}',contentparams:[{1}=Email], rendermode: text)
-            dynamictext custCity (content: '{1}',contentparams:[{1}=City], rendermode: text)
+            dynamictext custName (content: '{1}',contentparams:({1}=Name), rendermode: H4)
+            dynamictext custEmail (content: '{1}',contentparams:({1}=Email), rendermode: text)
+            dynamictext custCity (content: '{1}',contentparams:({1}=City), rendermode: text)
           }
         }
       }
@@ -1512,15 +1513,15 @@ create page PgTest.P020_Master_Detail
     row row1 {
       -- Master list (4 columns)
       column colMaster (desktopwidth: 4) {
-        dynamictext masterTitle (content: 'Customers: {1}',contentparams:[{1}='too many'], rendermode: H3)
+        dynamictext masterTitle (content: 'Customers: {1}',contentparams:({1}='too many'), rendermode: H3)
         gallery customerList (
           datasource: database from PgTest.Customer sort by Name asc,
           selection: single,
           ItemSelectionMode: toggle
         ) {
           template template1 {
-            dynamictext custName (content: '{1}',contentparams:[{1}=Name], rendermode: H4)
-            dynamictext custEmail (content: 'Email: {1}',contentparams:[{1}=Email], rendermode: text)
+            dynamictext custName (content: '{1}',contentparams:({1}=Name), rendermode: H4)
+            dynamictext custEmail (content: 'Email: {1}',contentparams:({1}=Email), rendermode: text)
           }
         }
       }
@@ -1569,9 +1570,9 @@ create page PgTest.P022_Gallery_With_Filter
             textfilter searchName (attributes: [Name])
           }
           template template1 {
-            dynamictext prodName (content: '{1}',contentparams:[{1}=Name], rendermode: H4)
-            dynamictext prodCode (content: 'SKU: {1}',contentparams:[{1}=Code], rendermode: text)
-            dynamictext prodPrice (content: 'Price: {1}',contentparams:[{1}=Price], rendermode: text)
+            dynamictext prodName (content: '{1}',contentparams:({1}=Name), rendermode: H4)
+            dynamictext prodCode (content: 'SKU: {1}',contentparams:({1}=Code), rendermode: text)
+            dynamictext prodPrice (content: 'Price: {1}',contentparams:({1}=Price), rendermode: text)
           }
         }
       }
@@ -1598,9 +1599,9 @@ create page PgTest.P022_Gallery_With_Filter_2 (
             textfilter textFilter1 (attributes: [Name])
           }
           template template1 {
-            dynamictext text1 (content: '{1}', rendermode: H4, contentparams: [{1} = Name])
-            dynamictext text2 (content: 'SKU: {1}', contentparams: [{1} = Code])
-            dynamictext text3 (content: 'Price: {1}', contentparams: [{1} = Price])
+            dynamictext text1 (content: '{1}', rendermode: H4, contentparams: ({1} = Name))
+            dynamictext text2 (content: 'SKU: {1}', contentparams: ({1} = Code))
+            dynamictext text3 (content: 'Price: {1}', contentparams: ({1} = Price))
           }
         }
       }
@@ -1628,15 +1629,15 @@ create page PgTest.P022_Gallery_With_Filter_3 (
             layoutgrid layoutGrid2 {
               row row1 {
                 column col1 (desktopwidth: autofill) {
-                  dynamictext text1 (content: '{1}', rendermode: H4, contentparams: [{1} = Name])
+                  dynamictext text1 (content: '{1}', rendermode: H4, contentparams: ({1} = Name))
                 }
               }
               row row2 {
                 column col1 (desktopwidth: autofill) {
-                  dynamictext text2 (content: 'SKU: {1}', contentparams: [{1} = Code])
+                  dynamictext text2 (content: 'SKU: {1}', contentparams: ({1} = Code))
                 }
                 column col2 (desktopwidth: autofill) {
-                  dynamictext text3 (content: 'Price: {1}', contentparams: [{1} = Price])
+                  dynamictext text3 (content: 'Price: {1}', contentparams: ({1} = Price))
                 }
               }
             }
@@ -1668,15 +1669,15 @@ create page PgTest.P022_Gallery_With_Filter_4 (
             layoutgrid layoutGrid2 {
               row row1 {
                 column col1 (desktopwidth: autofill) {
-                  dynamictext text1 (content: '{1}', rendermode: H4, contentparams: [{1} = Name])
+                  dynamictext text1 (content: '{1}', rendermode: H4, contentparams: ({1} = Name))
                 }
               }
               row row2 {
                 column col1 (desktopwidth: autofill) {
-                  dynamictext text2 (content: 'SKU: {1}', contentparams: [{1} = Code])
+                  dynamictext text2 (content: 'SKU: {1}', contentparams: ({1} = Code))
                 }
                 column col2 (desktopwidth: autofill) {
-                  dynamictext text3 (content: 'Price: {1}', contentparams: [{1} = Price])
+                  dynamictext text3 (content: 'Price: {1}', contentparams: ({1} = Price))
                 }
               }
             }
@@ -1702,19 +1703,19 @@ create page PgTest.P023_Gallery_MultiSelect
     row row1 {
       column col1 (desktopwidth: 12) {
         dynamictext pageTitle1 (content: 'Select Products for Batch Action', rendermode: H1)
-        dynamictext pageTitle2 (content: '{1}',contentparams:[{1}='Select Products for Batch Action'], rendermode: H2)
-        dynamictext pageTitle3 (content: 'Select {1}',contentparams:[{1}='Products for Batch Action'], rendermode: H3)
-        dynamictext pageTitle4 (content: '{1} - {2}',contentparams:[{1}='Select ', {2}='Products for Batch Action'], rendermode: H4)
-        dynamictext pageTitle5 (content: '{1} - {2} - {3}',contentparams:[{1}='Select ', {2}='Products for Batch Action', {3}='Extra'], rendermode: H5)
-        dynamictext pageTitle6 (content: '{1} - {2} - {3} - {4}',contentparams:[{1}='Select ', {2}='Products for Batch Action', {3}='Extra', {4}='More'], rendermode: H6)
+        dynamictext pageTitle2 (content: '{1}',contentparams:({1}='Select Products for Batch Action'), rendermode: H2)
+        dynamictext pageTitle3 (content: 'Select {1}',contentparams:({1}='Products for Batch Action'), rendermode: H3)
+        dynamictext pageTitle4 (content: '{1} - {2}',contentparams:({1}='Select ', {2}='Products for Batch Action'), rendermode: H4)
+        dynamictext pageTitle5 (content: '{1} - {2} - {3}',contentparams:({1}='Select ', {2}='Products for Batch Action', {3}='Extra'), rendermode: H5)
+        dynamictext pageTitle6 (content: '{1} - {2} - {3} - {4}',contentparams:({1}='Select ', {2}='Products for Batch Action', {3}='Extra', {4}='More'), rendermode: H6)
       }
     }
     row row2 {
       column col2 (desktopwidth: 12) {
         gallery productGallery (datasource: database PgTest.Product, selection: multiple) {
           template template1 {
-            dynamictext prodName (content: '{1}',contentparams:[{1}=Name], rendermode: H4)
-            dynamictext prodStock (content: 'Stock: {1}',contentparams:[{1}=Stock], rendermode: text)
+            dynamictext prodName (content: '{1}',contentparams:({1}=Name), rendermode: H4)
+            dynamictext prodStock (content: 'Stock: {1}',contentparams:({1}=Stock), rendermode: text)
           }
         }
       }
@@ -1749,7 +1750,7 @@ create page PgTest.P024_Gallery_Columns
           PhoneColumns: 1
         ) {
           template template1 {
-            dynamictext prodName (content: '{1}', contentparams: [{1} = Name], rendermode: H4)
+            dynamictext prodName (content: '{1}', contentparams: ({1} = Name), rendermode: H4)
           }
         }
       }
@@ -1873,9 +1874,9 @@ create page PgTest.P023b_DataGrid_MicroflowActions
  */
 create page PgTest.P023c_Detail_MicroflowAction
 (
-  params: {
+  params: (
     $Product: PgTest.Product
-  },
+  ),
   title: 'Product Details',
   layout: Atlas_Core.PopupLayout,
   url: 'p023c_detail_microflow/{Product/Code}',
@@ -1938,9 +1939,9 @@ owner both;
  */
 create page PgTest.P024_Template_Basic
 (
-  params: {
+  params: (
     $Order: PgTest.Order
-  },
+  ),
   title: 'Order Details',
   layout: Atlas_Core.Atlas_Default,
   url: 'p024_template_basic/{Order/OrderNumber}',
@@ -1953,25 +1954,25 @@ create page PgTest.P024_Template_Basic
         dataview dvOrder (datasource: $Order) {
           dynamictext txtOrderHeader (
             content: 'Order #{1} - Status: {2}',
-            contentparams: [{1} = $order.OrderNumber, {2} = $order.status],
+            contentparams: ({1} = $order.OrderNumber, {2} = $order.status),
             rendermode: H3
           )
 
           dynamictext txtOrderDate (
             content: 'Placed on: {1}',
-            contentparams: [{1} = $order.OrderDate],
+            contentparams: ({1} = $order.OrderDate),
             rendermode: paragraph
           )
 
           dynamictext txtTotal (
             content: 'Total Amount: ${1}',
-            contentparams: [{1} = $order.TotalAmount],
+            contentparams: ({1} = $order.TotalAmount),
             rendermode: H4
           )
 
           actionbutton btnProcess (
             caption: 'Process Order #{1}',
-            captionparams: [{1} = $order.OrderNumber],
+            captionparams: ({1} = $order.OrderNumber),
             action: microflow PgTest.ProcessProducts,
             buttonstyle: primary
           )
@@ -1996,7 +1997,7 @@ create page PgTest.P024_Template_Basic
 
 create page PgTest.StyledPage
 (
-  params: { $Customer: PgTest.Customer },
+  params: ( $Customer: PgTest.Customer ),
   title: 'Styled Customer',
   layout: Atlas_Core.Atlas_Default,
   folder: 'Styling'
@@ -2009,7 +2010,7 @@ create page PgTest.StyledPage
       -- NOTE: an inline `style` on a dynamictext crashes MxBuild — style the
       -- wrapping container instead (the dynamictext keeps its class).
       container ctnCity (style: 'font-size: 12px;') {
-        dynamictext dtCity (content: 'City: {1}', contentparams: [{1} = City], class: 'text-muted')
+        dynamictext dtCity (content: 'City: {1}', contentparams: ({1} = City), class: 'text-muted')
       }
 
       footer footer1 {
@@ -2125,7 +2126,7 @@ end;
  */
 create page PgTest.P030_ProductDetail
 (
-  params: { $Product: PgTest.Product },
+  params: ( $Product: PgTest.Product ),
   title: 'Product Detail',
   layout: Atlas_Core.Atlas_Default,
   url: 'p030_detail/{Product}',
@@ -2155,7 +2156,7 @@ create page PgTest.P030_WidgetReferences
       column col1 (desktopwidth: 12) {
         -- DataSource: MICROFLOW reference
         listview lvProducts (datasource: microflow PgTest.DSO_GetProducts) {
-          dynamictext txtProductName (content: '{1}', contentparams: [{1} = Name])
+          dynamictext txtProductName (content: '{1}', contentparams: ({1} = Name))
         }
       }
     }
@@ -2304,7 +2305,7 @@ create page PgTest.P033b_DataGrid_ColumnProperties
   layout: Atlas_Core.Atlas_Default,
   url: 'p033b_datagrid_column_properties',
   folder: 'DataGrid',
-  variables: { $showStockColumn: boolean = 'if (3 < 4) then true else false' }
+  variables: ( $showStockColumn: boolean = 'if (3 < 4) then true else false' )
 )
 {
   datagrid dgProducts (datasource: database PgTest.Product) {
@@ -2358,9 +2359,9 @@ create page PgTest.P033b_DataGrid_ColumnProperties
  */
 create page PgTest.P034_ComboBox_Enum
 (
-  params: {
+  params: (
     $Customer: PgTest.Customer
-  },
+  ),
   title: 'ComboBox Enumeration Selection',
   layout: Atlas_Core.PopupLayout,
   folder: 'ComboBox'
@@ -2392,9 +2393,9 @@ create page PgTest.P034_ComboBox_Enum
  */
 create page PgTest.P035_Order_Edit
 (
-  params: {
+  params: (
     $Order: PgTest.Order
-  },
+  ),
   title: 'Edit Order',
   layout: Atlas_Core.PopupLayout,
   folder: 'ComboBox'
@@ -2474,9 +2475,9 @@ create page PgTest.P035_Order_With_ComboBox
  */
 create page PgTest.P037_GroupBox_Example
 (
-  params: {
+  params: (
     $Customer: PgTest.Customer
-  },
+  ),
   title: 'GroupBox Example',
   layout: Atlas_Core.PopupLayout,
   folder: 'GroupBox'
@@ -2523,9 +2524,9 @@ create page PgTest.P037_GroupBox_Example
  */
 create page PgTest.P036_ComboBox_Association
 (
-  params: {
+  params: (
     $Order: PgTest.Order
-  },
+  ),
   title: 'ComboBox Association Selection',
   layout: Atlas_Core.PopupLayout,
   folder: 'ComboBox'
@@ -2782,7 +2783,7 @@ move snippet PgTest.CustomerSidebar to folder 'Shared' in PgTest2;
 create page PgTest.UserTaskPage (
   title: 'User Task Page',
   layout: Atlas_Core.Atlas_Default,
-  params: { $WorkflowUserTask: System.WorkflowUserTask }
+  params: ( $WorkflowUserTask: System.WorkflowUserTask )
 ) {
   actionbutton btnApprove (
     caption: 'Approve',
@@ -2807,7 +2808,7 @@ create page PgTest.UserTaskPage (
 create page PgTest.P_OrderWithCustomer (
   Title: 'Order + Customer',
   Layout: Atlas_Core.Atlas_Default,
-  Params: { $Order: PgTest.Order }
+  Params: ( $Order: PgTest.Order )
 )
 {
   dataview dvOrder (DataSource: $Order) {
diff --git a/mdl-examples/doctype-tests/05-database-connection-examples.mdl b/mdl-examples/doctype-tests/05-database-connection-examples.mdl
index f2382eb1bd..bd2b99ca3d 100644
--- a/mdl-examples/doctype-tests/05-database-connection-examples.mdl
+++ b/mdl-examples/doctype-tests/05-database-connection-examples.mdl
@@ -121,13 +121,13 @@ create non-persistent entity DbTest.RaceResult (
  * Minimal database connection - type, connection string, and credentials.
  * This is the simplest possible connection definition.
  */
-create database connection DbTest.MinimalDB
-type 'MSSQL'
-connection string @DbTest.F1Database_DBSource
-username @DbTest.F1Database_DBUsername
-password @DbTest.F1Database_DBPassword
-begin
-end;
+create database connection DbTest.MinimalDB (
+  Type: 'MSSQL',
+  ConnectionString: @DbTest.F1Database_DBSource,
+  Username: @DbTest.F1Database_DBUsername,
+  Password: @DbTest.F1Database_DBPassword
+) {
+};
 
 -- ============================================================================
 -- Level 1.2: Connection with Single Simple Query
@@ -137,24 +137,25 @@ end;
  * Basic connection with one simple SELECT query.
  * Returns all drivers mapped to the Driver entity.
  */
-create database connection DbTest.SimpleQueryDB
-type 'MSSQL'
-connection string @DbTest.F1Database_DBSource
-username @DbTest.F1Database_DBUsername
-password @DbTest.F1Database_DBPassword
-begin
-  query GetAllDrivers
-    sql 'SELECT driverId, driverRef, forename, surname, nationality, dob FROM drivers ORDER BY surname'
-    returns DbTest.Driver
-    map (
-      driverId as DriverId,
-      driverRef as DriverRef,
-      forename as Forename,
-      surname as Surname,
-      nationality as Nationality,
-      dob as DateOfBirth
-    );
-end;
+create database connection DbTest.SimpleQueryDB (
+  Type: 'MSSQL',
+  ConnectionString: @DbTest.F1Database_DBSource,
+  Username: @DbTest.F1Database_DBUsername,
+  Password: @DbTest.F1Database_DBPassword
+) {
+  query GetAllDrivers (
+    Sql: 'SELECT driverId, driverRef, forename, surname, nationality, dob FROM drivers ORDER BY surname',
+    Returns: DbTest.Driver,
+    Map: (
+      DriverId = driverId,
+      DriverRef = driverRef,
+      Forename = forename,
+      Surname = surname,
+      Nationality = nationality,
+      DateOfBirth = dob
+    )
+  )
+};
 
 
 -- ############################################################################
@@ -169,23 +170,24 @@ end;
  * Connection with query that returns circuits.
  * Demonstrates explicit column-to-attribute mapping.
  */
-create database connection DbTest.CircuitQueryDB
-type 'MSSQL'
-connection string @DbTest.F1Database_DBSource
-username @DbTest.F1Database_DBUsername
-password @DbTest.F1Database_DBPassword
-begin
-  query GetAllCircuits
-    sql 'SELECT circuitId, circuitRef, name, location, country FROM circuits ORDER BY name'
-    returns DbTest.Circuit
-    map (
-      circuitId as CircuitId,
-      circuitRef as CircuitRef,
-      name as CircuitName,
-      location as Location,
-      country as Country
-    );
-end;
+create database connection DbTest.CircuitQueryDB (
+  Type: 'MSSQL',
+  ConnectionString: @DbTest.F1Database_DBSource,
+  Username: @DbTest.F1Database_DBUsername,
+  Password: @DbTest.F1Database_DBPassword
+) {
+  query GetAllCircuits (
+    Sql: 'SELECT circuitId, circuitRef, name, location, country FROM circuits ORDER BY name',
+    Returns: DbTest.Circuit,
+    Map: (
+      CircuitId = circuitId,
+      CircuitRef = circuitRef,
+      CircuitName = name,
+      Location = location,
+      Country = country
+    )
+  )
+};
 
 -- ============================================================================
 -- Level 2.2: Multiple Queries in One Connection
@@ -194,34 +196,36 @@ end;
 /**
  * Connection with multiple queries returning different entity types.
  */
-create database connection DbTest.MultiQueryDB
-type 'MSSQL'
-connection string @DbTest.F1Database_DBSource
-username @DbTest.F1Database_DBUsername
-password @DbTest.F1Database_DBPassword
-begin
-  query GetDrivers
-    sql 'SELECT driverId, driverRef, forename, surname, nationality, dob FROM drivers ORDER BY surname'
-    returns DbTest.Driver
-    map (
-      driverId as DriverId,
-      driverRef as DriverRef,
-      forename as Forename,
-      surname as Surname,
-      nationality as Nationality,
-      dob as DateOfBirth
-    );
-
-  query GetConstructors
-    sql 'SELECT constructorId, constructorRef, name, nationality FROM constructors ORDER BY name'
-    returns DbTest.Constructor
-    map (
-      constructorId as ConstructorId,
-      constructorRef as ConstructorRef,
-      name as ConstructorName,
-      nationality as Nationality
-    );
-end;
+create database connection DbTest.MultiQueryDB (
+  Type: 'MSSQL',
+  ConnectionString: @DbTest.F1Database_DBSource,
+  Username: @DbTest.F1Database_DBUsername,
+  Password: @DbTest.F1Database_DBPassword
+) {
+  query GetDrivers (
+    Sql: 'SELECT driverId, driverRef, forename, surname, nationality, dob FROM drivers ORDER BY surname',
+    Returns: DbTest.Driver,
+    Map: (
+      DriverId = driverId,
+      DriverRef = driverRef,
+      Forename = forename,
+      Surname = surname,
+      Nationality = nationality,
+      DateOfBirth = dob
+    )
+  )
+
+  query GetConstructors (
+    Sql: 'SELECT constructorId, constructorRef, name, nationality FROM constructors ORDER BY name',
+    Returns: DbTest.Constructor,
+    Map: (
+      ConstructorId = constructorId,
+      ConstructorRef = constructorRef,
+      ConstructorName = name,
+      Nationality = nationality
+    )
+  )
+};
 
 
 -- ############################################################################
@@ -236,25 +240,26 @@ end;
  * Connection with parameterized query.
  * Demonstrates safe parameter binding for filtering.
  */
-create database connection DbTest.ParamQueryDB
-type 'MSSQL'
-connection string @DbTest.F1Database_DBSource
-username @DbTest.F1Database_DBUsername
-password @DbTest.F1Database_DBPassword
-begin
-  query GetDriversByNationality
-    sql 'SELECT driverId, driverRef, forename, surname, nationality, dob FROM drivers WHERE nationality = {nation} ORDER BY surname'
-    parameter nation: string default 'British'
-    returns DbTest.Driver
-    map (
-      driverId as DriverId,
-      driverRef as DriverRef,
-      forename as Forename,
-      surname as Surname,
-      nationality as Nationality,
-      dob as DateOfBirth
-    );
-end;
+create database connection DbTest.ParamQueryDB (
+  Type: 'MSSQL',
+  ConnectionString: @DbTest.F1Database_DBSource,
+  Username: @DbTest.F1Database_DBUsername,
+  Password: @DbTest.F1Database_DBPassword
+) {
+  query GetDriversByNationality (
+    Sql: 'SELECT driverId, driverRef, forename, surname, nationality, dob FROM drivers WHERE nationality = {nation} ORDER BY surname',
+    Parameters: ( nation: string default 'British' ),
+    Returns: DbTest.Driver,
+    Map: (
+      DriverId = driverId,
+      DriverRef = driverRef,
+      Forename = forename,
+      Surname = surname,
+      Nationality = nationality,
+      DateOfBirth = dob
+    )
+  )
+};
 
 -- ============================================================================
 -- Level 3.2: Multiple Parameters and Multiple Queries
@@ -264,36 +269,38 @@ end;
  * Connection with multiple parameterized queries.
  * Demonstrates filtering by different criteria.
  */
-create database connection DbTest.MultiParamDB
-type 'MSSQL'
-connection string @DbTest.F1Database_DBSource
-username @DbTest.F1Database_DBUsername
-password @DbTest.F1Database_DBPassword
-begin
-  query GetRacesByYear
-    sql 'SELECT raceId, year, round, name, date FROM races WHERE year = {raceYear} ORDER BY round'
-    parameter raceYear: integer default '2023'
-    returns DbTest.Race
-    map (
-      raceId as RaceId,
-      year as RaceYear,
-      round as Round,
-      name as RaceName,
-      date as RaceDate
-    );
-
-  query GetCircuitsByCountry
-    sql 'SELECT circuitId, circuitRef, name, location, country FROM circuits WHERE country = {searchCountry} ORDER BY name'
-    parameter searchCountry: string null
-    returns DbTest.Circuit
-    map (
-      circuitId as CircuitId,
-      circuitRef as CircuitRef,
-      name as CircuitName,
-      location as Location,
-      country as Country
-    );
-end;
+create database connection DbTest.MultiParamDB (
+  Type: 'MSSQL',
+  ConnectionString: @DbTest.F1Database_DBSource,
+  Username: @DbTest.F1Database_DBUsername,
+  Password: @DbTest.F1Database_DBPassword
+) {
+  query GetRacesByYear (
+    Sql: 'SELECT raceId, year, round, name, date FROM races WHERE year = {raceYear} ORDER BY round',
+    Parameters: ( raceYear: integer default '2023' ),
+    Returns: DbTest.Race,
+    Map: (
+      RaceId = raceId,
+      RaceYear = year,
+      Round = round,
+      RaceName = name,
+      RaceDate = date
+    )
+  )
+
+  query GetCircuitsByCountry (
+    Sql: 'SELECT circuitId, circuitRef, name, location, country FROM circuits WHERE country = {searchCountry} ORDER BY name',
+    Parameters: ( searchCountry: string null ),
+    Returns: DbTest.Circuit,
+    Map: (
+      CircuitId = circuitId,
+      CircuitRef = circuitRef,
+      CircuitName = name,
+      Location = location,
+      Country = country
+    )
+  )
+};
 
 
 -- ############################################################################
@@ -313,108 +320,116 @@ end;
  * Connection: jdbc:sqlserver://host.docker.internal:1433;databaseName=F1
  * Tables: drivers, circuits, constructors, races, results
  */
-create database connection DbTest.F1Database
-type 'MSSQL'
-connection string @DbTest.F1Database_DBSource
-username @DbTest.F1Database_DBUsername
-password @DbTest.F1Database_DBPassword
-begin
-  query GetAllDrivers
-    sql 'SELECT driverId, driverRef, forename, surname, nationality, dob FROM drivers ORDER BY surname'
-    returns DbTest.Driver
-    map (
-      driverId as DriverId,
-      driverRef as DriverRef,
-      forename as Forename,
-      surname as Surname,
-      nationality as Nationality,
-      dob as DateOfBirth
-    );
-
-  query GetDriverById
-    sql 'SELECT driverId, driverRef, forename, surname, nationality, dob FROM drivers WHERE driverId = {id}'
-    parameter id: integer default '1'
-    returns DbTest.Driver
-    map (
-      driverId as DriverId,
-      driverRef as DriverRef,
-      forename as Forename,
-      surname as Surname,
-      nationality as Nationality,
-      dob as DateOfBirth
-    );
-
-  query GetDriversByNationality
-    sql 'SELECT driverId, driverRef, forename, surname, nationality, dob FROM drivers WHERE nationality = {nation} ORDER BY surname'
-    parameter nation: string default 'British'
-    returns DbTest.Driver
-    map (
-      driverId as DriverId,
-      driverRef as DriverRef,
-      forename as Forename,
-      surname as Surname,
-      nationality as Nationality,
-      dob as DateOfBirth
-    );
-
-  query GetAllCircuits
-    sql 'SELECT circuitId, circuitRef, name, location, country FROM circuits ORDER BY name'
-    returns DbTest.Circuit
-    map (
-      circuitId as CircuitId,
-      circuitRef as CircuitRef,
-      name as CircuitName,
-      location as Location,
-      country as Country
-    );
-
-  query GetCircuitsByCountry
-    sql 'SELECT circuitId, circuitRef, name, location, country FROM circuits WHERE country = {searchCountry} ORDER BY name'
-    parameter searchCountry: string default 'United Kingdom'
-    returns DbTest.Circuit
-    map (
-      circuitId as CircuitId,
-      circuitRef as CircuitRef,
-      name as CircuitName,
-      location as Location,
-      country as Country
-    );
-
-  query GetAllConstructors
-    sql 'SELECT constructorId, constructorRef, name, nationality FROM constructors ORDER BY name'
-    returns DbTest.Constructor
-    map (
-      constructorId as ConstructorId,
-      constructorRef as ConstructorRef,
-      name as ConstructorName,
-      nationality as Nationality
-    );
-
-  query GetRacesByYear
-    sql 'SELECT raceId, year, round, name, date FROM races WHERE year = {raceYear} ORDER BY round'
-    parameter raceYear: integer default '2023'
-    returns DbTest.Race
-    map (
-      raceId as RaceId,
-      year as RaceYear,
-      round as Round,
-      name as RaceName,
-      date as RaceDate
-    );
-
-  query GetRacesBySeason
-    sql 'SELECT raceId, year, round, name, date FROM races WHERE year BETWEEN {startYear} AND {endYear} ORDER BY year, round'
-    parameter startYear: integer default '1900'
-    parameter endYear: integer null
-    returns DbTest.Race
-    map (
-      raceId as RaceId,
-      year as RaceYear,
-      round as Round,
-      name as RaceName,
-      date as RaceDate
-    );
-end;
+create database connection DbTest.F1Database (
+  Type: 'MSSQL',
+  ConnectionString: @DbTest.F1Database_DBSource,
+  Username: @DbTest.F1Database_DBUsername,
+  Password: @DbTest.F1Database_DBPassword
+) {
+  query GetAllDrivers (
+    Sql: 'SELECT driverId, driverRef, forename, surname, nationality, dob FROM drivers ORDER BY surname',
+    Returns: DbTest.Driver,
+    Map: (
+      DriverId = driverId,
+      DriverRef = driverRef,
+      Forename = forename,
+      Surname = surname,
+      Nationality = nationality,
+      DateOfBirth = dob
+    )
+  )
+
+  query GetDriverById (
+    Sql: 'SELECT driverId, driverRef, forename, surname, nationality, dob FROM drivers WHERE driverId = {id}',
+    Parameters: ( id: integer default '1' ),
+    Returns: DbTest.Driver,
+    Map: (
+      DriverId = driverId,
+      DriverRef = driverRef,
+      Forename = forename,
+      Surname = surname,
+      Nationality = nationality,
+      DateOfBirth = dob
+    )
+  )
+
+  query GetDriversByNationality (
+    Sql: 'SELECT driverId, driverRef, forename, surname, nationality, dob FROM drivers WHERE nationality = {nation} ORDER BY surname',
+    Parameters: ( nation: string default 'British' ),
+    Returns: DbTest.Driver,
+    Map: (
+      DriverId = driverId,
+      DriverRef = driverRef,
+      Forename = forename,
+      Surname = surname,
+      Nationality = nationality,
+      DateOfBirth = dob
+    )
+  )
+
+  query GetAllCircuits (
+    Sql: 'SELECT circuitId, circuitRef, name, location, country FROM circuits ORDER BY name',
+    Returns: DbTest.Circuit,
+    Map: (
+      CircuitId = circuitId,
+      CircuitRef = circuitRef,
+      CircuitName = name,
+      Location = location,
+      Country = country
+    )
+  )
+
+  query GetCircuitsByCountry (
+    Sql: 'SELECT circuitId, circuitRef, name, location, country FROM circuits WHERE country = {searchCountry} ORDER BY name',
+    Parameters: ( searchCountry: string default 'United Kingdom' ),
+    Returns: DbTest.Circuit,
+    Map: (
+      CircuitId = circuitId,
+      CircuitRef = circuitRef,
+      CircuitName = name,
+      Location = location,
+      Country = country
+    )
+  )
+
+  query GetAllConstructors (
+    Sql: 'SELECT constructorId, constructorRef, name, nationality FROM constructors ORDER BY name',
+    Returns: DbTest.Constructor,
+    Map: (
+      ConstructorId = constructorId,
+      ConstructorRef = constructorRef,
+      ConstructorName = name,
+      Nationality = nationality
+    )
+  )
+
+  query GetRacesByYear (
+    Sql: 'SELECT raceId, year, round, name, date FROM races WHERE year = {raceYear} ORDER BY round',
+    Parameters: ( raceYear: integer default '2023' ),
+    Returns: DbTest.Race,
+    Map: (
+      RaceId = raceId,
+      RaceYear = year,
+      Round = round,
+      RaceName = name,
+      RaceDate = date
+    )
+  )
+
+  query GetRacesBySeason (
+    Sql: 'SELECT raceId, year, round, name, date FROM races WHERE year BETWEEN {startYear} AND {endYear} ORDER BY year, round',
+    Parameters: ( startYear: integer default '1900',
+    endYear: integer null ),
+    Returns: DbTest.Race,
+    Map: (
+      RaceId = raceId,
+      RaceYear = year,
+      Round = round,
+      RaceName = name,
+      RaceDate = date
+    )
+  )
+};
 
 
 -- ############################################################################
diff --git a/mdl-examples/doctype-tests/06-rest-client-examples.mdl b/mdl-examples/doctype-tests/06-rest-client-examples.mdl
index 3edea9948a..f8f2464306 100644
--- a/mdl-examples/doctype-tests/06-rest-client-examples.mdl
+++ b/mdl-examples/doctype-tests/06-rest-client-examples.mdl
@@ -62,7 +62,7 @@ create rest client RestTest.RC001_SimpleAPI (
   operation GetStatus (
     method: get,
     path: '/echo',
-    headers: ('Accept' = '*/*'),
+    headers: ('Accept': '*/*'),
     response: none
   )
 };
@@ -81,7 +81,7 @@ create rest client RestTest.RC002_JsonAPI (
   operation GetPosts (
     method: get,
     path: '/posts',
-    headers: ('Accept' = 'application/json'),
+    headers: ('Accept': 'application/json'),
     response: json as $Posts
   )
 };
@@ -101,7 +101,7 @@ create rest client RestTest.RC003_UserAPI (
     method: get,
     path: '/users/{userId}',
     parameters: ($userId: integer),
-    headers: ('Accept' = 'application/json'),
+    headers: ('Accept': 'application/json'),
     response: json as $user
   )
 };
@@ -127,7 +127,7 @@ create rest client RestTest.RC004_CrudAPI (
   operation GetAll (
     method: get,
     path: '/get',
-    headers: ('Accept' = 'application/json'),
+    headers: ('Accept': 'application/json'),
     response: json as $Resources
   )
 
@@ -135,7 +135,7 @@ create rest client RestTest.RC004_CrudAPI (
   operation CreateResource (
     method: post,
     path: '/post',
-    headers: ('Accept' = 'application/json'),
+    headers: ('Accept': 'application/json'),
     body: json from $NewResource,
     response: json as $CreatedResource
   )
@@ -144,7 +144,7 @@ create rest client RestTest.RC004_CrudAPI (
   operation UpdateResource (
     method: put,
     path: '/put',
-    headers: ('Accept' = 'application/json'),
+    headers: ('Accept': 'application/json'),
     body: json from $UpdatedResource,
     response: json as $resource
   )
@@ -153,7 +153,7 @@ create rest client RestTest.RC004_CrudAPI (
   operation "PatchResource" (
     method: patch,
     path: '/patch',
-    headers: ('Accept' = 'application/json'),
+    headers: ('Accept': 'application/json'),
     body: json from $PatchData,
     response: json as $resource
   )
@@ -248,7 +248,7 @@ create rest client RestTest.RC008_HeaderAPI (
   operation GetData (
     method: get,
     path: '/headers',
-    headers: ('Accept' = 'application/json', 'X-API-Version' = '2.0', 'X-Client-ID' = 'mendix-repl'),
+    headers: ('Accept': 'application/json', 'X-API-Version': '2.0', 'X-Client-ID': 'mendix-repl'),
     response: json as $data
   )
 };
@@ -267,7 +267,7 @@ create rest client RestTest.RC009_AuthHeaderAPI (
   operation GetSecureData (
     method: get,
     path: '/headers',
-    headers: ('Accept' = 'application/json', 'Authorization' = 'Bearer my-api-token', 'X-Request-ID' = 'request-001'),
+    headers: ('Accept': 'application/json', 'Authorization': 'Bearer my-api-token', 'X-Request-ID': 'request-001'),
     response: json as $data
   )
 };
@@ -284,7 +284,7 @@ create rest client RestTest.RC010_ContentTypeAPI (
   operation PostJson (
     method: post,
     path: '/post',
-    headers: ('Content-Type' = 'application/json', 'Accept' = 'application/json'),
+    headers: ('Content-Type': 'application/json', 'Accept': 'application/json'),
     body: json from $Payload,
     response: json as $Result
   )
@@ -342,7 +342,7 @@ create rest client RestTest.RC013_SecureAuthAPI (
   operation GetSecureData (
     method: get,
     path: '/hidden-basic-auth/testuser/testpass',
-    headers: ('Accept' = 'application/json'),
+    headers: ('Accept': 'application/json'),
     response: json as $data
   )
 };
@@ -365,7 +365,7 @@ create rest client RestTest.RC014_JsonBodyAPI (
   operation AddItem (
     method: post,
     path: '/post',
-    headers: ('Content-Type' = 'application/json'),
+    headers: ('Content-Type': 'application/json'),
     body: json from $ItemData,
     response: json as $CreatedItem
   )
@@ -517,7 +517,7 @@ create rest client RestTest.RC018_PetStoreAPI (
     method: get,
     path: '/pet/findByStatus',
     query: ($status: string),
-    headers: ('Accept' = 'application/json'),
+    headers: ('Accept': 'application/json'),
     timeout: 30,
     response: json as $PetList
   )
@@ -530,7 +530,7 @@ create rest client RestTest.RC018_PetStoreAPI (
     method: get,
     path: '/pet/{petId}',
     parameters: ($petId: integer),
-    headers: ('Accept' = 'application/json'),
+    headers: ('Accept': 'application/json'),
     response: json as $Pet
   )
 
@@ -541,7 +541,7 @@ create rest client RestTest.RC018_PetStoreAPI (
   operation AddPet (
     method: post,
     path: '/pet',
-    headers: ('Content-Type' = 'application/json', 'Accept' = 'application/json'),
+    headers: ('Content-Type': 'application/json', 'Accept': 'application/json'),
     body: json from $NewPet,
     response: json as $CreatedPet
   )
@@ -553,7 +553,7 @@ create rest client RestTest.RC018_PetStoreAPI (
   operation ModifyPet (
     method: put,
     path: '/pet',
-    headers: ('Content-Type' = 'application/json', 'Accept' = 'application/json'),
+    headers: ('Content-Type': 'application/json', 'Accept': 'application/json'),
     body: json from $UpdatedPet,
     response: json as $Pet
   )
@@ -567,7 +567,7 @@ create rest client RestTest.RC018_PetStoreAPI (
     method: delete,
     path: '/pet/{petId}',
     parameters: ($petId: integer),
-    headers: ('api_key' = 'special-key'),
+    headers: ('api_key': 'special-key'),
     response: none
   )
 
@@ -594,7 +594,7 @@ create rest client RestTest.RC019_GitHubAPI (
     method: get,
     path: '/repos/{owner}/{repo}',
     parameters: ($owner: string, $repo: string),
-    headers: ('Accept' = 'application/vnd.github.v3+json', 'User-Agent' = 'Mendix-REPL'),
+    headers: ('Accept': 'application/vnd.github.v3+json', 'User-Agent': 'Mendix-REPL'),
     response: json as $Repository
   )
 
@@ -604,7 +604,7 @@ create rest client RestTest.RC019_GitHubAPI (
     path: '/repos/{owner}/{repo}/issues',
     parameters: ($owner: string, $repo: string),
     query: ($state: string, $labels: string, $page: integer, $per_page: integer),
-    headers: ('Accept' = 'application/vnd.github.v3+json', 'User-Agent' = 'Mendix-REPL'),
+    headers: ('Accept': 'application/vnd.github.v3+json', 'User-Agent': 'Mendix-REPL'),
     response: json as $Issues
   )
 
@@ -613,7 +613,7 @@ create rest client RestTest.RC019_GitHubAPI (
     method: post,
     path: '/repos/{owner}/{repo}/issues',
     parameters: ($owner: string, $repo: string),
-    headers: ('Accept' = 'application/vnd.github.v3+json', 'User-Agent' = 'Mendix-REPL', 'Authorization' = 'token ghp_exampletoken123'),
+    headers: ('Accept': 'application/vnd.github.v3+json', 'User-Agent': 'Mendix-REPL', 'Authorization': 'token ghp_exampletoken123'),
     body: json from $IssueData,
     response: json as $CreatedIssue
   )
@@ -622,7 +622,7 @@ create rest client RestTest.RC019_GitHubAPI (
   operation GetAuthenticatedUser (
     method: get,
     path: '/user',
-    headers: ('Accept' = 'application/vnd.github.v3+json', 'User-Agent' = 'Mendix-REPL', 'Authorization' = 'token ghp_exampletoken123'),
+    headers: ('Accept': 'application/vnd.github.v3+json', 'User-Agent': 'Mendix-REPL', 'Authorization': 'token ghp_exampletoken123'),
     response: json as $user
   )
 };
@@ -645,7 +645,7 @@ create rest client RestTest.RC020_WeatherAPI (
     method: get,
     path: '/weather',
     query: ($q: string, $appid: string, $units: string),
-    headers: ('Accept' = 'application/json'),
+    headers: ('Accept': 'application/json'),
     response: json as $Weather
   )
 
@@ -654,7 +654,7 @@ create rest client RestTest.RC020_WeatherAPI (
     method: get,
     path: '/forecast',
     query: ($q: string, $appid: string, $units: string, $cnt: integer),
-    headers: ('Accept' = 'application/json'),
+    headers: ('Accept': 'application/json'),
     response: json as $Forecast
   )
 
@@ -663,7 +663,7 @@ create rest client RestTest.RC020_WeatherAPI (
     method: get,
     path: '/weather',
     query: ($lat: decimal, $lon: decimal, $appid: string, $units: string),
-    headers: ('Accept' = 'application/json'),
+    headers: ('Accept': 'application/json'),
     response: json as $Weather
   )
 };
@@ -685,7 +685,7 @@ create rest client RestTest.RC021_PaymentAPI (
   operation InitiatePayment (
     method: post,
     path: '/payment_intents',
-    headers: ('Content-Type' = 'application/json', 'Accept' = 'application/json', 'Idempotency-Key' = 'idem-key-001'),
+    headers: ('Content-Type': 'application/json', 'Accept': 'application/json', 'Idempotency-Key': 'idem-key-001'),
     body: json from $PaymentData,
     timeout: 30,
     response: json as $PaymentIntent
@@ -704,7 +704,7 @@ create rest client RestTest.RC021_PaymentAPI (
     method: post,
     path: '/payment_intents/{paymentIntentId}/confirm',
     parameters: ($paymentIntentId: string),
-    headers: ('Content-Type' = 'application/json'),
+    headers: ('Content-Type': 'application/json'),
     body: json from $ConfirmData,
     response: json as $PaymentIntent
   )
diff --git a/mdl-examples/doctype-tests/08-security-examples.mdl b/mdl-examples/doctype-tests/08-security-examples.mdl
index 1caa821446..b9ac9d1308 100644
--- a/mdl-examples/doctype-tests/08-security-examples.mdl
+++ b/mdl-examples/doctype-tests/08-security-examples.mdl
@@ -451,7 +451,7 @@ show access on SecTest.Customer;
 /**
  * Create a user role and assign a single module role.
  */
-create or modify user role RegularUser (System.User, SecTest.User);
+create or modify user role RegularUser ( ModuleRoles: (System.User, SecTest.User) );
 /
 
 -- ============================================================================
@@ -461,7 +461,7 @@ create or modify user role RegularUser (System.User, SecTest.User);
 /**
  * A user role can include roles from multiple modules.
  */
-create or modify user role PowerUser (System.User, SecTest.User, SecTest.Administrator);
+create or modify user role PowerUser ( ModuleRoles: (System.User, SecTest.User, SecTest.Administrator) );
 /
 
 -- ============================================================================
@@ -471,7 +471,7 @@ create or modify user role PowerUser (System.User, SecTest.User, SecTest.Adminis
 /**
  * Admin user role that can manage all roles.
  */
-create or modify user role SuperAdmin (System.Administrator, SecTest.Administrator) manage all roles;
+create or modify user role SuperAdmin ( ModuleRoles: (System.Administrator, SecTest.Administrator), ManageAllRoles: true );
 /
 
 -- Verify
diff --git a/mdl-examples/doctype-tests/11-navigation-examples.mdl b/mdl-examples/doctype-tests/11-navigation-examples.mdl
index dc2b7c04dc..373f4377e1 100644
--- a/mdl-examples/doctype-tests/11-navigation-examples.mdl
+++ b/mdl-examples/doctype-tests/11-navigation-examples.mdl
@@ -84,12 +84,12 @@ create or replace navigation Responsive
 create or replace navigation Responsive
   home page NavTest.NavTest_Home
   login page Administration.login
-  menu (
-    menu item 'Home' page NavTest.NavTest_Home;
-    menu 'Admin' (
-      menu item 'Users' page Administration.Account_Overview;
-    );
-  );
+  {
+    menu item 'Home' ( OnClick: show page NavTest.NavTest_Home )
+    menu 'Admin' {
+      menu item 'Users' ( OnClick: show page Administration.Account_Overview )
+    }
+  };
 
 -- ============================================================================
 -- ICON — a menu item's icon, as a qualified name into an icon collection
@@ -101,21 +101,21 @@ create or replace navigation Responsive
 create or replace navigation Responsive
   home page NavTest.NavTest_Home
   login page Administration.login
-  menu (
-    menu item 'Home' page NavTest.NavTest_Home icon Atlas_Core.Atlas.home;
-    menu 'Admin' icon Atlas_Core.Atlas.user (
-      menu item 'Users' page Administration.Account_Overview
-        icon Atlas_Core.Atlas."list-bullets";
-    );
-  );
-
--- DESCRIBE round-trips the ICON clause, so this output is re-executable
+  {
+    menu item 'Home' ( OnClick: show page NavTest.NavTest_Home, Icon: Atlas_Core.Atlas.home )
+    menu 'Admin' ( Icon: Atlas_Core.Atlas.user ) {
+      menu item 'Users' ( OnClick: show page Administration.Account_Overview,
+        Icon: Atlas_Core.Atlas."list-bullets" )
+    }
+  };
+
+-- DESCRIBE round-trips the Icon: property, so this output is re-executable
 describe navigation Responsive;
 
--- Clear the menu (empty MENU block removes all items)
+-- Clear the menu (an empty { } block removes all items)
 create or replace navigation Responsive
   home page NavTest.NavTest_Home
-  menu ();
+  {};
 
 -- Verify the changes
 describe navigation Responsive;
@@ -148,7 +148,7 @@ describe context of NavTest.NavTest_Home;
  */
 create or replace navigation Responsive
   home page MyFirstModule.Home_Web
-  menu (
-    menu item 'Home' page MyFirstModule.Home_Web;
-  )
+  {
+    menu item 'Home' ( OnClick: show page MyFirstModule.Home_Web )
+  }
 ;
diff --git a/mdl-examples/doctype-tests/12-styling-examples.mdl b/mdl-examples/doctype-tests/12-styling-examples.mdl
index b443cb7f38..5f2777b49c 100644
--- a/mdl-examples/doctype-tests/12-styling-examples.mdl
+++ b/mdl-examples/doctype-tests/12-styling-examples.mdl
@@ -66,7 +66,7 @@ create page StyleTest.P001_CSS_Classes
   title: 'CSS Classes',
   layout: Atlas_Core.Atlas_Default,
   url: 'style_001_css_classes/{Employee}',
-  params: { $Employee: StyleTest.Employee }
+  params: ( $Employee: StyleTest.Employee )
 )
 {
   -- Single CSS class
@@ -157,7 +157,7 @@ create page StyleTest.P002b_Dynamic_Classes
   title: 'Dynamic Classes',
   layout: Atlas_Core.Atlas_Default,
   url: 'style_002b_dynamic_classes/{Employee}',
-  params: { $Employee: StyleTest.Employee }
+  params: ( $Employee: StyleTest.Employee )
 )
 {
   dataview dvEmp (datasource: $Employee) {
@@ -203,21 +203,21 @@ create page StyleTest.P003_Design_Properties
   title: 'Design Properties',
   layout: Atlas_Core.Atlas_Default,
   url: 'style_003_design_properties/{task}',
-  params: { $task: StyleTest.task }
+  params: ( $task: StyleTest.task )
 )
 {
   -- Toggle property (ON) — 'Card style' is a genuine Toggle on Container
-  container ctnFullWidth (designproperties: ['Card style': on]) {
+  container ctnFullWidth (designproperties: ('Card style': on)) {
     dynamictext txtFull (content: 'Container with card style', rendermode: H3)
   }
 
   -- Another Toggle property on Container
-  container ctnBordered (designproperties: ['Disable row wrap': on]) {
+  container ctnBordered (designproperties: ('Disable row wrap': on)) {
     dynamictext txtSpacing (content: 'Container with flex nowrap')
   }
 
   -- Multiple Toggle design properties
-  container ctnMultiProps (designproperties: ['Card style': on, 'Disable row wrap': on]) {
+  container ctnMultiProps (designproperties: ('Card style': on, 'Disable row wrap': on)) {
     dynamictext txtMulti (content: 'Multiple toggle properties applied')
   }
 
@@ -241,7 +241,7 @@ create page StyleTest.P003_Design_Properties
     checkbox chkDone (label: 'Completed', attribute: IsCompleted)
 
     footer footer1 {
-      actionbutton btnSave (caption: 'Save', action: save_changes, buttonstyle: primary, designproperties: ['Full width': on])
+      actionbutton btnSave (caption: 'Save', action: save_changes, buttonstyle: primary, designproperties: ('Full width': on))
       actionbutton btnCancel (caption: 'Cancel', action: cancel_changes)
     }
   }
@@ -262,14 +262,14 @@ create page StyleTest.P004_Combined_Styling
   title: 'Combined Styling',
   layout: Atlas_Core.Atlas_Default,
   url: 'style_004_combined_styling/{Employee}',
-  params: { $Employee: StyleTest.Employee }
+  params: ( $Employee: StyleTest.Employee )
 )
 {
   -- All three on a single container — Card style is a Toggle property
   container ctnHero (
     class: 'card',
     style: 'background: linear-gradient(135deg, #264AE5 0%, #1a237e 100%); color: white;',
-    designproperties: ['Card style': on]
+    designproperties: ('Card style': on)
   ) {
     dynamictext txtHero (content: 'Hero Section', rendermode: H1)
     dynamictext txtSubtitle (content: 'Combining Class, Style, and DesignProperties')
@@ -282,7 +282,7 @@ create page StyleTest.P004_Combined_Styling
         container ctnStat1 (
           class: 'card card-bordered',
           style: 'border-top: 3px solid #4caf50;',
-          designproperties: ['Card style': on]
+          designproperties: ('Card style': on)
         ) {
           dynamictext txtStat1Title (content: 'Active Employees', rendermode: H5)
           dynamictext txtStat1Value (content: '42', class: 'text-primary')
@@ -292,7 +292,7 @@ create page StyleTest.P004_Combined_Styling
         container ctnStat2 (
           class: 'card card-bordered',
           style: 'border-top: 3px solid #ff9800;',
-          designproperties: ['Card style': on]
+          designproperties: ('Card style': on)
         ) {
           dynamictext txtStat2Title (content: 'Open Tasks', rendermode: H5)
           dynamictext txtStat2Value (content: '17', class: 'text-warning')
@@ -302,7 +302,7 @@ create page StyleTest.P004_Combined_Styling
         container ctnStat3 (
           class: 'card card-bordered',
           style: 'border-top: 3px solid #f44336;',
-          designproperties: ['Card style': on]
+          designproperties: ('Card style': on)
         ) {
           dynamictext txtStat3Title (content: 'Overdue', rendermode: H5)
           dynamictext txtStat3Value (content: '3', class: 'text-danger')
@@ -313,7 +313,7 @@ create page StyleTest.P004_Combined_Styling
 
   -- Form with mixed styling
   dataview dvEmployee (datasource: $Employee) {
-    container ctnFormHeader (class: 'card-header', designproperties: ['Card style': on]) {
+    container ctnFormHeader (class: 'card-header', designproperties: ('Card style': on)) {
       dynamictext txtFormTitle (content: 'Employee Details', rendermode: H4)
     }
 
@@ -347,7 +347,7 @@ create page StyleTest.P004_Combined_Styling
         action: save_changes,
         buttonstyle: primary,
         class: 'btn-lg',
-        designproperties: ['Full width': on, 'Border': on]
+        designproperties: ('Full width': on, 'Border': on)
       )
       actionbutton btnCancel (caption: 'Cancel', action: cancel_changes)
     }
@@ -372,17 +372,17 @@ create page StyleTest.P005_Toggle_OFF
 )
 {
   -- ON enables a Toggle property — 'Card style' is a genuine Toggle on Container
-  container ctnOn (designproperties: ['Card style': on]) {
+  container ctnOn (designproperties: ('Card style': on)) {
     dynamictext txtOn (content: 'Card style is ON')
   }
 
   -- OFF disables/omits the toggle (equivalent to not setting it)
-  container ctnOff (designproperties: ['Card style': off]) {
+  container ctnOff (designproperties: ('Card style': off)) {
     dynamictext txtOff (content: 'Card style is OFF (omitted)')
   }
 
   -- Mix Toggle ON/OFF with option values (Shadow is a ToggleButtonGroup)
-  container ctnMixed (designproperties: ['Card style': on, 'Disable row wrap': on]) {
+  container ctnMixed (designproperties: ('Card style': on, 'Disable row wrap': on)) {
     dynamictext txtMixed (content: 'Mixed Toggle with option values')
   }
 }
@@ -406,7 +406,7 @@ describe page StyleTest.P001_CSS_Classes;
 -- Describe a snippet (creates it first so it exists)
 create snippet StyleTest.MySnippet
 (
-  params: { $Employee: StyleTest.Employee }
+  params: ( $Employee: StyleTest.Employee )
 )
 {
   container ctnSnippet (class: 'card', style: 'padding: 12px;') {
@@ -526,13 +526,13 @@ create page StyleTest.P006_Roundtrip
   title: 'Roundtrip Example',
   layout: Atlas_Core.Atlas_Default,
   url: 'style_006_roundtrip/{Employee}',
-  params: { $Employee: StyleTest.Employee }
+  params: ( $Employee: StyleTest.Employee )
 )
 {
   container ctnHeader (
     class: 'card',
     style: 'padding: 16px;',
-    designproperties: ['Card style': on]
+    designproperties: ('Card style': on)
   ) {
     dynamictext txtHeader (content: 'Employee Form', rendermode: H3)
   }
@@ -565,13 +565,13 @@ create or replace page StyleTest.P006_Roundtrip
   title: 'Roundtrip Example',
   layout: Atlas_Core.Atlas_Default,
   url: 'style_006_roundtrip/{Employee}',
-  params: { $Employee: StyleTest.Employee }
+  params: ( $Employee: StyleTest.Employee )
 )
 {
   container ctnHeader (
     class: 'card card-bordered',
     style: 'padding: 16px;',
-    designproperties: ['Card style': on, 'Disable row wrap': on]
+    designproperties: ('Card style': on, 'Disable row wrap': on)
   ) {
     dynamictext txtHeader (content: 'Employee Form', rendermode: H3)
   }
@@ -683,10 +683,10 @@ create or modify page StyleTest."P007_Compound" (
   layout: Atlas_Core.Atlas_Default
 ) {
   layoutgrid lgCompound (
-    designproperties: [
+    designproperties: (
       'Column gap': 'Medium',
-      'Spacing': ['margin-top': 'Large', 'margin-bottom': 'Medium']
-    ]
+      'Spacing': ('margin-top': 'Large', 'margin-bottom': 'Medium')
+    )
   ) {
     row rCompound {
       column colCompound (desktopwidth: autofill) {
diff --git a/mdl-examples/doctype-tests/15-fragment-examples.mdl b/mdl-examples/doctype-tests/15-fragment-examples.mdl
index 798166a9e3..737728ba6d 100644
--- a/mdl-examples/doctype-tests/15-fragment-examples.mdl
+++ b/mdl-examples/doctype-tests/15-fragment-examples.mdl
@@ -99,7 +99,7 @@ describe fragment CustomerFields;
  */
 create page FragTest.P001_Customer_Edit
 (
-  params: { $Customer: FragTest.Customer },
+  params: ( $Customer: FragTest.Customer ),
   title: 'Edit Customer',
   layout: Atlas_Core.PopupLayout
 )
@@ -172,7 +172,7 @@ define fragment OrderFields as {
 
 create page FragTest.P003_Order_Form
 (
-  params: { $Order: FragTest.Order },
+  params: ( $Order: FragTest.Order ),
   title: 'Edit Order',
   layout: Atlas_Core.PopupLayout
 )
@@ -210,7 +210,7 @@ create page FragTest.P003_Order_Form
  */
 create page FragTest.P004_Customer_New
 (
-  params: { $Customer: FragTest.Customer },
+  params: ( $Customer: FragTest.Customer ),
   title: 'New Customer',
   layout: Atlas_Core.Atlas_Default,
   url: 'frag_004_customer_new/{Customer}'
@@ -227,7 +227,7 @@ create page FragTest.P004_Customer_New
 
 create page FragTest.P005_Quick_View
 (
-  params: { $Customer: FragTest.Customer },
+  params: ( $Customer: FragTest.Customer ),
   title: 'Customer Details',
   layout: Atlas_Core.PopupLayout
 )
@@ -252,7 +252,7 @@ create page FragTest.P005_Quick_View
  */
 create snippet FragTest.CustomerCard
 (
-  params: { $Customer: FragTest.Customer }
+  params: ( $Customer: FragTest.Customer )
 )
 {
   container ctnCard (class: 'card') {
diff --git a/mdl-examples/doctype-tests/17-custom-widget-examples.mdl b/mdl-examples/doctype-tests/17-custom-widget-examples.mdl
index 4bec3b8b3b..cbb59d192b 100644
--- a/mdl-examples/doctype-tests/17-custom-widget-examples.mdl
+++ b/mdl-examples/doctype-tests/17-custom-widget-examples.mdl
@@ -81,8 +81,8 @@ create page CWTest.P_Gallery_Basic
           datasource: database CWTest.task sort by title asc
         ) {
           template tpl1 {
-            dynamictext dtTitle (content: '{1}', contentparams: [{1} = title], rendermode: H4)
-            dynamictext dtDesc (content: '{1}', contentparams: [{1} = description])
+            dynamictext dtTitle (content: '{1}', contentparams: ({1} = title), rendermode: H4)
+            dynamictext dtDesc (content: '{1}', contentparams: ({1} = description))
           }
         }
       }
@@ -116,8 +116,8 @@ create page CWTest.P_Gallery_Filtered
           datasource: database CWTest.task sort by DueDate desc
         ) {
           template tpl1 {
-            dynamictext dtTitle (content: '{1}', contentparams: [{1} = title], rendermode: H4)
-            dynamictext dtPriority (content: 'Priority: {1}', contentparams: [{1} = Priority])
+            dynamictext dtTitle (content: '{1}', contentparams: ({1} = title), rendermode: H4)
+            dynamictext dtPriority (content: 'Priority: {1}', contentparams: ({1} = Priority))
           }
           filter flt1 {
             textfilter tfSearch (attribute: title)
@@ -143,9 +143,9 @@ create page CWTest.P_Gallery_Filtered
  */
 create page CWTest.P_ComboBox_Enum
 (
-  params: {
+  params: (
     $task: CWTest.task
-  },
+  ),
   title: 'ComboBox Enum',
   layout: Atlas_Core.PopupLayout,
   folder: 'CustomWidgets'
@@ -183,9 +183,9 @@ create page CWTest.P_ComboBox_Enum
  */
 create page CWTest.P_ComboBox_Assoc
 (
-  params: {
+  params: (
     $task: CWTest.task
-  },
+  ),
   title: 'ComboBox Association',
   layout: Atlas_Core.PopupLayout,
   folder: 'CustomWidgets'
@@ -295,9 +295,9 @@ create page CWTest.P_Image_Dimensions
  */
 create page CWTest.P_Image_OnClick
 (
-  params: {
+  params: (
     $task: CWTest.task
-  },
+  ),
   title: 'Image with OnClick',
   layout: Atlas_Core.Atlas_Default,
   folder: 'CustomWidgets'
@@ -320,8 +320,8 @@ create page CWTest.P_Image_OnClick
           )
         }
         column col2 (desktopwidth: 6) {
-          dynamictext dtTitle (content: '{1}', contentparams: [{1} = title], rendermode: H3)
-          dynamictext dtDesc (content: '{1}', contentparams: [{1} = description])
+          dynamictext dtTitle (content: '{1}', contentparams: ({1} = title), rendermode: H3)
+          dynamictext dtDesc (content: '{1}', contentparams: ({1} = description))
         }
       }
     }
diff --git a/mdl-examples/doctype-tests/24-workflow-examples.mdl b/mdl-examples/doctype-tests/24-workflow-examples.mdl
index d74400f887..b1ea437b65 100644
--- a/mdl-examples/doctype-tests/24-workflow-examples.mdl
+++ b/mdl-examples/doctype-tests/24-workflow-examples.mdl
@@ -90,7 +90,7 @@ end;
 create page WFTest.TaskPage (
   title: 'Task Page',
   layout: Atlas_Core.Atlas_Default,
-  params: { $WorkflowUserTask: System.WorkflowUserTask }
+  params: ( $WorkflowUserTask: System.WorkflowUserTask )
 ) {
   layoutgrid g1 {
     row r1 {
@@ -104,7 +104,7 @@ create page WFTest.TaskPage (
 create page WFTest.AlternateTaskPage (
   title: 'Alternate Task',
   layout: Atlas_Core.Atlas_Default,
-  params: { $WorkflowUserTask: System.WorkflowUserTask }
+  params: ( $WorkflowUserTask: System.WorkflowUserTask )
 ) {
   layoutgrid g1 {
     row r1 {
@@ -119,7 +119,7 @@ create page WFTest.AlternateTaskPage (
 create page WFTest.OverviewPage (
   title: 'Workflow Overview',
   layout: Atlas_Core.Atlas_Default,
-  params: { $workflow: System.Workflow }
+  params: ( $workflow: System.Workflow )
 ) {
   layoutgrid g1 {
     row r1 {
@@ -367,7 +367,7 @@ end;
 create page WFTarget.TaskPage (
   title: 'Task Page',
   layout: Atlas_Core.Atlas_Default,
-  params: { $WorkflowUserTask: System.WorkflowUserTask }
+  params: ( $WorkflowUserTask: System.WorkflowUserTask )
 ) {
   layoutgrid g1 {
     row r1 {
diff --git a/mdl-examples/doctype-tests/26-menu-examples.mdl b/mdl-examples/doctype-tests/26-menu-examples.mdl
index 32e839450f..285cd2f805 100644
--- a/mdl-examples/doctype-tests/26-menu-examples.mdl
+++ b/mdl-examples/doctype-tests/26-menu-examples.mdl
@@ -8,10 +8,10 @@
 --
 -- It is NOT the menu inside a navigation profile. The two are easy to confuse
 -- because both are built from the same Menus$MenuItem elements — which is why
--- the item syntax below is identical to the MENU (...) block of
+-- the item syntax below is identical to the { ... } children of
 -- CREATE NAVIGATION:
 --
---   create or modify menu MenuTest.Main_Menu ( ... );  -- this file
+--   create or modify menu MenuTest.Main_Menu { ... };  -- this file
 --   show navigation menu;                              -- profile menu
 --
 -- This script is self-contained: it creates the module, and the page and
@@ -51,29 +51,29 @@ end;
 -- Create
 -- ----------------------------------------------------------------------------
 -- Item forms:
---   * page target      -> menu item '<caption>' page <Module.Page>
---   * microflow target -> menu item '<caption>' microflow <Module.Microflow>
+--   * page target      -> menu item '<caption>' ( OnClick: show page <Module.Page> )
+--   * microflow target -> menu item '<caption>' ( OnClick: call microflow <Module.Microflow> )
 --   * no action        -> menu item '<caption>'
---   * sub-menu         -> menu '<caption>' ( ...nested items... )
+--   * sub-menu         -> menu '<caption>' { ...nested items... }
 --
--- ICON names an entry in an icon collection. It is optional on every form.
-create menu MenuTest.Main_Menu (
-  menu item 'Home' page MenuTest.Landing icon Atlas_Core.Atlas_Filled.home;
-  menu item 'Rebuild' microflow MenuTest.Rebuild;
-  menu 'Admin' (
-    menu item 'Reports' page MenuTest.Reports;
-  );
-  menu item 'Plain';
-);
+-- Icon: names an entry in an icon collection. It is optional on every form.
+create menu MenuTest.Main_Menu {
+  menu item 'Home' ( OnClick: show page MenuTest.Landing, Icon: Atlas_Core.Atlas_Filled.home )
+  menu item 'Rebuild' ( OnClick: call microflow MenuTest.Rebuild )
+  menu 'Admin' {
+    menu item 'Reports' ( OnClick: show page MenuTest.Reports )
+  }
+  menu item 'Plain'
+};
 
 -- OR MODIFY replaces the item list wholesale, exactly like CREATE NAVIGATION:
 -- the list given is the document's complete contents, so an omitted item is a
 -- removed item. The document's identity and its export level are preserved, so
 -- menu widgets pointing at it keep working.
-create or modify menu MenuTest.Main_Menu (
-  menu item 'Home' page MenuTest.Landing icon Atlas_Core.Atlas_Filled.home;
-  menu item 'Rebuild' microflow MenuTest.Rebuild;
-);
+create or modify menu MenuTest.Main_Menu {
+  menu item 'Home' ( OnClick: show page MenuTest.Landing, Icon: Atlas_Core.Atlas_Filled.home )
+  menu item 'Rebuild' ( OnClick: call microflow MenuTest.Rebuild )
+};
 
 -- ----------------------------------------------------------------------------
 -- Describe
@@ -99,7 +99,7 @@ drop menu MenuTest.Main_Menu;
 --    selected for parameter ..."), which `mx check` reports at "Menu item".
 --    Point the item at a parameterless page, or open the page from a microflow.
 --
--- 2. Only Forms$IconCollectionIcon can be expressed by the ICON clause. A glyph
+-- 2. Only Forms$IconCollectionIcon can be expressed by the Icon: property. A glyph
 --    icon (numeric code) or an image icon is reported by DESCRIBE on its own
 --    comment line rather than dropped silently:
 --
diff --git a/mdl-examples/doctype-tests/29-datagrid-examples.mdl b/mdl-examples/doctype-tests/29-datagrid-examples.mdl
index f77cb08b3a..b5365282b5 100644
--- a/mdl-examples/doctype-tests/29-datagrid-examples.mdl
+++ b/mdl-examples/doctype-tests/29-datagrid-examples.mdl
@@ -78,7 +78,7 @@ create association DgTest.Category_Supplier
 -- @version: 11.0+
 -- Helper page: edit form opened from CRUD examples (page params require 11.0+)
 create page DgTest.Product_Edit (
-  params: { $Product: DgTest.Product },
+  params: ( $Product: DgTest.Product ),
   title: 'Edit Product',
   layout: Atlas_Core.PopupLayout,
   url: 'dg/product/edit/{Product/Name}',
@@ -248,14 +248,14 @@ create page DgTest.DG04_Microflow_DataSource (
  * The outer DataView provides $Category; the inner DataGrid shows its Products.
  */
 create page DgTest.DG05_Association_DataSource (
-  params: { $Category: DgTest.Category },
+  params: ( $Category: DgTest.Category ),
   title: 'Category Products',
   layout: Atlas_Core.PopupLayout,
   url: 'dg05_association_datasource/{Category/Name}',
   folder: 'DataGrid'
 ) {
   dataview dvCategory (datasource: $Category, editable: false) {
-    dynamictext txtName (content: '{1}', contentparams: [{1} = Name])
+    dynamictext txtName (content: '{1}', contentparams: ({1} = Name))
     datagrid dg1 (
       datasource: $Category/DgTest.Product_Category/DgTest.Product
     ) {
@@ -420,7 +420,7 @@ create page DgTest.DG09_Custom_Content_Column (
   datagrid dg1 (datasource: database DgTest.Product) {
     column colName   (attribute: Name, caption: 'Name')
     column colStatus (attribute: Status, caption: 'Status', ShowContentAs: customContent) {
-      dynamictext txtStatus (content: '{1}', contentparams: [{1} = Status])
+      dynamictext txtStatus (content: '{1}', contentparams: ({1} = Status))
     }
     column colActions (caption: 'Actions', ShowContentAs: customContent) {
       actionbutton btnEdit (
@@ -613,11 +613,11 @@ create page DgTest.DG14b_Styling_DesignProps (
     datasource: database DgTest.Product,
     PageSize: 10,
     PagingPosition: both,
-    designproperties: ['Compact': on, 'Striped': on, 'Hover': on, 'Borders': 'Horizontal']
+    designproperties: ('Compact': on, 'Striped': on, 'Hover': on, 'Borders': 'Horizontal')
   ) {
     column colName (
       attribute: Name, caption: 'Name',
-      designproperties: ['Compact': on]
+      designproperties: ('Compact': on)
     )
     column colPrice (attribute: Price, caption: 'Price', Alignment: right)
     column colStock (attribute: Stock, caption: 'Stock', Alignment: right)
@@ -637,7 +637,7 @@ create page DgTest.DG15_Variable_Visibility (
   layout: Atlas_Core.Atlas_Default,
   url: 'dg15_variable_visibility',
   folder: 'DataGrid',
-  variables: { $showStock: boolean = 'if (1 < 2) then true else false' }
+  variables: ( $showStock: boolean = 'if (1 < 2) then true else false' )
 ) {
   datagrid dg1 (datasource: database DgTest.Product) {
     column colName  (attribute: Name,  caption: 'Name')
@@ -694,7 +694,7 @@ create page DgTest.DG16_Associated_Attributes (
     column colCatBadge (caption: 'Category (badge)', ShowContentAs: customContent) {
       dynamictext dtCat (
         content: 'in {1}',
-        contentparams: [{1} = DgTest.Product_Category/Name]
+        contentparams: ({1} = DgTest.Product_Category/Name)
       )
     }
   }
diff --git a/mdl-examples/doctype-tests/29-listview-specialization-templates.mdl b/mdl-examples/doctype-tests/29-listview-specialization-templates.mdl
index 204e7f1ccf..320ad2af54 100644
--- a/mdl-examples/doctype-tests/29-listview-specialization-templates.mdl
+++ b/mdl-examples/doctype-tests/29-listview-specialization-templates.mdl
@@ -55,7 +55,7 @@ create or modify page Vehicles.Vehicle_Overview (
         -- below renders as. This is the list view's own Widgets array.
         dynamictext defaultVehicle (
             Content: '{1} {2} ({3})',
-            ContentParams: [{1} = Brand, {2} = Model, {3} = Year]
+            ContentParams: ({1} = Brand, {2} = Model, {3} = Year)
         )
 
         -- One body per specialization. The template has no name — the entity it
@@ -67,19 +67,19 @@ create or modify page Vehicles.Vehicle_Overview (
         template for Vehicles.Bus {
             dynamictext busLabel (
                 Content: 'Bus {1} - capacity {2}, route {3}',
-                ContentParams: [{1} = Brand, {2} = PassengerCapacity, {3} = RouteNumber]
+                ContentParams: ({1} = Brand, {2} = PassengerCapacity, {3} = RouteNumber)
             )
         }
         template for Vehicles.Truck {
             dynamictext truckLabel (
                 Content: 'Truck {1} - max load {2} kg, trailer: {3}',
-                ContentParams: [{1} = Brand, {2} = MaxLoadKg, {3} = HasTrailer]
+                ContentParams: ({1} = Brand, {2} = MaxLoadKg, {3} = HasTrailer)
             )
         }
         template for Vehicles.Car {
             dynamictext carLabel (
                 Content: 'Car {1} - {2} doors',
-                ContentParams: [{1} = Brand, {2} = NumberOfDoors]
+                ContentParams: ({1} = Brand, {2} = NumberOfDoors)
             )
         }
     }
@@ -98,7 +98,7 @@ alter page Vehicles.Vehicle_Overview {
         template for Vehicles.Motorcycle {
             dynamictext mcLabel (
                 Content: 'Motorcycle {1} - sidecar: {2}',
-                ContentParams: [{1} = Brand, {2} = HasSidecar]
+                ContentParams: ({1} = Brand, {2} = HasSidecar)
             )
         }
     };
diff --git a/mdl-examples/doctype-tests/30-guest-access.mdl b/mdl-examples/doctype-tests/30-guest-access.mdl
index 9ad30de055..8d2e7e38ac 100644
--- a/mdl-examples/doctype-tests/30-guest-access.mdl
+++ b/mdl-examples/doctype-tests/30-guest-access.mdl
@@ -32,8 +32,8 @@ create module role Catalog.Editor description 'Maintains the product catalogue';
 
 -- The role anonymous visitors are given. System.User is what lets an
 -- unauthenticated session exist at all.
-create user role Anonymous (Catalog.Visitor, System.User);
-create user role CatalogAdmin (Catalog.Editor, System.User);
+create user role Anonymous ( ModuleRoles: (Catalog.Visitor, System.User) );
+create user role CatalogAdmin ( ModuleRoles: (Catalog.Editor, System.User) );
 
 alter project security level production;
 alter project security guest access on role Anonymous;
diff --git a/mdl-examples/doctype-tests/30-pluggable-widget-examples.mdl b/mdl-examples/doctype-tests/30-pluggable-widget-examples.mdl
index 5b6ff80bfb..489cc89730 100644
--- a/mdl-examples/doctype-tests/30-pluggable-widget-examples.mdl
+++ b/mdl-examples/doctype-tests/30-pluggable-widget-examples.mdl
@@ -200,7 +200,7 @@ create page PW.P_PW04_ChildSlot (
 -- ============================================================================
 
 create page PW.P_PW05_Attribute (
-  params: { $Item: PW.Item },
+  params: ( $Item: PW.Item ),
   title: 'PW05 Attribute',
   layout: Atlas_Core.PopupLayout
 ) {
@@ -249,7 +249,7 @@ create page PW.P_PW06_GalleryFilter (
             pluggablewidget 'com.mendix.widget.web.dropdownsort.DropdownSort' ddSort1
           }
           template tpl1 {
-            dynamictext tTitle (content: '{1}', contentparams: [{1} = title], rendermode: H4)
+            dynamictext tTitle (content: '{1}', contentparams: ({1} = title), rendermode: H4)
           }
         }
       }
@@ -304,10 +304,10 @@ create page PW.P_PW08_MultiSlot (
           customVisualization: true
         ) {
           container customTitle {
-            dynamictext tlTitle (content: '{1}', rendermode: H4, contentparams: [{1} = title])
+            dynamictext tlTitle (content: '{1}', rendermode: H4, contentparams: ({1} = title))
           }
           container customDescription {
-            dynamictext tlDesc (content: '{1}', contentparams: [{1} = description])
+            dynamictext tlDesc (content: '{1}', contentparams: ({1} = description))
           }
         }
       }
@@ -322,7 +322,7 @@ create page PW.P_PW08_MultiSlot (
 -- ============================================================================
 
 create page PW.P_PW09_Nested (
-  params: { $Item: PW.Item },
+  params: ( $Item: PW.Item ),
   title: 'PW09 Nested',
   layout: Atlas_Core.Atlas_Default
 ) {
diff --git a/mdl-examples/doctype-tests/31-pluggable-datagrid-gallery-v010-examples.mdl b/mdl-examples/doctype-tests/31-pluggable-datagrid-gallery-v010-examples.mdl
index 6ceb7553a7..271c7ffbdc 100644
--- a/mdl-examples/doctype-tests/31-pluggable-datagrid-gallery-v010-examples.mdl
+++ b/mdl-examples/doctype-tests/31-pluggable-datagrid-gallery-v010-examples.mdl
@@ -240,8 +240,8 @@ create page PluggableV10.P_PD05_CustomCellContent (
             container ctnTotal {
               dynamictext txtTotal (
                 Content: '${1}',
-                ContentParams: [{1} = TotalAmount],
-                DesignProperties: ['Weight': 'Semibold', 'Size': 'Large']
+                ContentParams: ({1} = TotalAmount),
+                DesignProperties: ('Weight': 'Semibold', 'Size': 'Large')
               )
             }
           }
@@ -253,7 +253,7 @@ create page PluggableV10.P_PD05_CustomCellContent (
             container ctnStatus (Class: 'badge') {
               dynamictext txtStatus (
                 Content: '{1}',
-                ContentParams: [{1} = OrderStatusValue]
+                ContentParams: ({1} = OrderStatusValue)
               )
             }
           }
@@ -273,10 +273,10 @@ create page PluggableV10.P_PD05_CustomCellContent (
 -- ShowContentAs: dynamicText branch below) IS per-row, so its
 -- ContentParams CAN reference $currentObject attributes.
 create page PluggableV10.P_PD06_DynamicCaption (
-  Variables: {
+  Variables: (
     $Col1Label: String = '''Customer Name''',
     $Col2Label: String = '''Date Joined'''
-  },
+  ),
   Title: 'Customers — Dynamic',
   Layout: Atlas_Core.Atlas_Default,
   Folder: 'PluggableDataGrid'
@@ -295,7 +295,7 @@ create page PluggableV10.P_PD06_DynamicCaption (
           column Name (
             Attribute: Name,
             Caption: '{1}',
-            CaptionParams: [{1} = $Col1Label],
+            CaptionParams: ({1} = $Col1Label),
             ColumnWidth: manual,
             Size: 8
           ) {
@@ -307,10 +307,10 @@ create page PluggableV10.P_PD06_DynamicCaption (
           column JoinedDate (
             Attribute: JoinedDate,
             Caption: '{1}  {2}',
-            CaptionParams: [{1} = $Col2Label, {2} = '[%CurrentDateTime%]'],
+            CaptionParams: ({1} = $Col2Label, {2} = '[%CurrentDateTime%]'),
             ShowContentAs: dynamicText,
             Content: 'Joined on {1}',
-            ContentParams: [{1} = JoinedDate],
+            ContentParams: ({1} = JoinedDate),
             ColumnWidth: manual,
             Size: 6
           ) {
@@ -342,9 +342,9 @@ create page PluggableV10.P_PG01_BasicGallery (
               dynamictext txtName (
                 Content: '{1}',
                 RenderMode: H4,
-                ContentParams: [{1} = Name]
+                ContentParams: ({1} = Name)
               )
-              dynamictext txtEmail (Content: '{1}', ContentParams: [{1} = Email])
+              dynamictext txtEmail (Content: '{1}', ContentParams: ({1} = Email))
             }
           }
         }
@@ -379,7 +379,7 @@ create page PluggableV10.P_PG02_GalleryFilter (
               dynamictext txtName (
                 Content: '{1}',
                 RenderMode: H4,
-                ContentParams: [{1} = Name]
+                ContentParams: ({1} = Name)
               )
             }
           }
@@ -412,16 +412,16 @@ create page PluggableV10.P_PG03_RichGallery (
                     dynamictext txtNum (
                       Content: 'Order {1}',
                       RenderMode: H4,
-                      ContentParams: [{1} = OrderNumber],
-                      DesignProperties: ['Weight': 'Semibold']
+                      ContentParams: ({1} = OrderNumber),
+                      DesignProperties: ('Weight': 'Semibold')
                     )
-                    dynamictext txtDate (Content: '{1}', ContentParams: [{1} = OrderDate])
+                    dynamictext txtDate (Content: '{1}', ContentParams: ({1} = OrderDate))
                   }
                   column c2 (DesktopWidth: 4) {
                     dynamictext txtTotal (
                       Content: '${1}',
-                      ContentParams: [{1} = TotalAmount],
-                      DesignProperties: ['Weight': 'Bold', 'Size': 'Large', 'Align self': 'Right']
+                      ContentParams: ({1} = TotalAmount),
+                      DesignProperties: ('Weight': 'Bold', 'Size': 'Large', 'Align self': 'Right')
                     )
                   }
                 }
@@ -475,7 +475,7 @@ create page PluggableV10.P_MX01_GridAndGallery (
             dynamictext gtxtName (
               Content: '{1}',
               RenderMode: H4,
-              ContentParams: [{1} = Name]
+              ContentParams: ({1} = Name)
             )
           }
         }
diff --git a/mdl-examples/doctype-tests/33-alter-page-examples.mdl b/mdl-examples/doctype-tests/33-alter-page-examples.mdl
index 16a8a749c8..fa8a912a10 100644
--- a/mdl-examples/doctype-tests/33-alter-page-examples.mdl
+++ b/mdl-examples/doctype-tests/33-alter-page-examples.mdl
@@ -56,7 +56,7 @@ create persistent entity AlterPg.Product (
 
