diff --git a/.claude/skills/fix-issue/findings/mdl-executor.jsonl b/.claude/skills/fix-issue/findings/mdl-executor.jsonl
index 1f47e0c3f9..3552954e5e 100644
--- a/.claude/skills/fix-issue/findings/mdl-executor.jsonl
+++ b/.claude/skills/fix-issue/findings/mdl-executor.jsonl
@@ -574,6 +574,8 @@
 {"area": "mdl/executor", "date": "2026-09-09", "symptom": "A widget-describe change measured as 'zero rules lost' had in fact dropped SIX visibility rules from Combo box — the widget the work was justified by. The before/after sweep enumerated widgets from `.mxcli/widgets/*.def.json` (33 of them) but `mxcli widget describe` also serves widgets straight from their `.mpk`, and Combo box has no def.json. The real describable set is 42; the missing 9 included the one that mattered.", "cause": "The sweep's widget list was derived from an artifact of the pipeline (generated def.json files) rather than from the capability under test (what `widget describe` can describe). Nothing compared the two lists, so the sample silently excluded a whole class — the same 'two lists, nothing comparing them' shape as the defects being fixed.", "file": "mdl/executor/editorconfig_extract.go, mdl/executor/editorconfig_shapes_test.go", "insight": "Derive a sweep's population from the CAPABILITY, never from a convenient artifact, and state the population in the claim: 'zero rules lost across the 33 widgets carrying a def.json' would have been true and would have invited the question. A second trap immediately after: the regression test written to lock the fix used a hand-written editorConfig snippet of the same APPARENT shape, and it passed with the fix reverted — the nesting that triggers the drop is three levels deep and specific, so the synthetic case was never flagged conjunctive and the test proved nothing. Pointing the test at the real committed .mpk made the control fail with all six names. Rule of thumb: when a defect was found in real vendor input, the regression test takes the real input; a reconstructed minimal case must be shown to fail without the fix BEFORE it is trusted, and here it did not. The fix itself is the policy that should have been there from the start: conjunction support may WITHHOLD a rule the extractor never produced before (emitting one conjunct over-fires), but may never drop one the older vocabulary already lifted — that rule's accuracy is unchanged by the new work.", "refs": ["mendixlabs/mxcli#1036"]}
 {"area": "mdl/executor", "date": "2026-09-09", "symptom": "Six of Combo box's editorConfig hide-rules could not be lifted with their full condition, and its coverage counter sat at 21 of 32. The rules sit inside `\"association\"===t.optionsSourceType && ( … )`, itself the ELSE branch of a ternary inside `\"context\"===t.source ? ( … )` — a chained ternary, where each branch's BODY is parenthesised but each branch's CONDITION is not.", "cause": "groupGuard read the condition of a group opened after `&&`/`||` with trailingExpr, which stops at a STATEMENT separator. A chained ternary contains none, so it returned the whole `A ? (…) : B` expression as the group's condition. That is not a comparison, guardToCondition refused it, and enclosingGroupConditions reported the chain unreadable.", "file": "mdl/executor/editorconfig_extract.go (groupGuard, operandBefore)", "insight": "The characterisation written into the PR body — 'ternary chains without parentheses, which the outward walk does not traverse' — was WRONG, and instrumenting the walk rather than re-reading it is what showed so: the walk reaches these groups fine; the failure is guard EXTRACTION at the group, one function away. A one-line ceiling written from reasoning is worth re-deriving before anyone builds on it. The fix is not a straight swap to lastGuardExpr, which bounds at `{` and hands back a fragment with an unbalanced `}` where the expression follows a block (ProgressCircle's ternary follows a whole switch); take lastGuardExpr's answer only when it stopped at an INSIDE-expression boundary (`:`, `?`, `,`) and fall back to trailingExpr otherwise. Also a measurement note: the 'before' number quoted from an earlier session (16 of 32) was stale — the branch had been restarted from a main that already carried the previous fix, so the real baseline was 21. Re-measure the baseline in the tree you are actually editing rather than quoting a figure from memory.", "refs": ["mendixlabs/mxcli#1036"]}
 {"area": "mdl/executor", "date": "2026-09-09", "symptom": "`alter page P { set NoSuchProperty = 10 on dgProducts; }` and `set PageSize = 12 on noSuchWidget;` both passed `mxcli check -p app.mpr --references` (exit 0, \"All references valid\") and were then refused by `exec`: `pluggable property \"NoSuchProperty\" not found` / `widget \"noSuchWidget\" not found`. exec applies statements one at a time, so the script had already written everything before the typo", "cause": "ValidateWidgetProperties resolves the properties of widgets a statement CARRIES \u2014 CREATE PAGE's tree, and ALTER's InsertWidgetOp/ReplaceWidgetOp trees. SetPropertyOp carries no widget: it names one already stored, so its property can only be resolved against the DOCUMENT, which that pass never opens. Same inversion validate_alter_target.go closed for the ALTER's target document, one level further in", "file": "`mdl/executor/validate_alter_set.go` (new), `mdl/backend/pagemutator/probe.go` (new)", "insight": "**Do not re-derive what a mutation accepts \u2014 run the mutation.** The vocabulary of an ALTER SET is partly a switch in `setRawWidgetPropertyMut` and partly the STORED widget's own PropertyTypes, which belong to whatever widget package the project installed; no registry in this repo can state it for an arbitrary project. So the check opens the document, runs the real setter against a throwaway deep copy (`Mutator.Probe`, whose `Save` is refused), and keeps only the error \u2014 check and exec cannot drift because there is one resolver. The author also gets exec's exact wording from the pre-flight. **Two false-positive sources, both measured, both silence rather than a finding**: a page the script CREATEs (nothing stored \u2014 skip, and do not even open it) and a widget an INSERT in the same script adds. The second cannot be a name match: a DataGrid 2 column is inserted as `colBrand` and addressed as `Brand` (derived from the bound attribute), so the rule is `ResolvesTarget` \u2014 suppress only when the document does not carry the target AND the script adds widgets to that document. **Gating on an optional interface assertion, not on backend.PageMutator**, keeps the pass off the MCP mutator, which has no pluggable path and would have reported its own difference as the author's mistake. Controls: 4 casings of a real property pass (a case-sensitive pre-flight would have re-broken #1069); insert-then-set passes check AND exec in both the same-statement and across-statement forms; 17 ALTER SET examples in mdl-examples show 0 new errors vs the baseline binary; the project's files are byte-identical (md5 over .mpr + mprcontents) after five check runs. Revert control: stubbing the pass makes the three gap tests fail", "refs": []}
+{"area": "mdl/executor", "date": "2026-09-09", "symptom": "`mxcli widget describe COMBOBOX -p app.mpr` said nothing about 23 properties the widget's editor hides, and its generated MDL example offered two database-only properties (`optionsSourceDatabaseCaptionType`, `optionsSourceDatabaseCustomContentType`) for a combobox with `source: 'context'`, where the editor shows neither. The coverage counter read \"24 of 32 editor hide-rules recognized\" and did NOT move, because those calls were recognized — only their property lists were short", "cause": "`hideTargetKeys` read a hide call's property list by trimming a leading `[` and a trailing `]` off the argument. Combo box builds its biggest lists by concatenating module-level arrays onto the literal one — `hidePropertiesIn(e, t, [\"a\",\"b\"].concat(N))`, where `N` is ten database properties — so the trim never found the `]` (the argument ends in `)`), the top-level split stopped at the first element boundary, and every concatenated name was dropped silently. The call still incremented `stats.Recognized`, so the counter reported full coverage of a list it had read a third of", "file": "`mdl/executor/editorconfig_extract.go` (`stringArrayConsts`, `stringArrayMembers`, `concatMembers`; `hideTargetKeys` takes the consts map)", "insight": "**A coverage counter that counts CALL SITES hides a defect in what each call contributed.** \"Recognized\" meant \"I read the condition\", not \"I read the properties\", and the two came apart at exactly the calls that matter most — the branch-level ones hiding ten properties at a time, where a wrong answer is widest. What made it findable was not the counter but **the user-visible artifact**: the MDL example proposed properties the editor does not show, visible only by reading the example against the widget's own `editorConfig.js`. Measure the artifact, not the metric. **Resolution must withhold, not guess**: an argument that is not an inline string array or a known identifier (`.concat(n(b.static))` — a call on a computed key) makes the whole chain unresolvable and the literal keys stand alone; an identifier bound twice to different arrays is dropped, because the minifier reuses short names across scopes. Each of those three refusals needed its own **stubbed control** to show it was load-bearing — withhold-don't-guess is only real if a test fails when the guard is removed. **Measure lost rules as a SET, not a line diff**: `diff` on the sorted rule block reported five false losses that were re-ordering from the 23 insertions. Measured over the 42 describable widgets (population from the `.mpk` files, NOT the 33 `.def.json` — Combo box has none): 332 → 355 rules, 0 lost, 0 per-widget regressions, and the only example block that changed was Combo box's, losing exactly the two wrong bindings. 14 concat sites exist in the fixture; 6 resolve, 8 stay unresolvable and keep today's literal-only behaviour. **Still open after this**: rules inside the `? (…)` database branch and the `: else` branches keep only their own guard and lose the branch condition, so e.g. `selectedItemsSorting hidden when optionsSourceDatabaseItemSelection ≠ \"Multi\"` over-fires for a context-source combobox", "refs": []}
+{"area": "mdl/executor", "date": "2026-09-13", "symptom": "`customAllSelected: []` on a pluggable widget passed `mxcli check -p` with ZERO diagnostics, exec printed \"Created page\", and the stored page carried 0 `CustomWidgets$WidgetProperty` entries — then mxbuild reported 3x CE0642 \"Property 'All selected' is required.\" The same hole swallowed `attributes: []` on an object list and any scalar written for a container-typed property (mendixlabs/mxcli#1056)", "cause": "#999 built `[(k: v)]` into its own AST type so MDL-WIDGET27 could report it, but keyed the rule on that type — which the visitor only produces when the brackets contain a parenthesised entry. An EMPTY `[]` falls through to the generic `[expr, …]` branch and becomes an empty []string that no writer claims, which is #999's silent drop reached by a different spelling. A scalar never looked like a list at all, so nothing examined it", "file": "`mdl/executor/validate_widget_object_property.go` (`isEmptyListValue`, `isDeclaredContainer`, `containerKeyword` resolving child slots as well as object lists)", "insight": "**The reporter only reached the wrong spelling because the right one was rejected.** #1056 reads as one bug and is two: the slot syntax their own generated docs showed did not parse (fixed four days after their build by bca5466e, verified by building their exact commit 89824921 in a worktree — it reproduces their error verbatim and HEAD passes), and the wrong spelling stayed silent. Fixing only the parser would have left every author who had already worked around it with a page that builds broken. **Key on emptiness, never on the brackets**: `visible: [$x != '']`, `editable: [true]` and a filter's `attributes: [Name]` are all how MDL spells those properties, so a rule keyed on `[` would have broken the corpus — the guard test asserts those stay silent. **Gate the scalar case on the definition and the empty case on shape**: `p: 'x'` is the ordinary property form, so calling it wrong without knowing the property is container-typed would be a guess, while `p: []` writes nothing under every current writer and needs no project (which matters because `make check-mdl` runs without one). **A child slot and an object list spell their remedy differently** — `kw name { … }` vs `kw name (…)` — so one message for both would print an example that does not parse; that is why containerKeyword returns isSlot. Verified the printed remedy end-to-end: pasting it verbatim checks, execs, and adds 0 errors to a build where the pre-fix page still contributes its 3 CE0642 — the control pair in one mxbuild run. **Measurement trap hit again**: the first corpus sweep piped `2>/dev/null` while mxcli prints diagnostics to stderr, so it scored 0 of 547 on BOTH sides; the before-side positive control (the #999 file must fire) is what caught it", "refs": []}
 {"area": "mdl/executor", "date": "2026-09-09", "symptom": "`mxcli check … --references` reports \"Check passed!\" for a script whose `create module role M.Admin` names a role that already exists; `exec` then fails with \"module role already exists: M.Admin\" — after the statements before it have been written, leaving the project half-modified.", "cause": "The last gap of the class dbe5cc2a closed for documents. A module role is not a *document*, so `CreateModuleRoleStmt` was never in `stmtCreateInfo` and the sweep that compared stmtCreateInfo against `projectNameSets.setFor` never saw it — the guard tests pass because both lists agree on the types they contain, and a type absent from BOTH is invisible to a test that only compares them.", "file": "`mdl/executor/validate_duplicates.go` (`stmtCreateInfo`, `stmtDropInfo`, `setFor`, `friendlyDocType`), `mdl/executor/helpers.go` (`buildModuleRoleQualifiedNames`)", "insight": "**A guard that compares two lists cannot catch a type missing from both.** `TestEveryCreateDocTypeIsProjectChecked` reads stmtCreateInfo and setFor out of the Go source and is exactly right about the defect it was written for, and it stayed green through this one. The complement it cannot express — every statement `exec` refuses with \"already exists\" is classified at all — has no list to read; it was found by running the statements, not by reading code. **Match the exec predicate exactly, or a fixed under-report becomes a false positive.** Two exec behaviours had to be reproduced: CREATE OR MODIFY succeeds (the `idempotent` flag), and a plain CREATE on a role mxcli AUTO-PROVISIONED also succeeds — `execCreateModuleRole` adopts the caller's casing, rewrites references and returns nil — so `buildModuleRoleQualifiedNames` excludes any role carrying `autoDocumentRoleDescription`. Without that, `check` refuses a working script over a role the user never asked mxcli to create (`defaultDocumentAccessRoles` adds it on the first document in a role-less module). Verified live with its control: auto-provisioned role → check clean and exec prints \"already exists (auto-provisioned)\"; an authored role in the SAME module → reported. **`stmtDropInfo` is the other half**: without the DROP case, `drop module role X; create module role X;` reads as a conflict. Known limit, recorded rather than closed: exec matches role names case-insensitively (CE0123) and this set is keyed exactly, like every other doc type, so `create module role M.admin` against a stored `M.Admin` is still reported only by exec — an under-report of a rare spelling, not a false positive. Repro `mdl-examples/bug-tests/1067-duplicate-module-role.mdl` (a plain .mdl: the check needs a project, and `make check-mdl` runs check without one). Issue mendixlabs/mxcli#1067", "refs": ["mendixlabs/mxcli#1067"]}