 -- A NewEdit page so the row Edit button has somewhere to navigate.
 create or replace page AlterPg.Product_NewEdit (
-  Params: { $Product: AlterPg.Product },
+  Params: ( $Product: AlterPg.Product ),
   Title: 'Edit Product',
   Layout: Atlas_Core.PopupLayout,
   Folder: 'OverviewPages'
@@ -396,12 +396,12 @@ alter page AlterPg.Product_Overview {
 
 create or replace snippet AlterPg.Product_Card_Snippet
 (
-  Params: { $Product: AlterPg.Product }
+  Params: ( $Product: AlterPg.Product )
 )
 {
   dataview dvCard (datasource: $Product) {
-    dynamictext cardTitle (Content: '{1}', ContentParams: [{1} = Name], RenderMode: H4)
-    dynamictext cardBody (Content: '{1}', ContentParams: [{1} = Notes])
+    dynamictext cardTitle (Content: '{1}', ContentParams: ({1} = Name), RenderMode: H4)
+    dynamictext cardBody (Content: '{1}', ContentParams: ({1} = Notes))
   }
 };
 
diff --git a/mdl-examples/doctype-tests/35-mcp-pluggable-thirdparty.mdl b/mdl-examples/doctype-tests/35-mcp-pluggable-thirdparty.mdl
index 83bc4bd024..17f26ddd42 100644
--- a/mdl-examples/doctype-tests/35-mcp-pluggable-thirdparty.mdl
+++ b/mdl-examples/doctype-tests/35-mcp-pluggable-thirdparty.mdl
@@ -49,9 +49,9 @@ end;
  */
 create page MCPWidgetTest.P_BarcodeScanner
 (
-  params: {
+  params: (
     $Item: MCPWidgetTest.Item
-  },
+  ),
   title: 'Scan Barcode',
   layout: Atlas_Core.PopupLayout,
   folder: 'MCPWidgets'
@@ -81,9 +81,9 @@ create page MCPWidgetTest.P_BarcodeScanner
  */
 create page MCPWidgetTest.P_ImageActions
 (
-  params: {
+  params: (
     $Item: MCPWidgetTest.Item
-  },
+  ),
   title: 'Item Image',
   layout: Atlas_Core.PopupLayout,
   folder: 'MCPWidgets'
diff --git a/mdl-examples/doctype-tests/alter-page-insert-into.mdl b/mdl-examples/doctype-tests/alter-page-insert-into.mdl
index 7423fd954e..69374cbcd9 100644
--- a/mdl-examples/doctype-tests/alter-page-insert-into.mdl
+++ b/mdl-examples/doctype-tests/alter-page-insert-into.mdl
@@ -43,12 +43,12 @@ alter page AlterInto.Home {
 -- page and its ALTER are version-gated; the rest of the INSERT INTO coverage
 -- (the two AlterInto.Home cases above) still runs on 10.x.
 -- @version: 11.0+
-create or replace page AlterInto.Detail ( params: { $Item: AlterInto.Item }, layout: Atlas_Core.Atlas_Default ) {
+create or replace page AlterInto.Detail ( params: ( $Item: AlterInto.Item ), layout: Atlas_Core.Atlas_Default ) {
   dataview dv (datasource: $Item) { }
 }
 /
 alter page AlterInto.Detail {
   insert into dv {
-    dynamictext dtTitle (content: '{1}', contentparams: [{1} = Title], rendermode: H1)
+    dynamictext dtTitle (content: '{1}', contentparams: ({1} = Title), rendermode: H1)
   }
 }
diff --git a/mdl-examples/doctype-tests/layouts.mdl b/mdl-examples/doctype-tests/layouts.mdl
index 06d2e253be..efb2cf8cd8 100644
--- a/mdl-examples/doctype-tests/layouts.mdl
+++ b/mdl-examples/doctype-tests/layouts.mdl
@@ -152,10 +152,10 @@ alter layout LayoutTest.App_Default {
 -- document) or `profile:` (a navigation profile), never both.
 -- ----------------------------------------------------------------------------
 
-create or modify menu LayoutTest.Phone_Menu (
-  menu item 'Home' icon Atlas_Core.Atlas.home;
-  menu item 'Account' icon Atlas_Core.Atlas.user;
-);
+create or modify menu LayoutTest.Phone_Menu {
+  menu item 'Home' ( Icon: Atlas_Core.Atlas.home )
+  menu item 'Account' ( Icon: Atlas_Core.Atlas.user )
+};
 
 create or replace layout LayoutTest.Phone_Bottom (
   layouttype: 'Phone',
diff --git a/mdl-examples/doctype-tests/navigation-profiles.mdl b/mdl-examples/doctype-tests/navigation-profiles.mdl
index 82c860b33d..5596e21afd 100644
--- a/mdl-examples/doctype-tests/navigation-profiles.mdl
+++ b/mdl-examples/doctype-tests/navigation-profiles.mdl
@@ -20,22 +20,22 @@
 
 create or replace navigation Phone
   home page MyFirstModule.Home_Web
-  menu (
-    menu item 'Home' page MyFirstModule.Home_Web;
-  );
+  {
+    menu item 'Home' ( OnClick: show page MyFirstModule.Home_Web )
+  };
 
 create or replace navigation Tablet
   home page MyFirstModule.Home_Web
-  menu (
-    menu item 'Home' page MyFirstModule.Home_Web;
-  );
+  {
+    menu item 'Home' ( OnClick: show page MyFirstModule.Home_Web )
+  };
 
 -- Re-running is an update, not a duplicate: the second run reports 'updated'.
 create or replace navigation Phone
   home page MyFirstModule.Home_Web
-  menu (
-    menu item 'Home' page MyFirstModule.Home_Web;
-  );
+  {
+    menu item 'Home' ( OnClick: show page MyFirstModule.Home_Web )
+  };
 
 -- Each device kind has an offline twin. An offline profile is not a different
 -- document -- measured over PED, a freshly created PhoneOffline stores exactly
@@ -49,14 +49,14 @@ create or replace navigation Phone
 -- to it.
 create or replace navigation TabletOffline
   home page MyFirstModule.Home_Web
-  menu (
-    menu item 'Home' page MyFirstModule.Home_Web;
-  );
+  {
+    menu item 'Home' ( OnClick: show page MyFirstModule.Home_Web )
+  };
 
 create or replace navigation PhoneOffline
   home page MyFirstModule.Home_Web
-  menu (
-    menu item 'Home' page MyFirstModule.Home_Web;
-  );
+  {
+    menu item 'Home' ( OnClick: show page MyFirstModule.Home_Web )
+  };
 
 describe navigation;
diff --git a/mdl-examples/use-cases/02-agentic-search.mdl b/mdl-examples/use-cases/02-agentic-search.mdl
index 30fc9d0678..4952c88893 100644
--- a/mdl-examples/use-cases/02-agentic-search.mdl
+++ b/mdl-examples/use-cases/02-agentic-search.mdl
@@ -381,7 +381,7 @@ end;
  */
 create page TaskMgmt.Task_Detail
 (
-  params: { $task: TaskMgmt.task },
+  params: ( $task: TaskMgmt.task ),
   title: 'Task Detail',
   layout: Atlas_Core.PopupLayout
 )
@@ -408,14 +408,14 @@ create page TaskMgmt.Task_Detail
  */
 create page TaskMgmt.Project_Overview
 (
-  params: { $TaskProject: TaskMgmt.TaskProject },
+  params: ( $TaskProject: TaskMgmt.TaskProject ),
   title: 'Project Overview',
   layout: Atlas_Core.Atlas_Default
 )
 {
   dataview dvProject (datasource: $TaskProject) {
-    dynamictext dtName (content: '{1}', contentparams: [{1} = Name], rendermode: H2)
-    dynamictext dtDesc (content: '{1}', contentparams: [{1} = description])
+    dynamictext dtName (content: '{1}', contentparams: ({1} = Name), rendermode: H2)
+    dynamictext dtDesc (content: '{1}', contentparams: ({1} = description))
 
     container cTasks (class: 'mt-3') {
       datagrid dgProjectTasks (datasource: database TaskMgmt.task) {
diff --git a/mdl-examples/use-cases/ai-agent-platform-demo.mdl b/mdl-examples/use-cases/ai-agent-platform-demo.mdl
index 049d842208..b2fbd0d2d8 100644
--- a/mdl-examples/use-cases/ai-agent-platform-demo.mdl
+++ b/mdl-examples/use-cases/ai-agent-platform-demo.mdl
@@ -259,7 +259,7 @@ end;
 create page AICustSupport.WF_AgentReview (
   title:  'Review Support Case',
   layout: Atlas_Core.Atlas_Default,
-  params: { $WorkflowUserTask: System.WorkflowUserTask }
+  params: ( $WorkflowUserTask: System.WorkflowUserTask )
 ) {
   layoutgrid g1 {
     row r1 {
@@ -273,7 +273,7 @@ create page AICustSupport.WF_AgentReview (
 create page AICustSupport.WF_Overview (
   title:  'Case Workflow Overview',
   layout: Atlas_Core.Atlas_Default,
-  params: { $workflow: System.Workflow }
+  params: ( $workflow: System.Workflow )
 ) {
   layoutgrid g1 {
     row r1 {
@@ -548,10 +548,10 @@ grant view on page AICustSupport.Admin_AuditLog
 -- Demo users stand in for SSO identities during development.
 -- ############################################################################
 
-create or modify user role EndCustomer       (System.User, AICustSupport.Customer);
-create or modify user role SupportAgent      (System.User, AICustSupport.Agent);
-create or modify user role SupportSupervisor (System.User, AICustSupport.Agent, AICustSupport.Supervisor);
-create or modify user role PlatformAdmin     (System.Administrator, AICustSupport.Admin) manage all roles;
+create or modify user role EndCustomer       ( ModuleRoles: (System.User, AICustSupport.Customer) );
+create or modify user role SupportAgent      ( ModuleRoles: (System.User, AICustSupport.Agent) );
+create or modify user role SupportSupervisor ( ModuleRoles: (System.User, AICustSupport.Agent, AICustSupport.Supervisor) );
+create or modify user role PlatformAdmin     ( ModuleRoles: (System.Administrator, AICustSupport.Admin), ManageAllRoles: true );
 
 -- Enable demo users (disable in production — use SSO)
 alter project security demo users on;
diff --git a/mdl-examples/use-cases/graph-traversal-viewer-demo.mdl b/mdl-examples/use-cases/graph-traversal-viewer-demo.mdl
index 8aee2c7348..5eb43041ae 100644
--- a/mdl-examples/use-cases/graph-traversal-viewer-demo.mdl
+++ b/mdl-examples/use-cases/graph-traversal-viewer-demo.mdl
@@ -389,7 +389,7 @@ grant execute on nanoflow OntologyViewer.ACT_StopAwareSendMessage to OntologyVie
 -- 7. Input snippet — textarea + send/stop buttons + suggested prompts
 -- ----------------------------------------------------------------------------
 create snippet OntologyViewer.Snippet_ChatContext_Interaction (
-  params: { $ChatContext: ConversationalUI.ChatContext }
+  params: ( $ChatContext: ConversationalUI.ChatContext )
 ) {
   container container1 (class: 'chat-input-wrapper') {
     textarea textAreaUserPrompt (attribute: CurrentUserPrompt)
@@ -415,7 +415,7 @@ create snippet OntologyViewer.Snippet_ChatContext_Interaction (
 -- 8. Chat page — embeds the custom graph widget + the tool-call cards
 -- ----------------------------------------------------------------------------
 create page OntologyViewer.ConversationalUI_FullScreenChat (
-  params: { $ChatContext: ConversationalUI.ChatContext },
+  params: ( $ChatContext: ConversationalUI.ChatContext ),
   title: 'Full Screen Chat',
   layout: Atlas_Core.Atlas_Default
 ) {
diff --git a/mdl-examples/widget-matrix/pluggable-smoke.mdl b/mdl-examples/widget-matrix/pluggable-smoke.mdl
index ad7b7b16a5..b31e017d70 100644
--- a/mdl-examples/widget-matrix/pluggable-smoke.mdl
+++ b/mdl-examples/widget-matrix/pluggable-smoke.mdl
@@ -39,7 +39,7 @@ create page WMatrix.Pg
     Selection: Single
   ) {
     template tmpl {
-      dynamictext dt (content: '{1}', contentparams: [{1} = Name])
+      dynamictext dt (content: '{1}', contentparams: ({1} = Name))
     }
   }
 }
diff --git a/mdl-examples/widgetdemo/03-showcase-page.mdl b/mdl-examples/widgetdemo/03-showcase-page.mdl
index 3aa3207d27..5c862eae7a 100644
--- a/mdl-examples/widgetdemo/03-showcase-page.mdl
+++ b/mdl-examples/widgetdemo/03-showcase-page.mdl
@@ -6,7 +6,7 @@ create or replace page WidgetDemo.WidgetDemo_Showcase (
   title: 'Widget Showcase',
   layout: Atlas_Core.Atlas_Default,
   url: 'widget-demo/{DemoItem}',
-  params: { $DemoItem: WidgetDemo.DemoItem }
+  params: ( $DemoItem: WidgetDemo.DemoItem )
 ) {
   layoutgrid gridMain {
 
@@ -110,9 +110,9 @@ create or replace page WidgetDemo.WidgetDemo_Showcase (
             pluggablewidget 'com.mendix.widget.web.dropdownsort.DropdownSort' ddSort1
           }
           template tmpl1 {
-            dynamictext tTitle (content: '{1}', rendermode: H4, contentparams: [{1} = title])
-            dynamictext tCode (content: 'Code: {1} | Priority: {2}', contentparams: [{1} = Code, {2} = Priority])
-            dynamictext tAmount (content: 'Amount: {1} | Score: {2}', contentparams: [{1} = Amount, {2} = Score])
+            dynamictext tTitle (content: '{1}', rendermode: H4, contentparams: ({1} = title))
+            dynamictext tCode (content: 'Code: {1} | Priority: {2}', contentparams: ({1} = Code, {2} = Priority))
+            dynamictext tAmount (content: 'Amount: {1} | Score: {2}', contentparams: ({1} = Amount, {2} = Score))
           }
         }
         dataview dvDetail (datasource: $DemoItem) {
@@ -200,8 +200,8 @@ create or replace page WidgetDemo.WidgetDemo_Showcase (
     row rowS6 {
       column cS6a (desktopwidth: 12) {
         listview lvItems (datasource: database from WidgetDemo.DemoItem sort by title asc) {
-          dynamictext lvT (content: '{1}', rendermode: H4, contentparams: [{1} = title])
-          dynamictext lvD (content: '{1}', contentparams: [{1} = description])
+          dynamictext lvT (content: '{1}', rendermode: H4, contentparams: ({1} = title))
+          dynamictext lvD (content: '{1}', contentparams: ({1} = description))
         }
       }
     }
@@ -345,10 +345,10 @@ create or replace page WidgetDemo.WidgetDemo_Showcase (
           customVisualization: true
         ) {
           container customTitle {
-            dynamictext tlTitle (content: '{1}', rendermode: H4, contentparams: [{1} = title])
+            dynamictext tlTitle (content: '{1}', rendermode: H4, contentparams: ({1} = title))
           }
           container customDescription {
-            dynamictext tlDesc (content: '{1}', contentparams: [{1} = description])
+            dynamictext tlDesc (content: '{1}', contentparams: ({1} = description))
           }
         }
       }
@@ -403,7 +403,7 @@ create or replace page WidgetDemo.WidgetDemo_Showcase (
           showIcon: 'left'
         ) {
           container children {
-            dynamictext treeChildText (content: 'Score: {1} | Amount: {2}', contentparams: [{1} = Score, {2} = Amount])
+            dynamictext treeChildText (content: 'Score: {1} | Amount: {2}', contentparams: ({1} = Score, {2} = Amount))
           }
         }
       }
@@ -415,8 +415,8 @@ create or replace page WidgetDemo.WidgetDemo_Showcase (
           hasChildren: false
         ) {
           container headerContent {
-            dynamictext treeHdrTitle (content: '{1}', rendermode: H5, contentparams: [{1} = title])
-            dynamictext treeHdrMeta (content: 'Priority: {1}', contentparams: [{1} = Priority])
+            dynamictext treeHdrTitle (content: '{1}', rendermode: H5, contentparams: ({1} = title))
+            dynamictext treeHdrMeta (content: 'Priority: {1}', contentparams: ({1} = Priority))
           }
         }
       }
diff --git a/mdl/ast/ast_agenteditor.go b/mdl/ast/ast_agenteditor.go
index 46b6060adc..d6f0071e90 100644
--- a/mdl/ast/ast_agenteditor.go
+++ b/mdl/ast/ast_agenteditor.go
@@ -16,6 +16,7 @@ package ast
 //	  [, DeepLinkURL: '...']
 //	);
 type CreateModelStmt struct {
+	CreateGuard             // `create … if not exists` (ako/mxcli#731)
 	Folder           string // Folder path within module (empty = leave placement alone)
 	Name             QualifiedName
 	Documentation    string
@@ -58,6 +59,7 @@ func (s *AlterModelStmt) isStatement() {}
 //	  Documentation: '...'
 //	);
 type CreateConsumedMCPServiceStmt struct {
+	CreateGuard                     // `create … if not exists` (ako/mxcli#731)
 	Folder                   string // Folder path within module (empty = leave placement alone)
 	Name                     QualifiedName
 	OuterDocumentation       string // /** ... */ doc comment
@@ -95,6 +97,7 @@ func (s *AlterConsumedMCPServiceStmt) isStatement() {}
 //	  Key: @Module.SomeConstant
 //	);
 type CreateKnowledgeBaseStmt struct {
+	CreateGuard             // `create … if not exists` (ako/mxcli#731)
 	Folder           string // Folder path within module (empty = leave placement alone)
 	Name             QualifiedName
 	Documentation    string
@@ -131,6 +134,7 @@ func (s *AlterKnowledgeBaseStmt) isStatement() {}
 
 // CreateAgentStmt represents CREATE AGENT Module.Name (...) [{ body }].
 type CreateAgentStmt struct {
+	CreateGuard             // `create … if not exists` (ako/mxcli#731)
 	Folder           string // Folder path within module (empty = leave placement alone)
 	Name             QualifiedName
 	Documentation    string
diff --git a/mdl/ast/ast_association.go b/mdl/ast/ast_association.go
index b4e3904d74..47c00ab5e7 100644
--- a/mdl/ast/ast_association.go
+++ b/mdl/ast/ast_association.go
@@ -97,6 +97,7 @@ func (s StorageType) String() string {
 
 // CreateAssociationStmt represents: CREATE ASSOCIATION Module.Name FROM ... TO ... TYPE ...
 type CreateAssociationStmt struct {
+	CreateGuard    // `create … if not exists` (ako/mxcli#731)
 	Name           QualifiedName
 	Parent         QualifiedName
 	Child          QualifiedName
@@ -112,9 +113,6 @@ type CreateAssociationStmt struct {
 	Documentation      string
 	DocumentationSet   bool // see mendixlabs/mxcli#1018: absent preserves, empty clears
 	CreateOrModify     bool // true for CREATE OR MODIFY / CREATE OR REPLACE
-	// IfNotExists is CREATE ASSOCIATION IF NOT EXISTS: skip when it already
-	// exists, leaving the stored definition untouched.
-	IfNotExists bool
 
 	// Line anchors from `@anchor(from: (x, y), to: (x, y))` — where the
 	// connector attaches to the FROM and TO entity boxes, as a PERCENTAGE of the
diff --git a/mdl/ast/ast_businessevents.go b/mdl/ast/ast_businessevents.go
index d1978e163c..8ca33ff1b0 100644
--- a/mdl/ast/ast_businessevents.go
+++ b/mdl/ast/ast_businessevents.go
@@ -4,6 +4,7 @@ package ast
 
 // CreateBusinessEventServiceStmt represents CREATE BUSINESS EVENT SERVICE.
 type CreateBusinessEventServiceStmt struct {
+	CreateGuard      // `create … if not exists` (ako/mxcli#731)
 	Name             QualifiedName
 	ServiceName      string
 	EventNamePrefix  string
diff --git a/mdl/ast/ast_create_guard.go b/mdl/ast/ast_create_guard.go
new file mode 100644
index 0000000000..9f334f441f
--- /dev/null
+++ b/mdl/ast/ast_create_guard.go
@@ -0,0 +1,45 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package ast
+
+// CreateGuard is embedded in every document-level CREATE statement that accepts
+// `if not exists`. The guard is the "leave it alone" operation of ADR-0010 R1:
+// when the named element already exists, the statement is skipped and the
+// stored element is not touched; otherwise it creates exactly as a plain
+// `create` would. It is deliberately not `create or modify`, which makes the
+// stored element match the statement.
+//
+// The guard is honoured once, in the executor's dispatch, rather than in each
+// handler — the same choice DropGuard made for `drop … if exists`: a guard that
+// has to be remembered per handler is the one the next doctype forgets.
+type CreateGuard struct {
+	// IfNotExists is `create <kind> if not exists <name>`.
+	IfNotExists bool
+	// GuardWithOrModify records that the same statement also said
+	// `create or modify` (or its alias `or replace`). The two guards contradict
+	// each other, which check reports as MDL067.
+	GuardWithOrModify bool
+}
+
+// CreateIfNotExists reports whether the statement was written with
+// `if not exists`.
+func (g *CreateGuard) CreateIfNotExists() bool { return g.IfNotExists }
+
+// SetCreateIfNotExists records the guard; the visitor calls it once for
+// whichever create statement it built. orModify is whether the statement also
+// carried `or modify` / `or replace`.
+func (g *CreateGuard) SetCreateIfNotExists(orModify bool) {
+	g.IfNotExists = true
+	g.GuardWithOrModify = orModify
+}
+
+// CreateGuardContradicts reports `create or modify … if not exists`.
+func (g *CreateGuard) CreateGuardContradicts() bool { return g.IfNotExists && g.GuardWithOrModify }
+
+// IfNotExistsCreate is implemented by every statement that embeds CreateGuard.
+type IfNotExistsCreate interface {
+	Statement
+	CreateIfNotExists() bool
+	SetCreateIfNotExists(orModify bool)
+	CreateGuardContradicts() bool
+}
diff --git a/mdl/ast/ast_datatransformer.go b/mdl/ast/ast_datatransformer.go
index 9e8d2dabe3..bc4958d62d 100644
--- a/mdl/ast/ast_datatransformer.go
+++ b/mdl/ast/ast_datatransformer.go
@@ -6,6 +6,7 @@ package ast
 //
 //	CREATE DATA TRANSFORMER Module.Name SOURCE JSON '...' { JSLT '...'; };
 type CreateDataTransformerStmt struct {
+	CreateGuard           // `create … if not exists` (ako/mxcli#731)
 	Folder         string // Folder path within module (empty = leave placement alone)
 	Name           QualifiedName
 	SourceType     string // "JSON" or "XML"
diff --git a/mdl/ast/ast_entity.go b/mdl/ast/ast_entity.go
index 4f7524ef9f..b6e130194c 100644
--- a/mdl/ast/ast_entity.go
+++ b/mdl/ast/ast_entity.go
@@ -33,6 +33,7 @@ func (k EntityKind) String() string {
 
 // CreateEntityStmt represents: CREATE [OR MODIFY] PERSISTENT|NON-PERSISTENT ENTITY Module.Name [EXTENDS Parent] (attributes) ...
 type CreateEntityStmt struct {
+	CreateGuard    // `create … if not exists` (ako/mxcli#731)
 	Name           QualifiedName
 	Kind           EntityKind
 	Generalization *QualifiedName // Parent entity for inheritance (e.g., System.Image)
@@ -47,10 +48,6 @@ type CreateEntityStmt struct {
 	// comment clears it (mendixlabs/mxcli#1018).
 	DocumentationSet bool
 	CreateOrModify   bool // true for CREATE OR MODIFY
-	// IfNotExists is CREATE ENTITY IF NOT EXISTS: skip entirely when the entity
-	// is already there. Unlike CreateOrModify it never touches an existing
-	// definition, so it is the safe way to make a domain script re-runnable.
-	IfNotExists bool
 }
 
 func (s *CreateEntityStmt) isStatement() {}
@@ -176,6 +173,7 @@ type OQLQuery struct {
 
 // CreateViewEntityStmt represents: CREATE [OR MODIFY|REPLACE] VIEW ENTITY Module.Name (attrs) AS SELECT ...
 type CreateViewEntityStmt struct {
+	CreateGuard      // `create … if not exists` (ako/mxcli#731)
 	Name             QualifiedName
 	Attributes       []ViewAttribute
 	Query            OQLQuery
diff --git a/mdl/ast/ast_enumeration.go b/mdl/ast/ast_enumeration.go
index 6648da5273..007c259ff4 100644
--- a/mdl/ast/ast_enumeration.go
+++ b/mdl/ast/ast_enumeration.go
@@ -15,7 +15,8 @@ type EnumValue struct {
 
 // CreateModuleStmt represents: CREATE MODULE ModuleName
 type CreateModuleStmt struct {
-	Name string
+	CreateGuard // `create … if not exists` (ako/mxcli#731)
+	Name        string
 }
 
 func (s *CreateModuleStmt) isStatement() {}
@@ -48,6 +49,7 @@ func (s *MoveFolderStmt) isStatement() {}
 
 // CreateEnumerationStmt represents: CREATE ENUMERATION Module.Name (values) COMMENT '...'
 type CreateEnumerationStmt struct {
+	CreateGuard   // `create … if not exists` (ako/mxcli#731)
 	Name          QualifiedName
 	Values        []EnumValue
 	Documentation string
@@ -104,6 +106,7 @@ func (s *DropEnumerationStmt) isStatement() {}
 
 // CreateConstantStmt represents: CREATE CONSTANT Module.Name TYPE type DEFAULT value [COMMENT '...']
 type CreateConstantStmt struct {
+	CreateGuard      // `create … if not exists` (ako/mxcli#731)
 	Name             QualifiedName
 	DataType         DataType
 	DefaultValue     any // The default value (can be string, number, boolean, etc.)
diff --git a/mdl/ast/ast_imagecollection.go b/mdl/ast/ast_imagecollection.go
index 15d229df72..3a472da71e 100644
--- a/mdl/ast/ast_imagecollection.go
+++ b/mdl/ast/ast_imagecollection.go
@@ -5,13 +5,21 @@ package ast
 // ImageItem represents an image to add to a collection: IMAGE "name" FROM FILE 'path'.
 type ImageItem struct {
 	Name     string // Image name (e.g. "logo")
-	FilePath string // Path to image file on disk
+	FilePath string // Path to image file on disk; empty when Data is set
+	// Data is the image itself, from `Data: '<base64>'`: what describe writes,
+	// so its output does not depend on a file it wrote somewhere (ako/mxcli#707).
+	Data    []byte
+	HasData bool
+	// Format is the Mendix ImageFormat from `Format: <fmt>` (Png, Jpg, Gif,
+	// Svg, Bmp, Webp). Empty: taken from the file extension, or from the bytes.
+	Format string
 }
 
 // CreateImageCollectionStmt represents:
 //
 //	CREATE IMAGE COLLECTION Module.Name [EXPORT LEVEL 'Public'] [COMMENT '...'] [(IMAGE "name" FROM FILE 'path', ...)]
 type CreateImageCollectionStmt struct {
+	CreateGuard             // `create … if not exists` (ako/mxcli#731)
 	Folder           string // Folder path within module (empty = leave placement alone)
 	Name             QualifiedName
 	CreateOrModify   bool
diff --git a/mdl/ast/ast_import_export_mapping.go b/mdl/ast/ast_import_export_mapping.go
index 0f964b1d75..ef25a666ca 100644
--- a/mdl/ast/ast_import_export_mapping.go
+++ b/mdl/ast/ast_import_export_mapping.go
@@ -17,10 +17,11 @@ package ast
 //	  }
 //	};
 type CreateImportMappingStmt struct {
-	Name       QualifiedName
-	Folder     string        // Folder path within module (empty = leave placement alone)
-	SchemaKind string        // "JSON_STRUCTURE" or "XML_SCHEMA" or ""
-	SchemaRef  QualifiedName // qualified name of the schema source
+	CreateGuard // `create … if not exists` (ako/mxcli#731)
+	Name        QualifiedName
+	Folder      string        // Folder path within module (empty = leave placement alone)
+	SchemaKind  string        // "JSON_STRUCTURE" or "XML_SCHEMA" or ""
+	SchemaRef   QualifiedName // qualified name of the schema source
 	// SchemaRoot selects the element the mapping STARTS at, when that is not the
 	// structure's own root (#267). Written in member names, "/"-separated.
 	SchemaRoot string
@@ -100,10 +101,11 @@ type ImportMappingElementDef struct {
 //	  }
 //	};
 type CreateExportMappingStmt struct {
-	Name       QualifiedName
-	Folder     string        // Folder path within module (empty = leave placement alone)
-	SchemaKind string        // "JSON_STRUCTURE" or "XML_SCHEMA" or ""
-	SchemaRef  QualifiedName // qualified name of the schema source
+	CreateGuard // `create … if not exists` (ako/mxcli#731)
+	Name        QualifiedName
+	Folder      string        // Folder path within module (empty = leave placement alone)
+	SchemaKind  string        // "JSON_STRUCTURE" or "XML_SCHEMA" or ""
+	SchemaRef   QualifiedName // qualified name of the schema source
 	// SchemaRoot — see the note on CreateImportMappingStmt (#267).
 	SchemaRoot      string
 	NullValueOption string // "LeaveOutElement" or "SendAsNil" (default: "LeaveOutElement")
diff --git a/mdl/ast/ast_javaaction.go b/mdl/ast/ast_javaaction.go
index 7c4f5191d2..9560510e97 100644
--- a/mdl/ast/ast_javaaction.go
+++ b/mdl/ast/ast_javaaction.go
@@ -22,6 +22,7 @@ type JavaActionParam struct {
 //	EXPOSED AS 'caption' IN 'category'
 //	AS $$ ... $$;
 type CreateJavaActionStmt struct {
+	CreateGuard                        // `create … if not exists` (ako/mxcli#731)
 	Folder           string            // Folder path within module (empty = leave placement alone)
 	Name             QualifiedName     // Qualified name (Module.ActionName)
 	Parameters       []JavaActionParam // Input parameters
@@ -64,6 +65,7 @@ func (s *DropJavaActionStmt) isStatement() {}
 // It mirrors CreateJavaActionStmt with an added Platform (Web/Native/Hybrid/All,
 // default Web). The inline source is JavaScript rather than Java.
 type CreateJavaScriptActionStmt struct {
+	CreateGuard                        // `create … if not exists` (ako/mxcli#731)
 	Folder           string            // Folder path within module (empty = leave placement alone)
 	Name             QualifiedName     // Qualified name (Module.ActionName)
 	Parameters       []JavaActionParam // Input parameters
diff --git a/mdl/ast/ast_jsonstructure.go b/mdl/ast/ast_jsonstructure.go
index 617366ce0d..981fbc06db 100644
--- a/mdl/ast/ast_jsonstructure.go
+++ b/mdl/ast/ast_jsonstructure.go
@@ -6,6 +6,7 @@ package ast
 //
 //	CREATE [OR REPLACE] JSON STRUCTURE Module.Name [COMMENT 'doc'] SNIPPET '...json...' [CUSTOM NAME MAP (...)];
 type CreateJsonStructureStmt struct {
+	CreateGuard      // `create … if not exists` (ako/mxcli#731)
 	Name             QualifiedName
 	JsonSnippet      string            // Raw JSON snippet
 	Documentation    string            // Optional documentation comment
diff --git a/mdl/ast/ast_messagedefinition.go b/mdl/ast/ast_messagedefinition.go
index 7daa36ab13..af06569e4b 100644
--- a/mdl/ast/ast_messagedefinition.go
+++ b/mdl/ast/ast_messagedefinition.go
@@ -16,6 +16,7 @@ package ast
 //	  [FOLDER 'path']
 //	( definition Name for Module.Entity [as 'Exposed'] ( members ) , ... );
 type CreateMessageDefinitionCollectionStmt struct {
+	CreateGuard    // `create … if not exists` (ako/mxcli#731)
 	Name           QualifiedName
 	Folder         string
 	CreateOrModify bool
diff --git a/mdl/ast/ast_microflow.go b/mdl/ast/ast_microflow.go
index 0f1207460a..b878a6e254 100644
--- a/mdl/ast/ast_microflow.go
+++ b/mdl/ast/ast_microflow.go
@@ -52,6 +52,7 @@ type MicroflowReturnType struct {
 
 // CreateMicroflowStmt represents: CREATE MICROFLOW Module.Name (params) RETURNS type BEGIN body END
 type CreateMicroflowStmt struct {
+	CreateGuard   // `create … if not exists` (ako/mxcli#731)
 	Name          QualifiedName
 	Parameters    []MicroflowParam
 	ReturnType    *MicroflowReturnType
@@ -153,6 +154,7 @@ func (s *DropMicroflowStmt) isStatement() {}
 
 // CreateNanoflowStmt represents: CREATE NANOFLOW Module.Name (params) RETURNS type BEGIN body END
 type CreateNanoflowStmt struct {
+	CreateGuard      // `create … if not exists` (ako/mxcli#731)
 	Name             QualifiedName
 	Parameters       []MicroflowParam
 	ReturnType       *MicroflowReturnType
@@ -181,6 +183,7 @@ func (s *CreateNanoflowStmt) isStatement() {}
 // are the same minus the ones a rule document has no property for (a rule stores
 // no AllowedModuleRoles, so there is nothing to grant).
 type CreateRuleStmt struct {
+	CreateGuard      // `create … if not exists` (ako/mxcli#731)
 	Name             QualifiedName
 	Parameters       []MicroflowParam
 	ReturnType       *MicroflowReturnType
diff --git a/mdl/ast/ast_navigation.go b/mdl/ast/ast_navigation.go
index 53791655c6..30a23b0f9c 100644
--- a/mdl/ast/ast_navigation.go
+++ b/mdl/ast/ast_navigation.go
@@ -73,6 +73,7 @@ type NavMenuItemDef struct {
 // Like CREATE NAVIGATION, this is a full replacement: the item list given is the
 // document's complete contents, so an omitted item is a removed item.
 type CreateMenuStmt struct {
+	CreateGuard             // `create … if not exists` (ako/mxcli#731)
 	Folder           string // Folder path within module (empty = leave placement alone)
 	Name             QualifiedName
 	Items            []NavMenuItemDef
diff --git a/mdl/ast/ast_odata.go b/mdl/ast/ast_odata.go
index 2e19e4cad2..1707ed4ec6 100644
--- a/mdl/ast/ast_odata.go
+++ b/mdl/ast/ast_odata.go
@@ -8,6 +8,7 @@ package ast
 
 // CreateODataClientStmt represents: CREATE ODATA CLIENT Module.Name (...)
 type CreateODataClientStmt struct {
+	CreateGuard       // `create … if not exists` (ako/mxcli#731)
 	Name              QualifiedName
 	Version           string
 	ODataVersion      string
@@ -86,6 +87,7 @@ func (s *DropODataClientStmt) isStatement() {}
 
 // CreateODataServiceStmt represents: CREATE ODATA SERVICE Module.Name (...) AUTHENTICATION ... { ... }
 type CreateODataServiceStmt struct {
+	CreateGuard      // `create … if not exists` (ako/mxcli#731)
 	Name             QualifiedName
 	Path             string
 	Version          string
@@ -210,6 +212,7 @@ func (s *DropODataServiceStmt) isStatement() {}
 // from "explicitly set to zero" (e.g. Countable: false). Treating omitted
 // fields as zero on modify silently corrupted entities — see issue #594.
 type CreateExternalEntityStmt struct {
+	CreateGuard              // `create … if not exists` (ako/mxcli#731)
 	Name                     QualifiedName
 	ServiceRef               QualifiedName // FROM ODATA CLIENT ...
 	EntitySet                *string
diff --git a/mdl/ast/ast_page_v3.go b/mdl/ast/ast_page_v3.go
index 1fe8f539bd..e90ac68ab2 100644
--- a/mdl/ast/ast_page_v3.go
+++ b/mdl/ast/ast_page_v3.go
@@ -25,13 +25,14 @@ import (
 // CreatePageStmtV3 represents a V3 page creation statement.
 // V3 syntax: CREATE PAGE Module.Page (Title: '...', Layout: ...) { widgets }
 type CreatePageStmtV3 struct {
-	Name       QualifiedName
-	Parameters []PageParameter // From Params: { } block
-	Variables  []PageVariable  // From Variables: { } block
-	Title      string
-	Layout     string
-	URL        string
-	Folder     string
+	CreateGuard // `create … if not exists` (ako/mxcli#731)
+	Name        QualifiedName
+	Parameters  []PageParameter // From the Params: ( ) map
+	Variables   []PageVariable  // From Variables: { } block
+	Title       string
+	Layout      string
+	URL         string
+	Folder      string
 	// Class / Style set the page's Forms$Appearance CSS class and inline style
 	// (issue #714). Empty means "not specified".
 	Class   string
@@ -71,8 +72,9 @@ type PagePlaceholderV3 struct {
 
 // CreateSnippetStmtV3 represents a V3 snippet creation statement.
 type CreateSnippetStmtV3 struct {
+	CreateGuard      // `create … if not exists` (ako/mxcli#731)
 	Name             QualifiedName
-	Parameters       []PageParameter // From Params: { } block
+	Parameters       []PageParameter // From the Params: ( ) map
 	Variables        []PageVariable  // From Variables: { } block
 	Folder           string
 	Widgets          []*WidgetV3
@@ -90,6 +92,7 @@ func (s *CreateSnippetStmtV3) isStatement() {}
 // on the content wrapper rather than on the layout element — and which
 // placeholder a page's content goes into.
 type CreateLayoutStmt struct {
+	CreateGuard      // `create … if not exists` (ako/mxcli#731)
 	Name             QualifiedName
 	Properties       map[string]any
 	Widgets          []*WidgetV3
diff --git a/mdl/ast/ast_queue.go b/mdl/ast/ast_queue.go
index a4f4ee199f..313d020d50 100644
--- a/mdl/ast/ast_queue.go
+++ b/mdl/ast/ast_queue.go
@@ -6,6 +6,7 @@ package ast
 //
 //	CREATE [OR REPLACE|MODIFY] QUEUE Module.Name ( Parallelism: 3, ClusterWide: true );
 type CreateQueueStmt struct {
+	CreateGuard             // `create … if not exists` (ako/mxcli#731)
 	Folder           string // Folder path within module (empty = leave placement alone)
 	Name             QualifiedName
 	Documentation    string
diff --git a/mdl/ast/ast_regularexpression.go b/mdl/ast/ast_regularexpression.go
index eb01475d7b..272fe957be 100644
--- a/mdl/ast/ast_regularexpression.go
+++ b/mdl/ast/ast_regularexpression.go
@@ -8,6 +8,7 @@ package ast
 //	  Expression: '^[a-z]+$'
 //	);
 type CreateRegularExpressionStmt struct {
+	CreateGuard             // `create … if not exists` (ako/mxcli#731)
 	Folder           string // Folder path within module (empty = leave placement alone)
 	Name             QualifiedName
 	Documentation    string
diff --git a/mdl/ast/ast_rest.go b/mdl/ast/ast_rest.go
index 5b9d930df8..225d8e6b43 100644
--- a/mdl/ast/ast_rest.go
+++ b/mdl/ast/ast_rest.go
@@ -8,6 +8,7 @@ package ast
 
 // CreateRestClientStmt represents: CREATE REST CLIENT Module.Name BASE URL '...' AUTHENTICATION ... BEGIN ... END
 type CreateRestClientStmt struct {
+	CreateGuard      // `create … if not exists` (ako/mxcli#731)
 	Name             QualifiedName
 	BaseUrl          string
 	Authentication   *RestAuthDef // nil = AUTHENTICATION NONE
@@ -73,11 +74,13 @@ type RestParamDef struct {
 }
 
 // RestHeaderDef represents an HTTP header definition.
+//
+// Value is the stored value template: `{Name}` in it is replaced by the
+// operation parameter Name when the request is sent, as in the path. The old
+// spelling `'Bearer ' + $Token` builds the value `Bearer {Token}` (ako/mxcli#707).
 type RestHeaderDef struct {
-	Name     string // header name, e.g. "Accept"
-	Value    string // static value, e.g. "application/json" (may be empty if Variable is set)
-	Variable string // dynamic variable, e.g. "$Token" (may be empty if Value is set)
-	Prefix   string // concatenation prefix, e.g. "Bearer " (used with Variable)
+	Name  string // header name, e.g. "Authorization"
+	Value string // value template, e.g. "application/json" or "Bearer {Token}"
 }
 
 // DropRestClientStmt represents: DROP REST CLIENT Module.Name
@@ -104,6 +107,7 @@ func (s *DescribeContractFromOpenAPIStmt) isStatement() {}
 //
 //	CREATE PUBLISHED REST SERVICE Module.Name (Path: '...', Version: '...') { RESOURCE ... };
 type CreatePublishedRestServiceStmt struct {
+	CreateGuard    // `create … if not exists` (ako/mxcli#731)
 	Name           QualifiedName
 	Path           string
 	Version        string
diff --git a/mdl/ast/ast_scheduledevent.go b/mdl/ast/ast_scheduledevent.go
index 296d27e61c..6dbf425582 100644
--- a/mdl/ast/ast_scheduledevent.go
+++ b/mdl/ast/ast_scheduledevent.go
@@ -13,6 +13,7 @@ package ast
 // "not mentioned" stays distinguishable from "mentioned as 0" — 0 is a real
 // hour, minute and month offset.
 type CreateScheduledEventStmt struct {
+	CreateGuard             // `create … if not exists` (ako/mxcli#731)
 	Folder           string // Folder path within module (empty = leave placement alone)
 	Name             QualifiedName
 	Documentation    string
diff --git a/mdl/ast/ast_security.go b/mdl/ast/ast_security.go
index 4f152b76af..4307570cc2 100644
--- a/mdl/ast/ast_security.go
+++ b/mdl/ast/ast_security.go
@@ -8,6 +8,7 @@ package ast
 
 // CreateModuleRoleStmt represents: CREATE MODULE ROLE Module.RoleName [DESCRIPTION '...']
 type CreateModuleRoleStmt struct {
+	CreateGuard // `create … if not exists` (ako/mxcli#731)
 	Name        QualifiedName
 	Description string
 	// CreateOrModify makes the statement idempotent: an existing role has its
@@ -27,12 +28,30 @@ type DropModuleRoleStmt struct {
 
 func (s *DropModuleRoleStmt) isStatement() {}
 
-// CreateUserRoleStmt represents: CREATE [OR MODIFY] USER ROLE Name (ModuleRole, ...) [MANAGE ALL ROLES]
+// CreateUserRoleStmt represents
+// CREATE [OR MODIFY] USER ROLE Name [( ModuleRoles: (…), Description: '…', … )],
+// and the old positional form CREATE USER ROLE Name (ModuleRole, …) [MANAGE ALL ROLES].
+//
+// The pointer properties are nil when the statement does not state them: a new
+// role then gets Mendix's default, and `create or modify` leaves the stored
+// value alone (ako/mxcli#707).
 type CreateUserRoleStmt struct {
+	CreateGuard    // `create … if not exists` (ako/mxcli#731)
 	Name           string
 	ModuleRoles    []QualifiedName
 	ManageAllRoles bool
 	CreateOrModify bool // If true, adds module roles to existing role instead of failing
+
+	Description             *string
+	CheckSecurity           *bool
+	ManageUsersWithoutRoles *bool
+	// ManageableRoles names the user roles this role may manage; nil when the
+	// statement does not say. Only meaningful when ManageAllRoles is false.
+	ManageableRoles []string
+	ManageableSet   bool
+	// ManageAllRolesSet is true when the statement states ManageAllRoles, so
+	// `create or modify` can set it to false as well as to true.
+	ManageAllRolesSet bool
 }
 
 func (s *CreateUserRoleStmt) isStatement() {}
@@ -213,6 +232,7 @@ func (s *AlterProjectSecurityStmt) isStatement() {}
 
 // CreateDemoUserStmt represents: CREATE [OR MODIFY] DEMO USER 'name' PASSWORD 'pw' [ENTITY Module.Entity] (Role1, Role2)
 type CreateDemoUserStmt struct {
+	CreateGuard    // `create … if not exists` (ako/mxcli#731)
 	UserName       string
 	Password       string
 	Entity         string // qualified name of user entity, e.g. "Administration.Account"
diff --git a/mdl/ast/ast_settings.go b/mdl/ast/ast_settings.go
index 5333e1b555..21f86e37f3 100644
--- a/mdl/ast/ast_settings.go
+++ b/mdl/ast/ast_settings.go
@@ -41,8 +41,9 @@ func (s *AlterSettingsStmt) isStatement() {}
 
 // CreateConfigurationStmt represents CREATE CONFIGURATION 'name' [properties...].
 type CreateConfigurationStmt struct {
-	Name       string
-	Properties map[string]any
+	CreateGuard // `create … if not exists` (ako/mxcli#731)
+	Name        string
+	Properties  map[string]any
 	// CreateOrModify is CREATE OR MODIFY: update the configuration when it is
 	// already there instead of refusing. The grammar has always accepted the
 	// prefix — `CREATE (OR (MODIFY|REPLACE))?` is generic — so without this the
diff --git a/mdl/ast/ast_sql.go b/mdl/ast/ast_sql.go
index 3578737706..c631f7bc2a 100644
--- a/mdl/ast/ast_sql.go
+++ b/mdl/ast/ast_sql.go
@@ -104,6 +104,7 @@ type DatabaseQueryParamDef struct {
 
 // CreateDatabaseConnectionStmt represents: CREATE DATABASE CONNECTION Module.Name ...
 type CreateDatabaseConnectionStmt struct {
+	CreateGuard                  // `create … if not exists` (ako/mxcli#731)
 	Folder                string // Folder path within module (empty = leave placement alone)
 	Name                  QualifiedName
 	DatabaseType          string // "PostgreSQL", "MSSQL", "Oracle"
diff --git a/mdl/ast/ast_workflow.go b/mdl/ast/ast_workflow.go
index 5bc82a9528..a5bb5d5b28 100644
--- a/mdl/ast/ast_workflow.go
+++ b/mdl/ast/ast_workflow.go
@@ -4,6 +4,7 @@ package ast
 
 // CreateWorkflowStmt represents: CREATE WORKFLOW Module.Name ...
 type CreateWorkflowStmt struct {
+	CreateGuard             // `create … if not exists` (ako/mxcli#731)
 	Folder           string // Folder path within module (empty = leave placement alone)
 	Name             QualifiedName
 	CreateOrModify   bool
@@ -26,6 +27,10 @@ type CreateWorkflowStmt struct {
 	// Workflow event handlers, in statement order.
 	EventHandlers []WorkflowEventHandlerNode
 
+	// Annotation is the note attached to the workflow's start, from the header
+	// clause `annotation '…'` (ako/mxcli#707).
+	Annotation string
+
 	// Activities
 	Activities []WorkflowActivityNode
 
@@ -36,6 +41,7 @@ type CreateWorkflowStmt struct {
 // WorkflowEventSubProcessNode is `event subprocess <name> ['<caption>'] on
 // [non] interrupting notification|timer … { … };`.
 type WorkflowEventSubProcessNode struct {
+	WorkflowActivityAnnotation
 	Name         string
 	Caption      string
 	Interrupting bool
@@ -71,8 +77,27 @@ type WorkflowActivityNode interface {
 	workflowActivityNode()
 }
 
+// WorkflowActivityAnnotation is the note attached to an activity, written
+// `@annotation '…'` before it (ako/mxcli#707). Every activity node embeds it.
+type WorkflowActivityAnnotation struct {
+	Annotation string
+}
+
+// ActivityAnnotation returns the attached note, "" when there is none.
+func (a *WorkflowActivityAnnotation) ActivityAnnotation() string { return a.Annotation }
+
+// SetActivityAnnotation sets the attached note.
+func (a *WorkflowActivityAnnotation) SetActivityAnnotation(s string) { a.Annotation = s }
+
+// AnnotatedWorkflowActivity is an activity node that carries an attached note.
+type AnnotatedWorkflowActivity interface {
+	ActivityAnnotation() string
+	SetActivityAnnotation(string)
+}
+
 // WorkflowUserTaskNode represents a USER TASK activity.
 type WorkflowUserTaskNode struct {
+	WorkflowActivityAnnotation
 	Name            string // identifier name
 	Caption         string // display caption
 	Page            QualifiedName
@@ -127,6 +152,7 @@ type WorkflowUserTaskOutcomeNode struct {
 
 // WorkflowCallMicroflowNode represents a CALL MICROFLOW activity.
 type WorkflowCallMicroflowNode struct {
+	WorkflowActivityAnnotation
 	Name              string // explicit activity name (`as <name>`); see ako/mxcli#408
 	Agent             bool   // `call agent microflow`: an AI agent task (Workflows$AIAgentTaskActivity)
 	Microflow         QualifiedName
@@ -140,6 +166,7 @@ func (n *WorkflowCallMicroflowNode) workflowActivityNode() {}
 
 // WorkflowCallWorkflowNode represents a CALL WORKFLOW activity.
 type WorkflowCallWorkflowNode struct {
+	WorkflowActivityAnnotation
 	Name              string // explicit activity name (`as <name>`); see ako/mxcli#408
 	Workflow          QualifiedName
 	Caption           string
@@ -150,6 +177,7 @@ func (n *WorkflowCallWorkflowNode) workflowActivityNode() {}
 
 // WorkflowDecisionNode represents a DECISION activity.
 type WorkflowDecisionNode struct {
+	WorkflowActivityAnnotation
 	Name       string // explicit activity name; see ako/mxcli#408
 	Expression string // decision expression
 	Caption    string
@@ -166,6 +194,7 @@ type WorkflowConditionOutcomeNode struct {
 
 // WorkflowParallelSplitNode represents a PARALLEL SPLIT activity.
 type WorkflowParallelSplitNode struct {
+	WorkflowActivityAnnotation
 	Name    string // explicit activity name; see ako/mxcli#408
 	Caption string
 	Paths   []WorkflowParallelPathNode
@@ -181,6 +210,7 @@ type WorkflowParallelPathNode struct {
 
 // WorkflowJumpToNode represents a JUMP TO activity.
 type WorkflowJumpToNode struct {
+	WorkflowActivityAnnotation
 	Target  string // name of target activity
 	Caption string
 }
@@ -189,6 +219,7 @@ func (n *WorkflowJumpToNode) workflowActivityNode() {}
 
 // WorkflowWaitForTimerNode represents a WAIT FOR TIMER activity.
 type WorkflowWaitForTimerNode struct {
+	WorkflowActivityAnnotation
 	Name            string // explicit activity name; see ako/mxcli#408
 	DelayExpression string
 	Caption         string
@@ -198,6 +229,7 @@ func (n *WorkflowWaitForTimerNode) workflowActivityNode() {}
 
 // WorkflowWaitForNotificationNode represents a WAIT FOR NOTIFICATION activity.
 type WorkflowWaitForNotificationNode struct {
+	WorkflowActivityAnnotation
 	Name           string // explicit activity name; see ako/mxcli#408
 	Caption        string
 	BoundaryEvents []WorkflowBoundaryEventNode // Issue #7
@@ -208,6 +240,7 @@ func (n *WorkflowWaitForNotificationNode) workflowActivityNode() {}
 // WorkflowNotificationNode is `notification [<name>] [comment '<caption>']`, an
 // intermediate notification event.
 type WorkflowNotificationNode struct {
+	WorkflowActivityAnnotation
 	Name    string
 	Caption string
 }
@@ -292,15 +325,27 @@ type SetActivityPropertyOp struct {
 
 func (o *SetActivityPropertyOp) alterWorkflowOp() {}
 
-// InsertAfterOp inserts an activity after a named activity (linear position).
+// InsertAfterOp inserts activities after a named activity (linear position).
+// The old `insert after X <activity>` form carries exactly one; the generic
+// `insert after X { … }` any number.
 type InsertAfterOp struct {
-	ActivityRef string
-	AtPosition  int
-	NewActivity WorkflowActivityNode
+	ActivityRef   string
+	AtPosition    int
+	NewActivities []WorkflowActivityNode
 }
 
 func (o *InsertAfterOp) alterWorkflowOp() {}
 
+// InsertBeforeOp inserts activities before a named activity: the generic
+// ALTER's `insert before X { … }`, which the old form had no spelling for.
+type InsertBeforeOp struct {
+	ActivityRef   string
+	AtPosition    int
+	NewActivities []WorkflowActivityNode
+}
+
+func (o *InsertBeforeOp) alterWorkflowOp() {}
+
 // DropActivityOp removes a linear activity from the flow graph.
 type DropActivityOp struct {
 	ActivityRef string
@@ -311,9 +356,9 @@ func (o *DropActivityOp) alterWorkflowOp() {}
 
 // ReplaceActivityOp swaps an activity in place, preserving edges.
 type ReplaceActivityOp struct {
-	ActivityRef string
-	AtPosition  int
-	NewActivity WorkflowActivityNode
+	ActivityRef   string
+	AtPosition    int
+	NewActivities []WorkflowActivityNode
 }
 
 func (o *ReplaceActivityOp) alterWorkflowOp() {}
@@ -337,10 +382,13 @@ type DropOutcomeOp struct {
 
 func (o *DropOutcomeOp) alterWorkflowOp() {}
 
-// InsertPathOp adds a new path to a ParallelSplit.
+// InsertPathOp adds a new path to a ParallelSplit. PathNumber is the `path n`
+// the generic form may write, which must be the split's next path; 0 when it
+// is left out (and always for the old `insert path on X`).
 type InsertPathOp struct {
 	ActivityRef string
 	AtPosition  int
+	PathNumber  int
 	Activities  []WorkflowActivityNode
 }
 
diff --git a/mdl/backend/alter_target.go b/mdl/backend/alter_target.go
index f4c9186958..3ca6df9420 100644
--- a/mdl/backend/alter_target.go
+++ b/mdl/backend/alter_target.go
@@ -146,3 +146,109 @@ func CheckPageAlterTarget(t AlterTarget) error {
 	}
 	return nil
 }
+
+// WorkflowActivityCandidate is one workflow activity a target was compared
+// with: its name, its caption and its storage $Type.
+type WorkflowActivityCandidate struct {
+	Name        string
+	Caption     string
+	StorageType string
+}
+
+// ResolveWorkflowActivityTarget is the workflow's address rule, shared by
+// every backend's workflow mutator so an activity address means the same thing
+// on each. candidates are the activities whose name or caption equals the
+// target's text, in the depth-first order `describe workflow` prints them (an
+// activity, then its outcome flows, then its boundary-event flows).
+//
+// A name is an activity's identity and a caption a label that may repeat
+// another activity's name (a jump's caption defaults to its target's name), so
+// without @n the activities NAMED so win over those merely captioned so. With
+// @n every match counts, so an existing `ACT_Process@2` keeps addressing what
+// it always did.
+func ResolveWorkflowActivityTarget(t AlterTarget, candidates []WorkflowActivityCandidate) (AlterTargetMatch, error) {
+	if err := CheckWorkflowAlterTarget(t); err != nil {
+		return AlterTargetMatch{}, err
+	}
+	ref := WorkflowTargetText(t)
+	pool := candidates
+	if t.Ordinal == 0 {
+		var named []WorkflowActivityCandidate
+		for _, c := range candidates {
+			if c.Name == ref {
+				named = append(named, c)
+			}
+		}
+		if len(named) > 0 {
+			pool = named
+		}
+	}
+	matches := make([]AlterTargetMatch, 0, len(pool))
+	for _, c := range pool {
+		name := c.Name
+		if name == "" {
+			name = "'" + strings.ReplaceAll(c.Caption, "'", "''") + "'"
+		}
+		matches = append(matches, AlterTargetMatch{Kind: WorkflowActivityKind(c.StorageType), Name: name})
+	}
+	return PickAlterTargetMatch(t, matches)
+}
+
+// WorkflowTargetText is the text a workflow target compares with an
+// activity's name and caption.
+func WorkflowTargetText(t AlterTarget) string {
+	if t.Caption != "" {
+		return t.Caption
+	}
+	if len(t.Path) > 0 {
+		return t.Path[0]
+	}
+	return ""
+}
+
+// CheckWorkflowAlterTarget refuses the address forms a workflow activity has
+// no use for: a dotted member path.
+func CheckWorkflowAlterTarget(t AlterTarget) error {
+	if t.Caption == "" && len(t.Path) != 1 {
+		return &AlterTargetError{Target: t, Detail: fmt.Sprintf(
+			"alter target %s: a workflow activity is addressed by its name (`ReviewOrder`) or its "+
+				"caption (`'Review the order'`), with @n to choose one of several matches", t)}
+	}
+	return nil
+}
+
+// WorkflowActivityKind names a workflow activity's storage $Type the way an
+// author would, for the matches an ambiguous target lists.
+func WorkflowActivityKind(storageType string) string {
+	switch storageType {
+	case "Workflows$SingleUserTaskActivity", "Workflows$UserTaskActivity":
+		return "user task"
+	case "Workflows$MultiUserTaskActivity":
+		return "multi user task"
+	case "Workflows$ExclusiveSplitActivity":
+		return "decision"
+	case "Workflows$ParallelSplitActivity":
+		return "parallel split"
+	case "Workflows$CallMicroflowTask", "Workflows$CallMicroflowActivity":
+		return "call microflow"
+	case "Workflows$AIAgentTaskActivity":
+		return "call agent microflow"
+	case "Workflows$CallWorkflowActivity":
+		return "call workflow"
+	case "Workflows$JumpToActivity":
+		return "jump"
+	case "Workflows$WaitForTimerActivity":
+		return "wait for timer"
+	case "Workflows$WaitForNotificationActivity":
+		return "wait for notification"
+	case "Workflows$NotificationActivity":
+		return "notification"
+	case "Workflows$EndWorkflowActivity":
+		return "end workflow"
+	case "Workflows$StartWorkflowActivity":
+		return "start"
+	case "Workflows$Annotation":
+		return "annotation"
+	}
+	return "activity"
+}
diff --git a/mdl/backend/mcp/unsupported_gen.go b/mdl/backend/mcp/unsupported_gen.go
index abae5e3a3a..d5eeea9f70 100644
--- a/mdl/backend/mcp/unsupported_gen.go
+++ b/mdl/backend/mcp/unsupported_gen.go
@@ -1142,6 +1142,11 @@ func (unsupportedBackend) SetProjectStrictMode(_ model.ID, _ bool) (err0 error)
 	return
 }
 
+func (unsupportedBackend) SetUserRoleProperties(_ model.ID, _ string, _ backend.UserRoleProperties) (err0 error) {
+	err0 = errUnsupported("SetUserRoleProperties")
+	return
+}
+
 func (unsupportedBackend) UpdateAgentEditorAgent(_ *agenteditor.Agent) (err0 error) {
 	err0 = errUnsupported("UpdateAgentEditorAgent")
 	return
diff --git a/mdl/backend/mcp/workflow.go b/mdl/backend/mcp/workflow.go
index 07f042584d..c7055669cc 100644
--- a/mdl/backend/mcp/workflow.go
+++ b/mdl/backend/mcp/workflow.go
@@ -1522,6 +1522,8 @@ type activityRefMatch struct {
 	arrayPath string
 	index     int
 	name      string // the activity's own name (activityRef may be its caption)
+	caption   string
+	sType     string // the activity's storage $Type
 	inSplit   bool   // under a parallel split at any depth
 }
 
@@ -1608,7 +1610,8 @@ func (m *mcpWorkflowMutator) searchActivities(arrayPath, ref string, inSplit boo
 			taken[name] = true
 		}
 		if name == ref || mapString(a, "caption") == ref {
-			*matches = append(*matches, activityRefMatch{arrayPath: arrayPath, index: i, name: name, inSplit: inSplit})
+			*matches = append(*matches, activityRefMatch{arrayPath: arrayPath, index: i, name: name,
+				caption: mapString(a, "caption"), sType: mapString(a, "$Type"), inSplit: inSplit})
 		}
 		actPath := fmt.Sprintf("%s/%d", arrayPath, i)
 		sType := mapString(a, "$Type")
@@ -1773,6 +1776,45 @@ func (m *mcpWorkflowMutator) InsertAfterActivity(activityRef string, atPos int,
 	return m.apply(ops...)
 }
 
+// InsertBeforeActivity inserts activities just before the referenced one. A
+// batch counts every add's index against the list before the batch, so each
+// goes in at the anchor's index and they keep their order (see
+// InsertAfterActivity).
+func (m *mcpWorkflowMutator) InsertBeforeActivity(activityRef string, atPos int, activities []workflows.WorkflowActivity) error {
+	loc, err := m.resolve(activityRef, atPos)
+	if err != nil {
+		return err
+	}
+	wfnames.Dedup(activities, loc.taken)
+	ops := make([]pedOpEntry, 0, len(activities))
+	for _, a := range activities {
+		mapped, err := mapWorkflowActivity(a)
+		if err != nil {
+			return err
+		}
+		ops = append(ops, addAtOp(loc.arrayPath, loc.index, mapped))
+	}
+	return m.apply(ops...)
+}
+
+// ResolveAlterTarget is the MCP workflow mutator's backend.AlterTargetResolver,
+// under the rule backend.ResolveWorkflowActivityTarget shares with the modelsdk
+// backend: the same walk resolve does, the same answer.
+func (m *mcpWorkflowMutator) ResolveAlterTarget(t backend.AlterTarget) (backend.AlterTargetMatch, error) {
+	if err := backend.CheckWorkflowAlterTarget(t); err != nil {
+		return backend.AlterTargetMatch{}, err
+	}
+	var matches []activityRefMatch
+	if err := m.searchActivities("/flow/activities", backend.WorkflowTargetText(t), false, &matches, map[string]bool{}); err != nil {
+		return backend.AlterTargetMatch{}, err
+	}
+	candidates := make([]backend.WorkflowActivityCandidate, 0, len(matches))
+	for _, mt := range matches {
+		candidates = append(candidates, backend.WorkflowActivityCandidate{Name: mt.name, Caption: mt.caption, StorageType: mt.sType})
+	}
+	return backend.ResolveWorkflowActivityTarget(t, candidates)
+}
+
 func (m *mcpWorkflowMutator) DropActivity(activityRef string, atPos int) error {
 	loc, err := m.resolve(activityRef, atPos)
 	if err != nil {
diff --git a/mdl/backend/mcp/workflow_alter_target_test.go b/mdl/backend/mcp/workflow_alter_target_test.go
new file mode 100644
index 0000000000..c3c90090f8
--- /dev/null
+++ b/mdl/backend/mcp/workflow_alter_target_test.go
@@ -0,0 +1,51 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package mcp
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/backend"
+	"github.com/mendixlabs/mxcli/sdk/workflows"
+)
+
+// `insert before X { a; b; }` over MCP stores the activities together, in
+// order, right before X: every add at X's index, which a batch counts against
+// the list as it was (the rule InsertAfterActivity was measured against).
+func TestWFInsertBeforeActivity_KeepsOrder(t *testing.T) {
+	sim, m := listMutator(t, named("Start", "R", "P", "End"))
+	if err := m.InsertBeforeActivity("P", 0, []workflows.WorkflowActivity{waitWith("I1"), waitWith("I2")}); err != nil {
+		t.Fatal(err)
+	}
+	if got, want := sim.field("/flow/activities", "name"), []any{"Start", "R", "I1", "I2", "P", "End"}; !reflect.DeepEqual(got, want) {
+		t.Errorf("stored %v, want %v", got, want)
+	}
+}
+
+// The MCP resolver answers as the modelsdk one does (the shared
+// backend.ResolveWorkflowActivityTarget): a name, @n, an ambiguity that lists
+// its matches.
+func TestWFResolveAlterTarget(t *testing.T) {
+	flow := named("Start", "R", "P", "End")
+	flow[1]["caption"] = "Same"
+	flow[2]["caption"] = "Same"
+	_, m := listMutator(t, flow)
+
+	got, err := m.ResolveAlterTarget(backend.AlterTarget{Path: []string{"P"}})
+	if err != nil || got != (backend.AlterTargetMatch{Kind: "wait for notification", Name: "P"}) {
+		t.Errorf("P: got %+v, %v", got, err)
+	}
+	got, err = m.ResolveAlterTarget(backend.AlterTarget{Caption: "Same", Ordinal: 2})
+	if err != nil || got.Name != "P" {
+		t.Errorf("'Same'@2: got %+v, %v", got, err)
+	}
+	if _, err := m.ResolveAlterTarget(backend.AlterTarget{Caption: "Same"}); err == nil ||
+		!strings.Contains(err.Error(), "@1 wait for notification R, @2 wait for notification P") {
+		t.Errorf("'Same': err = %v, want the two matches listed", err)
+	}
+	if _, err := m.ResolveAlterTarget(backend.AlterTarget{Path: []string{"Nope"}}); err == nil {
+		t.Error("Nope resolved")
+	}
+}
diff --git a/mdl/backend/mock/backend.go b/mdl/backend/mock/backend.go
index cef40cf4a4..7f821c4833 100644
--- a/mdl/backend/mock/backend.go
+++ b/mdl/backend/mock/backend.go
@@ -155,6 +155,7 @@ type MockBackend struct {
 	SetProjectGuestAccessFunc            func(unitID model.ID, enabled bool, guestUserRole string) error
 	AddUserRoleFunc                      func(unitID model.ID, name string, moduleRoles []string, manageAllRoles bool) error
 	AlterUserRoleModuleRolesFunc         func(unitID model.ID, userRoleName string, add bool, moduleRoles []string) error
+	SetUserRolePropertiesFunc            func(unitID model.ID, userRoleName string, props backend.UserRoleProperties) error
 	RemoveUserRoleFunc                   func(unitID model.ID, name string) error
 	AddDemoUserFunc                      func(unitID model.ID, userName, password, entity string, userRoles []string) error
 	RemoveDemoUserFunc                   func(unitID model.ID, userName string) error
diff --git a/mdl/backend/mock/mock_security.go b/mdl/backend/mock/mock_security.go
index a7e6674709..9631af3454 100644
--- a/mdl/backend/mock/mock_security.go
+++ b/mdl/backend/mock/mock_security.go
@@ -53,6 +53,13 @@ func (m *MockBackend) AddUserRole(unitID model.ID, name string, moduleRoles []st
 	return nil
 }
 
+func (m *MockBackend) SetUserRoleProperties(unitID model.ID, userRoleName string, props backend.UserRoleProperties) error {
+	if m.SetUserRolePropertiesFunc != nil {
+		return m.SetUserRolePropertiesFunc(unitID, userRoleName, props)
+	}
+	return nil
+}
+
 func (m *MockBackend) AlterUserRoleModuleRoles(unitID model.ID, userRoleName string, add bool, moduleRoles []string) error {
 	if m.AlterUserRoleModuleRolesFunc != nil {
 		return m.AlterUserRoleModuleRolesFunc(unitID, userRoleName, add, moduleRoles)
diff --git a/mdl/backend/mock/mock_workflow_mutator.go b/mdl/backend/mock/mock_workflow_mutator.go
index b184953b99..12e29df58a 100644
--- a/mdl/backend/mock/mock_workflow_mutator.go
+++ b/mdl/backend/mock/mock_workflow_mutator.go
@@ -17,6 +17,8 @@ type MockWorkflowMutator struct {
 	SetPropertyWithEntityFunc func(prop string, value string, entity string) error
 	SetActivityPropertyFunc   func(activityRef string, atPos int, prop string, value string) error
 	InsertAfterActivityFunc   func(activityRef string, atPos int, activities []workflows.WorkflowActivity) error
+	InsertBeforeActivityFunc  func(activityRef string, atPos int, activities []workflows.WorkflowActivity) error
+	ResolveAlterTargetFunc    func(t backend.AlterTarget) (backend.AlterTargetMatch, error)
 	DropActivityFunc          func(activityRef string, atPos int) error
 	ReplaceActivityFunc       func(activityRef string, atPos int, activities []workflows.WorkflowActivity) error
 	InsertOutcomeFunc         func(activityRef string, atPos int, outcomeName string, activities []workflows.WorkflowActivity) error
@@ -58,6 +60,23 @@ func (m *MockWorkflowMutator) InsertAfterActivity(activityRef string, atPos int,
 	return nil
 }
 
+func (m *MockWorkflowMutator) InsertBeforeActivity(activityRef string, atPos int, activities []workflows.WorkflowActivity) error {
+	if m.InsertBeforeActivityFunc != nil {
+		return m.InsertBeforeActivityFunc(activityRef, atPos, activities)
+	}
+	return nil
+}
+
+// ResolveAlterTarget resolves every target unless ResolveAlterTargetFunc says
+// otherwise, so a test that does not care about resolution exercises the
+// operation behind it.
+func (m *MockWorkflowMutator) ResolveAlterTarget(t backend.AlterTarget) (backend.AlterTargetMatch, error) {
+	if m.ResolveAlterTargetFunc != nil {
+		return m.ResolveAlterTargetFunc(t)
+	}
+	return backend.AlterTargetMatch{Kind: "activity", Name: t.String()}, nil
+}
+
 func (m *MockWorkflowMutator) DropActivity(activityRef string, atPos int) error {
 	if m.DropActivityFunc != nil {
 		return m.DropActivityFunc(activityRef, atPos)
diff --git a/mdl/backend/modelsdk/security_write.go b/mdl/backend/modelsdk/security_write.go
index 102cee7c6a..38c29921ce 100644
--- a/mdl/backend/modelsdk/security_write.go
+++ b/mdl/backend/modelsdk/security_write.go
@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"strings"
 
+	"github.com/mendixlabs/mxcli/mdl/backend"
 	"github.com/mendixlabs/mxcli/model"
 	"github.com/mendixlabs/mxcli/modelsdk/codec"
 	"github.com/mendixlabs/mxcli/modelsdk/element"
@@ -268,6 +269,41 @@ func (b *Backend) AlterUserRoleModuleRoles(unitID model.ID, userRoleName string,
 	return fmt.Errorf("AlterUserRoleModuleRoles: user role not found: %s", userRoleName)
 }
 
+// SetUserRoleProperties sets the properties props states on a project user
+// role (by name); a nil property is left as stored.
+func (b *Backend) SetUserRoleProperties(unitID model.ID, userRoleName string, props backend.UserRoleProperties) error {
+	if b.writer == nil {
+		return fmt.Errorf("SetUserRoleProperties: not connected for writing")
+	}
+	ps, err := b.loadProjectSecurityGen(unitID)
+	if err != nil {
+		return err
+	}
+	for _, el := range ps.UserRolesItems() {
+		r, ok := el.(*genSec.UserRole)
+		if !ok || !strings.EqualFold(r.Name(), userRoleName) {
+			continue
+		}
+		if props.Description != nil {
+			r.SetDescription(*props.Description)
+		}
+		if props.ManageAllRoles != nil {
+			r.SetManageAllRoles(*props.ManageAllRoles)
+		}
+		if props.ManageUsersWithoutRoles != nil {
+			r.SetManageUsersWithoutRoles(*props.ManageUsersWithoutRoles)
+		}
+		if props.CheckSecurity != nil {
+			r.SetCheckSecurity(*props.CheckSecurity)
+		}
+		if props.ManageableRoles != nil {
+			r.SetManageableRolesQualifiedNames(props.ManageableRoles)
+		}
+		return b.persistUnit(unitID, ps)
+	}
+	return fmt.Errorf("SetUserRoleProperties: user role not found: %s", userRoleName)
+}
+
 // RemoveDemoUser removes a demo user by (case-insensitive) username.
 func (b *Backend) RemoveDemoUser(unitID model.ID, userName string) error {
 	ps, err := b.loadProjectSecurityGen(unitID)
diff --git a/mdl/backend/modelsdk/unimplemented_gen.go b/mdl/backend/modelsdk/unimplemented_gen.go
index b7b3f4f78a..eb2859df3b 100644
--- a/mdl/backend/modelsdk/unimplemented_gen.go
+++ b/mdl/backend/modelsdk/unimplemented_gen.go
@@ -1035,6 +1035,10 @@ func (unimplemented) SetProjectStrictMode(_ model.ID, _ bool) error {
 	return errUnimplemented("SetProjectStrictMode")
 }
 
+func (unimplemented) SetUserRoleProperties(_ model.ID, _ string, _ backend.UserRoleProperties) error {
+	return errUnimplemented("SetUserRoleProperties")
+}
+
 func (unimplemented) UpdateAgentEditorAgent(_ *agenteditor.Agent) error {
 	return errUnimplemented("UpdateAgentEditorAgent")
 }
diff --git a/mdl/backend/mutation.go b/mdl/backend/mutation.go
index 696af6c85b..72c77811d0 100644
--- a/mdl/backend/mutation.go
+++ b/mdl/backend/mutation.go
@@ -238,6 +238,14 @@ type PluggablePropertyContext struct {
 // workflow unit. Obtain one via WorkflowMutationBackend.OpenWorkflowForMutation.
 // All methods operate on the in-memory representation; call Save to persist.
 type WorkflowMutator interface {
+	// AlterTargetResolver resolves a generic ALTER target against this
+	// workflow's activities: the workflow's half of `alter workflow X { … }`
+	// (ADR-0012). An activity is addressed by its name or its caption, @n
+	// choosing one of several matches; a name wins over a caption that repeats
+	// it. The executor resolves every operation's target through it first, so
+	// a miss or an ambiguity refuses the statement before anything changes.
+	AlterTargetResolver
+
 	// --- Top-level property operations ---
 
 	// SetProperty sets a workflow-level property (DisplayName, Description,
@@ -257,6 +265,9 @@ type WorkflowMutator interface {
 	// InsertAfterActivity inserts new activities after the referenced activity.
 	InsertAfterActivity(activityRef string, atPos int, activities []workflows.WorkflowActivity) error
 
+	// InsertBeforeActivity inserts new activities before the referenced activity.
+	InsertBeforeActivity(activityRef string, atPos int, activities []workflows.WorkflowActivity) error
+
 	// DropActivity removes the referenced activity.
 	DropActivity(activityRef string, atPos int) error
 
diff --git a/mdl/backend/security.go b/mdl/backend/security.go
index 3de10febf9..2cdd00429d 100644
--- a/mdl/backend/security.go
+++ b/mdl/backend/security.go
@@ -37,11 +37,31 @@ type ProjectSecurityBackend interface {
 	SetProjectGuestAccess(unitID model.ID, enabled bool, guestUserRole string) error
 	AddUserRole(unitID model.ID, name string, moduleRoles []string, manageAllRoles bool) error
 	AlterUserRoleModuleRoles(unitID model.ID, userRoleName string, add bool, moduleRoles []string) error
+	// SetUserRoleProperties sets the properties props states on an existing
+	// user role and leaves the others as stored (ako/mxcli#707).
+	SetUserRoleProperties(unitID model.ID, userRoleName string, props UserRoleProperties) error
 	RemoveUserRole(unitID model.ID, name string) error
 	AddDemoUser(unitID model.ID, userName, password, entity string, userRoles []string) error
 	RemoveDemoUser(unitID model.ID, userName string) error
 }
 