 {"area": "mdl/executor", "date": "2026-09-09", "symptom": "A microflow whose activity has a CUSTOM error handler comes back from `describe microflow` with the handler AND every activity in its branch missing. Output stays valid MDL, `mxcli check` passes, nothing on stderr \u2014 so describe\u2192edit\u2192exec deletes the handler from the model. Reported on a create-variable activity with \"custom with rollback\" (v0.21, Mx 11.12.3); reproduced on HEAD/11.14.0 with a pure mxcli round trip", "cause": "TWO STACKED DEFECTS. (1) `getActionErrorHandlingType` was a hand-maintained switch covering 17 of the 38 action types that store ErrorHandlingType. `emitActivityStatement` walks the error branch only when `hasCustomErrorHandler(errType)` agrees, so each of the 21 missing types lost the ENTIRE `on error { \u2026 }` block, not just the suffix \u2014 CreateObject and ChangeObject among them. (2) legacy only: 9 parse functions never read ErrorHandlingType off the BSON, so the value was gone before the describer was asked. Fixing (1) alone left legacy still broken, which is how they hid each other", "file": "`mdl/executor/cmd_microflows_show_helpers.go` (`getActionErrorHandlingType` \u2192 new `actionErrorHandlingField`); `sdk/mpr/parser_microflow.go`, `sdk/mpr/parser_microflow_actions.go` (9 parsers); grammar+visitor+builder for 8 statements; `mdl/executor/validate_microflow_error_handling.go` (MDL076 table, new MDL077)", "insight": "**Count the gap before fixing the instance** \u2014 the reported activity was 1 of 21, measured by diffing the switch's cases against the action types declaring the field. **Replace the enumeration, do not extend it**: the list had already been patched per-instance (#863) and silently regrew, so it is now a reflection lookup on the `ErrorHandlingType` field, with `RestOperationCallAction` the ONE deliberate exclusion (Mendix rejects a custom handler there, CE6035). Actions embed model.BaseElement, which has no such field, so no promoted field is picked up by accident. **The trap: fixing the describer alone makes things WORSE.** 8 statement forms had no `onErrorClause` in the grammar \u2014 `declare` (the reporter's own), `set`, `change`, `log`, `show page`, `close page`, `show message`, `validation feedback` \u2014 so DESCRIBE began emitting `declare $name String = 'v' on error { \u2026 };`, which fails to parse (`mismatched input 'on' expecting ';'`). Trading a silent drop for a broken script is not a fix; the grammar was extended instead. **Measured on 11.14.0, and the result is not guessable**: all 8 accept a custom handler (0 errors), but for `on error continue` create-VARIABLE and change-VARIABLE are fine while change-OBJECT, log, show page, close page, show message and validation feedback are CE6035 \u2014 now in MDL076's deny-list, whose comment claiming Log/Change were \"unreachable from a script\" this change invalidated. New MDL077 refuses `on error` on the list-operation/aggregate forms of `set`, which genuinely have no ErrorHandlingType in the metamodel \u2014 one MDL keyword spanning activities that can and cannot hold the clause. **A non-terminating handler causing CE0108 is NOT a bug**: the branch merges back and a later variable is out of scope on the error path; Studio Pro reports the same. Controls: revert the lookup \u2192 all 7 describer cases fail naming the dropped branch; revert one parser \u2192 the legacy case fails; a no-clause microflow must still render NO suffix (#840 in reverse). Repro `mdl-examples/bug-tests/microflow-1078-error-handler-roundtrip.mdl`; describe\u2192exec\u2192describe byte-identical and reported \"Unchanged microflow\"", "refs": ["#1078", "#863", "#840"], "ce": ["CE6035", "CE0108"]}
 {"area": "mdl/executor", "date": "2026-09-10", "symptom": "CI `make test-integration` fails where `go test ./...` is green: `TestMxCheck_DoctypeScripts/02b-nanoflow-examples.mdl` (both engines) and `/03-page-examples.mdl` report **CE6035 \"Error handling type is not supported\"** on 11 activities \u2014 every un-annotated Change object / Log message / Validation feedback / Close page in a NANOFLOW. Self-inflicted while fixing #1078", "cause": "Eight builders were switched from `fb.ehType(nil)` to `explicitErrorHandling(fb, s.ErrorHandling)` on the action. `explicitErrorHandling` returns EMPTY for \"no clause\", and the writers turn empty into a literal `\"Rollback\"` via orDefault \u2014 but `fb.ehType(nil)` is CONTEXT-DEPENDENT and returns **Abort** in a nanoflow. So every un-annotated nanoflow activity silently changed from Abort to Rollback, which mxbuild rejects", "file": "`mdl/executor/cmd_microflows_builder_actions.go` + `cmd_microflows_builder_calls.go` (8 sites reverted to `fb.ehType(s.ErrorHandling)`); `mdl/executor/nanoflow_validation.go` (`getErrorHandling`)", "insight": "**The same helper is correct for one action and wrong for its neighbour, and the difference is what the code did BEFORE.** `explicitErrorHandling` is right for Retrieve/Delete (#1020-era): their writers emitted a hardcoded `\"Rollback\"` that those two actions accept in every flow flavour, so empty\u2192Rollback is a no-op. It is wrong wherever the builder already supplied a *context-dependent* default \u2014 empty discards the flow flavour. The rule: before replacing a default-supplying expression, ask what the OLD expression returned in every context, not just the one you are testing. Its own doc comment names Abort/nanoflow and I still missed it, because I was reading it as \"the safe choice\" rather than \"the choice that preserves THIS call site's prior value\". **`go test ./...` does not run this suite** \u2014 the mx-check round trips are behind `-tags integration` (`make test-integration`, ~30 min), so a green unit suite says nothing about whether mxbuild still accepts what mxcli writes; run it before pushing anything that touches a serialized default. Regression test `TestAuthorOnError_NanoflowKeepsAbortWithoutAClause` (control: the same statements in a microflow must NOT become Abort) \u2014 a unit test, so it catches this in seconds instead of 30 minutes. A second, quieter gap in the same change: `getErrorHandling` in nanoflow_validation.go gates the walk that looks for disallowed actions INSIDE a handler body, so the eight new statements had to be added there too or a Java action nested in `declare \u2026 on error { \u2026 }` goes unreported (test carries a `commit` control, since that entry point is `validateNanoflowBody`, NOT the exported `ValidateNanoflowBody`, which is a different check)", "refs": ["#1078"], "ce": ["CE6035"]}
@@ -604,3 +606,9 @@
 {"area": "mdl/executor", "date": "2026-09-13", "symptom": "A boundary event path written from MDL fails the build with CE0105 'Call microflow cannot be the last object of a flow, it should end with a jump or end activity' (interrupting), or builds at 0 errors and the runtime refuses to start: 'Expected the flow to end with an end event' (non-interrupting). After the fix, `create or modify` of the same workflow was refused by the dropped-construct guard", "cause": "Mendix ends every boundary event path with `EndOfBoundaryEventPathActivity`; mxcli never wrote one, and MDL has no end statement. The rewrite guard then counted `$Type`s containing 'BoundaryEvent', which includes the marker, so a stored workflow with one event counted two", "file": "`sdk/workflows/workflow.go` (`EndBoundaryEventPath`), `mdl/executor/cmd_workflows_write.go` (`buildBoundaryEvents`), `mdl/backend/wfmutator/mutator.go` + `mdl/backend/mcp/workflow.go` (`InsertBoundaryEvent`), `mdl/executor/validate_workflow_rewrite.go` (`countRawBoundaryEvents`)", "insight": "**Same class as the parallel-split marker: a Studio Pro terminal marker that no MDL statement spells.** Grep the writers for every `EndOf*` type the reader knows before assuming one is the only one. The guard miscount was only visible by re-running the fixed script against the fixed workflow \u2014 a substring match on `$Type` is wrong the moment a sibling type shares the stem; match the suffix, and keep a control asserting the substring count so the test says why", "fix": "Append the marker unless the path ends in a jump or end-of-workflow (CE6692 otherwise); count boundary events by `strings.HasSuffix($Type, \"BoundaryEvent\")`"}
 {"area": "mdl/executor", "date": "2026-09-13", "symptom": "A workflow with `boundary event timer '\u2026'` (no interrupting / non interrupting) passes check and builds at 0 errors; the runtime then fails to start: `Class 'Workflows$TimerBoundaryEvent' could not be found`", "cause": "The bare form maps to `Workflows$TimerBoundaryEvent`, which exists in no cached 11.x runtime (only Interrupting/NonInterruptingTimerBoundaryEvent). mxbuild tolerates the unknown type. It was the documented syntax example", "file": "`mdl/executor/validate_workflow_refs.go` (`bareTimerBoundaryEventErrors`, MDL-WF07), `cmd/mxcli/syntax/features_workflow.go`", "insight": "**A type mxbuild accepts is not a type the runtime has.** Found only because a verification boot of an unrelated fix loaded it. When a grammar has a default branch that maps to a storage type, check that type against the runtime's class list, not against `mx check`", "fix": "Refuse the bare form on 11+ at check and exec, CREATE and every ALTER op that can carry a boundary event; update syntax help, skill table and the ako/mxcli#415 bug-test script to name the kind"}
 {"area": "mdl/executor", "date": "2026-09-13", "symptom": "A view entity whose association column is also declared as an attribute (`MeterRef: Trends.Meter` or `MeterRef: Trends.Meter.ID` beside `select m.ID as MeterRef`) passes `mxcli check`; `check -p` says 'OQL select has 1 columns but 2 attributes declared'; exec writes `Enumeration(Trends.Meter)` and mx check reports CE1613, or throws 'An error occurred when trying to set the Enumeration property' for the three-part form", "cause": "A bare qualified name parses as TypeEnumeration (the entity/enum ambiguity), and execCreateViewEntity converted it with convertDataType without asking what it names. The alias-to-attribute alignment skips association columns, so the declared attribute had no column and was compared against the next one", "file": "`mdl/executor/oql_view_associations.go` (`ValidateViewAttributeDeclarations` MDL080, `viewAttributeEntityTypeErrors`), `mdl/executor/cmd_entities.go` (`execCreateViewEntity`), `mdl/executor/validate.go`, `mdl/executor/validate_program.go`, `cmd/mxcli/lsp_diagnostics.go`", "insight": "**The TypeEnumeration/TypeEntity ambiguity has a consumer wherever a data type becomes a stored type, and view entity attributes were one nobody had listed.** Split the refusal by what it needs: an association column's alias and a three-part name are decidable from the script, so they belong in the no-project phase that exec's pre-check also runs; entity-vs-enum needs the project, so it goes in check -p AND the handler, because exec --no-check skips both phases. Verify the handler refusal by counting changed files, not by the error text", "fix": "Refuse in ValidateProgram/LSP (MDL080) and at the top of execCreateViewEntity before any backend call; report an attribute once"}
+{"area": "mdl/executor", "date": "2026-09-13", "symptom": "Three new MDL-WIDGET27 tests passed locally and failed in CI on the same commit: two reported the fallback remedy (\"move the entries into the widget body as container blocks\") instead of naming the container keyword, and the third found 0 violations where it wanted 1", "cause": "The tests resolved the widget through `LoadWidgetRegistry(fixtureProject(t))`, which reads `.def.json` files from `testdata/expr-checker/.mxcli/widgets/`. That directory is GITIGNORED — the definitions are derived, not tracked — so they exist for any developer who has ever run `mxcli widget docs` against the fixture (I generated them earlier in the same session, while investigating) and never exist on the runner. With no definition, `containerKeyword` returns \"\" and the two definition-dependent branches degrade exactly as designed: fallback wording, and silence for the scalar case", "file": "`mdl/executor/validate_widget_object_property_test.go` (`fixtureProjectWithDefs`)", "insight": "**A gitignored fixture makes a test environment-dependent in the one direction nobody checks** — the developer's tree is a superset of the runner's, so the test is green exactly where it is not being tested. The fix is to DERIVE the artifact from tracked inputs inside the test (`RefreshWidgetDefinitions` over the fixture's tracked `.mpk` files, into a temp copy, after removing any `.mxcli` the developer's tree carries), so local and CI see identical inputs. Reproduce by moving the gitignored directory aside before believing any diagnosis. **The sibling lesson is why this was not caught by the existing suite**: #999's test asserted `strings.Contains(msg, \"attribute\")` on a widget whose property is named `attributes`, so the property name alone satisfied it and the assertion passed with NO definition loaded — a substring assertion whose needle is a substring of the data it is meant to distinguish from proves nothing. Tightened to the remedy shape (`` `attribute <name> (…)` blocks ``) and verified with the derivation stubbed: all four then fail, where before only the three new ones did", "refs": []}
+{"area": "mdl-executor", "date": "2026-09-13", "symptom": "DESCRIBE silently deletes an ExclusiveMerge: describe -> exec leaves the microflow with fewer merge nodes than the stored graph, with no warning, no MDL-FLOW01 and mx check clean", "cause": "The nested describer walks straight through a merge with a single incoming path without emitting anything for it, so the rebuild has no reason to create it. Only two merge shapes were represented: a split's join point (rendered by `end if`) and a labelled error rejoin (`merge <label>`).", "file": "mdl/executor/cmd_microflows_show_merge.go", "fix": "droppedMergeWarnings() emits a describe-time warning for any ExclusiveMerge that is neither a split join point, nor a labelled error rejoin, nor has in-degree >= 2. Wired into both describe paths beside irreducibleGraphWarnings.", "insight": "The obvious rule (represented == the join point findSplitMergePoints pairs with a split) is WRONG on real code and produces a false positive on ordinary Marketplace microflows. findMergeForSplit needs a join common to ALL branches, so a split where one branch returns pairs with nothing -- yet its merge is still emitted as the continuation after `end split` and survives with its $ID intact (Administration.ManageMyAccount). The in-degree clause is what separates the two. Establish the rule by CORRELATING survival with structure over a corpus rather than reasoning from the describer's code: measuring merge $IDs before and after a round trip over 21 microflows gave in-degree=1 deleted 7 of 7, in-degree>=2 survived 6 of 7. The one exception is a merge lost to flattening in an irreducible graph, which MDL-FLOW01 already owns with a stronger message. Also: count-based comparison cannot tell 'preserved' from 'deleted and recreated' -- compare $IDs. And when scanning describe output for your own warning, grep a string unique to it: MDL-FLOW01's text also contains 'is not represented', which faked a false positive for one round of measurement."}
+{"area":"mdl-executor","date":"2026-09-13","symptom":"DESCRIBE renders a microflow whose branches cross as `c1 and c2` when the activity actually runs on `not(c1) or c2` — a program that always logs described as one that never does, with mx check clean","cause":"Nested if/then/else is single-entry/single-exit; a Mendix microflow is an arbitrary digraph. When an inner split's branch lands where an outer split's branch lands, the describer walks the graph as a tree and emits the conjunction of the guards along one path.","file":"mdl/executor/cmd_microflows_normalize.go","fix":"DESCRIBE MICROFLOW ... NORMALIZED (Mode 3): fold the branch guards into one condition via mdl/microflownorm and rewrite a COPY of the graph into the equivalent nested one, then let the existing describer render it. Refuses per-decision when the region holds an activity, a rule-based split, or genuinely interleaved branches.","insight":"Do not write a second describer for a second rendering mode — rewrite the GRAPH and reuse the one describer, or the two drift and every activity renderer is implemented twice. Two verification lessons. (1) A boolean simplifier needs a truth-table equivalence test over generated formulas, not per-rule unit tests: an unsound rewrite produces a pretty WRONG guard, which is the original bug from the other direction. Run it with a rule deliberately broken as the control — mine caught it at the first assignment. (2) Algebra is not behaviour: build the original and the microflow rebuilt from its normalized description side by side and compare return values over the whole input truth table on a real runtime. The rows that matter are the ones the OLD rendering got wrong, so make the fixture's return value distinguish them (a `log` activity is invisible to a test; a `$Result` string is not). Also: the fold leaves the entry merge with in-degree 1, which describe->exec would then silently delete, so splice it out in the transform — otherwise Mode 3's output does not describe the graph its own re-execution builds."}