+// UserRoleProperties are a user role's properties other than its name and
+// module roles. A nil field is left as stored.
+type UserRoleProperties struct {
+	Description             *string
+	ManageAllRoles          *bool
+	ManageUsersWithoutRoles *bool
+	CheckSecurity           *bool
+	// ManageableRoles is set when non-nil; an empty, non-nil slice clears it.
+	ManageableRoles []string
+}
+
+// IsZero reports whether p states no property.
+func (p UserRoleProperties) IsZero() bool {
+	return p.Description == nil && p.ManageAllRoles == nil && p.ManageUsersWithoutRoles == nil &&
+		p.CheckSecurity == nil && p.ManageableRoles == nil
+}
+
 // ModuleSecurityBackend manages module-level security.
 type ModuleSecurityBackend interface {
 	ListModuleSecurity() ([]*security.ModuleSecurity, error)
diff --git a/mdl/backend/wfmutator/alter_target_test.go b/mdl/backend/wfmutator/alter_target_test.go
new file mode 100644
index 0000000000..e1d027ff04
--- /dev/null
+++ b/mdl/backend/wfmutator/alter_target_test.go
@@ -0,0 +1,91 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package wfmutator
+
+import (
+	"errors"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/backend"
+	"github.com/mendixlabs/mxcli/mdl/backend/bsonnav"
+	"github.com/mendixlabs/mxcli/sdk/workflows"
+	"go.mongodb.org/mongo-driver/bson"
+)
+
+// The workflow's half of the generic ALTER (ADR-0012, ako/mxcli#712): an
+// activity is addressed by name or caption, @n picks one of several, a name
+// wins over a caption repeating it, and an ambiguity lists every match.
+func TestResolveAlterTarget_Workflow(t *testing.T) {
+	doc := makeWorkflowDoc(
+		makeWfActivity("Workflows$SingleUserTaskActivity", "Review", "task1"),
+		makeWfActivity("Workflows$ExclusiveSplitActivity", "Review", "decision1"),
+		makeWfActivity("Workflows$SingleUserTaskActivity", "Split the jump", "bugSplitJump"),
+		makeWfActivity("Workflows$JumpToActivity", "bugSplitJump", "jump1"),
+	)
+	m := newMutator(doc)
+	for _, tc := range []struct {
+		name   string
+		target backend.AlterTarget
+		want   backend.AlterTargetMatch
+		errHas string
+	}{
+		{"by name", backend.AlterTarget{Path: []string{"task1"}}, backend.AlterTargetMatch{Kind: "user task", Name: "task1"}, ""},
+		{"by caption", backend.AlterTarget{Caption: "Split the jump"}, backend.AlterTargetMatch{Kind: "user task", Name: "bugSplitJump"}, ""},
+		{"name beats a caption repeating it", backend.AlterTarget{Path: []string{"bugSplitJump"}},
+			backend.AlterTargetMatch{Kind: "user task", Name: "bugSplitJump"}, ""},
+		{"@n counts every match", backend.AlterTarget{Path: []string{"bugSplitJump"}, Ordinal: 2},
+			backend.AlterTargetMatch{Kind: "jump", Name: "jump1"}, ""},
+		{"@2 of a shared caption", backend.AlterTarget{Caption: "Review", Ordinal: 2},
+			backend.AlterTargetMatch{Kind: "decision", Name: "decision1"}, ""},
+		{"ambiguous caption lists the matches", backend.AlterTarget{Caption: "Review"}, backend.AlterTargetMatch{},
+			"@1 user task task1, @2 decision decision1"},
+		{"miss", backend.AlterTarget{Path: []string{"nope"}}, backend.AlterTargetMatch{}, "not found"},
+		{"@n past the matches", backend.AlterTarget{Caption: "Review", Ordinal: 3}, backend.AlterTargetMatch{}, "only 2 matches"},
+		{"a member path is not an activity", backend.AlterTarget{Path: []string{"task1", "Caption"}}, backend.AlterTargetMatch{},
+			"addressed by its name"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			got, err := m.ResolveAlterTarget(tc.target)
+			if tc.errHas != "" {
+				var te *backend.AlterTargetError
+				if err == nil || !errors.As(err, &te) || !strings.Contains(err.Error(), tc.errHas) {
+					t.Fatalf("err = %v, want an AlterTargetError containing %q", err, tc.errHas)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatal(err)
+			}
+			if !reflect.DeepEqual(got, tc.want) {
+				t.Errorf("got %+v, want %+v", got, tc.want)
+			}
+		})
+	}
+}
+
+// `insert before X { a; b; }` puts the activities, in order, right before X in
+// X's own flow.
+func TestInsertBeforeActivity(t *testing.T) {
+	m := newMutator(makeWorkflowDoc(
+		makeWfActivity("Workflows$SingleUserTaskActivity", "A", "a"),
+		makeWfActivity("Workflows$SingleUserTaskActivity", "B", "b"),
+	))
+	newAct := func(name string) workflows.WorkflowActivity {
+		u := &workflows.UserTask{}
+		u.Name, u.Caption = name, name
+		return u
+	}
+	if err := m.InsertBeforeActivity("b", 0, []workflows.WorkflowActivity{newAct("x"), newAct("y")}); err != nil {
+		t.Fatal(err)
+	}
+	flow := bsonnav.DGetDoc(m.rawData, "Flow")
+	var names []string
+	for _, e := range bsonnav.DGetArrayElements(bsonnav.DGet(flow, "Activities")) {
+		names = append(names, bsonnav.DGetString(e.(bson.D), "Name"))
+	}
+	if want := []string{"a", "x", "y", "b"}; !reflect.DeepEqual(names, want) {
+		t.Errorf("flow = %v, want %v", names, want)
+	}
+}
diff --git a/mdl/backend/wfmutator/mutator.go b/mdl/backend/wfmutator/mutator.go
index fcc049077b..84f5eca7eb 100644
--- a/mdl/backend/wfmutator/mutator.go
+++ b/mdl/backend/wfmutator/mutator.go
@@ -16,6 +16,7 @@ import (
 
 	"go.mongodb.org/mongo-driver/bson"
 
+	"github.com/mendixlabs/mxcli/mdl/backend"
 	"github.com/mendixlabs/mxcli/mdl/backend/bsonnav"
 	"github.com/mendixlabs/mxcli/mdl/backend/wfnames"
 	"github.com/mendixlabs/mxcli/mdl/bsonutil"
@@ -230,6 +231,49 @@ func (m *Mutator) InsertAfterActivity(activityRef string, atPos int, activities
 	return nil
 }
 
+// InsertBeforeActivity inserts activities just before the referenced one, in
+// the same flow: the generic ALTER's `insert before X { … }`.
+func (m *Mutator) InsertBeforeActivity(activityRef string, atPos int, activities []workflows.WorkflowActivity) error {
+	idx, acts, containingFlow, err := m.findActivityIndex(activityRef, atPos)
+	if err != nil {
+		return err
+	}
+
+	newBsonActs := m.serializeAndDedup(activities, "")
+
+	newArr := make([]any, 0, len(acts)+len(newBsonActs))
+	newArr = append(newArr, acts[:idx]...)
+	newArr = append(newArr, newBsonActs...)
+	newArr = append(newArr, acts[idx:]...)
+
+	bsonnav.DSetArray(containingFlow, "Activities", newArr)
+	return nil
+}
+
+// ResolveAlterTarget is the workflow's backend.AlterTargetResolver: the
+// activities whose name or caption the target names, in describe order, under
+// the rule backend.ResolveWorkflowActivityTarget shares with every backend.
+func (m *Mutator) ResolveAlterTarget(t backend.AlterTarget) (backend.AlterTargetMatch, error) {
+	if err := backend.CheckWorkflowAlterTarget(t); err != nil {
+		return backend.AlterTargetMatch{}, err
+	}
+	flow := bsonnav.DGetDoc(m.rawData, "Flow")
+	if flow == nil {
+		return backend.AlterTargetMatch{}, fmt.Errorf("workflow has no Flow")
+	}
+	var found []bson.D
+	findActivitiesRecursive(flow, backend.WorkflowTargetText(t), &found)
+	candidates := make([]backend.WorkflowActivityCandidate, 0, len(found))
+	for _, d := range found {
+		candidates = append(candidates, backend.WorkflowActivityCandidate{
+			Name:        bsonnav.DGetString(d, "Name"),
+			Caption:     bsonnav.DGetString(d, "Caption"),
+			StorageType: bsonnav.DGetString(d, "$Type"),
+		})
+	}
+	return backend.ResolveWorkflowActivityTarget(t, candidates)
+}
+
 func (m *Mutator) DropActivity(activityRef string, atPos int) error {
 	idx, acts, containingFlow, err := m.findActivityIndex(activityRef, atPos)
 	if err != nil {
diff --git a/mdl/deprecation/alter_workflow.go b/mdl/deprecation/alter_workflow.go
new file mode 100644
index 0000000000..cd60a91f8e
--- /dev/null
+++ b/mdl/deprecation/alter_workflow.go
@@ -0,0 +1,157 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package deprecation
+
+// Codes 140-149 are `alter workflow`'s old action forms, ported onto the
+// generic ALTER (ADR-0012 decision 2, ako/mxcli#712):
+//
+//	alter workflow M.W {
+//	  set ( Key: value, … ) [on <activity>];
+//	  insert before|after <activity> { <activities> }
+//	  insert into <activity> { outcomes … | path { … } | boundary event … }
+//	  replace <activity> with { <activities> }
+//	  drop <activity> [outcome 'X' | outcome true | path n | boundary event];
+//	}
+//
+// Each old action is recorded under its own code. The old statement had no
+// braces; the rewrite of a statement's first action opens the block and the
+// rewrite of its last closes it, so every record still carries one code.
+const (
+	// AlterWorkflowSet is `set display 'x'`, `set description …`, `set export
+	// level …`, `set due date …`, `set overview page …`, `set parameter …`.
+	AlterWorkflowSet = "MDL-DEPR140"
+	// AlterWorkflowSetActivity is `set activity X page M.P` and the other
+	// activity properties.
+	AlterWorkflowSetActivity = "MDL-DEPR141"
+	// AlterWorkflowInsertAfter is `insert after X <activity>;`, the activity
+	// not in braces.
+	AlterWorkflowInsertAfter = "MDL-DEPR142"
+	// AlterWorkflowDropActivity is `drop activity X`.
+	AlterWorkflowDropActivity = "MDL-DEPR143"
+	// AlterWorkflowReplaceActivity is `replace activity X with <activity>;`.
+	AlterWorkflowReplaceActivity = "MDL-DEPR144"
+	// AlterWorkflowInsertOutcome is `insert outcome 'N' on X { … }`.
+	AlterWorkflowInsertOutcome = "MDL-DEPR145"
+	// AlterWorkflowInsertPath is `insert path on X { … }`.
+	AlterWorkflowInsertPath = "MDL-DEPR146"
+	// AlterWorkflowInsertCondition is `insert condition 'V' on X { … }`.
+	AlterWorkflowInsertCondition = "MDL-DEPR147"
+	// AlterWorkflowInsertBoundaryEvent is `insert boundary event on X <event>`.
+	AlterWorkflowInsertBoundaryEvent = "MDL-DEPR148"
+	// AlterWorkflowDropMember is `drop outcome 'N' on X`, `drop condition 'V'
+	// on X`, `drop path 'Path n' on X` and `drop boundary event on X`.
+	AlterWorkflowDropMember = "MDL-DEPR149"
+)
+
+const alterWorkflowBlockNote = "`alter workflow` is the generic alter (ADR-0012): its operations go in " +
+	"{ }, a target is an activity's name or 'caption' with an optional @n, and a fragment is " +
+	"written exactly as in `create workflow`."
+
+var alterWorkflowEntries = []Entry{
+	{
+		Code:      AlterWorkflowSet,
+		Old:       "alter workflow M.W set display 'x' / set description … / set export level … / set due date … / set overview page … / set parameter $P: M.E",
+		Canonical: "alter workflow M.W { set ( Display: 'x', Description: …, ExportLevel: …, DueDate: …, OverviewPage: …, Parameter: $P: M.E ); }",
+		Rewrite:   Rewrite{Structural: "property as `set ( Key: value )`, inside the statement's { }"},
+		RemovedIn: 2,
+		Note:      "R3: `:` sets a model property, in create's property list. " + alterWorkflowBlockNote,
+		Example:   "alter workflow M.W set display 'Order';",
+		// The rewrite keeps the old statement's own terminator after the block.
+		CanonicalExample: "alter workflow M.W { set (Display: 'Order'); };",
+	},
+	{
+		Code:             AlterWorkflowSetActivity,
+		Old:              "alter workflow M.W set activity X page M.P / description … / targeting … / due date …",
+		Canonical:        "alter workflow M.W { set ( Page: M.P, Description: …, Targeting: …, DueDate: … ) on X; }",
+		Rewrite:          Rewrite{Structural: "`set activity X <prop> v` as `set ( Key: v ) on X`, inside the statement's { }"},
+		RemovedIn:        2,
+		Note:             "The target follows `on`, as in every generic alter. " + alterWorkflowBlockNote,
+		Example:          "alter workflow M.W set activity Review page M.TaskPage;",
+		CanonicalExample: "alter workflow M.W { set (Page: M.TaskPage) on Review; };",
+	},
+	{
+		Code:             AlterWorkflowInsertAfter,
+		Old:              "alter workflow M.W insert after X <activity>;",
+		Canonical:        "alter workflow M.W { insert after X { <activity>; } }",
+		Rewrite:          Rewrite{Structural: "inserted activity in { }, inside the statement's { }"},
+		RemovedIn:        2,
+		Note:             "A fragment is a brace body, so it can hold several activities. " + alterWorkflowBlockNote,
+		Example:          "alter workflow M.W insert after Review call microflow M.Notify;",
+		CanonicalExample: "alter workflow M.W { insert after Review { call microflow M.Notify; } };",
+	},
+	{
+		Code:             AlterWorkflowDropActivity,
+		Old:              "alter workflow M.W drop activity X",
+		Canonical:        "alter workflow M.W { drop X; }",
+		Rewrite:          Rewrite{Structural: "`drop activity X` as `drop X`, inside the statement's { }"},
+		RemovedIn:        2,
+		Note:             "The target names the element; the kind is its own. " + alterWorkflowBlockNote,
+		Example:          "alter workflow M.W drop activity Review;",
+		CanonicalExample: "alter workflow M.W { drop Review; };",
+	},
+	{
+		Code:             AlterWorkflowReplaceActivity,
+		Old:              "alter workflow M.W replace activity X with <activity>;",
+		Canonical:        "alter workflow M.W { replace X with { <activity>; } }",
+		Rewrite:          Rewrite{Structural: "`replace activity X with a;` as `replace X with { a; }`, inside the statement's { }"},
+		RemovedIn:        2,
+		Note:             alterWorkflowBlockNote,
+		Example:          "alter workflow M.W replace activity Review with call microflow M.Notify;",
+		CanonicalExample: "alter workflow M.W { replace Review with { call microflow M.Notify; } };",
+	},
+	{
+		Code:             AlterWorkflowInsertOutcome,
+		Old:              "alter workflow M.W insert outcome 'N' on X { … }",
+		Canonical:        "alter workflow M.W { insert into X { outcomes 'N' { … } } }",
+		Rewrite:          Rewrite{Structural: "`insert outcome 'N' on X { … }` as `insert into X { outcomes 'N' { … } }`"},
+		RemovedIn:        2,
+		Note:             "The fragment is the user task's own `outcomes` clause, as `create workflow` writes it. " + alterWorkflowBlockNote,
+		Example:          "alter workflow M.W insert outcome 'Escalate' on Review { call microflow M.Notify; };",
+		CanonicalExample: "alter workflow M.W { insert into Review { outcomes 'Escalate' { call microflow M.Notify; } } };",
+	},
+	{
+		Code:             AlterWorkflowInsertPath,
+		Old:              "alter workflow M.W insert path on X { … }",
+		Canonical:        "alter workflow M.W { insert into X { path { … } } }",
+		Rewrite:          Rewrite{Structural: "`insert path on X { … }` as `insert into X { path { … } }`"},
+		RemovedIn:        2,
+		Note:             "The fragment is the split's own `path n { … }`; the number may be left out, and when written it must be the next one. " + alterWorkflowBlockNote,
+		Example:          "alter workflow M.W insert path on split1 { call microflow M.Notify; };",
+		CanonicalExample: "alter workflow M.W { insert into split1 { path { call microflow M.Notify; } } };",
+	},
+	{
+		Code:             AlterWorkflowInsertCondition,
+		Old:              "alter workflow M.W insert condition 'V' on X { … }",
+		Canonical:        "alter workflow M.W { insert into X { outcomes 'V' -> { … } } }",
+		Rewrite:          Rewrite{Structural: "`insert condition 'V' on X { … }` as `insert into X { outcomes 'V' -> { … } }`"},
+		RemovedIn:        2,
+		Note:             "The fragment is the decision's own `outcomes` clause, as `create workflow` writes it (`true -> { … }`, `default -> { … }`). " + alterWorkflowBlockNote,
+		Example:          "alter workflow M.W insert condition 'true' on decision1 { };",
+		CanonicalExample: "alter workflow M.W { insert into decision1 { outcomes 'true' -> { } } };",
+	},
+	{
+		Code:             AlterWorkflowInsertBoundaryEvent,
+		Old:              "alter workflow M.W insert boundary event on X <event>",
+		Canonical:        "alter workflow M.W { insert into X { boundary event <event> } }",
+		Rewrite:          Rewrite{Structural: "`insert boundary event on X e` as `insert into X { boundary event e }`"},
+		RemovedIn:        2,
+		Note:             "The fragment is the activity's own `boundary event` clause. " + alterWorkflowBlockNote,
+		Example:          "alter workflow M.W insert boundary event on Review interrupting timer addHours([%CurrentDateTime%], 1) { };",
+		CanonicalExample: "alter workflow M.W { insert into Review { boundary event interrupting timer addHours([%CurrentDateTime%], 1) { } } };",
+	},
+	{
+		Code:      AlterWorkflowDropMember,
+		Old:       "alter workflow M.W drop outcome 'N' on X / drop condition 'V' on X / drop path 'Path n' on X / drop boundary event on X",
+		Canonical: "alter workflow M.W { drop X outcome 'N'; drop X outcome true; drop X path n; drop X boundary event; }",
+		Rewrite:   Rewrite{Structural: "member after the activity it belongs to: `drop X outcome 'N'`, `drop X path n`, `drop X boundary event`"},
+		RemovedIn: 2,
+		Note: "A decision's `true`, `false` and `default` outcomes are written as those words; any other " +
+			"outcome by its value. `drop path 'x'` whose caption is not `Path n` has no rewrite. " + alterWorkflowBlockNote,
+		Example:          "alter workflow M.W drop outcome 'Reject' on Review;",
+		CanonicalExample: "alter workflow M.W { drop Review outcome 'Reject'; };",
+	},
+}
+
+func init() {
+	entries = append(entries, alterWorkflowEntries...)
+}
diff --git a/mdl/deprecation/deprecation.go b/mdl/deprecation/deprecation.go
index 61e19434f4..9180800bea 100644
--- a/mdl/deprecation/deprecation.go
+++ b/mdl/deprecation/deprecation.go
@@ -241,6 +241,34 @@ const (
 	// fragment in braces: `insert after $X { … }`, `replace … with { … }`.
 	AlterFlowFragmentBraces = "MDL-DEPR074"
 
+	// Codes 120-129 are the rest of R2 (ako/mxcli#754): navigation and menus,
+	// property maps, and the database connection.
+
+	// RestHeaderEquals is a consumed REST service operation's header written
+	// `'Name' = value`: a header list is a map, `( 'Name': value )`.
+	RestHeaderEquals = "MDL-DEPR120"
+	// MenuChildrenParens is a navigation profile's `menu ( … )`, a menu
+	// document's or a sub-menu's items in ( ), and the `;` after an item:
+	// menu items are children, in { } with no separator.
+	MenuChildrenParens = "MDL-DEPR121"
+	// MenuItemClauses is a menu item's action or icon written as a clause after
+	// its caption, `menu item 'X' page M.P icon I`, rather than in its property
+	// list `( OnClick: show page M.P, Icon: I )`.
+	MenuItemClauses = "MDL-DEPR122"
+	// HeaderMapBraces is a page or snippet header's `Params: { … }` /
+	// `Variables: { … }`: a map in braces.
+	HeaderMapBraces = "MDL-DEPR123"
+	// TemplateParamsBrackets is a text template's parameters in brackets,
+	// `ContentParams: [{1} = …]` (also CaptionParams and `<Name>Params`).
+	TemplateParamsBrackets = "MDL-DEPR124"
+	// DesignPropertiesBrackets is `DesignProperties: ['Key': 'Value']`.
+	DesignPropertiesBrackets = "MDL-DEPR125"
+	// SnippetCallParamsBraces is a snippet call's `Params: {$P: $v}`.
+	SnippetCallParamsBraces = "MDL-DEPR126"
+	// DatabaseConnectionClauses is a database connection written as clauses
+	// with a begin … end block of queries.
+	DatabaseConnectionClauses = "MDL-DEPR127"
+
 	// Codes 060-069 and 101-103 are R3's (ako/mxcli#751,
 	// PROPOSAL_mdl_beta_syntax_freeze.md §3 R3): `:` sets a model property, so
 	// an `alter` sets properties in create's `( Key: value, … )` list, and a
@@ -274,6 +302,18 @@ const (
 	// ModifyAttributeColon is `modify attribute A T`: an attribute definition
 	// is always `Name: Type`.
 	ModifyAttributeColon = "MDL-DEPR065"
+
+	// Codes 710-719 are ako/mxcli#707's: describe output that did not re-parse
+	// or lost data, where the fix needed a canonical form the old one lacked.
+
+	// UserRolePositional is `create user role R (M.A, M.B) manage all roles`:
+	// the module roles by position, with no slot for the role's description,
+	// its check-security flag or its manageable roles.
+	UserRolePositional = "MDL-DEPR710"
+	// RestHeaderConcat is a consumed REST service header written
+	// `'Bearer ' + $Token` or `$Token`: the value template `'Bearer {Token}'`
+	// written as an expression.
+	RestHeaderConcat = "MDL-DEPR711"
 )
 
 // entries is the registry. Append only: a code is never reused or renumbered,
@@ -424,8 +464,8 @@ var entries = []Entry{
 		RemovedIn: 2,
 		Note: "XPath is written in [ ] everywhere (R5), so the quotes inside it are no longer doubled. " +
 			"A string whose value is not a bracketed XPath is left in place and reported by `fmt --upgrade`.",
-		Example:          "alter workflow M.WF set activity 'Review' targeting xpath '[Role = ''Manager'']';",
-		CanonicalExample: "alter workflow M.WF set activity 'Review' targeting xpath [Role = 'Manager'];",
+		Example:          "alter workflow M.WF { set (Targeting: xpath '[Role = ''Manager'']') on 'Review'; };",
+		CanonicalExample: "alter workflow M.WF { set (Targeting: xpath [Role = 'Manager']) on 'Review'; };",
 	},
 	{
 		Code:      OnErrorBraces,
@@ -495,7 +535,41 @@ func init() {
 	entries = append(entries, r6Entries...)
 	entries = append(entries, r5Entries...)
 	entries = append(entries, r2Entries...)
+	entries = append(entries, r2RestEntries...)
 	entries = append(entries, r3Entries...)
+	entries = append(entries, issue707Entries...)
+}
+
+// issue707Entries are ako/mxcli#707's: forms describe could not write, so its
+// output lost what they had no slot for.
+var issue707Entries = []Entry{
+	{
+		Code:      UserRolePositional,
+		Old:       "create user role R (M.A, …) [manage all roles]",
+		Canonical: "create user role R ( ModuleRoles: (M.A, …), ManageAllRoles: true, … )",
+		Rewrite: Rewrite{Structural: "user role properties: the role list becomes `ModuleRoles: (…)` in a " +
+			"( Key: value ) list, and `manage all roles` becomes `ManageAllRoles: true`"},
+		RemovedIn: 2,
+		Note: "The property list also takes Description, CheckSecurity, ManageableRoles and " +
+			"ManageUsersWithoutRoles, and may be empty or left out: `create user role Guest;`.",
+		Example:          "create user role Clerk (M.User, M.Viewer) manage all roles;",
+		CanonicalExample: "create user role Clerk ( ModuleRoles: (M.User, M.Viewer), ManageAllRoles: true );",
+	},
+	{
+		Code:      RestHeaderConcat,
+		Old:       "Headers: ('Authorization': 'Bearer ' + $Token) / ('X-Key': $Key)",
+		Canonical: "Headers: ('Authorization': 'Bearer {Token}') / ('X-Key': '{Key}')",
+		Rewrite:   Rewrite{Structural: "header value as a template: `'text' + $P` becomes `'text{P}'`"},
+		RemovedIn: 2,
+		Note: "A header value is a template like the path: `{P}` is the operation parameter P. The old " +
+			"form stored only the text before the `+`. Not rewritten when that text holds a `{` or `}`.",
+		Example: "create consumed rest service M.Api (BaseUrl: 'https://x', Authentication: none) " +
+			"{ operation Get (Method: get, Path: '/a', Parameters: ($Token: String), " +
+			"Headers: ('Authorization': 'Bearer ' + $Token), Response: none) };",
+		CanonicalExample: "create consumed rest service M.Api (BaseUrl: 'https://x', Authentication: none) " +
+			"{ operation Get (Method: get, Path: '/a', Parameters: ($Token: String), " +
+			"Headers: ('Authorization': 'Bearer {Token}'), Response: none) };",
+	},
 }
 
 // r9Entries are R9's (ako/mxcli#755): documentation is a `/** … */` doc
@@ -781,6 +855,111 @@ var r2Entries = []Entry{
 	},
 }
 
+// r2RestEntries are the rest of R2 (ako/mxcli#754): navigation and menus,
+// property maps, and the database connection.
+var r2RestEntries = []Entry{
+	{
+		Code:      RestHeaderEquals,
+		Old:       "Headers: ( 'Name' = value )",
+		Canonical: "Headers: ( 'Name': value )",
+		Rewrite:   Rewrite{Structural: "header list: `'Name' = value` becomes `'Name': value`"},
+		RemovedIn: 2,
+		Note:      "A header list is a map of the operation's properties, so it is `( key: value )` like every property map (R2/R3).",
+		Example: "create consumed rest service M.Api (BaseUrl: 'https://x', Authentication: none) " +
+			"{ operation Ping ( Method: get, Path: '/p', Headers: ('Accept' = 'application/json'), Response: none ) };",
+		CanonicalExample: "create consumed rest service M.Api (BaseUrl: 'https://x', Authentication: none) " +
+			"{ operation Ping ( Method: get, Path: '/p', Headers: ('Accept': 'application/json'), Response: none ) };",
+	},
+	{
+		Code:      MenuChildrenParens,
+		Old:       "navigation P menu ( menu item …; menu 'X' ( … ); )  /  create menu M.M ( … )",
+		Canonical: "navigation P { menu item … menu 'X' { … } }  /  create menu M.M { … }",
+		Rewrite: Rewrite{Structural: "menu items: `menu (` becomes `{`, a menu's or sub-menu's ( ) become { }, " +
+			"and the `;` after each item is dropped"},
+		RemovedIn: 2,
+		Note: "Menu items are children, so they are in { } like a page's widgets, and a child ends in `)` or `}`, " +
+			"so it needs no separator (R2). In a navigation profile the items are the profile's own children.",
+		Example:          "create or modify navigation Responsive home page M.Home menu ( menu item 'Home'; menu 'Admin' ( menu item 'Users'; ); );",
+		CanonicalExample: "create or modify navigation Responsive home page M.Home { menu item 'Home' menu 'Admin' { menu item 'Users' } };",
+	},
+	{
+		Code:      MenuItemClauses,
+		Old:       "menu item 'X' page M.P icon I  /  microflow M.F  /  sign out",
+		Canonical: "menu item 'X' ( OnClick: show page M.P, Icon: I )  /  call microflow M.F  /  sign out",
+		Rewrite: Rewrite{Structural: "item clauses: `page M.P` becomes `( OnClick: show page M.P )`, `microflow M.F` " +
+			"`OnClick: call microflow M.F`, `sign out` `OnClick: sign out`, and `icon I` `Icon: I`"},
+		RemovedIn: 2,
+		Note: "A menu item is a child: its properties are in ( ), and its action is written in the words a page " +
+			"action uses (R2, R8). A sub-menu's icon moves the same way: `menu 'X' ( Icon: I ) { … }`.",
+		Example:          "create menu M.Main { menu item 'Home' page M.Home icon Atlas_Core.Atlas.home menu item 'Bye' sign out };",
+		CanonicalExample: "create menu M.Main { menu item 'Home' ( OnClick: show page M.Home, Icon: Atlas_Core.Atlas.home ) menu item 'Bye' ( OnClick: sign out ) };",
+	},
+	{
+		Code:             HeaderMapBraces,
+		Old:              "Params: { $P: M.E }  /  Variables: { $v: Boolean = 'true' }",
+		Canonical:        "Params: ( $P: M.E )  /  Variables: ( $v: Boolean = 'true' )",
+		Rewrite:          Rewrite{Structural: "header map: the braces become ( )"},
+		RemovedIn:        2,
+		Note:             "In a page's and a snippet's header. A map is a property list, so it is in ( ); { } holds children (R2).",
+		Example:          "create page M.P (Title: 'P', Layout: Atlas_Core.Atlas_Default, Params: { $Order: M.Order }) { };",
+		CanonicalExample: "create page M.P (Title: 'P', Layout: Atlas_Core.Atlas_Default, Params: ( $Order: M.Order )) { };",
+	},
+	{
+		Code:      TemplateParamsBrackets,
+		Old:       "ContentParams: [{1} = expr]",
+		Canonical: "ContentParams: ({1} = expr)",
+		Rewrite:   Rewrite{Structural: "template parameters: the brackets become ( )"},
+		RemovedIn: 2,
+		Note: "Also CaptionParams and a pluggable widget's `<Name>Params`. The parameters are a map, in ( ) (R2), " +
+			"and each binds a value with `=`, as `with ({1} = …)` does (R4).",
+		Example: "create page M.P (Title: 'P', Layout: Atlas_Core.Atlas_Default) " +
+			"{ dynamictext t (Content: 'Hi {1}', ContentParams: [{1} = 'x']) };",
+		CanonicalExample: "create page M.P (Title: 'P', Layout: Atlas_Core.Atlas_Default) " +
+			"{ dynamictext t (Content: 'Hi {1}', ContentParams: ({1} = 'x')) };",
+	},
+	{
+		Code:      DesignPropertiesBrackets,
+		Old:       "DesignProperties: ['Key': 'Value', 'Group': ['k': on]]",
+		Canonical: "DesignProperties: ('Key': 'Value', 'Group': ('k': on))",
+		Rewrite:   Rewrite{Structural: "design properties: each bracketed list becomes ( )"},
+		RemovedIn: 2,
+		Note:      "The design properties are a map of properties, so they are in ( ) (R2).",
+		Example: "create page M.P (Title: 'P', Layout: Atlas_Core.Atlas_Default) " +
+			"{ container c (DesignProperties: ['Spacing': ['margin-top': 'Large'], 'Full width': on]) };",
+		CanonicalExample: "create page M.P (Title: 'P', Layout: Atlas_Core.Atlas_Default) " +
+			"{ container c (DesignProperties: ('Spacing': ('margin-top': 'Large'), 'Full width': on)) };",
+	},
+	{
+		Code:      SnippetCallParamsBraces,
+		Old:       "snippetcall s (Snippet: M.S, Params: {$Asset: $var})",
+		Canonical: "snippetcall s (Snippet: M.S, Params: (Asset = $var))",
+		Rewrite:   Rewrite{Structural: "snippet call arguments: `{$P: $v}` becomes `(P = $v)`"},
+		RemovedIn: 2,
+		Note: "A snippet call is a call site, so it binds `Param = value` without a `$` on the parameter name (R4), " +
+			"in the ( ) of a map (R2).",
+		Example: "create page M.P (Title: 'P', Layout: Atlas_Core.Atlas_Default, Params: ($Asset: M.Asset)) " +
+			"{ snippetcall s (Snippet: M.S, Params: {$Asset: $Asset}) };",
+		CanonicalExample: "create page M.P (Title: 'P', Layout: Atlas_Core.Atlas_Default, Params: ($Asset: M.Asset)) " +
+			"{ snippetcall s (Snippet: M.S, Params: (Asset = $Asset)) };",
+	},
+	{
+		Code:      DatabaseConnectionClauses,
+		Old:       "database connection M.Db type '…' connection string @M.C … begin query Q sql '…' returns M.E map (c as A); end",
+		Canonical: "database connection M.Db ( Type: '…', ConnectionString: @M.C, … ) { query Q ( Sql: '…', Returns: M.E, Map: ( A = c ) ) }",
+		Rewrite: Rewrite{Structural: "clauses become the property list: `type` `Type:`, `connection string` `ConnectionString:`, " +
+			"`host` `Host:`, `port` `Port:`, `database` `DatabaseName:`, `username` `Username:`, `password` `Password:`; " +
+			"`begin … end` becomes { }; a query's `sql`, `parameter`, `returns` and `map` become Sql, Parameters, Returns " +
+			"and Map, and `column as Attr` becomes `Attr = column`"},
+		RemovedIn: 2,
+		Note: "The database connection was the one declarative document written as clauses and begin … end. Its " +
+			"properties are in ( ) and its queries are children in { } (R2).",
+		Example: "create database connection M.Db type 'PostgreSQL' connection string @M.Url username @M.User password @M.Pass " +
+			"begin query Q sql $$select id from t where id > {min}$$ parameter min: Integer default '0' returns M.T map (id as Id); end;",
+		CanonicalExample: "create database connection M.Db ( Type: 'PostgreSQL', ConnectionString: @M.Url, Username: @M.User, Password: @M.Pass ) " +
+			"{ query Q ( Sql: $$select id from t where id > {min}$$, Parameters: ( min: Integer default '0' ), Returns: M.T, Map: (Id = id) ) };",
+	},
+}
+
 // r3Entries are R3's spellings (ako/mxcli#751): `:` sets a model property. An
 // `alter` takes exactly create's `( Key: value, … )` list, so a fragment of
 // describe output pastes into an alter unchanged.
diff --git a/mdl/executor/alter_workflow_generic_test.go b/mdl/executor/alter_workflow_generic_test.go
new file mode 100644
index 0000000000..0b00837770
--- /dev/null
+++ b/mdl/executor/alter_workflow_generic_test.go
@@ -0,0 +1,160 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package executor
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/backend"
+	"github.com/mendixlabs/mxcli/mdl/backend/mock"
+	"github.com/mendixlabs/mxcli/mdl/visitor"
+	"github.com/mendixlabs/mxcli/model"
+	"github.com/mendixlabs/mxcli/sdk/workflows"
+)
+
+// alter workflow on the generic ALTER (ako/mxcli#712): every operation's target
+// goes through the workflow's AlterTargetResolver before anything is applied.
+
+func genericWfCtx(t *testing.T, mut *mock.MockWorkflowMutator) *ExecContext {
+	t.Helper()
+	mod := mkModule("Sales")
+	wf := mkWorkflow(mod.ID, "WF")
+	wf.Flow = &workflows.Flow{Activities: []workflows.WorkflowActivity{
+		&workflows.UserTask{BaseWorkflowActivity: workflows.BaseWorkflowActivity{
+			BaseElement: model.BaseElement{ID: "a1"}, Name: "task1"}},
+		&workflows.ParallelSplitActivity{BaseWorkflowActivity: workflows.BaseWorkflowActivity{
+			BaseElement: model.BaseElement{ID: "a3"}, Name: "split1"},
+			Outcomes: []*workflows.ParallelSplitOutcome{{}, {}}},
+	}}
+	h := mkHierarchy(mod)
+	withContainer(h, wf.ContainerID, mod.ID)
+	mb := &mock.MockBackend{
+		IsConnectedFunc:             func() bool { return true },
+		ListWorkflowsFunc:           func() ([]*workflows.Workflow, error) { return []*workflows.Workflow{wf}, nil },
+		OpenWorkflowForMutationFunc: func(model.ID) (backend.WorkflowMutator, error) { return mut, nil },
+	}
+	ctx, _ := newMockCtx(t, withBackend(mb), withHierarchy(h))
+	return ctx
+}
+
+func execAlterWf(t *testing.T, ctx *ExecContext, src string) error {
+	t.Helper()
+	prog, errs := visitor.Build(src)
+	if len(errs) > 0 {
+		t.Fatalf("parse %q: %v", src, errs)
+	}
+	return execAlterWorkflow(ctx, prog.Statements[0].(*ast.AlterWorkflowStmt))
+}
+
+// An ambiguous target refuses the statement before the operation ahead of it
+// is applied: a half-applied alter is the thing resolving first prevents.
+func TestAlterWorkflowGeneric_UnresolvedTargetRefusesBeforeAnyChange(t *testing.T) {
+	var applied []string
+	mut := &mock.MockWorkflowMutator{
+		ResolveAlterTargetFunc: func(tg backend.AlterTarget) (backend.AlterTargetMatch, error) {
+			if backend.WorkflowTargetText(tg) == "Review" {
+				return backend.AlterTargetMatch{}, &backend.AlterTargetError{Target: tg, Matches: []backend.AlterTargetMatch{
+					{Kind: "user task", Name: "task1"}, {Kind: "decision", Name: "decision1"}}}
+			}
+			return backend.AlterTargetMatch{Kind: "user task", Name: backend.WorkflowTargetText(tg)}, nil
+		},
+		DropActivityFunc: func(ref string, _ int) error { applied = append(applied, "drop "+ref); return nil },
+		SetActivityPropertyFunc: func(ref string, _ int, prop, _ string) error {
+			applied = append(applied, "set "+prop+" on "+ref)
+			return nil
+		},
+		SaveFunc: func() error { applied = append(applied, "save"); return nil },
+	}
+	ctx := genericWfCtx(t, mut)
+	err := execAlterWf(t, ctx, `alter workflow Sales.WF { drop task1; set (Description: 'x') on 'Review'; };`)
+	if err == nil || !strings.Contains(err.Error(), "@1 user task task1, @2 decision decision1") {
+		t.Fatalf("err = %v, want the ambiguity with its matches", err)
+	}
+	if len(applied) != 0 {
+		t.Fatalf("applied %v before refusing", applied)
+	}
+}
+
+// The canonical operations reach the same mutator calls the old actions do,
+// and `insert before` — which the old form could not say — reaches its own.
+func TestAlterWorkflowGeneric_OperationsReachTheMutator(t *testing.T) {
+	var calls []string
+	rec := func(format string, a ...any) { calls = append(calls, fmt.Sprintf(format, a...)) }
+	var resolved []string
+	mut := &mock.MockWorkflowMutator{
+		ResolveAlterTargetFunc: func(tg backend.AlterTarget) (backend.AlterTargetMatch, error) {
+			resolved = append(resolved, tg.String())
+			return backend.AlterTargetMatch{Kind: "activity", Name: backend.WorkflowTargetText(tg)}, nil
+		},
+		InsertBeforeActivityFunc: func(ref string, pos int, acts []workflows.WorkflowActivity) error {
+			rec("before %s@%d %d", ref, pos, len(acts))
+			return nil
+		},
+		InsertAfterActivityFunc: func(ref string, pos int, acts []workflows.WorkflowActivity) error {
+			rec("after %s@%d %d", ref, pos, len(acts))
+			return nil
+		},
+		InsertPathFunc: func(ref string, _ int, _ string, acts []workflows.WorkflowActivity) error {
+			rec("path %s", ref)
+			return nil
+		},
+		DropOutcomeFunc: func(ref string, _ int, name string) error { rec("drop outcome %s %s", ref, name); return nil },
+		DropPathFunc:    func(ref string, _ int, c string) error { rec("drop path %s %s", ref, c); return nil },
+		SetPropertyFunc: func(prop, v string) error { rec("set %s=%s", prop, v); return nil },
+	}
+	ctx := genericWfCtx(t, mut)
+	err := execAlterWf(t, ctx, `alter workflow Sales.WF {
+  set (Display: 'Orders');
+  insert before task1 { wait for notification w1; wait for notification w2; }
+  insert after 'Review'@2 { wait for notification w3; }
+  insert after w3 { wait for notification w4; }
+  insert into split1 { path 3 { } }
+  drop task1 outcome 'Reject', split1 path 1;
+};`)
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := []string{"set display=Orders", "before task1@0 2", "after Review@2 1", "after w3@0 1",
+		"path split1", "drop outcome task1 Reject", "drop path split1 Path 1"}
+	if strings.Join(calls, "|") != strings.Join(want, "|") {
+		t.Errorf("calls = %v\nwant    %v", calls, want)
+	}
+	// w3 is inserted by the statement itself, so it is resolved when its
+	// operation runs, not against the workflow as stored.
+	for _, r := range resolved {
+		if r == "w3" {
+			t.Errorf("resolved %v: w3 was looked up before the statement inserted it", resolved)
+		}
+	}
+}
+
+// `path n` in an insert must be the split's next path; the number is not a
+// position to insert at, so any other is refused rather than silently
+// appended.
+func TestAlterWorkflowGeneric_PathNumberMustBeTheNextOne(t *testing.T) {
+	for _, tc := range []struct {
+		src     string
+		refused bool
+	}{
+		{`alter workflow Sales.WF { insert into split1 { path 3 { } } };`, false},
+		{`alter workflow Sales.WF { insert into split1 { path { } } };`, false},
+		{`alter workflow Sales.WF { insert into split1 { path 3 { } path 4 { } } };`, false},
+		{`alter workflow Sales.WF { insert into split1 { path 2 { } } };`, true},
+		{`alter workflow Sales.WF { insert into split1 { path 3 { } path 3 { } } };`, true},
+	} {
+		ctx := genericWfCtx(t, &mock.MockWorkflowMutator{})
+		errs := alterWfRefErrors(t, ctx, tc.src)
+		got := false
+		for _, e := range errs {
+			if strings.Contains(e, "so a path added here is path") {
+				got = true
+			}
+		}
+		if got != tc.refused {
+			t.Errorf("%s: refused = %v, want %v (%v)", tc.src, got, tc.refused, errs)
+		}
+	}
+}
diff --git a/mdl/executor/alter_workflow_insert_before_start_test.go b/mdl/executor/alter_workflow_insert_before_start_test.go
new file mode 100644
index 0000000000..fade4c7d5f
--- /dev/null
+++ b/mdl/executor/alter_workflow_insert_before_start_test.go
@@ -0,0 +1,54 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package executor
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/backend/mock"
+	"github.com/mendixlabs/mxcli/model"
+	"github.com/mendixlabs/mxcli/sdk/workflows"
+)
+
+// `insert before` is new with the generic alter (ako/mxcli#712), and a flow's
+// start activity is an ordinary, addressable member of it (`start1`). Inserting
+// before it wrote a flow that no longer begins with its start event: exec
+// reported "Altered workflow" and mx check (11.14.0, TestApp) answered CE9526
+// "Main process in workflow should start with a start event."
+func TestAlterWorkflow_InsertBeforeStartIsRefused(t *testing.T) {
+	mod := mkModule("Sales")
+	wf := mkWorkflow(mod.ID, "WF")
+	wf.Flow = &workflows.Flow{
+		Activities: []workflows.WorkflowActivity{
+			&workflows.StartWorkflowActivity{BaseWorkflowActivity: workflows.BaseWorkflowActivity{
+				BaseElement: model.BaseElement{ID: "s1"}, Name: "start1", Caption: "Start"}},
+			&workflows.UserTask{BaseWorkflowActivity: workflows.BaseWorkflowActivity{
+				BaseElement: model.BaseElement{ID: "a1"}, Name: "task1"}},
+			&workflows.EndWorkflowActivity{BaseWorkflowActivity: workflows.BaseWorkflowActivity{
+				BaseElement: model.BaseElement{ID: "e1"}, Name: "end1", Caption: "End"}},
+		},
+	}
+	h := mkHierarchy(mod)
+	withContainer(h, wf.ContainerID, mod.ID)
+	mb := &mock.MockBackend{
+		IsConnectedFunc:   func() bool { return true },
+		ListWorkflowsFunc: func() ([]*workflows.Workflow, error) { return []*workflows.Workflow{wf}, nil },
+	}
+	ctx, _ := newMockCtx(t, withBackend(mb), withHierarchy(h))
+
+	for _, src := range []string{
+		"alter workflow Sales.WF { insert before start1 { wait for notification Ready; } };",
+		"alter workflow Sales.WF { insert before 'Start' { wait for notification Ready; } };",
+	} {
+		errs := alterWfRefErrors(t, ctx, src)
+		if len(errs) != 1 || !strings.Contains(errs[0], "start") || !strings.Contains(errs[0], "insert after") {
+			t.Errorf("%s: want one refusal pointing at `insert after`, got %q", src, errs)
+		}
+	}
+
+	// Control: the same fragment before an ordinary activity is accepted.
+	if errs := alterWfRefErrors(t, ctx, "alter workflow Sales.WF { insert before task1 { wait for notification Ready; } };"); len(errs) != 0 {
+		t.Errorf("insert before task1: want no refusal, got %q", errs)
+	}
+}
diff --git a/mdl/executor/alter_workflow_outcome_kind_test.go b/mdl/executor/alter_workflow_outcome_kind_test.go
index 46f7c93fe6..bf79a86797 100644
--- a/mdl/executor/alter_workflow_outcome_kind_test.go
+++ b/mdl/executor/alter_workflow_outcome_kind_test.go
@@ -130,7 +130,7 @@ func TestAlterWorkflow_RefusalNamesTheRightOp(t *testing.T) {
 		t.Fatal("expected a refusal")
 	}
 	joined := strings.Join(errs, "\n")
-	for _, want := range []string{"INSERT CONDITION", "decision"} {
+	for _, want := range []string{"insert into decision9 { outcomes '<Module.Enumeration.Value>' -> { … } }", "decision"} {
 		if !strings.Contains(joined, want) {
 			t.Errorf("refusal does not mention %q: %s", want, joined)
 		}
diff --git a/mdl/executor/button_caption_params_632_test.go b/mdl/executor/button_caption_params_632_test.go
index adb836c0f6..797e4a099e 100644
--- a/mdl/executor/button_caption_params_632_test.go
+++ b/mdl/executor/button_caption_params_632_test.go
@@ -108,7 +108,7 @@ func TestDescribeButtonEmitsCaptionParams(t *testing.T) {
 		Action:     "save_changes",
 	}, 0)
 	out := buf.String()
-	if !strings.Contains(out, "CaptionParams: [{1} = Title]") {
+	if !strings.Contains(out, "CaptionParams: ({1} = Title)") {
 		t.Errorf("button parameters not described as CaptionParams:\n%s", out)
 	}
 	if strings.Contains(out, "ContentParams") {
diff --git a/mdl/executor/cmd_alter_workflow.go b/mdl/executor/cmd_alter_workflow.go
index 97f986b520..9becd839cf 100644
--- a/mdl/executor/cmd_alter_workflow.go
+++ b/mdl/executor/cmd_alter_workflow.go
@@ -4,9 +4,11 @@ package executor
 
 import (
 	"fmt"
+	"reflect"
 	"strings"
 
 	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/backend"
 	mdlerrors "github.com/mendixlabs/mxcli/mdl/errors"
 	"github.com/mendixlabs/mxcli/model"
 	"github.com/mendixlabs/mxcli/sdk/workflows"
@@ -85,6 +87,13 @@ func execAlterWorkflow(ctx *ExecContext, s *ast.AlterWorkflowStmt) error {
 		return mdlerrors.NewBackend("open workflow for mutation", err)
 	}
 
+	// Resolve every operation's target before changing anything (the generic
+	// ALTER, ADR-0012): a miss or an ambiguity refuses the statement, listing
+	// the matches, instead of leaving the operations before it applied.
+	if err := resolveAlterWorkflowTargets(mutator, s); err != nil {
+		return err
+	}
+
 	// Apply operations sequentially
 	for _, op := range s.Operations {
 		switch o := op.(type) {
@@ -127,7 +136,7 @@ func execAlterWorkflow(ctx *ExecContext, s *ast.AlterWorkflowStmt) error {
 			}
 
 		case *ast.InsertAfterOp:
-			acts := buildAndBindActivities(ctx, []ast.WorkflowActivityNode{o.NewActivity})
+			acts := buildAndBindActivities(ctx, o.NewActivities)
 			if len(acts) == 0 {
 				return mdlerrors.NewValidation("failed to build new activity")
 			}
@@ -135,13 +144,22 @@ func execAlterWorkflow(ctx *ExecContext, s *ast.AlterWorkflowStmt) error {
 				return mdlerrors.NewBackend("insert after", err)
 			}
 
+		case *ast.InsertBeforeOp:
+			acts := buildAndBindActivities(ctx, o.NewActivities)
+			if len(acts) == 0 {
+				return mdlerrors.NewValidation("failed to build new activity")
+			}
+			if err := mutator.InsertBeforeActivity(o.ActivityRef, o.AtPosition, acts); err != nil {
+				return mdlerrors.NewBackend("insert before", err)
+			}
+
 		case *ast.DropActivityOp:
 			if err := mutator.DropActivity(o.ActivityRef, o.AtPosition); err != nil {
 				return mdlerrors.NewBackend("drop activity", err)
 			}
 
 		case *ast.ReplaceActivityOp:
-			acts := buildAndBindActivities(ctx, []ast.WorkflowActivityNode{o.NewActivity})
+			acts := buildAndBindActivities(ctx, o.NewActivities)
 			if len(acts) == 0 {
 				return mdlerrors.NewValidation("failed to build replacement activity")
 			}
@@ -214,6 +232,93 @@ func execAlterWorkflow(ctx *ExecContext, s *ast.AlterWorkflowStmt) error {
 	return nil
 }
 
+// alterWorkflowOpTarget returns the activity an operation addresses, as the
+// generic target it was written as; ok is false for a workflow-level SET.
+func alterWorkflowOpTarget(op ast.AlterWorkflowOp) (backend.AlterTarget, bool) {
+	var ref string
+	var pos int
+	switch o := op.(type) {
+	case *ast.SetActivityPropertyOp:
+		ref, pos = o.ActivityRef, o.AtPosition
+	case *ast.InsertAfterOp:
+		ref, pos = o.ActivityRef, o.AtPosition
+	case *ast.InsertBeforeOp:
+		ref, pos = o.ActivityRef, o.AtPosition
+	case *ast.DropActivityOp:
+		ref, pos = o.ActivityRef, o.AtPosition
+	case *ast.ReplaceActivityOp:
+		ref, pos = o.ActivityRef, o.AtPosition
+	case *ast.InsertOutcomeOp:
+		ref, pos = o.ActivityRef, o.AtPosition
+	case *ast.DropOutcomeOp:
+		ref, pos = o.ActivityRef, o.AtPosition
+	case *ast.InsertPathOp:
+		ref, pos = o.ActivityRef, o.AtPosition
+	case *ast.DropPathOp:
+		ref, pos = o.ActivityRef, o.AtPosition
+	case *ast.InsertBranchOp:
+		ref, pos = o.ActivityRef, o.AtPosition
+	case *ast.DropBranchOp:
+		ref, pos = o.ActivityRef, o.AtPosition
+	case *ast.InsertBoundaryEventOp:
+		ref, pos = o.ActivityRef, o.AtPosition
+	case *ast.DropBoundaryEventOp:
+		ref, pos = o.ActivityRef, o.AtPosition
+	default:
+		return backend.AlterTarget{}, false
+	}
+	// A name and a caption are compared alike (a name wins); the target
+	// carries the text as a name so the resolver's messages print it bare.
+	return backend.AlterTarget{Path: []string{ref}, Ordinal: pos}, true
+}
+
+// resolveAlterWorkflowTargets resolves every operation's target against the
+// stored workflow as it stands before the statement. An operation that targets
+// an activity an earlier operation of the same statement inserted is resolved
+// when it is applied instead, by the mutator's own lookup.
+func resolveAlterWorkflowTargets(resolver backend.AlterTargetResolver, s *ast.AlterWorkflowStmt) error {
+	inserted := map[string]bool{}
+	for _, op := range s.Operations {
+		if t, ok := alterWorkflowOpTarget(op); ok && !inserted[backend.WorkflowTargetText(t)] {
+			if _, err := resolver.ResolveAlterTarget(t); err != nil {
+				return mdlerrors.NewValidationf("alter workflow %s: %v", s.Name.String(), err)
+			}
+		}
+		for _, n := range alterWorkflowOpNewNames(op) {
+			inserted[n] = true
+		}
+	}
+	return nil
+}
+
+// alterWorkflowOpNewNames lists the names and captions of the activities an
+// operation adds at the top of its fragment.
+func alterWorkflowOpNewNames(op ast.AlterWorkflowOp) []string {
+	var acts []ast.WorkflowActivityNode
+	switch o := op.(type) {
+	case *ast.InsertAfterOp:
+		acts = o.NewActivities
+	case *ast.InsertBeforeOp:
+		acts = o.NewActivities
+	case *ast.ReplaceActivityOp:
+		acts = o.NewActivities
+	case *ast.InsertOutcomeOp:
+		acts = o.Activities
+	case *ast.InsertPathOp:
+		acts = o.Activities
+	case *ast.InsertBranchOp:
+		acts = o.Activities
+	case *ast.InsertBoundaryEventOp:
+		acts = o.Activities
+	}
+	var out []string
+	for _, a := range acts {
+		name, caption := workflowActivityNodeLabels(a)
+		out = append(out, name, caption)
+	}
+	return out
+}
+
 // buildAndBindActivities builds workflow activities from AST nodes and auto-binds parameters.
 func buildAndBindActivities(ctx *ExecContext, nodes []ast.WorkflowActivityNode) []workflows.WorkflowActivity {
 	acts := buildWorkflowActivities(nodes)
@@ -222,3 +327,23 @@ func buildAndBindActivities(ctx *ExecContext, nodes []ast.WorkflowActivityNode)
 	autoBindActivitiesInFlow(ctx, acts, contextExprNormalizer{})
 	return acts
 }
+
+// workflowActivityNodeLabels reads an activity node's Name and Caption, the
+// two texts a target can match. Every activity node carries them under those
+// field names; a node without one yields "".
+func workflowActivityNodeLabels(a ast.WorkflowActivityNode) (name, caption string) {
+	v := reflect.ValueOf(a)
+	if v.Kind() == reflect.Pointer {
+		v = v.Elem()
+	}
+	if v.Kind() != reflect.Struct {
+		return "", ""
+	}
+	if f := v.FieldByName("Name"); f.IsValid() && f.Kind() == reflect.String {
+		name = f.String()
+	}
+	if f := v.FieldByName("Caption"); f.IsValid() && f.Kind() == reflect.String {
+		caption = f.String()
+	}
+	return name, caption
+}
diff --git a/mdl/executor/cmd_create_guard.go b/mdl/executor/cmd_create_guard.go
new file mode 100644
index 0000000000..f6732b2c75
--- /dev/null
+++ b/mdl/executor/cmd_create_guard.go
@@ -0,0 +1,306 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package executor
+
+import (
+	"fmt"
+	"reflect"
+	"strings"
+
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	mdlerrors "github.com/mendixlabs/mxcli/mdl/errors"
+	"github.com/mendixlabs/mxcli/mdl/linter"
+	"github.com/mendixlabs/mxcli/model"
+)
+
+// createGuardTarget is what `create … if not exists` tests before the handler
+// runs: the element's kind and name as the author wrote them, and a probe for
+// whether the project already has it.
+type createGuardTarget struct {
+	kind   string
+	name   string
+	exists func(ctx *ExecContext) (bool, error)
+}
+
+// skipExistingCreate honours `create … if not exists` (ako/mxcli#731, ADR-0010
+// R1): when the named element already exists, the statement is skipped and the
+// stored element is left exactly as it is; otherwise the handler creates it as
+// a plain `create` would. It reports whether the statement was skipped.
+//
+// It runs once, in the dispatch, for every statement that embeds
+// ast.CreateGuard — the same place `drop … if exists` is honoured — so a new
+// document type gets the guard by embedding it rather than by each handler
+// remembering to test it.
+//
+// A probe that cannot answer is an error, not a "no": creating on a guess is
+// exactly what the guard promises not to do.
+func skipExistingCreate(ctx *ExecContext, stmt ast.Statement) (bool, error) {
+	g, ok := stmt.(ast.IfNotExistsCreate)
+	if !ok || !g.CreateIfNotExists() || !ctx.Connected() {
+		return false, nil
+	}
+	target, ok := createGuardTargetOf(stmt)
+	if !ok {
+		// Entities and associations test the guard in their own handlers, which
+		// also know the cross-module association forms.
+		return false, nil
+	}
+	exists, err := target.exists(ctx)
+	if err != nil {
+		return false, mdlerrors.NewBackend(fmt.Sprintf("check whether %s %s exists", target.kind, target.name), err)
+	}
+	if !exists {
+		return false, nil
+	}
+	fmt.Fprintf(ctx.Output, "%s %s already exists, skipped (if not exists)\n", target.kind, target.name)
+	return true, nil
+}
+
+// createGuardTargetOf names the element a guarded create would make. ok is
+// false for a statement whose handler tests the guard itself.
+func createGuardTargetOf(stmt ast.Statement) (createGuardTarget, bool) {
+	doc := func(kind string, qn ast.QualifiedName, list func(*ExecContext) (any, error)) (createGuardTarget, bool) {
+		return createGuardTarget{kind: kind, name: qn.String(), exists: func(ctx *ExecContext) (bool, error) {
+			items, err := list(ctx)
+			if err != nil {
+				return false, err
+			}
+			return documentListed(ctx, items, qn)
+		}}, true
+	}
+	switch s := stmt.(type) {
+	case *ast.CreateEntityStmt, *ast.CreateAssociationStmt:
+		return createGuardTarget{}, false
+	case *ast.CreateViewEntityStmt:
+		return entityGuardTarget("view entity", s.Name), true
+	case *ast.CreateExternalEntityStmt:
+		return entityGuardTarget("external entity", s.Name), true
+	case *ast.CreateModuleStmt:
+		return createGuardTarget{kind: "module", name: s.Name, exists: func(ctx *ExecContext) (bool, error) {
+			mods, err := ctx.Backend.ListModules()
+			if err != nil {
+				return false, err
+			}
+			for _, m := range mods {
+				if m != nil && strings.EqualFold(m.Name, s.Name) {
+					return true, nil
+				}
+			}
+			return false, nil
+		}}, true
+	case *ast.CreateModuleRoleStmt:
+		return createGuardTarget{kind: "module role", name: s.Name.String(), exists: func(ctx *ExecContext) (bool, error) {
+			mod, err := findModule(ctx, s.Name.Module)
+			if err != nil {
+				// No module, no role: let the handler report the module.
+				return false, nil
+			}
+			ms, err := ctx.Backend.GetModuleSecurity(mod.ID)
+			if err != nil || ms == nil {
+				return false, err
+			}
+			for _, mr := range ms.ModuleRoles {
+				// Role names are case-insensitive (CE0123), as in the handler. An
+				// auto-provisioned role is not the author's: the handler adopts it.
+				if mr != nil && strings.EqualFold(mr.Name, s.Name.Name) && mr.Description != autoDocumentRoleDescription {
+					return true, nil
+				}
+			}
+			return false, nil
+		}}, true
+	case *ast.CreateUserRoleStmt:
+		return createGuardTarget{kind: "user role", name: s.Name, exists: func(ctx *ExecContext) (bool, error) {
+			ps, err := ctx.Backend.GetProjectSecurity()
+			if err != nil || ps == nil {
+				return false, err
+			}
+			for _, ur := range ps.UserRoles {
+				if ur != nil && ur.Name == s.Name {
+					return true, nil
+				}
+			}
+			return false, nil
+		}}, true
+	case *ast.CreateDemoUserStmt:
+		return createGuardTarget{kind: "demo user", name: s.UserName, exists: func(ctx *ExecContext) (bool, error) {
+			ps, err := ctx.Backend.GetProjectSecurity()
+			if err != nil || ps == nil {
+				return false, err
+			}
+			for _, du := range ps.DemoUsers {
+				if du != nil && du.UserName == s.UserName {
+					return true, nil
+				}
+			}
+			return false, nil
+		}}, true
+	case *ast.CreateConfigurationStmt:
+		return createGuardTarget{kind: "configuration", name: s.Name, exists: func(ctx *ExecContext) (bool, error) {
+			ps, err := ctx.Backend.GetProjectSettings()
+			if err != nil || ps == nil || ps.Configuration == nil {
+				return false, err
+			}
+			for _, cfg := range ps.Configuration.Configurations {
+				if cfg != nil && strings.EqualFold(cfg.Name, s.Name) {
+					return true, nil
+				}
+			}
+			return false, nil
+		}}, true
+	case *ast.CreateMicroflowStmt:
+		return doc("microflow", s.Name, func(ctx *ExecContext) (any, error) { return ctx.Backend.ListMicroflows() })
+	case *ast.CreateNanoflowStmt:
+		return doc("nanoflow", s.Name, func(ctx *ExecContext) (any, error) { return ctx.Backend.ListNanoflows() })
+	case *ast.CreateRuleStmt:
+		return doc("rule", s.Name, func(ctx *ExecContext) (any, error) { return ctx.Backend.ListRules() })
+	case *ast.CreateJavaActionStmt:
+		return doc("java action", s.Name, func(ctx *ExecContext) (any, error) { return ctx.Backend.ListJavaActions() })
+	case *ast.CreateJavaScriptActionStmt:
+		return doc("javascript action", s.Name, func(ctx *ExecContext) (any, error) { return ctx.Backend.ListJavaScriptActions() })
+	case *ast.CreatePageStmtV3:
+		return doc("page", s.Name, func(ctx *ExecContext) (any, error) { return ctx.Backend.ListPages() })
+	case *ast.CreateSnippetStmtV3:
+		return doc("snippet", s.Name, func(ctx *ExecContext) (any, error) { return ctx.Backend.ListSnippets() })
+	case *ast.CreateLayoutStmt:
+		return doc("layout", s.Name, func(ctx *ExecContext) (any, error) { return ctx.Backend.ListLayouts() })
+	case *ast.CreateEnumerationStmt:
+		return doc("enumeration", s.Name, func(ctx *ExecContext) (any, error) { return ctx.Backend.ListEnumerations() })
+	case *ast.CreateConstantStmt:
+		return doc("constant", s.Name, func(ctx *ExecContext) (any, error) { return ctx.Backend.ListConstants() })
+	case *ast.CreateDatabaseConnectionStmt:
+		return doc("database connection", s.Name, func(ctx *ExecContext) (any, error) { return ctx.Backend.ListDatabaseConnections() })
+	case *ast.CreateRestClientStmt:
+		return doc("rest client", s.Name, func(ctx *ExecContext) (any, error) { return ctx.Backend.ListConsumedRestServices() })
+	case *ast.CreatePublishedRestServiceStmt:
+		return doc("published rest service", s.Name, func(ctx *ExecContext) (any, error) { return ctx.Backend.ListPublishedRestServices() })
+	case *ast.CreateODataClientStmt:
+		return doc("odata client", s.Name, func(ctx *ExecContext) (any, error) { return ctx.Backend.ListConsumedODataServices() })
+	case *ast.CreateODataServiceStmt:
+		return doc("odata service", s.Name, func(ctx *ExecContext) (any, error) { return ctx.Backend.ListPublishedODataServices() })
+	case *ast.CreateBusinessEventServiceStmt:
+		return doc("business event service", s.Name, func(ctx *ExecContext) (any, error) { return ctx.Backend.ListBusinessEventServices() })
+	case *ast.CreateWorkflowStmt:
+		return doc("workflow", s.Name, func(ctx *ExecContext) (any, error) { return ctx.Backend.ListWorkflows() })
+	case *ast.CreateImageCollectionStmt:
+		return doc("image collection", s.Name, func(ctx *ExecContext) (any, error) { return ctx.Backend.ListImageCollections() })
+	case *ast.CreateQueueStmt:
+		return doc("task queue", s.Name, func(ctx *ExecContext) (any, error) { return ctx.Backend.ListQueues() })
+	case *ast.CreateScheduledEventStmt:
+		return doc("scheduled event", s.Name, func(ctx *ExecContext) (any, error) { return ctx.Backend.ListScheduledEvents() })
+	case *ast.CreateRegularExpressionStmt:
+		return doc("regular expression", s.Name, func(ctx *ExecContext) (any, error) { return ctx.Backend.ListRegularExpressions() })
+	case *ast.CreateJsonStructureStmt:
+		return doc("json structure", s.Name, func(ctx *ExecContext) (any, error) { return ctx.Backend.ListJsonStructures() })
+	case *ast.CreateMessageDefinitionCollectionStmt:
+		return doc("message definition collection", s.Name, func(ctx *ExecContext) (any, error) { return ctx.Backend.ListMessageDefinitionCollections() })
+	case *ast.CreateImportMappingStmt:
+		return doc("import mapping", s.Name, func(ctx *ExecContext) (any, error) { return ctx.Backend.ListImportMappings() })
+	case *ast.CreateExportMappingStmt:
+		return doc("export mapping", s.Name, func(ctx *ExecContext) (any, error) { return ctx.Backend.ListExportMappings() })
+	case *ast.CreateDataTransformerStmt:
+		return doc("data transformer", s.Name, func(ctx *ExecContext) (any, error) { return ctx.Backend.ListDataTransformers() })
+	case *ast.CreateModelStmt:
+		return doc("model", s.Name, func(ctx *ExecContext) (any, error) { return ctx.Backend.ListAgentEditorModels() })
+	case *ast.CreateConsumedMCPServiceStmt:
+		return doc("consumed mcp service", s.Name, func(ctx *ExecContext) (any, error) { return ctx.Backend.ListAgentEditorConsumedMCPServices() })
+	case *ast.CreateKnowledgeBaseStmt:
+		return doc("knowledge base", s.Name, func(ctx *ExecContext) (any, error) { return ctx.Backend.ListAgentEditorKnowledgeBases() })
+	case *ast.CreateAgentStmt:
+		return doc("agent", s.Name, func(ctx *ExecContext) (any, error) { return ctx.Backend.ListAgentEditorAgents() })
+	case *ast.CreateMenuStmt:
+		return doc("menu", s.Name, func(ctx *ExecContext) (any, error) { return ctx.Backend.ListMenuDocuments() })
+	}
+	// A statement that embeds the guard but is not listed here would have it
+	// silently ignored; TestCreateGuardTargetCoversEveryGuardedStatement fails
+	// first. At run time, refuse rather than create on a guess.
+	return createGuardTarget{kind: fmt.Sprintf("%T", stmt), exists: func(*ExecContext) (bool, error) {
+		return false, fmt.Errorf("`if not exists` has no existence check for %T", stmt)
+	}}, true
+}
+
+// entityGuardTarget probes the domain models for an entity of any kind: a view
+// or external entity shares its name space with every other entity.
+func entityGuardTarget(kind string, qn ast.QualifiedName) createGuardTarget {
+	return createGuardTarget{kind: kind, name: qn.String(), exists: func(ctx *ExecContext) (bool, error) {
+		mod, err := findModule(ctx, qn.Module)
+		if err != nil {
+			return false, nil // the handler reports the missing module
+		}
+		dms, err := ctx.Backend.ListDomainModels()
+		if err != nil {
+			return false, err
+		}
+		for _, dm := range dms {
+			if dm == nil || dm.ContainerID != mod.ID {
+				continue
+			}
+			for _, e := range dm.Entities {
+				if e != nil && strings.EqualFold(e.Name, qn.Name) {
+					return true, nil
+				}
+			}
+		}
+		return false, nil
+	}}
+}
+
+// documentListed reports whether items — a slice of pointers to document
+// structs, each with a ContainerID and a Name, as every Backend.List* returns —
+// holds the document qn. Names compare case-insensitively: Mendix refuses two
+// documents in one module whose names differ only in case, so an element that
+// matches that way is the one a create would collide with.
+func documentListed(ctx *ExecContext, items any, qn ast.QualifiedName) (bool, error) {
+	h, err := getHierarchy(ctx)
+	if err != nil {
+		return false, err
+	}
+	if h == nil {
+		return false, fmt.Errorf("no project hierarchy")
+	}
+	want := qn.String()
+	v := reflect.ValueOf(items)
+	if v.Kind() != reflect.Slice {
+		return false, fmt.Errorf("document list is %T, not a slice", items)
+	}
+	for i := 0; i < v.Len(); i++ {
+		e := v.Index(i)
+		if e.Kind() == reflect.Pointer {
+			if e.IsNil() {
+				continue
+			}
+			e = e.Elem()
+		}
+		if e.Kind() != reflect.Struct {
+			return false, fmt.Errorf("document list element is %s, not a struct", e.Type())
+		}
+		cid, name := e.FieldByName("ContainerID"), e.FieldByName("Name")
+		if !cid.IsValid() || !name.IsValid() {
+			return false, fmt.Errorf("document list element %s has no ContainerID or Name", e.Type())
+		}
+		id, ok := cid.Interface().(model.ID)
+		if !ok {
+			return false, fmt.Errorf("%s.ContainerID is %s, not model.ID", e.Type(), cid.Type())
+		}
+		if strings.EqualFold(h.GetQualifiedName(id, name.String()), want) {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+// validateCreateGuardContradiction reports `create or modify … if not exists`
+// (MDL067) on every guarded document kind. The two guards contradict each
+// other: `or modify` makes the stored element match the statement, `if not
+// exists` leaves it untouched, and which one wins is not readable from the
+// statement. Entities and associations report it from their own flags.
+func validateCreateGuardContradiction(stmt ast.Statement) []linter.Violation {
+	g, ok := stmt.(ast.IfNotExistsCreate)
+	if !ok || !g.CreateGuardContradicts() {
+		return nil
+	}
+	target, ok := createGuardTargetOf(stmt)
+	if !ok {
+		return nil
+	}
+	return validateIdempotencyGuard(true, true, target.kind, target.name)
+}
diff --git a/mdl/executor/cmd_dbconnection.go b/mdl/executor/cmd_dbconnection.go
index afcef20f00..b9441a95d9 100644
--- a/mdl/executor/cmd_dbconnection.go
+++ b/mdl/executor/cmd_dbconnection.go
@@ -237,72 +237,59 @@ func describeDatabaseConnection(ctx *ExecContext, name ast.QualifiedName) error
 
 // outputDatabaseConnectionMDL outputs a database connection definition in MDL format.
 func outputDatabaseConnectionMDL(ctx *ExecContext, conn *model.DatabaseConnection, moduleName string) error {
-	fmt.Fprintf(ctx.Output, "create or modify database connection %s.%s%s\n", moduleName, conn.Name, describeFolderClause(ctx, conn.ContainerID))
-	fmt.Fprintf(ctx.Output, "type '%s'\n", conn.DatabaseType)
-
-	// Connection string
-	fmt.Fprintf(ctx.Output, "connection string @%s\n", conn.ConnectionString)
-
-	// Username
-	fmt.Fprintf(ctx.Output, "username @%s\n", conn.UserName)
-
-	// Password
-	fmt.Fprintf(ctx.Output, "password @%s\n", conn.Password)
-
-	// Queries
-	if len(conn.Queries) > 0 {
-		fmt.Fprintln(ctx.Output, "begin")
-		for _, q := range conn.Queries {
-			fmt.Fprintf(ctx.Output, "  query %s\n", q.Name)
-
-			// SQL string
-			if q.SQL != "" {
-				escaped := strings.ReplaceAll(q.SQL, "'", "''")
-				fmt.Fprintf(ctx.Output, "    sql '%s'\n", escaped)
-			}
-
-			// PARAMETER clauses
+	// R2 (ako/mxcli#754): the connection's properties in ( ), its queries as
+	// children in { }, each query's properties in its own ( ).
+	w := ctx.Output
+	fmt.Fprintf(w, "create or modify database connection %s.%s%s (\n", moduleName, conn.Name, describeFolderClause(ctx, conn.ContainerID))
+	fmt.Fprintf(w, "  Type: %s,\n", mdlQuoted(conn.DatabaseType))
+	fmt.Fprintf(w, "  ConnectionString: @%s,\n", conn.ConnectionString)
+	fmt.Fprintf(w, "  Username: @%s,\n", conn.UserName)
+	fmt.Fprintf(w, "  Password: @%s\n", conn.Password)
+
+	if len(conn.Queries) == 0 {
+		fmt.Fprintln(w, ");")
+		return nil
+	}
+	fmt.Fprintln(w, ") {")
+	for _, q := range conn.Queries {
+		var props []string
+		if q.SQL != "" {
+			props = append(props, "Sql: "+mdlQuoted(q.SQL))
+		}
+		if len(q.Parameters) > 0 {
+			var params []string
 			for _, p := range q.Parameters {
-				typeName := dbTypeToMDLType(p.DataType)
+				param := fmt.Sprintf("%s: %s", p.ParameterName, dbTypeToMDLType(p.DataType))
 				if p.EmptyValueBecomesNull {
-					fmt.Fprintf(ctx.Output, "    parameter %s: %s null\n", p.ParameterName, typeName)
+					param += " null"
 				} else if p.DefaultValue != "" {
-					escaped := strings.ReplaceAll(p.DefaultValue, "'", "''")
-					fmt.Fprintf(ctx.Output, "    parameter %s: %s default '%s'\n", p.ParameterName, typeName, escaped)
-				} else {
-					fmt.Fprintf(ctx.Output, "    parameter %s: %s\n", p.ParameterName, typeName)
+					param += " default " + mdlQuoted(p.DefaultValue)
 				}
+				params = append(params, param)
 			}
-
-			// RETURNS and MAP from table mapping
-			if len(q.TableMappings) > 0 {
-				tm := q.TableMappings[0]
-				fmt.Fprintf(ctx.Output, "    returns %s\n", tm.Entity)
-
-				// MAP clause
-				if len(tm.Columns) > 0 {
-					fmt.Fprintln(ctx.Output, "    map (")
-					for i, c := range tm.Columns {
-						// Extract attribute name from qualified ref (Module.Entity.Attr → Attr)
-						attrName := c.Attribute
-						if parts := strings.Split(attrName, "."); len(parts) >= 3 {
-							attrName = parts[len(parts)-1]
-						}
-						sep := ","
-						if i == len(tm.Columns)-1 {
-							sep = ""
-						}
-						fmt.Fprintf(ctx.Output, "      %s as %s%s\n", c.ColumnName, attrName, sep)
+			props = append(props, "Parameters: ( "+strings.Join(params, ", ")+" )")
+		}
+		if len(q.TableMappings) > 0 {
+			tm := q.TableMappings[0]
+			props = append(props, "Returns: "+tm.Entity)
+			if len(tm.Columns) > 0 {
+				var cols []string
+				for _, c := range tm.Columns {
+					// Extract attribute name from qualified ref (Module.Entity.Attr → Attr)
+					attrName := c.Attribute
+					if parts := strings.Split(attrName, "."); len(parts) >= 3 {
+						attrName = parts[len(parts)-1]
 					}
-					fmt.Fprintln(ctx.Output, "    )")
+					// A column map binds the attribute to the column, as a
+					// mapping side does: Attr = column.
+					cols = append(cols, fmt.Sprintf("%s = %s", attrName, c.ColumnName))
 				}
+				props = append(props, "Map: (\n      "+strings.Join(cols, ",\n      ")+"\n    )")
 			}
-			fmt.Fprintln(ctx.Output, "  ;")
 		}
-		fmt.Fprintln(ctx.Output, "end")
+		fmt.Fprintf(w, "  query %s (\n    %s\n  )\n", q.Name, strings.Join(props, ",\n    "))
 	}
-
-	fmt.Fprintln(ctx.Output, ";")
+	fmt.Fprintln(w, "};")
 
 	return nil
 }
diff --git a/mdl/executor/cmd_diff.go b/mdl/executor/cmd_diff.go
index 816692dff6..c145dc79b0 100644
--- a/mdl/executor/cmd_diff.go
+++ b/mdl/executor/cmd_diff.go
@@ -106,6 +106,13 @@ func diffProgram(ctx *ExecContext, prog *ast.Program, opts DiffOptions) error {
 			continue
 		}
 		if result != nil {
+			// CREATE … IF NOT EXISTS on an element that is already there is
+			// skipped by exec and leaves the element untouched (#731), so what
+			// the script would leave behind is what is stored now.
+			if g, ok := stmt.(ast.IfNotExistsCreate); ok && g.CreateIfNotExists() && !result.IsNew {
+				result.Proposed = result.Current
+				result.Changes = nil
+			}
 			// Create unique key for deduplication
 			key := result.ObjectType + ":" + result.ObjectName.String()
 			if processed[key] {
diff --git a/mdl/executor/cmd_diff_if_not_exists_test.go b/mdl/executor/cmd_diff_if_not_exists_test.go
new file mode 100644
index 0000000000..af81992aa9
--- /dev/null
+++ b/mdl/executor/cmd_diff_if_not_exists_test.go
@@ -0,0 +1,62 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package executor
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/backend/mock"
+	"github.com/mendixlabs/mxcli/mdl/visitor"
+	"github.com/mendixlabs/mxcli/model"
+)
+
+// diffEnumScript diffs src against a project holding enumeration M.E (Red).
+func diffEnumScript(t *testing.T, src string) string {
+	t.Helper()
+	mod := mkModule("M")
+	enum := mkEnumeration(mod.ID, "E", "Red")
+	mb := &mock.MockBackend{
+		IsConnectedFunc:      func() bool { return true },
+		ListModulesFunc:      func() ([]*model.Module, error) { return []*model.Module{mod}, nil },
+		ListEnumerationsFunc: func() ([]*model.Enumeration, error) { return []*model.Enumeration{enum}, nil },
+	}
+	ctx, out := newMockCtx(t, withBackend(mb), withHierarchy(mkHierarchy(mod)))
+	prog, errs := visitor.Build(src)
+	if len(errs) > 0 {
+		t.Fatalf("parse %q: %v", src, errs)
+	}
+	if err := diffProgram(ctx, prog, DiffOptions{}); err != nil {
+		t.Fatalf("diff: %v", err)
+	}
+	return out.String()
+}
+
+// diff is the pre-apply view of exec, so a guarded create of an element that
+// already exists — which exec skips and leaves untouched (ako/mxcli#731) — is
+// unchanged, not modified.
+func TestDiff_CreateIfNotExistsOnExistingElementIsUnchanged(t *testing.T) {
+	out := diffEnumScript(t, "create enumeration if not exists M.E (Blue 'Blue');")
+	if !strings.Contains(out, "Summary: 0 new, 0 modified, 1 unchanged") {
+		t.Errorf("a guarded create of an existing element must diff as unchanged; got:\n%s", out)
+	}
+	if strings.Contains(out, "Blue") {
+		t.Errorf("diff shows the script's definition, which exec will not apply:\n%s", out)
+	}
+}
+
+// CONTROL: without the guard the same statement is a modification.
+func TestDiff_UnguardedCreateOnExistingElementIsModified(t *testing.T) {
+	out := diffEnumScript(t, "create or modify enumeration M.E (Blue 'Blue');")
+	if !strings.Contains(out, "Summary: 0 new, 1 modified, 0 unchanged") {
+		t.Errorf("control: an unguarded create of a changed element must diff as modified; got:\n%s", out)
+	}
+}
+
+// CONTROL: a guarded create of an absent element is new.
+func TestDiff_CreateIfNotExistsOnAbsentElementIsNew(t *testing.T) {
+	out := diffEnumScript(t, "create enumeration if not exists M.F (Blue 'Blue');")
+	if !strings.Contains(out, "Summary: 1 new, 0 modified, 0 unchanged") {
+		t.Errorf("a guarded create of an absent element must diff as new; got:\n%s", out)
+	}
+}
diff --git a/mdl/executor/cmd_imagecollections.go b/mdl/executor/cmd_imagecollections.go
index a723840ffc..466ca9249d 100644
--- a/mdl/executor/cmd_imagecollections.go
+++ b/mdl/executor/cmd_imagecollections.go
@@ -4,6 +4,8 @@
 package executor
 
 import (
+	"bytes"
+	"encoding/base64"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -59,21 +61,26 @@ func execCreateImageCollection(ctx *ExecContext, s *ast.CreateImageCollectionStm
 		ic.Excluded = existing.Excluded
 	}
 
-	// Load image files
+	// Load the images: inline Data (what describe writes), or a file, which a
+	// relative path names relative to the script, as `execute script` does.
 	for _, item := range s.Images {
-		filePath := item.FilePath
-		if !filepath.IsAbs(filePath) {
-			cwd, err := os.Getwd()
+		data, format := item.Data, item.Format
+		if !item.HasData {
+			filePath, err := ctx.ResolveScriptRelative(item.FilePath)
 			if err != nil {
-				return mdlerrors.NewBackend("get working directory", err)
+				return err
+			}
+			data, err = os.ReadFile(filePath)
+			if err != nil {
+				return mdlerrors.NewBackend(fmt.Sprintf("read image file %q", item.FilePath), err)
+			}
+			if format == "" {
+				format = extToImageFormat(filepath.Ext(filePath))
 			}
-			filePath = filepath.Join(cwd, filePath)
 		}
-		data, err := os.ReadFile(filePath)
-		if err != nil {
-			return mdlerrors.NewBackend(fmt.Sprintf("read image file %q", item.FilePath), err)
+		if format == "" {
+			format = sniffImageFormat(data)
 		}
-		format := extToImageFormat(filepath.Ext(filePath))
 		ic.Images = append(ic.Images, types.Image{
 			Name:   item.Name,
 			Data:   data,
@@ -154,52 +161,29 @@ func describeImageCollection(ctx *ExecContext, name ast.QualifiedName) error {
 		return nil
 	}
 