+{"area":"mdl/executor","date":"2026-09-13","symptom":"CATALOG.GRAPH_CYCLES returns 0 rows on a project whose CATALOG.GRAPH_MODULE_COUPLING lists mutual Source/Target module pairs, so a user reads 'no circular dependencies' from a table that was never computed (mendixlabs/mxcli#1060)","cause":"graph_cycles_data is written only by the graph-analysis pass (REFRESH CATALOG COMMUNITIES), while graph_module_coupling is a plain SQL view over refs that any full-mode catalog answers. GRAPH_CYCLES and its four siblings appeared in neither fullOnlyTables nor sourceOnlyTables, so no warning fired; and the recorded build mode is only fast/full/source, so a communities-augmented cache is indistinguishable from a plain full one — which also let a later `refresh catalog full` drop the graph tables silently","file":"`mdl/executor/cmd_catalog.go` (`communitiesOnlyTables`, `warnIfCatalogModeInsufficient`, `tableRequiredMode`, `carryGraphAnalysis`, `cachedCatalogInfo`), `mdl/catalog/catalog.go` (`MetaGraphAnalysis`), `mdl/catalog/builder_graph.go`, `mdl/catalog/builder.go`","insight":"**An empty analytic table is only an answer once something distinguishes 'computed and empty' from 'never computed'.** The mode ladder could not carry that bit: fast/full/source is a LEVEL, and the graph pass is orthogonal to it (it augments any level), so folding it in makes 'source' and 'full+graph' incomparable — it has to be a flag, not a rank. Guard it by MEASUREMENT, not a second hand-written list: run the pass on a synthetic refs graph and diff which tables went from empty to non-empty, then compare that set to the classification map. Shape the fixture so every table fills — two clusters for the community split and the integration surface, one MUTUAL pair for cycles — or the guard silently skips the very table the bug was about","fix":"Record MetaGraphAnalysis/MetaGraphResolution when the pass runs; classify the six tables in communitiesOnlyTables and warn 'requires refresh catalog communities (not run for this catalog)'; report it in SHOW CATALOG STATUS; re-run the pass when a full rebuild replaces a cache that had it"}
+{"area": "mdl/executor", "date": "2026-09-13", "symptom": "describe page -> create or replace page broke a button's icon. An icon into an IMAGE collection came back as `Icon: 'DesignSystem.Icons_SVG.edit'` and the build failed [CE1613] \"The selected custom icon 'DesignSystem.Icons_SVG.edit' no longer exists.\" A GLYPH icon produced no describe output at all -- no clause, no comment -- and replay DELETED it at exit 0.", "cause": "Mendix stores three icon elements and two put a qualified name under the same BSON key: Forms$IconCollectionIcon{Image}->CustomIcons$CustomIcon, Forms$ImageIcon{Image}->Images$Image, Forms$GlyphIcon{Code}. extractIconRef read `Image` off whichever element was there and threw the $Type away, and the page builder writes Forms$IconCollectionIcon unconditionally -- so the two named variants were spelled identically on the way out and collapsed into one on the way back in.", "file": "mdl/executor/cmd_pages_describe_output.go (extractButtonIcon, widgetIconMDL, widgetIconNote), mdl/executor/cmd_pages_describe.go (rawWidget.IconType/IconCode), mdl/executor/cmd_pages_describe_parse.go; tests mdl/executor/cmd_pages_describe_icon_test.go", "insight": "The identical three-variant defect was fixed in NAVIGATION eight days earlier (2026-09-05, same area file) and the page path never received it -- so the cheapest possible diagnosis was `grep MenuIconKindOf`, and the fix reuses that resolver rather than adding a second one. **Generalisable: when a fix teaches a layer to distinguish polymorphic variants, grep for every OTHER reader of the same element.** The find was one `git grep Forms\\$ImageIcon` away all along. Two things the report got understandably wrong and that the fix depends on getting right: it is not about third-party vs native collections (a third-party ICON collection round-trips fine -- and CE1613 naming the reference is itself proof the name was never a custom icon, since mxbuild would otherwise have resolved it), and the reported image-icon case is the CHEAPER half -- the glyph case is silent on both sides, so nothing in the output even hints at the loss. **Measure the silence, not the wrong answer**: `grep -c icon` over describe output of a stock marketplace project's FeedbackModule pages returned 0 before and 3 after, which is the only form the glyph bug has. The note has to fire on an UNRECOGNISED $Type too, not a known-bad list, or the next variant Mendix adds is dropped the same way. Controls that matter: an icon-collection icon must still emit a bare `Icon:` and NO note (else the fix passes by flagging everything), and an iconless button must emit neither. No .mdl repro is possible -- mxcli cannot author an image or glyph icon on a button, so the input to the round trip cannot be constructed in MDL; the reproduction is a stored-widget map in the unit test. Also observed in passing and NOT fixed: a nameless `statictext` makes describe output unparseable (pre-existing, confirmed against the base binary), and NavigationList item / DropDownButton icons are never read at all, so they are dropped as silently as the glyph was.", "refs": ["#1059", "#1008", "#602"], "ce": ["CE1613"]}
+{"area": "mdl/executor", "date": "2026-09-13", "symptom": "Follow-on to #1059: a widget's image and glyph icons were readable but unwritable, so describe -> exec could only be made honest (a `-- NOT re-executable` note), not lossless. Authoring them needed the kind to reach the element $Type through grammar, AST, visitor, builder and BOTH engines.", "cause": "Three separate vocabularies for the same three Mendix icon elements: types.MenuIconKind (navigation), pages.IconType (the page model's own three-value enum), and a bare string in the widget property map. The page path had no kind at all, so it could not express one.", "file": "mdl/grammar/domains/MDLPage.g4 (widgetIconV3), mdl/ast/ast_page_v3.go (WidgetIcon), mdl/visitor/visitor_page_v3.go (buildWidgetIconV3), mdl/executor/cmd_pages_builder_v3_widgets.go (buildWidgetIcon), mdl/backend/modelsdk/widget_write.go (iconToGen), sdk/mpr/writer_widgets_display.go (buildWidgetIconBson), mdl/executor/validate_icon_refs.go, mdl/executor/validate_glyph_codes.go", "insight": "**Delete the second vocabulary as part of the fix, not after it.** pages.IconType existed for exactly the same three kinds as types.MenuIconKind and had drifted to a different value set; replacing it (2 call sites) is what made the writers a dispatch rather than an inference. A feature that adds a third copy would have re-created the bug in a new place. **The pre-existing tests of the OLD feature are the safety net for the new one**: MDL078's menu tests caught a python replace of mine that silently no-opped (anchor did not match, no assert), which nothing else would have. Always assert on the replacement count when editing by script. **Measure the premise, don't reason by analogy** — extending MDL078 to widget glyphs assumed mxbuild resolves a widget glyph the same way it resolves a menu one. It does, measured: `Icon: glyph 57562` fails `mxbuild --target=deploy` with `System.InvalidOperationException: Sequence contains no matching element` — but it names the **page**, not a layout, so the rule's own message was wrong and had to be corrected from the measurement. **The reference check had the mirror-image bug waiting**: resolving an image reference against the ICON collections reports a correct name as a typo, which is the same conflation pointed the other way — per-kind resolution plus an `otherKindHint` naming the remedy. **An empty listing is 'could not establish', not 'none'** — each half of the index is independent, so a project that yields icon collections but no image collections still resolves what it can. Verified on 11.13.0: all three authored, mx check 0 errors, deploy BUILD SUCCEEDED, right $Type on disk; controls reproduce CE1613 (image written without `image`) and the glyph build failure. Corpus sweep 531 clean.", "refs": ["#1059", "#1008", "#602"], "ce": ["CE1613"]}
diff --git a/.claude/skills/fix-issue/findings/mdl-other.jsonl b/.claude/skills/fix-issue/findings/mdl-other.jsonl
index 6cfc09dccc..8deaa128bd 100644
--- a/.claude/skills/fix-issue/findings/mdl-other.jsonl
+++ b/.claude/skills/fix-issue/findings/mdl-other.jsonl
@@ -61,3 +61,4 @@
 {"area": "mdl/linter", "date": "2026-09-07", "symptom": "`mxcli lint` CONV010 reported \"ACT_ microflow 'X' contains 'ExclusiveMerge' activity\" on every ACT_ microflow containing an `if` — 122 times on one project, and on a minimal microflow whose ONLY violation was the merge (ako/CapTrackV4 R11).", "cause": "ALLOWED_ACTIVITY_TYPES in conv010_act_microflow_content.star listed ExclusiveSplit and not ExclusiveMerge. An `if` emits both, so the rule permitted the branch and flagged the join it necessarily creates. Fixed by adding ExclusiveMerge, with a test that asks the catalog's own labeller (getMicroflowObjectType) for the two names rather than hardcoding them.", "file": "`.claude/lint-rules/conv010_act_microflow_content.star`; tests `mdl/catalog/lint_rule_vocabulary_test.go`", "insight": "The codebase had already answered this in the other direction and the rule disagreed with it: countMicroflowActivities in mdl/catalog excludes ExclusiveMerge as structural, with a comment saying so. When a lint rule's vocabulary looks wrong, check whether another part of the same package has already classified the same thing. The control matters as much as the fix — LoopedActivity and InheritanceSplit must stay flagged, or a 'widen the list' fix passes the new test and guts the rule. Note also that `mxcli lint` loads Starlark rules ONLY from the project's own `.claude/lint-rules/`, never the embed, so a fixed built-in reaches an existing project only when it re-runs `mxcli init` — which is why a project can keep reporting a rule bug that is already fixed upstream."}
 {"area": "mdl/catalog", "date": "2026-09-07", "symptom": "A microflow wired as the project's AfterStartupMicroflow reported \"no callers found\" and \"no references found\", and `mxcli lint` QUAL004 said \"is not called from anywhere. Remove if unused.\" Dropping it left a dangling name that `mx check` also missed; only the runtime refused to start (ako/CapTrackV4 049, R13).", "cause": "The runtime calls these, so nothing in the model does, and CATALOG.REFS had no edge kind for a project setting. Added RefKindSettings and extractProjectSettingsRefs, emitting one `settings` edge per setting that names a microflow (AfterStartupMicroflow, BeforeShutdownMicroflow, HealthCheckMicroflow), with the SETTING as the edge's source; added \"settings\" to QUAL004's MICROFLOW_ENTRY_KINDS.", "file": "`mdl/catalog/builder_references.go` (RefKindSettings, extractProjectSettingsRefs, projectSettingsMicroflowRefs); `.claude/lint-rules/orphaned_elements.star`; tests `mdl/catalog/lint_rule_vocabulary_test.go`", "insight": "Same class as the scheduled-event edge, and the rule's own comment had already named the failure mode — \"a kind missing here turns a live document into a false 'not called from anywhere' finding\" — which makes the list of entry kinds worth auditing whenever a new way to invoke a microflow is added. The dangerous half is not the missing reference but the lint rule built on it: QUAL004 does not merely fail to notice, it actively advises deleting the microflow whose deletion breaks the build. The settings list is a literal rather than reflection over ModelSettings, because most of that struct is strings that are not microflow names and a wrong entry would invent an edge rather than miss one."}
 {"area": "mdl/catalog", "date": "2026-09-09", "symptom": "A new CATALOG view is queryable by name but absent from `show catalog tables`, so nobody can discover it — caught by TestTables_CoversAllViews, not by any query", "cause": "Adding a view to tables.go creates it in SQLite, but Catalog.Tables() is a separate hand-maintained list and is what SHOW CATALOG TABLES prints. The two are not derived from each other", "file": "`mdl/catalog/catalog.go` (Tables), `mdl/catalog/tables.go`", "insight": "Two hand-maintained lists of the same thing, with a guard test comparing them — the guard is the only reason this is a five-second fix instead of a view nobody finds for months. When adding a catalog view, expect to touch both. The general shape recurs in this codebase (stmtCreateInfo vs projectNameSets.setFor under-reported conflicts for the same reason), so the question to ask of any list is what compares it to its twin", "refs": ["ako/mxcli#413"]}
+{"area":"mdl/catalog","date":"2026-09-13","symptom":"A user asks 'are there circular dependencies between my modules?', reads CATALOG.GRAPH_CYCLES, gets 0 rows, and concludes there are none — while CATALOG.GRAPH_MODULE_COUPLING lists the same module pair in both directions (mendixlabs/mxcli#1060)","cause":"GRAPH_CYCLES is SCCs of the ASSET graph. Modules A and B reference each other through DIFFERENT documents, which form no cycle among themselves, so the asset table is correctly empty for a genuinely circular module pair. Compounded by scope: the asset graph admits only graphRefKinds, while coupling counts every kind — 110 of 316 edges on a stock 11.14 app, and Administration -> Atlas_Core there is `layout`-only","file":"`mdl/catalog/builder_graph.go` (`buildModuleCycles`, `loadModuleEdges`, `graphRefKindsSQL`), `mdl/catalog/tables.go` (`graph_module_cycles_data`, `graph_analysis_scope`), `mdl/linter/starlark_graph.go` (`module_cycles()`)","insight":"**When a report says two tables disagree, check whether they answer different questions before checking whether one is broken — then make the difference queryable.** Tarjan was fine; the granularity and the edge filter were both undocumented and invisible from SQL. Two traps in the implementation: (1) the new module pass sat after `if len(edges) == 0 { return }` on the STRUCTURAL edge set, so a project whose only cross-module refs are navigational — the reported case exactly — got nothing; a test with only `layout` edges caught it. (2) A module-cycle table built on the structural subset would have shipped green and still answered 'none' for the reported pair, so the edge set has to match graph_module_coupling, the table it is read beside. Generate the scope view's IN list from graphRefKinds rather than restating it, or the documentation of the filter drifts from the filter","fix":"Add graph_module_cycles (module SCCs, all kinds, with a RefKinds column naming the edges inside the cycle) and graph_analysis_scope (per-kind edge counts + InAssetGraph), plus a module_cycles() Starlark builtin"}
diff --git a/.claude/skills/mendix/create-page/SKILL.md b/.claude/skills/mendix/create-page/SKILL.md
index a9a839d18e..9495c15c59 100644
--- a/.claude/skills/mendix/create-page/SKILL.md
+++ b/.claude/skills/mendix/create-page/SKILL.md
@@ -380,6 +380,41 @@ image imgRemote (ImageType: imageUrl, ImageUrl: 'https://example.com/logo.svg')
 image imgIcon   (ImageType: icon)
 ```
 
+### A button's icon is one of three elements
+
+Mendix stores **three different icon elements**, and the keyword picks which:
+
+```sql
+actionbutton btnEdit  (Caption: 'Edit',  Action: nothing, Icon: 'Atlas_Core.Atlas_Filled.pencil')
+actionbutton btnLogo  (Caption: 'Logo',  Action: nothing, Icon: image MyFirstModule.Images.logo)
+actionbutton btnHome  (Caption: 'Home',  Action: nothing, Icon: glyph 57377)
+```
+
+| form | element | holds |
+|------|---------|-------|
+| bare name | `Forms$IconCollectionIcon` | a name in an **icon** collection |
+| `image <name>` | `Forms$ImageIcon` | a name in an **image** collection |
+| `glyph <code>` | `Forms$GlyphIcon` | a font character code, no name |
+
+The first two are spelled identically and point into **different documents**, so
+the `image` keyword is the only thing separating them. Write an image reference
+without it and mxcli stores a custom-icon reference, which fails the build with
+*CE1613 "The selected custom icon … no longer exists."* `mxcli check -p app.mpr
+--references` resolves each kind against its own collection and names the remedy
+when the kind is wrong, which is cheaper than a build.