-	// Write image data to temp files and output CREATE statement with IMAGE lines
-	previewDir := filepath.Join("/tmp/mxcli-preview", qualifiedName)
-	if err := os.MkdirAll(previewDir, 0o755); err != nil {
-		return mdlerrors.NewBackend("create preview directory", err)
-	}
-
 	fmt.Fprintf(ctx.Output, "create or modify image collection %s%s", qualifiedName, describeFolderClause(ctx, ic.ContainerID))
 	if exportLevel != "Hidden" {
 		fmt.Fprintf(ctx.Output, " export level '%s'", exportLevel)
 	}
 	fmt.Fprintln(ctx.Output, " {")
 
+	// The images are written into the statement, base64-encoded. They used to
+	// be written to /tmp/mxcli-preview and named by that path, so the output
+	// only replayed on the machine that described it, until /tmp was cleared,
+	// and a diff of it showed a path rather than a changed image
+	// (ako/mxcli#707). Format is written only where the bytes do not say it.
 	for _, img := range ic.Images {
-		ext := imageFormatToExt(img.Format)
-		filePath := filepath.Join(previewDir, img.Name+ext)
-		if len(img.Data) > 0 {
-			if err := os.WriteFile(filePath, img.Data, 0o644); err != nil {
-				return mdlerrors.NewBackend(fmt.Sprintf("write image %s", img.Name), err)
-			}
+		props := "Data: '" + base64.StdEncoding.EncodeToString(img.Data) + "'"
+		if f := img.Format; f != "" && f != sniffImageFormat(img.Data) {
+			props += ", Format: " + strings.ToLower(f)
 		}
-
-		fmt.Fprintf(ctx.Output, "  image %s ( File: '%s' )\n", img.Name, filePath)
+		fmt.Fprintf(ctx.Output, "  image %s ( %s )\n", mdlIdent(img.Name), props)
 	}
 
 	fmt.Fprintln(ctx.Output, "};")
 	return nil
 }
 
-// imageFormatToExt converts a Mendix ImageFormat value to a file extension.
-func imageFormatToExt(format string) string {
-	switch format {
-	case "Svg":
-		return ".svg"
-	case "Gif":
-		return ".gif"
-	case "Jpg":
-		return ".jpg"
-	case "Bmp":
-		return ".bmp"
-	case "Webp":
-		return ".webp"
-	default:
-		return ".png"
-	}
-}
-
 // extToImageFormat converts a file extension to a Mendix ImageFormat value.
 func extToImageFormat(ext string) string {
 	switch strings.ToLower(ext) {
@@ -274,3 +258,29 @@ func findImageCollection(ctx *ExecContext, moduleName, collectionName string) *t
 	}
 	return nil
 }
+
+// sniffImageFormat is the Mendix ImageFormat the bytes of an image declare
+// themselves: a PNG, JPEG, GIF, BMP or WebP signature, or an SVG document. ""
+// when they declare none.
+func sniffImageFormat(data []byte) string {
+	switch {
+	case bytes.HasPrefix(data, []byte("\x89PNG\r\n\x1a\n")):
+		return "Png"
+	case bytes.HasPrefix(data, []byte{0xFF, 0xD8, 0xFF}):
+		return "Jpg"
+	case bytes.HasPrefix(data, []byte("GIF87a")), bytes.HasPrefix(data, []byte("GIF89a")):
+		return "Gif"
+	case bytes.HasPrefix(data, []byte("BM")):
+		return "Bmp"
+	case len(data) >= 12 && bytes.Equal(data[0:4], []byte("RIFF")) && bytes.Equal(data[8:12], []byte("WEBP")):
+		return "Webp"
+	}
+	head := data
+	if len(head) > 512 {
+		head = head[:512]
+	}
+	if bytes.Contains(bytes.ToLower(head), []byte("<svg")) {
+		return "Svg"
+	}
+	return ""
+}
diff --git a/mdl/executor/cmd_menus.go b/mdl/executor/cmd_menus.go
index d985ab06cf..00fe00053b 100644
--- a/mdl/executor/cmd_menus.go
+++ b/mdl/executor/cmd_menus.go
@@ -43,13 +43,13 @@ func describeMenu(ctx *ExecContext, name ast.QualifiedName) error {
 
 	// Output is re-executable: the item syntax is the same one CREATE MENU
 	// accepts, so describe → exec → describe is a fixed point.
-	fmt.Fprintf(ctx.Output, "create or modify menu %s.%s%s (\n", name.Module, md.Name, describeFolderClause(ctx, md.ContainerID))
+	fmt.Fprintf(ctx.Output, "create or modify menu %s.%s%s {\n", name.Module, md.Name, describeFolderClause(ctx, md.ContainerID))
 	printMenuMDL(ctx.Output, md.Items, 1, "CREATE MENU")
-	fmt.Fprintln(ctx.Output, ");")
+	fmt.Fprintln(ctx.Output, "};")
 	return nil
 }
 
-// execCreateMenu handles CREATE [OR MODIFY] MENU Module.Name ( items ).
+// execCreateMenu handles CREATE [OR MODIFY] MENU Module.Name { items }.
 //
 // Like CREATE NAVIGATION, the item list is the document's complete contents, so
 // a modify replaces the items wholesale rather than merging. The existing
diff --git a/mdl/executor/cmd_menus_mock_test.go b/mdl/executor/cmd_menus_mock_test.go
index 95dd5c0e5f..500e9d57ee 100644
--- a/mdl/executor/cmd_menus_mock_test.go
+++ b/mdl/executor/cmd_menus_mock_test.go
@@ -62,13 +62,13 @@ func TestDescribeMenu_Nested(t *testing.T) {
 	out := buf.String()
 
 	// The output is re-executable, so it opens with the statement that recreates it.
-	assertContainsStr(t, out, "create or modify menu Atlas_Core.Main_Menu (")
-	assertContainsStr(t, out, "menu item 'Home' page MyModule.Home_Web icon Atlas_Core.Atlas.home;")
+	assertContainsStr(t, out, "create or modify menu Atlas_Core.Main_Menu {")
+	assertContainsStr(t, out, "menu item 'Home' ( OnClick: show page MyModule.Home_Web, Icon: Atlas_Core.Atlas.home )")
 
 	// A sub-menu opens a nested block and its children are indented one level in.
-	assertContainsStr(t, out, "menu 'Admin' (")
-	assertContainsStr(t, out, "    menu item 'Accounts' page Administration.Account_Overview;")
-	assertContainsStr(t, out, "    menu item 'Rebuild' microflow Administration.Rebuild;")
+	assertContainsStr(t, out, "menu 'Admin' {")
+	assertContainsStr(t, out, "    menu item 'Accounts' ( OnClick: show page Administration.Account_Overview )")
+	assertContainsStr(t, out, "    menu item 'Rebuild' ( OnClick: call microflow Administration.Rebuild )")
 
 	// The glyph icon is reported rather than dropped, and points at the statement
 	// that would have to reproduce it — CREATE MENU, not CREATE NAVIGATION.
@@ -83,8 +83,8 @@ func TestDescribeMenu_Empty(t *testing.T) {
 	ctx, buf := newMockCtx(t, withBackend(menuBackend(md)))
 	assertNoError(t, describeMenu(ctx, ast.QualifiedName{Module: "Atlas_Core", Name: "Empty_Menu"}))
 	// An empty menu still describes to a statement that recreates it.
-	assertContainsStr(t, buf.String(), "create or modify menu Atlas_Core.Empty_Menu (")
-	assertContainsStr(t, buf.String(), ");")
+	assertContainsStr(t, buf.String(), "create or modify menu Atlas_Core.Empty_Menu {")
+	assertContainsStr(t, buf.String(), "};")
 }
 
 func TestDescribeMenu_NotFound(t *testing.T) {
diff --git a/mdl/executor/cmd_microflows_builder_actions.go b/mdl/executor/cmd_microflows_builder_actions.go
index 1e3bc4e855..5b7670d7f2 100644
--- a/mdl/executor/cmd_microflows_builder_actions.go
+++ b/mdl/executor/cmd_microflows_builder_actions.go
@@ -550,6 +550,9 @@ func (fb *flowBuilder) addEnumSplit(s *ast.EnumSplitStmt) model.ID {
 				fb.nextConnectionPoint = ""
 				pendingCase = fb.nextFlowCase
 				fb.nextFlowCase = ""
+				// A branch statement's own anchor (prevAnchor) already carries its
+				// outgoing side; a nested if's exit anchor must not outlive it.
+				fb.nextFlowAnchor = nil
 			} else {
 				lastID = actID
 			}
@@ -722,6 +725,9 @@ func (fb *flowBuilder) addStructuredInheritanceSplit(s *ast.InheritanceSplitStmt
 				fb.nextConnectionPoint = ""
 				pendingCase = fb.nextFlowCase
 				fb.nextFlowCase = ""
+				// A branch statement's own anchor (prevAnchor) already carries its
+				// outgoing side; a nested if's exit anchor must not outlive it.
+				fb.nextFlowAnchor = nil
 			} else {
 				lastID = actID
 			}
diff --git a/mdl/executor/cmd_microflows_builder_control.go b/mdl/executor/cmd_microflows_builder_control.go
index a7be260d0c..7333155ca1 100644
--- a/mdl/executor/cmd_microflows_builder_control.go
+++ b/mdl/executor/cmd_microflows_builder_control.go
@@ -497,6 +497,10 @@ func (fb *flowBuilder) addIfStatement(s *ast.IfStmt) model.ID {
 		fb.posX = mergeX + MergeSize + HorizontalSpacing/2
 		fb.posY = centerY
 		fb.nextConnectionPoint = mergeID
+		// `@anchor(from: X)` on an if is the flow leaving it, which is the flow
+		// out of its merge (#767). Only the origin side: the if's `to:` is its
+		// incoming flow and must not become the next statement's.
+		fb.nextFlowAnchor = mergeExitFlowAnchor(s)
 	} else {
 		// No merge: the split's continuing branch connects directly to the next activity.
 		// Position after the split, past the downward branch's horizontal extent.
@@ -529,6 +533,16 @@ func (fb *flowBuilder) addIfStatement(s *ast.IfStmt) model.ID {
 	return splitID
 }
 
+// mergeExitFlowAnchor is the origin anchor an if's own `@anchor(from: X)` gives
+// the flow leaving its closing merge, or nil when it sets none.
+func mergeExitFlowAnchor(s *ast.IfStmt) *ast.FlowAnchors {
+	own := stmtOwnAnchor(s)
+	if own == nil || own.From == ast.AnchorSideUnset {
+		return nil
+	}
+	return &ast.FlowAnchors{From: own.From, To: ast.AnchorSideUnset}
+}
+
 // firstElseIsLeafActivity reports whether the ELSE body's first statement is
 // a plain activity (not a compound split/if/loop). Rejoining an error flow
 // onto a compound statement's internal split/merge would need extra plumbing
diff --git a/mdl/executor/cmd_microflows_merge_exit_anchor_test.go b/mdl/executor/cmd_microflows_merge_exit_anchor_test.go
new file mode 100644
index 0000000000..6bc73342f3
--- /dev/null
+++ b/mdl/executor/cmd_microflows_merge_exit_anchor_test.go
@@ -0,0 +1,175 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package executor
+
+import (
+	"os"
+	"sort"
+	"strings"
+	"testing"
+
+	"github.com/mendixlabs/mxcli/sdk/microflows"
+)
+
+// ako/mxcli#767. The flow LEAVING an if's closing merge has an anchor of its
+// own: when the next decision starts a new row it leaves the merge's bottom and
+// enters the decision's top. The full description wrote the entering side
+// (`@anchor(to: top)` on the next if) but had nowhere to write the leaving one,
+// so re-executing it drew the flow out of the merge's right side and back
+// across the row above. Every reader of the full description inherited that:
+// `layout flows`, the ELK view, diff, `with handles`, and create or modify's
+// diff.
+//
+// The complex-layout example is the reproduction the issue names: its long
+// validation chains wrap onto new rows, and each wrap is a merge-to-split flow.
+func TestDescribe_MergeExitAnchorRoundTrips(t *testing.T) {
+	exec, out := describeExecutor(t)
+	src, err := os.ReadFile("../../mdl-examples/doctype-tests/02c-complex-layout-examples.mdl")
+	if err != nil {
+		t.Fatal(err)
+	}
+	run(t, exec, string(src))
+
+	for _, name := range []string{
+		"CxLayout.CX_VAL_Factory",
+		"CxLayout.CX_VAL_EmailTemplate",
+		// Controls: flows of the same file with no merge-to-split wrap, which
+		// round-tripped before the fix as well.
+		"CxLayout.CX_POST_SurveySubmission",
+		"CxLayout.CX_ACT_BatchProcessFactories",
+	} {
+		t.Run(name, func(t *testing.T) {
+			stored := fullGeometry(t, exec, "microflow", name)
+			asCopy := func(mdl, suffix string) []string {
+				copyName := name + suffix
+				script := strings.Replace(withoutGrant(mdl), "microflow "+name+" ", "microflow "+copyName+" ", 1)
+				if !strings.Contains(script, copyName) {
+					t.Fatalf("could not rename the described microflow:\n%s", script)
+				}
+				run(t, exec, script)
+				return fullGeometry(t, exec, "microflow", copyName)
+			}
+
+			full, _, err := describeMicroflowToString(exec.newExecContext(t.Context()), flowQN(name))
+			if err != nil {
+				t.Fatal(err)
+			}
+			geometryDiff(t, "re-executing the full description", stored, asCopy(full, "_Full"))
+
+			canonical := describeText(t, exec, out, "describe microflow "+name+";")
+			geometryDiff(t, "re-executing the canonical description", stored, asCopy(canonical, "_Canonical"))
+		})
+	}
+}
+
+// geometryDiff is sameGeometry reporting only the lines that differ: these
+// flows have close to a hundred objects and flows each.
+func geometryDiff(t *testing.T, what string, before, after []string) {
+	t.Helper()
+	inBefore, inAfter := map[string]bool{}, map[string]bool{}
+	for _, l := range before {
+		inBefore[l] = true
+	}
+	for _, l := range after {
+		inAfter[l] = true
+	}
+	var diff []string
+	for _, l := range before {
+		if !inAfter[l] {
+			diff = append(diff, "- "+l)
+		}
+	}
+	for _, l := range after {
+		if !inBefore[l] {
+			diff = append(diff, "+ "+l)
+		}
+	}
+	if len(diff) > 0 || len(before) != len(after) {
+		t.Errorf("%s moved the flow (- stored, + rebuilt):\n  %s", what, strings.Join(diff, "\n  "))
+	}
+}
+
+// mergeExitSides returns the origin side of every flow leaving an
+// ExclusiveMerge of the stored flow, sorted.
+func mergeExitSides(t *testing.T, exec *Executor, name string) []string {
+	t.Helper()
+	_, g := rawFlow(t, exec, "microflow", name)
+	idx := indexFlowGraph(g.objects)
+	var out []string
+	for _, f := range idx.flow {
+		if _, ok := idx.object[f.OriginID].(*microflows.ExclusiveMerge); ok {
+			out = append(out, anchorSideKeyword(f.OriginConnectionIndex))
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
+// `@anchor(from: X)` on an if is the flow leaving the statement. With a
+// closing merge that is the flow out of the merge. Inside a branch body the
+// builder already honoured it; at the top level it was dropped (#767). The
+// unannotated if is the control.
+func TestBuild_IfFromAnchorIsTheMergeExit(t *testing.T) {
+	exec, _ := describeExecutor(t)
+	for _, tc := range []struct {
+		name, anchor string
+		want         []string
+	}{
+		{"MyFirstModule.MergeExitDefault", "", []string{"right"}},
+		{"MyFirstModule.MergeExitBottom", "@anchor(from: bottom)\n  ", []string{"bottom"}},
+		{"MyFirstModule.MergeExitBottomWithTo", "@anchor(from: bottom, to: top)\n  ", []string{"bottom"}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			run(t, exec, `create microflow `+tc.name+` ($Flag: boolean)
+begin
+  `+tc.anchor+`if $Flag then
+    log info node 'Test' 'yes';
+  else
+    log info node 'Test' 'no';
+  end if;
+  log info node 'Test' 'after';
+end;`)
+			if got := mergeExitSides(t, exec, tc.name); strings.Join(got, ",") != strings.Join(tc.want, ",") {
+				t.Errorf("merge exit sides = %v, want %v", got, tc.want)
+			}
+		})
+	}
+}
+
+// The exit anchor belongs to the if that set it. Inside a case branch the
+// branch's own anchor bookkeeping carries it, so it must not also survive the
+// case and land on the flow out of the CASE's merge (or anything after it).
+func TestBuild_IfExitAnchorDoesNotLeakOutOfCase(t *testing.T) {
+	exec, _ := describeExecutor(t)
+	const name = "MyFirstModule.MergeExitInCase"
+	run(t, exec, `create enumeration MyFirstModule.MergeExitKind (One 'One', Two 'Two');`)
+	run(t, exec, `create microflow `+name+` ($Flag: boolean, $Kind: enum MyFirstModule.MergeExitKind)
+begin
+  if $Flag then
+    case $Kind
+      when One then
+        @anchor(from: bottom)
+        if $Flag then
+          log info node 'Test' 'one-yes';
+        else
+          log info node 'Test' 'one-no';
+        end if;
+        log info node 'Test' 'one-after';
+      when Two then
+        log info node 'Test' 'two';
+    end case;
+    log info node 'Test' 'after-case';
+  end if;
+  log info node 'Test' 'after';
+end;`)
+	got := mergeExitSides(t, exec, name)
+	bottoms := 0
+	for _, side := range got {
+		if side == "bottom" {
+			bottoms++
+		}
+	}
+	if bottoms != 1 {
+		t.Errorf("want exactly the annotated if's merge to leave from the bottom, got merge exit sides %v", got)
+	}
+}
diff --git a/mdl/executor/cmd_microflows_show_helpers.go b/mdl/executor/cmd_microflows_show_helpers.go
index 848314604d..8169c3edbe 100644
--- a/mdl/executor/cmd_microflows_show_helpers.go
+++ b/mdl/executor/cmd_microflows_show_helpers.go
@@ -302,11 +302,12 @@ func emitAnchorAnnotationWithActivityMap(
 	id := obj.GetID()
 
 	if _, isSplit := obj.(*microflows.ExclusiveSplit); isSplit {
-		emitSplitAnchorAnnotation(id, flowsByOrigin, flowsByDest, lines, indentStr, false)
+		emitSplitAnchorAnnotation(id, flowsByOrigin, flowsByDest, lines, indentStr, false,
+			mergeExitAnchor(id, flowsByOrigin, activityMap))
 		return
 	}
 	if _, isSplit := obj.(*microflows.InheritanceSplit); isSplit {
-		emitSplitAnchorAnnotation(id, flowsByOrigin, flowsByDest, lines, indentStr, true)
+		emitSplitAnchorAnnotation(id, flowsByOrigin, flowsByDest, lines, indentStr, true, "")
 		return
 	}
 	if loop, isLoop := obj.(*microflows.LoopedActivity); isLoop {
@@ -433,6 +434,22 @@ func emitMergeAnnotation(
 	*lines = append(*lines, indentStr+fmt.Sprintf("@merge(%d, %d)", p.X, p.Y))
 }
 
+// closingMergeID is the merge an ExclusiveSplit's description speaks for (its
+// @merge and the `from:` of its @anchor), or "" for anything else.
+func closingMergeID(
+	obj microflows.MicroflowObject,
+	flowsByOrigin map[model.ID][]*microflows.SequenceFlow,
+	activityMap map[model.ID]microflows.MicroflowObject,
+) model.ID {
+	if _, ok := obj.(*microflows.ExclusiveSplit); !ok || activityMap == nil {
+		return ""
+	}
+	if merge := commonMergeAfter(obj.GetID(), flowsByOrigin, activityMap); merge != nil {
+		return merge.GetID()
+	}
+	return ""
+}
+
 // commonMergeAfter returns the nearest ExclusiveMerge reachable from every
 // outgoing branch of splitID, or nil when the branches do not rejoin (each
 // returns, say).
@@ -552,6 +569,7 @@ func emitSplitAnchorAnnotation(
 	lines *[]string,
 	indentStr string,
 	preserveDefaultIncoming bool,
+	mergeExitFrom string,
 ) {
 	// Incoming flow anchor (where the previous activity's flow lands on the split).
 	var inTo string
@@ -571,11 +589,16 @@ func emitSplitAnchorAnnotation(
 		falseTo = anchorSideKeyword(falseFlow.DestinationConnectionIndex)
 	}
 
-	if inTo == "" && trueFrom == "" && trueTo == "" && falseFrom == "" && falseTo == "" {
+	if inTo == "" && trueFrom == "" && trueTo == "" && falseFrom == "" && falseTo == "" && mergeExitFrom == "" {
 		return
 	}
 
 	var parts []string
+	// `from:` on an if is the flow leaving the statement — out of its closing
+	// merge (#767). mergeExitAnchor has already dropped the default side.
+	if mergeExitFrom != "" {
+		parts = append(parts, "from: "+mergeExitFrom)
+	}
 	trueDefaultFroms := []string{anchorSideKeyword(AnchorRight), anchorSideKeyword(AnchorBottom)}
 	trueDefaultTos := []string{anchorSideKeyword(AnchorLeft)}
 	falseDefaultFroms := []string{anchorSideKeyword(AnchorBottom), anchorSideKeyword(AnchorRight)}
@@ -596,6 +619,44 @@ func emitSplitAnchorAnnotation(
 	*lines = append(*lines, indentStr+fmt.Sprintf("@anchor(%s)", strings.Join(parts, ", ")))
 }
 
+// mergeExitAnchor returns the side the flow LEAVING an if's closing merge
+// starts from, or "" when it is the default (right) or there is no such merge.
+//
+// The merge has no statement of its own, so this anchor is written as `from:`
+// on the if — the same slot `from:` has on any other statement: the flow
+// leaving it. Without it a merge-to-split flow that wraps onto a new row
+// (bottom of the merge to top of the next decision) re-executed as leaving the
+// merge's right side, back across the row above (ako/mxcli#767).
+//
+// Only an if (a split with true/false branches) has this slot; the merge is
+// found the way @merge finds it, so the two annotations name the same node.
+func mergeExitAnchor(
+	splitID model.ID,
+	flowsByOrigin map[model.ID][]*microflows.SequenceFlow,
+	activityMap map[model.ID]microflows.MicroflowObject,
+) string {
+	if activityMap == nil {
+		return ""
+	}
+	if trueFlow, falseFlow := findBranchFlows(flowsByOrigin[splitID]); trueFlow == nil && falseFlow == nil {
+		return ""
+	}
+	merge := commonMergeAfter(splitID, flowsByOrigin, activityMap)
+	if merge == nil {
+		return ""
+	}
+	for _, flow := range flowsByOrigin[merge.GetID()] {
+		if flow.IsErrorHandler {
+			continue
+		}
+		if flow.OriginConnectionIndex == AnchorRight {
+			return ""
+		}
+		return anchorSideKeyword(flow.OriginConnectionIndex)
+	}
+	return ""
+}
+
 // branchAnchorFragment builds a `key: (from: X, to: Y)` fragment for a branch
 // anchor. Returns "" when both sides are empty (default).
 func branchAnchorFragment(label, from, to string) string {
@@ -804,7 +865,9 @@ func emitObjectAnnotations(
 		// @anchor — emit whenever attached flows exist, for roundtrip fidelity.
 		// The emitter sorts out the right form (simple / split / loop) based on
 		// the object type.
-		if layout.keepsAnchor(currentID) {
+		// An if's anchor also carries the flow out of its closing merge, which
+		// has no statement of its own — so a pinned merge keeps the if's anchor.
+		if layout.keepsAnchor(currentID) || layout.keepsAnchor(closingMergeID(obj, flowsByOrigin, activityMap)) {
 			emitAnchorAnnotationWithActivityMap(obj, flowsByOrigin, flowsByDest, activityMap, lines, indentStr)
 		}
 		if layout.keepsCurve(currentID) {
diff --git a/mdl/executor/cmd_misc.go b/mdl/executor/cmd_misc.go
index a67ea623be..0440c42767 100644
--- a/mdl/executor/cmd_misc.go
+++ b/mdl/executor/cmd_misc.go
@@ -276,12 +276,12 @@ Navigation:
     [home page Module.Page for UserRole]
     [login page Module.Page]
     [not found page Module.Page]
-    [menu (
-      menu item 'Caption' page Module.Page;
-      menu 'SubMenu' (
-        menu item 'Child' microflow Module.Flow;
-      );
-    )];
+    [{
+      menu item 'Caption' ( OnClick: show page Module.Page )
+      menu 'SubMenu' {
+        menu item 'Child' ( OnClick: call microflow Module.Flow )
+      }
+    }];
 
 Data Types:
   String[(length)]  Integer  Long  Decimal[(p,s)]
diff --git a/mdl/executor/cmd_navigation.go b/mdl/executor/cmd_navigation.go
index 632c6f353b..6c2b1e7827 100644
--- a/mdl/executor/cmd_navigation.go
+++ b/mdl/executor/cmd_navigation.go
@@ -344,13 +344,6 @@ func outputNavigationProfile(ctx *ExecContext, p *types.NavigationProfile) {
 		fmt.Fprintf(ctx.Output, "  not found page %s\n", p.NotFoundPage)
 	}
 
-	// Menu items
-	if len(p.MenuItems) > 0 {
-		fmt.Fprintln(ctx.Output, "  menu (")
-		printMenuMDL(ctx.Output, p.MenuItems, 2, "CREATE NAVIGATION")
-		fmt.Fprintln(ctx.Output, "  )")
-	}
-
 	// Only emitted when it differs from the platform default, so the clause
 	// appears exactly when it carries information. Describing every profile
 	// with `on sync error throw` would add a line to every navigation script
@@ -379,7 +372,14 @@ func outputNavigationProfile(ctx *ExecContext, p *types.NavigationProfile) {
 		}
 	}
 
-	fmt.Fprintln(ctx.Output, ";")
+	// Menu items: the profile's children, in { } after its clauses (R2).
+	if len(p.MenuItems) > 0 {
+		fmt.Fprintln(ctx.Output, "{")
+		printMenuMDL(ctx.Output, p.MenuItems, 1, "CREATE NAVIGATION")
+		fmt.Fprintln(ctx.Output, "};")
+	} else {
+		fmt.Fprintln(ctx.Output, ";")
+	}
 	fmt.Fprintln(ctx.Output)
 }
 
@@ -421,23 +421,39 @@ func menuItemTarget(item *types.NavMenuItem) string {
 // printMenuMDL prints menu items in MDL-style format. reproducer names the
 // construct an icon note should point at — navigation menus are authored by
 // CREATE NAVIGATION, while a standalone menu document cannot be authored at all.
+//
+// Each item is a child with the shape every child has (R2, ako/mxcli#754):
+// `menu item 'X' ( OnClick: show page M.P, Icon: I )`, and a sub-menu
+// `menu 'X' ( Icon: I ) { … }`. A child ends in `)` or `}`, or in its caption
+// when it has no properties, so no separator is written.
 func printMenuMDL(w io.Writer, items []*types.NavMenuItem, depth int, reproducer string) {
 	indent := strings.Repeat("  ", depth)
 	for _, item := range items {
-		icon := menuItemIconMDL(item)
+		var props []string
+		if len(item.Items) == 0 {
+			switch {
+			case item.Page != "":
+				props = append(props, "OnClick: show page "+item.Page)
+			case item.Microflow != "":
+				props = append(props, "OnClick: call microflow "+item.Microflow)
+			case item.ActionType == "SignOutAction":
+				props = append(props, "OnClick: sign out")
+			}
+		}
+		if icon := menuItemIconMDL(item); icon != "" {
+			props = append(props, "Icon: "+icon)
+		}
+		propList := ""
+		if len(props) > 0 {
+			propList = " ( " + strings.Join(props, ", ") + " )"
+		}
 		if len(item.Items) > 0 {
 			// Sub-menu container
-			fmt.Fprintf(w, "%smenu '%s'%s (\n", indent, item.Caption, icon)
+			fmt.Fprintf(w, "%smenu '%s'%s {\n", indent, item.Caption, propList)
 			printMenuMDL(w, item.Items, depth+1, reproducer)
-			fmt.Fprintf(w, "%s);\n", indent)
-		} else if item.Page != "" {
-			fmt.Fprintf(w, "%smenu item '%s' page %s%s;\n", indent, item.Caption, item.Page, icon)
-		} else if item.Microflow != "" {
-			fmt.Fprintf(w, "%smenu item '%s' microflow %s%s;\n", indent, item.Caption, item.Microflow, icon)
-		} else if item.ActionType == "SignOutAction" {
-			fmt.Fprintf(w, "%smenu item '%s' sign out%s;\n", indent, item.Caption, icon)
+			fmt.Fprintf(w, "%s}\n", indent)
 		} else {
-			fmt.Fprintf(w, "%smenu item '%s'%s;\n", indent, item.Caption, icon)
+			fmt.Fprintf(w, "%smenu item '%s'%s\n", indent, item.Caption, propList)
 		}
 		if note := menuItemIconNote(item, reproducer); note != "" {
 			fmt.Fprintf(w, "%s%s\n", indent, note)
@@ -445,7 +461,7 @@ func printMenuMDL(w io.Writer, items []*types.NavMenuItem, depth int, reproducer
 	}
 }
 
-// menuItemIconMDL renders the ICON clause for a menu item, or "" when there is
+// menuItemIconMDL renders a menu item's `Icon:` value, or "" when there is
 // nothing CREATE NAVIGATION can reproduce.
 //
 // All three of Mendix's icon elements have a form now. Only the collection one
@@ -460,17 +476,17 @@ func menuItemIconMDL(item *types.NavMenuItem) string {
 		if item.IconCode == 0 {
 			return ""
 		}
-		return fmt.Sprintf(" icon glyph %d", item.IconCode)
+		return fmt.Sprintf("glyph %d", item.IconCode)
 	case types.MenuIconImage:
 		if item.Icon == "" {
 			return ""
 		}
-		return " icon image " + quoteQualifiedName(item.Icon)
+		return "image " + quoteQualifiedName(item.Icon)
 	case types.MenuIconCollection:
 		if item.Icon == "" {
 			return ""
 		}
-		return " icon " + quoteQualifiedName(item.Icon)
+		return quoteQualifiedName(item.Icon)
 	}
 	return ""
 }
diff --git a/mdl/executor/cmd_navigation_icon_roundtrip_test.go b/mdl/executor/cmd_navigation_icon_roundtrip_test.go
index 0565241007..2b9f6d519d 100644
--- a/mdl/executor/cmd_navigation_icon_roundtrip_test.go
+++ b/mdl/executor/cmd_navigation_icon_roundtrip_test.go
@@ -39,14 +39,14 @@ func TestMenuIconMDL_RoundTripsEveryVariant(t *testing.T) {
 		{
 			"collection",
 			types.NavMenuItem{IconType: "Forms$IconCollectionIcon", Icon: "Atlas_Core.Atlas.home"},
-			" icon Atlas_Core.Atlas.home",
+			"Atlas_Core.Atlas.home",
 		},
 		{
 			// The one that was being destroyed. The code IS the glyph's identity;
 			// reading only the $Type left DESCRIBE with nothing to say.
 			"glyph",
 			types.NavMenuItem{IconType: "Forms$GlyphIcon", IconCode: 57377},
-			" icon glyph 57377",
+			"glyph 57377",
 		},
 		{
 			// An image icon points into an IMAGE collection, a different document
@@ -54,7 +54,7 @@ func TestMenuIconMDL_RoundTripsEveryVariant(t *testing.T) {
 			// would rebuild it as the wrong element.
 			"image",
 			types.NavMenuItem{IconType: "Forms$ImageIcon", Icon: "System.Images.Close"},
-			" icon image System.Images.Close",
+			"image System.Images.Close",
 		},
 	}
 
diff --git a/mdl/executor/cmd_navigation_icon_test.go b/mdl/executor/cmd_navigation_icon_test.go
index c66676db33..83cfb2d076 100644
--- a/mdl/executor/cmd_navigation_icon_test.go
+++ b/mdl/executor/cmd_navigation_icon_test.go
@@ -30,7 +30,7 @@ func TestPrintMenuMDL_RoundTripsAnIconCollectionIcon(t *testing.T) {
 		Icon:     "Atlas_Core.Atlas.align-center",
 		IconType: "Forms$IconCollectionIcon",
 	}})
-	want := "menu item 'Dashboard' page M.Dash icon Atlas_Core.Atlas.\"align-center\";\n"
+	want := "menu item 'Dashboard' ( OnClick: show page M.Dash, Icon: Atlas_Core.Atlas.\"align-center\" )\n"
 	if got != want {
 		t.Errorf("got %q, want %q", got, want)
 	}
@@ -47,14 +47,14 @@ func TestPrintMenuMDL_LeavesAKeywordIconNameUnquoted(t *testing.T) {
 		Caption: "Home", Page: "M.Home",
 		Icon: "Atlas_Core.Atlas.home", IconType: "Forms$IconCollectionIcon",
 	}})
-	want := "menu item 'Home' page M.Home icon Atlas_Core.Atlas.home;\n"
+	want := "menu item 'Home' ( OnClick: show page M.Home, Icon: Atlas_Core.Atlas.home )\n"
 	if got != want {
 		t.Errorf("got %q, want %q", got, want)
 	}
 }
 
-// A sub-menu carries its icon before the parenthesised body, matching the
-// grammar's second alternative.
+// A sub-menu carries its icon in its property list, before the { } of its
+// items, matching the grammar's second alternative.
 func TestPrintMenuMDL_RoundTripsASubMenuIcon(t *testing.T) {
 	got := menuMDL([]*types.NavMenuItem{{
 		Caption:  "Reports",
@@ -62,10 +62,10 @@ func TestPrintMenuMDL_RoundTripsASubMenuIcon(t *testing.T) {
 		IconType: "Forms$IconCollectionIcon",
 		Items:    []*types.NavMenuItem{{Caption: "Monthly", Page: "M.Monthly"}},
 	}})
-	if !strings.HasPrefix(got, "menu 'Reports' icon Atlas_Core.Atlas.\"list-bullets\" (\n") {
+	if !strings.HasPrefix(got, "menu 'Reports' ( Icon: Atlas_Core.Atlas.\"list-bullets\" ) {\n") {
 		t.Errorf("sub-menu header lost its icon: %q", got)
 	}
-	if !strings.Contains(got, "menu item 'Monthly' page M.Monthly;") {
+	if !strings.Contains(got, "menu item 'Monthly' ( OnClick: show page M.Monthly )") {
 		t.Errorf("sub-items went missing: %q", got)
 	}
 }
@@ -76,13 +76,13 @@ func TestPrintMenuMDL_RoundTripsASubMenuIcon(t *testing.T) {
 // on testdata/expr-checker, a glyph icon destroyed at exit 0.
 //
 // Each form is emitted with its own keyword, so replay rebuilds the same
-// ELEMENT. Writing `icon System.Images.Close` for an ImageIcon would have
+// ELEMENT. Writing `Icon: System.Images.Close` for an ImageIcon would have
 // converted it to an IconCollectionIcon: a silent variant swap, which is why the
 // bare form was not simply widened to cover all three.
 func TestPrintMenuMDL_EmitsEachIconVariant(t *testing.T) {
 	for _, tc := range []struct{ name, iconType, icon, want string }{
-		{"collection icon", "Forms$IconCollectionIcon", "Atlas_Core.Atlas.home", " icon Atlas_Core.Atlas.home"},
-		{"image icon", "Forms$ImageIcon", "System.Images.Close", " icon image System.Images.Close"},
+		{"collection icon", "Forms$IconCollectionIcon", "Atlas_Core.Atlas.home", "Icon: Atlas_Core.Atlas.home"},
+		{"image icon", "Forms$ImageIcon", "System.Images.Close", "Icon: image System.Images.Close"},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			got := menuMDL([]*types.NavMenuItem{{
@@ -101,8 +101,8 @@ func TestPrintMenuMDL_EmitsEachIconVariant(t *testing.T) {
 		got := menuMDL([]*types.NavMenuItem{{
 			Caption: "Close", Page: "M.Close", IconType: "Forms$GlyphIcon", IconCode: 57345,
 		}})
-		if !strings.Contains(got, " icon glyph 57345") {
-			t.Errorf("got %q, want it to contain ` icon glyph 57345`", got)
+		if !strings.Contains(got, "Icon: glyph 57345") {
+			t.Errorf("got %q, want it to contain `Icon: glyph 57345`", got)
 		}
 		if strings.Contains(got, "-- icon") {
 			t.Errorf("still flagged as unreproducible: %q", got)
@@ -127,7 +127,7 @@ func TestPrintMenuMDL_StillFlagsWhatItCannotRebuild(t *testing.T) {
 				Caption: "Close", Page: "M.Close", Icon: tc.icon, IconType: tc.iconType,
 			}})
 			stmt := strings.SplitN(got, "\n", 2)[0]
-			if strings.Contains(stmt, " icon ") {
+			if strings.Contains(stmt, "Icon:") {
 				t.Errorf("emitted a clause for %s, which replay could not rebuild: %q", tc.iconType, got)
 			}
 			if !strings.Contains(got, "-- icon") {
@@ -140,7 +140,7 @@ func TestPrintMenuMDL_StillFlagsWhatItCannotRebuild(t *testing.T) {
 // No icon means no clause and no note — the common case must stay clean.
 func TestPrintMenuMDL_SilentWhenThereIsNoIcon(t *testing.T) {
 	got := menuMDL([]*types.NavMenuItem{{Caption: "Dashboard", Page: "M.Dash"}})
-	if got != "menu item 'Dashboard' page M.Dash;\n" {
+	if got != "menu item 'Dashboard' ( OnClick: show page M.Dash )\n" {
 		t.Errorf("got %q", got)
 	}
 }
@@ -160,7 +160,7 @@ func TestPrintMenuMDL_EmittedIconsReParse(t *testing.T) {
 			body := menuMDL([]*types.NavMenuItem{{
 				Caption: "X", Page: "M.P", Icon: icon, IconType: "Forms$IconCollectionIcon",
 			}})
-			script := "create or replace navigation Responsive menu (\n" + body + ");"
+			script := "create or modify navigation Responsive {\n" + body + "};"
 			prog, errs := visitor.Build(script)
 			if len(errs) > 0 {
 				t.Fatalf("DESCRIBE emitted output its own parser rejects:\n%s\nerrors: %v", script, errs)
diff --git a/mdl/executor/cmd_pages_builder.go b/mdl/executor/cmd_pages_builder.go
index 35b102b570..6cd6d3c5ca 100644
--- a/mdl/executor/cmd_pages_builder.go
+++ b/mdl/executor/cmd_pages_builder.go
@@ -90,7 +90,7 @@ type pageBuilder struct {
 	// reference as a last line, ALTER included (canon.BareAttributeRefError).
 	tolerateDanglingRefs bool
 
-	// Local page/snippet variables (Variables: { $name: Type = 'default' }).
+	// Local page/snippet variables (Variables: ( $name: Type = 'default' )).
 	// Used to distinguish a $localVar reference from a page parameter when
 	// resolving TextTemplate parameters — local variables must be stored as
 	// Forms$PageVariable.LocalVariable in BSON, not as a literal Expression.
@@ -150,13 +150,11 @@ func (pb *pageBuilder) registerWidgetName(name string, id model.ID) error {
 
 // getModules returns cached modules or loads them.
 func (pb *pageBuilder) getModules() []*model.Module {
-	if pb.execCache != nil && pb.execCache.modules != nil {
-		return pb.execCache.modules
-	}
-	modules, _ := pb.backend.ListModules()
-	if pb.execCache != nil {
-		pb.execCache.modules = modules
+	if pb.execCache == nil {
+		modules, _ := pb.backend.ListModules()
+		return modules
 	}
+	modules, _ := pb.execCache.cachedModules(pb.backend.ListModules)
 	return modules
 }
 
diff --git a/mdl/executor/cmd_pages_builder_v3_widgets.go b/mdl/executor/cmd_pages_builder_v3_widgets.go
index 39feb89a18..761c958c72 100644
--- a/mdl/executor/cmd_pages_builder_v3_widgets.go
+++ b/mdl/executor/cmd_pages_builder_v3_widgets.go
@@ -782,7 +782,7 @@ func (pb *pageBuilder) buildDynamicTextV3(w *ast.WidgetV3) (*pages.DynamicText,
 	//   Content: $widget.Name            -> auto-generate {1} with $widget.Name as param
 	//   Content: Entity.Attribute        -> auto-generate {1} with Entity.Attribute as param
 	//   Content: SomeStaticText          -> literal string, no params (no dot, no $)
-	//   Content: 'Name: {1}', ContentParams: [Name] -> use explicit template and params
+	//   Content: 'Name: {1}', ContentParams: (Name) -> use explicit template and params
 	var autoGeneratedParams []string
 	if content != "" && explicitParams == nil {
 		// Only auto-generate for:
@@ -807,7 +807,7 @@ func (pb *pageBuilder) buildDynamicTextV3(w *ast.WidgetV3) (*pages.DynamicText,
 	}
 
 	// Attribute: X binds the dynamic text to an attribute (issue #650), equivalent
-	// to `ContentParams: [{1} = X]`. Without this the Attribute was dropped, leaving
+	// to `ContentParams: ({1} = X)`. Without this the Attribute was dropped, leaving
 	// an orphaned `{1}` template with no parameter — which Studio Pro can't open
 	// (NullReferenceException in ClientTemplateFormPart.CollectControls).
 	// Outside a data container that parameter binds nothing (CE0402).
@@ -1239,7 +1239,7 @@ func (pb *pageBuilder) buildSnippetCallParams(sc *pages.SnippetCallWidget, snipp
 				continue
 			}
 			return mdlerrors.NewValidationf(
-				"snippet %s requires parameter $%s — add Params: {%s: $<variable>} to the SNIPPETCALL, "+
+				"snippet %s requires parameter $%s — add Params: (%s = $<variable>) to the SNIPPETCALL, "+
 					"or place the call inside a data context of %s so the parameter is satisfied from it",
 				snippetQName, declared.Name, declared.Name, orDefaultStr(declared.EntityName, "the parameter's entity"),
 			)
diff --git a/mdl/executor/cmd_pages_describe.go b/mdl/executor/cmd_pages_describe.go
index 593e94b363..e02dbabc9f 100644
--- a/mdl/executor/cmd_pages_describe.go
+++ b/mdl/executor/cmd_pages_describe.go
@@ -86,7 +86,7 @@ func describePage(ctx *ExecContext, name ast.QualifiedName) error {
 		fmt.Fprintln(ctx.Output, "@excluded")
 	}
 
-	// V3 syntax: CREATE PAGE Module.Page (Title: '...', Layout: ..., Params: { })
+	// V3 syntax: CREATE PAGE Module.Page (Title: '...', Layout: ..., Params: ( ))
 	header := fmt.Sprintf("create or modify page %s.%s", modName, foundPage.Name)
 	// The folder is a clause after the name (R9); `Folder:` is its alias.
 	if folderPath := h.BuildFolderPath(foundPage.ContainerID); folderPath != "" {
@@ -135,7 +135,7 @@ func describePage(ctx *ExecContext, name ast.QualifiedName) error {
 			typeName := pageParamTypeMDL(p)
 			params = append(params, fmt.Sprintf("$%s: %s", p.Name, typeName))
 		}
-		props = append(props, fmt.Sprintf("Params: { %s }", strings.Join(params, ", ")))
+		props = append(props, fmt.Sprintf("Params: ( %s )", strings.Join(params, ", ")))
 	}
 	// Output page variables from raw BSON
 	if rawData != nil {
@@ -157,7 +157,7 @@ func describePage(ctx *ExecContext, name ast.QualifiedName) error {
 				}
 				varParts = append(varParts, fmt.Sprintf("$%s: %s = %s", varName, varTypeName, mdlQuote(defaultVal)))
 			}
-			props = append(props, fmt.Sprintf("Variables: { %s }", strings.Join(varParts, ", ")))
+			props = append(props, fmt.Sprintf("Variables: ( %s )", strings.Join(varParts, ", ")))
 		}
 	}
 
@@ -284,7 +284,7 @@ func describeSnippet(ctx *ExecContext, name ast.QualifiedName) error {
 				paramName, _ := p["Name"].(string)
 				paramParts = append(paramParts, fmt.Sprintf("$%s: %s", paramName, snippetParamTypeMDL(p["ParameterType"])))
 			}
-			snippetProps = append(snippetProps, fmt.Sprintf("Params: { %s }", strings.Join(paramParts, ", ")))
+			snippetProps = append(snippetProps, fmt.Sprintf("Params: ( %s )", strings.Join(paramParts, ", ")))
 		}
 		fmt.Fprintf(ctx.Output, " (%s)", strings.Join(snippetProps, ", "))
 	}
diff --git a/mdl/executor/cmd_pages_describe_designprops_test.go b/mdl/executor/cmd_pages_describe_designprops_test.go
index dbd0f3140e..164202ab72 100644
--- a/mdl/executor/cmd_pages_describe_designprops_test.go
+++ b/mdl/executor/cmd_pages_describe_designprops_test.go
@@ -72,7 +72,7 @@ func TestFormatDesignPropertiesMDL_Compound(t *testing.T) {
 		{Key: "Show divider", ValueType: "toggle"},
 	}
 	got := formatDesignPropertiesMDL(dps)
-	want := "DesignProperties: ['Column gap': 'Medium', 'Spacing': ['margin-top': 'Large', 'margin-bottom': 'Medium'], 'Show divider': on]"
+	want := "DesignProperties: ('Column gap': 'Medium', 'Spacing': ('margin-top': 'Large', 'margin-bottom': 'Medium'), 'Show divider': on)"
 	if got != want {
 		t.Errorf("formatDesignPropertiesMDL:\n got  %s\n want %s", got, want)
 	}
diff --git a/mdl/executor/cmd_pages_describe_output.go b/mdl/executor/cmd_pages_describe_output.go
index 1d5d91c2e1..04bce59214 100644
--- a/mdl/executor/cmd_pages_describe_output.go
+++ b/mdl/executor/cmd_pages_describe_output.go
@@ -214,12 +214,12 @@ func appendAppearanceProps(props []string, w rawWidget) []string {
 // formatDesignPropertiesMDL formats design properties as MDL V3 syntax.
 // Toggle → 'Key': ON, Option → 'Key': 'Value'
 func formatDesignPropertiesMDL(dps []rawDesignProp) string {
-	return fmt.Sprintf("DesignProperties: [%s]", joinDesignPropertyEntries(dps))
+	return fmt.Sprintf("DesignProperties: (%s)", joinDesignPropertyEntries(dps))
 }
 
 // joinDesignPropertyEntries renders design-property entries as comma-separated
 // MDL. Compound properties recurse into a nested list (issue #668):
-// 'Spacing': ['margin-top': 'Large', 'margin-bottom': 'Medium'].
+// 'Spacing': ('margin-top': 'Large', 'margin-bottom': 'Medium').
 func joinDesignPropertyEntries(dps []rawDesignProp) string {
 	var entries []string
 	for _, dp := range dps {
@@ -229,7 +229,7 @@ func joinDesignPropertyEntries(dps []rawDesignProp) string {
 		case "option":
 			entries = append(entries, fmt.Sprintf("%s: %s", mdlQuote(dp.Key), mdlQuote(dp.Option)))
 		case "compound":
-			entries = append(entries, fmt.Sprintf("%s: [%s]", mdlQuote(dp.Key), joinDesignPropertyEntries(dp.Nested)))
+			entries = append(entries, fmt.Sprintf("%s: (%s)", mdlQuote(dp.Key), joinDesignPropertyEntries(dp.Nested)))
 		}
 	}
 	return strings.Join(entries, ", ")
@@ -498,7 +498,7 @@ func outputWidgetMDLV3(ctx *ExecContext, w rawWidget, indent int) {
 			props = append(props, fmt.Sprintf("RenderMode: %s", w.RenderMode))
 		}
 		if len(w.Parameters) > 0 {
-			props = append(props, fmt.Sprintf("ContentParams: [%s]", strings.Join(formatParametersV3(w.Parameters), ", ")))
+			props = append(props, fmt.Sprintf("ContentParams: (%s)", strings.Join(formatParametersV3(w.Parameters), ", ")))
 		}
 		props = appendAppearanceProps(props, w)
 		formatWidgetProps(ctx.Output, prefix, header, props, "\n")
@@ -515,7 +515,7 @@ func outputWidgetMDLV3(ctx *ExecContext, w rawWidget, indent int) {
 			props = append(props, fmt.Sprintf("Caption: %s", mdlQuote(w.Caption)))
 		}
 		if len(w.Parameters) > 0 {
-			props = append(props, fmt.Sprintf("CaptionParams: [%s]", strings.Join(formatParametersV3(w.Parameters), ", ")))
+			props = append(props, fmt.Sprintf("CaptionParams: (%s)", strings.Join(formatParametersV3(w.Parameters), ", ")))
 		}
 		if w.Action != "" {
 			props = append(props, actionProp("Action", w.Action))
@@ -803,7 +803,7 @@ func outputWidgetMDLV3(ctx *ExecContext, w rawWidget, indent int) {
 				// A `{1}` re-executed without its parameter is CE0720, so the
 				// companion travels with the text it belongs to (#575).
 				if len(ep.Params) > 0 {
-					props = append(props, fmt.Sprintf("%sParams: [%s]",
+					props = append(props, fmt.Sprintf("%sParams: (%s)",
 						ep.Key, strings.Join(formatParametersV3(ep.Params), ", ")))
 				}
 			}
@@ -1121,7 +1121,7 @@ func outputDataGrid2ColumnV3(ctx *ExecContext, prefix string, col rawDataGridCol
 		props = append(props, fmt.Sprintf("Caption: %s", mdlQuote(col.Caption)))
 	}
 	if len(col.CaptionParams) > 0 {
-		props = append(props, fmt.Sprintf("CaptionParams: [%s]", strings.Join(formatParametersV3(col.CaptionParams), ", ")))
+		props = append(props, fmt.Sprintf("CaptionParams: (%s)", strings.Join(formatParametersV3(col.CaptionParams), ", ")))
 	}
 	// Add ShowContentAs if not default "attribute"
 	if col.ShowContentAs != "" && col.ShowContentAs != "attribute" {
@@ -1131,7 +1131,7 @@ func outputDataGrid2ColumnV3(ctx *ExecContext, prefix string, col rawDataGridCol
 	if col.ShowContentAs == "dynamicText" && col.DynamicText != "" {
 		props = append(props, fmt.Sprintf("Content: %s", mdlQuote(col.DynamicText)))
 		if len(col.DynamicTextParams) > 0 {
-			props = append(props, fmt.Sprintf("ContentParams: [%s]", strings.Join(formatParametersV3(col.DynamicTextParams), ", ")))
+			props = append(props, fmt.Sprintf("ContentParams: (%s)", strings.Join(formatParametersV3(col.DynamicTextParams), ", ")))
 		}
 	}
 	// Add column styling properties if non-default
@@ -2019,14 +2019,14 @@ func describeImageWidgetProps(w rawWidget) []string {
 	if w.ImageUrl != "" {
 		props = append(props, fmt.Sprintf("ImageUrl: %s", mdlQuote(w.ImageUrl)))
 		if len(w.ImageUrlParams) > 0 {
-			props = append(props, fmt.Sprintf("ImageUrlParams: [%s]",
+			props = append(props, fmt.Sprintf("ImageUrlParams: (%s)",
 				strings.Join(formatParametersV3(w.ImageUrlParams), ", ")))
 		}
 	}
 	if w.AlternativeText != "" {
 		props = append(props, fmt.Sprintf("AlternativeText: %s", mdlQuote(w.AlternativeText)))
 		if len(w.AlternativeTextParams) > 0 {
-			props = append(props, fmt.Sprintf("AlternativeTextParams: [%s]",
+			props = append(props, fmt.Sprintf("AlternativeTextParams: (%s)",
 				strings.Join(formatParametersV3(w.AlternativeTextParams), ", ")))
 		}
 	}
diff --git a/mdl/executor/cmd_pages_describe_pluggable.go b/mdl/executor/cmd_pages_describe_pluggable.go
index ec5e5898bb..d64e832226 100644
--- a/mdl/executor/cmd_pages_describe_pluggable.go
+++ b/mdl/executor/cmd_pages_describe_pluggable.go
@@ -1246,8 +1246,8 @@ func extractImageProperties(ctx *ExecContext, w map[string]any, widget *rawWidge
 // property of a CustomWidget, together with the `{N}` parameters bound to it.
 //
 // The parameters are returned separately rather than folded into the text
-// because MDL spells them separately: `imageUrl: '{1}', imageUrlParams: [{1} =
-// PictureUrl]` (#575).
+// because MDL spells them separately: `imageUrl: '{1}', imageUrlParams: ({1} =
+// PictureUrl)` (#575).
 func extractCustomWidgetPropertyTextTemplate(ctx *ExecContext, w map[string]any, propertyKey string) (string, []string) {
 	obj, ok := w["Object"].(map[string]any)
 	if !ok {
diff --git a/mdl/executor/cmd_rest_clients.go b/mdl/executor/cmd_rest_clients.go
index 84518cc2a4..f89eade0c1 100644
--- a/mdl/executor/cmd_rest_clients.go
+++ b/mdl/executor/cmd_rest_clients.go
@@ -180,11 +180,11 @@ func outputRestOperation(w io.Writer, op *model.RestClientOperation) {
 		fmt.Fprintf(w, "    Query: (%s),\n", strings.Join(params, ", "))
 	}
 
-	// Headers: ('Name' = 'Value', ...)
+	// Headers: ('Name': 'Value', ...) — a map, `key: value` (R2/R3)
 	if len(op.Headers) > 0 {
 		var hdrs []string
 		for _, h := range op.Headers {
-			hdrs = append(hdrs, mdlQuoted(h.Name)+" = "+mdlQuoted(h.Value))
+			hdrs = append(hdrs, mdlQuoted(h.Name)+": "+mdlQuoted(h.Value))
 		}
 		fmt.Fprintf(w, "    Headers: (%s),\n", strings.Join(hdrs, ", "))
 	}
@@ -588,19 +588,11 @@ func buildRestClientOperation(opDef *ast.RestOperationDef) (*model.RestClientOpe
 
 	// Headers
 	for _, h := range opDef.Headers {
-		header := &model.RestClientHeader{
-			Name: h.Name,
-		}
-		if h.Variable != "" {
-			// Dynamic headers: store static prefix only.
-			// Mendix consumed REST services don't support dynamic header values
-			// in the service definition; dynamic values must be set through the
-			// calling microflow.
-			header.Value = h.Prefix
-		} else {
-			header.Value = h.Value
-		}
-		op.Headers = append(op.Headers, header)
+		// The value is a template: `{P}` is the operation parameter P, as in
+		// the path. `'Bearer ' + $Token` used to store "Bearer " alone, which
+		// dropped the token and described back as a literal (ako/mxcli#707);
+		// the visitor now builds `Bearer {Token}` from it.
+		op.Headers = append(op.Headers, &model.RestClientHeader{Name: h.Name, Value: h.Value})
 	}
 
 	return op, nil
diff --git a/mdl/executor/cmd_security.go b/mdl/executor/cmd_security.go
index c6e7e4172e..03467c0e3c 100644
--- a/mdl/executor/cmd_security.go
+++ b/mdl/executor/cmd_security.go
@@ -852,29 +852,7 @@ func describeUserRole(ctx *ExecContext, name ast.QualifiedName) error {
 
 	for _, ur := range ps.UserRoles {
 		if ur.Name == name.Name {
-			fmt.Fprintf(ctx.Output, "create or modify user role %s", ur.Name)
-
-			// Module roles
-			if len(ur.ModuleRoles) > 0 {
-				fmt.Fprintf(ctx.Output, " (%s)", strings.Join(ur.ModuleRoles, ", "))
-			}
-
-			if ur.ManageAllRoles {
-				fmt.Fprint(ctx.Output, " manage all roles")
-			}
-
-			fmt.Fprintln(ctx.Output, ";")
-
-			// Show description if present
-			if ur.Description != "" {
-				fmt.Fprintf(ctx.Output, "\n-- Description: %s\n", ur.Description)
-			}
-
-			// Show check security flag
-			if ur.CheckSecurity {
-				fmt.Fprintln(ctx.Output, "-- Check security: enabled")
-			}
-
+			fmt.Fprint(ctx.Output, formatUserRoleMDL(ur))
 			return nil
 		}
 	}
@@ -884,3 +862,40 @@ func describeUserRole(ctx *ExecContext, name ast.QualifiedName) error {
 
 // Executor method wrappers — delegate to free functions for callers that
 // still use the Executor receiver (e.g. executor_query.go).
+
+// formatUserRoleMDL writes a user role as `create or modify user role`, its
+// properties in a ( Key: value ) list (ako/mxcli#707). The positional form it
+// replaces had no slot for the description or the check-security flag, which
+// describe printed as `--` comments that a replay dropped, and it could not
+// write a role with no module roles at all. A property at Mendix's default for
+// a new role is left out (R12), so an empty role is `create or modify user
+// role R;`.
+func formatUserRoleMDL(ur *security.UserRole) string {
+	var props []string
+	if len(ur.ModuleRoles) > 0 {
+		props = append(props, "ModuleRoles: ("+strings.Join(ur.ModuleRoles, ", ")+")")
+	}
+	if ur.Description != "" {
+		props = append(props, "Description: "+mdlQuoted(ur.Description))
+	}
+	if ur.ManageAllRoles {
+		props = append(props, "ManageAllRoles: true")
+	}
+	if len(ur.ManageableRoles) > 0 && !ur.ManageAllRoles {
+		props = append(props, "ManageableRoles: ("+strings.Join(ur.ManageableRoles, ", ")+")")
+	}
+	if ur.ManageUsersWithoutRoles {
+		props = append(props, "ManageUsersWithoutRoles: true")
+	}
+	if ur.CheckSecurity {
+		props = append(props, "CheckSecurity: true")
+	}
+	head := "create or modify user role " + ur.Name
+	switch len(props) {
+	case 0:
+		return head + ";\n"
+	case 1:
+		return head + " ( " + props[0] + " );\n"
+	}
+	return head + " (\n  " + strings.Join(props, ",\n  ") + "\n);\n"
+}
diff --git a/mdl/executor/cmd_security_write.go b/mdl/executor/cmd_security_write.go
index 46d50e7eb4..4aa45b212d 100644
--- a/mdl/executor/cmd_security_write.go
+++ b/mdl/executor/cmd_security_write.go
@@ -234,13 +234,21 @@ func execCreateUserRole(ctx *ExecContext, s *ast.CreateUserRoleStmt) error {
 				// exist and filed it as missing MDL surface; it exists, and its
 				// module-role list is required.
 				return mdlerrors.NewAlreadyExistsMsg("user role", s.Name, fmt.Sprintf(
-					"user role already exists: %s — use 'create or modify user role %s (Module.Role, ...)' "+
-						"to add module roles to it and keep the script re-runnable "+
-						"(the parenthesised module-role list is required)", s.Name, s.Name))
+					"user role already exists: %s — use 'create or modify user role %s ( ModuleRoles: (Module.Role, ...) )' "+
+						"to add module roles to it and keep the script re-runnable", s.Name, s.Name))
 			}
 			// Additive: ensure specified module roles are present
-			if err := ctx.Backend.AlterUserRoleModuleRoles(ps.ID, s.Name, true, moduleRoleNames); err != nil {
-				return mdlerrors.NewBackend("update user role", err)
+			if len(moduleRoleNames) > 0 {
+				if err := ctx.Backend.AlterUserRoleModuleRoles(ps.ID, s.Name, true, moduleRoleNames); err != nil {
+					return mdlerrors.NewBackend("update user role", err)
+				}
+			}
+			// The properties the statement states; the rest keep their stored
+			// values, as a module role's missing description does.
+			if props := userRoleProperties(s); !props.IsZero() {
+				if err := ctx.Backend.SetUserRoleProperties(ps.ID, s.Name, props); err != nil {
+					return mdlerrors.NewBackend("update user role", err)
+				}
 			}
 			ctx.ReportMutation("Modified", "user role: %s", s.Name)
 			return nil
@@ -250,11 +258,38 @@ func execCreateUserRole(ctx *ExecContext, s *ast.CreateUserRoleStmt) error {
 	if err := ctx.Backend.AddUserRole(ps.ID, s.Name, moduleRoleNames, s.ManageAllRoles); err != nil {
 		return mdlerrors.NewBackend("create user role", err)
 	}
+	// Description, CheckSecurity and the manageable roles: a positional role
+	// list had no slot for them, so describe → exec lost them (ako/mxcli#707).
+	props := userRoleProperties(s)
+	props.ManageAllRoles = nil // AddUserRole set it
+	if !props.IsZero() {
+		if err := ctx.Backend.SetUserRoleProperties(ps.ID, s.Name, props); err != nil {
+			return mdlerrors.NewBackend("create user role", err)
+		}
+	}
 
 	fmt.Fprintf(ctx.Output, "Created user role: %s\n", s.Name)
 	return nil
 }
 
+// userRoleProperties is what a create user role statement states beyond the
+// name and the module roles.
+func userRoleProperties(s *ast.CreateUserRoleStmt) backend.UserRoleProperties {
+	p := backend.UserRoleProperties{
+		Description:             s.Description,
+		CheckSecurity:           s.CheckSecurity,
+		ManageUsersWithoutRoles: s.ManageUsersWithoutRoles,
+	}
+	if s.ManageAllRolesSet {
+		v := s.ManageAllRoles
+		p.ManageAllRoles = &v
+	}
+	if s.ManageableSet {
+		p.ManageableRoles = append([]string{}, s.ManageableRoles...)
+	}
+	return p
+}
+
 // execAlterUserRole handles ALTER USER ROLE Name ADD/REMOVE MODULE ROLES (...).
 func execAlterUserRole(ctx *ExecContext, s *ast.AlterUserRoleStmt) error {
 	if !ctx.ConnectedForWrite() {
diff --git a/mdl/executor/cmd_styling.go b/mdl/executor/cmd_styling.go
index 21df27f04d..120686f783 100644
--- a/mdl/executor/cmd_styling.go
+++ b/mdl/executor/cmd_styling.go
@@ -214,7 +214,7 @@ func execDescribeStyling(ctx *ExecContext, s *ast.DescribeStylingStmt) error {
 		if len(w.DesignProperties) > 0 {
 			// Reuse the DESCRIBE PAGE formatter so toggle/option/compound render
 			// identically across both describe paths (compound = issue #668).
-			fmt.Fprintf(ctx.Output, "  DesignProperties: [%s]\n", joinDesignPropertyEntries(w.DesignProperties))
+			fmt.Fprintf(ctx.Output, "  DesignProperties: (%s)\n", joinDesignPropertyEntries(w.DesignProperties))
 		}
 	}
 
@@ -337,7 +337,7 @@ func applyStylingMutator(mutator backend.PageMutator, s *ast.AlterStylingStmt, t
 			return mdlerrors.NewUnsupported(fmt.Sprintf(
 				"design property %q takes a SET of options, and `alter styling` writes one value — "+
 					"mxbuild refuses that with CE6084. Set it inline instead: "+
-					"`DesignProperties: ['%s': ['%s': on]]` on the widget, in CREATE PAGE or an "+
+					"`DesignProperties: ('%s': ('%s': on))` on the widget, in CREATE PAGE or an "+
 					"ALTER PAGE REPLACE.",
 				a.Property, a.Property, firstOptionName(multi, a.Value)))
 		}
diff --git a/mdl/executor/cmd_workflows.go b/mdl/executor/cmd_workflows.go
index 723e613531..583ef084fc 100644
--- a/mdl/executor/cmd_workflows.go
+++ b/mdl/executor/cmd_workflows.go
@@ -181,9 +181,6 @@ func describeWorkflowToString(ctx *ExecContext, name ast.QualifiedName) (string,
 
 	// Header
 	lines = append(lines, fmt.Sprintf("-- Workflow: %s", qualifiedName))
-	if targetWf.Annotation != "" {
-		lines = append(lines, fmt.Sprintf("-- %s", targetWf.Annotation))
-	}
 	lines = append(lines, "")
 
 	// `create or modify`: the rewrite carries what describe cannot print (the names
@@ -224,6 +221,12 @@ func describeWorkflowToString(ctx *ExecContext, name ast.QualifiedName) (string,
 		lines = append(lines, fmt.Sprintf("  due date %s", workflowExpressionMDL(targetWf.DueDate)))
 	}
 
+	// The note attached to the workflow's start. It was a `--` comment, which
+	// a replay dropped (ako/mxcli#707).
+	if targetWf.Annotation != "" {
+		lines = append(lines, fmt.Sprintf("  annotation %s", mdlQuoted(targetWf.Annotation)))
+	}
+
 	lines = append(lines, formatWorkflowEventHandlers(ctx, targetWf.EventHandlers)...)
 
 	lines = append(lines, "")
@@ -241,33 +244,19 @@ func describeWorkflowToString(ctx *ExecContext, name ast.QualifiedName) (string,
 	return strings.Join(lines, "\n"), nil, nil
 }
 
-// formatAnnotation renders an activity's annotation as MDL comment lines.
-//
-// It used to emit `annotation '<text>';`, and its own doc comment claimed that
-// statement "survives round-trips". It does not, and has not since MDL-WF04: a
-// standalone `annotation` in a workflow body is refused at check time AND by
-// execCreateWorkflow, because Mendix constructs every child of the activity flow
-// with a Flow parent and no annotation type takes one — the written unit cannot
-// be LOADED, so Studio Pro will not open the project. The describer was emitting
-// the one construct the writer refuses, and a 23-activity workflow produced 13
-// MDL-WF04 errors from unmodified DESCRIBE output (mendixlabs/mxcli#1007).
-//
-// A comment is the honest emit today, not a workaround. The annotation being
-// re-emitted here is ATTACHED to an activity, and although the write path stores
-// an attached annotation (addActivityBaseFields), no MDL input can produce one:
-// MDLWorkflow.g4 has only the standalone `workflowAnnotationStmt`. So the text is
-// unwritable either way, and carrying it as a comment at least keeps it in front
-// of whoever edits the script. The `annotation:` marker says what the line was.
+// formatAnnotation renders the note attached to an activity as the
+// `@annotation '…'` line before it, the form a microflow activity's note takes.
 //
-// The microflow domain does have an attached form (`@annotation 'text'`, see
-// MDLMicroflow.g4) and it round-trips properly. Giving workflow activities the
-// same prefix is the fix that would preserve the annotation rather than
-// commenting it out; it is a grammar change, and deliberately not bundled here.
+// It was a `-- annotation:` comment, because MDLWorkflow.g4 had no attached
+// form: the only workflow `annotation` was the standalone statement, which
+// MDL-WF04 and exec refuse (mendixlabs/mxcli#1007). A comment kept the text in
+// front of the reader, but a replay dropped it (ako/mxcli#707). A standalone
+// note read back from the model is still a comment: see annotationComment.
 func formatAnnotation(annotation string, indent string) string {
 	if annotation == "" {
 		return ""
 	}
-	return annotationComment(annotation, indent)
+	return indent + "@annotation " + mdlQuoted(annotation)
 }
 
 // annotationComment renders text as one or more `-- annotation:` lines. An
diff --git a/mdl/executor/cmd_workflows_write.go b/mdl/executor/cmd_workflows_write.go
index 435bc0373a..a9c1dd88f7 100644
--- a/mdl/executor/cmd_workflows_write.go
+++ b/mdl/executor/cmd_workflows_write.go
@@ -180,6 +180,7 @@ func execCreateWorkflow(ctx *ExecContext, s *ast.CreateWorkflowStmt) error {
 	// Display metadata
 	wf.WorkflowName = s.DisplayName
 	wf.WorkflowDescription = s.Description
+	wf.Annotation = s.Annotation
 	if s.ExportLevel != "" {
 		wf.ExportLevel = s.ExportLevel
 	}
@@ -356,8 +357,20 @@ func buildBoundaryEvents(nodes []ast.WorkflowBoundaryEventNode) []*workflows.Bou
 	return events
 }
 
-// buildWorkflowActivity converts a single AST activity node to an SDK workflow activity.
+// buildWorkflowActivity converts a single AST activity node to an SDK workflow
+// activity, with the note `@annotation '…'` attached to it (ako/mxcli#707).
 func buildWorkflowActivity(node ast.WorkflowActivityNode) workflows.WorkflowActivity {
+	act := buildWorkflowActivityCore(node)
+	if an, ok := node.(ast.AnnotatedWorkflowActivity); ok && an.ActivityAnnotation() != "" {
+		if a, ok := act.(interface{ SetAnnotation(string) }); ok {
+			a.SetAnnotation(an.ActivityAnnotation())
+		}
+	}
+	return act
+}
+
+// buildWorkflowActivityCore converts the activity itself.
+func buildWorkflowActivityCore(node ast.WorkflowActivityNode) workflows.WorkflowActivity {
 	switch n := node.(type) {
 	case *ast.WorkflowUserTaskNode:
 		return buildUserTask(n)
@@ -822,7 +835,7 @@ func buildNotificationActivity(n *ast.WorkflowNotificationNode) *workflows.Notif
 func buildEventSubProcesses(nodes []ast.WorkflowEventSubProcessNode) []*workflows.EventSubProcess {
 	var out []*workflows.EventSubProcess
 	for _, n := range nodes {
-		esp := &workflows.EventSubProcess{Name: n.Name, Caption: n.Caption}
+		esp := &workflows.EventSubProcess{Name: n.Name, Caption: n.Caption, Annotation: n.Annotation}
 		esp.ID = model.ID(generateWorkflowUUID())
 
 		start := &workflows.EventSubProcessStartActivity{
diff --git a/mdl/executor/create_if_not_exists_test.go b/mdl/executor/create_if_not_exists_test.go
new file mode 100644
index 0000000000..00ed17383a
--- /dev/null
+++ b/mdl/executor/create_if_not_exists_test.go
@@ -0,0 +1,257 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package executor
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/backend/mock"
+	"github.com/mendixlabs/mxcli/mdl/visitor"
+	"github.com/mendixlabs/mxcli/model"
+	"github.com/mendixlabs/mxcli/sdk/domainmodel"
+	"github.com/mendixlabs/mxcli/sdk/security"
+)
+
+// createGuardCase is one guarded create per document family, and how to make
+// the mock project already hold the element it names (ako/mxcli#731).
+//
+// Most families are found through a Backend.List* method; lister names the
+// MockBackend field, and the test fills it by reflection with one element of
+// the list's own element type, named after the statement. That also proves the
+// production probe reads the real type's ContainerID and Name.
+type createGuardCase struct {
+	src    string
+	lister string                                        // MockBackend List*Func field, or ""
+	seed   func(mb *mock.MockBackend, mod *model.Module) // for the families without one
+}
+
+var createGuardCases = map[string]createGuardCase{
+	"microflow":        {src: "create microflow if not exists M.X () begin return; end;", lister: "ListMicroflowsFunc"},
+	"nanoflow":         {src: "create nanoflow if not exists M.X () begin return; end;", lister: "ListNanoflowsFunc"},
+	"rule":             {src: "create rule if not exists M.X ($c: M.C) returns Boolean begin return true; end;", lister: "ListRulesFunc"},
+	"javaaction":       {src: "create java action if not exists M.X() returns String as $$return \"\";$$;", lister: "ListJavaActionsFunc"},
+	"javascriptaction": {src: "create javascript action if not exists M.X() returns Boolean platform Web as $$return true;$$;", lister: "ListJavaScriptActionsFunc"},
+	"page":             {src: "create page if not exists M.X (Title: 'X', Layout: Atlas_Core.Atlas_Default) { dynamictext t (Content: 'x') };", lister: "ListPagesFunc"},
+	"snippet":          {src: "create snippet if not exists M.X { dynamictext t (Content: 'x') };", lister: "ListSnippetsFunc"},
+	"layout":           {src: "create layout if not exists M.X (layouttype: 'Responsive') { placeholder Main };", lister: "ListLayoutsFunc"},
+	"enumeration":      {src: "create enumeration if not exists M.X (Red 'Red');", lister: "ListEnumerationsFunc"},
+	"constant":         {src: "create constant if not exists M.X type String default 'a';", lister: "ListConstantsFunc"},
+	"databaseconnection": {src: "create database connection if not exists M.X type 'PostgreSQL' connection string @M.DbUrl username @M.DbUser password @M.DbPass;",
+		lister: "ListDatabaseConnectionsFunc"},
+	"restclient":           {src: "create consumed rest service if not exists M.X (BaseUrl: 'https://x.example.com', Authentication: NONE) { };", lister: "ListConsumedRestServicesFunc"},
+	"publishedrestservice": {src: "create published rest service if not exists M.X (Path: 'rest/x/v1', Version: '1.0.0', ServiceName: 'X') { };", lister: "ListPublishedRestServicesFunc"},
+	"odataclient":          {src: "create consumed odata service if not exists M.X (Version: '1.0', ODataVersion: OData4, MetadataUrl: 'https://x.example.com/$metadata');", lister: "ListConsumedODataServicesFunc"},
+	"odataservice": {src: "create published odata service if not exists M.X (path: 'odata/x/', version: '1.0.0', ODataVersion: OData4, namespace: 'M.X') authentication basic { };",
+		lister: "ListPublishedODataServicesFunc"},
+	"businesseventservice": {src: "create business event service if not exists M.X (ServiceName: 'X', EventNamePrefix: '') { message E (Id: Long) publish entity M.PBE; };",
+		lister: "ListBusinessEventServicesFunc"},
+	"workflow":                    {src: "create workflow if not exists M.X parameter $Context: M.C begin end workflow;", lister: "ListWorkflowsFunc"},
+	"imagecollection":             {src: "create image collection if not exists M.X;", lister: "ListImageCollectionsFunc"},
+	"queue":                       {src: "create task queue if not exists M.X (Parallelism: 3);", lister: "ListQueuesFunc"},
+	"scheduledevent":              {src: "create scheduled event if not exists M.X (Microflow: M.SE, Repeat: Daily, HourOfDay: 4, MinuteOfHour: 0, TimeZone: Server, Enabled: true);", lister: "ListScheduledEventsFunc"},
+	"regularexpression":           {src: "create regular expression if not exists M.X (Expression: '.+');", lister: "ListRegularExpressionsFunc"},
+	"jsonstructure":               {src: "create json structure if not exists M.X snippet '{\"id\": 1}';", lister: "ListJsonStructuresFunc"},
+	"messagedefinitioncollection": {src: "create message definition collection if not exists M.X {definition D for M.C as 'Cs' {Id}};", lister: "ListMessageDefinitionCollectionsFunc"},
+	"importmapping":               {src: "create import mapping if not exists M.X with json structure M.J { create M.C { Id = id } };", lister: "ListImportMappingsFunc"},
+	"exportmapping":               {src: "create export mapping if not exists M.X with json structure M.J { M.C { id = Id } };", lister: "ListExportMappingsFunc"},
+	"datatransformer":             {src: "create data transformer if not exists M.X source json '{\"id\": 1}' { jslt '{\"id\": .id}'; };", lister: "ListDataTransformersFunc"},
+	"model":                       {src: "create model if not exists M.X (Provider: MxCloudGenAI, Key: @M.K);", lister: "ListAgentEditorModelsFunc"},
+	"consumedmcpservice":          {src: "create consumed mcp service if not exists M.X (ProtocolVersion: v2025_03_26, Version: '1.0');", lister: "ListAgentEditorConsumedMCPServicesFunc"},
+	"knowledgebase":               {src: "create knowledge base if not exists M.X (Provider: MxCloudGenAI, Key: @M.K);", lister: "ListAgentEditorKnowledgeBasesFunc"},
+	"agent":                       {src: "create agent if not exists M.X (UsageType: Task, Model: M.GPT4, SystemPrompt: 'S.', UserPrompt: 'U.');", lister: "ListAgentEditorAgentsFunc"},
+	"menu":                        {src: "create menu if not exists M.X (menu item 'Plain';);", lister: "ListMenuDocumentsFunc"},
+	"module": {src: "create module if not exists X;", seed: func(mb *mock.MockBackend, mod *model.Module) {
+		x := mkModule("X")
+		mb.ListModulesFunc = func() ([]*model.Module, error) { return []*model.Module{mod, x}, nil }
+	}},
+	"modulerole": {src: "create module role if not exists M.X description 'x';", seed: func(mb *mock.MockBackend, mod *model.Module) {
+		mb.GetModuleSecurityFunc = func(model.ID) (*security.ModuleSecurity, error) {
+			return &security.ModuleSecurity{ContainerID: mod.ID, ModuleRoles: []*security.ModuleRole{{Name: "x"}}}, nil
+		}
+	}},
+	"userrole": {src: "create user role if not exists X (M.User);", seed: func(mb *mock.MockBackend, _ *model.Module) {
+		mb.GetProjectSecurityFunc = func() (*security.ProjectSecurity, error) {
+			return &security.ProjectSecurity{UserRoles: []*security.UserRole{{Name: "X"}}}, nil
+		}
+	}},
+	"demouser": {src: "create demo user if not exists 'X' password 'Password1!' (Clerk);", seed: func(mb *mock.MockBackend, _ *model.Module) {
+		mb.GetProjectSecurityFunc = func() (*security.ProjectSecurity, error) {
+			return &security.ProjectSecurity{DemoUsers: []*security.DemoUser{{UserName: "X"}}}, nil
+		}
+	}},
+	"configuration": {src: "create configuration if not exists 'X';", seed: func(mb *mock.MockBackend, _ *model.Module) {
+		mb.GetProjectSettingsFunc = func() (*model.ProjectSettings, error) {
+			return &model.ProjectSettings{Configuration: &model.ConfigurationSettings{
+				Configurations: []*model.ServerConfiguration{{Name: "x"}}}}, nil
+		}
+	}},
+	"viewentity": {src: "create view entity if not exists M.X (Name: String(100)) as (select c.Name as Name from M.C as c);", seed: seedEntityX},
+	"externalentity": {src: "create external entity if not exists M.X from consumed odata service M.Api (EntitySet: 'Xs', RemoteName: 'X');",
+		seed: seedEntityX},
+}
+
+func seedEntityX(mb *mock.MockBackend, mod *model.Module) {
+	mb.ListDomainModelsFunc = func() ([]*domainmodel.DomainModel, error) {
+		return []*domainmodel.DomainModel{{ContainerID: mod.ID, Entities: []*domainmodel.Entity{{Name: "X"}}}}, nil
+	}
+}
+
+// createGuardCtx is a project holding module M and nothing else; with exists,
+// it also holds the element the case's statement names.
+func createGuardCtx(t *testing.T, c createGuardCase, exists bool) (*ExecContext, *strings.Builder) {
+	t.Helper()
+	mod := mkModule("M")
+	mb := &mock.MockBackend{
+		IsConnectedFunc: func() bool { return true },
+		ListModulesFunc: func() ([]*model.Module, error) { return []*model.Module{mod}, nil },
+		ListDomainModelsFunc: func() ([]*domainmodel.DomainModel, error) {
+			return []*domainmodel.DomainModel{{ContainerID: mod.ID}}, nil
+		},
+		GetModuleSecurityFunc: func(model.ID) (*security.ModuleSecurity, error) {
+			return &security.ModuleSecurity{ContainerID: mod.ID}, nil
+		},
+		GetProjectSecurityFunc: func() (*security.ProjectSecurity, error) { return &security.ProjectSecurity{}, nil },
+		GetProjectSettingsFunc: func() (*model.ProjectSettings, error) {
+			return &model.ProjectSettings{Configuration: &model.ConfigurationSettings{}}, nil
+		},
+	}
+	if c.lister != "" {
+		f := reflect.ValueOf(mb).Elem().FieldByName(c.lister)
+		if !f.IsValid() {
+			t.Fatalf("MockBackend has no field %s", c.lister)
+		}
+		var items []reflect.Value
+		sliceType := f.Type().Out(0)
+		if exists {
+			elem := reflect.New(sliceType.Elem().Elem())
+			elem.Elem().FieldByName("ContainerID").Set(reflect.ValueOf(mod.ID))
+			elem.Elem().FieldByName("Name").SetString("X")
+			items = append(items, elem)
+		}
+		slice := reflect.MakeSlice(sliceType, 0, len(items))
+		slice = reflect.Append(slice, items...)
+		f.Set(reflect.MakeFunc(f.Type(), func([]reflect.Value) []reflect.Value {
+			return []reflect.Value{slice, reflect.Zero(f.Type().Out(1))}
+		}))
+	} else if exists {
+		c.seed(mb, mod)
+	}
+	ctx, _ := newMockCtx(t, withBackend(mb), withHierarchy(mkHierarchy(mod)))
+	var out strings.Builder
+	ctx.Output = &out
+	return ctx, &out
+}
+
+// runRecorded runs src through a registry whose handler for the built
+// statement only records that it ran, so the test sees exactly what the guard
+// decides, independent of what each handler needs from a mock.
+func runRecorded(t *testing.T, ctx *ExecContext, src string) (bool, error) {
+	t.Helper()
+	prog, errs := visitor.Build(src)
+	if len(errs) > 0 {
+		t.Fatalf("parse %q: %v", src, errs)
+	}
+	stmt := prog.Statements[0]
+	ran := false
+	r := NewRegistry()
+	r.handlers[reflect.TypeOf(stmt)] = func(*ExecContext, ast.Statement) error {
+		ran = true
+		return nil
+	}
+	err := r.Dispatch(ctx, stmt)
+	return ran, err
+}
+
+// An element that already exists is left alone: the handler — which would
+// refuse the create, or rewrite the element — never runs, and the skip is
+// reported.
+func TestCreateIfNotExists_ExistingElementIsLeftAlone(t *testing.T) {
+	for name, c := range createGuardCases {
+		t.Run(name, func(t *testing.T) {
+			ctx, out := createGuardCtx(t, c, true)
+			ran, err := runRecorded(t, ctx, c.src)
+			if err != nil {
+				t.Fatalf("errored: %v", err)
+			}
+			if ran {
+				t.Error("the create handler ran on an element that already exists")
+			}
+			if !strings.Contains(out.String(), "skipped (if not exists)") {
+				t.Errorf("a skipped create should say so; output: %q", out.String())
+			}
+		})
+	}
+}
+
+// CONTROL: an absent element is created — the handler runs. Without this the
+// test above passes against a guard that skips everything.
+func TestCreateIfNotExists_AbsentElementIsCreated(t *testing.T) {
+	for name, c := range createGuardCases {
+		t.Run(name, func(t *testing.T) {
+			ctx, out := createGuardCtx(t, c, false)
+			ran, err := runRecorded(t, ctx, c.src)
+			if err != nil {
+				t.Fatalf("errored: %v", err)
+			}
+			if !ran {
+				t.Errorf("the create handler did not run on an absent element; output: %q", out.String())
+			}
+		})
+	}
+}
+
+// CONTROL: without the guard, an existing element still reaches the handler —
+// the skip is the guard's doing, not the probe's.
+func TestCreateIfNotExists_UnguardedCreateReachesHandler(t *testing.T) {
+	for name, c := range createGuardCases {
+		t.Run(name, func(t *testing.T) {
+			ctx, _ := createGuardCtx(t, c, true)
+			ran, err := runRecorded(t, ctx, strings.Replace(c.src, " if not exists", "", 1))
+			if err != nil {
+				t.Fatalf("errored: %v", err)
+			}
+			if !ran {
+				t.Error("an unguarded create was skipped")
+			}
+		})
+	}
+}
+
+// Every statement type that carries the guard has an existence probe. The
+// visitor test proves every create kind builds a guarded statement; this closes
+// the loop to the executor, so the fallback "no existence check" error is
+// unreachable from a script.
+func TestCreateGuardTargetCoversEveryGuardedStatement(t *testing.T) {
+	var guarded []ast.Statement
+	for _, c := range createGuardCases {
+		prog, errs := visitor.Build(c.src)
+		if len(errs) > 0 {
+			t.Fatalf("parse %q: %v", c.src, errs)
+		}
+		guarded = append(guarded, prog.Statements[0])
+	}
+	seen := map[reflect.Type]bool{}
+	for _, s := range guarded {
+		seen[reflect.TypeOf(s)] = true
+	}
+	// Every AST type that embeds CreateGuard must be among the cases, except
+	// the two whose handlers test the guard themselves.
+	for _, s := range allKnownStatements() {
+		if _, ok := s.(ast.IfNotExistsCreate); !ok {
+			continue
+		}
+		switch s.(type) {
+		case *ast.CreateEntityStmt, *ast.CreateAssociationStmt:
+			continue
+		}
+		if !seen[reflect.TypeOf(s)] {
+			t.Errorf("%T carries the if-not-exists guard but has no case in createGuardCases", s)
+		}
+		if tgt, ok := createGuardTargetOf(s); ok && strings.HasPrefix(tgt.kind, "*ast.") {
+			t.Errorf("%T has no existence probe in createGuardTargetOf", s)
+		}
+	}
+}
diff --git a/mdl/executor/design_property_routing.go b/mdl/executor/design_property_routing.go
index 98185e7c4c..ad4f2c405c 100644
--- a/mdl/executor/design_property_routing.go
+++ b/mdl/executor/design_property_routing.go
@@ -123,7 +123,7 @@ func designPropertyAssignment(p *ThemeProperty, value any) (valueType, option st
 	if p.MultiSelect {
 		return "", "", fmt.Errorf(
 			"design property %q takes a SET of options, not one value — `set` carries a single "+
-				"value, so write it inline instead: `DesignProperties: ['%s': ['%s': on]]` on the "+
+				"value, so write it inline instead: `DesignProperties: ('%s': ('%s': on))` on the "+
 				"widget, in CREATE PAGE or an ALTER PAGE REPLACE. A single value is stored as an "+
 				"Option and mxbuild refuses it with CE6084",
 			p.Name, p.Name, firstOptionName(p, str))
diff --git a/mdl/executor/design_property_routing_test.go b/mdl/executor/design_property_routing_test.go
index 26ebf4fa8e..0ec9957e2b 100644
--- a/mdl/executor/design_property_routing_test.go
+++ b/mdl/executor/design_property_routing_test.go
@@ -144,7 +144,7 @@ func TestDesignPropertyAssignment(t *testing.T) {
 	if err == nil {
 		t.Fatal("a flat value on a multi-select property was accepted; mxbuild refuses it with CE6084")
 	}
-	if !strings.Contains(err.Error(), "['Phone': on]") {
+	if !strings.Contains(err.Error(), "('Phone': on)") {
 		t.Errorf("the message does not name the compound spelling: %v", err)
 	}
 }
diff --git a/mdl/executor/executor.go b/mdl/executor/executor.go
index bb19581283..3f5442ca75 100644
--- a/mdl/executor/executor.go
+++ b/mdl/executor/executor.go
@@ -27,6 +27,9 @@ import (
 
 // executorCache holds cached data for performance across multiple operations.
 type executorCache struct {
+	// modulesMu guards modules, the one cache a parallel describe fills
+	// lazily (see getModulesFromCache, ako/mxcli#765).
+	modulesMu    sync.Mutex
 	modules      []*model.Module
 	units        []*types.UnitInfo
 	folders      []*types.FolderInfo
diff --git a/mdl/executor/helpers.go b/mdl/executor/helpers.go
index f27bb0c48c..5e436244ad 100644
--- a/mdl/executor/helpers.go
+++ b/mdl/executor/helpers.go
@@ -22,25 +22,44 @@ import (
 
 // getModulesFromCache returns cached modules or loads them.
 func getModulesFromCache(ctx *ExecContext) ([]*model.Module, error) {
-	if ctx.Cache != nil && ctx.Cache.modules != nil {
-		return ctx.Cache.modules, nil
+	if ctx.Cache == nil {
+		return ctx.Backend.ListModules()
 	}
-	modules, err := ctx.Backend.ListModules()
+	return ctx.Cache.cachedModules(ctx.Backend.ListModules)
+}
+
+// cachedModules returns the cached module list, filling it with list on first
+// use.
+//
+// The list is filled lazily, and `refresh catalog full source` reaches this
+// from a pool of goroutines sharing one executorCache (every describeEntity
+// calls findModule). The fill is therefore made under modulesMu: unguarded,
+// one worker published its freshly built slice while another read the field,
+// which the race detector reported twice per refresh (ako/mxcli#765). The
+// slice is never mutated once published, so returning it after the lock is
+// released is safe.
+func (c *executorCache) cachedModules(list func() ([]*model.Module, error)) ([]*model.Module, error) {
+	c.modulesMu.Lock()
+	defer c.modulesMu.Unlock()
+	if c.modules != nil {
+		return c.modules, nil
+	}
+	modules, err := list()
 	if err != nil {
 		return nil, err
 	}
-	if ctx.Cache != nil {
-		ctx.Cache.modules = modules
-	}
+	c.modules = modules
 	return modules, nil
 }
 
 // invalidateModuleCache clears the module cache so next lookup gets fresh data.
 // Also invalidates the hierarchy cache since new modules affect hierarchy.
 func invalidateModuleCache(ctx *ExecContext) {
-	if ctx.Cache != nil {
-		ctx.Cache.modules = nil
-		ctx.Cache.hierarchy = nil
+	if c := ctx.Cache; c != nil {
+		c.modulesMu.Lock()
+		c.modules = nil
+		c.modulesMu.Unlock()
+		c.hierarchy = nil
 	}
 }
 
diff --git a/mdl/executor/issue1007_annotation_emit_test.go b/mdl/executor/issue1007_annotation_emit_test.go
index 775320dee7..54ffd8e8a6 100644
--- a/mdl/executor/issue1007_annotation_emit_test.go
+++ b/mdl/executor/issue1007_annotation_emit_test.go
@@ -66,9 +66,38 @@ func TestDescribeWorkflow_AttachedAnnotationPassesOwnCheck(t *testing.T) {
 	if !strings.Contains(src, "Source: Receive + Set busState = New Opening") {
 		t.Errorf("the annotation text was dropped:\n%s", src)
 	}
-	if strings.Contains(src, "annotation '") {
-		t.Errorf("still emitting an `annotation` statement:\n%s", src)
+	for _, line := range strings.Split(src, "\n") {
+		if strings.HasPrefix(strings.TrimSpace(line), "annotation '") {
+			t.Errorf("still emitting an `annotation` statement:\n%s", src)
+		}
+	}
+	// And it is attached, not a comment: a replay keeps it (ako/mxcli#707).
+	if got := reparsedAnnotations(t, src); len(got) != 1 || got[0] != jump.Annotation {
+		t.Errorf("re-parsed annotations %q, want [%q]\n%s", got, jump.Annotation, src)
+	}
+}
+
+// reparsedAnnotations is the attached annotation of every top-level activity
+// the source re-parses into that has one.
+func reparsedAnnotations(t *testing.T, src string) []string {
+	t.Helper()
+	prog, errs := visitor.Build(src)
+	if len(errs) > 0 {
+		t.Fatalf("parse: %v\n%s", errs, src)
 	}
+	var out []string
+	for _, stmt := range prog.Statements {
+		wf, ok := stmt.(*ast.CreateWorkflowStmt)
+		if !ok {
+			continue
+		}
+		for _, a := range wf.Activities {
+			if an, ok := a.(ast.AnnotatedWorkflowActivity); ok && an.ActivityAnnotation() != "" {
+				out = append(out, an.ActivityAnnotation())
+			}
+		}
+	}
+	return out
 }
 
 // A standalone annotation (a canvas sticky note) read back from the model, which
@@ -95,10 +124,11 @@ func TestDescribeWorkflow_StandaloneAnnotationPassesOwnCheck(t *testing.T) {
 	}
 }
 
-// An annotation may contain newlines, and `--` runs to end of line — so every
-// line needs its own prefix or the tail becomes stray tokens, which is the same
-// failure mode the statement form had.
-func TestDescribeWorkflow_MultiLineAnnotationCommentsEveryLine(t *testing.T) {
+// An annotation may contain newlines. It was a `--` comment, where every line
+// needed its own prefix or the tail became stray tokens; as `@annotation '…'`
+// the newlines are inside the string, and the text re-parses unchanged
+// (ako/mxcli#707).
+func TestDescribeWorkflow_MultiLineAnnotationSurvives(t *testing.T) {
 	jump := &workflows.JumpToActivity{TargetActivity: "Review"}
 	jump.Name = "j1"
 	jump.Annotation = "first line\nsecond line\nthird line"
@@ -112,12 +142,8 @@ func TestDescribeWorkflow_MultiLineAnnotationCommentsEveryLine(t *testing.T) {
 			t.Errorf("%q missing from:\n%s", want, src)
 		}
 	}
-	for _, line := range strings.Split(src, "\n") {
-		for _, part := range []string{"second line", "third line"} {
-			if strings.Contains(line, part) && !strings.Contains(line, "--") {
-				t.Errorf("continuation line is not commented: %q", line)
-			}
-		}
+	if got := reparsedAnnotations(t, src); len(got) != 1 || got[0] != jump.Annotation {
+		t.Errorf("re-parsed annotations %q, want [%q]\n%s", got, jump.Annotation, src)
 	}
 }
 
diff --git a/mdl/executor/issue707_remaining_test.go b/mdl/executor/issue707_remaining_test.go
new file mode 100644
index 0000000000..e47b86e4e2
--- /dev/null
+++ b/mdl/executor/issue707_remaining_test.go
@@ -0,0 +1,332 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package executor
+
+import (
+	"bytes"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/backend"
+	"github.com/mendixlabs/mxcli/mdl/backend/mock"
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
+	"github.com/mendixlabs/mxcli/mdl/types"
+	"github.com/mendixlabs/mxcli/mdl/visitor"
+	"github.com/mendixlabs/mxcli/model"
+	"github.com/mendixlabs/mxcli/sdk/security"
+	"github.com/mendixlabs/mxcli/sdk/workflows"
+)
+
+// ako/mxcli#707, the items #728 left open: a user role's description and
+// check-security flag, a user role with no module roles, workflow annotations,
+// REST client header expressions and image-collection file paths. Each test
+// feeds describe output to the real visitor and, where the loss was on the
+// write side, executes it and compares what is stored.
+
+// --- user roles ------------------------------------------------------------
+
+// userRoleCtx serves a project security document whose user roles the mock
+// write methods really change, so describe → exec → describe can be compared.
+func userRoleCtx(t *testing.T, roles ...*security.UserRole) (*ExecContext, *bytes.Buffer, *security.ProjectSecurity) {
+	t.Helper()
+	ps := &security.ProjectSecurity{
+		BaseElement: model.BaseElement{ID: nextID("ps")},
+		UserRoles:   roles,
+	}
+	find := func(name string) *security.UserRole {
+		for _, ur := range ps.UserRoles {
+			if ur.Name == name {
+				return ur
+			}
+		}
+		t.Fatalf("user role %s not found", name)
+		return nil
+	}
+	mb := &mock.MockBackend{
+		IsConnectedFunc:        func() bool { return true },
+		GetProjectSecurityFunc: func() (*security.ProjectSecurity, error) { return ps, nil },
+		AddUserRoleFunc: func(_ model.ID, name string, mrs []string, manageAll bool) error {
+			ps.UserRoles = append(ps.UserRoles, &security.UserRole{Name: name, ModuleRoles: mrs, ManageAllRoles: manageAll})
+			return nil
+		},
+		AlterUserRoleModuleRolesFunc: func(_ model.ID, name string, add bool, mrs []string) error {
+			ur := find(name)
+			for _, m := range mrs {
+				found := false
+				for _, have := range ur.ModuleRoles {
+					found = found || have == m
+				}
+				if !found {
+					ur.ModuleRoles = append(ur.ModuleRoles, m)
+				}
+			}
+			return nil
+		},
+		SetUserRolePropertiesFunc: func(_ model.ID, name string, p backend.UserRoleProperties) error {
+			ur := find(name)
+			if p.Description != nil {
+				ur.Description = *p.Description
+			}
+			if p.ManageAllRoles != nil {
+				ur.ManageAllRoles = *p.ManageAllRoles
+			}
+			if p.ManageUsersWithoutRoles != nil {
+				ur.ManageUsersWithoutRoles = *p.ManageUsersWithoutRoles
+			}
+			if p.CheckSecurity != nil {
+				ur.CheckSecurity = *p.CheckSecurity
+			}
+			if p.ManageableRoles != nil {
+				ur.ManageableRoles = p.ManageableRoles
+			}
+			return nil
+		},
+	}
+	ctx, buf := newMockCtx(t, withBackend(mb))
+	return ctx, buf, ps
+}
+
+// The description and the check-security flag were printed as `--` comments
+// after the statement, so a replay dropped them; the manageable roles were not
+// printed at all. Replayed onto a project without the role, the output now
+// builds the same role.
+func TestIssue707_UserRolePropertiesSurviveReplay(t *testing.T) {
+	stored := &security.UserRole{
+		Name:                    "Manager",
+		Description:             "Can't delete, can approve",
+		ModuleRoles:             []string{"Shop.Manager", "Administration.User"},
+		ManageableRoles:         []string{"Clerk", "Viewer"},
+		ManageUsersWithoutRoles: true,
+		CheckSecurity:           true,
+	}
+	src, srcBuf, _ := userRoleCtx(t, stored)
+	assertNoError(t, describeUserRole(src, ast.QualifiedName{Name: "Manager"}))
+	out := srcBuf.String()
+	prog := reparse(t, out)
+	if len(prog.Deprecations) != 0 {
+		t.Errorf("describe output uses a deprecated spelling: %+v\n%s", prog.Deprecations, out)
+	}
+	stmt := findStmt[*ast.CreateUserRoleStmt](t, prog, out)
+
+	dst, dstBuf, ps := userRoleCtx(t)
+	assertNoError(t, execCreateUserRole(dst, stmt))
+	if len(ps.UserRoles) != 1 {
+		t.Fatalf("user roles after replay = %d, want 1", len(ps.UserRoles))
+	}
+	got := ps.UserRoles[0]
+	if !reflect.DeepEqual(got, stored) {
+		t.Errorf("replay stored\n  %+v\nwant\n  %+v\n%s", got, stored, out)
+	}
+
+	dstBuf.Reset()
+	assertNoError(t, describeUserRole(dst, ast.QualifiedName{Name: "Manager"}))
+	if again := dstBuf.String(); again != out {
+		t.Errorf("describe is not a fixed point:\n--- first ---\n%s\n--- second ---\n%s", out, again)
+	}
+}
+
+// A user role with no module roles described as `create user role X;` in the
+// old form's words, which did not parse: the positional list was required.
+func TestIssue707_UserRoleWithoutModuleRolesReparses(t *testing.T) {
+	ctx, buf, _ := userRoleCtx(t, &security.UserRole{Name: "Empty"})
+	assertNoError(t, describeUserRole(ctx, ast.QualifiedName{Name: "Empty"}))
+	out := buf.String()
+	stmt := findStmt[*ast.CreateUserRoleStmt](t, reparse(t, out), out)
+	if stmt.Name != "Empty" || len(stmt.ModuleRoles) != 0 || stmt.Description != nil || stmt.CheckSecurity != nil {
+		t.Errorf("empty role re-parses as %+v\n%s", stmt, out)
+	}
+}
+
+// Control: `create or modify` states a property only when the statement does,
+// so a replay of the old positional form onto an existing role keeps the
+// stored description rather than clearing it.
+func TestIssue707_UserRoleModifyKeepsUnstatedProperties(t *testing.T) {
+	ctx, _, ps := userRoleCtx(t, &security.UserRole{
+		Name: "Clerk", Description: "Front desk", CheckSecurity: true, ModuleRoles: []string{"Shop.User"},
+	})
+	prog, errs := visitor.Build("create or modify user role Clerk (Shop.User, Shop.Viewer);")
+	if len(errs) > 0 {
+		t.Fatal(errs)
+	}
+	assertNoError(t, execCreateUserRole(ctx, prog.Statements[0].(*ast.CreateUserRoleStmt)))
+	ur := ps.UserRoles[0]
+	if ur.Description != "Front desk" || !ur.CheckSecurity {
+		t.Errorf("unstated properties changed: %+v", ur)
+	}
+	if !reflect.DeepEqual(ur.ModuleRoles, []string{"Shop.User", "Shop.Viewer"}) {
+		t.Errorf("module roles = %v", ur.ModuleRoles)
+	}
+	if len(prog.Deprecations) != 1 || prog.Deprecations[0].Code != deprecation.UserRolePositional {
+		t.Errorf("positional form recorded %+v, want %s", prog.Deprecations, deprecation.UserRolePositional)
+	}
+}
+
+// --- workflow annotations --------------------------------------------------
+
+// An activity's note, the workflow's own note and an event sub-process's note
+// were printed as `-- annotation:` comments, so a replay dropped all three.
+func TestIssue707_WorkflowAnnotationsSurvive(t *testing.T) {
+	mod := mkModule("Sales")
+	wf := mkWorkflow(mod.ID, "Approve")
+	wf.Annotation = "Starts when an order is placed; it's audited"
+	wf.Parameter = &workflows.WorkflowParameter{EntityRef: "Sales.Order"}
+	note := &workflows.NotificationActivity{}
+	note.Name = "Ready"
+	note.Caption = "Ready"
+	note.Annotation = "Line one\nLine two"
+	wf.Flow = &workflows.Flow{Activities: []workflows.WorkflowActivity{&workflows.StartWorkflowActivity{}, note, &workflows.EndWorkflowActivity{}}}
+	start := &workflows.EventSubProcessStartActivity{Interrupting: true}
+	start.Name = "Cancel"
+	wf.EventSubProcesses = []*workflows.EventSubProcess{{
+		Name:       "OnCancel",
+		Annotation: "Runs on cancel",
+		Flow:       &workflows.Flow{Activities: []workflows.WorkflowActivity{start}},
+	}}
+
+	h := mkHierarchy(mod)
+	withContainer(h, wf.ContainerID, mod.ID)
+	mb := &mock.MockBackend{
+		IsConnectedFunc:   func() bool { return true },
+		ListWorkflowsFunc: func() ([]*workflows.Workflow, error) { return []*workflows.Workflow{wf}, nil },
+	}
+	ctx, buf := newMockCtx(t, withBackend(mb), withHierarchy(h))
+	assertNoError(t, describeWorkflow(ctx, ast.QualifiedName{Module: "Sales", Name: "Approve"}))
+
+	out := buf.String()
+	if strings.Contains(out, "-- annotation") {
+		t.Errorf("an annotation is still a comment:\n%s", out)
+	}
+	stmt := findStmt[*ast.CreateWorkflowStmt](t, reparse(t, out), out)
+	if stmt.Annotation != wf.Annotation {
+		t.Errorf("workflow annotation: stored %q, re-exec stores %q\n%s", wf.Annotation, stmt.Annotation, out)
+	}
+	var got string
+	for _, a := range stmt.Activities {
+		if n, ok := a.(*ast.WorkflowNotificationNode); ok {
+			got = n.Annotation
+			// The builder carries it into the activity it writes.
+			act := buildWorkflowActivity(n)
+			if b, ok := act.(*workflows.NotificationActivity); !ok || b.Annotation != note.Annotation {
+				t.Errorf("built activity %+v, want annotation %q", act, note.Annotation)
+			}
+		}
+	}
+	if got != note.Annotation {
+		t.Errorf("activity annotation: stored %q, re-exec stores %q\n%s", note.Annotation, got, out)
+	}
+	if len(stmt.EventSubProcesses) != 1 || stmt.EventSubProcesses[0].Annotation != "Runs on cancel" {
+		t.Errorf("event sub-process annotation lost: %+v\n%s", stmt.EventSubProcesses, out)
+	}
+}
+
+// Anything but one `@annotation '…'` before a workflow activity is refused:
+// MDL writes no position for one, and Mendix attaches one note.
+func TestIssue707_WorkflowActivityRefusesOtherAnnotations(t *testing.T) {
+	for _, src := range []string{
+		"create workflow M.W parameter $WorkflowContext: M.E begin @position(1, 2) notification N; end workflow;",
+		"create workflow M.W parameter $WorkflowContext: M.E begin @annotation 'a' @annotation 'b' notification N; end workflow;",
+	} {
+		if _, errs := visitor.Build(src); len(errs) == 0 {
+			t.Errorf("accepted: %s", src)
+		}
+	}
+}
+
+// --- REST client header expressions ----------------------------------------
+
+// `'Bearer ' + $Token` stored "Bearer " and dropped the token, and describe then
+// printed the literal 'Bearer '. A header value is a template, `{P}` naming the
+// operation parameter P, so the old spelling now builds `Bearer {Token}`.
+func TestIssue707_RestHeaderExpressionKeepsTheParameter(t *testing.T) {
+	const old = "create consumed rest service M.Api (BaseUrl: 'https://x', Authentication: none) " +
+		"{ operation Get (Method: get, Path: '/a', Parameters: ($Token: String, $Key: String), " +
+		"Headers: ('Authorization' = 'Bearer ' + $Token, 'X-Key' = $Key), Response: none) };"
+	prog, errs := visitor.Build(old)
+	if len(errs) > 0 {
+		t.Fatal(errs)
+	}
+	stmt := prog.Statements[0].(*ast.CreateRestClientStmt)
+	op, err := buildRestClientOperation(stmt.Operations[0])
+	assertNoError(t, err)
+	want := map[string]string{"Authorization": "Bearer {Token}", "X-Key": "{Key}"}
+	for _, h := range op.Headers {
+		if w, ok := want[h.Name]; ok && h.Value != w {
+			t.Errorf("header %s stored %q, want %q", h.Name, h.Value, w)
+		}
+	}
+	codes := 0
+	for _, d := range prog.Deprecations {
+		if d.Code == deprecation.RestHeaderConcat {
+			codes++
+		}
+	}
+	if codes != 2 {
+		t.Errorf("recorded %d uses of %s, want 2: %+v", codes, deprecation.RestHeaderConcat, prog.Deprecations)
+	}
+
+	// Describe prints the stored template, which re-parses to itself.
+	svc := &model.ConsumedRestService{Name: "Api", BaseUrl: "https://x", Operations: []*model.RestClientOperation{op}}
+	ctx, buf := newMockCtx(t)
+	assertNoError(t, outputConsumedRestServiceMDL(ctx, svc, "M"))
+	out := buf.String()
+	re := findStmt[*ast.CreateRestClientStmt](t, reparse(t, out), out)
+	for _, h := range re.Operations[0].Headers {
+		if w, ok := want[h.Name]; ok && h.Value != w {
+			t.Errorf("describe → parse: header %s = %q, want %q\n%s", h.Name, h.Value, w, out)
+		}
+	}
+}
+
+// --- image collections -----------------------------------------------------
+
+// Describe wrote each image to /tmp/mxcli-preview and printed that path, so its
+// output replayed only on the machine that described it, until /tmp was
+// cleared. The image is now in the statement.
+func TestIssue707_ImageCollectionDescribeCarriesTheImage(t *testing.T) {
+	png := []byte("\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR")
+	odd := []byte("not an image signature")
+	mod := mkModule("Shop")
+	ic := &types.ImageCollection{
+		BaseElement: model.BaseElement{ID: nextID("ic")},
+		ContainerID: mod.ID,
+		Name:        "Icons",
+		Images: []types.Image{
+			{Name: "Logo", Data: png, Format: "Png"},
+			{Name: "Odd", Data: odd, Format: "Svg"},
+		},
+	}
+	h := mkHierarchy(mod)
+	withContainer(h, ic.ContainerID, mod.ID)
+	mb := &mock.MockBackend{
+		IsConnectedFunc:          func() bool { return true },
+		ListImageCollectionsFunc: func() ([]*types.ImageCollection, error) { return []*types.ImageCollection{ic}, nil },
+	}
+	ctx, buf := newMockCtx(t, withBackend(mb), withHierarchy(h))
+	assertNoError(t, describeImageCollection(ctx, ast.QualifiedName{Module: "Shop", Name: "Icons"}))
+	out := buf.String()
+	if strings.Contains(out, "/tmp") || strings.Contains(out, "File:") {
+		t.Errorf("describe names a file:\n%s", out)
+	}
+	stmt := findStmt[*ast.CreateImageCollectionStmt](t, reparse(t, out), out)
+	if len(stmt.Images) != 2 {
+		t.Fatalf("images = %d, want 2\n%s", len(stmt.Images), out)
+	}
+
+	var written *types.ImageCollection
+	mb.CreateImageCollectionFunc = func(c *types.ImageCollection) error { written = c; return nil }
+	mb.ListImageCollectionsFunc = func() ([]*types.ImageCollection, error) { return nil, nil }
+	mb.ListModulesFunc = func() ([]*model.Module, error) { return []*model.Module{mod}, nil }
+	assertNoError(t, execCreateImageCollection(ctx, stmt))
+	if written == nil {
+		t.Fatal("no image collection written")
+	}
+	for i, img := range written.Images {
+		want := ic.Images[i]
+		if img.Name != want.Name || !bytes.Equal(img.Data, want.Data) || img.Format != want.Format {
+			t.Errorf("image %d: replay stored %s/%q/%s, want %s/%q/%s\n%s",
+				i, img.Name, img.Data, img.Format, want.Name, want.Data, want.Format, out)
+		}
+	}
+}
diff --git a/mdl/executor/menu_signout_test.go b/mdl/executor/menu_signout_test.go
index 24bfa1cf78..f8cd2480a5 100644
--- a/mdl/executor/menu_signout_test.go
+++ b/mdl/executor/menu_signout_test.go
@@ -103,11 +103,11 @@ func TestPrintMenuMDL_RendersSignOut(t *testing.T) {
 	}, 0, "CREATE NAVIGATION")
 
 	out := b.String()
-	if !strings.Contains(out, "menu item 'Sign out' sign out;") {
+	if !strings.Contains(out, "menu item 'Sign out' ( OnClick: sign out )") {
 		t.Errorf("describe output does not round-trip the sign-out item:\n%s", out)
 	}
 	// CONTROL: a plain item must not gain an action.
-	if strings.Contains(out, "'Plain' sign out") {
+	if strings.Contains(out, "'Plain' (") {
 		t.Errorf("a plain item was rendered as sign-out:\n%s", out)
 	}
 }
@@ -120,7 +120,7 @@ func TestMenuItem_SignOutRoundTripsThroughDescribe(t *testing.T) {
 	printMenuMDL(&b, []*types.NavMenuItem{{Caption: "Sign out", ActionType: "SignOutAction"}},
 		0, "CREATE NAVIGATION")
 
-	stmt := signOutMenuStmt(t, "create or modify menu M.Main (\n"+b.String()+");")
+	stmt := signOutMenuStmt(t, "create or modify menu M.Main {\n"+b.String()+"};")
 	if !stmt.Items[0].SignOut {
 		t.Errorf("describe emitted %q, which does not parse back as a sign-out item", b.String())
 	}
diff --git a/mdl/executor/module_cache_race_test.go b/mdl/executor/module_cache_race_test.go
new file mode 100644
index 0000000000..7ac6ea140b
--- /dev/null
+++ b/mdl/executor/module_cache_race_test.go
@@ -0,0 +1,109 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package executor
+
+import (
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/mendixlabs/mxcli/mdl/backend/mock"
+	"github.com/mendixlabs/mxcli/mdl/catalog"
+	"github.com/mendixlabs/mxcli/model"
+)
+
+// ako/mxcli#765: `refresh catalog full source` describes every document from
+// a pool of goroutines that share one ExecContext.Cache. describeEntity's
+// findModule filled the module list lazily with no synchronisation, so one
+// worker published its slice while another read the field.
+
+// TestParallelEntityDescribes_NoDataRace runs the catalog's describe path —
+// preWarmCache, then captureDescribeParallel from many goroutines on one
+// shared cache — over every entity of the Studio Pro-authored PedApp fixture.
+// It only fails under `go test -race`, where it reported the two races of the
+// issue in getModulesFromCache before the fix.
+//
+// It drives entities only rather than the whole `refresh catalog full source`:
+// page, workflow and microflow describes parse expressions, and concurrent
+// ANTLR parsers race inside the runtime's shared DFA cache — a separate
+// defect that would make this test flaky without saying anything about the
+// module cache.
+func TestParallelEntityDescribes_NoDataRace(t *testing.T) {
+	exec, _ := openPedAppFixture(t)
+	ctx := exec.newExecContext(t.Context())
+	preWarmCache(ctx)
+
+	h, err := getHierarchy(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	dms, err := ctx.Backend.ListDomainModels()
+	if err != nil {
+		t.Fatal(err)
+	}
+	var names []string
+	for _, dm := range dms {
+		for _, e := range dm.Entities {
+			names = append(names, h.GetModuleName(dm.ContainerID)+"."+e.Name)
+		}
+	}
+	if len(names) < 4 {
+		t.Fatalf("PedApp has %d entities; the test needs several to run in parallel", len(names))
+	}
+
+	var wg sync.WaitGroup
+	errs := make([]error, len(names))
+	for i, name := range names {
+		wg.Go(func() {
+			_, errs[i] = captureDescribeParallel(ctx, catalog.SourceEntity, name, "")
+		})
+	}
+	wg.Wait()
+	for i, err := range errs {
+		if err != nil {
+			t.Errorf("describe entity %s: %v", names[i], err)
+		}
+	}
+}
+
+// TestModuleCache_ConcurrentFillListsOnce is the detector-free half: workers
+// that find the module cache empty at the same moment must not each list and
+// publish the modules. Unguarded, every worker that passed the nil check
+// before the first one stored its result called ListModules itself.
+func TestModuleCache_ConcurrentFillListsOnce(t *testing.T) {
+	var calls atomic.Int32
+	mb := &mock.MockBackend{
+		IsConnectedFunc: func() bool { return true },
+		ListModulesFunc: func() ([]*model.Module, error) {
+			calls.Add(1)
+			time.Sleep(20 * time.Millisecond) // hold the window open
+			return []*model.Module{{BaseElement: model.BaseElement{ID: "m1"}, Name: "Shop"}}, nil
+		},
+	}
+	ctx, _ := newMockCtx(t, withBackend(mb), withCache(&executorCache{}))
+
+	const workers = 8
+	var start, done sync.WaitGroup
+	start.Add(1)
+	errs := make([]error, workers)
+	for i := range workers {
+		done.Add(1)
+		go func() {
+			defer done.Done()
+			start.Wait()
+			_, errs[i] = findModule(ctx, "Shop")
+		}()
+	}
+	start.Done()
+	done.Wait()
+
+	for i, err := range errs {
+		if err != nil {
+			t.Errorf("worker %d: findModule: %v", i, err)
+		}
+	}
+	if n := calls.Load(); n != 1 {
+		t.Errorf("ListModules called %d times by %d concurrent lookups on one cache, want 1", n, workers)
+	}
+}
diff --git a/mdl/executor/r2_children_describe_test.go b/mdl/executor/r2_children_describe_test.go
index f982ac9d1f..1c7a92b2a7 100644
--- a/mdl/executor/r2_children_describe_test.go
+++ b/mdl/executor/r2_children_describe_test.go
@@ -92,7 +92,7 @@ func TestDescribeImageCollection_ImagesInBraces(t *testing.T) {
 	ctx, buf := newMockCtx(t, withBackend(mb), withHierarchy(h))
 	assertNoError(t, describeImageCollection(ctx, ast.QualifiedName{Module: "Icons", Name: "AppIcons"}))
 	out := buf.String()
-	assertCanonicalDescribe(t, out, "export level 'Public' {", "image Logo ( File: ", "image Home ( File: ")
+	assertCanonicalDescribe(t, out, "export level 'Public' {", "image Logo ( Data: ", "image \"Home\" ( Data: ")
 	s := findStmt[*ast.CreateImageCollectionStmt](t, reparse(t, out), out)
 	if len(s.Images) != 2 || s.Images[0].Name != "Logo" || s.Images[1].Name != "Home" {
 		t.Errorf("images = %+v", s.Images)
diff --git a/mdl/executor/r2_rest_describe_test.go b/mdl/executor/r2_rest_describe_test.go
new file mode 100644
index 0000000000..92b0d4bf38
--- /dev/null
+++ b/mdl/executor/r2_rest_describe_test.go
@@ -0,0 +1,172 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package executor
+
+import (
+	"bytes"
+	"strings"
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/backend/mock"
+	"github.com/mendixlabs/mxcli/mdl/types"
+	"github.com/mendixlabs/mxcli/model"
+	"github.com/mendixlabs/mxcli/sdk/pages"
+)
+
+// The rest of R2 (ako/mxcli#754): describe prints navigation and menus with
+// { } children, the property maps in ( ), and the database connection as a
+// property list with query children — so its output re-parses without
+// recording any deprecated spelling (MDL-DEPR120..127), and builds what was
+// described.
+
+func TestDescribeNavigation_MenuItemsAreChildren(t *testing.T) {
+	ctx, buf := newMockCtx(t)
+	outputNavigationProfile(ctx, &types.NavigationProfile{
+		Name:                  "Responsive",
+		HomePage:              &types.NavHomePage{Page: "M.Home"},
+		ThrowPartialSyncError: true,
+		MenuItems: []*types.NavMenuItem{
+			{Caption: "Home", Page: "M.Home", Icon: "Atlas_Core.Atlas.home", IconType: "Forms$IconCollectionIcon"},
+			{Caption: "Admin", IconType: "Forms$GlyphIcon", IconCode: 57345, Items: []*types.NavMenuItem{
+				{Caption: "Users", Microflow: "M.ShowUsers"},
+				{Caption: "Out", ActionType: "SignOutAction"},
+			}},
+		},
+	})
+	out := buf.String()
+	assertCanonicalDescribe(t, out,
+		"{\n  menu item 'Home' ( OnClick: show page M.Home, Icon: Atlas_Core.Atlas.home )",
+		"menu 'Admin' ( Icon: glyph 57345 ) {",
+		"menu item 'Users' ( OnClick: call microflow M.ShowUsers )",
+		"menu item 'Out' ( OnClick: sign out )",
+		"};")
+	stmt := findStmt[*ast.AlterNavigationStmt](t, reparse(t, out), out)
+	if len(stmt.MenuItems) != 2 || len(stmt.MenuItems[1].Items) != 2 || !stmt.MenuItems[1].Items[1].SignOut ||
+		stmt.MenuItems[1].IconCode != 57345 || stmt.MenuItems[0].Page == nil {
+		t.Errorf("menu did not round-trip: %+v", stmt.MenuItems)
+	}
+}
+
+// Control: a profile without menu items still ends in `;` and gains no block.
+func TestDescribeNavigation_NoMenuNoBlock(t *testing.T) {
+	ctx, buf := newMockCtx(t)
+	outputNavigationProfile(ctx, &types.NavigationProfile{Name: "Responsive", HomePage: &types.NavHomePage{Page: "M.Home"}, ThrowPartialSyncError: true})
+	out := buf.String()
+	assertCanonicalDescribe(t, out, "home page M.Home\n;")
+	if strings.Contains(out, "{") {
+		t.Errorf("a profile with no menu items gained a block:\n%s", out)
+	}
+}
+
+func TestDescribeMenu_ReParsesCanonically(t *testing.T) {
+	md := &types.MenuDocument{Name: "Main_Menu", Items: []*types.NavMenuItem{
+		{Caption: "Home", Page: "M.Home"},
+		{Caption: "More", Items: []*types.NavMenuItem{{Caption: "Out", ActionType: "SignOutAction"}}},
+	}}
+	ctx, buf := newMockCtx(t, withBackend(menuBackend(md)))
+	assertNoError(t, describeMenu(ctx, ast.QualifiedName{Module: "Atlas_Core", Name: "Main_Menu"}))
+	assertCanonicalDescribe(t, buf.String(), "create or modify menu Atlas_Core.Main_Menu {", "menu 'More' {")
+}
+
+func TestDescribeDatabaseConnection_PropertiesAndQueryChildren(t *testing.T) {
+	conn := &model.DatabaseConnection{
+		Name: "Erp", DatabaseType: "PostgreSQL",
+		ConnectionString: "M.DbUrl", UserName: "M.DbUser", Password: "M.DbPass",
+		Queries: []*model.DatabaseQuery{
+			{
+				Name: "GetCustomers",
+				SQL:  "select id, name from customer where id > {minId} and name = 'it''s'",
+				Parameters: []*model.DatabaseQueryParameter{
+					{ParameterName: "minId", DataType: "DataTypes$IntegerType", DefaultValue: "0"},
+					{ParameterName: "name", DataType: "DataTypes$StringType", EmptyValueBecomesNull: true},
+				},
+				TableMappings: []*model.DatabaseTableMapping{{Entity: "M.Customer", Columns: []*model.DatabaseColumnMapping{
+					{Attribute: "M.Customer.CustomerId", ColumnName: "id"},
+					{Attribute: "M.Customer.Name", ColumnName: "name"},
+				}}},
+			},
+			{Name: "Ping", SQL: "select 1"},
+		},
+	}
+	ctx, buf := newMockCtx(t)
+	assertNoError(t, outputDatabaseConnectionMDL(ctx, conn, "M"))
+	out := buf.String()
+	assertCanonicalDescribe(t, out, "create or modify database connection M.Erp (\n  Type: 'PostgreSQL',",
+		"query GetCustomers (", "Map: (", "CustomerId = id", "query Ping (")
+	stmt := findStmt[*ast.CreateDatabaseConnectionStmt](t, reparse(t, out), out)
+	if stmt.DatabaseType != "PostgreSQL" || stmt.ConnectionString != "M.DbUrl" || !stmt.ConnectionStringIsRef ||
+		!stmt.UserNameIsRef || !stmt.PasswordIsRef || len(stmt.Queries) != 2 {
+		t.Fatalf("connection did not round-trip: %+v", stmt)
+	}
+	q := stmt.Queries[0]
+	if q.SQL != conn.Queries[0].SQL || q.Returns.String() != "M.Customer" || len(q.Parameters) != 2 ||
+		q.Parameters[0].DefaultValue != "0" || !q.Parameters[1].TestWithNull ||
+		len(q.Mappings) != 2 || q.Mappings[0].ColumnName != "id" || q.Mappings[0].AttributeName != "CustomerId" {
+		t.Errorf("query did not round-trip: %+v", q)
+	}
+}
+
+// Control: a connection without queries ends at its property list.
+func TestDescribeDatabaseConnection_NoQueries(t *testing.T) {
+	ctx, buf := newMockCtx(t)
+	assertNoError(t, outputDatabaseConnectionMDL(ctx, &model.DatabaseConnection{
+		Name: "Erp", DatabaseType: "MSSQL", ConnectionString: "M.U", UserName: "M.N", Password: "M.P"}, "M"))
+	assertCanonicalDescribe(t, buf.String(), "Password: @M.P\n);")
+}
+
+func TestDescribeRestHeaders_AreAMap(t *testing.T) {
+	svc := &model.ConsumedRestService{
+		Name: "Api", BaseUrl: "https://api.example.com",
+		Operations: []*model.RestClientOperation{{Name: "Ping", HttpMethod: "GET", Path: "/ping", ResponseType: "NONE",
+			Headers: []*model.RestClientHeader{{Name: "Accept", Value: "application/json"}}}},
+	}
+	ctx, buf := newMockCtx(t)
+	assertNoError(t, outputConsumedRestServiceMDL(ctx, svc, "M"))
+	assertCanonicalDescribe(t, buf.String(), "Headers: ('Accept': 'application/json')")
+}
+
+// A widget's design properties and text-template parameters are maps, in ( ).
+func TestDescribeWidgetMaps_InParens(t *testing.T) {
+	var buf bytes.Buffer
+	ctx := &ExecContext{Output: &buf}
+	outputWidgetMDLV3(ctx, rawWidget{
+		Type: "Forms$DynamicText", Name: "t", Content: "Hi {1}", Parameters: []string{"Name"},
+		DesignProperties: []rawDesignProp{
+			{Key: "Spacing", ValueType: "compound", Nested: []rawDesignProp{{Key: "margin-top", ValueType: "option", Option: "Large"}}},
+			{Key: "Full width", ValueType: "toggle"},
+		},
+	}, 1)
+	outputWidgetMDLV3(ctx, rawWidget{
+		Type: "Forms$ActionButton", Name: "b", Caption: "Go {1}", Parameters: []string{"Title"}, Action: "save changes",
+	}, 1)
+	out := "create page M.P (Title: 'P', Layout: Atlas_Core.Atlas_Default) {\n" + buf.String() + "};\n"
+	assertCanonicalDescribe(t, out,
+		"ContentParams: ({1} = Name)", "CaptionParams: ({1} = Title)",
+		"DesignProperties: ('Spacing': ('margin-top': 'Large'), 'Full width': on)")
+}
+
+// A page's header maps — Params and Variables — are in ( ).
+func TestDescribePageHeaderMaps_InParens(t *testing.T) {
+	mod := mkModule("M")
+	h := mkHierarchy(mod)
+	page := &pages.Page{
+		BaseElement: model.BaseElement{ID: nextID("pg")},
+		ContainerID: mod.ID,
+		Name:        "Edit",
+		Parameters:  []*pages.PageParameter{{Name: "Order", EntityName: "M.Order"}},
+	}
+	mb := &mock.MockBackend{
+		IsConnectedFunc: func() bool { return true },
+		ListPagesFunc:   func() ([]*pages.Page, error) { return []*pages.Page{page}, nil },
+		GetRawUnitFunc: func(model.ID) (map[string]any, error) {
+			return map[string]any{"Variables": []any{int32(3), map[string]any{
+				"Name": "show", "DefaultValue": "true",
+				"VariableType": map[string]any{"$Type": "DataTypes$BooleanType"},
+			}}}, nil
+		},
+	}
+	ctx, buf := newMockCtx(t, withBackend(mb), withHierarchy(h))
+	assertNoError(t, describePage(ctx, ast.QualifiedName{Module: "M", Name: "Edit"}))
+	assertCanonicalDescribe(t, buf.String(), "Params: ( $Order: M.Order )", "Variables: ( $show: Boolean = 'true' )")
+}
diff --git a/mdl/executor/registry.go b/mdl/executor/registry.go
index 93054e789c..689c9387f0 100644
--- a/mdl/executor/registry.go
+++ b/mdl/executor/registry.go
@@ -89,6 +89,12 @@ func (r *Registry) Dispatch(ctx *ExecContext, stmt ast.Statement) error {
 	if h == nil {
 		return mdlerrors.NewUnsupported(fmt.Sprintf("unhandled statement type %T", stmt))
 	}
+	// CREATE … IF NOT EXISTS: an element that is already there is left
+	// untouched, and the handler — which would refuse or rewrite it — never
+	// runs (ako/mxcli#731).
+	if skipped, err := skipExistingCreate(ctx, stmt); skipped || err != nil {
+		return err
+	}
 	err := h(ctx, stmt)
 	// DROP … IF EXISTS: a missing target is a skip, not a failure (#531). The
 	// guard lives here rather than in the ~35 drop handlers because every one
diff --git a/mdl/executor/roundtrip_dbconnection_test.go b/mdl/executor/roundtrip_dbconnection_test.go
index 7dd2eaf5fc..781f39c6e3 100644
--- a/mdl/executor/roundtrip_dbconnection_test.go
+++ b/mdl/executor/roundtrip_dbconnection_test.go
@@ -66,15 +66,15 @@ end;`
 	env.assertContains(createMDL, []string{
 		"database connection",
 		"TestDatabase",
-		"type 'PostgreSQL'",
-		"connection string @" + testModule + ".TestDatabase_DBSource",
-		"username @" + testModule + ".TestDatabase_DBUsername",
-		"password @" + testModule + ".TestDatabase_DBPassword",
+		"Type: 'PostgreSQL'",
+		"ConnectionString: @" + testModule + ".TestDatabase_DBSource",
+		"Username: @" + testModule + ".TestDatabase_DBUsername",
+		"Password: @" + testModule + ".TestDatabase_DBPassword",
 		"query GetAllEmployees",
-		"returns " + testModule + ".Employee",
-		"id as EmployeeId",
-		"name as Name",
-		"email as Email",
+		"Returns: " + testModule + ".Employee",
+		"EmployeeId = id",
+		"Name = name",
+		"Email = email",
 	})
 }
 
@@ -129,10 +129,10 @@ end;`
 		"database connection",
 		"ParamDB",
 		"query GetRacesBySeason",
-		"parameter startYear: Integer default '1900'",
-		"parameter endYear: Integer null",
-		"returns " + testModule + ".Race",
-		"raceId as RaceId",
+		"startYear: Integer default '1900'",
+		"endYear: Integer null",
+		"Returns: " + testModule + ".Race",
+		"RaceId = raceId",
 	})
 }
 
@@ -162,9 +162,9 @@ password @` + testModule + `.SimpleDB_DBPassword;`
 	env.assertContains(createMDL, []string{
 		"database connection",
 		"SimpleDB",
-		"type 'MSSQL'",
-		"connection string @" + testModule + ".SimpleDB_DBSource",
-		"username @" + testModule + ".SimpleDB_DBUsername",
-		"password @" + testModule + ".SimpleDB_DBPassword",
+		"Type: 'MSSQL'",
+		"ConnectionString: @" + testModule + ".SimpleDB_DBSource",
+		"Username: @" + testModule + ".SimpleDB_DBUsername",
+		"Password: @" + testModule + ".SimpleDB_DBPassword",
 	})
 }
diff --git a/mdl/executor/roundtrip_restclient_test.go b/mdl/executor/roundtrip_restclient_test.go
index 489f0c23c0..af00bb2d9a 100644
--- a/mdl/executor/roundtrip_restclient_test.go
+++ b/mdl/executor/roundtrip_restclient_test.go
@@ -53,7 +53,7 @@ func TestRoundtripRestClient_WithJsonResponse(t *testing.T) {
   operation GetPosts {
     Method: get,
     Path: '/posts',
-    Headers: ('Accept' = 'application/json'),
+    Headers: ('Accept': 'application/json'),
     Response: json as $Posts
   }
 };`
@@ -65,7 +65,7 @@ func TestRoundtripRestClient_WithJsonResponse(t *testing.T) {
 		"operation GetPosts",
 		"Method: get",
 		"Path: '/posts'",
-		"'Accept' = 'application/json'",
+		"'Accept': 'application/json'",
 		"Response: json",
 	})
 }
@@ -210,7 +210,7 @@ func TestRoundtripRestClient_MultipleOperations(t *testing.T) {
     Method: get,
     Path: '/pet/findByStatus',
     Query: ($status: String),
-    Headers: ('Accept' = 'application/json'),
+    Headers: ('Accept': 'application/json'),
     Timeout: 30,
     Response: json as $PetList
   }
@@ -389,7 +389,7 @@ func TestMxCheck_RestClient_SimpleGet(t *testing.T) {
   operation GetStatus {
     Method: get,
     Path: '/status',
-    Headers: ('Accept' = '*/*'),
+    Headers: ('Accept': '*/*'),
     Response: none
   }
 };`
@@ -424,7 +424,7 @@ func TestMxCheck_RestClient_PostWithBody(t *testing.T) {
     Method: get,
     Path: '/items/{itemId}',
     Parameters: ($itemId: Integer),
-    Headers: ('Accept' = '*/*'),
+    Headers: ('Accept': '*/*'),
     Response: none
   }
 };`
@@ -474,7 +474,7 @@ func TestMxCheck_RestClient_BasicAuth(t *testing.T) {
   operation GetSecureData {
     Method: get,
     Path: '/secure/data',
-    Headers: ('Accept' = '*/*'),
+    Headers: ('Accept': '*/*'),
     Response: none
   }
 };`
@@ -508,7 +508,7 @@ func TestMxCheck_RestClient_MultipleOperations(t *testing.T) {
     Method: get,
     Path: '/pet/findByStatus',
     Query: ($status: String),
-    Headers: ('Accept' = 'application/json'),
+    Headers: ('Accept': 'application/json'),
     Timeout: 30,
     Response: none
   }
@@ -517,7 +517,7 @@ func TestMxCheck_RestClient_MultipleOperations(t *testing.T) {
     Method: get,
     Path: '/pet/{petId}',
     Parameters: ($petId: Integer),
-    Headers: ('Accept' = 'application/json'),
+    Headers: ('Accept': 'application/json'),
     Response: none
   }
 
@@ -525,7 +525,7 @@ func TestMxCheck_RestClient_MultipleOperations(t *testing.T) {
     Method: delete,
     Path: '/pet/{petId}',
     Parameters: ($petId: Integer),
-    Headers: ('Accept' = '*/*'),
+    Headers: ('Accept': '*/*'),
     Response: none
   }
 };`
diff --git a/mdl/executor/validate.go b/mdl/executor/validate.go
index 01f9c5f1ab..c07ab9dd05 100644
--- a/mdl/executor/validate.go
+++ b/mdl/executor/validate.go
@@ -941,7 +941,7 @@ func (sc *scriptContext) relaxExcludedWidgetRefs(kind, name string, widgets []*a
 // nested container with a data source of its own, which scopes its children.
 //
 // Covered: `Attribute:`, `CaptionAttribute:`, `Visible: Attr in (…)` and
-// template parameters (`…Params: [{1} = Attr]`). Anything else is caught by
+// template parameters (`…Params: ({1} = Attr)`). Anything else is caught by
 // the page writer's refusal of a bare attribute reference.
 func unscopedBindings(widgets []*ast.WidgetV3, ref string) []string {
 	var out []string
diff --git a/mdl/executor/validate_alter_styling.go b/mdl/executor/validate_alter_styling.go
index 2b66d9dd30..8682149a29 100644
--- a/mdl/executor/validate_alter_styling.go
+++ b/mdl/executor/validate_alter_styling.go
@@ -98,7 +98,7 @@ func validateAlterStylingDesignProps(prog *ast.Program, reg *ThemeRegistry) []li
 							"and ALTER STYLING can only write one value — mxbuild refuses the result "+
 							"with CE6084", label, a.Property, s.WidgetName),
 						Location: linter.Location{DocumentType: "page", DocumentName: s.ContainerName.String()},
-						Suggestion: fmt.Sprintf("Set it inline instead: `DesignProperties: ['%s': ['%s': on]]` "+
+						Suggestion: fmt.Sprintf("Set it inline instead: `DesignProperties: ('%s': ('%s': on))` "+
 							"on the widget in CREATE PAGE, or in an ALTER PAGE REPLACE.",
 							a.Property, firstOptionName(multi, a.Value)),
 					})
@@ -241,7 +241,7 @@ func renamedStylingSuggestion(r *designPropRename, value string) string {
 	}
 	if strings.Contains(r.Replacement, "[") {
 		return fmt.Sprintf("ALTER STYLING cannot write its current form, which is a compound: set "+
-			"`DesignProperties: [%s]` on the widget in CREATE PAGE, or in an ALTER PAGE REPLACE.", r.Replacement)
+			"`DesignProperties: (%s)` on the widget in CREATE PAGE, or in an ALTER PAGE REPLACE.", r.Replacement)
 	}
 	// 'Key': 'Value'  →  set ( 'Key': 'Value' ), the canonical list (R3)
 	if strings.Contains(r.Replacement, "': ") {
diff --git a/mdl/executor/validate_dbconnection.go b/mdl/executor/validate_dbconnection.go
index 5bc727ecf4..ac546b6597 100644
--- a/mdl/executor/validate_dbconnection.go
+++ b/mdl/executor/validate_dbconnection.go
@@ -32,25 +32,29 @@ import (
 // `password` it would bake a secret into the model as a design-time default —
 // exactly what the constant indirection exists to avoid.
 var dbConnectionConstantProps = []struct {
-	label  string // the MDL keyword, so the message points at what was typed
+	label  string // the property in words, so the message names what was set
+	key    string // the canonical property key the suggestion writes (R2)
 	value  func(*ast.CreateDatabaseConnectionStmt) string
 	isRef  func(*ast.CreateDatabaseConnectionStmt) bool
 	sample string
 }{
 	{
 		label:  "connection string",
+		key:    "ConnectionString",
 		value:  func(s *ast.CreateDatabaseConnectionStmt) string { return s.ConnectionString },
 		isRef:  func(s *ast.CreateDatabaseConnectionStmt) bool { return s.ConnectionStringIsRef },
 		sample: "DbUrl",
 	},
 	{
 		label:  "username",
+		key:    "Username",
 		value:  func(s *ast.CreateDatabaseConnectionStmt) string { return s.UserName },
 		isRef:  func(s *ast.CreateDatabaseConnectionStmt) bool { return s.UserNameIsRef },
 		sample: "DbUser",
 	},
 	{
 		label:  "password",
+		key:    "Password",
 		value:  func(s *ast.CreateDatabaseConnectionStmt) string { return s.Password },
 		isRef:  func(s *ast.CreateDatabaseConnectionStmt) bool { return s.PasswordIsRef },
 		sample: "DbPassword",
@@ -87,9 +91,9 @@ func ValidateDatabaseConnection(stmt *ast.CreateDatabaseConnectionStmt) []linter
 				"(StorageLoadException: \"is not a valid ConstantIdentifier\")",
 				stmt.Name.String(), p.label),
 			Suggestion: fmt.Sprintf("Declare a constant and reference it: "+
-				"`create constant %s.%s type String default '…';` then `%s @%s.%s`. "+
+				"`create constant %s.%s type String default '…';` then `%s: @%s.%s`. "+
 				"The indirection is how Mendix keeps the value per-environment rather than in the model.",
-				module, p.sample, p.label, module, p.sample),
+				module, p.sample, p.key, module, p.sample),
 			Location: loc,
 		})
 	}
diff --git a/mdl/executor/validate_dbconnection_test.go b/mdl/executor/validate_dbconnection_test.go
index 397ab07b05..fec8859460 100644
--- a/mdl/executor/validate_dbconnection_test.go
+++ b/mdl/executor/validate_dbconnection_test.go
@@ -29,6 +29,7 @@ func TestValidateDatabaseConnection_RejectsLiteralCredentials(t *testing.T) {
 		name     string
 		stmt     *ast.CreateDatabaseConnectionStmt
 		wantProp string
+		wantKey  string // the canonical (R2) property key the suggestion writes
 	}{
 		{
 			name: "literal connection string",
@@ -37,6 +38,7 @@ func TestValidateDatabaseConnection_RejectsLiteralCredentials(t *testing.T) {
 				ConnectionString: "jdbc:postgresql://localhost:5432/app",
 			},
 			wantProp: "connection string",
+			wantKey:  "ConnectionString: @M.DbUrl",
 		},
 		{
 			name: "literal username",
@@ -45,6 +47,7 @@ func TestValidateDatabaseConnection_RejectsLiteralCredentials(t *testing.T) {
 				UserName: "app",
 			},
 			wantProp: "username",
+			wantKey:  "Username: @M.DbUser",
 		},
 		{
 			name: "literal password",
@@ -53,6 +56,7 @@ func TestValidateDatabaseConnection_RejectsLiteralCredentials(t *testing.T) {
 				Password: "secret",
 			},
 			wantProp: "password",
+			wantKey:  "Password: @M.DbPassword",
 		},
 	}
 
@@ -73,6 +77,11 @@ func TestValidateDatabaseConnection_RejectsLiteralCredentials(t *testing.T) {
 			if !strings.Contains(v.Suggestion, "@") || !strings.Contains(strings.ToLower(v.Suggestion), "constant") {
 				t.Errorf("suggestion %q does not point at the `@Module.Constant` form", v.Suggestion)
 			}
+			// ... in the canonical property-list spelling (R2, #754), not the
+			// deprecated clause (`username @M.X`, MDL-DEPR127).
+			if !strings.Contains(v.Suggestion, tc.wantKey) {
+				t.Errorf("suggestion %q does not write the canonical %q", v.Suggestion, tc.wantKey)
+			}
 		})
 	}
 }
diff --git a/mdl/executor/validate_duplicates.go b/mdl/executor/validate_duplicates.go
index 77c77ead21..3bceec58de 100644
--- a/mdl/executor/validate_duplicates.go
+++ b/mdl/executor/validate_duplicates.go
@@ -89,8 +89,20 @@ func (r *nameRegistry) renameModule(oldMod, newMod string) {
 // re-runnable domain scripts use it. Missing it makes the check disagree with
 // what exec does, and the check is wrong: a `create entity if not exists` was
 // reported as a conflict for a statement exec cleanly skips.
-// TestIfNotExistsCountsAsIdempotent guards the mapping.
+// TestIfNotExistsCountsAsIdempotent guards the mapping. The guard is read once,
+// here, for every document kind that carries it (ako/mxcli#731).
 func stmtCreateInfo(stmt ast.Statement) (docType, name string, idempotent bool) {
+	docType, name, idempotent = stmtCreateKind(stmt)
+	if g, ok := stmt.(ast.IfNotExistsCreate); ok && g.CreateIfNotExists() {
+		idempotent = true
+	}
+	return docType, name, idempotent
+}
+
+// stmtCreateKind is stmtCreateInfo without the `if not exists` guard: the
+// doc-type key, the qualified name, and whether `or modify` / `or replace`
+// makes the create idempotent.
+func stmtCreateKind(stmt ast.Statement) (docType, name string, idempotent bool) {
 	switch s := stmt.(type) {
 	case *ast.CreateModuleStmt:
 		return "module", s.Name, false
@@ -100,7 +112,7 @@ func stmtCreateInfo(stmt ast.Statement) (docType, name string, idempotent bool)
 		// existing role, so check has to as well.
 		return "module-role", s.Name.String(), s.CreateOrModify
 	case *ast.CreateEntityStmt:
-		return "entity", s.Name.String(), s.CreateOrModify || s.IfNotExists
+		return "entity", s.Name.String(), s.CreateOrModify
 	case *ast.CreateViewEntityStmt:
 		return "entity", s.Name.String(), s.CreateOrModify || s.CreateOrReplace
 	case *ast.CreateExternalEntityStmt:
@@ -108,7 +120,7 @@ func stmtCreateInfo(stmt ast.Statement) (docType, name string, idempotent bool)
 	case *ast.CreateEnumerationStmt:
 		return "enumeration", s.Name.String(), s.CreateOrModify
 	case *ast.CreateAssociationStmt:
-		return "association", s.Name.String(), s.CreateOrModify || s.IfNotExists
+		return "association", s.Name.String(), s.CreateOrModify
 	case *ast.CreateConstantStmt:
 		return "constant", s.Name.String(), s.CreateOrModify
 	case *ast.CreateMicroflowStmt:
diff --git a/mdl/executor/validate_duplicates_coverage_test.go b/mdl/executor/validate_duplicates_coverage_test.go
index a2c8917d62..b75305db34 100644
--- a/mdl/executor/validate_duplicates_coverage_test.go
+++ b/mdl/executor/validate_duplicates_coverage_test.go
@@ -9,6 +9,8 @@ import (
 	"sort"
 	"strconv"
 	"testing"
+
+	mdlast "github.com/mendixlabs/mxcli/mdl/ast"
 )
 
 // projectCheckExemptDocTypes lists the doc types stmtCreateInfo can return that
@@ -95,7 +97,7 @@ func docTypesFromSwitch(t *testing.T, funcName, kind string) map[string]bool {
 //
 // Nothing compared the two switches, so the gap was silent. This does.
 func TestEveryCreateDocTypeIsProjectChecked(t *testing.T) {
-	created := docTypesFromSwitch(t, "stmtCreateInfo", "return")
+	created := docTypesFromSwitch(t, "stmtCreateKind", "return")
 	checked := docTypesFromSwitch(t, "setFor", "case")
 
 	var missing []string
@@ -136,7 +138,7 @@ func TestEveryCreateDocTypeIsProjectChecked(t *testing.T) {
 // type DROP knows and CREATE does not is harmless, but the reverse means a
 // `drop X; create X;` pair reports a conflict the script already resolved.
 func TestEveryDropDocTypeIsCreatable(t *testing.T) {
-	created := docTypesFromSwitch(t, "stmtCreateInfo", "return")
+	created := docTypesFromSwitch(t, "stmtCreateKind", "return")
 	dropped := docTypesFromSwitch(t, "stmtDropInfo", "return")
 
 	var missing []string
@@ -161,93 +163,34 @@ func TestEveryDropDocTypeIsCreatable(t *testing.T) {
 // was told its `create entity if not exists` conflicted with the project, for
 // a statement exec skips with "already exists — skipped".
 //
-// The guard reads both sides out of source: every `case *ast.XStmt` in
-// stmtCreateInfo whose AST type declares an IfNotExists field must mention
-// IfNotExists in that case's return. Neither list is restated here.
+// Since #731 every document kind carries the guard (ast.CreateGuard), and
+// stmtCreateInfo reads it once for all of them. This walks every known
+// statement type rather than restating a list: each one that carries the guard
+// and is classified as a create must count as idempotent once guarded — and,
+// as the control, not before.
 func TestIfNotExistsCountsAsIdempotent(t *testing.T) {
-	// Which mdl/ast CREATE types declare an IfNotExists field.
-	fset := token.NewFileSet()
-	pkgs, err := parser.ParseDir(fset, "../ast", nil, 0)
-	if err != nil {
-		t.Fatalf("parse mdl/ast: %v", err)
-	}
-	hasIfNotExists := map[string]bool{}
-	for _, pkg := range pkgs {
-		for _, f := range pkg.Files {
-			ast.Inspect(f, func(n ast.Node) bool {
-				ts, ok := n.(*ast.TypeSpec)
-				if !ok {
-					return true
-				}
-				st, ok := ts.Type.(*ast.StructType)
-				if !ok || st.Fields == nil {
-					return true
-				}
-				for _, fld := range st.Fields.List {
-					for _, nm := range fld.Names {
-						if nm.Name == "IfNotExists" {
-							hasIfNotExists[ts.Name.Name] = true
-						}
-					}
-				}
-				return true
-			})
-		}
-	}
-	if len(hasIfNotExists) == 0 {
-		t.Fatal("found no mdl/ast type with an IfNotExists field — the guard would pass vacuously")
-	}
-
-	// Which of them stmtCreateInfo handles, and whether its case consults the field.
-	fset2 := token.NewFileSet()
-	f, err := parser.ParseFile(fset2, "validate_duplicates.go", nil, 0)
-	if err != nil {
-		t.Fatalf("parse validate_duplicates.go: %v", err)
-	}
-	var fn *ast.FuncDecl
-	for _, d := range f.Decls {
-		if fd, ok := d.(*ast.FuncDecl); ok && fd.Name.Name == "stmtCreateInfo" {
-			fn = fd
-			break
-		}
-	}
-	if fn == nil {
-		t.Fatal("stmtCreateInfo not found")
-	}
-
 	checked := 0
-	ast.Inspect(fn, func(n ast.Node) bool {
-		c, ok := n.(*ast.CaseClause)
+	for _, stmt := range allKnownStatements() {
+		g, ok := stmt.(mdlast.IfNotExistsCreate)
 		if !ok {
-			return true
+			continue
 		}
-		for _, e := range c.List {
-			star, ok := e.(*ast.StarExpr)
-			if !ok {
-				continue
-			}
-			sel, ok := star.X.(*ast.SelectorExpr)
-			if !ok || !hasIfNotExists[sel.Sel.Name] {
-				continue
-			}
-			checked++
-			consulted := false
-			ast.Inspect(c, func(m ast.Node) bool {
-				if id, ok := m.(*ast.Ident); ok && id.Name == "IfNotExists" {
-					consulted = true
-				}
-				return true
-			})
-			if !consulted {
-				t.Errorf("stmtCreateInfo case *ast.%s ignores its IfNotExists field: "+
-					"`create ... if not exists` on an element the project already has would be "+
-					"reported as a conflict, for a statement exec cleanly skips. "+
-					"Return `s.CreateOrModify || s.IfNotExists`.", sel.Sel.Name)
-			}
+		dt, _, before := stmtCreateInfo(stmt)
+		if dt == "" {
+			continue // not a create the duplicate checks track
 		}
-		return true
-	})
+		checked++
+		if before {
+			t.Errorf("%T counts as idempotent without any guard — the control is void", stmt)
+			continue
+		}
+		g.SetCreateIfNotExists(false)
+		if _, _, after := stmtCreateInfo(stmt); !after {
+			t.Errorf("%T: `create … if not exists` is not idempotent to stmtCreateInfo: "+
+				"it would be reported as a conflict for a statement exec cleanly skips", stmt)
+		}
+	}
 	if checked == 0 {
-		t.Fatal("stmtCreateInfo handles no type with an IfNotExists field — the guard would pass vacuously")
+		t.Fatal("no guarded create statement is classified by stmtCreateInfo — the guard would pass vacuously")
 	}
 }
diff --git a/mdl/executor/validate_idempotency_guard_test.go b/mdl/executor/validate_idempotency_guard_test.go
index a972952827..247583f38c 100644
--- a/mdl/executor/validate_idempotency_guard_test.go
+++ b/mdl/executor/validate_idempotency_guard_test.go
@@ -18,6 +18,14 @@ func TestMDL067RejectsContradictoryGuards(t *testing.T) {
 	for _, src := range []string{
 		`create or modify entity if not exists M."Game" ("Level": string(20));`,
 		`create or modify association if not exists M.Move_Game from M.Move to M.Game;`,
+		// Every other document kind carries the same guard (ako/mxcli#731).
+		`create or modify page if not exists M.P (Title: 'P', Layout: Atlas_Core.Atlas_Default) { dynamictext t (Content: 'x') };`,
+		`create or modify microflow if not exists M.MF () begin return; end;`,
+		`create or modify enumeration if not exists M.E (A 'A');`,
+		`create or replace constant if not exists M.C type String default 'a';`,
+		`create or modify module role if not exists M.User;`,
+		`create or modify configuration if not exists 'Default';`,
+		`create or modify view entity if not exists M.V (Name: String(100)) as (select c.Name as Name from M.C as c);`,
 	} {
 		prog, errs := visitor.Build(src)
 		if len(errs) > 0 {
@@ -48,6 +56,10 @@ func TestMDL067LeavesEitherGuardAlone(t *testing.T) {
 		`create association if not exists M.Move_Game from M.Move to M.Game;`,
 		`create or modify association M.Move_Game from M.Move to M.Game;`,
 		`create entity M."Game" ("Level": string(20));`,
+		`create page if not exists M.P (Title: 'P', Layout: Atlas_Core.Atlas_Default) { dynamictext t (Content: 'x') };`,
+		`create or modify page M.P (Title: 'P', Layout: Atlas_Core.Atlas_Default) { dynamictext t (Content: 'x') };`,
+		`create microflow if not exists M.MF () begin return; end;`,
+		`create module role if not exists M.User;`,
 	} {
 		prog, errs := visitor.Build(src)
 		if len(errs) > 0 {
@@ -72,7 +84,7 @@ func TestCreateEntityIfNotExistsSkipsWithoutTouching(t *testing.T) {
 		Name:        ast.QualifiedName{Module: "Sudoku", Name: "Game"},
 		Kind:        ast.EntityPersistent,
 		Attributes:  []ast.Attribute{{Name: "OnlyThisOne", Type: ast.DataType{Kind: ast.TypeInteger}}},
-		IfNotExists: true,
+		CreateGuard: ast.CreateGuard{IfNotExists: true},
 	})
 	assertNoError(t, err)
 	if *updated {
diff --git a/mdl/executor/validate_odata_properties_drift_test.go b/mdl/executor/validate_odata_properties_drift_test.go
index 08cef446ac..8966f3781b 100644
--- a/mdl/executor/validate_odata_properties_drift_test.go
+++ b/mdl/executor/validate_odata_properties_drift_test.go
@@ -78,7 +78,7 @@ func TestKnownODataProps_CoverEveryASTField(t *testing.T) {
 			"external entity", reflect.TypeOf(ast.CreateExternalEntityStmt{}), knownExternalEntityProps,
 			map[string]bool{
 				"Name": true, "ServiceRef": true, "Attributes": true, "Documentation": true,
-				"CreateOrModify": true, "UnknownProperties": true,
+				"CreateOrModify": true, "UnknownProperties": true, "CreateGuard": true,
 			},
 		},
 	}
diff --git a/mdl/executor/validate_program.go b/mdl/executor/validate_program.go
index fb2b710ddf..3359e92503 100644
--- a/mdl/executor/validate_program.go
+++ b/mdl/executor/validate_program.go
@@ -47,6 +47,9 @@ func ValidateProgram(prog *ast.Program, projectPath string) []linter.Violation {
 				assocStmt.CreateOrModify, assocStmt.IfNotExists, "association", assocStmt.Name.String())...)
 			violations = append(violations, ValidateAssociationModules(assocStmt)...)
 		}
+		// Every other guarded create carries the same contradiction (#731).
+		// Entities and associations report it above, from their own flags.
+		violations = append(violations, validateCreateGuardContradiction(stmt)...)
 		// A user role with no System module role cannot sign in (CE0156) — but
 		// only once security is on, which the script may say itself.
 		if roleStmt, ok := stmt.(*ast.CreateUserRoleStmt); ok {
diff --git a/mdl/executor/validate_role_and_url.go b/mdl/executor/validate_role_and_url.go
index fa39a3a2eb..caf0500b0d 100644
--- a/mdl/executor/validate_role_and_url.go
+++ b/mdl/executor/validate_role_and_url.go
@@ -58,7 +58,7 @@ func ValidateUserRoleSystemModuleRole(stmt *ast.CreateUserRoleStmt, securityEnab
 		Message: fmt.Sprintf(
 			"user role %q has no System module role — %snobody holding it can sign in or read "+
 				"System entities (MxBuild reports this as CE0156 once security is on; at security "+
-				"level Off it is not flagged). Add System.User: CREATE USER ROLE %s (%s, System.User)",
+				"level Off it is not flagged). Add System.User: CREATE USER ROLE %s ( ModuleRoles: (%s, System.User) )",
 			stmt.Name, when, stmt.Name, joinQualified(stmt.ModuleRoles)),
 	}}
 }
diff --git a/mdl/executor/validate_widget_member_refs.go b/mdl/executor/validate_widget_member_refs.go
index dae0fd3216..b4758d0297 100644
--- a/mdl/executor/validate_widget_member_refs.go
+++ b/mdl/executor/validate_widget_member_refs.go
@@ -29,7 +29,7 @@ import (
 //     (mendixlabs/mxcli#1046). The writer put the whole string in the attribute
 //     name, so the model came out naming an attribute that could never exist:
 //
-//     ContentParams: [{1} = $Customer/Name]
+//     ContentParams: ({1} = $Customer/Name)
 //     mx check -> [CE1613] "The selected attribute
 //     'Bench.Customer.$Customer/Name' no longer exists."
 //
diff --git a/mdl/executor/validate_widgets.go b/mdl/executor/validate_widgets.go
index a5fb7edc8a..cfe349f399 100644
--- a/mdl/executor/validate_widgets.go
+++ b/mdl/executor/validate_widgets.go
@@ -826,7 +826,7 @@ func validateDynamicTextFormatting(w *ast.WidgetV3, locationPrefix string) []lin
 					RuleID:   "MDL-WIDGET18",
 					Severity: linter.SeverityError,
 					Message: fmt.Sprintf(
-						"%s: widget `%s`: `%s` is a per-parameter format, not a widget property — put it in the ContentParams format block, e.g. `ContentParams: [{1} = Attr format (%s: <value>)]`. A widget-level `%s` is dropped on write.",
+						"%s: widget `%s`: `%s` is a per-parameter format, not a widget property — put it in the ContentParams format block, e.g. `ContentParams: ({1} = Attr format (%s: <value>))`. A widget-level `%s` is dropped on write.",
 						locationPrefix, w.Name, key, strings.ToLower(key), key,
 					),
 				})
@@ -1150,7 +1150,7 @@ func validateDynamicTextPlaceholders(w *ast.WidgetV3, locationPrefix string) *li
 		RuleID:   "MDL-WIDGET04",
 		Severity: linter.SeverityError,
 		Message: fmt.Sprintf(
-			"%s: widget `%s` (dynamictext) references template placeholder {%d} but only %d parameter(s) are bound — bind it with `Attribute: <attr>` or `ContentParams: [{%d} = <attr>]`. An orphaned placeholder crashes Studio Pro.",
+			"%s: widget `%s` (dynamictext) references template placeholder {%d} but only %d parameter(s) are bound — bind it with `Attribute: <attr>` or `ContentParams: ({%d} = <attr>)`. An orphaned placeholder crashes Studio Pro.",
 			locationPrefix, w.Name, maxIdx, params, maxIdx,
 		),
 	}
@@ -1176,7 +1176,7 @@ func validateButtonCaptionPlaceholders(w *ast.WidgetV3, locationPrefix string) *
 		RuleID:   "MDL-WIDGET04",
 		Severity: linter.SeverityError,
 		Message: fmt.Sprintf(
-			"%s: %s caption references template placeholder {%d} but only %d parameter(s) are bound — bind it with `CaptionParams: [{%d} = <attr>]`. An orphaned placeholder fails the build (CE0720).",
+			"%s: %s caption references template placeholder {%d} but only %d parameter(s) are bound — bind it with `CaptionParams: ({%d} = <attr>)`. An orphaned placeholder fails the build (CE0720).",
 			locationPrefix, widgetLabel(w.Name, strings.ToLower(w.Type)), maxIdx, params, maxIdx,
 		),
 	}
diff --git a/mdl/executor/validate_workflow.go b/mdl/executor/validate_workflow.go
index 4bc5ef443c..f197fa1bf2 100644
--- a/mdl/executor/validate_workflow.go
+++ b/mdl/executor/validate_workflow.go
@@ -371,9 +371,11 @@ func ValidateAlterWorkflow(stmt *ast.AlterWorkflowStmt) []linter.Violation {
 	for _, op := range stmt.Operations {
 		switch o := op.(type) {
 		case *ast.InsertAfterOp:
-			added = append(added, o.NewActivity)
+			added = append(added, o.NewActivities...)
+		case *ast.InsertBeforeOp:
+			added = append(added, o.NewActivities...)
 		case *ast.ReplaceActivityOp:
-			added = append(added, o.NewActivity)
+			added = append(added, o.NewActivities...)
 		case *ast.InsertOutcomeOp:
 			added = append(added, o.Activities...)
 		case *ast.InsertPathOp:
diff --git a/mdl/executor/validate_workflow_activity_kind.go b/mdl/executor/validate_workflow_activity_kind.go
index fb96622b67..ba1ef5c1db 100644
--- a/mdl/executor/validate_workflow_activity_kind.go
+++ b/mdl/executor/validate_workflow_activity_kind.go
@@ -67,7 +67,7 @@ const (
 