+
+Any icon collection works, third-party ones included — `show icon collections`
+lists them and `describe icon collection Atlas_Core.Atlas_Filled` lists the names
+(they are non-obvious: it is `add`, not `plus`).
+
+A glyph has a code and no name. The codes are **sparse**, and an undefined one
+fails only at `mxbuild --target=deploy` — with *"An exception occurred while
+exporting page '<name>'"*, naming the page and never the icon — so `mxcli check`
+reports it as **MDL078** first. Browse them with `show glyphs`.
+
+`describe page` emits all three forms, so describe → exec round-trips a button's
+icon whichever kind it is.
+
 ### Binding across modules and to audit members
 
 An attribute path may cross module boundaries, including into the platform's
diff --git a/.claude/skills/mendix/custom-widgets/SKILL.md b/.claude/skills/mendix/custom-widgets/SKILL.md
index 5e386c3c40..9d0a446c26 100644
--- a/.claude/skills/mendix/custom-widgets/SKILL.md
+++ b/.claude/skills/mendix/custom-widgets/SKILL.md
@@ -71,6 +71,29 @@ vanished from storage, while the multi-key shape died as `missing ')' at ','`.
 The error now names the container keyword and rewrites your entry into the form
 that works.
 
+The same rule covers the two spellings that carry no entry to key on
+(`mendixlabs/mxcli#1056`):
+
+```sql
+selectionhelper sh (renderStyle: 'custom', customAllSelected: [])          -- MDL-WIDGET27
+selectionhelper sh (renderStyle: 'custom', customAllSelected: 'something') -- MDL-WIDGET27
+```
+
+A **widgets**-typed property such as `customAllSelected` holds child widgets, so
+it is written as a block with widgets in it rather than entries:
+
+```sql
+selectionhelper sh (renderStyle: 'custom') {
+  customallselected s1 { dynamictext d1 (Content: 'All') }
+}
+```
+
+The empty form is reported from its shape, with no project needed. The scalar
+form is reported only when the widget resolves, because without a definition
+`p: 'x'` is the ordinary property form and flagging it would be a guess. Both
+matter because a required slot left empty is not a silent no-op at build time —
+it is `CE0642 "Property '…' is required."`, one per slot.
+
 `describe widget <name> -p <project.mpr>` lists a widget's container keywords
 under **Body containers**, and — for an object list — the widgets-typed **slots
 inside one item**, with the widget types that route into each:
diff --git a/.claude/skills/mendix/graph-analysis/SKILL.md b/.claude/skills/mendix/graph-analysis/SKILL.md
index 7ce2494ea3..bca6af2938 100644
--- a/.claude/skills/mendix/graph-analysis/SKILL.md
+++ b/.claude/skills/mendix/graph-analysis/SKILL.md
@@ -37,6 +37,15 @@ Two separate commands are needed. The full catalog must exist before community d
 | `REFRESH CATALOG FULL` | `GRAPH_GOD_NODES`, `GRAPH_MODULE_COUPLING`, `GRAPH_MODULE_COHESION`, `GRAPH_DEAD_ASSETS`, `GRAPH_ENTITY_HOTSPOTS`, `GRAPH_MODULE_DEPENDENCIES`, `GRAPH_REFKIND_DISTRIBUTION` |
 | `REFRESH CATALOG COMMUNITIES` | `COMMUNITIES`, `COMMUNITY_SUMMARY`, `GRAPH_CYCLES`, `GRAPH_LAYERS`, `GRAPH_CENTRALITY`, `GRAPH_INTEGRATION_SURFACE` |
 
+**An empty table from the second row is ambiguous unless you check.** Step 2 is
+not a build mode — it augments whatever the catalog is, so `Build mode: full`
+says nothing about whether it ran, and before mendixlabs/mxcli#1060 an un-run
+pass and a genuinely cycle-free project produced the same `0 rows`. A query now
+warns `requires refresh catalog communities (not run for this catalog)` when the
+pass is missing, and `SHOW CATALOG STATUS` has a `Graph analysis:` line. **No
+warning plus no rows is a real answer**; treat anything else as "not computed
+yet", not as "clean".
+
 `REFRESH CATALOG COMMUNITIES` with a resolution modifier:
 - `REFRESH CATALOG COMMUNITIES` — default resolution (balanced granularity)
 - `REFRESH CATALOG COMMUNITIES resolution 0.6` — coarser clusters (fewer, larger communities; good for monolith-to-multi-app planning)
@@ -233,6 +242,37 @@ ORDER BY CycleSize DESC, CycleId
 **Size 2**: mutual reference between two elements — e.g. workflow A calls workflow B which triggers workflow A. Investigate before assuming it's intentional; these can cause infinite loops at runtime.  
 **Size 3+**: a dependency ring — must be broken before the module can be split or properly layered.
 
+### Module cycles are a different query, not a rollup
+
+`GRAPH_CYCLES` is **document**-level. Two modules referencing each other almost
+never means two documents do — Administration calls something in Atlas_Core from
+one page while Atlas_Core reaches back from another — so `GRAPH_CYCLES` is
+correctly empty for a genuinely circular pair of modules. Reading it as "no
+circular dependencies" was mendixlabs/mxcli#1060. Ask the module question of the
+module table:
+
+```sql
+SELECT ModuleName, CycleSize, RefKinds
+FROM CATALOG.GRAPH_MODULE_CYCLES
+ORDER BY CycleSize DESC, ModuleName
+```
+
+`RefKinds` names the kinds on that module's edges **into the rest of the cycle** —
+the references to go and break, as opposed to everything else the module points at.
+
+The two also read different edges. `GRAPH_MODULE_CYCLES` uses every reference
+kind, matching `GRAPH_MODULE_COUPLING`; the computed asset pass
+(`GRAPH_CYCLES`/`COMMUNITIES`/`GRAPH_LAYERS`/`GRAPH_CENTRALITY`) is restricted to
+the structural kinds so navigational edges do not blur the clustering. On a stock
+app that is about a third of the edges. `GRAPH_ANALYSIS_SCOPE` reports the split
+per kind, which is the query to run when coupling shows an edge and the computed
+tables act as though it were not there:
+
+```sql
+SELECT RefKind, Edges, InAssetGraph FROM CATALOG.GRAPH_ANALYSIS_SCOPE
+ORDER BY InAssetGraph, Edges DESC
+```
+
 ---
 
 ## Use Case 8: Monolith-to-Multi-App Planning
@@ -294,7 +334,9 @@ Elements at the same layer can be parallelised safely. A microflow calling somet
 | Which modules are tightly coupled? | `GRAPH_MODULE_COUPLING` |
 | Is module M self-contained? | `GRAPH_MODULE_COHESION` |
 | What is unused / dead? | `GRAPH_DEAD_ASSETS` |
-| Are there circular dependencies? | `GRAPH_CYCLES` |
+| Are there circular dependencies between **documents**? | `GRAPH_CYCLES` |
+| Are there circular dependencies between **modules**? | `GRAPH_MODULE_CYCLES` |
+| Why isn't an edge I see in coupling affecting the cycles/layers? | `GRAPH_ANALYSIS_SCOPE` |
 | Which entities are hotspots? | `GRAPH_ENTITY_HOTSPOTS` |
 | What contracts would a split require? | `GRAPH_INTEGRATION_SURFACE` |
 | What reference types cross module boundaries? | `GRAPH_MODULE_DEPENDENCIES` |
diff --git a/CHANGELOG.md b/CHANGELOG.md
index be2f849073..efef663bea 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,8 +6,44 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+### Added
+
+- **`CATALOG.GRAPH_MODULE_CYCLES` — the modules that depend on each other** (mendixlabs/mxcli#1060), plus a `module_cycles()` Starlark builtin for enforcing a no-circular-modules policy. Not a rollup of `GRAPH_CYCLES`: modules reference each other through documents that need form no cycle themselves, which is the ordinary shape and why the document-level table is legitimately empty for a genuinely tangled pair. Computed over **every** reference kind, matching `GRAPH_MODULE_COUPLING` — the table it is read beside — rather than the structural subset the clustering uses; on a blank Mendix app `Administration → Atlas_Core` is a `layout` edge and nothing else, so a module-cycle table on the structural subset would answer "none" for exactly the pair that gets reported. Each row carries `RefKinds`: the kinds on that module's edges **into the rest of the cycle**, not everything it points at.
+
+- **`CATALOG.GRAPH_ANALYSIS_SCOPE` — which reference kinds reach the computed graph.** The two graph families disagree by construction and there was no way to see it from SQL: `GRAPH_MODULE_COUPLING` and friends read every kind straight off `refs`, while the computed pass (communities, cycles, layers, centrality) is restricted to the structural kinds. On a stock 11.14 app that is 110 of 316 edges. One row per kind with its edge count and whether it is in the asset graph; the `IN` list is generated from the filter itself, so the view cannot drift from what it describes.
+
+- **`Icon: image <qn>` and `Icon: glyph <n>` on page widgets** (mendixlabs/mxcli#1059) — Mendix stores three icon elements on a button and MDL could spell one, so the other two were readable and unwritable. DESCRIBE learned to flag them rather than destroy them (see *Fixed*, below); this makes them authorable, so the round trip is lossless rather than merely honest.
+
+  ```sql
+  actionbutton btnEdit (Caption: 'Edit', Action: nothing, Icon: 'Atlas_Core.Atlas_Filled.pencil')
+  actionbutton btnLogo (Caption: 'Logo', Action: nothing, Icon: image MyModule.Images.logo)
+  actionbutton btnHome (Caption: 'Home', Action: nothing, Icon: glyph 57377)
+  ```
+
+  The bare form stays the icon-collection icon, so no existing script changes meaning; a name may also be written unquoted, as every other reference into the model is. The keyword is the whole point: the first two forms are spelled identically and point into **different documents**, so nothing else can separate them. Same vocabulary and same ordering trap as navigation's `icon image` / `icon glyph`, and the shared resolver (`types.MenuIconKind`) rather than a second copy — `pages.Icon` carried its own three-value enum for the same three things, which is precisely the drift that produced the bug.
+
+  `mxcli check --references` now resolves **each kind against its own collection**, which it could not do before: an image reference was checked against the icon collections and reported as a typo. When the kind is wrong it names the remedy — *"`MyFirstModule.Images` IS an image collection — write `Icon: image MyFirstModule.Images.workflow`"* — rather than leaving a correct name looking misspelt. **MDL078** (undefined glyph code) now covers widget glyphs too: it read the statements through its own walk, so the day a widget could carry a glyph every one of them would have passed in silence; both it and the reference check now consume the package's single icon walk.
+
+  The legacy engine wrote `Icon: nil` on every action button unconditionally — a button icon has been authorable since #602 and only the modelsdk engine ever wrote one, so under `--engine legacy` it was dropped on every write, silently, since a null Icon is what an iconless button stores. Both engines now write all three.
+
+  Measured on 11.13.0 against a real project: all three authored, `mx check` 0 errors, `mxbuild --target=deploy` **BUILD SUCCEEDED**, and the three elements on disk with the right `$Type` and payload. The controls are what pin it — the same page with `image` dropped produces exactly `[error] [CE1613] "The selected custom icon 'MyFirstModule.Images.workflow' no longer exists." at Action button 'btnImage'`, and a widget `Icon: glyph 57562` fails the deploy build with `System.InvalidOperationException: Sequence contains no matching element`, naming the **page** (so MDL078's message no longer promises "layout"). Corpus sweep clean at 531 scripts.