 // workflowOpSlot describes one inserting op for the diagnostic.
 type workflowOpSlot struct {
-	op      string              // the MDL keywords, as the author wrote them
+	op      string              // the fragment `insert into` takes, in its canonical spelling
 	slot    workflowOutcomeSlot // which typed list it writes into
 	writes  string              // the BSON $Type it writes
 	accepts string              // the activity kinds whose list holds that type
@@ -75,19 +75,19 @@ type workflowOpSlot struct {
 
 var workflowOpSlots = map[workflowOutcomeSlot]workflowOpSlot{
 	slotUserTaskOutcome: {
-		op: "INSERT OUTCOME", slot: slotUserTaskOutcome,
+		op: "outcomes '<name>' { … }", slot: slotUserTaskOutcome,
 		writes: "Workflows$UserTaskOutcome", accepts: "a user task",
 	},
 	slotParallelSplitOutcome: {
-		op: "INSERT PATH", slot: slotParallelSplitOutcome,
+		op: "path { … }", slot: slotParallelSplitOutcome,
 		writes: "Workflows$ParallelSplitOutcome", accepts: "a parallel split",
 	},
 	slotConditionOutcome: {
-		op: "INSERT CONDITION", slot: slotConditionOutcome,
+		op: "outcomes <value> -> { … }", slot: slotConditionOutcome,
 		writes: "Workflows$…ConditionOutcome", accepts: "a decision or a call microflow",
 	},
 	slotBoundaryEvent: {
-		op: "INSERT BOUNDARY EVENT", slot: slotBoundaryEvent,
+		op: "boundary event …", slot: slotBoundaryEvent,
 		writes: "a boundary event", accepts: "a user task, call microflow, call workflow or wait for notification",
 	},
 }
@@ -121,11 +121,11 @@ func activityAcceptsSlot(a workflows.WorkflowActivity, slot workflowOutcomeSlot)
 func opForActivity(a workflows.WorkflowActivity) string {
 	switch a.(type) {
 	case *workflows.UserTask:
-		return "INSERT OUTCOME '<value>'"
+		return "outcomes '<name>' { … }"
 	case *workflows.ExclusiveSplitActivity, *workflows.CallMicroflowTask, *workflows.SystemTask:
-		return "INSERT CONDITION '<Module.Enumeration.Value>'"
+		return "outcomes '<Module.Enumeration.Value>' -> { … }"
 	case *workflows.ParallelSplitActivity:
-		return "INSERT PATH"
+		return "path { … }"
 	}
 	return ""
 }
@@ -175,25 +175,45 @@ func validateAlterWorkflowActivityKinds(ctx *ExecContext, s *ast.AlterWorkflowSt
 		kind := describeActivityKind(target)
 		remedy := fmt.Sprintf("%s takes %s", spec.op, spec.accepts)
 		if alt := opForActivity(target); alt != "" && slot != slotBoundaryEvent {
-			remedy = fmt.Sprintf("use `%s ON %s { … }` to add a branch to %s (%s takes %s)",
-				alt, ref, kind, spec.op, spec.accepts)
+			remedy = fmt.Sprintf("use `insert into %s { %s }` to add a branch to %s (%s takes %s)",
+				ref, alt, kind, spec.op, spec.accepts)
 		}
 		errs = append(errs, fmt.Sprintf(
-			"%s on '%s' is refused: it writes %s, and %s cannot hold one — the project would not LOAD "+
+			"`insert into %s { %s }` is refused: it writes %s, and %s cannot hold one — the project would not LOAD "+
 				"(Studio Pro will not open it and `mx check` dies before validating anything); %s",
-			spec.op, ref, spec.writes, kind, remedy))
+			ref, spec.op, spec.writes, kind, remedy))
 	}
 
+	added := map[workflows.WorkflowActivity]int{} // paths this statement already added, per split
 	for _, op := range s.Operations {
 		switch o := op.(type) {
 		case *ast.InsertOutcomeOp:
 			check(o.ActivityRef, o.AtPosition, slotUserTaskOutcome)
 		case *ast.InsertPathOp:
 			check(o.ActivityRef, o.AtPosition, slotParallelSplitOutcome)
+			if split, ok := resolveStoredActivity(wf.Flow, o.ActivityRef, o.AtPosition).(*workflows.ParallelSplitActivity); ok {
+				next := len(split.Outcomes) + added[split] + 1
+				added[split]++
+				if o.PathNumber > 0 && o.PathNumber != next {
+					errs = append(errs, fmt.Sprintf(
+						"insert into '%s' { path %d { … } } is refused: '%s' has %d paths, so a path added here is path %d — "+
+							"write `path %d`, or leave the number out to append one",
+						o.ActivityRef, o.PathNumber, o.ActivityRef, next-1, next, next))
+				}
+			}
 		case *ast.InsertBranchOp:
 			check(o.ActivityRef, o.AtPosition, slotConditionOutcome)
 		case *ast.InsertBoundaryEventOp:
 			check(o.ActivityRef, o.AtPosition, slotBoundaryEvent)
+		case *ast.InsertBeforeOp:
+			// A flow begins with its start activity; anything before it is
+			// CE9526 "Main process in workflow should start with a start event".
+			if _, ok := resolveStoredActivity(wf.Flow, o.ActivityRef, o.AtPosition).(*workflows.StartWorkflowActivity); ok {
+				errs = append(errs, fmt.Sprintf(
+					"`insert before %s` is refused: '%s' is the workflow's start activity, and a flow must begin with it "+
+						"(mx check CE9526); use `insert after %s { … }` to add activities at the start of the flow",
+					o.ActivityRef, o.ActivityRef, o.ActivityRef))
+			}
 		}
 	}
 	return errs
diff --git a/mdl/executor/validate_workflow_end.go b/mdl/executor/validate_workflow_end.go
index eebe9473f0..e37a254939 100644
--- a/mdl/executor/validate_workflow_end.go
+++ b/mdl/executor/validate_workflow_end.go
@@ -166,9 +166,11 @@ func ValidateAlterWorkflowEnds(stmt *ast.AlterWorkflowStmt) []linter.Violation {
 	for _, op := range stmt.Operations {
 		switch o := op.(type) {
 		case *ast.InsertAfterOp:
-			collectEndBodies(endBody{activities: []ast.WorkflowActivityNode{o.NewActivity}}, &bodies)
+			collectEndBodies(endBody{activities: o.NewActivities}, &bodies)
+		case *ast.InsertBeforeOp:
+			collectEndBodies(endBody{activities: o.NewActivities}, &bodies)
 		case *ast.ReplaceActivityOp:
-			collectEndBodies(endBody{activities: []ast.WorkflowActivityNode{o.NewActivity}}, &bodies)
+			collectEndBodies(endBody{activities: o.NewActivities}, &bodies)
 		case *ast.InsertOutcomeOp:
 			collectEndBodies(endBody{activities: o.Activities}, &bodies)
 		case *ast.InsertBranchOp:
@@ -282,9 +284,11 @@ func validateAlterWorkflowEndAncestry(ctx *ExecContext, s *ast.AlterWorkflowStmt
 	for _, op := range s.Operations {
 		switch o := op.(type) {
 		case *ast.InsertAfterOp:
-			check("insert after", o.ActivityRef, o.AtPosition, []ast.WorkflowActivityNode{o.NewActivity})
+			check("insert after", o.ActivityRef, o.AtPosition, o.NewActivities)
+		case *ast.InsertBeforeOp:
+			check("insert before", o.ActivityRef, o.AtPosition, o.NewActivities)
 		case *ast.ReplaceActivityOp:
-			check("replace activity", o.ActivityRef, o.AtPosition, []ast.WorkflowActivityNode{o.NewActivity})
+			check("replace activity", o.ActivityRef, o.AtPosition, o.NewActivities)
 		case *ast.InsertOutcomeOp:
 			check("insert outcome", o.ActivityRef, o.AtPosition, o.Activities)
 		case *ast.InsertBranchOp:
@@ -400,9 +404,11 @@ func alterWorkflowAddedActivities(s *ast.AlterWorkflowStmt) []ast.WorkflowActivi
 	for _, op := range s.Operations {
 		switch o := op.(type) {
 		case *ast.InsertAfterOp:
-			added = append(added, o.NewActivity)
+			added = append(added, o.NewActivities...)
+		case *ast.InsertBeforeOp:
+			added = append(added, o.NewActivities...)
 		case *ast.ReplaceActivityOp:
-			added = append(added, o.NewActivity)
+			added = append(added, o.NewActivities...)
 		case *ast.InsertOutcomeOp:
 			added = append(added, o.Activities...)
 		case *ast.InsertPathOp:
diff --git a/mdl/executor/validate_workflow_refs.go b/mdl/executor/validate_workflow_refs.go
index e15dca017a..e9f1e799b3 100644
--- a/mdl/executor/validate_workflow_refs.go
+++ b/mdl/executor/validate_workflow_refs.go
@@ -277,9 +277,11 @@ func validateAlterWorkflowRefs(ctx *ExecContext, s *ast.AlterWorkflowStmt, sc *s
 				}
 				nested = append(nested, o.Activities...)
 			case *ast.InsertAfterOp:
-				nested = append(nested, o.NewActivity)
+				nested = append(nested, o.NewActivities...)
+			case *ast.InsertBeforeOp:
+				nested = append(nested, o.NewActivities...)
 			case *ast.ReplaceActivityOp:
-				nested = append(nested, o.NewActivity)
+				nested = append(nested, o.NewActivities...)
 			case *ast.InsertOutcomeOp:
 				nested = append(nested, o.Activities...)
 			case *ast.InsertPathOp:
@@ -297,9 +299,11 @@ func validateAlterWorkflowRefs(ctx *ExecContext, s *ast.AlterWorkflowStmt, sc *s
 	for _, op := range s.Operations {
 		switch o := op.(type) {
 		case *ast.InsertAfterOp:
-			added = append(added, o.NewActivity)
+			added = append(added, o.NewActivities...)
+		case *ast.InsertBeforeOp:
+			added = append(added, o.NewActivities...)
 		case *ast.ReplaceActivityOp:
-			added = append(added, o.NewActivity)
+			added = append(added, o.NewActivities...)
 		case *ast.InsertOutcomeOp:
 			added = append(added, o.Activities...)
 		case *ast.InsertPathOp:
diff --git a/mdl/executor/validate_workflow_rewrite.go b/mdl/executor/validate_workflow_rewrite.go
index ad1fdc2d56..808adb96d5 100644
--- a/mdl/executor/validate_workflow_rewrite.go
+++ b/mdl/executor/validate_workflow_rewrite.go
@@ -428,8 +428,9 @@ func validateAlterReplaceKeepsStudioProState(ctx *ExecContext, s *ast.AlterWorkf
 		var reasons []string
 		walkRawDocs(raw, func(d map[string]any) {
 			if n, _ := d["Name"].(string); n != "" && n == act.GetName() {
-				reasons = append(reasons, rawReplaceLosses(d, o.NewActivity)...)
-				if mf := rawOnCreatedMicroflow(d); mf != "" && !restatesOnCreated(o.NewActivity) {
+				repl := replacementFor(o.NewActivities, n)
+				reasons = append(reasons, rawReplaceLosses(d, repl)...)
+				if mf := rawOnCreatedMicroflow(d); mf != "" && !restatesOnCreated(repl) {
 					reasons = append(reasons, fmt.Sprintf(
 						"it runs on-created microflow %s, which the replacement does not restate (add `on created microflow %s`)", mf, mf))
 				}
@@ -438,7 +439,7 @@ func validateAlterReplaceKeepsStudioProState(ctx *ExecContext, s *ast.AlterWorkf
 		if len(reasons) > 0 {
 			errs = append(errs, fmt.Sprintf(
 				"replace activity '%s' is refused: the activity is rebuilt from the statement, and the statement does not carry what it "+
-					"holds — %s. Change it with SET ACTIVITY, which edits it in place, or in Studio Pro.",
+					"holds — %s. Change it with `set ( … ) on <activity>`, which edits it in place, or in Studio Pro.",
 				o.ActivityRef, strings.Join(reasons, "; ")))
 		}
 	}
@@ -517,6 +518,21 @@ func countAuthoredOnCreated(activities []ast.WorkflowActivityNode) int {
 	return n
 }
 
+// replacementFor picks, among a replace's new activities, the one that stands in
+// for the stored activity called name: the user task that keeps its name (the
+// only kind whose losses this guard measures), else the first. The old `replace activity X with a` form always carries exactly one.
+func replacementFor(acts []ast.WorkflowActivityNode, name string) ast.WorkflowActivityNode {
+	for _, a := range acts {
+		if t, ok := a.(*ast.WorkflowUserTaskNode); ok && t.Name == name {
+			return a
+		}
+	}
+	if len(acts) > 0 {
+		return acts[0]
+	}
+	return nil
+}
+
 func restatesOnCreated(act ast.WorkflowActivityNode) bool {
 	t, ok := act.(*ast.WorkflowUserTaskNode)
 	return ok && t.OnCreated.Module != ""
diff --git a/mdl/executor/validate_workflow_task_signature.go b/mdl/executor/validate_workflow_task_signature.go
index 64a545c254..ade66b56c5 100644
--- a/mdl/executor/validate_workflow_task_signature.go
+++ b/mdl/executor/validate_workflow_task_signature.go
@@ -146,7 +146,7 @@ func (c *workflowTaskSignatureChecker) checkPage(label, pageQN string) string {
 	if len(params) == 0 {
 		return fmt.Sprintf(
 			"%s: page %s takes no parameters — a task page is opened with the task, so it must take a %s parameter; "+
-				"the build fails CE7410 (add `params: { $WorkflowUserTask: %s }`)",
+				"the build fails CE7410 (add `params: ( $WorkflowUserTask: %s )`)",
 			label, pageQN, workflowUserTaskEntity, workflowUserTaskEntity)
 	}
 	for _, e := range params {
diff --git a/mdl/executor/widget_texttemplate_named_params_575_test.go b/mdl/executor/widget_texttemplate_named_params_575_test.go
index 9c4c07ce9b..d493c333e9 100644
--- a/mdl/executor/widget_texttemplate_named_params_575_test.go
+++ b/mdl/executor/widget_texttemplate_named_params_575_test.go
@@ -229,8 +229,8 @@ func TestIssue575_DescribeEmitsTheParamsCompanion(t *testing.T) {
 	}
 	got := strings.Join(describeImageWidgetProps(w), ", ")
 	for _, want := range []string{
-		"ImageUrlParams: [{1} = Bug575.Product.PictureUrl]",
-		"AlternativeTextParams: [{1} = Bug575.Product.Name]",
+		"ImageUrlParams: ({1} = Bug575.Product.PictureUrl)",
+		"AlternativeTextParams: ({1} = Bug575.Product.Name)",
 	} {
 		if !strings.Contains(got, want) {
 			t.Errorf("describe output missing %q; got: %s", want, got)
diff --git a/mdl/grammar/MDLParser.g4 b/mdl/grammar/MDLParser.g4
index 6c619c70a8..bd9d1c953c 100644
--- a/mdl/grammar/MDLParser.g4
+++ b/mdl/grammar/MDLParser.g4
@@ -217,6 +217,12 @@ alterStatement
     | ALTER (MICROFLOW | NANOFLOW) qualifiedName LBRACE alterFlowOperation* RBRACE
     | alterPagesLayoutStatement
     | alterPagesStylingStatement
+    // The generic ALTER on a workflow (ADR-0012 decision 2, ako/mxcli#712): its
+    // targets are activities (name, 'caption', @n) and its fragments are
+    // workflow activities, so it has its own operation rule, like microflows.
+    | ALTER WORKFLOW qualifiedName LBRACE alterWorkflowOperation+ RBRACE
+    // The old per-action form: each alternative of alterWorkflowAction is a
+    // registered alias (MDL-DEPR140-149).
     | ALTER WORKFLOW qualifiedName alterWorkflowAction+ SEMICOLON?
     | alterMessageDefinitionCollectionStatement
     | alterMessageDefinitionStatement
@@ -344,9 +350,8 @@ alterDrop
     | DROP WIDGET /* @alias MDL-DEPR103 */ alterTarget (COMMA alterTarget)*   // drop widget a, b
     ;
 
-// A fragment is written exactly as `create` writes the same content. Only the
-// page family is on the generic path so far; a workflow's body joins here when
-// ALTER WORKFLOW is ported.
+// A fragment is written exactly as `create` writes the same content. A
+// workflow's fragment is a workflow body (alterWorkflowFragment).
 alterFragment
     : LBRACE pageBodyV3 RBRACE
     ;
@@ -518,7 +523,12 @@ navigationClause
     : HOME (PAGE | MICROFLOW) qualifiedName (FOR qualifiedName)?
     | LOGIN PAGE qualifiedName
     | NOT FOUND PAGE qualifiedName
-    | MENU_KW LPAREN navMenuItemDef* RPAREN
+    // The profile's menu items are its declarative children, in { } like a
+    // page's widgets and with no separators (R2, ako/mxcli#754). describe
+    // writes the block after every other clause; the clauses are order-free,
+    // so it parses anywhere among them. `menu ( item; … )` is the old spelling.
+    | navMenuChildren
+    | MENU_KW LPAREN /* @alias MDL-DEPR121 */ navMenuItemDef* RPAREN
     | SYNC LPAREN navSyncDef* RPAREN
     // Studio Pro's "Throw error when server rejects objects during
     // synchronization", stored as the profile-level ThrowPartialSyncError.
@@ -574,9 +584,48 @@ navSyncMode
 // the same Forms$SignOutClientAction a button uses (measured on ako/TestApp),
 // which is why it sits beside PAGE and MICROFLOW rather than in a syntax of its
 // own.
+//
+// R2 (ako/mxcli#754): a menu item is a child with the shape every child has,
+// `<kind> Caption ( props ) [ { children } ]`. Its action is `OnClick:` with the
+// words a page action uses (R8), and its icon is `Icon:` as on a widget:
+//   menu item 'Home' ( OnClick: show page Shop.Home, Icon: Atlas_Core.Atlas.home )
+//   menu 'Admin' ( Icon: glyph 57345 ) { menu item 'Users' ( OnClick: call microflow M.F ) }
+// A child ends in `)` or `}`, so no separator is needed.
+//
+// The old spelling is still read: the action and icon as clauses after the
+// caption (MDL-DEPR122), and a sub-menu's items in ( ) with `;` after each
+// item (MDL-DEPR121) — a `;` is read after either shape, so a half-converted
+// menu still parses. The canonical alternatives come first, so a bare
+// `menu item 'x'` is read as the canonical form.
 navMenuItemDef
-    : MENU_KW ITEM STRING_LITERAL ((PAGE qualifiedName) | (MICROFLOW qualifiedName) | SIGN_OUT)? navMenuIcon? SEMICOLON?
-    | MENU_KW STRING_LITERAL navMenuIcon? LPAREN navMenuItemDef* RPAREN SEMICOLON?
+    : MENU_KW ITEM STRING_LITERAL navMenuItemProps? (SEMICOLON /* @alias MDL-DEPR121 */)?
+    | MENU_KW STRING_LITERAL navMenuItemProps? navMenuChildren (SEMICOLON /* @alias MDL-DEPR121 */)?
+    | MENU_KW ITEM STRING_LITERAL
+      ((PAGE qualifiedName) | (MICROFLOW qualifiedName) | SIGN_OUT)? /* @alias MDL-DEPR122 */ navMenuIcon? SEMICOLON?
+    | MENU_KW STRING_LITERAL navMenuIcon? LPAREN /* @alias MDL-DEPR121 */ navMenuItemDef* RPAREN SEMICOLON?
+    // Half-converted: the items already in { }, the icon still a clause.
+    | MENU_KW STRING_LITERAL navMenuIcon /* @alias MDL-DEPR122 */ navMenuChildren SEMICOLON?
+    ;
+
+navMenuChildren
+    : LBRACE navMenuItemDef* RBRACE
+    ;
+
+navMenuItemProps
+    : LPAREN (navMenuItemProp (COMMA navMenuItemProp)* COMMA?)? RPAREN
+    ;
+
+// OnClick takes the three actions a menu item can carry, in the page-action
+// words (R8); Icon the three icon elements, as navMenuIcon.
+navMenuItemProp
+    : ONCLICK COLON navMenuAction
+    | ICON COLON navMenuIconValue
+    ;
+
+navMenuAction
+    : SHOW PAGE qualifiedName
+    | CALL MICROFLOW qualifiedName
+    | SIGN_OUT
     ;
 
 // Mendix stores three DIFFERENT icon elements, and they are not variants of one
@@ -596,9 +645,13 @@ navMenuItemDef
 // bare form with `image` read as the name; listing the specific alternatives
 // ahead of the general one is what settles it.
 navMenuIcon
-    : ICON GLYPH NUMBER_LITERAL
-    | ICON IMAGE qualifiedName
-    | ICON qualifiedName
+    : ICON navMenuIconValue
+    ;
+
+navMenuIconValue
+    : GLYPH NUMBER_LITERAL
+    | IMAGE qualifiedName
+    | qualifiedName
     ;
 
 // A standalone menu document (Menus$MenuDocument) — the reusable menu a menu
@@ -606,7 +659,8 @@ navMenuIcon
 // built from the same items, so this reuses navMenuItemDef rather than defining a
 // second item syntax.
 createMenuStatement
-    : MENU_KW qualifiedName (FOLDER STRING_LITERAL)? LPAREN navMenuItemDef* RPAREN
+    : MENU_KW ifNotExists? qualifiedName (FOLDER STRING_LITERAL)? navMenuChildren
+    | MENU_KW ifNotExists? qualifiedName (FOLDER STRING_LITERAL)? LPAREN /* @alias MDL-DEPR121 */ navMenuItemDef* RPAREN
     ;
 
 dropStatement
diff --git a/mdl/grammar/domains/MDLAgent.g4 b/mdl/grammar/domains/MDLAgent.g4
index 51d25f36ac..c56ca3d02b 100644
--- a/mdl/grammar/domains/MDLAgent.g4
+++ b/mdl/grammar/domains/MDLAgent.g4
@@ -15,7 +15,7 @@ options { tokenVocab = MDLLexer; }
 //   [, DisplayName: '...', KeyName: '...', etc. — Portal-populated metadata]
 // );
 createModelStatement
-    : MODEL qualifiedName
+    : MODEL ifNotExists? qualifiedName
       (FOLDER STRING_LITERAL)?
       LPAREN modelProperty (COMMA modelProperty)* RPAREN
     ;
@@ -51,7 +51,7 @@ variableDef
 //   Documentation: '...'
 // );
 createConsumedMCPServiceStatement
-    : CONSUMED MCP SERVICE qualifiedName
+    : CONSUMED MCP SERVICE ifNotExists? qualifiedName
       (FOLDER STRING_LITERAL)?
       LPAREN modelProperty (COMMA modelProperty)* RPAREN
     ;
@@ -64,7 +64,7 @@ createConsumedMCPServiceStatement
 //   Key: @Module.SomeConstant
 // );
 createKnowledgeBaseStatement
-    : KNOWLEDGE BASE qualifiedName
+    : KNOWLEDGE BASE ifNotExists? qualifiedName
       (FOLDER STRING_LITERAL)?
       LPAREN modelProperty (COMMA modelProperty)* RPAREN
     ;
@@ -81,7 +81,7 @@ createKnowledgeBaseStatement
 // [ { tool X ( ... ) | mcp service M.X ( ... ) | knowledge base KB ( ... ) } ]
 // ;
 createAgentStatement
-    : AGENT qualifiedName
+    : AGENT ifNotExists? qualifiedName
       (FOLDER STRING_LITERAL)?
       LPAREN modelProperty (COMMA modelProperty)* RPAREN
       agentBody?
diff --git a/mdl/grammar/domains/MDLDomainModel.g4 b/mdl/grammar/domains/MDLDomainModel.g4
index 5c8376aef1..1d5e0581bf 100644
--- a/mdl/grammar/domains/MDLDomainModel.g4
+++ b/mdl/grammar/domains/MDLDomainModel.g4
@@ -294,8 +294,13 @@ alterEntityAction
 // Idempotency guards for a re-runnable domain script: ADD ... IF NOT EXISTS
 // skips (with a notice) when the member is already present, and DROP ... IF
 // EXISTS skips when it is already gone — instead of erroring and halting the
-// run. Accepted on ATTRIBUTE, EVENT HANDLER and INDEX, and on CREATE ENTITY /
-// CREATE ASSOCIATION.
+// run. Accepted on ATTRIBUTE, EVENT HANDLER and INDEX.
+//
+// On a document-level CREATE it sits after the kind's keywords and before the
+// name (`create page if not exists M.P …`) on every kind that names one element
+// (ako/mxcli#731, ADR-0010 R1): leave an existing element untouched, create it
+// otherwise. The visitor applies it once, in ExitCreateStatement, and the
+// executor's dispatch honours it, so a create rule only has to accept it.
 //
 // EVENT HANDLER and INDEX have no other way to be re-run: a defensive
 // drop-then-add fails on the drop when the member is absent, and on the add
@@ -346,7 +351,7 @@ alterEnumerationAction
 // =============================================================================
 
 createModuleStatement
-    : MODULE identifierOrKeyword moduleOptions?
+    : MODULE ifNotExists? identifierOrKeyword moduleOptions?
     ;
 
 // =============================================================================
@@ -386,7 +391,7 @@ moduleOption
 // =============================================================================
 
 createEnumerationStatement
-    : ENUMERATION qualifiedName
+    : ENUMERATION ifNotExists? qualifiedName
       LPAREN enumerationValueList RPAREN
       enumerationOptions?
     ;
@@ -428,7 +433,7 @@ enumerationOption
  * quoted expression.
  */
 createQueueStatement
-    : taskQueueKw qualifiedName (FOLDER STRING_LITERAL)? queueBody?
+    : taskQueueKw ifNotExists? qualifiedName (FOLDER STRING_LITERAL)? queueBody?
     ;
 
 queueBody
@@ -448,7 +453,7 @@ queueProperty
 // document rather than a string on the rule.
 
 createRegularExpressionStatement
-    : REGULAR EXPRESSION qualifiedName (FOLDER STRING_LITERAL)? regularExpressionBody?
+    : REGULAR EXPRESSION ifNotExists? qualifiedName (FOLDER STRING_LITERAL)? regularExpressionBody?
     ;
 
 regularExpressionBody
@@ -473,7 +478,7 @@ regularExpressionProperty
 // not belong to the chosen repeat.
 
 createScheduledEventStatement
-    : SCHEDULED EVENT qualifiedName (FOLDER STRING_LITERAL)? scheduledEventBody?
+    : SCHEDULED EVENT ifNotExists? qualifiedName (FOLDER STRING_LITERAL)? scheduledEventBody?
     ;
 
 scheduledEventBody
@@ -489,7 +494,7 @@ scheduledEventProperty
 // =============================================================================
 
 createImageCollectionStatement
-    : IMAGE COLLECTION qualifiedName (FOLDER STRING_LITERAL)? imageCollectionOptions? imageCollectionBody?
+    : IMAGE COLLECTION ifNotExists? qualifiedName (FOLDER STRING_LITERAL)? imageCollectionOptions? imageCollectionBody?
     ;
 
 // CREATE [OR MODIFY] ANNOTATION IN Module ( Caption: '…', Position: (x, y), Width: n )
@@ -538,8 +543,12 @@ imageCollectionChild
     : IMAGE imageName LPAREN imageProperty (COMMA imageProperty)* COMMA? RPAREN   // image Logo ( File: 'logo.png' )
     ;
 
+// File: '<path>' reads the image from a file; Data: '<base64>' carries the
+// bytes in the script, which is what describe writes (ako/mxcli#707), with
+// Format: <png|jpg|gif|svg|bmp|webp> when the bytes do not say it themselves.
 imageProperty
     : identifierOrKeyword COLON STRING_LITERAL
+    | identifierOrKeyword COLON identifierOrKeyword
     ;
 
 imageCollectionItem
@@ -557,7 +566,7 @@ imageName
 // =============================================================================
 
 createJsonStructureStatement
-    : JSON STRUCTURE qualifiedName (FOLDER STRING_LITERAL)? (COMMENT /* @alias MDL-DEPR100 */ STRING_LITERAL)? SNIPPET (STRING_LITERAL | DOLLAR_STRING)
+    : JSON STRUCTURE ifNotExists? qualifiedName (FOLDER STRING_LITERAL)? (COMMENT /* @alias MDL-DEPR100 */ STRING_LITERAL)? SNIPPET (STRING_LITERAL | DOLLAR_STRING)
       (CUSTOM_NAME_MAP LPAREN customNameMapping (COMMA customNameMapping)* RPAREN)?
     ;
 
@@ -611,7 +620,7 @@ customNameMapping
  * (Module.Collection.Definition), so the collection is never implicit.
  */
 createMessageDefinitionCollectionStatement
-    : MESSAGE DEFINITION COLLECTION qualifiedName
+    : MESSAGE DEFINITION COLLECTION ifNotExists? qualifiedName
       (FOLDER STRING_LITERAL)?
       ( LBRACE messageDefinitionDef (COMMA? messageDefinitionDef)* COMMA? RBRACE
       | LPAREN /* @alias MDL-DEPR073 */ messageDefinitionDef (COMMA messageDefinitionDef)* COMMA? RPAREN
@@ -727,7 +736,7 @@ messageMemberPath
  * };
  */
 createImportMappingStatement
-    : IMPORT MAPPING qualifiedName
+    : IMPORT MAPPING ifNotExists? qualifiedName
       (FOLDER STRING_LITERAL)?
       importMappingWithClause?
       importMappingParameterClause?
@@ -869,7 +878,7 @@ importMappingObjectHandling
  * };
  */
 createExportMappingStatement
-    : EXPORT MAPPING qualifiedName
+    : EXPORT MAPPING ifNotExists? qualifiedName
       (FOLDER STRING_LITERAL)?
       exportMappingWithClause?
       exportMappingNullValuesClause?
@@ -969,7 +978,7 @@ validationRuleRange
 // =============================================================================
 
 createConstantStatement
-    : CONSTANT qualifiedName
+    : CONSTANT ifNotExists? qualifiedName
       TYPE dataType
       DEFAULT literal
       constantOptions?
@@ -1005,7 +1014,7 @@ createIndexStatement
  * };
  */
 createDataTransformerStatement
-    : DATA TRANSFORMER qualifiedName
+    : DATA TRANSFORMER ifNotExists? qualifiedName
       (FOLDER folder=STRING_LITERAL)?
       SOURCE_KW (JSON | XML) source=STRING_LITERAL
       LBRACE dataTransformerStep* RBRACE
diff --git a/mdl/grammar/domains/MDLMicroflow.g4 b/mdl/grammar/domains/MDLMicroflow.g4
index 3c6d68b090..24b6abbac2 100644
--- a/mdl/grammar/domains/MDLMicroflow.g4
+++ b/mdl/grammar/domains/MDLMicroflow.g4
@@ -14,7 +14,7 @@ options { tokenVocab = MDLLexer; }
  * Creates a new microflow with parameters, return type, and activity body.
  */
 createMicroflowStatement
-    : MICROFLOW qualifiedName
+    : MICROFLOW ifNotExists? qualifiedName
       LPAREN microflowParameterList? RPAREN
       microflowReturnType?
       microflowOptions?
@@ -25,7 +25,7 @@ createMicroflowStatement
  * Nanoflow creation — mirrors microflow syntax but targets client-side execution.
  */
 createNanoflowStatement
-    : NANOFLOW qualifiedName
+    : NANOFLOW ifNotExists? qualifiedName
       LPAREN microflowParameterList? RPAREN
       microflowReturnType?
       microflowOptions?
@@ -41,7 +41,7 @@ createNanoflowStatement
  * no explanation.
  */
 createRuleStatement
-    : RULE qualifiedName
+    : RULE ifNotExists? qualifiedName
       LPAREN microflowParameterList? RPAREN
       microflowReturnType?
       microflowOptions?
@@ -52,7 +52,7 @@ createRuleStatement
  * Java Action creation with inline Java source code.
  */
 createJavaActionStatement
-    : JAVA ACTION qualifiedName
+    : JAVA ACTION ifNotExists? qualifiedName
       (FOLDER STRING_LITERAL)?
       LPAREN javaActionParameterList? RPAREN
       javaActionReturnType?
@@ -108,7 +108,7 @@ exposeBitmapClause
  * defaults to Web). Reuses the javaAction parameter/return/exposed sub-rules.
  */
 createJavaScriptActionStatement
-    : JAVASCRIPT ACTION qualifiedName
+    : JAVASCRIPT ACTION ifNotExists? qualifiedName
       (FOLDER STRING_LITERAL)?
       LPAREN javaActionParameterList? RPAREN
       javaActionReturnType?
diff --git a/mdl/grammar/domains/MDLPage.g4 b/mdl/grammar/domains/MDLPage.g4
index 15d7700bd2..53c11298a1 100644
--- a/mdl/grammar/domains/MDLPage.g4
+++ b/mdl/grammar/domains/MDLPage.g4
@@ -16,7 +16,7 @@ options { tokenVocab = MDLLexer; }
 // R9: the folder is a clause after the name, as on every document; the
 // `Folder:` header property is a registered alias.
 createPageStatement
-    : PAGE qualifiedName
+    : PAGE ifNotExists? qualifiedName
       (FOLDER STRING_LITERAL)?
       pageHeaderV3
       LBRACE pageBodyV3 RBRACE
@@ -31,7 +31,7 @@ createPageStatement
 // wrapper, not on the layout element — and which placeholder a page's content
 // goes into.
 createLayoutStatement
-    : LAYOUT qualifiedName
+    : LAYOUT ifNotExists? qualifiedName
       widgetPropertiesV3?
       LBRACE pageBodyV3 RBRACE
     ;
@@ -41,7 +41,7 @@ createLayoutStatement
 // =============================================================================
 
 createSnippetStatement
-    : SNIPPET qualifiedName
+    : SNIPPET ifNotExists? qualifiedName
       (FOLDER STRING_LITERAL)?
       snippetHeaderV3?
       snippetOptions?
@@ -243,8 +243,11 @@ pageHeaderV3
     ;
 
 pageHeaderPropertyV3
-    : PARAMS COLON LBRACE pageParameterList RBRACE                   // Params: { $Order: Entity }
-    | VARIABLES_KW COLON LBRACE variableDeclarationList RBRACE       // Variables: { $show: Boolean = 'true' }
+    // A map is a property list, so it is in ( ) (R2, ako/mxcli#754).
+    : PARAMS COLON LPAREN pageParameterList COMMA? RPAREN                         // Params: ( $Order: Entity )
+    | PARAMS COLON LBRACE /* @alias MDL-DEPR123 */ pageParameterList RBRACE       // Params: { $Order: Entity }
+    | VARIABLES_KW COLON LPAREN variableDeclarationList COMMA? RPAREN             // Variables: ( $show: Boolean = 'true' )
+    | VARIABLES_KW COLON LBRACE /* @alias MDL-DEPR123 */ variableDeclarationList RBRACE
     | TITLE COLON STRING_LITERAL                                     // Title: 'My Page'
     | LAYOUT COLON (qualifiedName | STRING_LITERAL)                  // Layout: Atlas_Core.Atlas_Default
     | URL COLON STRING_LITERAL                                       // Url: 'my-page'
@@ -260,8 +263,10 @@ snippetHeaderV3
     ;
 
 snippetHeaderPropertyV3
-    : PARAMS COLON LBRACE pageParameterList RBRACE                 // Params: { $Customer: Module.Entity } — entities only (MDL087)
-    | VARIABLES_KW COLON LBRACE variableDeclarationList RBRACE     // Variables: { $show: Boolean = 'true' }
+    : PARAMS COLON LPAREN pageParameterList COMMA? RPAREN                         // Params: ( $Customer: Module.Entity ) — entities only (MDL087)
+    | PARAMS COLON LBRACE /* @alias MDL-DEPR123 */ pageParameterList RBRACE
+    | VARIABLES_KW COLON LPAREN variableDeclarationList COMMA? RPAREN             // Variables: ( $show: Boolean = 'true' )
+    | VARIABLES_KW COLON LBRACE /* @alias MDL-DEPR123 */ variableDeclarationList RBRACE
     | FOLDER COLON /* @alias MDL-DEPR105 */ STRING_LITERAL        // Folder: 'Snippets/Common'
     ;
 
@@ -503,15 +508,15 @@ widgetPropertyV3
     | ATTR COLON attributePathV3                      // Attr: (deprecated, use Attribute:)
     | CONTENT COLON stringExprV3                      // Content: 'Hello {1}'
     | RENDERMODE COLON renderModeV3                   // RenderMode: H3
-    | CONTENTPARAMS COLON paramListV3                 // ContentParams: [{1} = $var.Name]
-    | CAPTIONPARAMS COLON paramListV3                 // CaptionParams: [{1} = 'hello']
+    | CONTENTPARAMS COLON paramListV3                 // ContentParams: ({1} = $var.Name)
+    | CAPTIONPARAMS COLON paramListV3                 // CaptionParams: ({1} = 'hello')
     // A text-template sub-property of an object-list ITEM carries its
     // parameters under `<Name>Params`, and those names are the widget's own
     // (a File Uploader custom button's `ButtonCaptionParams`), so they cannot
     // each have a token. Placed before the generic propertyValueV3
     // alternatives, which also admit a `[...]` array — `{N} = expr` inside is
     // what separates them (#956).
-    | (IDENTIFIER | keyword) COLON paramListV3        // <Name>Params: [{1} = Attr]
+    | (IDENTIFIER | keyword) COLON paramListV3        // <Name>Params: ({1} = Attr)
     | BUTTONSTYLE COLON buttonStyleV3                  // ButtonStyle: Primary
     | ICON COLON widgetIconV3                          // Icon: 'Atlas_Core.Atlas_Filled.pencil' | image Mod.Images.logo | glyph 57377
     | CLASS COLON STRING_LITERAL                       // Class: 'my-class'
@@ -521,10 +526,10 @@ widgetPropertyV3
     | PHONEWIDTH COLON desktopWidthV3                 // PhoneWidth: 12 | AutoFill
     | SELECTION COLON selectionModeV3                 // Selection: Single | Multiple
     | SNIPPET COLON qualifiedName                     // Snippet: Module.SnippetName
-    | PARAMS COLON snippetCallParamListV3             // Params: {$Asset: $var} — snippet call parameter mappings
+    | PARAMS COLON snippetCallParamListV3             // Params: (Asset = $var) — snippet call arguments
     | ATTRIBUTES COLON attributeListV3                // Attributes: [Entity.Attr1, Entity.Attr2]
     | FILTERTYPE COLON filterTypeValue                // FilterType: startsWith | contains | equal
-    | DESIGNPROPERTIES COLON designPropertyListV3       // DesignProperties: [...]
+    | DESIGNPROPERTIES COLON designPropertyListV3       // DesignProperties: ( 'Key': 'Value', … )
     | WIDTH COLON NUMBER_LITERAL                        // Width: 200
     | HEIGHT COLON NUMBER_LITERAL                      // Height: 100
     // R5 (ako/mxcli#753): a conditional Visible / Editable is a client
@@ -613,9 +618,17 @@ filterTypeValue
     | IDENTIFIER    // startsWith, endsWith, greater, greaterEqual, equal, notEqual, smaller, smallerEqual, notEmpty
     ;
 
-// Snippet call parameter mappings: {$Asset: $var, $Other: $other}
+// Snippet call arguments: (Asset = $var, Other = $other). A snippet call is a
+// call site, so it binds its arguments the way every call does, `Param = value`
+// (R4), in the ( ) of a property map (R2, ako/mxcli#754). The old spelling was
+// a brace map `{$Asset: $var}`.
 snippetCallParamListV3
-    : LBRACE snippetCallParamMappingV3 (COMMA snippetCallParamMappingV3)* RBRACE
+    : LPAREN snippetCallArgV3 (COMMA snippetCallArgV3)* COMMA? RPAREN
+    | LBRACE /* @alias MDL-DEPR126 */ snippetCallParamMappingV3 (COMMA snippetCallParamMappingV3)* RBRACE
+    ;
+
+snippetCallArgV3
+    : parameterName EQUALS VARIABLE
     ;
 
 snippetCallParamMappingV3
@@ -730,9 +743,12 @@ stringExprV3
     | VARIABLE (DOT (IDENTIFIER | keyword))?
     ;
 
-// V3 Parameter list: [{1} = value, {2} = value]
+// V3 Parameter list: ({1} = value, {2} = value). The parameters of a text
+// template are a map, so they are in ( ) (R2, ako/mxcli#754), and each binds a
+// runtime value with `=` (R4, `with ({1} = …)`). `[…]` is the old spelling.
 paramListV3
-    : LBRACKET paramAssignmentV3 (COMMA paramAssignmentV3)* RBRACKET
+    : LPAREN paramAssignmentV3 (COMMA paramAssignmentV3)* COMMA? RPAREN
+    | LBRACKET /* @alias MDL-DEPR124 */ paramAssignmentV3 (COMMA paramAssignmentV3)* RBRACKET
     ;
 
 paramAssignmentV3
@@ -822,17 +838,19 @@ objectEntryFieldV3
     : identifierOrKeyword COLON propertyValueV3
     ;
 
-// V3 Design property list: ['Key': 'Value', 'Key': ON]
+// V3 Design property list: ('Key': 'Value', 'Key': on). A map of properties, so
+// it is in ( ) (R2, ako/mxcli#754); `['Key': 'Value']` is the old spelling.
 designPropertyListV3
-    : LBRACKET designPropertyEntryV3 (COMMA designPropertyEntryV3)* RBRACKET
-    | LBRACKET RBRACKET
+    : LPAREN (designPropertyEntryV3 (COMMA designPropertyEntryV3)* COMMA?)? RPAREN
+    | LBRACKET /* @alias MDL-DEPR125 */ designPropertyEntryV3 (COMMA designPropertyEntryV3)* RBRACKET
+    | LBRACKET /* @alias MDL-DEPR125 */ RBRACKET
     ;
 
 designPropertyEntryV3
     : STRING_LITERAL COLON STRING_LITERAL
     | STRING_LITERAL COLON ON
     | STRING_LITERAL COLON OFF
-    | STRING_LITERAL COLON designPropertyListV3   // compound: 'Spacing': ['margin-top': 'Large', ...]
+    | STRING_LITERAL COLON designPropertyListV3   // compound: 'Spacing': ('margin-top': 'Large', ...)
     ;
 
 // V3 Widget body: { children }
diff --git a/mdl/grammar/domains/MDLSecurity.g4 b/mdl/grammar/domains/MDLSecurity.g4
index 8fd199125d..e85a3bb5cb 100644
--- a/mdl/grammar/domains/MDLSecurity.g4
+++ b/mdl/grammar/domains/MDLSecurity.g4
@@ -15,19 +15,41 @@ options { tokenVocab = MDLLexer; }
 // it, re-executing the script that sets up roles fails on the first role that
 // already exists), and a doc comment attaches to it (#731).
 createModuleRoleStatement
-    : MODULE ROLE qualifiedName (DESCRIPTION STRING_LITERAL)?
+    : MODULE ROLE ifNotExists? qualifiedName (DESCRIPTION STRING_LITERAL)?
     ;
 
 dropModuleRoleStatement
     : DROP MODULE ROLE ifExists? qualifiedName
     ;
 
+// A user role's properties are a ( Key: value ) list, as a scheduled event's
+// are (ako/mxcli#707, PROPOSAL_mdl_beta_syntax_freeze.md §4 Security). The
+// positional form had no slot for Description or CheckSecurity, so describe
+// printed them as comments and a replay lost them, and it required at least one
+// module role, so a role with none described into a statement that did not
+// parse. The list is optional, and may be empty: `create user role Guest;`.
+// The positional form is the deprecated alias; both start `( <name>`, and the
+// `:` after the first name tells them apart.
 createUserRoleStatement
-    : USER ROLE identifierOrKeyword
+    : USER ROLE ifNotExists? identifierOrKeyword userRolePropertyList?
+    | USER ROLE ifNotExists? identifierOrKeyword /* @alias MDL-DEPR710 */
       LPAREN moduleRoleList RPAREN
       (MANAGE ALL ROLES)?
     ;
 
+userRolePropertyList
+    : LPAREN (userRoleProperty (COMMA userRoleProperty)* COMMA?)? RPAREN
+    ;
+
+// ModuleRoles: (M.R, …) and ManageableRoles: (UserRole, …) take a list;
+// Description a string; ManageAllRoles, ManageUsersWithoutRoles and
+// CheckSecurity a boolean. The visitor refuses any other key.
+userRoleProperty
+    : identifierOrKeyword COLON LPAREN (qualifiedName (COMMA qualifiedName)*)? RPAREN
+    | identifierOrKeyword COLON STRING_LITERAL
+    | identifierOrKeyword COLON booleanLiteral
+    ;
+
 alterUserRoleStatement
     : ALTER USER ROLE identifierOrKeyword ADD MODULE ROLES LPAREN moduleRoleList RPAREN
     // R6: an alter's children are added and dropped; `remove` is the old verb.
@@ -139,7 +161,7 @@ appSecurityKw
     ;
 
 createDemoUserStatement
-    : DEMO USER STRING_LITERAL PASSWORD STRING_LITERAL (ENTITY qualifiedName)?
+    : DEMO USER ifNotExists? STRING_LITERAL PASSWORD STRING_LITERAL (ENTITY qualifiedName)?
       LPAREN identifierOrKeyword (COMMA identifierOrKeyword)* RPAREN
     ;
 
diff --git a/mdl/grammar/domains/MDLService.g4 b/mdl/grammar/domains/MDLService.g4
index 2595aa5586..28c147606e 100644
--- a/mdl/grammar/domains/MDLService.g4
+++ b/mdl/grammar/domains/MDLService.g4
@@ -10,13 +10,60 @@ options { tokenVocab = MDLLexer; }
 // DATABASE / REST CLIENT
 // =============================================================================
 
+// R2 (ako/mxcli#754): a declarative document has its properties in ( ) and
+// its children in { }. The database connection was the one declarative
+// document written as clauses with a begin … end block of queries:
+//
+//   create database connection M.Db (
+//     Type: 'PostgreSQL', ConnectionString: @M.Url, Username: @M.User, Password: @M.Pass,
+//   ) {
+//     query GetCustomers (
+//       Sql: $$select id, name from customer where id > {minId}$$,
+//       Parameters: ( minId: Integer default '0' ),
+//       Returns: M.Customer,
+//       Map: ( CustomerId = id, Name = name ),
+//     )
+//   };
+//
+// A query's column map binds an attribute to a column, `Attr = column`, the way
+// a REST mapping binds `Attr = jsonField` (R3: `=` for a mapping side). The
+// clause form is the old spelling (MDL-DEPR127), and builds the same statement.
 createDatabaseConnectionStatement
-    : DATABASE CONNECTION qualifiedName
+    : DATABASE CONNECTION ifNotExists? qualifiedName
       (FOLDER STRING_LITERAL)?
-      databaseConnectionOption+
+      LPAREN databaseConnectionProp (COMMA databaseConnectionProp)* COMMA? RPAREN
+      (LBRACE databaseQueryDef* RBRACE)?
+    | DATABASE CONNECTION ifNotExists? qualifiedName
+      (FOLDER STRING_LITERAL)?
+      databaseConnectionOption+ /* @alias MDL-DEPR127 */
       (BEGIN databaseQuery* END)?
     ;
 
+databaseConnectionProp
+    : identifierOrKeyword COLON (STRING_LITERAL | NUMBER_LITERAL | AT qualifiedName)
+    ;
+
+databaseQueryDef
+    : QUERY identifierOrKeyword LPAREN databaseQueryProp (COMMA databaseQueryProp)* COMMA? RPAREN
+    ;
+
+databaseQueryProp
+    : identifierOrKeyword COLON (STRING_LITERAL | DOLLAR_STRING)                     // Sql: $$…$$
+    | identifierOrKeyword COLON LPAREN
+      databaseQueryParam (COMMA databaseQueryParam)* COMMA? RPAREN                  // Parameters: ( p: Integer default '0' )
+    | identifierOrKeyword COLON LPAREN
+      databaseQueryColumn (COMMA databaseQueryColumn)* COMMA? RPAREN                // Map: ( Attr = column )
+    | identifierOrKeyword COLON qualifiedName                                       // Returns: M.Entity
+    ;
+
+databaseQueryParam
+    : identifierOrKeyword COLON dataType (DEFAULT STRING_LITERAL | NULL)?
+    ;
+
+databaseQueryColumn
+    : identifierOrKeyword EQUALS identifierOrKeyword
+    ;
+
 databaseConnectionOption
     : TYPE STRING_LITERAL
     | CONNECTION STRING_TYPE (STRING_LITERAL | AT qualifiedName)
@@ -42,8 +89,8 @@ databaseQueryMapping
     ;
 
 createConfigurationStatement
-    : CONFIGURATION STRING_LITERAL settingsItemOptions?          // configuration 'X' ( Key: value, … )
-    | CONFIGURATION STRING_LITERAL
+    : CONFIGURATION ifNotExists? STRING_LITERAL settingsItemOptions?          // configuration 'X' ( Key: value, … )
+    | CONFIGURATION ifNotExists? STRING_LITERAL
       settingsAssignment (COMMA settingsAssignment)*             // old spelling: Key = value, … (MDL-DEPR060)
     ;
 
@@ -54,7 +101,7 @@ createConfigurationStatement
 // list is a registered alias /* @alias MDL-DEPR105 */, here and in the
 // published REST and OData property lists; the visitor reports it by key.
 createRestClientStatement
-    : consumedRestServiceKw qualifiedName
+    : consumedRestServiceKw ifNotExists? qualifiedName
       (FOLDER STRING_LITERAL)?
       LPAREN restClientProperty (COMMA restClientProperty)* RPAREN
       (LBRACE restClientOperation* RBRACE)?
@@ -94,8 +141,16 @@ restClientParamItem
     : VARIABLE COLON dataType
     ;
 
+// A header list is a map, so it is `( 'Name': value, … )` like every other
+// property map (R2/R3, ako/mxcli#754); `'Name' = value` is the old spelling.
+// A header value is a template: `{Name}` is replaced by the operation
+// parameter Name, as in the path (ako/mxcli#707). `'Bearer ' + $Token` and
+// `$Token` are the old spellings of `'Bearer {Token}'` and `'{Token}'`; they
+// used to store only the text before the `+`.
 restClientHeaderItem
-    : STRING_LITERAL EQUALS (STRING_LITERAL | VARIABLE | STRING_LITERAL PLUS VARIABLE)
+    : STRING_LITERAL (COLON | EQUALS /* @alias MDL-DEPR120 */) STRING_LITERAL
+    | STRING_LITERAL (COLON | EQUALS /* @alias MDL-DEPR120 */) /* @alias MDL-DEPR711 */ VARIABLE
+    | STRING_LITERAL (COLON | EQUALS /* @alias MDL-DEPR120 */) /* @alias MDL-DEPR711 */ STRING_LITERAL PLUS VARIABLE
     ;
 
 restClientMappingEntry
@@ -113,7 +168,7 @@ restHttpMethod
 // =============================================================================
 
 createPublishedRestServiceStatement
-    : PUBLISHED REST SERVICE qualifiedName
+    : PUBLISHED REST SERVICE ifNotExists? qualifiedName
       (FOLDER STRING_LITERAL)?
       LPAREN publishedRestProperty (COMMA publishedRestProperty)* RPAREN
       LBRACE publishedRestResource* RBRACE
@@ -191,14 +246,14 @@ taskQueuesKw
     ;
 
 createODataClientStatement
-    : consumedODataServiceKw qualifiedName
+    : consumedODataServiceKw ifNotExists? qualifiedName
       (FOLDER STRING_LITERAL)?
       LPAREN odataPropertyAssignment (COMMA odataPropertyAssignment)* RPAREN
       odataHeadersClause?
     ;
 
 createODataServiceStatement
-    : publishedODataServiceKw qualifiedName
+    : publishedODataServiceKw ifNotExists? qualifiedName
       (FOLDER STRING_LITERAL)?
       LPAREN odataPropertyAssignment (COMMA odataPropertyAssignment)* RPAREN
       odataAuthenticationClause?
@@ -283,7 +338,7 @@ exposeMemberOptions
     ;
 
 createExternalEntityStatement
-    : EXTERNAL ENTITY qualifiedName
+    : EXTERNAL ENTITY ifNotExists? qualifiedName
       FROM consumedODataServiceKw qualifiedName
       LPAREN odataPropertyAssignment (COMMA odataPropertyAssignment)* RPAREN
       (LPAREN attributeDefinitionList? RPAREN)?
@@ -313,7 +368,7 @@ odataHeaderEntry
 // =============================================================================
 
 createBusinessEventServiceStatement
-    : BUSINESS EVENT SERVICE qualifiedName
+    : BUSINESS EVENT SERVICE ifNotExists? qualifiedName
       LPAREN odataPropertyAssignment (COMMA odataPropertyAssignment)* RPAREN
       LBRACE businessEventMessageDef+ RBRACE
     ;
diff --git a/mdl/grammar/domains/MDLWorkflow.g4 b/mdl/grammar/domains/MDLWorkflow.g4
index 3fe2e5ce5e..11ab0b6bf5 100644
--- a/mdl/grammar/domains/MDLWorkflow.g4
+++ b/mdl/grammar/domains/MDLWorkflow.g4
@@ -13,7 +13,7 @@ options { tokenVocab = MDLLexer; }
  * Create a workflow with activities.
  */
 createWorkflowStatement
-    : WORKFLOW qualifiedName
+    : WORKFLOW ifNotExists? qualifiedName
       workflowHeaderClause*
       BEGIN workflowMainBody workflowEventSubProcess* END WORKFLOW SEMICOLON? SLASH?
     ;
@@ -42,6 +42,9 @@ workflowHeaderClause
     | EXPORT LEVEL (IDENTIFIER | API | HIDDEN_KW)
     | OVERVIEW PAGE qualifiedName
     | DUE DATE_TYPE dueDate=workflowExpression
+    // The note attached to the workflow's start (ako/mxcli#707); an activity's
+    // is `@annotation '…'` before it.
+    | ANNOTATION annotationText=STRING_LITERAL
     | workflowEventHandlerClause
     ;
 
@@ -56,7 +59,7 @@ workflowHeaderClause
  * the body does not already end (in an End, a jump, or branches that all end).
  */
 workflowEventSubProcess
-    : EVENT SUBPROCESS workflowActivityName STRING_LITERAL?
+    : annotation* EVENT SUBPROCESS workflowActivityName STRING_LITERAL?
       ON (INTERRUPTING | NON INTERRUPTING) workflowEventSubProcessTrigger
       LBRACE workflowBody RBRACE SEMICOLON
     ;
@@ -128,16 +131,19 @@ workflowReturnStmt
     : RETURN
     ;
 
+// `@annotation '…'` before an activity is the note Studio Pro attaches to it,
+// as it is before a microflow activity (ako/mxcli#707). The standalone
+// `annotation '…';` is a different thing, a sticky note, and MDL-WF04 refuses it.
 workflowActivityStmt
-    : workflowUserTaskStmt SEMICOLON
-    | workflowCallMicroflowStmt SEMICOLON
-    | workflowCallWorkflowStmt SEMICOLON
-    | workflowDecisionStmt SEMICOLON
-    | workflowParallelSplitStmt SEMICOLON
-    | workflowJumpToStmt SEMICOLON
-    | workflowWaitForTimerStmt SEMICOLON
-    | workflowWaitForNotificationStmt SEMICOLON
-    | workflowNotificationStmt SEMICOLON
+    : annotation* workflowUserTaskStmt SEMICOLON
+    | annotation* workflowCallMicroflowStmt SEMICOLON
+    | annotation* workflowCallWorkflowStmt SEMICOLON
+    | annotation* workflowDecisionStmt SEMICOLON
+    | annotation* workflowParallelSplitStmt SEMICOLON
+    | annotation* workflowJumpToStmt SEMICOLON
+    | annotation* workflowWaitForTimerStmt SEMICOLON
+    | annotation* workflowWaitForNotificationStmt SEMICOLON
+    | annotation* workflowNotificationStmt SEMICOLON
     | workflowAnnotationStmt SEMICOLON
     ;
 
@@ -351,20 +357,99 @@ workflowAnnotationStmt
 // ALTER WORKFLOW
 // =============================================================================
 
+/**
+ * `alter workflow` operations: the generic ALTER (ADR-0012 decision 2,
+ * ako/mxcli#712).
+ *
+ * ```mdl
+ * alter workflow Shop.OrderApproval {
+ *   set (Display: 'Order approval', DueDate: addDays([%CurrentDateTime%], 3));
+ *   set (Page: Shop.TaskPage, Targeting: xpath [Active = true()]) on ReviewOrder;
+ *   insert after ReviewOrder { call microflow Shop.ACT_Notify; }
+ *   insert before 'Review the order'@2 { wait for notification Ready; }
+ *   insert into ReviewOrder { outcomes 'Escalate' { call microflow Shop.ACT_Escalate; } }
+ *   insert into decision1 { outcomes default -> { } }
+ *   insert into split1 { path { call microflow Shop.ACT_Log; } }
+ *   insert into ReviewOrder { boundary event interrupting timer addHours([%CurrentDateTime%], 4) { } }
+ *   replace ReviewOrder with { user task ReviewOrder caption 'Review' outcomes 'Done' { }; }
+ *   drop ReviewOrder outcome 'Reject', split1 path 2, ReviewOrder boundary event;
+ *   drop callMicroflow1;
+ * }
+ * ```
+ *
+ * A target is an activity's name or its quoted caption, with `@n` to choose
+ * one of several matches; the workflow's resolver (wfmutator) refuses an
+ * ambiguous one and lists the matches. A fragment is written exactly as
+ * `create workflow` writes it: activities in `{ }`, and for `insert into` the
+ * activity's own `outcomes`, `path` or `boundary event` clause.
+ */
+alterWorkflowOperation
+    : SET LPAREN alterWorkflowAssignment (COMMA alterWorkflowAssignment)* RPAREN (ON alterTarget)? SEMICOLON?
+    | INSERT (AFTER | BEFORE) alterTarget alterWorkflowFragment SEMICOLON?
+    | INSERT INTO alterTarget LBRACE alterWorkflowMember+ RBRACE SEMICOLON?
+    | REPLACE alterTarget WITH alterWorkflowFragment SEMICOLON?
+    | DROP alterWorkflowTarget (COMMA alterWorkflowTarget)* SEMICOLON?
+    ;
+
+// Activities, as the body of an outcome in `create workflow` writes them.
+alterWorkflowFragment
+    : LBRACE workflowBody RBRACE
+    ;
+
+// What `insert into <activity>` adds: the activity's own clause, as `create
+// workflow` writes it. A path's number may be left out; when written it must
+// be the next one.
+alterWorkflowMember
+    : OUTCOMES (workflowUserTaskOutcome | workflowConditionOutcome)+
+    | PATH NUMBER_LITERAL? LBRACE workflowBody RBRACE
+    | BOUNDARY EVENT workflowBoundaryEventClause
+    ;
+
+// A drop target: an activity, or one member of it — a user task's or a
+// decision's outcome, a parallel split's path, the activity's boundary event.
+alterWorkflowTarget
+    : alterTarget alterWorkflowTargetMember?
+    ;
+
+alterWorkflowTargetMember
+    : OUTCOME (STRING_LITERAL | TRUE | FALSE | DEFAULT)
+    | PATH NUMBER_LITERAL
+    | BOUNDARY EVENT
+    ;
+
+// `Key: value`, the key naming a workflow property (Display, Description,
+// ExportLevel, DueDate, OverviewPage, Parameter) or, with `on <activity>`, an
+// activity property (Page, Description, Targeting, DueDate). Which keys exist
+// is the visitor's call, so an unknown key is refused with the list.
+alterWorkflowAssignment
+    : identifierOrKeyword COLON alterWorkflowValue
+    ;
+
+alterWorkflowValue
+    : VARIABLE COLON qualifiedName                  // Parameter: $WorkflowContext: M.Ctx
+    | MICROFLOW qualifiedName                       // Targeting: microflow M.Target
+    | XPATH xpathConstraint+                        // Targeting: xpath [Active = true()]
+    | XPATH STRING_LITERAL /* @alias MDL-DEPR031 */ // Targeting: xpath '[Active = true()]'
+    | qualifiedName                                 // Page: M.P, ExportLevel: API
+    | workflowExpression                            // Display: 'x', DueDate: addDays(…)
+    ;
+
+// The old per-action forms, each a registered alias of the generic operation
+// it spells (MDL-DEPR140-149); `fmt --upgrade` rewrites them.
 alterWorkflowAction
-    : SET workflowSetProperty
-    | SET ACTIVITY alterActivityRef activitySetProperty
-    | INSERT AFTER alterActivityRef workflowActivityStmt
-    | DROP ACTIVITY alterActivityRef
-    | REPLACE ACTIVITY alterActivityRef WITH workflowActivityStmt
-    | INSERT OUTCOME STRING_LITERAL ON alterActivityRef LBRACE workflowBody RBRACE
-    | INSERT PATH ON alterActivityRef LBRACE workflowBody RBRACE
-    | DROP OUTCOME STRING_LITERAL ON alterActivityRef
-    | DROP PATH STRING_LITERAL ON alterActivityRef
-    | INSERT BOUNDARY EVENT ON alterActivityRef workflowBoundaryEventClause
-    | DROP BOUNDARY EVENT ON alterActivityRef
-    | INSERT CONDITION STRING_LITERAL ON alterActivityRef LBRACE workflowBody RBRACE
-    | DROP CONDITION STRING_LITERAL ON alterActivityRef
+    : SET /* @alias MDL-DEPR140 */ workflowSetProperty
+    | SET ACTIVITY /* @alias MDL-DEPR141 */ alterActivityRef activitySetProperty
+    | INSERT AFTER /* @alias MDL-DEPR142 */ alterActivityRef workflowActivityStmt
+    | DROP ACTIVITY /* @alias MDL-DEPR143 */ alterActivityRef
+    | REPLACE ACTIVITY /* @alias MDL-DEPR144 */ alterActivityRef WITH workflowActivityStmt
+    | INSERT OUTCOME /* @alias MDL-DEPR145 */ STRING_LITERAL ON alterActivityRef LBRACE workflowBody RBRACE
+    | INSERT PATH /* @alias MDL-DEPR146 */ ON alterActivityRef LBRACE workflowBody RBRACE
+    | DROP OUTCOME /* @alias MDL-DEPR149 */ STRING_LITERAL ON alterActivityRef
+    | DROP PATH /* @alias MDL-DEPR149 */ STRING_LITERAL ON alterActivityRef
+    | INSERT BOUNDARY EVENT /* @alias MDL-DEPR148 */ ON alterActivityRef workflowBoundaryEventClause
+    | DROP BOUNDARY EVENT /* @alias MDL-DEPR149 */ ON alterActivityRef
+    | INSERT CONDITION /* @alias MDL-DEPR147 */ STRING_LITERAL ON alterActivityRef LBRACE workflowBody RBRACE
+    | DROP CONDITION /* @alias MDL-DEPR149 */ STRING_LITERAL ON alterActivityRef
     ;
 
 workflowSetProperty
diff --git a/mdl/upgrade/alter_workflow_test.go b/mdl/upgrade/alter_workflow_test.go
new file mode 100644
index 0000000000..be3d059259
--- /dev/null
+++ b/mdl/upgrade/alter_workflow_test.go
@@ -0,0 +1,76 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package upgrade
+
+import (
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
+)
+
+// ako/mxcli#712: an old `alter workflow` statement of several actions becomes
+// one generic block, each action its generic operation, and the deprecations
+// inside the actions (a quoted XPath, an expression in a string, a `comment`
+// caption) are rewritten alongside.
+func TestUpgrade_AlterWorkflowBlock(t *testing.T) {
+	for _, tc := range []struct{ name, src, want string }{
+		{
+			"several actions over several lines",
+			"alter workflow Shop.OrderApproval\n" +
+				"  set display 'Order approval'\n" +
+				"  set activity ReviewOrder targeting xpath '[Active = true()]'\n" +
+				"  insert after ReviewOrder call microflow Shop.ACT_Notify comment 'Notify';\n" +
+				"  drop path 'Path 2' on split1\n" +
+				"  insert condition 'false' on decision1 { }\n" +
+				"  drop activity oldTask;\n",
+			"alter workflow Shop.OrderApproval {\n" +
+				"  set (Display: 'Order approval');\n" +
+				"  set (Targeting: xpath [Active = true()]) on ReviewOrder;\n" +
+				"  insert after ReviewOrder { call microflow Shop.ACT_Notify caption 'Notify'; }\n" +
+				"  drop split1 path 2;\n" +
+				"  insert into decision1 { outcomes 'false' -> { } }\n" +
+				"  drop oldTask;\n};\n",
+		},
+		{
+			"upper case keeps its case",
+			"ALTER WORKFLOW M.W DROP OUTCOME 'Reject' ON Review;",
+			"ALTER WORKFLOW M.W { DROP Review OUTCOME 'Reject'; };",
+		},
+		{
+			"a statement ending in an activity gets its own terminator",
+			"alter workflow M.W replace activity 'Review order'@2 with call microflow M.F;\nlist entities;",
+			"alter workflow M.W { replace 'Review order'@2 with { call microflow M.F; } };\nlist entities;",
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			res := mustUpgrade(t, tc.src, Options{})
+			if res.Source != tc.want {
+				t.Errorf("got:\n%s\nwant:\n%s", res.Source, tc.want)
+			}
+			if len(res.Unrewritten) != 0 {
+				t.Errorf("Unrewritten = %+v", res.Unrewritten)
+			}
+		})
+	}
+}
+
+// A path dropped by a caption that is not `Path n` has no generic address, and
+// half a block would not parse: the whole statement is left as written and
+// every action is reported.
+func TestUpgrade_AlterWorkflowWithAnUnrewritableActionIsLeftWhole(t *testing.T) {
+	src := "alter workflow M.W set display 'x' drop path 'Left' on split1;"
+	res := mustUpgrade(t, src, Options{})
+	if res.Source != src {
+		t.Fatalf("rewritten to %q", res.Source)
+	}
+	if len(res.Unrewritten) != 2 {
+		t.Fatalf("Unrewritten = %+v, want both actions", res.Unrewritten)
+	}
+	codes := map[string]bool{}
+	for _, u := range res.Unrewritten {
+		codes[u.Code] = true
+	}
+	if !codes[deprecation.AlterWorkflowSet] || !codes[deprecation.AlterWorkflowDropMember] {
+		t.Errorf("Unrewritten codes = %v", codes)
+	}
+}
diff --git a/mdl/upgrade/gated_test.go b/mdl/upgrade/gated_test.go
index 7ffb34e58c..bf5c062cb9 100644
--- a/mdl/upgrade/gated_test.go
+++ b/mdl/upgrade/gated_test.go
@@ -75,8 +75,8 @@ func TestUpgrade_GatedRewrites(t *testing.T) {
 			mf + "  set $i = find($S, 'x');\nend;\n", false},
 		{"set contains on a String", mf + "  declare $b Boolean = false;\n  set $b = contains($S, $S);\nend;\n",
 			mf + "  declare $b Boolean = false;\n  set $b = contains($S, $S);\nend;\n", false},
-		{"create or replace user role is a plain create", "create or replace user role R (M.Admin);\n",
-			"create user role R (M.Admin);\n", true},
+		{"create or replace user role is a plain create", "create or replace user role R ( ModuleRoles: (M.Admin) );\n",
+			"create user role R ( ModuleRoles: (M.Admin) );\n", true},
 		{"while without begin", mf + "  while $S = 'a'\n    log info 'x';\n  end while;\nend;\n",
 			mf + "  while $S = 'a' begin\n    log info 'x';\n  end while;\nend;\n", true},
 		{"while ending in a bare end", mf + "  while $S = 'a' begin\n    log info 'x';\n  end; -- note\nend;\n",
diff --git a/mdl/upgrade/issue707_upgrade_test.go b/mdl/upgrade/issue707_upgrade_test.go
new file mode 100644
index 0000000000..f823ba9e53
--- /dev/null
+++ b/mdl/upgrade/issue707_upgrade_test.go
@@ -0,0 +1,42 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package upgrade
+
+import (
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
+)
+
+// ako/mxcli#707: a user role's positional module roles become its property
+// list, and a REST header written as an expression becomes the value template.
+func TestUpgrade_Issue707UserRoleAndRestHeader(t *testing.T) {
+	src := "create user role Clerk (M.User, M.Viewer);\n" +
+		"CREATE OR MODIFY USER ROLE Admin (M.Admin) MANAGE ALL ROLES;\n" +
+		"create consumed rest service M.Api (BaseUrl: 'https://x', Authentication: none) {\n" +
+		"  operation Get (Method: get, Path: '/a', Parameters: ($Token: String, $Key: String),\n" +
+		"    Headers: ('Authorization' = 'Bearer ' + $Token, 'X-Key' = $Key, 'X-Odd' = '{x' + $Key), Response: none)\n" +
+		"};\n"
+	want := "create user role Clerk ( ModuleRoles: (M.User, M.Viewer) );\n" +
+		"CREATE OR MODIFY USER ROLE Admin ( ModuleRoles: (M.Admin), ManageAllRoles: true );\n" +
+		"create consumed rest service M.Api (BaseUrl: 'https://x', Authentication: none) {\n" +
+		"  operation Get (Method: get, Path: '/a', Parameters: ($Token: String, $Key: String),\n" +
+		"    Headers: ('Authorization': 'Bearer {Token}', 'X-Key': '{Key}', 'X-Odd': '{x' + $Key), Response: none)\n" +
+		"};\n"
+	res := mustUpgrade(t, src, Options{})
+	if res.Source != want {
+		t.Fatalf("got:\n%s\nwant:\n%s", res.Source, want)
+	}
+	for code, n := range map[string]int{deprecation.UserRolePositional: 2, deprecation.RestHeaderConcat: 2} {
+		if res.Rewritten[code] != n {
+			t.Errorf("Rewritten[%s] = %d, want %d (all: %v)", code, res.Rewritten[code], n, res.Rewritten)
+		}
+	}
+	// A prefix holding a brace would turn into a placeholder: reported, not rewritten.
+	if len(res.Unrewritten) != 1 || res.Unrewritten[0].Code != deprecation.RestHeaderConcat {
+		t.Errorf("Unrewritten = %+v, want the '{x' + $Key header", res.Unrewritten)
+	}
+	if again := mustUpgrade(t, res.Source, Options{}); again.Changed() {
+		t.Errorf("second upgrade changed the script again: %v", again.Rewritten)
+	}
+}
diff --git a/mdl/upgrade/metadata_placement_test.go b/mdl/upgrade/metadata_placement_test.go
index 92e6a7b5e9..b40c4d4937 100644
--- a/mdl/upgrade/metadata_placement_test.go
+++ b/mdl/upgrade/metadata_placement_test.go
@@ -63,8 +63,8 @@ func TestUpgrade_MetadataPlacement(t *testing.T) {
 			"create page M.P folder 'Admin' (Title: 'P', Layout: Atlas_Core.Atlas_Default) { };\n",
 			deprecation.FolderProperty},
 		{"snippet Folder property",
-			"create snippet M.S (Params: { $C: M.E }, Folder: 'Common') { };\n",
-			"create snippet M.S folder 'Common' (Params: { $C: M.E }) { };\n",
+			"create snippet M.S (Params: ( $C: M.E ), Folder: 'Common') { };\n",
+			"create snippet M.S folder 'Common' (Params: ( $C: M.E )) { };\n",
 			deprecation.FolderProperty},
 		{"snippet with Folder as its only property",
 			"create snippet M.S(\n  folder: 'Snippets'\n)\n{ };\n",
diff --git a/mdl/upgrade/r2_children_test.go b/mdl/upgrade/r2_children_test.go
index 8b3cb4ffb7..3451ef0270 100644
--- a/mdl/upgrade/r2_children_test.go
+++ b/mdl/upgrade/r2_children_test.go
@@ -51,7 +51,7 @@ ALTER NANOFLOW M.N {
   operation GetUser (
     Method: get,
     Path: '/u/{id}',
-    Headers: ('Accept' = 'application/json'),
+    Headers: ('Accept': 'application/json'),
     Response: mapping M.User { Name = name }
   )
   operation Ping ( Method: get, Path: '/ping', Response: none )
diff --git a/mdl/upgrade/r2_rest_test.go b/mdl/upgrade/r2_rest_test.go
new file mode 100644
index 0000000000..06daffedda
--- /dev/null
+++ b/mdl/upgrade/r2_rest_test.go
@@ -0,0 +1,104 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package upgrade
+
+import (
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
+)
+
+// The rest of R2 (ako/mxcli#754): menus, property maps and the database
+// connection upgrade together — several old spellings in one statement, in
+// either letter case, with comments and layout left as written.
+func TestUpgrade_R2NavigationMapsAndDatabaseConnection(t *testing.T) {
+	src := `create or replace navigation Responsive
+  home page M.Home
+  menu (
+    menu item 'Home' page M.Home icon Atlas_Core.Atlas.home;
+    -- administration
+    menu 'Admin' icon glyph 57345 (
+      menu item 'Users' microflow M.ShowUsers;
+      MENU ITEM 'Out' SIGN_OUT;
+    );
+  );
+CREATE MENU M.Side (MENU ITEM 'Plain';);
+create page M.P (Title: 'P', Layout: Atlas_Core.Atlas_Default, Params: { $Asset: M.Asset }, Variables: { $n: Integer = '1' }) {
+  dynamictext t (Content: 'Hi {1}', ContentParams: [{1} = Name])
+  container c (DesignProperties: ['Spacing': ['margin-top': 'Large'], 'Full width': on])
+  snippetcall s (Snippet: M.S, Params: {$Asset: $Asset})
+};
+create consumed rest service M.Api (BaseUrl: 'https://x', Authentication: none) {
+  operation Ping ( Method: get, Path: '/p', Headers: ('Accept' = 'application/json'), Response: none )
+};
+create database connection M.Db
+  type 'PostgreSQL'
+  connection string @M.Url
+  username @M.User
+  password @M.Pass
+begin
+  query Customers
+    sql $$select id, name from customer where id > {min}$$
+    parameter min: Integer default '0'
+    parameter name: String null
+    returns M.Customer
+    map (
+      id as CustomerId,
+      name as Name
+    );
+end;
+`
+	want := `create or modify navigation Responsive
+  home page M.Home
+  {
+    menu item 'Home' ( OnClick: show page M.Home, Icon: Atlas_Core.Atlas.home )
+    -- administration
+    menu 'Admin' ( Icon: glyph 57345 ) {
+      menu item 'Users' ( OnClick: call microflow M.ShowUsers )
+      MENU ITEM 'Out' ( OnClick: SIGN OUT )
+    }
+  };
+CREATE MENU M.Side {MENU ITEM 'Plain'};
+create page M.P (Title: 'P', Layout: Atlas_Core.Atlas_Default, Params: ( $Asset: M.Asset ), Variables: ( $n: Integer = '1' )) {
+  dynamictext t (Content: 'Hi {1}', ContentParams: ({1} = Name))
+  container c (DesignProperties: ('Spacing': ('margin-top': 'Large'), 'Full width': on))
+  snippetcall s (Snippet: M.S, Params: (Asset = $Asset))
+};
+create consumed rest service M.Api (BaseUrl: 'https://x', Authentication: none) {
+  operation Ping ( Method: get, Path: '/p', Headers: ('Accept': 'application/json'), Response: none )
+};
+create database connection M.Db (
+  Type: 'PostgreSQL',
+  ConnectionString: @M.Url,
+  Username: @M.User,
+  Password: @M.Pass )
+{
+  query Customers (
+    Sql: $$select id, name from customer where id > {min}$$,
+    Parameters: ( min: Integer default '0',
+    name: String null ),
+    Returns: M.Customer,
+    Map: (
+      CustomerId = id,
+      Name = name
+    ) )
+};
+`
+	res := mustUpgrade(t, src, Options{})
+	if res.Source != want {
+		t.Fatalf("got:\n%s\nwant:\n%s", res.Source, want)
+	}
+	for code, n := range map[string]int{
+		deprecation.MenuChildrenParens: 2, deprecation.MenuItemClauses: 1,
+		deprecation.HeaderMapBraces: 1, deprecation.TemplateParamsBrackets: 1,
+		deprecation.DesignPropertiesBrackets: 1, deprecation.SnippetCallParamsBraces: 1,
+		deprecation.RestHeaderEquals: 1, deprecation.DatabaseConnectionClauses: 1,
+	} {
+		if res.Rewritten[code] != n {
+			t.Errorf("Rewritten[%s] = %d, want %d (all: %v)", code, res.Rewritten[code], n, res.Rewritten)
+		}
+	}
+	if again := mustUpgrade(t, res.Source, Options{}); again.Changed() {
+		t.Errorf("second upgrade changed the script again: %v", again.Rewritten)
+	}
+}
diff --git a/mdl/upgrade/r8_spellings_test.go b/mdl/upgrade/r8_spellings_test.go
index 6490d5419d..a6019fa537 100644
--- a/mdl/upgrade/r8_spellings_test.go
+++ b/mdl/upgrade/r8_spellings_test.go
@@ -28,7 +28,7 @@ func TestUpgrade_R8Spellings(t *testing.T) {
 		{page("sign_out"), page("sign out")},
 		{page("complete_task 'Approve'"), page("complete task 'Approve'")},
 		{"create navigation Responsive home page M.Home menu (menu item 'Out' sign_out;);\n",
-			"create navigation Responsive home page M.Home menu (menu item 'Out' sign out;);\n"},
+			"create navigation Responsive home page M.Home {menu item 'Out' ( OnClick: sign out )};\n"},
 		{"create entity M.E (\n  Name: String(100) not null error 'Required',\n  Code: String(9) UNIQUE ERROR 'Taken'\n);\n",
 			"create entity M.E (\n  Name: String(100) not null error message 'Required',\n  Code: String(9) UNIQUE ERROR MESSAGE 'Taken'\n);\n"},
 		{"create validation rule for M.E.Email regex M.Pattern\n  feedback 'Bad';\n",
diff --git a/mdl/upgrade/upgrade_test.go b/mdl/upgrade/upgrade_test.go
index 1def31b41e..2c33e69942 100644
--- a/mdl/upgrade/upgrade_test.go
+++ b/mdl/upgrade/upgrade_test.go
@@ -75,7 +75,7 @@ func TestUpgrade_LeavesNonAliasesAlone(t *testing.T) {
 	for _, src := range []string{
 		"create or replace view entity M.V (Name: String(100)) as (select c.Name as Name from M.Customer as c);",
 		"create or replace translations in Administration for nl_NL ('Save' as 'Opslaan');",
-		"create or replace user role Clerk (M.User);",
+		"create or replace user role Clerk ( ModuleRoles: (M.User) );",
 		"show version;",
 	} {
 		res := mustUpgrade(t, src, Options{})
diff --git a/mdl/upgrade/workflow_expressions_test.go b/mdl/upgrade/workflow_expressions_test.go
index 9174cdb769..dd9e0578d5 100644
--- a/mdl/upgrade/workflow_expressions_test.go
+++ b/mdl/upgrade/workflow_expressions_test.go
@@ -39,13 +39,14 @@ func TestUpgrade_WorkflowExpressionsBare(t *testing.T) {
 		},
 		{
 			"a string with no space around it",
+			// The old action form is rewritten as well (MDL-DEPR141, ako/mxcli#712).
 			"alter workflow M.WF set activity Review due date'addDays([%CurrentDateTime%], 1)';",
-			"alter workflow M.WF set activity Review due date addDays([%CurrentDateTime%], 1);",
+			"alter workflow M.WF { set (DueDate: addDays([%CurrentDateTime%], 1)) on Review; };",
 		},
 		{
 			"upper case, doubled quotes inside",
 			"ALTER WORKFLOW M.WF SET DUE DATE 'if $x = ''a'' then [%CurrentDateTime%] else [%BeginOfCurrentDay%]';",
-			"ALTER WORKFLOW M.WF SET DUE DATE if $x = 'a' then [%CurrentDateTime%] else [%BeginOfCurrentDay%];",
+			"ALTER WORKFLOW M.WF { SET (DueDate: if $x = 'a' then [%CurrentDateTime%] else [%BeginOfCurrentDay%]); };",
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
@@ -66,8 +67,8 @@ func TestUpgrade_WorkflowExpressionsBare(t *testing.T) {
 func TestUpgrade_WorkflowExpressionNotBareIsReported(t *testing.T) {
 	head := "create workflow M.WF\n  parameter $WorkflowContext: M.E\nbegin\n"
 	for _, src := range []string{
-		"alter workflow M.WF set due date '${PT1H}';",
-		"alter workflow M.WF set due date ' addDays([%CurrentDateTime%], 1)';",
+		"alter workflow M.WF { set (DueDate: '${PT1H}'); };",
+		"alter workflow M.WF { set (DueDate: ' addDays([%CurrentDateTime%], 1)'); };",
 		head + "  decision 'Total + 1 > 3'\n    outcomes true -> { } false -> { };\nend workflow;",
 	} {
 		res := mustUpgrade(t, src, Options{})
diff --git a/mdl/upgrade/xpath_brackets_test.go b/mdl/upgrade/xpath_brackets_test.go
index ead31c95e2..9c69ff14d7 100644
--- a/mdl/upgrade/xpath_brackets_test.go
+++ b/mdl/upgrade/xpath_brackets_test.go
@@ -53,7 +53,7 @@ func TestUpgrade_XPathInBrackets(t *testing.T) {
 func TestUpgrade_XPathNotBracketedIsReported(t *testing.T) {
 	for _, tc := range []struct{ src, code string }{
 		{"grant M.R on M.E (read *) where 'a = 1';", deprecation.ReversedEntityGrant},
-		{"alter workflow M.WF set activity 'Review' targeting xpath 'Role = 1';", deprecation.QuotedTargetingXPath},
+		{"alter workflow M.WF { set (Targeting: xpath 'Role = 1') on 'Review'; };", deprecation.QuotedTargetingXPath},
 	} {
 		res := mustUpgrade(t, tc.src, Options{})
 		if res.Source != tc.src {
diff --git a/mdl/visitor/r2_children_test.go b/mdl/visitor/r2_children_test.go
index 821b02f24f..65a06ef981 100644
--- a/mdl/visitor/r2_children_test.go
+++ b/mdl/visitor/r2_children_test.go
@@ -28,11 +28,11 @@ var r2Cases = []r2Case{
 		name: "rest operation",
 		code: deprecation.RestOperationBraces,
 		old: `create consumed rest service M.Api (BaseUrl: 'https://x', Authentication: none) {
-  operation GetUser { Method: get, Path: '/u/{id}', Parameters: ($id: Integer), Headers: ('Accept' = 'application/json'), Response: none }
+  operation GetUser { Method: get, Path: '/u/{id}', Parameters: ($id: Integer), Headers: ('Accept': 'application/json'), Response: none }
   operation Ping { Method: get, Path: '/ping', Response: none }
 };`,
 		canonical: `create consumed rest service M.Api (BaseUrl: 'https://x', Authentication: none) {
-  operation GetUser ( Method: get, Path: '/u/{id}', Parameters: ($id: Integer), Headers: ('Accept' = 'application/json'), Response: none, )
+  operation GetUser ( Method: get, Path: '/u/{id}', Parameters: ($id: Integer), Headers: ('Accept': 'application/json'), Response: none, )
   operation Ping ( Method: get, Path: '/ping', Response: none )
 };`,
 	},
diff --git a/mdl/visitor/r2_rest_test.go b/mdl/visitor/r2_rest_test.go
new file mode 100644
index 0000000000..e67f37511b
--- /dev/null
+++ b/mdl/visitor/r2_rest_test.go
@@ -0,0 +1,347 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package visitor
+
+import (
+	"reflect"
+	"sort"
+	"strings"
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
+)
+
+// The rest of R2 (ako/mxcli#754): navigation and menus, property maps, and
+// the database connection. As for the integration documents
+// (r2_children_test.go), each canonical form builds without a warning under
+// both versions, and each old form builds the SAME statement, records its code
+// once per statement, and carries a rewrite that reaches the canonical form.
+// Every old form below uses exactly one old spelling, so the one code's
+// rewrite is the whole upgrade; mixtures are covered by the upgrade tests.
+var r2RestCases = []r2Case{
+	{
+		name: "rest header",
+		code: deprecation.RestHeaderEquals,
+		old: `create consumed rest service M.Api (BaseUrl: 'https://x', Authentication: none) {
+  operation GetUser ( Method: get, Path: '/u', Headers: ('Accept' = 'application/json', 'X-Key'='k', 'Auth' = 'Bearer x'), Response: none )
+  operation Ping ( Method: get, Path: '/ping', Headers: ('Accept' = '*/*'), Response: none )
+};`,
+		canonical: `create consumed rest service M.Api (BaseUrl: 'https://x', Authentication: none) {
+  operation GetUser ( Method: get, Path: '/u', Headers: ('Accept': 'application/json', 'X-Key':'k', 'Auth': 'Bearer x'), Response: none )
+  operation Ping ( Method: get, Path: '/ping', Headers: ('Accept': '*/*'), Response: none )
+};`,
+	},
+	{
+		name: "navigation menu block",
+		code: deprecation.MenuChildrenParens,
+		old: `create or modify navigation Responsive
+  home page M.Home
+  menu (
+    menu item 'Home' ( OnClick: show page M.Home );
+    menu 'Admin' (
+      menu item 'Users' ( OnClick: call microflow M.ShowUsers );
+      menu item 'Plain';
+    );
+  )
+  login page M.Login;`,
+		canonical: `create or modify navigation Responsive
+  home page M.Home
+  {
+    menu item 'Home' ( OnClick: show page M.Home )
+    menu 'Admin' {
+      menu item 'Users' ( OnClick: call microflow M.ShowUsers )
+      menu item 'Plain'
+    }
+  }
+  login page M.Login;`,
+	},
+	{
+		name: "menu document",
+		code: deprecation.MenuChildrenParens,
+		old: `create or modify menu M.Main folder 'Menus' (
+  menu item 'Home' ( OnClick: show page M.Home, Icon: Atlas_Core.Atlas.home )
+  menu 'More' (menu item 'Out' ( OnClick: sign out ));
+);`,
+		canonical: `create or modify menu M.Main folder 'Menus' {
+  menu item 'Home' ( OnClick: show page M.Home, Icon: Atlas_Core.Atlas.home )
+  menu 'More' {menu item 'Out' ( OnClick: sign out )}
+};`,
+	},
+	{
+		name: "menu item clauses",
+		code: deprecation.MenuItemClauses,
+		old: `create menu M.Main {
+  menu item 'Home' page M.Home icon Atlas_Core.Atlas.home
+  menu item 'Run' microflow M.Run
+  menu item 'Pic' page M.Pic icon image M.Images.pic
+  menu item 'Glyph' icon glyph 57345
+  MENU ITEM 'Bye' SIGN OUT
+  menu 'Admin' { menu item 'Users' page M.Users }
+};`,
+		canonical: `create menu M.Main {
+  menu item 'Home' ( OnClick: show page M.Home, Icon: Atlas_Core.Atlas.home )
+  menu item 'Run' ( OnClick: call microflow M.Run )
+  menu item 'Pic' ( OnClick: show page M.Pic, Icon: image M.Images.pic )
+  menu item 'Glyph' ( Icon: glyph 57345 )
+  MENU ITEM 'Bye' ( OnClick: SIGN OUT )
+  menu 'Admin' { menu item 'Users' ( OnClick: show page M.Users ) }
+};`,
+	},
+	{
+		name: "page header maps",
+		code: deprecation.HeaderMapBraces,
+		old: `create page M.P (Title: 'P', Layout: Atlas_Core.Atlas_Default,
+  Params: { $Order: M.Order, $Qty: Integer },
+  Variables: { $show: Boolean = 'true' }) { };`,
+		canonical: `create page M.P (Title: 'P', Layout: Atlas_Core.Atlas_Default,
+  Params: ( $Order: M.Order, $Qty: Integer ),
+  Variables: ( $show: Boolean = 'true', )) { };`,
+	},
+	{
+		name:      "snippet header maps",
+		code:      deprecation.HeaderMapBraces,
+		old:       `create snippet M.S (Params: { $Customer: M.Customer }, Variables: {$x: Integer = '1'}) { };`,
+		canonical: `create snippet M.S (Params: ( $Customer: M.Customer ), Variables: ($x: Integer = '1')) { };`,
+	},
+	{
+		name: "template parameters",
+		code: deprecation.TemplateParamsBrackets,
+		old: `create page M.P (Title: 'P', Layout: Atlas_Core.Atlas_Default) {
+  dynamictext t (Content: '{1} of {2}', ContentParams: [{1} = 'a', {2} = Name format (decimalPrecision: 2)])
+  actionbutton b (Caption: 'Go {1}', CaptionParams: [{1} = Title], Action: save changes)
+  image i (ImageType: imageUrl, ImageUrl: '{1}', ImageUrlParams: [{1} = PictureUrl])
+};`,
+		canonical: `create page M.P (Title: 'P', Layout: Atlas_Core.Atlas_Default) {
+  dynamictext t (Content: '{1} of {2}', ContentParams: ({1} = 'a', {2} = Name format (decimalPrecision: 2)))
+  actionbutton b (Caption: 'Go {1}', CaptionParams: ({1} = Title,), Action: save changes)
+  image i (ImageType: imageUrl, ImageUrl: '{1}', ImageUrlParams: ({1} = PictureUrl))
+};`,
+	},
+	{
+		name: "design properties",
+		code: deprecation.DesignPropertiesBrackets,
+		old: `create page M.P (Title: 'P', Layout: Atlas_Core.Atlas_Default) {
+  container c (DesignProperties: ['Spacing': ['margin-top': 'Large', 'margin-bottom': 'Medium'], 'Full width': on]) {
+    container d (DesignProperties: [])
+  }
+};`,
+		canonical: `create page M.P (Title: 'P', Layout: Atlas_Core.Atlas_Default) {
+  container c (DesignProperties: ('Spacing': ('margin-top': 'Large', 'margin-bottom': 'Medium'), 'Full width': on,)) {
+    container d (DesignProperties: ())
+  }
+};`,
+	},
+	{
+		name: "snippet call arguments",
+		code: deprecation.SnippetCallParamsBraces,
+		old: `create page M.P (Title: 'P', Layout: Atlas_Core.Atlas_Default, Params: ($Asset: M.Asset)) {
+  snippetcall s (Snippet: M.S, Params: {$Asset: $Asset, Agent:$Asset})
+};`,
+		canonical: `create page M.P (Title: 'P', Layout: Atlas_Core.Atlas_Default, Params: ($Asset: M.Asset)) {
+  snippetcall s (Snippet: M.S, Params: (Asset = $Asset, Agent = $Asset))
+};`,
+	},
+	{
+		name: "database connection",
+		code: deprecation.DatabaseConnectionClauses,
+		old: `create or modify database connection M.Erp folder 'Db'
+  type 'PostgreSQL'
+  connection string @M.DbUrl
+  host 'db.local'
+  port 5432
+  database 'erp'
+  username @M.DbUser
+  password 'secret'
+begin
+  query GetCustomers
+    sql $$select id, name from customer where id > {minId} and name = {name}$$
+    parameter minId: Integer default '0'
+    parameter name: String null
+    returns M.Customer
+    map (
+      id as CustomerId,
+      name as Name
+    );
+  query Ping sql 'select 1';
+end;`,
+		canonical: `create or modify database connection M.Erp folder 'Db' (
+  Type: 'PostgreSQL',
+  ConnectionString: @M.DbUrl,
+  Host: 'db.local',
+  Port: 5432,
+  DatabaseName: 'erp',
+  Username: @M.DbUser,
+  Password: 'secret',
+) {
+  query GetCustomers (
+    Sql: $$select id, name from customer where id > {minId} and name = {name}$$,
+    Parameters: ( minId: Integer default '0', name: String null ),
+    Returns: M.Customer,
+    Map: ( CustomerId = id, Name = name ),
+  )
+  query Ping ( Sql: 'select 1' )
+};`,
+	},
+}
+
+func TestR2Rest_CanonicalFormBuildsWithoutWarning(t *testing.T) {
+	for _, c := range r2RestCases {
+		for _, header := range []string{"", "mdl 1;\n"} {
+			prog := buildNoErrors(t, header+c.canonical)
+			if len(prog.Statements) != 1 {
+				t.Errorf("%s, header %q: %d statements", c.name, header, len(prog.Statements))
+			}
+			if len(prog.Deprecations) != 0 {
+				t.Errorf("%s, header %q: the canonical form recorded %+v", c.name, header, prog.Deprecations)
+			}
+		}
+	}
+}
+
+func TestR2Rest_OldFormIsADeprecatedAlias(t *testing.T) {
+	for _, c := range r2RestCases {
+		for _, header := range []string{"", "mdl 1;\n"} {
+			old := buildNoErrors(t, header+c.old)
+			canon := buildNoErrors(t, header+c.canonical)
+			if n := countDeprecations(old, c.code); n != 1 {
+				t.Errorf("%s, header %q: recorded %s %d times, want once per statement (%+v)", c.name, header, c.code, n, old.Deprecations)
+			}
+			for _, d := range old.Deprecations {
+				if d.Code != c.code {
+					t.Errorf("%s: also recorded %s; each case exercises one spelling", c.name, d.Code)
+				}
+				if d.Fix == nil || len(d.Fix.Edits) == 0 {
+					t.Errorf("%s: %s carries no rewrite", c.name, d.Code)
+				}
+			}
+			if !reflect.DeepEqual(old.Statements, canon.Statements) {
+				t.Errorf("%s, header %q: the two forms build different statements:\nold:   %#v\ncanon: %#v",
+					c.name, header, old.Statements[0], canon.Statements[0])
+			}
+		}
+	}
+}
+
+// The recorded rewrite, applied to the old form, gives a script that records
+// nothing and builds the same statement.
+func TestR2Rest_RewriteReachesTheCanonicalForm(t *testing.T) {
+	for _, c := range r2RestCases {
+		prog := buildNoErrors(t, c.old)
+		out := applyAllFixes(prog, c.old)
+		again := buildNoErrors(t, out)
+		if len(again.Deprecations) != 0 {
+			t.Errorf("%s: the rewrite still records %+v:\n%s", c.name, again.Deprecations, out)
+		}
+		if !reflect.DeepEqual(prog.Statements, again.Statements) {
+			t.Errorf("%s: the rewrite changed the statement:\n%s", c.name, out)
+		}
+	}
+}
+
+// applyAllFixes applies every recorded rewrite the way mdl/upgrade does: two
+// edits at one offset apply in the order they were recorded, an insertion
+// before a replacement.
+func applyAllFixes(prog *ast.Program, src string) string {
+	var edits []ast.TextEdit
+	for _, d := range prog.Deprecations {
+		if d.Fix != nil {
+			edits = append(edits, d.Fix.Edits...)
+		}
+	}
+	sort.SliceStable(edits, func(i, j int) bool {
+		if edits[i].Start != edits[j].Start {
+			return edits[i].Start < edits[j].Start
+		}
+		return edits[i].Stop-edits[i].Start < edits[j].Stop-edits[j].Start
+	})
+	runes := []rune(src)
+	var b strings.Builder
+	at := 0
+	for _, e := range edits {
+		b.WriteString(string(runes[at:e.Start]))
+		b.WriteString(e.Text)
+		at = e.Stop
+	}
+	b.WriteString(string(runes[at:]))
+	return b.String()
+}
+
+// The rewrites are exact: each old form upgrades to the canonical text the
+// case spells out, except where the case's canonical form deliberately adds a
+// trailing comma (which the rewrite has no reason to write).
+func TestR2Rest_RewriteText(t *testing.T) {
+	for src, want := range map[string]string{
+		`create menu M.M (menu item 'A' page M.A icon Atlas_Core.Atlas.home; menu 'B' icon glyph 1 (menu item 'C' sign_out;););`: `create menu M.M {menu item 'A' ( OnClick: show page M.A, Icon: Atlas_Core.Atlas.home ) menu 'B' ( Icon: glyph 1 ) {menu item 'C' ( OnClick: sign out )}};`,
+		`create or modify navigation Responsive menu (menu item 'A' microflow M.F;) home page M.H;`:                              `create or modify navigation Responsive {menu item 'A' ( OnClick: call microflow M.F )} home page M.H;`,
+		`create page M.P (Title: 'P', Layout: L.L) { snippetcall s (Snippet: M.S, Params: {$A: $A}) };`:                          `create page M.P (Title: 'P', Layout: L.L) { snippetcall s (Snippet: M.S, Params: (A = $A)) };`,
+		// Half-converted: the braces are new, the sub-menu's icon clause and the items' `;` old.
+		"create menu M.M { menu 'X' icon glyph 1 { menu item 'a' page M.P; }; };":                                        "create menu M.M { menu 'X' ( Icon: glyph 1 ) { menu item 'a' ( OnClick: show page M.P ) } };",
+		`create database connection M.Db type 'x' connection string @M.C;`:                                               `create database connection M.Db ( Type: 'x', ConnectionString: @M.C );`,
+		"create database connection M.Db type 'x' connection string @M.C begin query Q sql 'select 1' returns M.E; end;": "create database connection M.Db ( Type: 'x', ConnectionString: @M.C ) { query Q ( Sql: 'select 1', Returns: M.E ) };",
+	} {
+		prog := buildNoErrors(t, src)
+		if got := applyAllFixes(prog, src); got != want {
+			t.Errorf("rewrite of\n  %s\ngot\n  %s\nwant\n  %s", src, got, want)
+		}
+	}
+}
+
+// The new property lists are new syntax, so a key they do not know is an
+// error rather than something warned about and dropped.
+func TestR2Rest_DatabaseConnectionRejectsUnknownKeys(t *testing.T) {
+	for src, want := range map[string]string{
+		`create database connection M.Db (Type: 'x', Server: 'h');`:                                    "unknown property 'Server'",
+		`create database connection M.Db (Type: 'x', Port: 'many');`:                                   "Port takes a number",
+		`create database connection M.Db (Type: 'x') { query Q ( Sql: 'x', Limit: 'y' ) };`:            "unknown property 'Limit'",
+		`create database connection M.Db (Type: 'x') { query Q ( Sql: 'x', Map: ( a: String ) ) };`:    "Map takes a column map",
+		`create database connection M.Db (Type: 'x') { query Q ( Sql: 'x', Parameters: ( a = b ) ) };`: "Parameters takes a parameter list",
+	} {
+		_, errs := Build(src)
+		if len(errs) == 0 || !strings.Contains(errs[0].Error(), want) {
+			t.Errorf("%q: errors %v, want one containing %q", src, errs, want)
+		}
+	}
+}
+
+// A menu item's OnClick takes only the three actions an item can carry.
+func TestR2Rest_MenuItemActionIsRestricted(t *testing.T) {
+	if _, errs := Build(`create menu M.M { menu item 'x' ( OnClick: save changes ) };`); len(errs) == 0 {
+		t.Error("a menu item accepted `save changes`, which a menu item cannot carry")
+	}
+}
+
+// The new property lists are strict in the other direction too: a key written
+// twice is an error rather than a silent last-wins (a menu item with two
+// OnClick actions was written with whichever the builder checked first), a
+// query must say its SQL (the old clause form required it; the property list
+// made it optional by accident), and a sub-menu carries no OnClick (the old
+// form had no way to write one, and describe never prints one).
+func TestR2Rest_NewPropertyListsRejectDuplicatesAndOmissions(t *testing.T) {
+	for src, want := range map[string]string{
+		`create database connection M.Db (Type: 'x', ConnectionString: @M.C, Type: 'y');`:                    "Type is written twice",
+		`create database connection M.Db (Type: 'x') { query Q ( Sql: 'x', Sql: 'y' ) };`:                    "Sql is written twice",
+		`create database connection M.Db (Type: 'x') { query Q ( Returns: M.E ) };`:                          "query Q on database connection M.Db has no Sql",
+		`create menu M.M { menu item 'x' ( OnClick: show page M.P, OnClick: call microflow M.F ) };`:         "OnClick is written twice",
+		`create menu M.M { menu item 'x' ( Icon: glyph 57345, Icon: glyph 57346 ) };`:                        "Icon is written twice",
+		`create menu M.M { menu 'Sub' ( OnClick: show page M.P ) { menu item 'x' ( OnClick: sign out ) } };`: "a sub-menu has no OnClick",
+	} {
+		_, errs := Build(src)
+		found := false
+		for _, e := range errs {
+			found = found || strings.Contains(e.Error(), want)
+		}
+		if !found {
+			t.Errorf("%q: errors %v, want one containing %q", src, errs, want)
+		}
+	}
+	// Control: the same shapes written once build cleanly.
+	for _, src := range []string{
+		`create database connection M.Db (Type: 'x', ConnectionString: @M.C) { query Q ( Sql: 'x', Returns: M.E ) };`,
+		`create menu M.M { menu item 'x' ( OnClick: show page M.P, Icon: glyph 57345 ) menu 'Sub' ( Icon: glyph 57345 ) { menu item 'y' } };`,
+	} {
+		if _, errs := Build(src); len(errs) != 0 {
+			t.Errorf("%q: unexpected errors %v", src, errs)
+		}
+	}
+}
diff --git a/mdl/visitor/r8_spellings_test.go b/mdl/visitor/r8_spellings_test.go
index 8d49f37bd9..a4a53a7017 100644
--- a/mdl/visitor/r8_spellings_test.go
+++ b/mdl/visitor/r8_spellings_test.go
@@ -36,8 +36,8 @@ var r8Pairs = []r8Pair{
 	{"open link attr", pageWith("open_link $currentObject/Url"), pageWith("open link $currentObject/Url"), deprecation.PageActionWord},
 	{"sign out", pageWith("sign_out"), pageWith("sign out"), deprecation.PageActionWord},
 	{"complete task", pageWith("complete_task 'Approve'"), pageWith("complete task 'Approve'"), deprecation.PageActionWord},
-	{"menu sign out", "create navigation Responsive home page M.Home menu (menu item 'Out' sign_out;);",
-		"create navigation Responsive home page M.Home menu (menu item 'Out' sign out;);", deprecation.PageActionWord},
+	{"menu sign out", "create navigation Responsive home page M.Home { menu item 'Out' ( OnClick: sign_out ) };",
+		"create navigation Responsive home page M.Home { menu item 'Out' ( OnClick: sign out ) };", deprecation.PageActionWord},
 	{"alter page set action", "alter page M.P { set (Action: show_page M.Q) on b };",
 		"alter page M.P { set (Action: show page M.Q) on b };", deprecation.PageActionWord},
 
diff --git a/mdl/visitor/visitor.go b/mdl/visitor/visitor.go
index 0f0ee1e36c..a6beb4ebeb 100644
--- a/mdl/visitor/visitor.go
+++ b/mdl/visitor/visitor.go
@@ -517,6 +517,10 @@ type Builder struct {
 	// stringLits are the string literals of the parse tree, by token index,
 	// for the string-escape rewrite to find the expression each is in.
 	stringLits map[int]antlr.TerminalNode
+	// createStart is len(statements) when the current createStatement was
+	// entered, so ExitCreateStatement can tell which statement it built — see
+	// applyCreateGuard.
+	createStart int
 }
 
 // NewBuilder creates a new AST builder.
diff --git a/mdl/visitor/visitor_alter.go b/mdl/visitor/visitor_alter.go
index 8c56e611f1..a9efbccade 100644
--- a/mdl/visitor/visitor_alter.go
+++ b/mdl/visitor/visitor_alter.go
@@ -39,7 +39,7 @@ func (b *Builder) ExitAlterStatement(ctx *parser.AlterStatementContext) {
 	}
 
 	// Handle ALTER WORKFLOW
-	if ctx.WORKFLOW() != nil && len(ctx.AllAlterWorkflowAction()) > 0 {
+	if ctx.WORKFLOW() != nil && (len(ctx.AllAlterWorkflowAction()) > 0 || len(ctx.AllAlterWorkflowOperation()) > 0) {
 		b.exitAlterWorkflowStatement(ctx)
 		return
 	}
diff --git a/mdl/visitor/visitor_alter_workflow.go b/mdl/visitor/visitor_alter_workflow.go
new file mode 100644
index 0000000000..63b917933a
--- /dev/null
+++ b/mdl/visitor/visitor_alter_workflow.go
@@ -0,0 +1,708 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package visitor
+
+import (
+	"fmt"
+	"regexp"
+	"strconv"
+	"strings"
+
+	"github.com/antlr4-go/antlr/v4"
+
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
+	"github.com/mendixlabs/mxcli/mdl/grammar/parser"
+)
+
+// `alter workflow` on the generic ALTER (ADR-0012 decision 2, ako/mxcli#712):
+//
+//	alter workflow M.W {
+//	  set ( Key: value, … ) [on <activity>];
+//	  insert before|after <activity> { <activities> }
+//	  insert into <activity> { outcomes … | path { … } | boundary event … }
+//	  replace <activity> with { <activities> }
+//	  drop <activity> [outcome 'X' | outcome true | path n | boundary event];
+//	}
+//
+// It builds the same operations the old per-action form builds — each old
+// action is a registered alias of one generic operation — so the executor has
+// one path for both, and the old form's tests exercise it.
+
+// workflowPropertyKeys maps a `set ( … )` key, lower-cased, to the property a
+// SetWorkflowPropertyOp names; activityPropertyKeys does the same for `set
+// ( … ) on <activity>`.
+var workflowPropertyKeys = map[string]string{
+	"display":      "display",
+	"description":  "description",
+	"exportlevel":  "export_level",
+	"duedate":      "due_date",
+	"overviewpage": "overview_page",
+	"parameter":    "parameter",
+}
+
+var activityPropertyKeys = map[string]string{
+	"page":        "page",
+	"description": "description",
+	"targeting":   "targeting",
+	"duedate":     "due_date",
+}
+
+const (
+	workflowKeysText = "Display, Description, ExportLevel, DueDate, OverviewPage, Parameter"
+	activityKeysText = "Page, Description, Targeting, DueDate"
+)
+
+// buildAlterWorkflowOperation builds one generic operation. A `set` list and a
+// `drop` list build one operation per key or target, as the old form wrote
+// them one per action; `insert into` builds one per member.
+func (b *Builder) buildAlterWorkflowOperation(ctx *parser.AlterWorkflowOperationContext) []ast.AlterWorkflowOp {
+	switch {
+	case ctx.SET() != nil:
+		return b.buildAlterWorkflowSet(ctx)
+	case ctx.INSERT() != nil && ctx.INTO() != nil:
+		ref, pos, ok := b.alterWorkflowActivityRef(ctx.AlterTarget())
+		if !ok {
+			return nil
+		}
+		var ops []ast.AlterWorkflowOp
+		for _, m := range ctx.AllAlterWorkflowMember() {
+			ops = append(ops, buildAlterWorkflowMember(m.(*parser.AlterWorkflowMemberContext), ref, pos)...)
+		}
+		return ops
+	case ctx.INSERT() != nil:
+		ref, pos, ok := b.alterWorkflowActivityRef(ctx.AlterTarget())
+		if !ok {
+			return nil
+		}
+		acts := alterWorkflowFragmentActivities(ctx.AlterWorkflowFragment())
+		if ctx.BEFORE() != nil {
+			return []ast.AlterWorkflowOp{&ast.InsertBeforeOp{ActivityRef: ref, AtPosition: pos, NewActivities: acts}}
+		}
+		return []ast.AlterWorkflowOp{&ast.InsertAfterOp{ActivityRef: ref, AtPosition: pos, NewActivities: acts}}
+	case ctx.REPLACE() != nil:
+		ref, pos, ok := b.alterWorkflowActivityRef(ctx.AlterTarget())
+		if !ok {
+			return nil
+		}
+		return []ast.AlterWorkflowOp{&ast.ReplaceActivityOp{ActivityRef: ref, AtPosition: pos,
+			NewActivities: alterWorkflowFragmentActivities(ctx.AlterWorkflowFragment())}}
+	case ctx.DROP() != nil:
+		var ops []ast.AlterWorkflowOp
+		for _, t := range ctx.AllAlterWorkflowTarget() {
+			if op := b.buildAlterWorkflowDrop(t.(*parser.AlterWorkflowTargetContext)); op != nil {
+				ops = append(ops, op)
+			}
+		}
+		return ops
+	}
+	return nil
+}
+
+// alterWorkflowActivityRef reads a generic target as the activity address the
+// workflow operations carry: a name or a caption, and @n. A workflow activity
+// has no members to dot into and no grid columns, so those forms are refused
+// here, where the author wrote them.
+func (b *Builder) alterWorkflowActivityRef(ctx parser.IAlterTargetContext) (string, int, bool) {
+	if ctx == nil {
+		return "", 0, false
+	}
+	ref := b.buildAlterTarget(ctx)
+	if ref.IsColumnAddress() || ref.Column != "" {
+		b.addError(fmt.Errorf("alter workflow target %s: a workflow activity is addressed by its name "+
+			"(`ReviewOrder`) or its caption (`'Review the order'`), with @n to choose one of several "+
+			"matches — `describe workflow` prints every activity's name", ref.Name()))
+		return "", 0, false
+	}
+	if ref.Caption != "" {
+		return ref.Caption, ref.Ordinal, true
+	}
+	return ref.Widget, ref.Ordinal, true
+}
+
+// alterWorkflowFragmentActivities builds a `{ … }` fragment's activities,
+// exactly as an outcome's body in `create workflow` is built.
+func alterWorkflowFragmentActivities(ctx parser.IAlterWorkflowFragmentContext) []ast.WorkflowActivityNode {
+	if ctx == nil {
+		return nil
+	}
+	return buildWorkflowBody(ctx.(*parser.AlterWorkflowFragmentContext).WorkflowBody())
+}
+
+// buildAlterWorkflowMember builds what `insert into <activity> { … }` adds:
+// user-task outcomes (`'X' { … }`), condition outcomes (`true -> { … }`), a
+// parallel path, or a boundary event — each the operation the old `insert
+// outcome` / `insert condition` / `insert path` / `insert boundary event`
+// built.
+func buildAlterWorkflowMember(ctx *parser.AlterWorkflowMemberContext, ref string, pos int) []ast.AlterWorkflowOp {
+	switch {
+	case ctx.OUTCOMES() != nil:
+		var ops []ast.AlterWorkflowOp
+		for _, c := range ctx.GetChildren() {
+			switch o := c.(type) {
+			case *parser.WorkflowUserTaskOutcomeContext:
+				ops = append(ops, &ast.InsertOutcomeOp{
+					OutcomeName: unquoteStringLit(o.STRING_LITERAL()),
+					ActivityRef: ref, AtPosition: pos,
+					Activities: buildWorkflowBody(o.WorkflowBody()),
+				})
+			case *parser.WorkflowConditionOutcomeContext:
+				ops = append(ops, &ast.InsertBranchOp{
+					Condition:   conditionOutcomeText(o),
+					ActivityRef: ref, AtPosition: pos,
+					Activities: buildWorkflowBody(o.WorkflowBody()),
+				})
+			}
+		}
+		return ops
+	case ctx.PATH() != nil:
+		op := &ast.InsertPathOp{ActivityRef: ref, AtPosition: pos, Activities: buildWorkflowBody(ctx.WorkflowBody())}
+		if n := ctx.NUMBER_LITERAL(); n != nil {
+			op.PathNumber, _ = strconv.Atoi(n.GetText())
+		}
+		return []ast.AlterWorkflowOp{op}
+	case ctx.BOUNDARY() != nil:
+		be := buildBoundaryEventNode(ctx.WorkflowBoundaryEventClause())
+		return []ast.AlterWorkflowOp{&ast.InsertBoundaryEventOp{
+			ActivityRef: ref, AtPosition: pos,
+			EventType: be.EventType, Delay: be.Delay, Activities: be.Activities,
+		}}
+	}
+	return nil
+}
+
+// conditionOutcomeText is the condition an InsertBranchOp carries: `true`,
+// `false` and `default` as those words, any other outcome by its value — what
+// the old `insert condition '<value>'` carried as its string.
+func conditionOutcomeText(o *parser.WorkflowConditionOutcomeContext) string {
+	switch {
+	case o.TRUE() != nil:
+		return "true"
+	case o.FALSE() != nil:
+		return "false"
+	case o.DEFAULT() != nil:
+		return "default"
+	case o.STRING_LITERAL() != nil:
+		return unquoteStringLit(o.STRING_LITERAL())
+	}
+	return ""
+}
+
+// buildAlterWorkflowDrop builds one drop target: an activity, or a member of
+// one. `outcome 'X'` is an outcome by value (the old `drop outcome`);
+// `outcome true|false|default` a decision's (the old `drop condition`).
+func (b *Builder) buildAlterWorkflowDrop(ctx *parser.AlterWorkflowTargetContext) ast.AlterWorkflowOp {
+	ref, pos, ok := b.alterWorkflowActivityRef(ctx.AlterTarget())
+	if !ok {
+		return nil
+	}
+	mc := ctx.AlterWorkflowTargetMember()
+	if mc == nil {
+		return &ast.DropActivityOp{ActivityRef: ref, AtPosition: pos}
+	}
+	m := mc.(*parser.AlterWorkflowTargetMemberContext)
+	switch {
+	case m.OUTCOME() != nil && m.STRING_LITERAL() != nil:
+		return &ast.DropOutcomeOp{OutcomeName: unquoteStringLit(m.STRING_LITERAL()), ActivityRef: ref, AtPosition: pos}
+	case m.OUTCOME() != nil:
+		name := "default"
+		if m.TRUE() != nil {
+			name = "true"
+		} else if m.FALSE() != nil {
+			name = "false"
+		}
+		return &ast.DropBranchOp{BranchName: name, ActivityRef: ref, AtPosition: pos}
+	case m.PATH() != nil:
+		return &ast.DropPathOp{PathCaption: "Path " + m.NUMBER_LITERAL().GetText(), ActivityRef: ref, AtPosition: pos}
+	case m.BOUNDARY() != nil:
+		return &ast.DropBoundaryEventOp{ActivityRef: ref, AtPosition: pos}
+	}
+	return nil
+}
+
+// buildAlterWorkflowSet builds `set ( Key: value, … ) [on <activity>]`: one
+// SetWorkflowPropertyOp per key without a target, one SetActivityPropertyOp
+// per key with one — the operations the old `set <prop> v` and `set activity
+// X <prop> v` built.
+func (b *Builder) buildAlterWorkflowSet(ctx *parser.AlterWorkflowOperationContext) []ast.AlterWorkflowOp {
+	onActivity := ctx.ON() != nil
+	var ref string
+	var pos int
+	if onActivity {
+		var ok bool
+		if ref, pos, ok = b.alterWorkflowActivityRef(ctx.AlterTarget()); !ok {
+			return nil
+		}
+	}
+	var ops []ast.AlterWorkflowOp
+	for _, a := range ctx.AllAlterWorkflowAssignment() {
+		ac := a.(*parser.AlterWorkflowAssignmentContext)
+		key := identifierOrKeywordText(ac.IdentifierOrKeyword())
+		v := ac.AlterWorkflowValue().(*parser.AlterWorkflowValueContext)
+		lk := strings.ToLower(key)
+		if onActivity {
+			prop, known := activityPropertyKeys[lk]
+			if !known {
+				b.addError(fmt.Errorf("alter workflow: an activity has no property %s — `set ( … ) on <activity>` takes %s; "+
+					"a workflow property (%s) is set without `on`", key, activityKeysText, workflowKeysText))
+				continue
+			}
+			if op := b.buildActivitySet(key, prop, v, ref, pos); op != nil {
+				ops = append(ops, op)
+			}
+			continue
+		}
+		prop, known := workflowPropertyKeys[lk]
+		if !known {
+			if _, isActivity := activityPropertyKeys[lk]; isActivity {
+				b.addError(fmt.Errorf("alter workflow: %s is an activity property — write `set (%s: …) on <activity>`", key, key))
+			} else {
+				b.addError(fmt.Errorf("alter workflow: a workflow has no property %s — `set ( … )` takes %s; "+
+					"an activity's (%s) are set with `on <activity>`", key, workflowKeysText, activityKeysText))
+			}
+			continue
+		}
+		if op := b.buildWorkflowSet(key, prop, v); op != nil {
+			ops = append(ops, op)
+		}
+	}
+	return ops
+}
+
+// alterWorkflowStringValue reads a value that must be a string.
+func alterWorkflowStringValue(v *parser.AlterWorkflowValueContext) (string, bool) {
+	if we := v.WorkflowExpression(); we != nil && we.STRING_LITERAL() != nil {
+		return unquoteStringLit(we.STRING_LITERAL()), true
+	}
+	return "", false
+}
+
+// alterWorkflowExpressionValue reads an expression-valued property (a due
+// date): the expression written bare, or — the deprecated form, MDL-DEPR080 —
+// its string's content, as workflowExpression reads it everywhere else.
+func alterWorkflowExpressionValue(v *parser.AlterWorkflowValueContext) (string, bool) {
+	if we := v.WorkflowExpression(); we != nil {
+		return workflowExpressionText(we), true
+	}
+	if qn := v.QualifiedName(); qn != nil && v.VARIABLE() == nil && v.MICROFLOW() == nil {
+		// A bare constant or enumeration value reads as a name first.
+		return extractExpressionText(qn), true
+	}
+	return "", false
+}
+
+func (b *Builder) alterWorkflowValueError(key, want string) {
+	b.addError(fmt.Errorf("alter workflow: %s takes %s", key, want))
+}
+
+func (b *Builder) buildWorkflowSet(key, prop string, v *parser.AlterWorkflowValueContext) ast.AlterWorkflowOp {
+	op := &ast.SetWorkflowPropertyOp{Property: prop}
+	switch prop {
+	case "display", "description":
+		s, ok := alterWorkflowStringValue(v)
+		if !ok {
+			b.alterWorkflowValueError(key, "a string: `"+key+": '…'`")
+			return nil
+		}
+		op.Value = s
+	case "export_level":
+		qn := v.QualifiedName()
+		if qn == nil || v.VARIABLE() != nil || v.MICROFLOW() != nil || strings.Contains(qn.GetText(), ".") {
+			b.alterWorkflowValueError(key, "a level: `ExportLevel: API`, `ExportLevel: Hidden`")
+			return nil
+		}
+		op.Value = qn.GetText()
+		if strings.EqualFold(op.Value, "api") {
+			op.Value = "API"
+		}
+	case "due_date":
+		s, ok := alterWorkflowExpressionValue(v)
+		if !ok {
+			b.alterWorkflowValueError(key, "an expression: `DueDate: addDays([%CurrentDateTime%], 3)`")
+			return nil
+		}
+		op.Value = s
+	case "overview_page":
+		qn := v.QualifiedName()
+		if qn == nil || v.VARIABLE() != nil || v.MICROFLOW() != nil {
+			b.alterWorkflowValueError(key, "a page: `OverviewPage: Module.Page`")
+			return nil
+		}
+		op.Entity = buildQualifiedName(qn)
+	case "parameter":
+		if v.VARIABLE() == nil || v.QualifiedName() == nil {
+			b.alterWorkflowValueError(key, "a parameter declaration: `Parameter: $WorkflowContext: Module.Entity`")
+			return nil
+		}
+		op.Value = v.VARIABLE().GetText()
+		op.Entity = buildQualifiedName(v.QualifiedName())
+	}
+	return op
+}
+
+func (b *Builder) buildActivitySet(key, prop string, v *parser.AlterWorkflowValueContext, ref string, pos int) ast.AlterWorkflowOp {
+	op := &ast.SetActivityPropertyOp{ActivityRef: ref, AtPosition: pos, Property: prop}
+	switch prop {
+	case "page":
+		qn := v.QualifiedName()
+		if qn == nil || v.VARIABLE() != nil || v.MICROFLOW() != nil {
+			b.alterWorkflowValueError(key, "a page: `Page: Module.Page`")
+			return nil
+		}
+		op.PageName = buildQualifiedName(qn)
+	case "description":
+		s, ok := alterWorkflowStringValue(v)
+		if !ok {
+			b.alterWorkflowValueError(key, "a string: `Description: '…'`")
+			return nil
+		}
+		op.Value = s
+	case "targeting":
+		switch {
+		case v.MICROFLOW() != nil:
+			op.Property = "targeting_microflow"
+			op.Microflow = buildQualifiedName(v.QualifiedName())
+		case v.XPATH() != nil:
+			op.Property = "targeting_xpath"
+			if groups := v.AllXpathConstraint(); len(groups) > 0 {
+				op.Value = bracketedXPathText(groups)
+			} else if lit := v.STRING_LITERAL(); lit != nil {
+				op.Value = unquoteStringLit(lit) // MDL-DEPR031, recorded by ExitAlterWorkflowValue
+			}
+		default:
+			b.alterWorkflowValueError(key, "`Targeting: microflow Module.Microflow` or `Targeting: xpath [ … ]`")
+			return nil
+		}
+	case "due_date":
+		s, ok := alterWorkflowExpressionValue(v)
+		if !ok {
+			b.alterWorkflowValueError(key, "an expression: `DueDate: addDays([%CurrentDateTime%], 1)`")
+			return nil
+		}
+		op.Value = s
+	}
+	return op
+}
+
+// ExitAlterWorkflowValue records `Targeting: xpath '…'`, the XPath in a
+// string (MDL-DEPR031), as the old `set activity … targeting xpath '…'` does.
+func (b *Builder) ExitAlterWorkflowValue(ctx *parser.AlterWorkflowValueContext) {
+	if ctx.XPATH() != nil {
+		b.recordQuotedTargetingXPath(ctx.STRING_LITERAL())
+	}
+}
+
+// isAlterWorkflowStringProperty reports whether a workflowExpression is the
+// value of a `set ( … )` key other than DueDate: there a string is the value
+// (Display: 'x'), not the deprecated spelling of an expression.
+func isAlterWorkflowStringProperty(ctx antlr.Tree) bool {
+	v, ok := ctx.GetParent().(*parser.AlterWorkflowValueContext)
+	if !ok {
+		return false
+	}
+	a, ok := v.GetParent().(*parser.AlterWorkflowAssignmentContext)
+	if !ok {
+		return false
+	}
+	return !strings.EqualFold(identifierOrKeywordText(a.IdentifierOrKeyword()), "DueDate")
+}
+
+// ---------------------------------------------------------------------------
+// The old per-action form: MDL-DEPR140-149 and their rewrites
+// ---------------------------------------------------------------------------
+
+// oldAlterWorkflowUse is one old action's record: its code, and the rewrite
+// of the action itself (the block's braces are added around them), or why
+// there is none.
+type oldAlterWorkflowUse struct {
+	code  string
+	tok   antlr.Token
+	edits []ast.TextEdit
+	noFix string
+	// separate says the canonical operation is followed by `;` (set, drop);
+	// an insert or replace ends in its fragment's `}`.
+	separate bool
+}
+
+var pathCaption = regexp.MustCompile(`^Path ([1-9][0-9]*)$`)
+
+// recordOldAlterWorkflowActions records every action of the old form under its
+// code, with its rewrite. The old statement has no braces: the first action's
+// rewrite opens the block after the workflow's name, the last one's closes it
+// (adding the statement's `;` when it had none). An action with no rewrite
+// leaves the whole statement unrewritten — half a block would not parse.
+func (b *Builder) recordOldAlterWorkflowActions(ctx *parser.AlterStatementContext) {
+	actions := ctx.AllAlterWorkflowAction()
+	if len(actions) == 0 {
+		return
+	}
+	uses := make([]oldAlterWorkflowUse, 0, len(actions))
+	noFix := ""
+	for _, a := range actions {
+		u := oldAlterWorkflowActionUse(a.(*parser.AlterWorkflowActionContext))
+		if u.noFix != "" && noFix == "" {
+			noFix = u.noFix
+		}
+		uses = append(uses, u)
+	}
+	if noFix != "" {
+		for i := range uses {
+			if uses[i].noFix == "" {
+				uses[i].noFix = "another action of this `alter workflow` has no rewrite (" + noFix + "); rewrite the statement by hand"
+			}
+		}
+	} else {
+		if qn := ctx.QualifiedName(); qn != nil && qn.GetStop() != nil {
+			uses[0].edits = append([]ast.TextEdit{insertAt(qn.GetStop().GetStop()+1, " {")}, uses[0].edits...)
+		}
+		for i := range uses {
+			end := actions[i].GetStop().GetStop() + 1
+			if uses[i].separate {
+				uses[i].edits = append(uses[i].edits, insertAt(end, ";"))
+			}
+			if i == len(uses)-1 {
+				// A statement written over several lines closes on a line of
+				// its own, as a block does; a one-liner stays on its line.
+				closing := " }"
+				if qn := ctx.QualifiedName(); qn != nil && qn.GetStop() != nil &&
+					actions[i].GetStop().GetLine() != qn.GetStop().GetLine() {
+					closing = "\n}"
+				}
+				if !alterStatementTerminated(ctx) {
+					closing += ";"
+				}
+				uses[i].edits = append(uses[i].edits, insertAt(end, closing))
+			}
+		}
+	}
+	for _, u := range uses {
+		b.recordDeprecation(u.code, u.tok, "alter workflow")
+		if u.noFix != "" {
+			b.fixLastDeprecation(u.code, nil, u.noFix)
+		} else {
+			b.fixLastDeprecation(u.code, &ast.Fix{Edits: u.edits}, "")
+		}
+	}
+}
+
+// alterStatementTerminated reports whether the statement has its own `;`.
+// An old action ending in an activity (`insert after X call microflow M.F;`)
+// takes the `;` itself, and the statement then has none.
+func alterStatementTerminated(ctx *parser.AlterStatementContext) bool {
+	if ctx.SEMICOLON() != nil {
+		return true
+	}
+	if ddl, ok := ctx.GetParent().(*parser.DdlStatementContext); ok {
+		if st, ok := ddl.GetParent().(*parser.StatementContext); ok && st.SEMICOLON() != nil {
+			return true
+		}
+	}
+	return false
+}
+
+// srcText is the source between two tokens, as written.
+func srcText(start, stop antlr.Token) string {
+	if start == nil || stop == nil || start.GetInputStream() == nil || stop.GetStop() < start.GetStart() {
+		return ""
+	}
+	return start.GetInputStream().GetText(start.GetStart(), stop.GetStop())
+}
+
+// spaceBefore is " " when the source has blank space before tok, as the old
+// form did between its keywords and the value: `due date'x'` stays glued, so
+// the rewrite of the string itself can decide the spacing.
+func spaceBefore(tok antlr.Token) string {
+	is := tok.GetInputStream()
+	if is == nil || tok.GetStart() == 0 {
+		return " "
+	}
+	switch is.GetText(tok.GetStart()-1, tok.GetStart()-1) {
+	case " ", "\t", "\n", "\r":
+		return " "
+	}
+	return ""
+}
+
+// replaceBefore replaces from the start of first up to (not including) the
+// start of next.
+func replaceBefore(first, next antlr.Token, text string) ast.TextEdit {
+	return ast.TextEdit{Start: first.GetStart(), Stop: next.GetStart(), Text: text}
+}
+
+// oldAlterWorkflowActionUse computes one old action's code and rewrite. Each
+// rewrite touches only the action's own words and moves the activity address;
+// the value, the fragment and the boundary event clause are left as written,
+// so a deprecation inside them (a quoted XPath, an expression in a string, a
+// `comment` caption) is rewritten by its own record.
+func oldAlterWorkflowActionUse(a *parser.AlterWorkflowActionContext) (u oldAlterWorkflowUse) {
+	start := a.GetStart()
+	// A malformed action (a parse error the parser recovered from) is missing
+	// the children a rewrite reads; the parse error is what gets reported.
+	defer func() {
+		if recover() != nil {
+			u = oldAlterWorkflowUse{code: deprecation.AlterWorkflowSet, tok: start, noFix: "the action does not parse"}
+		}
+	}()
+	ref := ""
+	if r := a.AlterActivityRef(); r != nil {
+		ref = srcText(r.GetStart(), r.GetStop())
+	}
+	after := func(t antlr.Token, text string) ast.TextEdit { return insertAt(t.GetStop()+1, text) }
+	// Keywords the rewrite writes follow the action's own letter case.
+	kw := func(w string) string { return keywordLike(start.GetText(), w) }
+
+	switch {
+	case a.WorkflowSetProperty() != nil:
+		return oldWorkflowSetUse(a.WorkflowSetProperty().(*parser.WorkflowSetPropertyContext), start, kw)
+
+	case a.ActivitySetProperty() != nil:
+		return oldActivitySetUse(a.ActivitySetProperty().(*parser.ActivitySetPropertyContext), start, ref, kw)
+
+	case a.INSERT() != nil && a.AFTER() != nil:
+		st := a.WorkflowActivityStmt()
+		return oldAlterWorkflowUse{code: deprecation.AlterWorkflowInsertAfter, tok: start, edits: []ast.TextEdit{
+			insertAt(st.GetStart().GetStart(), "{ "), after(st.GetStop(), " }")}}
+
+	case a.REPLACE() != nil:
+		st := a.WorkflowActivityStmt()
+		act := a.ACTIVITY().GetSymbol()
+		return oldAlterWorkflowUse{code: deprecation.AlterWorkflowReplaceActivity, tok: start, edits: []ast.TextEdit{
+			{Start: act.GetStart(), Stop: afterBlank(act), Text: ""},
+			insertAt(st.GetStart().GetStart(), "{ "), after(st.GetStop(), " }")}}
+
+	case a.DROP() != nil && a.ACTIVITY() != nil:
+		act := a.ACTIVITY().GetSymbol()
+		return oldAlterWorkflowUse{code: deprecation.AlterWorkflowDropActivity, tok: start, separate: true,
+			edits: []ast.TextEdit{{Start: act.GetStart(), Stop: afterBlank(act), Text: ""}}}
+
+	case a.INSERT() != nil && a.BOUNDARY() != nil:
+		clause := a.WorkflowBoundaryEventClause()
+		return oldAlterWorkflowUse{code: deprecation.AlterWorkflowInsertBoundaryEvent, tok: start, edits: []ast.TextEdit{
+			replaceBefore(start, clause.GetStart(), kw("insert into")+" "+ref+" { "+kw("boundary event")+" "),
+			after(clause.GetStop(), " }")}}
+
+	case a.INSERT() != nil:
+		code, member := "", ""
+		switch {
+		case a.OUTCOME() != nil:
+			code, member = deprecation.AlterWorkflowInsertOutcome, kw("outcomes")+" "+a.STRING_LITERAL().GetText()+" "
+		case a.PATH() != nil:
+			code, member = deprecation.AlterWorkflowInsertPath, kw("path")+" "
+		case a.CONDITION() != nil:
+			code, member = deprecation.AlterWorkflowInsertCondition, kw("outcomes")+" "+a.STRING_LITERAL().GetText()+" -> "
+		}
+		return oldAlterWorkflowUse{code: code, tok: start, edits: []ast.TextEdit{
+			replaceBefore(start, a.LBRACE().GetSymbol(), kw("insert into")+" "+ref+" { "+member),
+			after(a.RBRACE().GetSymbol(), " }")}}
+
+	case a.DROP() != nil:
+		return oldDropMemberUse(a, start, ref, kw)
+	}
+	return oldAlterWorkflowUse{code: deprecation.AlterWorkflowSet, tok: start, noFix: "unrecognised alter workflow action"}
+}
+
+// oldWorkflowSetUse rewrites `set <property> v` as `set (Key: v)`.
+func oldWorkflowSetUse(wp *parser.WorkflowSetPropertyContext, start antlr.Token, kw func(string) string) oldAlterWorkflowUse {
+	key, value := "", antlr.Token(nil)
+	switch {
+	case wp.DISPLAY() != nil:
+		key, value = "Display", wp.STRING_LITERAL().GetSymbol()
+	case wp.DESCRIPTION() != nil:
+		key, value = "Description", wp.STRING_LITERAL().GetSymbol()
+	case wp.EXPORT() != nil:
+		key = "ExportLevel"
+		switch {
+		case wp.API() != nil:
+			value = wp.API().GetSymbol()
+		case wp.HIDDEN_KW() != nil:
+			value = wp.HIDDEN_KW().GetSymbol()
+		case wp.IDENTIFIER() != nil:
+			value = wp.IDENTIFIER().GetSymbol()
+		}
+	case wp.DUE() != nil:
+		key = "DueDate"
+		if e := wp.WorkflowExpression(); e != nil {
+			value = e.GetStart()
+		}
+	case wp.OVERVIEW() != nil:
+		key = "OverviewPage"
+		if q := wp.QualifiedName(); q != nil {
+			value = q.GetStart()
+		}
+	case wp.PARAMETER() != nil:
+		key, value = "Parameter", wp.VARIABLE().GetSymbol()
+	}
+	u := oldAlterWorkflowUse{code: deprecation.AlterWorkflowSet, tok: start, separate: true}
+	if value == nil {
+		u.noFix = "the property has no value to move into `set ( … )`"
+		return u
+	}
+	u.edits = []ast.TextEdit{replaceBefore(start, value, kw("set")+" ("+key+":"+spaceBefore(value)), insertAt(wp.GetStop().GetStop()+1, ")")}
+	return u
+}
+
+// oldActivitySetUse rewrites `set activity X <property> v` as `set (Key: v) on X`.
+func oldActivitySetUse(ap *parser.ActivitySetPropertyContext, start antlr.Token, ref string, kw func(string) string) oldAlterWorkflowUse {
+	key, extra, value := "", "", antlr.Token(nil)
+	switch {
+	case ap.PAGE() != nil:
+		key, value = "Page", ap.QualifiedName().GetStart()
+	case ap.DESCRIPTION() != nil:
+		key, value = "Description", ap.STRING_LITERAL().GetSymbol()
+	case ap.TARGETING() != nil && ap.MICROFLOW() != nil:
+		key, extra, value = "Targeting", " "+kw("microflow"), ap.QualifiedName().GetStart()
+	case ap.TARGETING() != nil:
+		key, extra = "Targeting", " "+kw("xpath")
+		if g := ap.AllXpathConstraint(); len(g) > 0 {
+			value = g[0].GetStart()
+		} else if lit := ap.STRING_LITERAL(); lit != nil {
+			value = lit.GetSymbol()
+		}
+	case ap.DUE() != nil:
+		key = "DueDate"
+		if e := ap.WorkflowExpression(); e != nil {
+			value = e.GetStart()
+		}
+	}
+	u := oldAlterWorkflowUse{code: deprecation.AlterWorkflowSetActivity, tok: start, separate: true}
+	if value == nil {
+		u.noFix = "the property has no value to move into `set ( … ) on`"
+		return u
+	}
+	u.edits = []ast.TextEdit{replaceBefore(start, value, kw("set")+" ("+key+":"+extra+spaceBefore(value)),
+		insertAt(ap.GetStop().GetStop()+1, ") "+kw("on")+" "+ref)}
+	return u
+}
+
+// oldDropMemberUse rewrites `drop outcome|condition|path|boundary event … on X`
+// as `drop X outcome …|path n|boundary event`.
+func oldDropMemberUse(a *parser.AlterWorkflowActionContext, start antlr.Token, ref string, kw func(string) string) oldAlterWorkflowUse {
+	u := oldAlterWorkflowUse{code: deprecation.AlterWorkflowDropMember, tok: start, separate: true}
+	member := ""
+	switch {
+	case a.OUTCOME() != nil:
+		member = " " + kw("outcome") + " " + a.STRING_LITERAL().GetText()
+	case a.CONDITION() != nil:
+		v := unquoteStringLit(a.STRING_LITERAL())
+		switch strings.ToLower(v) {
+		case "true", "false", "default":
+			member = " " + kw("outcome") + " " + kw(v)
+		default:
+			// An enumeration outcome by value: `drop outcome` and `drop
+			// condition` match a non-Boolean outcome the same way.
+			member = " " + kw("outcome") + " " + a.STRING_LITERAL().GetText()
+		}
+	case a.PATH() != nil:
+		m := pathCaption.FindStringSubmatch(unquoteStringLit(a.STRING_LITERAL()))
+		if m == nil {
+			u.noFix = "the path caption " + a.STRING_LITERAL().GetText() +
+				" is not `Path n`, and a path is dropped by its number (`drop <split> path n`)"
+			return u
+		}
+		member = " " + kw("path") + " " + m[1]
+	case a.BOUNDARY() != nil:
+		member = " " + kw("boundary event")
+	}
+	u.edits = []ast.TextEdit{{Start: start.GetStart(), Stop: a.GetStop().GetStop() + 1, Text: kw("drop") + " " + ref + member}}
+	return u
+}
diff --git a/mdl/visitor/visitor_alter_workflow_generic_test.go b/mdl/visitor/visitor_alter_workflow_generic_test.go
new file mode 100644
index 0000000000..b47075cf1d
--- /dev/null
+++ b/mdl/visitor/visitor_alter_workflow_generic_test.go
@@ -0,0 +1,179 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package visitor
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
+)
+
+// alter workflow on the generic ALTER (ADR-0012 decision 2, ako/mxcli#712):
+// every old action spelling builds exactly the statement its canonical
+// spelling builds, records its own MDL-DEPR14x code, and the canonical
+// spelling records nothing.
+var alterWorkflowPairs = []struct {
+	name, old, canonical, code string
+}{
+	{"set display", `alter workflow M.W set display 'Order';`,
+		`alter workflow M.W { set (Display: 'Order'); };`, deprecation.AlterWorkflowSet},
+	{"set description", `alter workflow M.W set description 'd';`,
+		`alter workflow M.W { set (Description: 'd'); };`, deprecation.AlterWorkflowSet},
+	{"set export level", `alter workflow M.W set export level API;`,
+		`alter workflow M.W { set (ExportLevel: API); };`, deprecation.AlterWorkflowSet},
+	{"set export level hidden", `alter workflow M.W set export level Hidden;`,
+		`alter workflow M.W { set (ExportLevel: Hidden); };`, deprecation.AlterWorkflowSet},
+	{"set due date", `alter workflow M.W set due date addDays([%CurrentDateTime%], 3);`,
+		`alter workflow M.W { set (DueDate: addDays([%CurrentDateTime%], 3)); };`, deprecation.AlterWorkflowSet},
+	{"set overview page", `alter workflow M.W set overview page M.Admin;`,
+		`alter workflow M.W { set (OverviewPage: M.Admin); };`, deprecation.AlterWorkflowSet},
+	{"set parameter", `alter workflow M.W set parameter $WorkflowContext: M.Ctx;`,
+		`alter workflow M.W { set (Parameter: $WorkflowContext: M.Ctx); };`, deprecation.AlterWorkflowSet},
+	{"set activity page", `alter workflow M.W set activity Review page M.TaskPage;`,
+		`alter workflow M.W { set (Page: M.TaskPage) on Review; };`, deprecation.AlterWorkflowSetActivity},
+	{"set activity page by caption @2", `alter workflow M.W set activity 'Review order'@2 page M.TaskPage;`,
+		`alter workflow M.W { set (Page: M.TaskPage) on 'Review order'@2; };`, deprecation.AlterWorkflowSetActivity},
+	{"set activity description", `alter workflow M.W set activity Review description 'x';`,
+		`alter workflow M.W { set (Description: 'x') on Review; };`, deprecation.AlterWorkflowSetActivity},
+	{"set activity targeting microflow", `alter workflow M.W set activity Review targeting microflow M.Target;`,
+		`alter workflow M.W { set (Targeting: microflow M.Target) on Review; };`, deprecation.AlterWorkflowSetActivity},
+	{"set activity targeting xpath", `alter workflow M.W set activity Review targeting xpath [Active = true()];`,
+		`alter workflow M.W { set (Targeting: xpath [Active = true()]) on Review; };`, deprecation.AlterWorkflowSetActivity},
+	{"set activity due date", `alter workflow M.W set activity Review due date addDays([%CurrentDateTime%], 1);`,
+		`alter workflow M.W { set (DueDate: addDays([%CurrentDateTime%], 1)) on Review; };`, deprecation.AlterWorkflowSetActivity},
+	{"insert after", `alter workflow M.W insert after Review call microflow M.Notify;`,
+		`alter workflow M.W { insert after Review { call microflow M.Notify; } };`, deprecation.AlterWorkflowInsertAfter},
+	{"drop activity", `alter workflow M.W drop activity Review;`,
+		`alter workflow M.W { drop Review; };`, deprecation.AlterWorkflowDropActivity},
+	{"replace activity", `alter workflow M.W replace activity Review with call microflow M.Notify;`,
+		`alter workflow M.W { replace Review with { call microflow M.Notify; } };`, deprecation.AlterWorkflowReplaceActivity},
+	{"insert outcome", `alter workflow M.W insert outcome 'Escalate' on Review { call microflow M.Notify; };`,
+		`alter workflow M.W { insert into Review { outcomes 'Escalate' { call microflow M.Notify; } } };`, deprecation.AlterWorkflowInsertOutcome},
+	{"insert path", `alter workflow M.W insert path on split1 { call microflow M.Notify; };`,
+		`alter workflow M.W { insert into split1 { path { call microflow M.Notify; } } };`, deprecation.AlterWorkflowInsertPath},
+	{"insert condition", `alter workflow M.W insert condition 'true' on decision1 { };`,
+		`alter workflow M.W { insert into decision1 { outcomes 'true' -> { } } };`, deprecation.AlterWorkflowInsertCondition},
+	{"insert boundary event", `alter workflow M.W insert boundary event on Review interrupting timer addHours([%CurrentDateTime%], 1) { };`,
+		`alter workflow M.W { insert into Review { boundary event interrupting timer addHours([%CurrentDateTime%], 1) { } } };`, deprecation.AlterWorkflowInsertBoundaryEvent},
+	{"drop outcome", `alter workflow M.W drop outcome 'Reject' on Review;`,
+		`alter workflow M.W { drop Review outcome 'Reject'; };`, deprecation.AlterWorkflowDropMember},
+	{"drop condition true", `alter workflow M.W drop condition 'true' on decision1;`,
+		`alter workflow M.W { drop decision1 outcome true; };`, deprecation.AlterWorkflowDropMember},
+	{"drop condition default", `alter workflow M.W drop condition 'default' on decision1;`,
+		`alter workflow M.W { drop decision1 outcome default; };`, deprecation.AlterWorkflowDropMember},
+	{"drop path", `alter workflow M.W drop path 'Path 2' on split1;`,
+		`alter workflow M.W { drop split1 path 2; };`, deprecation.AlterWorkflowDropMember},
+	{"drop boundary event", `alter workflow M.W drop boundary event on Review;`,
+		`alter workflow M.W { drop Review boundary event; };`, deprecation.AlterWorkflowDropMember},
+}
+
+func TestAlterWorkflowGeneric_OldAndCanonicalBuildTheSameStatement(t *testing.T) {
+	for _, tc := range alterWorkflowPairs {
+		t.Run(tc.name, func(t *testing.T) {
+			old := mustBuild(t, tc.old)
+			canon := mustBuild(t, tc.canonical)
+			if got := deprecationCodes(canon); len(got) != 0 {
+				t.Errorf("canonical %q recorded %v, want none", tc.canonical, got)
+			}
+			if got := deprecationCodes(old); !reflect.DeepEqual(got, []string{tc.code}) {
+				t.Errorf("old %q recorded %v, want [%s]", tc.old, got, tc.code)
+			}
+			if len(canon.Statements) != 1 {
+				t.Fatalf("canonical built %d statements", len(canon.Statements))
+			}
+			if _, ok := canon.Statements[0].(*ast.AlterWorkflowStmt); !ok {
+				t.Fatalf("canonical built %T", canon.Statements[0])
+			}
+			if !reflect.DeepEqual(old.Statements, canon.Statements) {
+				t.Errorf("different statements:\n old:   %#v\n canon: %#v", old.Statements[0], canon.Statements[0])
+			}
+		})
+	}
+}
+
+// Several operations in one block, one property list setting several keys,
+// and the forms the old grammar had no spelling for.
+func TestAlterWorkflowGeneric_BlockForms(t *testing.T) {
+	prog := mustBuild(t, `alter workflow M.W {
+  set (Display: 'Order', Description: 'Handles orders');
+  set (Page: M.TaskPage, DueDate: addDays([%CurrentDateTime%], 2)) on Review;
+  insert before Review { call microflow M.Prepare; call microflow M.Log; }
+  insert after 'Review order'@2 { wait for notification waitHere; }
+  insert into split1 { path 3 { call microflow M.Notify; } }
+  insert into decision1 { outcomes false -> { } default -> { } }
+  drop Review outcome 'Reject', split1 path 1, callMf boundary event;
+};`)
+	if got := deprecationCodes(prog); len(got) != 0 {
+		t.Fatalf("recorded %v, want none", got)
+	}
+	s := prog.Statements[0].(*ast.AlterWorkflowStmt)
+	var kinds []string
+	for _, op := range s.Operations {
+		kinds = append(kinds, strings.TrimPrefix(reflect.TypeOf(op).String(), "*ast."))
+	}
+	want := []string{
+		"SetWorkflowPropertyOp", "SetWorkflowPropertyOp",
+		"SetActivityPropertyOp", "SetActivityPropertyOp",
+		"InsertBeforeOp", "InsertAfterOp", "InsertPathOp",
+		"InsertBranchOp", "InsertBranchOp",
+		"DropOutcomeOp", "DropPathOp", "DropBoundaryEventOp",
+	}
+	if !reflect.DeepEqual(kinds, want) {
+		t.Fatalf("ops = %v\nwant %v", kinds, want)
+	}
+	before := s.Operations[4].(*ast.InsertBeforeOp)
+	if before.ActivityRef != "Review" || len(before.NewActivities) != 2 {
+		t.Errorf("insert before = %+v", before)
+	}
+	after := s.Operations[5].(*ast.InsertAfterOp)
+	if after.ActivityRef != "Review order" || after.AtPosition != 2 {
+		t.Errorf("insert after target = %q@%d", after.ActivityRef, after.AtPosition)
+	}
+	if p := s.Operations[6].(*ast.InsertPathOp); p.PathNumber != 3 {
+		t.Errorf("path number = %d, want 3", p.PathNumber)
+	}
+	if d := s.Operations[8].(*ast.InsertBranchOp); d.Condition != "default" {
+		t.Errorf("branch = %q, want default", d.Condition)
+	}
+	if d := s.Operations[10].(*ast.DropPathOp); d.PathCaption != "Path 1" {
+		t.Errorf("drop path = %q", d.PathCaption)
+	}
+}
+
+// A workflow activity has a name or a caption, never a member path or a grid
+// column address; an unknown property key names the ones that exist.
+func TestAlterWorkflowGeneric_RefusesAddressesAndKeysItCannotMean(t *testing.T) {
+	for _, tc := range []struct{ src, want string }{
+		{`alter workflow M.W { drop Review.Caption; };`, "addressed by its name"},
+		{`alter workflow M.W { drop dg column(Name); };`, "addressed by its name"},
+		{`alter workflow M.W { set (Colour: 'red'); };`, "Display"},
+		{`alter workflow M.W { set (Page: M.P); };`, "on <activity>"},
+		{`alter workflow M.W { set (ExportLevel: API) on Review; };`, "Page"},
+	} {
+		_, errs := Build(tc.src)
+		if len(errs) == 0 {
+			t.Errorf("%s: accepted", tc.src)
+			continue
+		}
+		if !strings.Contains(errs[0].Error(), tc.want) {
+			t.Errorf("%s: error %q does not mention %q", tc.src, errs[0], tc.want)
+		}
+	}
+}
+
+// Several old actions in one statement become one block; the braces belong to
+// the first and last action's rewrite, so each record still has one code.
+func TestAlterWorkflowGeneric_MultiActionOldFormBuildsTheBlock(t *testing.T) {
+	old := mustBuild(t, `alter workflow M.W set display 'A' drop activity X insert after Y call microflow M.F;`)
+	canon := mustBuild(t, `alter workflow M.W { set (Display: 'A'); drop X; insert after Y { call microflow M.F; } };`)
+	if !reflect.DeepEqual(old.Statements, canon.Statements) {
+		t.Fatalf("different statements:\n old:   %#v\n canon: %#v", old.Statements[0], canon.Statements[0])
+	}
+	want := []string{deprecation.AlterWorkflowSet, deprecation.AlterWorkflowDropActivity, deprecation.AlterWorkflowInsertAfter}
+	if got := deprecationCodes(old); !reflect.DeepEqual(got, want) {
+		t.Fatalf("recorded %v, want %v", got, want)
+	}
+}
diff --git a/mdl/visitor/visitor_association.go b/mdl/visitor/visitor_association.go
index 4a43a0959e..d373abf5c2 100644
--- a/mdl/visitor/visitor_association.go
+++ b/mdl/visitor/visitor_association.go
@@ -28,7 +28,6 @@ func (b *Builder) ExitCreateAssociationStatement(ctx *parser.CreateAssociationSt
 		Type:           ast.AssocReference, // Default
 		Owner:          ast.OwnerDefault,
 		DeleteBehavior: ast.DeleteKeepReferences,
-		IfNotExists:    ctx.IfNotExists() != nil,
 	}
 	// The doc comment, the same spelling every other document type uses. It
 	// was never captured here, so an association was the one domain-model
diff --git a/mdl/visitor/visitor_create_guard.go b/mdl/visitor/visitor_create_guard.go
new file mode 100644
index 0000000000..6678b50ea5
--- /dev/null
+++ b/mdl/visitor/visitor_create_guard.go
@@ -0,0 +1,59 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package visitor
+
+import (
+	"fmt"
+
+	"github.com/antlr4-go/antlr/v4"
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/grammar/parser"
+)
+
+// EnterCreateStatement remembers how many statements were built before this
+// one, so ExitCreateStatement can find the statement the create rule built.
+func (b *Builder) EnterCreateStatement(ctx *parser.CreateStatementContext) {
+	b.createStart = len(b.statements)
+}
+
+// applyCreateGuard applies `if not exists` to whichever statement the create
+// rule built (ako/mxcli#731, ADR-0010 R1).
+//
+// The guard is written in each create rule — after the kind's keywords, before
+// the name — but applied here once, the way `drop … if exists` is applied in
+// ExitDropStatement: a guard each document builder has to remember to read is
+// the one the next document type forgets. A statement type that does not embed
+// ast.CreateGuard is reported rather than silently built without the guard,
+// since an ignored guard turns a leave-it-alone create into a plain one.
+func (b *Builder) applyCreateGuard(ctx *parser.CreateStatementContext) {
+	guard := createGuardToken(ctx)
+	if guard == nil || len(b.statements) != b.createStart+1 {
+		return
+	}
+	stmt := b.statements[len(b.statements)-1]
+	g, ok := stmt.(ast.IfNotExistsCreate)
+	if !ok {
+		b.addError(fmt.Errorf("line %d: `if not exists` is not supported on %T",
+			guard.GetStart().GetLine(), stmt))
+		return
+	}
+	g.SetCreateIfNotExists(ctx.OR() != nil)
+}
+
+// createGuardToken returns the `if not exists` of the create rule under ctx, or
+// nil. Only the create rule's own children are searched: a guard deeper in the
+// tree belongs to something inside the document, not to the document.
+func createGuardToken(ctx *parser.CreateStatementContext) *parser.IfNotExistsContext {
+	for _, child := range ctx.GetChildren() {
+		rc, ok := child.(antlr.ParserRuleContext)
+		if !ok {
+			continue
+		}
+		for _, grand := range rc.GetChildren() {
+			if g, ok := grand.(*parser.IfNotExistsContext); ok {
+				return g
+			}
+		}
+	}
+	return nil
+}
diff --git a/mdl/visitor/visitor_create_if_not_exists_test.go b/mdl/visitor/visitor_create_if_not_exists_test.go
new file mode 100644
index 0000000000..12303e3d9f
--- /dev/null
+++ b/mdl/visitor/visitor_create_if_not_exists_test.go
@@ -0,0 +1,147 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package visitor
+
+import (
+	"reflect"
+	"regexp"
+	"strings"
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/ast"
+)
+
+// createIfNotExistsExempt names the create kinds that do not take
+// `if not exists`, and why. Everything else createStatement accepts must
+// (ako/mxcli#731, ADR-0010 R1: "if not exists on every document type").
+var createIfNotExistsExempt = map[string]string{
+	"annotation":       "an annotation has no name to test for existence",
+	"index":            "an index is an entity member identified by its columns; alter entity … add index if not exists is its guard",
+	"validationrule":   "a validation rule is keyed by its attribute, not by a name",
+	"navigation":       "a navigation profile always exists; create navigation configures it",
+	"translations":     "translations merge into existing texts; there is nothing to leave alone",
+	"externalentities": "a bulk import of many entities, not one element",
+}
+
+// createNameRE finds where the element name starts in a createOrReplaceCases
+// body: the first qualified name in module M, the bare module name, a user
+// role name, or a quoted name (demo user, configuration).
+var createNameRE = regexp.MustCompile(`\s(M\.\w|M;|Clerk\b|'Default'|'demo')`)
+
+// withIfNotExists writes `if not exists` in its canonical place: after the
+// kind's keywords, before the name — `create persistent entity if not exists
+// Shop.Audit (…)`, as in the proposal's §3.
+func withIfNotExists(t *testing.T, body string) string {
+	t.Helper()
+	loc := createNameRE.FindStringIndex(body)
+	if loc == nil {
+		t.Fatalf("no element name found in %q", body)
+	}
+	return body[:loc[0]] + " if not exists" + body[loc[0]:]
+}
+
+func clearCreateGuard(stmts []ast.Statement) {
+	for _, s := range stmts {
+		if g, ok := s.(ast.IfNotExistsCreate); ok {
+			v := reflect.ValueOf(g).Elem().FieldByName("CreateGuard")
+			v.Set(reflect.Zero(v.Type()))
+		}
+	}
+}
+
+// Every document kind accepts `create <kind> if not exists <name>`, the built
+// statement carries the guard, and apart from the guard it is the statement a
+// plain `create` builds — the guard changes whether it runs, not what it says.
+func TestCreateIfNotExistsOnEveryDocumentKind(t *testing.T) {
+	kinds := createStatementKinds(t)
+	for _, kind := range kinds {
+		if _, ok := createOrReplaceCases[kind]; !ok {
+			t.Errorf("create kind %q has no case in createOrReplaceCases", kind)
+		}
+	}
+	cases := make(map[string]string, len(createOrReplaceCases)+1)
+	for k, v := range createOrReplaceCases {
+		cases[k] = v
+	}
+	cases["entity (view)"] = "view entity M.V (Name: String(100)) as (select c.Name as Name from M.Customer as c);"
+	cases["entity (non-persistent)"] = "non-persistent entity M.Filter (Q: String(200));"
+
+	for name, body := range cases {
+		if _, exempt := createIfNotExistsExempt[name]; exempt {
+			continue
+		}
+		body = strings.TrimSuffix(body, ";") + ";" // every statement ends with ; (valid under mdl 0 and mdl 1)
+		for _, header := range []string{"", "mdl 1;\n"} {
+			t.Run(name+"/"+strings.TrimSpace(header), func(t *testing.T) {
+				guarded := header + "create " + withIfNotExists(t, body)
+				plain := header + "create " + body
+				g := mustBuild(t, guarded)
+				p := mustBuild(t, plain)
+				if len(g.Statements) != 1 || len(p.Statements) != 1 {
+					t.Fatalf("want one statement each, got %d and %d", len(g.Statements), len(p.Statements))
+				}
+				guard, ok := g.Statements[0].(ast.IfNotExistsCreate)
+				if !ok {
+					t.Fatalf("%q built %T, which does not carry the if-not-exists guard", guarded, g.Statements[0])
+				}
+				if !guard.CreateIfNotExists() {
+					t.Errorf("%q: guard not recorded", guarded)
+				}
+				if guard.CreateGuardContradicts() {
+					t.Errorf("%q: reported as contradicting or modify", guarded)
+				}
+				if pg, ok := p.Statements[0].(ast.IfNotExistsCreate); ok && pg.CreateIfNotExists() {
+					t.Errorf("%q: plain create recorded the guard", plain)
+				}
+				clearCreateGuard(g.Statements)
+				clearCreateGuard(p.Statements)
+				if !reflect.DeepEqual(g.Statements, p.Statements) {
+					t.Errorf("the guard changed what the statement says:\n guarded: %#v\n plain:   %#v",
+						g.Statements, p.Statements)
+				}
+				if len(g.Deprecations) != 0 {
+					t.Errorf("the canonical guarded form recorded deprecations %v", deprecationCodes(g))
+				}
+			})
+		}
+	}
+}
+
+// `create or modify … if not exists` is recorded as such on every kind, so
+// check can refuse it (MDL067) — the two guards contradict each other.
+func TestCreateOrModifyIfNotExistsIsRecorded(t *testing.T) {
+	for name, body := range createOrReplaceCases {
+		if _, exempt := createIfNotExistsExempt[name]; exempt {
+			continue
+		}
+		t.Run(name, func(t *testing.T) {
+			prog := mustBuild(t, "create or modify "+withIfNotExists(t, body))
+			guard, ok := prog.Statements[0].(ast.IfNotExistsCreate)
+			if !ok {
+				t.Fatalf("built %T without the guard", prog.Statements[0])
+			}
+			if !guard.CreateGuardContradicts() {
+				t.Error("or modify + if not exists not recorded as contradicting")
+			}
+		})
+	}
+}
+
+// The exempt kinds refuse the guard at parse time rather than accepting and
+// ignoring it — an ignored guard is a plain create that fails, or worse
+// rewrites, on the second run.
+func TestCreateIfNotExistsRefusedOnExemptKinds(t *testing.T) {
+	for name := range createIfNotExistsExempt {
+		body, ok := createOrReplaceCases[name]
+		if !ok {
+			t.Errorf("exempt kind %q is not a create kind", name)
+			continue
+		}
+		t.Run(name, func(t *testing.T) {
+			src := "create " + strings.Replace(body, " ", " if not exists ", 1)
+			if _, errs := Build(src); len(errs) == 0 {
+				t.Errorf("%q parsed; an exempt kind must refuse `if not exists`", src)
+			}
+		})
+	}
+}
diff --git a/mdl/visitor/visitor_dbconnection.go b/mdl/visitor/visitor_dbconnection.go
index 8de82bc511..b6e9b0ffd7 100644
--- a/mdl/visitor/visitor_dbconnection.go
+++ b/mdl/visitor/visitor_dbconnection.go
@@ -3,6 +3,7 @@
 package visitor
 
 import (
+	"fmt"
 	"strconv"
 	"strings"
 