+
 ### Fixed
 
+- **An empty graph-analysis table could not be told apart from one that was never computed** (mendixlabs/mxcli#1060). `CATALOG.GRAPH_CYCLES` answered `0 rows` on a project whose `CATALOG.GRAPH_MODULE_COUPLING` listed mutual module pairs, so it read as "no circular dependencies". The two are built by different things: coupling is a plain view over `refs` that any full catalog answers, while the cycles/communities/layers/centrality tables are written only by `REFRESH CATALOG COMMUNITIES` — and those six were in neither `fullOnlyTables` nor `sourceOnlyTables`, so nothing warned.
+
+  The mode ladder could not carry the distinction. fast/full/source is a *level*, each containing the one below, which is what lets a rank comparison decide everything; the graph pass is orthogonal, augmenting whichever level is cached. It is now recorded as a flag plus the resolution it ran at. A query against one of the six says `requires refresh catalog communities (not run for this catalog)`; `SHOW CATALOG STATUS` reports `Graph analysis: ✓/✗` separately from the build mode; `DESCRIBE CATALOG.GRAPH_CYCLES` names the command that populates it.
+
+  A full rebuild also dropped the graph tables silently while the recorded mode stayed `full` — measured on a 16-module app: 150 community rows before `refresh catalog full force`, 0 after. It now re-runs the pass at the same resolution instead. A fast build is deliberately not promoted: it never overwrites a full cache, so it has nothing to preserve.
+
+- **`describe page` → `create or replace page` rebuilt a button's icon as the wrong element, or deleted it** (mendixlabs/mxcli#1059) — an icon pointing into an **image** collection came back out as a bare `Icon: 'DesignSystem.Icons_SVG.edit'`, which the page builder writes as a custom-icon reference: `[error] [CE1613] "The selected custom icon 'DesignSystem.Icons_SVG.edit' no longer exists."` A **glyph** icon was worse — DESCRIBE emitted nothing for it at all, neither a clause nor a comment, and since `CREATE OR REPLACE PAGE` is a full replacement, replaying that output removed the icon with an exit 0 and a success message.
+
+  Mendix stores three icon elements and two of them put a qualified name under the same BSON key — `Forms$IconCollectionIcon{Image}` into a `CustomIcons$CustomIcon`, `Forms$ImageIcon{Image}` into an `Images$Image`, `Forms$GlyphIcon{Code}` into a font with no name at all. The page describer read `Image` off whichever element was there and discarded the `$Type`, so the emitter could not tell the two named variants apart; the builder has exactly one icon element, so any name reaching `Icon:` became a custom-icon reference. Not a limit on *third-party* collections, as the report reasonably read it: a third-party **icon** collection round-trips fine, and CE1613 naming the reference is itself the evidence that the name was never a custom icon.
+
+  The same three-way split was already understood one layer over, in navigation (`types.MenuIconKindOf`, ako/mxcli#1008) — the page path never received it, and the shared resolver is now used on both. DESCRIBE emits `Icon:` only for the variant mxcli can author and flags every other kind, the unrecognised `$Type` included, with a `-- NOT re-executable` note naming the reference and its element. Measured on the FeedbackModule pages of a stock marketplace project: three glyph icons per page went from **zero mentions** in describe output to three notes; the `Icon:` clauses on icon-collection icons are unchanged (10 on that project), and the emitted script still parses.
+
+  Authoring the other two variants (`Icon: image <qn>` / `Icon: glyph <n>`, as navigation spells them) is not part of this — the loss is now visible, not yet reversible.
+
 - **A parallel split written from MDL ran every path empty** (reported in ako/view-entity-examples FINDINGS §6). `PARALLEL SPLIT … PATH 1 { … } PATH 2 { … }` passed `mxcli check`, built at 0 errors and round-tripped through `describe`, and at runtime each path ran from the split straight to its end: the activities inside never executed and left **no activity record**. Every gate said the workflow was fine, including the one that reads the model back.
 
   Mendix stores an `EndOfParallelSplitPathActivity` as the last activity of every path, and its engine executes a path up to that marker. mxcli wrote paths without one — on both engines, and through `ALTER WORKFLOW … INSERT PATH` on both mutators — so the runtime synthesised an end ahead of the path's contents. Measured on Mendix 11.14.0 with the marker as the only variable between two instances of the same workflow, reading `system$workflowactivity`: without it neither path's call-microflow produced a record; with it both finished. The shipped fix was then booted on its own and the same query shows both paths' activities `Finished`, plus an end record for an empty path.
diff --git a/cmd/mxcli/lsp_completions_gen.go b/cmd/mxcli/lsp_completions_gen.go
index 3201586ade..79a59f3ba8 100644
--- a/cmd/mxcli/lsp_completions_gen.go
+++ b/cmd/mxcli/lsp_completions_gen.go
@@ -28,6 +28,7 @@ var mdlGeneratedKeywords = []protocol.CompletionItem{
 	{Label: "MOVE", Kind: protocol.CompletionItemKindKeyword, Detail: "DDL keyword"},
 	{Label: "MODIFY", Kind: protocol.CompletionItemKindKeyword, Detail: "DDL keyword"},
 	{Label: "MERGE", Kind: protocol.CompletionItemKindKeyword, Detail: "DDL keyword"},
+	{Label: "NORMALIZED", Kind: protocol.CompletionItemKindKeyword, Detail: "DDL keyword"},
 	{Label: "ENTITY", Kind: protocol.CompletionItemKindKeyword, Detail: "DDL keyword"},
 	{Label: "PERSISTENT", Kind: protocol.CompletionItemKindKeyword, Detail: "DDL keyword"},
 	{Label: "VIEW", Kind: protocol.CompletionItemKindKeyword, Detail: "DDL keyword"},
diff --git a/cmd/mxcli/syntax/features_microflow.go b/cmd/mxcli/syntax/features_microflow.go
index 713a5e88c8..43ae19d473 100644
--- a/cmd/mxcli/syntax/features_microflow.go
+++ b/cmd/mxcli/syntax/features_microflow.go
@@ -155,6 +155,51 @@ func init() {
 		SeeAlso: []string{"microflow.control-flow"},
 	})
 
+	Register(SyntaxFeature{
+		Path:    "microflow.normalized-describe",
+		Summary: "DESCRIBE MICROFLOW ... NORMALIZED: fold crossed branches into one condition",
+		Keywords: []string{
+			"normalized", "normalize", "describe", "fold", "recombinable",
+			"irreducible", "crossed branches", "guard", "mode 3",
+		},
+		Syntax: "DESCRIBE MICROFLOW Module.Name NORMALIZED;\n\n" +
+			"-- Opt-in rendering for a graph whose branches cross. Nested IF cannot\n" +
+			"-- describe one faithfully, so the DEFAULT rendering flattens it and warns\n" +
+			"-- (MDL-FLOW01). NORMALIZED instead folds the branch guards into a single\n" +
+			"-- condition, which is equivalent and duplicates nothing.\n" +
+			"--\n" +
+			"-- The graph from mxcli #923:\n" +
+			"--   split1: true -> split2      false -> merge1\n" +
+			"--   split2: true -> merge1      false -> merge2\n" +
+			"-- The activity on merge1 runs on `not(c1) or c2`. Default DESCRIBE renders\n" +
+			"-- it as `c1 and c2` -- with the reporter's expressions, a program that\n" +
+			"-- always logged described as one that never did.\n" +
+			"--\n" +
+			"-- WHY OPT-IN. The output re-executes to a DIFFERENT graph: same behaviour,\n" +
+			"-- fewer nodes, different layout. Describing a microflow to change one\n" +
+			"-- activity must not rebuild the canvas, so this is never the default and\n" +
+			"-- the output carries a NOTE saying so.\n" +
+			"--\n" +
+			"-- WHAT IT REFUSES, rather than guessing:\n" +
+			"--   * an activity between the decision and the shared part -- folding\n" +
+			"--     would move a side effect;\n" +
+			"--   * a rule-based decision -- a rule call cannot go inside an expression;\n" +
+			"--   * genuinely interleaved branches -- nesting those needs a duplicated\n" +
+			"--     activity or an invented boolean (Boehm-Jacopini), neither of which\n" +
+			"--     is a description.\n" +
+			"-- A refusal leaves that decision rendered as-is and says why.\n" +
+			"--\n" +
+			"-- Folding is safe because Mendix `and`/`or` SHORT-CIRCUIT -- measured, see\n" +
+			"-- mdl-examples/bug-tests/923-short-circuit-semantics.test.mdl. Were they\n" +
+			"-- eager, the folded form could evaluate a guard the original skipped.",
+		Example: "DESCRIBE MICROFLOW MyModule.MF_Reporter NORMALIZED;\n\n" +
+			"-- emits, for the crossed graph above:\n" +
+			"--   if $B or not($A) then\n" +
+			"--     log info node 'NODE' 'Do something';\n" +
+			"--   end if;",
+		SeeAlso: []string{"microflow.merge-join", "microflow.control-flow"},
+	})
+
 	Register(SyntaxFeature{
 		Path:    "microflow.merge-join",
 		Summary: "Named join points: MERGE <label> and JOIN <label>",
diff --git a/cmd/mxcli/syntax/features_page.go b/cmd/mxcli/syntax/features_page.go
index 793ab9fae0..444953b44b 100644
--- a/cmd/mxcli/syntax/features_page.go
+++ b/cmd/mxcli/syntax/features_page.go
@@ -228,7 +228,7 @@ CREATE PAGE Sales.Detail (Title: 'Detail', Layout: Atlas_Core.Atlas_Default) {
 			"icon", "linkbutton", "link button",
 			"nothing", "no action", "inert", "dead button",
 		},
-		Syntax:  "Action: NOTHING                      -- deliberately no action (Forms$NoAction)\nAction: SAVE_CHANGES\nAction: SAVE_CHANGES CLOSE_PAGE      -- save, then close the pop-up\nAction: CANCEL_CHANGES\nAction: CANCEL_CHANGES CLOSE_PAGE\nAction: CLOSE_PAGE\nAction: DELETE\nAction: DELETE CLOSE_PAGE\nAction: DELETE_OBJECT\nAction: NANOFLOW Module.NF\nAction: NANOFLOW Module.NF(Param: $val)\nAction: OPEN_LINK 'https://example.com'\nAction: SIGN_OUT\nAction: COMPLETE_TASK 'OutcomeName'\nAction: SHOW_PAGE Module.Page\nAction: SHOW_PAGE Module.Page(Param: $currentObject)\nAction: MICROFLOW Module.MF\nAction: MICROFLOW Module.MF(Param: $val)\nAction: CREATE_OBJECT Module.Entity THEN SHOW_PAGE Module.Page\n\nThe list above is exhaustive. Anything else in an action slot is an\nERROR (MDL-WIDGET28), including a real keyword short its argument --\n`Action: OPEN_LINK` without a URL, `Action: SHOW_PAGE` without a page.\nSuch a widget used to be written with NO action at all and rendered as a\ndead control, with check, exec and mxbuild all clean, because a\nno-action widget is legal Mendix (mendixlabs/mxcli#1062). Write NOTHING\nwhen a control really is meant to be inert.\n\nThe same forms serve `OnClick:` (an alias of `Action:`) and `OnChange:`.\n\nA microflow or nanoflow action is a CALL: it needs an argument for every\nparameter the flow declares, or Mendix rejects the page with CE1571. The\nargument list is the same on every widget that takes an action -- a\nCONTAINER (which is clickable) as much as an ACTIONBUTTON. An enclosing\ndata container of the right type supplies it without an argument; a data\ngrid's CONTROL BAR does not, because it is not row-scoped -- pass the\ngrid's selection there (`$dgOrders`).\n\nA SHOW_PAGE argument must be the enclosing widget's context object --\neither $currentObject or the name of the variable the enclosing data\nwidget is bound to. Mendix infers it from that widget, so naming any\nother variable is refused (MDL-PAGEARG01); call a microflow instead.\n\nOPEN_LINK takes a static web address and stores it as a\nForms$StaticOrDynamicString. Mendix also supports a DYNAMIC address, read\nfrom an attribute at runtime; MDL cannot author that one, and DESCRIBE\nflags such a button rather than printing its address as a literal.\n\nButton styles: Default, Primary, Success, Info, Warning, Danger\nIcon: 'Module.IconCollection.IconName'   -- e.g. 'Atlas_Core.Atlas_Filled.pencil'\nUse `linkbutton` instead of `actionbutton` for link render mode (same properties).",
+		Syntax:  "Action: NOTHING                      -- deliberately no action (Forms$NoAction)\nAction: SAVE_CHANGES\nAction: SAVE_CHANGES CLOSE_PAGE      -- save, then close the pop-up\nAction: CANCEL_CHANGES\nAction: CANCEL_CHANGES CLOSE_PAGE\nAction: CLOSE_PAGE\nAction: DELETE\nAction: DELETE CLOSE_PAGE\nAction: DELETE_OBJECT\nAction: NANOFLOW Module.NF\nAction: NANOFLOW Module.NF(Param: $val)\nAction: OPEN_LINK 'https://example.com'\nAction: SIGN_OUT\nAction: COMPLETE_TASK 'OutcomeName'\nAction: SHOW_PAGE Module.Page\nAction: SHOW_PAGE Module.Page(Param: $currentObject)\nAction: MICROFLOW Module.MF\nAction: MICROFLOW Module.MF(Param: $val)\nAction: CREATE_OBJECT Module.Entity THEN SHOW_PAGE Module.Page\n\nThe list above is exhaustive. Anything else in an action slot is an\nERROR (MDL-WIDGET28), including a real keyword short its argument --\n`Action: OPEN_LINK` without a URL, `Action: SHOW_PAGE` without a page.\nSuch a widget used to be written with NO action at all and rendered as a\ndead control, with check, exec and mxbuild all clean, because a\nno-action widget is legal Mendix (mendixlabs/mxcli#1062). Write NOTHING\nwhen a control really is meant to be inert.\n\nThe same forms serve `OnClick:` (an alias of `Action:`) and `OnChange:`.\n\nA microflow or nanoflow action is a CALL: it needs an argument for every\nparameter the flow declares, or Mendix rejects the page with CE1571. The\nargument list is the same on every widget that takes an action -- a\nCONTAINER (which is clickable) as much as an ACTIONBUTTON. An enclosing\ndata container of the right type supplies it without an argument; a data\ngrid's CONTROL BAR does not, because it is not row-scoped -- pass the\ngrid's selection there (`$dgOrders`).\n\nA SHOW_PAGE argument must be the enclosing widget's context object --\neither $currentObject or the name of the variable the enclosing data\nwidget is bound to. Mendix infers it from that widget, so naming any\nother variable is refused (MDL-PAGEARG01); call a microflow instead.\n\nOPEN_LINK takes a static web address and stores it as a\nForms$StaticOrDynamicString. Mendix also supports a DYNAMIC address, read\nfrom an attribute at runtime; MDL cannot author that one, and DESCRIBE\nflags such a button rather than printing its address as a literal.\n\nButton styles: Default, Primary, Success, Info, Warning, Danger\n\nMendix has THREE icon elements and the keyword picks which one:\n\nIcon: 'Atlas_Core.Atlas_Filled.pencil'   -- an icon collection\nIcon: image MyModule.Images.logo         -- an IMAGE collection\nIcon: glyph 57377                        -- a font code point\n\nThe bare form is the icon-collection icon and any collection in the\nproject works, third-party ones included. The image form points into a\ndifferent document, and is spelled the same way apart from the keyword\n-- write it without `image` and mxcli stores a custom-icon reference,\nwhich fails the build with CE1613 (mendixlabs/mxcli#1059).\n`mxcli check -p … --references` resolves each kind against its own\ncollection and names the remedy when the kind is wrong.\n\nA glyph carries a code and no name. Codes are sparse, and an undefined\none fails only at `mxbuild --target=deploy`, naming the PAGE rather\nthan the icon -- so MDL078 checks it against the font's own table.\nList them with `show glyphs`.\n\nA name may be quoted or bare; a hyphenated segment is double-quoted on\nits own: Atlas_Core.Atlas.\"align-center\".\n\nUse `linkbutton` instead of `actionbutton` for link render mode (same properties).",
 		Example: "ACTIONBUTTON btnSave (Caption: 'Save', Action: SAVE_CHANGES, ButtonStyle: Primary)\nACTIONBUTTON btnEdit (Caption: 'Edit',\n  Action: SHOW_PAGE Module.EditPage(Item: $currentObject))\nLINKBUTTON btnDelete (Caption: 'Delete', Action: DELETE,\n  Icon: 'Atlas_Core.Atlas_Filled.pencil')\n\n-- A clickable CONTAINER in a data grid's control bar, calling a nanoflow\n-- with the grid's selection as its argument.\nDATAGRID dgOrders (DataSource: DATABASE FROM Sales.Order, Selection: Single) {\n  COLUMN colNr (Attribute: Number, Caption: 'Order #')\n  CONTROLBAR cb {\n    CONTAINER cShip (Class: 'command',\n      Action: NANOFLOW Sales.ACT_Ship($Order = $dgOrders)) {\n      ACTIONBUTTON btnShip (Caption: 'Ship')\n    }\n  }\n}",
 		SeeAlso: []string{"page.widgets"},
 	})
diff --git a/docs-site/src/reference/query/describe-widget.md b/docs-site/src/reference/query/describe-widget.md
index 38cf9247f9..e8b4d3984b 100644
--- a/docs-site/src/reference/query/describe-widget.md
+++ b/docs-site/src/reference/query/describe-widget.md
@@ -103,6 +103,15 @@ widget hides under the configuration the example picked is left out, so what you
 see is what that configuration actually supports. The footer reports how many of
 the widget's hide-rules were recognised; an unrecognised rule never prunes.