@@ -20,7 +21,10 @@ func (b *Builder) ExitCreateDatabaseConnectionStatement(ctx *parser.CreateDataba
 		stmt.Folder = unquoteStringLit(lit)
 	}
 
-	// Parse options
+	// Canonical form: ( Key: value, … ) { query Q ( … ) } (R2)
+	b.applyDatabaseConnectionProps(stmt, ctx)
+
+	// Old form: clauses and a begin … end block (MDL-DEPR127)
 	for _, optCtx := range ctx.AllDatabaseConnectionOption() {
 		opt := optCtx.(*parser.DatabaseConnectionOptionContext)
 
@@ -203,3 +207,148 @@ func unquoteDollarString(s string) string {
 	}
 	return s
 }
+
+// applyDatabaseConnectionProps reads the canonical database connection: its
+// properties in ( ) and its queries as { query Q ( … ) } children (R2,
+// ako/mxcli#754). The keys are those of the old clauses; they are new syntax,
+// so an unknown key or a value of the wrong kind is an error rather than
+// something to warn about and drop.
+func (b *Builder) applyDatabaseConnectionProps(stmt *ast.CreateDatabaseConnectionStmt, ctx *parser.CreateDatabaseConnectionStatementContext) {
+	seen := map[string]bool{}
+	for _, pc := range ctx.AllDatabaseConnectionProp() {
+		p := pc.(*parser.DatabaseConnectionPropContext)
+		key := identifierOrKeywordText(p.IdentifierOrKeyword())
+		line := p.GetStart().GetLine()
+		if seen[strings.ToLower(key)] {
+			b.addError(fmt.Errorf("line %d: database connection %s: %s is written twice", line, stmt.Name, key))
+			continue
+		}
+		seen[strings.ToLower(key)] = true
+		str, ref, num := p.STRING_LITERAL(), p.QualifiedName(), p.NUMBER_LITERAL()
+		refOrString := func(val *string, isRef *bool) {
+			switch {
+			case ref != nil:
+				*val, *isRef = buildQualifiedName(ref).String(), true
+			case str != nil:
+				*val = unquoteStringLit(str)
+			default:
+				b.addError(fmt.Errorf("line %d: database connection %s: %s takes a string or a constant (@Module.Constant)", line, stmt.Name, key))
+			}
+		}
+		onlyString := func(val *string) {
+			if str == nil {
+				b.addError(fmt.Errorf("line %d: database connection %s: %s takes a string", line, stmt.Name, key))
+				return
+			}
+			*val = unquoteStringLit(str)
+		}
+		switch strings.ToLower(key) {
+		case "type":
+			onlyString(&stmt.DatabaseType)
+		case "connectionstring":
+			refOrString(&stmt.ConnectionString, &stmt.ConnectionStringIsRef)
+		case "username":
+			refOrString(&stmt.UserName, &stmt.UserNameIsRef)
+		case "password":
+			refOrString(&stmt.Password, &stmt.PasswordIsRef)
+		case "host":
+			onlyString(&stmt.Host)
+		case "databasename":
+			onlyString(&stmt.Database)
+		case "port":
+			if num == nil {
+				b.addError(fmt.Errorf("line %d: database connection %s: Port takes a number", line, stmt.Name))
+				continue
+			}
+			stmt.Port, _ = strconv.Atoi(num.GetText())
+		default:
+			b.addError(fmt.Errorf("line %d: unknown property '%s' on database connection %s: the properties are "+
+				"Type, ConnectionString, Host, Port, DatabaseName, Username and Password", line, key, stmt.Name))
+		}
+	}
+
+	for _, qc := range ctx.AllDatabaseQueryDef() {
+		stmt.Queries = append(stmt.Queries, b.buildDatabaseQueryDef(stmt.Name, qc.(*parser.DatabaseQueryDefContext)))
+	}
+}
+
+// buildDatabaseQueryDef reads `query Q ( Sql: …, Parameters: ( … ), Returns:
+// M.E, Map: ( Attr = column ) )`.
+func (b *Builder) buildDatabaseQueryDef(conn ast.QualifiedName, qc *parser.DatabaseQueryDefContext) ast.DatabaseQueryDef {
+	q := ast.DatabaseQueryDef{Name: identifierOrKeywordText(qc.IdentifierOrKeyword())}
+	seen := map[string]bool{}
+	for _, pc := range qc.AllDatabaseQueryProp() {
+		p := pc.(*parser.DatabaseQueryPropContext)
+		key := identifierOrKeywordText(p.IdentifierOrKeyword())
+		line := p.GetStart().GetLine()
+		if seen[strings.ToLower(key)] {
+			b.addError(fmt.Errorf("line %d: query %s on database connection %s: %s is written twice", line, q.Name, conn, key))
+			continue
+		}
+		seen[strings.ToLower(key)] = true
+		wrong := func(want string) {
+			b.addError(fmt.Errorf("line %d: query %s on database connection %s: %s takes %s", line, q.Name, conn, key, want))
+		}
+		switch strings.ToLower(key) {
+		case "sql":
+			switch {
+			case p.DOLLAR_STRING() != nil:
+				q.SQL = unquoteDollarString(p.DOLLAR_STRING().GetText())
+			case p.STRING_LITERAL() != nil:
+				q.SQL = unquoteStringLit(p.STRING_LITERAL())
+			default:
+				wrong("the SQL, as $$…$$ or a string")
+			}
+		case "returns":
+			if p.QualifiedName() == nil {
+				wrong("an entity")
+				continue
+			}
+			q.Returns = buildQualifiedName(p.QualifiedName())
+		case "parameters":
+			if len(p.AllDatabaseQueryParam()) == 0 {
+				wrong("a parameter list, ( name: Type [default '…' | null], … )")
+				continue
+			}
+			for _, dc := range p.AllDatabaseQueryParam() {
+				d := dc.(*parser.DatabaseQueryParamContext)
+				param := ast.DatabaseQueryParamDef{Name: identifierOrKeywordText(d.IdentifierOrKeyword())}
+				if dt := d.DataType(); dt != nil {
+					param.DataType = buildDataType(dt)
+				}
+				switch {
+				case d.DEFAULT() != nil && d.STRING_LITERAL() != nil:
+					param.DefaultValue = unquoteStringLit(d.STRING_LITERAL())
+				case d.NULL() != nil:
+					param.TestWithNull = true
+				}
+				q.Parameters = append(q.Parameters, param)
+			}
+		case "map":
+			if len(p.AllDatabaseQueryColumn()) == 0 {
+				wrong("a column map, ( Attribute = column, … )")
+				continue
+			}
+			for _, mc := range p.AllDatabaseQueryColumn() {
+				m := mc.(*parser.DatabaseQueryColumnContext)
+				ioks := m.AllIdentifierOrKeyword()
+				if len(ioks) < 2 {
+					continue
+				}
+				q.Mappings = append(q.Mappings, ast.DatabaseQueryMappingDef{
+					ColumnName:    identifierOrKeywordText(ioks[1]),
+					AttributeName: identifierOrKeywordText(ioks[0]),
+				})
+			}
+		default:
+			b.addError(fmt.Errorf("line %d: unknown property '%s' on query %s of database connection %s: "+
+				"a query takes Sql, Parameters, Returns and Map", line, key, q.Name, conn))
+		}
+	}
+	// The old clause form could not omit the SQL; the property list must not
+	// either, or it writes a query with no statement to run.
+	if !seen["sql"] {
+		b.addError(fmt.Errorf("line %d: query %s on database connection %s has no Sql", qc.GetStart().GetLine(), q.Name, conn))
+	}
+	return q
+}
diff --git a/mdl/visitor/visitor_deprecations_test.go b/mdl/visitor/visitor_deprecations_test.go
index 7d11fba96b..bc35e9692f 100644
--- a/mdl/visitor/visitor_deprecations_test.go
+++ b/mdl/visitor/visitor_deprecations_test.go
@@ -80,7 +80,7 @@ var createOrReplaceCases = map[string]string{
 	"snippet":                     "snippet M.CustomerInfo { dynamictext t (Content: 'x') }",
 	"enumeration":                 "enumeration M.Color (Red 'Red');",
 	"validationrule":              "validation rule for M.Customer.Email regex M.EmailPattern error message 'Invalid';",
-	"databaseconnection":          "database connection M.Erp type 'PostgreSQL' connection string @M.DbUrl username @M.DbUser password @M.DbPass;",
+	"databaseconnection":          "database connection M.Erp (Type: 'PostgreSQL', ConnectionString: @M.DbUrl, Username: @M.DbUser, Password: @M.DbPass);",
 	"constant":                    "constant M.ApiBaseUrl type String default 'https://api.example.com';",
 	"restclient":                  "consumed rest service M.PetStore (BaseUrl: 'https://petstore.example.com', Authentication: NONE) { };",
 	"index":                       "index idx_name on M.Customer (Name);",
@@ -91,7 +91,7 @@ var createOrReplaceCases = map[string]string{
 	"navigation":                  "navigation Responsive home page M.Home_Web;",
 	"businesseventservice":        "business event service M.CustomerEventsApi (ServiceName: 'CustomerEventsApi', EventNamePrefix: '') { message CustomerChangedEvent (CustomerId: Long) publish entity M.PBE_CustomerChangedEvent; };",
 	"workflow":                    "workflow M.LeaveApproval parameter $Context: M.LeaveRequest begin end workflow;",
-	"userrole":                    "user role Clerk (M.User);",
+	"userrole":                    "user role Clerk ( ModuleRoles: (M.User) );",
 	"demouser":                    "demo user 'demo' password 'Password1!' (Clerk);",
 	"imagecollection":             "image collection M.AppIcons;",
 	"annotation":                  "annotation in M (Caption: 'Orders', Position: (60, 40));",
@@ -111,7 +111,7 @@ var createOrReplaceCases = map[string]string{
 	"agent":                       "agent M.Summarizer (UsageType: Task, Model: M.GPT4, SystemPrompt: 'Summarize.', UserPrompt: 'Text.');",
 	"nanoflow":                    "nanoflow M.NF_Validate () begin return; end;",
 	"rule":                        "rule M.Rule_IsSolvent ($c: M.Customer) returns Boolean begin return true; end;",
-	"menu":                        "menu M.Main_Menu (menu item 'Plain';);",
+	"menu":                        "menu M.Main_Menu { menu item 'Plain' };",
 	"translations":                "translations in Administration for nl_NL ('Save' as 'Opslaan');",
 }
 
diff --git a/mdl/visitor/visitor_document_annotations.go b/mdl/visitor/visitor_document_annotations.go
index a1b499ef2c..5ec8bcca70 100644
--- a/mdl/visitor/visitor_document_annotations.go
+++ b/mdl/visitor/visitor_document_annotations.go
@@ -29,6 +29,7 @@ func (b *Builder) ExitCreateStatement(ctx *parser.CreateStatementContext) {
 		return
 	}
 	b.recordCreateOrReplace(ctx)
+	b.applyCreateGuard(ctx)
 	anns := ctx.AllAnnotation()
 	if len(anns) == 0 {
 		return
diff --git a/mdl/visitor/visitor_entity.go b/mdl/visitor/visitor_entity.go
index 157042022c..ceb88e750c 100644
--- a/mdl/visitor/visitor_entity.go
+++ b/mdl/visitor/visitor_entity.go
@@ -20,9 +20,8 @@ func (b *Builder) ExitCreateEntityStatement(ctx *parser.CreateEntityStatementCon
 	}
 
 	stmt := &ast.CreateEntityStmt{
-		Name:        buildQualifiedName(ctx.QualifiedName()),
-		Kind:        ast.EntityPersistent, // Default
-		IfNotExists: ctx.IfNotExists() != nil,
+		Name: buildQualifiedName(ctx.QualifiedName()),
+		Kind: ast.EntityPersistent, // Default
 	}
 
 	// Entity type
diff --git a/mdl/visitor/visitor_imagecollection.go b/mdl/visitor/visitor_imagecollection.go
index 00bd69608b..79ba91f1b6 100644
--- a/mdl/visitor/visitor_imagecollection.go
+++ b/mdl/visitor/visitor_imagecollection.go
@@ -3,6 +3,7 @@
 package visitor
 
 import (
+	"encoding/base64"
 	"fmt"
 	"strings"
 
@@ -50,14 +51,49 @@ func (b *Builder) ExitCreateImageCollectionStatement(ctx *parser.CreateImageColl
 			hasFile := false
 			for _, p := range childCtx.AllImageProperty() {
 				pc := p.(*parser.ImagePropertyContext)
-				key := identifierOrKeywordText(pc.IdentifierOrKeyword())
-				if !strings.EqualFold(key, "File") {
-					b.addError(fmt.Errorf("line %d: unknown property '%s' on image %s: an image takes only File: '<path>'",
-						pc.GetStart().GetLine(), key, name))
-					continue
+				key := identifierOrKeywordText(pc.IdentifierOrKeyword(0))
+				line := pc.GetStart().GetLine()
+				// A string value, or a bare word (the Format's only shape).
+				str, isStr := "", pc.STRING_LITERAL() != nil
+				if isStr {
+					str = unquoteStringLit(pc.STRING_LITERAL())
+				} else if w := pc.IdentifierOrKeyword(1); w != nil {
+					str = identifierOrKeywordText(w)
 				}
-				item.FilePath = unquoteStringLit(pc.STRING_LITERAL())
-				hasFile = true
+				switch strings.ToLower(key) {
+				case "file":
+					if !isStr {
+						b.addError(fmt.Errorf("line %d: image %s: File takes a path in a string: File: '<path>'", line, name))
+						continue
+					}
+					item.FilePath = str
+					hasFile = true
+				case "data":
+					// The image itself, base64-encoded: what describe writes, so
+					// its output does not name a file it wrote (ako/mxcli#707).
+					data, err := base64.StdEncoding.DecodeString(str)
+					if !isStr || err != nil {
+						b.addError(fmt.Errorf("line %d: image %s: Data takes the image base64-encoded in a string", line, name))
+						continue
+					}
+					item.Data, item.HasData = data, true
+					hasFile = true
+				case "format":
+					f, ok := imageFormatName(str)
+					if !ok {
+						b.addError(fmt.Errorf("line %d: image %s: unknown Format '%s'; an image format is png, jpg, gif, svg, bmp or webp",
+							line, name, str))
+						continue
+					}
+					item.Format = f
+				default:
+					b.addError(fmt.Errorf("line %d: unknown property '%s' on image %s: an image takes File: '<path>', "+
+						"or Data: '<base64>' with an optional Format", line, key, name))
+				}
+			}
+			if item.FilePath != "" && item.HasData {
+				b.addError(fmt.Errorf("line %d: image %s has both File and Data; it takes one of them",
+					childCtx.GetStart().GetLine(), name))
 			}
 			if !hasFile {
 				b.addError(fmt.Errorf("line %d: image %s has no File: an image is `image %s ( File: '<path>' )`",
@@ -92,3 +128,23 @@ func imageNameText(ctx parser.IImageNameContext) string {
 	}
 	return name
 }
+
+// imageFormatName maps a written image format to the Mendix ImageFormat
+// value, in any letter case; `jpeg` is `jpg`.
+func imageFormatName(s string) (string, bool) {
+	switch strings.ToLower(s) {
+	case "png":
+		return "Png", true
+	case "jpg", "jpeg":
+		return "Jpg", true
+	case "gif":
+		return "Gif", true
+	case "svg":
+		return "Svg", true
+	case "bmp":
+		return "Bmp", true
+	case "webp":
+		return "Webp", true
+	}
+	return "", false
+}
diff --git a/mdl/visitor/visitor_menu.go b/mdl/visitor/visitor_menu.go
index dcb14830f5..79e294a08c 100644
--- a/mdl/visitor/visitor_menu.go
+++ b/mdl/visitor/visitor_menu.go
@@ -7,7 +7,7 @@ import (
 	"github.com/mendixlabs/mxcli/mdl/grammar/parser"
 )
 
-// ExitCreateMenuStatement handles CREATE [OR MODIFY] MENU Module.Name ( items ).
+// ExitCreateMenuStatement handles CREATE [OR MODIFY] MENU Module.Name { items } (old spelling: ( items )).
 //
 // The items reuse navMenuItemDef, the same rule CREATE NAVIGATION's MENU block
 // uses, so buildNavMenuItemDef is reused verbatim — a menu item is written the
@@ -26,8 +26,12 @@ func (b *Builder) ExitCreateMenuStatement(ctx *parser.CreateMenuStatementContext
 	if lit := ctx.STRING_LITERAL(); lit != nil {
 		stmt.Folder = unquoteStringLit(lit)
 	}
-	for _, itemCtx := range ctx.AllNavMenuItemDef() {
-		stmt.Items = append(stmt.Items, buildNavMenuItemDef(itemCtx))
+	items := ctx.AllNavMenuItemDef()
+	if ch, ok := ctx.NavMenuChildren().(*parser.NavMenuChildrenContext); ok && ch != nil {
+		items = ch.AllNavMenuItemDef()
+	}
+	for _, itemCtx := range items {
+		stmt.Items = append(stmt.Items, b.buildNavMenuItemDef(itemCtx))
 	}
 
 	if createStmt := findParentCreateStatement(ctx); createStmt != nil {
diff --git a/mdl/visitor/visitor_navigation.go b/mdl/visitor/visitor_navigation.go
index b9686cd6f4..6e647c25eb 100644
--- a/mdl/visitor/visitor_navigation.go
+++ b/mdl/visitor/visitor_navigation.go
@@ -3,6 +3,7 @@
 package visitor
 
 import (
+	"fmt"
 	"github.com/antlr4-go/antlr/v4"
 	"strconv"
 	"strings"
@@ -77,11 +78,18 @@ func (b *Builder) processNavigationClause(stmt *ast.AlterNavigationStmt, ctx *pa
 			qn := buildQualifiedName(names[0])
 			stmt.NotFoundPage = &qn
 		}
+	} else if ch, ok := ctx.NavMenuChildren().(*parser.NavMenuChildrenContext); ok && ch != nil {
+		// { navMenuItemDef* } — the profile's menu items as its children (R2)
+		stmt.HasMenuBlock = true
+		for _, itemCtx := range ch.AllNavMenuItemDef() {
+			item := b.buildNavMenuItemDef(itemCtx)
+			stmt.MenuItems = append(stmt.MenuItems, item)
+		}
 	} else if ctx.MENU_KW() != nil {
-		// MENU (navMenuItemDef*)
+		// MENU (navMenuItemDef*) — the old spelling (MDL-DEPR121)
 		stmt.HasMenuBlock = true
 		for _, itemCtx := range ctx.AllNavMenuItemDef() {
-			item := buildNavMenuItemDef(itemCtx)
+			item := b.buildNavMenuItemDef(itemCtx)
 			stmt.MenuItems = append(stmt.MenuItems, item)
 		}
 	} else if ctx.ON() != nil && ctx.SYNC() != nil && ctx.ERROR() != nil {
@@ -155,7 +163,12 @@ func buildNavSyncDef(ctx parser.INavSyncDefContext) ast.NavSyncDef {
 }
 
 // buildNavMenuItemDef recursively builds a NavMenuItemDef from the parse context.
-func buildNavMenuItemDef(ctx parser.INavMenuItemDefContext) ast.NavMenuItemDef {
+//
+// An item is read the same whichever spelling wrote it: the canonical
+// `menu item 'X' ( OnClick: show page M.P, Icon: … )` with sub-items in { },
+// or the old clauses `menu item 'X' page M.P icon …;` with sub-items in ( )
+// (R2, ako/mxcli#754). The two build the same item.
+func (b *Builder) buildNavMenuItemDef(ctx parser.INavMenuItemDefContext) ast.NavMenuItemDef {
 	c := ctx.(*parser.NavMenuItemDefContext)
 
 	caption := ""
@@ -165,10 +178,8 @@ func buildNavMenuItemDef(ctx parser.INavMenuItemDefContext) ast.NavMenuItemDef {
 
 	item := ast.NavMenuItemDef{Caption: caption}
 
-	// The PAGE/MICROFLOW target is the item's only qualifiedName now that the
-	// icon is its own sub-rule — which is what removed the old positional
-	// bookkeeping, where the target and the icon shared one indexed list and the
-	// icon was "whatever remains".
+	// Old spelling: the PAGE/MICROFLOW target is the item's only qualifiedName
+	// now that the icon is its own sub-rule.
 	if qn := c.QualifiedName(); qn != nil {
 		switch {
 		case c.PAGE() != nil:
@@ -184,17 +195,71 @@ func buildNavMenuItemDef(ctx parser.INavMenuItemDefContext) ast.NavMenuItemDef {
 	if c.SIGN_OUT() != nil {
 		item.SignOut = true
 	}
-	applyNavMenuIcon(&item, c.NavMenuIcon())
+	if ic, ok := c.NavMenuIcon().(*parser.NavMenuIconContext); ok && ic != nil {
+		applyNavMenuIcon(&item, ic.NavMenuIconValue())
+	}
 
-	// Recurse into sub-items (for MENU 'caption' (...))
-	for _, subCtx := range c.AllNavMenuItemDef() {
-		subItem := buildNavMenuItemDef(subCtx)
-		item.Items = append(item.Items, subItem)
+	// Canonical spelling: OnClick and Icon in the item's property list.
+	// The list is new syntax, so it is strict: a key written twice is an error
+	// rather than a silent first- or last-wins, and a sub-menu — which opens
+	// its items rather than acting — takes no OnClick (the old spelling had no
+	// way to write one, and describe never prints one).
+	if pc, ok := c.NavMenuItemProps().(*parser.NavMenuItemPropsContext); ok && pc != nil {
+		seen := map[string]bool{}
+		for _, p := range pc.AllNavMenuItemProp() {
+			prop := p.(*parser.NavMenuItemPropContext)
+			key := prop.GetStart().GetText()
+			line := prop.GetStart().GetLine()
+			if seen[strings.ToLower(key)] {
+				b.addError(fmt.Errorf("line %d: menu item '%s': %s is written twice", line, caption, key))
+				continue
+			}
+			seen[strings.ToLower(key)] = true
+			switch {
+			case prop.ONCLICK() != nil:
+				if c.NavMenuChildren() != nil {
+					b.addError(fmt.Errorf("line %d: menu '%s': a sub-menu has no OnClick — it opens its items; "+
+						"give the action to one of them", line, caption))
+					continue
+				}
+				applyNavMenuAction(&item, prop.NavMenuAction())
+			case prop.ICON() != nil:
+				applyNavMenuIcon(&item, prop.NavMenuIconValue())
+			}
+		}
+	}
+
+	// Sub-items: in { } (canonical) or directly in ( ) (old spelling).
+	subs := c.AllNavMenuItemDef()
+	if ch, ok := c.NavMenuChildren().(*parser.NavMenuChildrenContext); ok && ch != nil {
+		subs = ch.AllNavMenuItemDef()
+	}
+	for _, subCtx := range subs {
+		item.Items = append(item.Items, b.buildNavMenuItemDef(subCtx))
 	}
 
 	return item
 }
 
+// applyNavMenuAction reads a menu item's `OnClick:` action: `show page M.P`,
+// `call microflow M.F` or `sign out`.
+func applyNavMenuAction(item *ast.NavMenuItemDef, ctx parser.INavMenuActionContext) {
+	a, ok := ctx.(*parser.NavMenuActionContext)
+	if !ok || a == nil {
+		return
+	}
+	switch {
+	case a.SIGN_OUT() != nil:
+		item.SignOut = true
+	case a.PAGE() != nil && a.QualifiedName() != nil:
+		built := buildQualifiedName(a.QualifiedName())
+		item.Page = &built
+	case a.MICROFLOW() != nil && a.QualifiedName() != nil:
+		built := buildQualifiedName(a.QualifiedName())
+		item.Microflow = &built
+	}
+}
+
 // applyNavMenuIcon reads the ICON clause onto the item.
 //
 // Mendix stores three different icon ELEMENTS, not three spellings of one
@@ -206,12 +271,9 @@ func buildNavMenuItemDef(ctx parser.INavMenuItemDefContext) ast.NavMenuItemDef {
 //
 // The bare form is the collection icon, which keeps every existing script
 // meaning exactly what it did.
-func applyNavMenuIcon(item *ast.NavMenuItemDef, ctx parser.INavMenuIconContext) {
-	if ctx == nil {
-		return
-	}
-	c, ok := ctx.(*parser.NavMenuIconContext)
-	if !ok {
+func applyNavMenuIcon(item *ast.NavMenuItemDef, ctx parser.INavMenuIconValueContext) {
+	c, ok := ctx.(*parser.NavMenuIconValueContext)
+	if !ok || c == nil {
 		return
 	}
 	switch {
diff --git a/mdl/visitor/visitor_page_v3.go b/mdl/visitor/visitor_page_v3.go
index ca0edc5854..22bb61f3cb 100644
--- a/mdl/visitor/visitor_page_v3.go
+++ b/mdl/visitor/visitor_page_v3.go
@@ -97,12 +97,12 @@ func (b *Builder) parsePageHeaderV3(ctx parser.IPageHeaderV3Context, stmt *ast.C
 		prop := propCtx.(*parser.PageHeaderPropertyV3Context)
 
 		if prop.PARAMS() != nil {
-			// Params: { $Order: Entity, ... }
+			// Params: ( $Order: Entity, ... )
 			if paramList := prop.PageParameterList(); paramList != nil {
 				stmt.Parameters = buildPageParameters(paramList)
 			}
 		} else if prop.VARIABLES_KW() != nil {
-			// Variables: { $showStock: Boolean = 'true', ... }
+			// Variables: ( $showStock: Boolean = 'true', ... )
 			if varList := prop.VariableDeclarationList(); varList != nil {
 				stmt.Variables = buildVariableDeclarations(varList)
 			}
@@ -269,12 +269,12 @@ func (b *Builder) parseSnippetHeaderV3(ctx parser.ISnippetHeaderV3Context, stmt
 		prop := propCtx.(*parser.SnippetHeaderPropertyV3Context)
 
 		if prop.PARAMS() != nil {
-			// Params: { $Customer: Entity, ... }
+			// Params: ( $Customer: Entity, ... )
 			if paramList := prop.PageParameterList(); paramList != nil {
 				stmt.Parameters = buildPageParameters(paramList)
 			}
 		} else if prop.VARIABLES_KW() != nil {
-			// Variables: { $showStock: Boolean = 'true', ... }
+			// Variables: ( $showStock: Boolean = 'true', ... )
 			if varList := prop.VariableDeclarationList(); varList != nil {
 				stmt.Variables = buildVariableDeclarations(varList)
 			}
@@ -716,7 +716,7 @@ func parseWidgetPropertyV3(ctx parser.IWidgetPropertyV3Context, widget *ast.Widg
 		return
 	}
 
-	// ContentParams: [...]
+	// ContentParams: (...)
 	if propCtx.CONTENTPARAMS() != nil {
 		if plCtx := propCtx.ParamListV3(); plCtx != nil {
 			widget.Properties["ContentParams"] = buildParamListV3(plCtx)
@@ -724,7 +724,7 @@ func parseWidgetPropertyV3(ctx parser.IWidgetPropertyV3Context, widget *ast.Widg
 		return
 	}
 
-	// CaptionParams: [...]
+	// CaptionParams: (...)
 	if propCtx.CAPTIONPARAMS() != nil {
 		if plCtx := propCtx.ParamListV3(); plCtx != nil {
 			widget.Properties["CaptionParams"] = buildParamListV3(plCtx)
@@ -806,7 +806,7 @@ func parseWidgetPropertyV3(ctx parser.IWidgetPropertyV3Context, widget *ast.Widg
 		return
 	}
 
-	// Params: {$Asset: $var} — snippet call parameter mappings
+	// Params: (Asset = $var) — snippet call arguments
 	if propCtx.PARAMS() != nil {
 		if plCtx := propCtx.SnippetCallParamListV3(); plCtx != nil {
 			widget.Properties["Params"] = buildSnippetCallParamListV3(plCtx)
@@ -850,7 +850,7 @@ func parseWidgetPropertyV3(ctx parser.IWidgetPropertyV3Context, widget *ast.Widg
 		return
 	}
 
-	// DesignProperties: [...]
+	// DesignProperties: (...)
 	if propCtx.DESIGNPROPERTIES() != nil {
 		if dpCtx := propCtx.DesignPropertyListV3(); dpCtx != nil {
 			widget.Properties["DesignProperties"] = buildDesignPropertyListV3(dpCtx)
@@ -915,7 +915,7 @@ func parseWidgetPropertyV3(ctx parser.IWidgetPropertyV3Context, widget *ast.Widg
 			}
 			return
 		}
-		// `<Name>Params: [{1} = Attr]` — the parameters of a text-template
+		// `<Name>Params: ({1} = Attr)` — the parameters of a text-template
 		// sub-property whose name belongs to the WIDGET rather than to MDL (a
 		// File Uploader custom button's ButtonCaptionParams). ContentParams and
 		// CaptionParams have their own tokens and are handled above; every other
@@ -1918,8 +1918,21 @@ func xpathPathToString(path *ast.XPathPathExpr) string {
 
 // buildSnippetCallParamListV3 converts a parsed snippetCallParamListV3 context
 // into a slice of SnippetCallParam AST nodes.
+//
+// The canonical form binds `Param = $var` (R4) in ( ); the old brace map
+// `{$Param: $var}` / `{Param: $var}` builds the same params. The parameter name
+// is stored without its `$`, which the builder strips either way.
 func buildSnippetCallParamListV3(ctx parser.ISnippetCallParamListV3Context) []ast.SnippetCallParam {
 	var params []ast.SnippetCallParam
+	for _, argCtx := range ctx.AllSnippetCallArgV3() {
+		param := ast.SnippetCallParam{ParamName: parameterNameText(argCtx.ParameterName())}
+		if v := argCtx.VARIABLE(); v != nil {
+			param.Variable = v.GetText()
+		}
+		if param.ParamName != "" && param.Variable != "" {
+			params = append(params, param)
+		}
+	}
 	for _, mappingCtx := range ctx.AllSnippetCallParamMappingV3() {
 		param := ast.SnippetCallParam{}
 		if iok := mappingCtx.IdentifierOrKeyword(); iok != nil {
@@ -1932,7 +1945,7 @@ func buildSnippetCallParamListV3(ctx parser.ISnippetCallParamListV3Context) []as
 			// Param name written with $: $Asset: $someVar
 			vars := mappingCtx.AllVARIABLE()
 			if len(vars) >= 2 {
-				param.ParamName = vars[0].GetText()
+				param.ParamName = strings.TrimPrefix(vars[0].GetText(), "$")
 				param.Variable = vars[1].GetText()
 			}
 		}
diff --git a/mdl/visitor/visitor_r2_children.go b/mdl/visitor/visitor_r2_children.go
index 64faca7369..a1cdfcfa17 100644
--- a/mdl/visitor/visitor_r2_children.go
+++ b/mdl/visitor/visitor_r2_children.go
@@ -77,6 +77,7 @@ func (b *Builder) EnterStatement(ctx *parser.StatementContext) {
 				use(deprecation.MessageTreeParens, x.LPAREN().GetSymbol()).swap(x.LPAREN(), x.RPAREN(), "{", "}")
 			}
 		}
+		r2RestUse(n, use)
 		for _, c := range n.GetChildren() {
 			walk(c)
 		}
diff --git a/mdl/visitor/visitor_r2_rest.go b/mdl/visitor/visitor_r2_rest.go
new file mode 100644
index 0000000000..8b5f2b6c2b
--- /dev/null
+++ b/mdl/visitor/visitor_r2_rest.go
@@ -0,0 +1,318 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package visitor
+
+import (
+	"strings"
+
+	"github.com/antlr4-go/antlr/v4"
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
+	"github.com/mendixlabs/mxcli/mdl/grammar/parser"
+)
+
+// The rest of R2 (ako/mxcli#754), after the integration documents: the
+// navigation and menu documents, the property maps, and the database
+// connection.
+//
+//   - a REST header list binds `'Name' = value` where a map has `'Name': value`
+//     (MDL-DEPR120);
+//   - menu items are in ( ) with `;` after each, where children are in { }
+//     (MDL-DEPR121), and an item's action and icon are clauses after its
+//     caption rather than `( OnClick: …, Icon: … )` (MDL-DEPR122);
+//   - the page and snippet header's `Params:` / `Variables:` maps are in
+//     braces (MDL-DEPR123), a text template's parameters in brackets
+//     (MDL-DEPR124), `DesignProperties:` in brackets (MDL-DEPR125), and a
+//     snippet call's arguments are a brace map `{$P: $v}` (MDL-DEPR126);
+//   - the database connection is clauses and a begin … end block of queries
+//     (MDL-DEPR127).
+//
+// r2RestUse is called for every node of the statement by EnterStatement's
+// walk, which records each code once per statement.
+func r2RestUse(n antlr.Tree, use func(code string, at antlr.Token) *r2Use) {
+	switch x := n.(type) {
+	case *parser.RestClientHeaderItemContext:
+		if eq := x.EQUALS(); eq != nil && len(x.AllSTRING_LITERAL()) > 0 {
+			name := x.STRING_LITERAL(0).GetSymbol()
+			u := use(deprecation.RestHeaderEquals, eq.GetSymbol())
+			u.edits = append(u.edits, replaceGap(name.GetStop(), eq.GetSymbol().GetStop()+1, ":"))
+		}
+	case *parser.NavigationClauseContext:
+		if x.MENU_KW() != nil && x.LPAREN() != nil && x.RPAREN() != nil {
+			u := use(deprecation.MenuChildrenParens, x.LPAREN().GetSymbol())
+			u.edits = append(u.edits,
+				replaceSpan(x.MENU_KW().GetSymbol(), x.LPAREN().GetSymbol(), "{"),
+				replaceSpan(x.RPAREN().GetSymbol(), x.RPAREN().GetSymbol(), "}"))
+		}
+	case *parser.CreateMenuStatementContext:
+		if x.LPAREN() != nil && x.RPAREN() != nil {
+			use(deprecation.MenuChildrenParens, x.LPAREN().GetSymbol()).swap(x.LPAREN(), x.RPAREN(), "{", "}")
+		}
+	case *parser.NavMenuItemDefContext:
+		if x.LPAREN() != nil && x.RPAREN() != nil {
+			use(deprecation.MenuChildrenParens, x.LPAREN().GetSymbol()).swap(x.LPAREN(), x.RPAREN(), "{", "}")
+		}
+		if semi := x.SEMICOLON(); semi != nil {
+			u := use(deprecation.MenuChildrenParens, semi.GetSymbol())
+			u.edits = append(u.edits, replaceSpan(semi.GetSymbol(), semi.GetSymbol(), ""))
+		}
+		if first := menuItemClauseStart(x); first != nil {
+			use(deprecation.MenuItemClauses, first).menuItemClauses(x)
+		}
+	case *parser.PageHeaderPropertyV3Context:
+		if x.LBRACE() != nil && x.RBRACE() != nil {
+			use(deprecation.HeaderMapBraces, x.LBRACE().GetSymbol()).swap(x.LBRACE(), x.RBRACE(), "(", ")")
+		}
+	case *parser.SnippetHeaderPropertyV3Context:
+		if x.LBRACE() != nil && x.RBRACE() != nil {
+			use(deprecation.HeaderMapBraces, x.LBRACE().GetSymbol()).swap(x.LBRACE(), x.RBRACE(), "(", ")")
+		}
+	case *parser.ParamListV3Context:
+		if x.LBRACKET() != nil && x.RBRACKET() != nil {
+			use(deprecation.TemplateParamsBrackets, x.LBRACKET().GetSymbol()).swap(x.LBRACKET(), x.RBRACKET(), "(", ")")
+		}
+	case *parser.DesignPropertyListV3Context:
+		if x.LBRACKET() != nil && x.RBRACKET() != nil {
+			use(deprecation.DesignPropertiesBrackets, x.LBRACKET().GetSymbol()).swap(x.LBRACKET(), x.RBRACKET(), "(", ")")
+		}
+	case *parser.SnippetCallParamListV3Context:
+		if x.LBRACE() != nil && x.RBRACE() != nil {
+			use(deprecation.SnippetCallParamsBraces, x.LBRACE().GetSymbol()).snippetCallArgs(x)
+		}
+	case *parser.CreateDatabaseConnectionStatementContext:
+		if opts := x.AllDatabaseConnectionOption(); len(opts) > 0 {
+			use(deprecation.DatabaseConnectionClauses, opts[0].GetStart()).databaseConnection(x)
+		}
+	}
+}
+
+// menuItemClauseStart is the first token of a menu item's action or icon
+// clause — `page`, `microflow`, `sign out` or `icon` — or nil when it has none.
+func menuItemClauseStart(x *parser.NavMenuItemDefContext) antlr.Token {
+	for _, t := range []antlr.TerminalNode{x.PAGE(), x.MICROFLOW(), x.SIGN_OUT()} {
+		if t != nil {
+			return t.GetSymbol()
+		}
+	}
+	if ic := x.NavMenuIcon(); ic != nil {
+		return ic.GetStart()
+	}
+	return nil
+}
+
+// menuItemClauses rewrites `menu item 'X' page M.P icon I` as
+// `menu item 'X' ( OnClick: show page M.P, Icon: I )`, and a sub-menu's
+// `menu 'X' icon I (` as `menu 'X' ( Icon: I ) (` (the parentheses around
+// its items are MDL-DEPR121's). Only the clause words are replaced, so the
+// target and the icon stay as written.
+func (u *r2Use) menuItemClauses(x *parser.NavMenuItemDefContext) {
+	like := x.MENU_KW().GetText()
+	var last antlr.Token
+	switch {
+	case x.PAGE() != nil && x.QualifiedName() != nil:
+		t := x.PAGE().GetSymbol()
+		u.edits = append(u.edits, replaceSpan(t, t, "( OnClick: "+keywordLike(like, "show page")))
+		last = x.QualifiedName().GetStop()
+	case x.MICROFLOW() != nil && x.QualifiedName() != nil:
+		t := x.MICROFLOW().GetSymbol()
+		u.edits = append(u.edits, replaceSpan(t, t, "( OnClick: "+keywordLike(like, "call microflow")))
+		last = x.QualifiedName().GetStop()
+	case x.SIGN_OUT() != nil:
+		// Inserted before the word rather than replacing it: `sign_out` has
+		// MDL-DEPR020's own rewrite of that token.
+		t := x.SIGN_OUT().GetSymbol()
+		u.edits = append(u.edits, insertAt(t.GetStart(), "( OnClick: "))
+		last = t
+	}
+	if ic, ok := x.NavMenuIcon().(*parser.NavMenuIconContext); ok && ic != nil {
+		t := ic.ICON().GetSymbol()
+		if last != nil {
+			u.edits = append(u.edits, insertAt(last.GetStop()+1, ","), replaceSpan(t, t, "Icon:"))
+		} else {
+			u.edits = append(u.edits, replaceSpan(t, t, "( Icon:"))
+		}
+		last = ic.GetStop()
+	}
+	if last != nil {
+		u.edits = append(u.edits, insertAt(last.GetStop()+1, " )"))
+	}
+}
+
+// snippetCallArgs rewrites a snippet call's `{$Asset: $var, Other: $o}` as
+// `(Asset = $var, Other = $o)`: a call binds its arguments `Param = value`,
+// without a `$` on the parameter's name (R4).
+func (u *r2Use) snippetCallArgs(x *parser.SnippetCallParamListV3Context) {
+	u.swap(x.LBRACE(), x.RBRACE(), "(", ")")
+	for _, mc := range x.AllSnippetCallParamMappingV3() {
+		m, ok := mc.(*parser.SnippetCallParamMappingV3Context)
+		if !ok || m.COLON() == nil {
+			continue
+		}
+		var name antlr.Token
+		if iok := m.IdentifierOrKeyword(); iok != nil {
+			name = iok.GetStop()
+		} else if vars := m.AllVARIABLE(); len(vars) >= 2 {
+			name = vars[0].GetSymbol()
+			u.edits = append(u.edits, replaceSpan(name, name, strings.TrimPrefix(name.GetText(), "$")))
+		}
+		if name == nil {
+			continue
+		}
+		u.edits = append(u.edits, replaceGap(name.GetStop(), m.COLON().GetSymbol().GetStop()+1, " ="))
+	}
+}
+
+// databaseConnection rewrites the clause form of a database connection,
+//
+//	type 'PostgreSQL' connection string @M.Url username @M.U password @M.P
+//	begin
+//	  query Q sql $$…$$ parameter p: Integer default '1' returns M.E map (c as A);
+//	end
+//
+// as its property list and query children:
+//
+//	( Type: 'PostgreSQL', ConnectionString: @M.Url, Username: @M.U, Password: @M.P )
+//	{
+//	  query Q ( Sql: $$…$$, Parameters: ( p: Integer default '1' ), Returns: M.E, Map: ( A = c ) )
+//	}
+//
+// Only the clause words are replaced and punctuation inserted: every value —
+// the strings, the SQL, the constants — stays where it is, as written.
+func (u *r2Use) databaseConnection(x *parser.CreateDatabaseConnectionStatementContext) {
+	opts := x.AllDatabaseConnectionOption()
+	for i, oc := range opts {
+		o := oc.(*parser.DatabaseConnectionOptionContext)
+		key, keyEnd := databaseConnectionKey(o)
+		if key == "" {
+			continue
+		}
+		if i == 0 {
+			// The list opens after the name (or folder), before the clauses'
+			// line break: `M.Db (` rather than `M.Db\n  ( Type:`.
+			if prev := childTokenBefore(x, o); prev != nil {
+				u.edits = append(u.edits, insertAt(prev.GetStop()+1, " ("))
+			}
+		}
+		u.edits = append(u.edits, replaceSpan(o.GetStart(), keyEnd, key+":"))
+		closing := ","
+		if i == len(opts)-1 {
+			closing = " )"
+		}
+		u.edits = append(u.edits, insertAt(o.GetStop().GetStop()+1, closing))
+	}
+	if x.BEGIN() != nil && x.END() != nil {
+		u.swap(x.BEGIN(), x.END(), "{", "}")
+	}
+	for _, qc := range x.AllDatabaseQuery() {
+		u.databaseQuery(qc.(*parser.DatabaseQueryContext))
+	}
+}
+
+// databaseConnectionKey is the property key of an old connection clause, and
+// the last token of the clause's words (`connection string` is two).
+func databaseConnectionKey(o *parser.DatabaseConnectionOptionContext) (string, antlr.Token) {
+	switch {
+	case o.TYPE() != nil:
+		return "Type", o.TYPE().GetSymbol()
+	case o.CONNECTION() != nil && o.STRING_TYPE() != nil:
+		return "ConnectionString", o.STRING_TYPE().GetSymbol()
+	case o.HOST() != nil:
+		return "Host", o.HOST().GetSymbol()
+	case o.PORT() != nil:
+		return "Port", o.PORT().GetSymbol()
+	case o.DATABASE() != nil:
+		return "DatabaseName", o.DATABASE().GetSymbol()
+	case o.USERNAME() != nil:
+		return "Username", o.USERNAME().GetSymbol()
+	case o.PASSWORD() != nil:
+		return "Password", o.PASSWORD().GetSymbol()
+	}
+	return "", nil
+}
+
+// databaseQuery rewrites one `query Q sql … parameter … returns M.E map (…);`
+// as `query Q ( Sql: …, Parameters: ( … ), Returns: M.E, Map: ( … ) )`.
+func (u *r2Use) databaseQuery(q *parser.DatabaseQueryContext) {
+	children := q.GetChildren()
+	// last is the last token before child i; next the first token of child i.
+	last := func(i int) antlr.Token {
+		for j := i - 1; j >= 0; j-- {
+			switch n := children[j].(type) {
+			case antlr.TerminalNode:
+				return n.GetSymbol()
+			case antlr.ParserRuleContext:
+				return n.GetStop()
+			}
+		}
+		return nil
+	}
+	inParams := false
+	for i, c := range children {
+		tn, ok := c.(antlr.TerminalNode)
+		if !ok {
+			continue
+		}
+		tok := tn.GetSymbol()
+		switch tok.GetTokenType() {
+		case parser.MDLParserSQL:
+			u.edits = append(u.edits, insertAt(last(i).GetStop()+1, " ("), replaceSpan(tok, tok, "Sql:"))
+		case parser.MDLParserPARAMETER:
+			prev := last(i)
+			if !inParams {
+				u.edits = append(u.edits, insertAt(prev.GetStop()+1, ","), replaceSpan(tok, tok, "Parameters: ("))
+				inParams = true
+				continue
+			}
+			// A later parameter: a comma after the one before, and the word
+			// dropped with the space after it.
+			stop := tok.GetStop() + 1
+			if i+1 < len(children) {
+				if pr, ok := children[i+1].(antlr.ParserRuleContext); ok && pr.GetStart() != nil {
+					stop = pr.GetStart().GetStart()
+				}
+			}
+			u.edits = append(u.edits, insertAt(prev.GetStop()+1, ","),
+				ast.TextEdit{Start: tok.GetStart(), Stop: stop})
+		case parser.MDLParserRETURNS, parser.MDLParserSEMICOLON:
+			prev := last(i)
+			if inParams {
+				u.edits = append(u.edits, insertAt(prev.GetStop()+1, " )"))
+				inParams = false
+			}
+			if tok.GetTokenType() == parser.MDLParserRETURNS {
+				u.edits = append(u.edits, insertAt(prev.GetStop()+1, ","), replaceSpan(tok, tok, "Returns:"))
+			} else {
+				u.edits = append(u.edits, replaceSpan(tok, tok, padWord(tok, ")")))
+			}
+		case parser.MDLParserMAP:
+			u.edits = append(u.edits, insertAt(last(i).GetStop()+1, ","), replaceSpan(tok, tok, "Map:"))
+		}
+	}
+	for _, mc := range q.AllDatabaseQueryMapping() {
+		mm := mc.(*parser.DatabaseQueryMappingContext)
+		ioks := mm.AllIdentifierOrKeyword()
+		if len(ioks) < 2 {
+			continue
+		}
+		// `column as Attr` binds Attr = column, the way a mapping side does.
+		u.edits = append(u.edits, replaceSpan(mm.GetStart(), mm.GetStop(),
+			nodeText(ioks[1])+" = "+nodeText(ioks[0])))
+	}
+}
+
+// childTokenBefore is the last token of the child of parent that precedes child.
+func childTokenBefore(parent antlr.ParserRuleContext, child antlr.Tree) antlr.Token {
+	var prev antlr.Token
+	for _, c := range parent.GetChildren() {
+		if c == child {
+			return prev
+		}
+		switch n := c.(type) {
+		case antlr.TerminalNode:
+			prev = n.GetSymbol()
+		case antlr.ParserRuleContext:
+			prev = n.GetStop()
+		}
+	}
+	return nil
+}
diff --git a/mdl/visitor/visitor_r8_spellings.go b/mdl/visitor/visitor_r8_spellings.go
index bd7e1a0feb..63ce095ceb 100644
--- a/mdl/visitor/visitor_r8_spellings.go
+++ b/mdl/visitor/visitor_r8_spellings.go
@@ -79,6 +79,11 @@ func (b *Builder) ExitNavMenuItemDef(ctx *parser.NavMenuItemDefContext) {
 	b.recordSnakeWord(ctx.SIGN_OUT())
 }
 
+// ExitNavMenuAction reports `OnClick: sign_out` on a menu item.
+func (b *Builder) ExitNavMenuAction(ctx *parser.NavMenuActionContext) {
+	b.recordSnakeWord(ctx.SIGN_OUT())
+}
+
 // errorMessageWord is the canonical spelling of the message keyword, in the
 // letter case of the spelling it replaces.
 func errorMessageWord(like string) string { return keywordLike(like, "error message") }
diff --git a/mdl/visitor/visitor_rest.go b/mdl/visitor/visitor_rest.go
index 1805339fcc..c092688a24 100644
--- a/mdl/visitor/visitor_rest.go
+++ b/mdl/visitor/visitor_rest.go
@@ -7,6 +7,7 @@ import (
 	"strings"
 
 	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
 	"github.com/mendixlabs/mxcli/mdl/grammar/parser"
 )
 
@@ -256,7 +257,7 @@ func parseRestClientOpProp(ctx *parser.RestClientOpPropContext, op *ast.RestOper
 		return
 	}
 
-	// Header list: ('Name' = 'Value', ...)
+	// Header list: ('Name': 'Value', ...) — or the old ('Name' = 'Value')
 	headerItems := ctx.AllRestClientHeaderItem()
 	if len(headerItems) > 0 {
 		for _, hi := range headerItems {
@@ -266,16 +267,14 @@ func parseRestClientOpProp(ctx *parser.RestClientOpPropContext, op *ast.RestOper
 			if len(allSL) >= 1 {
 				header.Name = unquoteStringLit(allSL[0])
 			}
-			if hic.PLUS() != nil {
-				// 'prefix' + $Variable
+			if v := hic.VARIABLE(); v != nil {
+				// `'prefix' + $P` / `$P` (MDL-DEPR711): the template
+				// `'prefix{P}'`. It used to store the prefix alone.
+				prefix := ""
 				if len(allSL) >= 2 {
-					header.Prefix = unquoteStringLit(allSL[1])
+					prefix = unquoteStringLit(allSL[1])
 				}
-				if v := hic.VARIABLE(); v != nil {
-					header.Variable = v.GetText()
-				}
-			} else if hic.VARIABLE() != nil {
-				header.Variable = hic.VARIABLE().GetText()
+				header.Value = prefix + "{" + strings.TrimPrefix(v.GetText(), "$") + "}"
 			} else if len(allSL) >= 2 {
 				header.Value = unquoteStringLit(allSL[1])
 			}
@@ -525,3 +524,44 @@ func (b *Builder) exitAlterPublishedRestServiceStatement(ctx *parser.AlterStatem
 
 	b.statements = append(b.statements, stmt)
 }
+
+// ExitRestClientHeaderItem records the expression form of a header value,
+// `'prefix' + $P` or `$P` (MDL-DEPR711).
+func (b *Builder) ExitRestClientHeaderItem(ctx *parser.RestClientHeaderItemContext) {
+	v := ctx.VARIABLE()
+	if v == nil {
+		return
+	}
+	prefix := ""
+	if sl := ctx.AllSTRING_LITERAL(); len(sl) >= 2 {
+		prefix = unquoteStringLit(sl[1])
+	}
+	b.recordDeprecation(deprecation.RestHeaderConcat, v.GetSymbol(), "")
+	fix, why := restHeaderConcatFix(ctx, prefix)
+	b.fixLastDeprecation(deprecation.RestHeaderConcat, fix, why)
+}
+
+// restHeaderConcatFix rewrites a header value written `'prefix' + $P` or `$P`
+// as the template `'prefix{P}'` (MDL-DEPR711). It returns the fix, or the
+// reason there is none: a prefix holding a brace, which the template would read
+// as a placeholder, or a backslash escape whose meaning depends on the version.
+func restHeaderConcatFix(hic *parser.RestClientHeaderItemContext, prefix string) (*ast.Fix, string) {
+	if strings.ContainsAny(prefix, "{}") {
+		return nil, "the text before `+` holds a brace, which a header template reads as a placeholder; write the value by hand"
+	}
+	allSL := hic.AllSTRING_LITERAL()
+	v := hic.VARIABLE().GetSymbol()
+	name := strings.TrimPrefix(v.GetText(), "$")
+	if len(allSL) < 2 {
+		// `'X-Key' = $Key` -> `'X-Key' = '{Key}'`
+		return &ast.Fix{Edits: []ast.TextEdit{replaceSpan(v, v, "'{"+name+"}'")}}, ""
+	}
+	lit := allSL[1]
+	if holdsInterpretedEscape(lit) {
+		return nil, "the text before `+` holds a backslash escape; write the value by hand"
+	}
+	// `'Bearer ' + $Token` -> `'Bearer {Token}'`: the literal keeps its text
+	// and its escapes, and the placeholder goes before its closing quote.
+	raw := lit.GetText()
+	return &ast.Fix{Edits: []ast.TextEdit{replaceSpan(lit.GetSymbol(), v, raw[:len(raw)-1]+"{"+name+"}'")}}, ""
+}
diff --git a/mdl/visitor/visitor_security.go b/mdl/visitor/visitor_security.go
index 6cac255ea9..01283b7b44 100644
--- a/mdl/visitor/visitor_security.go
+++ b/mdl/visitor/visitor_security.go
@@ -3,8 +3,13 @@
 package visitor
 
 import (
+	"fmt"
+	"strings"
+
 	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/deprecation"
 	"github.com/mendixlabs/mxcli/mdl/grammar/parser"
+	"github.com/mendixlabs/mxcli/mdl/suggest"
 )
 
 // ExitCreateModuleRoleStatement handles CREATE [OR MODIFY] MODULE ROLE Module.RoleName [DESCRIPTION '...']
@@ -45,8 +50,10 @@ func (b *Builder) ExitCreateUserRoleStatement(ctx *parser.CreateUserRoleStatemen
 	}
 
 	stmt := &ast.CreateUserRoleStmt{
-		Name:           identifierOrKeywordText(iok),
-		ManageAllRoles: ctx.MANAGE() != nil,
+		Name: identifierOrKeywordText(iok),
+	}
+	if ctx.MANAGE() != nil {
+		stmt.ManageAllRoles, stmt.ManageAllRolesSet = true, true
 	}
 
 	// Check parent createStatement for OR MODIFY
@@ -58,14 +65,113 @@ func (b *Builder) ExitCreateUserRoleStatement(ctx *parser.CreateUserRoleStatemen
 	}
 
 	if mrl := ctx.ModuleRoleList(); mrl != nil {
+		// The positional form (MDL-DEPR710).
 		for _, qn := range mrl.AllQualifiedName() {
 			stmt.ModuleRoles = append(stmt.ModuleRoles, buildQualifiedName(qn))
 		}
+		b.recordDeprecation(deprecation.UserRolePositional, ctx.LPAREN().GetSymbol(), "")
+		b.fixLastDeprecation(deprecation.UserRolePositional, userRolePositionalFix(ctx), "")
+	}
+	if pl, ok := ctx.UserRolePropertyList().(*parser.UserRolePropertyListContext); ok && pl != nil {
+		for _, p := range pl.AllUserRoleProperty() {
+			if pc, ok := p.(*parser.UserRolePropertyContext); ok && pc != nil {
+				b.userRoleProperty(stmt, pc)
+			}
+		}
 	}
 
 	b.statements = append(b.statements, stmt)
 }
 
+// userRoleProperty reads one `Key: value` of a user role's property list. The
+// list is new syntax, so an unknown key or a value of the wrong shape is an
+// error under every language version: there is no older reading to keep.
+func (b *Builder) userRoleProperty(stmt *ast.CreateUserRoleStmt, pc *parser.UserRolePropertyContext) {
+	key := identifierOrKeywordText(pc.IdentifierOrKeyword())
+	line := pc.GetStart().GetLine()
+	isList := pc.LPAREN() != nil
+	var list []ast.QualifiedName
+	for _, qn := range pc.AllQualifiedName() {
+		list = append(list, buildQualifiedName(qn))
+	}
+	var str *string
+	if sl := pc.STRING_LITERAL(); sl != nil {
+		s := unquoteStringLit(sl)
+		str = &s
+	}
+	var boolean *bool
+	if bl := pc.BooleanLiteral(); bl != nil {
+		v := strings.EqualFold(bl.GetText(), "true")
+		boolean = &v
+	}
+	wrong := func(takes string) {
+		b.addError(fmt.Errorf("line %d: user role property '%s' takes %s", line, key, takes))
+	}
+	switch strings.ToLower(key) {
+	case "moduleroles":
+		if !isList {
+			wrong("a list of module roles: ModuleRoles: (Module.Role, …)")
+			return
+		}
+		stmt.ModuleRoles = append(stmt.ModuleRoles, list...)
+	case "manageableroles":
+		if !isList {
+			wrong("a list of user roles: ManageableRoles: (UserRole, …)")
+			return
+		}
+		stmt.ManageableSet = true
+		stmt.ManageableRoles = []string{}
+		for _, qn := range list {
+			stmt.ManageableRoles = append(stmt.ManageableRoles, qn.String())
+		}
+	case "description":
+		if str == nil {
+			wrong("a string: Description: '…'")
+			return
+		}
+		stmt.Description = str
+	case "manageallroles":
+		if boolean == nil {
+			wrong("true or false")
+			return
+		}
+		stmt.ManageAllRoles, stmt.ManageAllRolesSet = *boolean, true
+	case "manageuserswithoutroles":
+		if boolean == nil {
+			wrong("true or false")
+			return
+		}
+		stmt.ManageUsersWithoutRoles = boolean
+	case "checksecurity":
+		if boolean == nil {
+			wrong("true or false")
+			return
+		}
+		stmt.CheckSecurity = boolean
+	default:
+		known := []string{"ModuleRoles", "Description", "ManageAllRoles", "ManageableRoles", "ManageUsersWithoutRoles", "CheckSecurity"}
+		detail := fmt.Sprintf("line %d: unknown user role property '%s'", line, key)
+		if near := suggest.Closest(key, known); near != "" {
+			detail += fmt.Sprintf(" — did you mean '%s'?", near)
+		}
+		b.addError(fmt.Errorf("%s Known properties: %s", detail, strings.Join(known, ", ")))
+	}
+}
+
+// userRolePositionalFix rewrites `(M.A, M.B) manage all roles` as
+// `( ModuleRoles: (M.A, M.B), ManageAllRoles: true )`. The role list's text is
+// kept as written.
+func userRolePositionalFix(ctx *parser.CreateUserRoleStatementContext) *ast.Fix {
+	lp, rp := ctx.LPAREN().GetSymbol(), ctx.RPAREN().GetSymbol()
+	props := "ModuleRoles: (" + nodeText(ctx.ModuleRoleList()) + ")"
+	last := rp
+	if ctx.MANAGE() != nil {
+		props += ", ManageAllRoles: true"
+		last = ctx.ROLES().GetSymbol()
+	}
+	return &ast.Fix{Edits: []ast.TextEdit{replaceSpan(lp, last, "( "+props+" )")}}
+}
+
 // ExitAlterUserRoleStatement handles ALTER USER ROLE Name ADD/REMOVE MODULE ROLES (...)
 func (b *Builder) ExitAlterUserRoleStatement(ctx *parser.AlterUserRoleStatementContext) {
 	iok := ctx.IdentifierOrKeyword()
diff --git a/mdl/visitor/visitor_snippetcall_params_test.go b/mdl/visitor/visitor_snippetcall_params_test.go
index 51010cc6a8..e5ce06488f 100644
--- a/mdl/visitor/visitor_snippetcall_params_test.go
+++ b/mdl/visitor/visitor_snippetcall_params_test.go
@@ -31,8 +31,10 @@ func TestSnippetCallParams_DollarPrefix(t *testing.T) {
 	if len(params) != 1 {
 		t.Fatalf("GetSnippetParams: want 1, got %d", len(params))
 	}
-	if params[0].ParamName != "$Asset" {
-		t.Errorf("ParamName: want $Asset, got %q", params[0].ParamName)
+	// The name is stored without its `$` (the builder strips it either way),
+	// so the old brace map builds what the canonical (Asset = $theAsset) does.
+	if params[0].ParamName != "Asset" {
+		t.Errorf("ParamName: want Asset, got %q", params[0].ParamName)
 	}
 	if params[0].Variable != "$theAsset" {
 		t.Errorf("Variable: want $theAsset, got %q", params[0].Variable)
diff --git a/mdl/visitor/visitor_workflow.go b/mdl/visitor/visitor_workflow.go
index 4e6b918ef0..f711e869fd 100644
--- a/mdl/visitor/visitor_workflow.go
+++ b/mdl/visitor/visitor_workflow.go
@@ -3,6 +3,7 @@
 package visitor
 
 import (
+	"fmt"
 	"strconv"
 	"strings"
 
@@ -76,6 +77,10 @@ func (b *Builder) ExitCreateWorkflowStatement(ctx *parser.CreateWorkflowStatemen
 			}
 		case hc.DUE() != nil && hc.DATE_TYPE() != nil:
 			stmt.DueDate = workflowExpressionText(hc.GetDueDate())
+		case hc.ANNOTATION() != nil:
+			if tok := hc.GetAnnotationText(); tok != nil {
+				stmt.Annotation = unquoteStringLit(tok)
+			}
 		case hc.WorkflowEventHandlerClause() != nil:
 			h, ok := hc.WorkflowEventHandlerClause().(*parser.WorkflowEventHandlerClauseContext)
 			if !ok {
@@ -130,12 +135,18 @@ func (b *Builder) exitAlterWorkflowStatement(ctx *parser.AlterStatementContext)
 	// included, so the at-most-once rule has to be applied here as well.
 	b.checkWorkflowClausesAtMostOnce(ctx)
 
+	// The generic block (ako/mxcli#712), or the old per-action form, whose
+	// every action is a registered alias of a generic operation.
+	for _, opCtx := range ctx.AllAlterWorkflowOperation() {
+		stmt.Operations = append(stmt.Operations, b.buildAlterWorkflowOperation(opCtx.(*parser.AlterWorkflowOperationContext))...)
+	}
 	for _, actionCtx := range ctx.AllAlterWorkflowAction() {
 		op := buildAlterWorkflowAction(actionCtx.(*parser.AlterWorkflowActionContext))
 		if op != nil {
 			stmt.Operations = append(stmt.Operations, op)
 		}
 	}
+	b.recordOldAlterWorkflowActions(ctx)
 
 	b.statements = append(b.statements, stmt)
 }
@@ -167,9 +178,9 @@ func buildAlterWorkflowAction(ctx *parser.AlterWorkflowActionContext) ast.AlterW
 			return nil
 		}
 		return &ast.InsertAfterOp{
-			ActivityRef: ref,
-			AtPosition:  atPos,
-			NewActivity: act,
+			ActivityRef:   ref,
+			AtPosition:    atPos,
+			NewActivities: []ast.WorkflowActivityNode{act},
 		}
 	}
 
@@ -196,9 +207,9 @@ func buildAlterWorkflowAction(ctx *parser.AlterWorkflowActionContext) ast.AlterW
 			return nil
 		}
 		return &ast.ReplaceActivityOp{
-			ActivityRef: ref,
-			AtPosition:  atPos,
-			NewActivity: act,
+			ActivityRef:   ref,
+			AtPosition:    atPos,
+			NewActivities: []ast.WorkflowActivityNode{act},
 		}
 	}
 
@@ -480,7 +491,68 @@ func buildWorkflowActivityStmt(ctx parser.IWorkflowActivityStmtContext) ast.Work
 		return nil
 	}
 	actCtx := ctx.(*parser.WorkflowActivityStmtContext)
+	act := buildWorkflowActivityCore(actCtx)
+	if a, ok := act.(ast.AnnotatedWorkflowActivity); ok {
+		a.SetActivityAnnotation(workflowAttachedAnnotation(actCtx.AllAnnotation()))
+	}
+	return act
+}
+
+// workflowAttachedAnnotation is the text of the `@annotation '…'` before a
+// workflow activity or event sub-process, "" when there is none. The listener
+// ExitWorkflowActivityStmt reports any other annotation.
+func workflowAttachedAnnotation(anns []parser.IAnnotationContext) string {
+	for _, a := range anns {
+		ann, ok := a.(*parser.AnnotationContext)
+		if !ok || !strings.EqualFold(ann.AnnotationName().GetText(), "annotation") {
+			continue
+		}
+		if v := ann.AnnotationValue(); v != nil {
+			return extractAnnotationValueString(v)
+		}
+	}
+	return ""
+}
+
+// checkWorkflowAnnotations reports what a workflow activity cannot carry: an
+// annotation other than one `@annotation '…'`. MDL writes no position for a
+// workflow activity, and Mendix attaches at most one note to it.
+func (b *Builder) checkWorkflowAnnotations(anns []parser.IAnnotationContext) {
+	notes := 0
+	for _, a := range anns {
+		ann, ok := a.(*parser.AnnotationContext)
+		if !ok {
+			continue
+		}
+		line := ann.GetStart().GetLine()
+		name := ann.AnnotationName().GetText()
+		if !strings.EqualFold(name, "annotation") {
+			b.addError(fmt.Errorf("line %d: @%s is not a workflow annotation; a workflow activity takes only @annotation '…'", line, name))
+			continue
+		}
+		if ann.AnnotationValue() == nil || extractAnnotationValueString(ann.AnnotationValue()) == "" {
+			b.addError(fmt.Errorf("line %d: a workflow activity's note is @annotation '<text>'", line))
+			continue
+		}
+		notes++
+		if notes > 1 {
+			b.addError(fmt.Errorf("line %d: a workflow activity has at most one @annotation", line))
+		}
+	}
+}
+
+// ExitWorkflowActivityStmt checks the annotations before an activity.
+func (b *Builder) ExitWorkflowActivityStmt(ctx *parser.WorkflowActivityStmtContext) {
+	b.checkWorkflowAnnotations(ctx.AllAnnotation())
+}
+
+// ExitWorkflowEventSubProcess checks the annotations before an event sub-process.
+func (b *Builder) ExitWorkflowEventSubProcess(ctx *parser.WorkflowEventSubProcessContext) {
+	b.checkWorkflowAnnotations(ctx.AllAnnotation())
+}
 
+// buildWorkflowActivityCore builds the activity itself, without its annotation.
+func buildWorkflowActivityCore(actCtx *parser.WorkflowActivityStmtContext) ast.WorkflowActivityNode {
 	if ut := actCtx.WorkflowUserTaskStmt(); ut != nil {
 		return buildWorkflowUserTask(ut)
 	}
@@ -924,6 +996,7 @@ func buildWorkflowEventSubProcess(ctx parser.IWorkflowEventSubProcessContext) as
 	if s := c.STRING_LITERAL(); s != nil {
 		node.Caption = unquoteStringLit(s)
 	}
+	node.Annotation = workflowAttachedAnnotation(c.AllAnnotation())
 	if t, ok := c.WorkflowEventSubProcessTrigger().(*parser.WorkflowEventSubProcessTriggerContext); ok && t != nil {
 		node.Timer = t.TIMER() != nil
 		node.StartName = workflowActivityNameText(t.WorkflowActivityName())
diff --git a/mdl/visitor/visitor_workflow_clauses.go b/mdl/visitor/visitor_workflow_clauses.go
index f1b7d57889..541de86dde 100644
--- a/mdl/visitor/visitor_workflow_clauses.go
+++ b/mdl/visitor/visitor_workflow_clauses.go
@@ -94,6 +94,8 @@ func workflowHeaderClauseKind(c *parser.WorkflowHeaderClauseContext) string {
 		return "OVERVIEW PAGE"
 	case c.DUE() != nil:
 		return "DUE DATE"
+	case c.ANNOTATION() != nil:
+		return "ANNOTATION"
 	}
 	// Event handlers accumulate.
 	return ""
diff --git a/mdl/visitor/visitor_workflow_expressions.go b/mdl/visitor/visitor_workflow_expressions.go
index 5a1b5b40a4..c919c56ec1 100644
--- a/mdl/visitor/visitor_workflow_expressions.go
+++ b/mdl/visitor/visitor_workflow_expressions.go
@@ -96,6 +96,10 @@ func (b *Builder) ExitWorkflowExpression(ctx *parser.WorkflowExpressionContext)
 		// spelling and stays as it is.
 		return
 	}
+	if isAlterWorkflowStringProperty(ctx) {
+		// `alter workflow … { set (Display: 'x') }`: the string is the value.
+		return
+	}
 	b.recordDeprecation(deprecation.WorkflowStringExpression, lit.GetSymbol(), "workflow expression")
 	fix, why := workflowStringExpressionFix(ctx, lit)
 	b.fixLastDeprecation(deprecation.WorkflowStringExpression, fix, why)
diff --git a/mdl/visitor/visitor_workflow_expressions_test.go b/mdl/visitor/visitor_workflow_expressions_test.go
index 19dd9a2738..4a5df3ddfa 100644
--- a/mdl/visitor/visitor_workflow_expressions_test.go
+++ b/mdl/visitor/visitor_workflow_expressions_test.go
@@ -45,14 +45,14 @@ func TestWorkflowExpression_BareFormIsCanonical(t *testing.T) {
 			wfHead + "begin\n  event subprocess Esp on interrupting timer 'addDays([%CurrentDateTime%], 30)' as Start caption 'After 30 days' { };\nend workflow;",
 			wfHead + "begin\n  event subprocess Esp on interrupting timer addDays([%CurrentDateTime%], 30) as Start caption 'After 30 days' { };\nend workflow;"},
 		{"alter workflow due date",
-			"alter workflow M.WF set due date 'addDays([%CurrentDateTime%], 1)';",
-			"alter workflow M.WF set due date addDays([%CurrentDateTime%], 1);"},
+			"alter workflow M.WF { set (DueDate: 'addDays([%CurrentDateTime%], 1)'); };",
+			"alter workflow M.WF { set (DueDate: addDays([%CurrentDateTime%], 1)); };"},
 		{"alter activity due date",
-			"alter workflow M.WF set activity Review due date 'addDays([%CurrentDateTime%], 1)';",
-			"alter workflow M.WF set activity Review due date addDays([%CurrentDateTime%], 1);"},
+			"alter workflow M.WF { set (DueDate: 'addDays([%CurrentDateTime%], 1)') on Review; };",
+			"alter workflow M.WF { set (DueDate: addDays([%CurrentDateTime%], 1)) on Review; };"},
 		{"inserted wait for timer",
-			"alter workflow M.WF insert after Review wait for timer 'addHours([%CurrentDateTime%], 1)' caption 'W';",
-			"alter workflow M.WF insert after Review wait for timer addHours([%CurrentDateTime%], 1) caption 'W';"},
+			"alter workflow M.WF { insert after Review { wait for timer 'addHours([%CurrentDateTime%], 1)' caption 'W'; } };",
+			"alter workflow M.WF { insert after Review { wait for timer addHours([%CurrentDateTime%], 1) caption 'W'; } };"},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			old, canon := mustBuild(t, tc.quoted), mustBuild(t, tc.bare)
@@ -101,7 +101,7 @@ func TestWorkflowExpression_DecisionNameOrCall(t *testing.T) {
 // `set due date ”` clears the due date: it is no expression at all, so it is
 // not an expression written in a string.
 func TestWorkflowExpression_EmptyStringIsNotDeprecated(t *testing.T) {
-	prog := mustBuild(t, "alter workflow M.WF set due date '';")
+	prog := mustBuild(t, "alter workflow M.WF { set (DueDate: ''); };")
 	if got := deprecationCodes(prog); len(got) != 0 {
 		t.Errorf("recorded %v, want none", got)
 	}
diff --git a/mdl/visitor/visitor_workflow_test.go b/mdl/visitor/visitor_workflow_test.go
index 6a2e033bcb..a4f402ea0f 100644
--- a/mdl/visitor/visitor_workflow_test.go
+++ b/mdl/visitor/visitor_workflow_test.go
@@ -833,9 +833,9 @@ func TestAlterWorkflow_InsertAfter(t *testing.T) {
 		t.Errorf("Expected ActivityRef 'Review', got %q", op.ActivityRef)
 	}
 
-	callMf, ok := op.NewActivity.(*ast.WorkflowCallMicroflowNode)
+	callMf, ok := op.NewActivities[0].(*ast.WorkflowCallMicroflowNode)
 	if !ok {
-		t.Fatalf("Expected WorkflowCallMicroflowNode, got %T", op.NewActivity)
+		t.Fatalf("Expected WorkflowCallMicroflowNode, got %T", op.NewActivities[0])
 	}
 	if callMf.Microflow.Name != "SendNotification" {
 		t.Errorf("Expected Microflow 'SendNotification', got %q", callMf.Microflow.Name)
@@ -883,9 +883,9 @@ func TestAlterWorkflow_ReplaceActivity(t *testing.T) {
 		t.Errorf("Expected ActivityRef 'OldStep', got %q", op.ActivityRef)
 	}
 
-	_, ok = op.NewActivity.(*ast.WorkflowCallMicroflowNode)
+	_, ok = op.NewActivities[0].(*ast.WorkflowCallMicroflowNode)
 	if !ok {
-		t.Fatalf("Expected WorkflowCallMicroflowNode, got %T", op.NewActivity)
+		t.Fatalf("Expected WorkflowCallMicroflowNode, got %T", op.NewActivities[0])
 	}
 }
 
diff --git a/mdl/visitor/visitor_xpath_brackets_test.go b/mdl/visitor/visitor_xpath_brackets_test.go
index 9990bd5552..5c698ba818 100644
--- a/mdl/visitor/visitor_xpath_brackets_test.go
+++ b/mdl/visitor/visitor_xpath_brackets_test.go
@@ -125,8 +125,13 @@ func TestAlterWorkflowTargeting_BracketedXPath(t *testing.T) {
 		src   string
 		codes []string
 	}{
-		{"alter workflow M.WF\n  set activity 'Review' targeting xpath [Role = 'Manager'];", nil},
-		{"alter workflow M.WF\n  set activity 'Review' targeting xpath '[Role = ''Manager'']';", []string{deprecation.QuotedTargetingXPath}},
+		{"alter workflow M.WF {\n  set (Targeting: xpath [Role = 'Manager']) on 'Review'; };", nil},
+		{"alter workflow M.WF {\n  set (Targeting: xpath '[Role = ''Manager'']') on 'Review'; };", []string{deprecation.QuotedTargetingXPath}},
+		// The old action form records its own alias as well (ako/mxcli#712).
+		{"alter workflow M.WF\n  set activity 'Review' targeting xpath [Role = 'Manager'];",
+			[]string{deprecation.AlterWorkflowSetActivity}},
+		{"alter workflow M.WF\n  set activity 'Review' targeting xpath '[Role = ''Manager'']';",
+			[]string{deprecation.QuotedTargetingXPath, deprecation.AlterWorkflowSetActivity}},
 	} {
 		prog := mustBuild(t, tc.src)
 		alt, ok := prog.Statements[0].(*ast.AlterWorkflowStmt)
diff --git a/sdk/workflows/workflow.go b/sdk/workflows/workflow.go
index a0e9259663..baaa8a52b5 100644
--- a/sdk/workflows/workflow.go
+++ b/sdk/workflows/workflow.go
@@ -118,6 +118,11 @@ func (a *BaseWorkflowActivity) SetName(name string) {
 }
 
 // GetCaption returns the activity's caption.
+// SetAnnotation sets the note attached to the activity.
+func (a *BaseWorkflowActivity) SetAnnotation(s string) {
+	a.Annotation = s
+}
+
 func (a *BaseWorkflowActivity) GetCaption() string {
 	return a.Caption
 }