 
+The count is of **hide-calls whose condition was read**, which is not the same
+as every property being accounted for. A widget editor often builds one call's
+property list by concatenating shared arrays onto a literal one — Combo box
+hides ten database properties that way in a single call. Those are resolved, so
+the rules appear; but where the concatenated argument is computed at runtime
+(`.concat(n(b.static))`) it cannot be resolved statically, and only the literal
+names are reported. Nothing is guessed: an unresolvable list contributes its
+literal members and no more.
+
 A rule can carry several conditions, joined with `and`:
 
 ```
diff --git a/docs-site/src/tools/catalog-tables.md b/docs-site/src/tools/catalog-tables.md
index 337db837f9..a2c450926e 100644
--- a/docs-site/src/tools/catalog-tables.md
+++ b/docs-site/src/tools/catalog-tables.md
@@ -249,12 +249,23 @@ The dependency graph (`CATALOG.REFS`, full refresh) is analysed by a family of
 `graph_*` views and tables — god nodes, module coupling/cohesion, dead documents,
 communities, cycles, layers, centrality, and the integration surface. The
 community/cycle/layer/centrality tables are populated by `REFRESH CATALOG
-COMMUNITIES`. See **[Graph Analysis](graph-analysis.md)** for the full reference
-and the `mxcli graph-report` command.
+COMMUNITIES` — a pass, not a build mode, so a full-mode catalog has them empty
+until it runs and a query against one says so rather than returning `0 rows`.
+See **[Graph Analysis](graph-analysis.md)** for the full reference and the
+`mxcli graph-report` command.
+
+Cycles come in two flavours, because they are two questions:
+`CATALOG.GRAPH_CYCLES` for tangled **documents** and `CATALOG.GRAPH_MODULE_CYCLES`
+for tangled **modules** — the second is not a rollup of the first, since modules
+reference each other through documents that need form no cycle themselves.
+`CATALOG.GRAPH_ANALYSIS_SCOPE` reports which reference kinds reach the computed
+asset graph, which is what to check when a `graph_module_coupling` edge seems to
+have no effect on cycles or layers.
 
 ```sql
 select * from CATALOG.graph_god_nodes order by Degree desc limit 20;
 select * from CATALOG.graph_module_coupling order by Edges desc;
+select * from CATALOG.graph_module_cycles order by CycleSize desc;
 show communities;
 ```
 
diff --git a/docs-site/src/tools/graph-analysis.md b/docs-site/src/tools/graph-analysis.md
index fa3048b259..5ba10b7e7e 100644
--- a/docs-site/src/tools/graph-analysis.md
+++ b/docs-site/src/tools/graph-analysis.md
@@ -55,7 +55,8 @@ populates these catalog objects (and fills the `PageRank`/`Betweenness` columns
 |--------|----------|
 | `CATALOG.communities` | community id per asset |
 | `CATALOG.community_summary` | per-community size, dominant-module label, members |
-| `CATALOG.graph_cycles` | assets in a dependency cycle |
+| `CATALOG.graph_cycles` | **assets** in a dependency cycle (structural kinds only) |
+| `CATALOG.graph_module_cycles` | **modules** in a dependency cycle (every kind) |
 | `CATALOG.graph_layers` | topological layer sequence number per asset |
 | `CATALOG.graph_centrality` | PageRank / betweenness per asset |
 | `CATALOG.graph_module_dependencies` | directed module→module edges (kind + count) |
@@ -64,6 +65,75 @@ populates these catalog objects (and fills the `PageRank`/`Betweenness` columns
 The `resolution` knob selects granularity: high γ → fine **candidate modules**;
 low γ → coarse **candidate apps**.
 
+### Two cycle tables, two questions
+
+`graph_cycles` and `graph_module_cycles` are not a detail view and a rollup of
+each other. Modules A and B are in a cycle when A references B *and* B references
+A — through any documents, which need form no cycle between themselves. That is
+the ordinary shape, so `graph_cycles` is legitimately empty for a genuinely
+tangled pair of modules. Reading it as "no circular dependencies" while
+`graph_module_coupling` listed both directions is
+[mendixlabs/mxcli#1060](https://github.com/mendixlabs/mxcli/issues/1060).
+
+They also read different edges, on purpose:
+
+| | edge set | asks |
+|---|---|---|
+| `graph_cycles` | structural kinds only | which documents are tangled together |
+| `graph_module_cycles` | every kind, like `graph_module_coupling` | which modules cannot be extracted independently |
+
+The asset graph excludes navigational kinds (`layout`, `show_page`,
+`datasource`, `widget`, `sync`, …) because they blur community and layer
+clustering. A module cycle is a different claim: a page bound to a layout in
+another module really is a dependency of that module, and on a blank Mendix app
+`Administration → Atlas_Core` is a `layout` edge and nothing else. A module-cycle
+table on the structural subset would answer "none" for exactly the pair that gets
+reported.
+
+`graph_analysis_scope` makes the split answerable instead of buried in source —
+one row per reference kind with its edge count and whether it reaches the asset
+graph:
+
+```sql
+select * from CATALOG.graph_analysis_scope order by InAssetGraph, Edges desc;
+```
+
+On a stock 11.14 app that is 110 of 316 edges outside it. Each
+`graph_module_cycles` row also carries `RefKinds` — the kinds on that module's
+edges *into the rest of the cycle*, so you know which reference to go and break.
+
+```sql
+select ModuleName, CycleSize, RefKinds from CATALOG.graph_module_cycles
+  order by CycleSize desc, ModuleName;
+```
+
+### If one of these is empty
+
+Empty means one of two very different things, and they used to look identical.
+The tables above are filled by the pass, not by a build mode — so a catalog built
+with `refresh catalog full` has all of them empty while `graph_module_coupling`,
+a plain view over `refs`, answers normally. That asymmetry was
+[mendixlabs/mxcli#1060](https://github.com/mendixlabs/mxcli/issues/1060).
+
+A query now says which case you are in:
+
+```
+Warning: CATALOG.GRAPH_CYCLES requires refresh catalog communities (not run for this catalog)
+```
+
+No warning and no rows means the pass ran and genuinely found nothing.
+`show catalog status` reports the same thing up front:
+
+```
+Graph analysis: ✓ Available (resolution 1)
+Graph analysis: ✗ Not run (use refresh catalog communities)
+```
+
+The pass is **not** a build mode — it augments whatever mode is cached, so
+`Build mode: full` says nothing about it. A later `refresh catalog full` used to
+drop these tables silently; it now re-runs the pass at the same resolution, so the
+graph survives a rebuild. To drop back, delete `.mxcli/catalog.db` and refresh.
+
 ### SHOW commands
 
 ```sql
@@ -77,7 +147,8 @@ show community members of Sales.Order              -- its co-clustered assets
 **Spaghetti → layered / modular app.**
 
 ```sql
-select * from CATALOG.graph_cycles;                       -- the tangles to break
+select * from CATALOG.graph_cycles;                       -- tangled documents
+select * from CATALOG.graph_module_cycles;                -- tangled modules
 select Layer, AssetName from CATALOG.graph_layers
   order by Layer;                                          -- dependency depth
 show communities;                                          -- cleaner module groupings
@@ -108,7 +179,7 @@ mxcli ships the *facts*, not an opinion. Teams enforce their own layering /
 allowed-dependency / no-cycle / coupling-budget policies via Starlark lint rules,
 using these builtins (which read the graph tables):
 
-`community_of`, `layer_of`, `cycles`, `module_dependencies`, `centrality`,
+`community_of`, `layer_of`, `cycles`, `module_cycles`, `module_dependencies`, `centrality`,
 `god_nodes`, `integration_surface`, `refs_from`.
 
 ```python
diff --git a/docs/01-project/MDL_QUICK_REFERENCE.md b/docs/01-project/MDL_QUICK_REFERENCE.md
index 5031d71fed..fa3d8e57de 100644
--- a/docs/01-project/MDL_QUICK_REFERENCE.md
+++ b/docs/01-project/MDL_QUICK_REFERENCE.md
@@ -467,6 +467,7 @@ rather than updating the first.
 | Show microflows | `show microflows [in module];` | List all or filter by module |
 | Show nanoflows | `show nanoflows [in module];` | List all or filter by module |
 | Describe microflow | `describe microflow Module.Name;` | Full MDL with activities |
+| Describe microflow (normalized) | `describe microflow Module.Name normalized;` | Folds crossed branches into one condition instead of flattening them. Opt-in: the output re-executes to an equivalent graph with fewer nodes and a different layout |
 | Describe nanoflow | `describe nanoflow Module.Name;` | Full MDL with activities |
 | Rename microflow | `rename microflow Module.Old to New;` | Updates all references |
 | Rename nanoflow | `rename nanoflow Module.Old to New;` | Updates all references |
@@ -1350,7 +1351,9 @@ MDL uses explicit property declarations for pages:
 | Action binding | `action: type` | `actionbutton btn (caption: 'Save', action: save_changes)` — the forms are a closed set (`mxcli syntax page.action`); anything else is **MDL-WIDGET28** |
 | No action | `action: nothing` | `actionbutton btn (caption: 'Decorative', action: nothing)` — an explicitly inert control. Write it deliberately: an action keyword **short its argument** (`action: open_link` with no URL) is now an error rather than a widget silently written with no action at all |
 | Microflow action | `action: microflow Name(Param: val)` | `action: microflow Mod.ACT_Process(Order: $Order)` |
-| Button icon | `icon: 'Module.IconCollection.IconName'` | `linkbutton btn (caption: 'Edit', action: nothing, icon: 'Atlas_Core.Atlas_Filled.pencil')` — icon-collection icon; MxBuild rejects an unknown name (CE1613) |
+| Button icon | `icon: 'Module.IconCollection.IconName'` | `linkbutton btn (caption: 'Edit', action: nothing, icon: 'Atlas_Core.Atlas_Filled.pencil')` — the **icon-collection** icon; MxBuild rejects an unknown name (CE1613) |
+| Image icon | `icon: image Module.ImageCollection.Name` | `actionbutton btn (caption: 'Logo', action: nothing, icon: image MyMod.Images.logo)` — an **image** collection is a different document from an icon collection, and the names are spelled the same, so the keyword is what separates them. Written without `image` it is stored as a custom-icon reference and the build fails **CE1613** |
+| Glyph icon | `icon: glyph <code>` | `actionbutton btn (caption: 'Home', action: nothing, icon: glyph 57377)` — a font code point with no name. Codes are sparse; an undefined one fails only at `mxbuild --target=deploy`, naming the **page**, so **MDL078** checks it. Browse with `show glyphs` |
 | Clickable container | `onclick: action` (alias of `action:`) | `container card (onclick: microflow Mod.ACT_Open) { ... }` — takes an argument list like a button: `action: nanoflow Mod.ACT_Ship($Order = $dgOrders)` |
 | Action arguments | every parameter needs one | A flow action with an unfilled parameter is **CE1571**. An enclosing data container of its type supplies it; a data grid's **control bar** does not (not row-scoped) — pass the grid's selection, `$dgOrders` |
 | Database source | `datasource: database entity` | `datagrid dg (datasource: database Module.Entity)` |
diff --git a/docs/11-proposals/PROPOSAL_structured_microflow_description.md b/docs/11-proposals/PROPOSAL_structured_microflow_description.md
index 5188e491a7..cfded08877 100644
--- a/docs/11-proposals/PROPOSAL_structured_microflow_description.md
+++ b/docs/11-proposals/PROPOSAL_structured_microflow_description.md
@@ -6,14 +6,22 @@ date: 2026-08-20
 
 # Proposal: Structured description of irreducible microflow graphs
 
-**Status:** Partial — Phase 0 (detector, `MDL-FLOW01`, describe-time warning) and
+**Status:** Partial — Phase 0 (detector, `MDL-FLOW01`, describe-time warning),
 **Phase E** (`merge`/`join`, both authoring and DESCRIBE, for error-path rejoins)
-are shipped; the prevalence scan that gates the rest is
-[measured below](#measured-2026-09-12) and selects Mode 3. Mode 2 for the
-*non*-error irreducible graphs — crossed branches with no error handler — is the
-remaining piece: those still describe to flattened MDL with the MDL-FLOW01
-warning. Phases 1–2 otherwise unscheduled.
-**Date:** 2026-08-20 (scan: 2026-09-12; Phase E: 2026-09-13)
+and **Mode 3** (`DESCRIBE … NORMALIZED`, opt-in guard folding for recombinable
+graphs) are shipped; the prevalence scan that gates the rest is
+[measured below](#measured-2026-09-12) and selects Mode 3, which the scan called
+the class most irreducible graphs fall into.
+
+**Mode 2 for the *non*-error irreducible graphs remains the open piece.** Mode 3
+covers them only when the caller opts in *and* the region folds; the DEFAULT
+rendering of a crossed graph is still flattened MDL with the MDL-FLOW01 warning,
+and an interleaved graph has no faithful rendering at all. Phases 1–2 otherwise
+unscheduled. One
+[known limitation](#known-limitation-a-merge-outside-both-described-forms-is-dropped)
+is open but now reported: a merge that is neither an error rejoin nor an
+`if`/`else` join is dropped by a describe → exec round trip, and DESCRIBE warns.
+**Date:** 2026-08-20 (scan: 2026-09-12; Phase E, the runtime measurements and Mode 3: 2026-09-13)
 
 `DESCRIBE MICROFLOW` renders a microflow's control flow as nested `if/then/else`.
 That works only for graphs that are *properly nested*. A Mendix microflow is an
@@ -183,7 +191,35 @@ Properties:
   `check` error, not a guess. (See Open Questions — the permissive alternative is
   viable and cheaper for hand-authors.)
 
-### Mode 3 — normalized (opt-in)
+### Mode 3 — normalized (opt-in) — SHIPPED 2026-09-13
+
+Implementation notes, where they differ from the sketch below:
+
+- **It is not a second describer.** `normalizeCollection` rewrites a *copy* of
+  the graph into the equivalent properly-nested one and hands that to the
+  existing describer, so Mode 3 inherits every activity renderer, annotation and
+  layout rule and cannot drift from Mode 1.
+- **The folded split keeps its identity** — same `$ID`, position and annotations
+  — but its stored `Caption` is cleared: it labels the *original* guard, and
+  leaving it puts a second, wrong condition in the more prominent place.
+- **The entry merge is spliced out.** After folding it has one predecessor and
+  one successor, and describe → exec would delete it anyway; removing it in the
+  transform makes Mode 3's output describe exactly the graph re-executing it
+  builds.
+- **Refusals are per-decision and explained**, and the rest of the microflow
+  still renders: an activity in the region (would move a side effect), a
+  rule-based decision (a rule call cannot go inside an expression), and
+  interleaved branches.
+- **Verified behaviourally, not just algebraically.** `microflownorm`'s
+  simplifier is checked against truth tables over 3000 generated formulas (with
+  a deliberately broken rewrite rule as the control), and the whole pipeline
+  against a **real runtime**: the original graph and the microflow rebuilt from
+  its normalized description return the same value for all four inputs
+  (`mdl-examples/bug-tests/923-normalized-describe{,.test}.mdl`). The two
+  `$A = false` rows are exactly the ones the flattened Mode 1 rendering gets
+  wrong.
+
+The original sketch:
 
 Recombine guards into an equivalent nested form. For the reporter's graph,
 `¬c1 ∨ (c1 ∧ c2)` simplifies to `¬c1 ∨ c2` and the whole microflow collapses to:
@@ -513,26 +549,96 @@ every supported version; this is a describe/parse-side concern. No entry in
 - **`mx check`** — every generated form at 0 errors.
 - **Runtime (Phase 2 only)** — the short-circuit question above, settled by
   booting an app and observing whether an erroring right operand is evaluated.
-- **Fixtures** — `mdl-examples/bug-tests/923-irreducible-microflow-graph.mdl`.
+  **Done** (2026-09-13): both operators short-circuit. Any such runtime probe
+  needs the positive control that forces the right operand to be reached —
+  otherwise a pass is explained just as well by the probe never throwing.
+- **Fixtures** — `mdl-examples/bug-tests/923-irreducible-microflow-graph.mdl`;
+  `923-short-circuit-semantics{,.test}.mdl` (shipped).
 
 ## Open Questions
 
-1. **Short-circuit semantics of `and`/`or`** — undocumented; blocks Mode 3. Settle
-   on a runtime before designing further.
-2. **Fall-through into a `merge`** — this proposal requires an explicit terminator.
-   The permissive alternative (fall-through means an implicit `join` to the next
-   declared merge) is friendlier to hand-authors and shorter to read, at the cost
-   of ambiguity in exactly the construct that exists to remove ambiguity.
-3. **`normalized` as an MDL modifier vs a CLI flag.** The modifier keeps it in the
-   language and works in the REPL; a flag keeps a rendering option out of the
-   grammar. No existing `DESCRIBE` modifier sets precedent.
-4. **`canon.TransplantIDs` on unnamed merges** — measure whether merge `$ID`s
-   survive a describe → exec round-trip, or whether positional matching churns
-   them. Affects whether Phase 1 output is genuinely idempotent.
-5. **Verb choice** — `join <name>` vs `goto <name>`. `join` matches Mendix's own
-   vocabulary and ADR-0003; `goto` is more immediately obvious to a developer and
-   was the reporter's own instinct in the issue discussion.
-6. **Loops.** This proposal addresses acyclic split/merge structure. Retry loops
-   (issue #281) already make the flow graph cyclic and are handled by separate
-   pass-through logic; whether the detector needs to exclude back-edges explicitly
-   is unverified.
+None outstanding.
+
+### Settled
+
+- **`normalized` as an MDL modifier vs a CLI flag** (was Q3) — shipped as the
+  **modifier**, `DESCRIBE MICROFLOW Module.Name NORMALIZED`. It keeps the option
+  in the language, so it works in the REPL and in a script, and it is what this
+  proposal's own examples were written as. `NORMALIZED` is registered in
+  `keyword` as well as the lexer, so an element called "normalized" still
+  parses — the same treatment `MERGE` needed.
+
+- **Short-circuit semantics of `and`/`or`** (was Q1, blocked Mode 3) — **both
+  short-circuit**, so folding a guard does not introduce an evaluation the
+  original avoided and **Mode 3 is unblocked**. Measured on Mendix 11.14.0 on a
+  local runtime, 2026-09-13; fixtures
+  `mdl-examples/bug-tests/923-short-circuit-semantics{,.test}.mdl`.
+
+  The probe is integer division by zero in the right operand — the only
+  observable an expression can have, Mendix expressions being pure. What makes
+  it a measurement rather than an assumption is the pair of **positive
+  controls**: two tests that force the right operand to be reached and therefore
+  must throw. Without them, the short-circuit tests passing is equally well
+  explained by `1 div 0` being harmless, which would say nothing about
+  evaluation order. Both operands read microflow *parameters*, not literals, so
+  mxbuild cannot constant-fold the expression and turn the measurement into one
+  of its own folding.
+
+  This removes the restriction the proposal contemplated ("if `or` turns out to
+  be eager, Mode 3 is restricted to conditions proven total, or dropped"). The
+  *purity and ordering* precondition is untouched and still applies: the region
+  being folded must contain only splits and merges.
+
+- **Fall-through into a `merge`** (was Q2) — settled **permissive** when Phase E
+  shipped: a path that has already ended (`return`, `throw`, `join`) does not
+  fall through into a following `merge`, but an ordinary path does. The
+  ambiguity the strict form guarded against turned out to sit elsewhere — a
+  *terminated* path emitting a duplicate edge into a following merge — and that
+  is what is enforced.
+
+- **`canon.TransplantIDs` on unnamed merges** (was Q4) — **IDs survive**;
+  positional matching does not churn them, and Phase E's output is genuinely
+  idempotent. Measured 2026-09-13 on Mendix 11.14.0 four ways, each stronger
+  than the last: re-exec of identical MDL (write elided, `Unchanged
+  microflow`); a **forced write** under `MXCLI_ALWAYS_WRITE=1` (`Replaced` — so
+  elision is bypassed and the transplant is what preserves the IDs); a
+  describe → exec round trip; and an edit inserting an activity *before* the
+  merges, shifting every position. The forced-write run is the load-bearing one:
+  without it a passing test only shows the write was skipped.
+
+- **Verb choice** (was Q5) — `join`, shipped in Phase E.
+
+- **Loops** (was Q6) — a retry loop is expressible as a **backward `join`** to a
+  `merge` declared earlier, which is what Phase E's forward-and-backward label
+  resolution is for. `merge`/`join` inside a `loop`/`while` *body* is refused
+  (MDL-FLOW04): a `LoopedActivity` owns its own object collection and a sequence
+  flow cannot leave it, so there is no graph to build.
+
+## Known limitation: a merge outside both described forms is dropped
+
+`labelRejoinMerges` labels only the merges an error handler reaches *and* the
+normal path also reaches. Every other merge is left to the nested describer,
+which represents an `if`/`else` join implicitly and **walks straight through a
+merge with a single incoming path without representing it at all**. Such a merge
+is therefore deleted by a describe → exec round trip, silently — no
+`MDL-FLOW01`, no warning on exec, just `Replaced microflow` one node lighter.
+
+Measured 2026-09-13: a microflow authored with two merges (one a 2-input error
+rejoin, one a 1-input pass-through) describes to **one** `merge`, and executing
+that output leaves the model with one. The ordinary `if`/`else` merge is
+unaffected and round-trips with its `$ID` intact and the write elided.
+
+This predates `merge`/`join` — `DESCRIBE` never emitted merges before, so a
+Studio Pro-authored 1-input merge has always been dropped — but Phase E makes it
+reachable from MDL, so a user can now write `MERGE done;` and have their own
+syntax disappear on the next round trip. It is behaviourally harmless (a 1-input
+merge is a no-op) and does **not** affect the Phase E fixpoint claim: describe →
+exec → describe converges after one step (verified D1 = D2 = D3). The loss is on
+the first step, from the *authored graph* to D1.
+
+Deleting a node the user drew is what guard-don't-drop exists to prevent, so the
+candidate remedies are a **describe-time warning** when an `ExclusiveMerge` is
+not represented in the output (cheap, no behaviour change, consistent with
+MDL-FLOW01 warning rather than silently flattening) or emitting a label for every
+unrepresented merge (more faithful, noisier on every describe of a real
+microflow). Undecided.
diff --git a/mdl-examples/bug-tests/1056-widget-slot-as-property-value.fail.mdl b/mdl-examples/bug-tests/1056-widget-slot-as-property-value.fail.mdl
new file mode 100644
index 0000000000..0f9740c477
--- /dev/null
+++ b/mdl-examples/bug-tests/1056-widget-slot-as-property-value.fail.mdl
@@ -0,0 +1,42 @@
+-- mendixlabs/mxcli#1056 — a container-typed widget property written as a VALUE.
+--
+-- This file is expected to FAIL `mxcli check` (.fail.mdl). Every statement below
+-- is a spelling that used to pass check, exec successfully, and write nothing.
+--
+-- The reporter arrived here because the slot syntax their own generated widget
+-- docs showed was rejected by the parser. That half is fixed — the grammar takes
+-- generic container names since bca5466e, so `customallselected s1 { … }` now
+-- parses, execs, and produces the same five CustomWidgets$WidgetProperty entries
+-- Studio Pro writes. What remained was that the WRONG spelling stayed silent:
+--
+--   customAllSelected: []   ->  check clean, exec "Created page", 0 properties
+--                               written, then 3x CE0642 at build time because
+--                               the slot is required.
+--
+-- #999 fixed the `[(k: v)]` shape. It keyed on there being at least one
+-- parenthesised entry, so the empty and scalar forms fell through the same hole.
+--
+-- Expected: MDL-WIDGET27 (error) on each of the three widgets below.
+
+-- 1. Empty list on a widgets-typed CHILD SLOT — the reporter's exact form.
+create or replace page BugTest1056.EmptySlot (Title: 'Empty slot', Layout: Atlas_Core.Atlas_Default) {
+  pluggablewidget 'com.mendix.widget.web.selectionhelper.SelectionHelper' sh1 (
+    renderStyle: 'custom',
+    customAllSelected: []
+  )
+}
+
+-- 2. Empty list on an OBJECT LIST. Same hole, reached from the #999 side.
+create or replace page BugTest1056.EmptyList (Title: 'Empty list', Layout: Atlas_Core.Atlas_Default) {
+  htmlelement frame1 (tagName: 'div', attributes: [])
+}
+
+-- 3. A scalar on a child slot. No value in a property list can reach a property
+-- that holds child widgets; this one is only knowable from the definition, so it
+-- is reported when the widget resolves and stays silent without a project.
+create or replace page BugTest1056.ScalarSlot (Title: 'Scalar slot', Layout: Atlas_Core.Atlas_Default) {
+  pluggablewidget 'com.mendix.widget.web.selectionhelper.SelectionHelper' sh2 (
+    renderStyle: 'custom',
+    customAllSelected: 'something'
+  )
+}
diff --git a/mdl-examples/bug-tests/1059-widget-icon-elements.mdl b/mdl-examples/bug-tests/1059-widget-icon-elements.mdl
new file mode 100644
index 0000000000..81bad527d6
--- /dev/null
+++ b/mdl-examples/bug-tests/1059-widget-icon-elements.mdl
@@ -0,0 +1,77 @@
+-- ============================================================================
+-- mendixlabs/mxcli#1059 — a widget's three icon ELEMENTS
+-- ============================================================================
+--
+-- Mendix stores three different icon elements on a button, and they are not
+-- three spellings of one value:
+--
+--   Forms$IconCollectionIcon{Image}  -> a CustomIcons$CustomIcon
+--   Forms$ImageIcon{Image}           -> an Images$Image  (a DIFFERENT document)
+--   Forms$GlyphIcon{Code}            -> a font code point, with no name at all
+--
+-- The two named kinds are spelled identically, so only the keyword separates
+-- them. Writing an image reference without `image` stores a custom-icon
+-- reference, and the build says:
+--
+--   [error] [CE1613] "The selected custom icon
+--   'MyFirstModule.Images.workflow' no longer exists." at Action button 'btnImage'
+--
+-- Measured on 11.13.0: this script builds at 0 errors and `mxbuild
+-- --target=deploy` SUCCEEDS, while the same script with `image` dropped from
+-- line "btnImage" produces exactly that CE1613.
+--
+-- `mxcli check --references` now catches it before anything is written, and
+-- names the remedy rather than reporting a correct name as a typo.
+-- ============================================================================
+
+-- MARK: Setup
+
+create or modify image collection IconProbe.Images (
+  image marker from file '../../docs/images/mxcli-cli.png'
+);
+
+-- MARK: The three icon elements
+
+create or replace page IconProbe.AllThreeIcons (
+  Title: 'Icon probe',
+  Layout: Atlas_Core.Atlas_Default
+) {
+  container cMain {
+    -- The bare form is the icon-collection icon. It has meant that since #602
+    -- and still does, so no existing script changes meaning.
+    actionbutton btnCollection (Caption: 'Collection',
+      Action: NOTHING,
+      Icon: 'Atlas_Core.Atlas_Filled.pencil')
+
+    -- `image` points into an IMAGE collection. Same shape of name as the line
+    -- above, different document — this is the one the issue reported.
+    actionbutton btnImage (Caption: 'Image',
+      Action: NOTHING,
+      Icon: image IconProbe.Images.marker)
+
+    -- A glyph carries a code and NO name, which is why one string could never
+    -- express all three. Codes are sparse: MDL078 checks this one against the
+    -- font's own table, because an undefined code fails only at
+    -- `mxbuild --target=deploy`, naming the page rather than the icon.
+    actionbutton btnGlyph (Caption: 'Glyph',
+      Action: NOTHING,
+      Icon: glyph 57377)
+  }
+}
+
+-- A reference into the model may also be written unquoted, as every other
+-- reference is (ADR-0003). Atlas icon names are hyphenated and IDENTIFIER
+-- cannot lex a hyphen, so that segment is double-quoted on its own.
+create or replace page IconProbe.UnquotedIconNames (
+  Title: 'Unquoted icon names',
+  Layout: Atlas_Core.Atlas_Default
+) {
+  container cMain {
+    actionbutton btnBare (Caption: 'Bare',
+      Action: NOTHING,
+      Icon: Atlas_Core.Atlas_Filled.pencil)
+    actionbutton btnHyphenated (Caption: 'Hyphenated',
+      Action: NOTHING,
+      Icon: Atlas_Core.Atlas."align-center")
+  }
+}
diff --git a/mdl-examples/bug-tests/923-normalized-describe.mdl b/mdl-examples/bug-tests/923-normalized-describe.mdl
new file mode 100644
index 0000000000..c4e779a0e8
--- /dev/null
+++ b/mdl-examples/bug-tests/923-normalized-describe.mdl
@@ -0,0 +1,50 @@
+-- ============================================================================
+-- Mode 3: DESCRIBE ... NORMALIZED on the #923 graph
+-- ============================================================================
+--
+-- MF_Orig is mendixlabs/mxcli#923's graph: an inner split's branch lands where
+-- an outer split's branch lands, so the branches cross and no nesting of IF
+-- reproduces them.
+--
+--   split1 : true -> split2      false -> merge1
+--   split2 : true -> merge1      false -> merge2
+--
+-- The activity on merge1 runs on `not($A) or $B`. The DEFAULT description
+-- renders it as `$A and $B` and warns (MDL-FLOW01) -- with the reporter's own
+-- expressions, a program that always logged described as one that never did.
+--
+--   mxcli -p app.mpr -c "describe microflow Mode3.MF_Orig"             -- $A and $B
+--   mxcli -p app.mpr -c "describe microflow Mode3.MF_Orig normalized"  -- $B or not($A)
+--
+-- $Result is what makes the difference observable: it distinguishes the two
+-- renderings on the (false, *) rows, which is what
+-- 923-normalized-describe.test.mdl asserts against a real runtime by comparing
+-- MF_Orig with the microflow rebuilt from the normalized output.
+--
+-- Run it:
+--   mxcli exec mdl-examples/bug-tests/923-normalized-describe.mdl -p app.mpr
+--   mxcli -p app.mpr -c "describe microflow Mode3.MF_Orig normalized" \
+--     | sed 's/MF_Orig/MF_Norm/' > /tmp/norm.mdl
+--   mxcli exec /tmp/norm.mdl -p app.mpr
+--   mxcli test mdl-examples/bug-tests/923-normalized-describe.test.mdl -p app.mpr --local
+
+CREATE MODULE Mode3;
+/
+CREATE OR REPLACE MICROFLOW Mode3.MF_Orig (A: Boolean, B: Boolean) RETURNS String
+BEGIN
+  DECLARE $Result String = 'skipped';
+  IF $A THEN
+    IF $B THEN
+      JOIN m1;
+    ELSE
+      JOIN m2;
+    END IF;
+  ELSE
+    JOIN m1;
+  END IF;
+  MERGE m1;
+  SET $Result = 'ran';
+  JOIN m2;
+  MERGE m2;
+  RETURN $Result;
+END;
diff --git a/mdl-examples/bug-tests/923-normalized-describe.test.mdl b/mdl-examples/bug-tests/923-normalized-describe.test.mdl
new file mode 100644
index 0000000000..3a1da5d329
--- /dev/null
+++ b/mdl-examples/bug-tests/923-normalized-describe.test.mdl
@@ -0,0 +1,41 @@
+/**
+ * Mode 3 must preserve BEHAVIOUR, not merely produce a plausible formula.
+ *
+ * MF_Orig is the #923 graph (an inner split's branch landing where an outer
+ * split's branch lands); MF_Norm is what `describe ... normalized` emitted for
+ * it, executed back. Their return value differs exactly when the shared suffix
+ * runs, so comparing it over all four inputs is a complete truth table.
+ *
+ * Mode 1 renders MF_Orig as `$A and $B`, so the (false, *) rows are the ones
+ * that would fail against the flattened description — they are the bug.
+ *
+ * @test A=true  B=true  -> both run the shared suffix
+ * @expect $orig = 'ran' and $norm = 'ran'
+ */
+$orig = call microflow Mode3.MF_Orig(A = true, B = true);
+$norm = call microflow Mode3.MF_Norm(A = true, B = true);
+/
+
+/**
+ * @test A=true  B=false -> both skip it
+ * @expect $orig = 'skipped' and $norm = 'skipped'
+ */
+$orig = call microflow Mode3.MF_Orig(A = true, B = false);
+$norm = call microflow Mode3.MF_Norm(A = true, B = false);
+/
+
+/**
+ * @test A=false B=true  -> both run it (Mode 1 would say skipped)
+ * @expect $orig = 'ran' and $norm = 'ran'
+ */
+$orig = call microflow Mode3.MF_Orig(A = false, B = true);
+$norm = call microflow Mode3.MF_Norm(A = false, B = true);
+/
+
+/**
+ * @test A=false B=false -> both run it (Mode 1 would say skipped)
+ * @expect $orig = 'ran' and $norm = 'ran'
+ */
+$orig = call microflow Mode3.MF_Orig(A = false, B = false);
+$norm = call microflow Mode3.MF_Norm(A = false, B = false);
+/
diff --git a/mdl-examples/bug-tests/923-short-circuit-semantics.mdl b/mdl-examples/bug-tests/923-short-circuit-semantics.mdl
new file mode 100644
index 0000000000..6c34c70c8f
--- /dev/null
+++ b/mdl-examples/bug-tests/923-short-circuit-semantics.mdl
@@ -0,0 +1,52 @@
+-- ============================================================================
+-- Do Mendix `and` / `or` short-circuit? Measured, not reasoned about.
+-- ============================================================================
+--
+-- Open Question 1 of PROPOSAL_structured_microflow_description.md. Mode 3 of
+-- that proposal folds the guards of nested exclusive splits into one condition
+-- -- `c1 and c2` on nested splits becomes `not(c1) or c2` -- which is only
+-- semantics-preserving if the right operand is NOT evaluated once the left has
+-- decided the result. Mendix's reference guide documents both operators
+-- WITHOUT stating whether they short-circuit, so the question could not be
+-- settled from the docs.
+--
+-- The probe is integer division by zero in the right operand: the only
+-- observable an expression can have is whether it throws, since Mendix
+-- expressions are pure and cannot carry a side effect.
+--
+-- Both operands read microflow PARAMETERS rather than literals. That is
+-- deliberate: `1 div 0` written literally could be folded at build time, and a
+-- folded expression would measure mxbuild's constant folding instead of the
+-- runtime's evaluation order.
+--
+-- Run it:
+--   mxcli exec mdl-examples/bug-tests/923-short-circuit-semantics.mdl -p app.mpr
+--   mxcli test mdl-examples/bug-tests/923-short-circuit-semantics.test.mdl \
+--     -p app.mpr --local
+--
+-- Result (Mendix 11.14.0, local runtime, 2026-09-13): BOTH short-circuit.
+-- The two CONTROL tests in the .test.mdl are what make that a measurement
+-- rather than an assumption -- see the header there.
+
+create module ShortCircuit;
+/
+
+create or replace microflow ShortCircuit.MF_ScOr (Guard: Boolean, Zero: Integer) returns String
+begin
+  if $Guard or (1 div $Zero > 0) then
+    return 'taken';
+  else
+    return 'not taken';
+  end if;
+end;
+/
+
+create or replace microflow ShortCircuit.MF_ScAnd (Guard: Boolean, Zero: Integer) returns String
+begin
+  if $Guard and (1 div $Zero > 0) then
+    return 'taken';
+  else
+    return 'not taken';
+  end if;
+end;
+/
diff --git a/mdl-examples/bug-tests/923-short-circuit-semantics.test.mdl b/mdl-examples/bug-tests/923-short-circuit-semantics.test.mdl
new file mode 100644
index 0000000000..0a78bc2a22
--- /dev/null
+++ b/mdl-examples/bug-tests/923-short-circuit-semantics.test.mdl
@@ -0,0 +1,42 @@
+/**
+ * Do Mendix `and` / `or` short-circuit? Open Question 1 of
+ * PROPOSAL_structured_microflow_description.md, which blocks Mode 3.
+ *
+ * Setup: run 923-short-circuit-semantics.mdl against the project first.
+ *
+ * Tests 1 and 3 are POSITIVE CONTROLS. They force the right operand to be
+ * reached, so they MUST throw. Without them a pass on tests 2 and 4 is
+ * worthless: it would be equally well explained by division by zero being
+ * harmless in Mendix, which would say nothing at all about evaluation order.
+ * The controls are the difference between measuring short-circuiting and
+ * measuring nothing.
+ *
+ * Measured on Mendix 11.14.0 (local runtime, 2026-09-13): all four pass, so
+ * both operators short-circuit.
+ *
+ * @test CONTROL or right operand reached so division by zero throws
+ * @throws
+ */
+$result = call microflow ShortCircuit.MF_ScOr(Guard = false, Zero = 0);
+/
+
+/**
+ * @test or short circuits when the left operand is true
+ * @expect $result = 'taken'
+ */
+$result = call microflow ShortCircuit.MF_ScOr(Guard = true, Zero = 0);
+/
+
+/**
+ * @test CONTROL and right operand reached so division by zero throws
+ * @throws
+ */
+$result = call microflow ShortCircuit.MF_ScAnd(Guard = true, Zero = 0);
+/
+
+/**
+ * @test and short circuits when the left operand is false
+ * @expect $result = 'not taken'
+ */
+$result = call microflow ShortCircuit.MF_ScAnd(Guard = false, Zero = 0);
+/
diff --git a/mdl/ast/ast_page_v3.go b/mdl/ast/ast_page_v3.go
index 8c90ad4d7a..39cde3ce6a 100644
--- a/mdl/ast/ast_page_v3.go
+++ b/mdl/ast/ast_page_v3.go
@@ -2,7 +2,11 @@
 
 package ast
 
-import "strings"
+import (
+	"strings"
+
+	"github.com/mendixlabs/mxcli/mdl/types"
+)
 
 // =============================================================================
 // V3 Page AST Types
@@ -126,6 +130,30 @@ type WidgetV3 struct {
 	TypeIsGeneric bool
 }
 
+// WidgetIcon is the value of a widget's `Icon:` property.
+//
+// It is a struct rather than a string because Mendix stores three different
+// icon ELEMENTS and they are not variants of one value: an icon-collection icon
+// and an image icon each hold a qualified name — into an icon collection and an
+// image collection, which are different documents — while a glyph icon holds a
+// numeric character code and no name at all. A single string could express only
+// one of the three, which is how a stored image icon was rewritten as a
+// custom-icon reference and a glyph icon was deleted outright
+// (mendixlabs/mxcli#1059).
+//
+// The vocabulary is types.MenuIconKind, shared with navigation rather than
+// restated: the kinds are Mendix's, not navigation's, and a second copy of the
+// mapping is the drift this fix exists to remove.
+type WidgetIcon struct {
+	// Kind says which of the three elements to write. Never MenuIconNone on a
+	// value the visitor produced — an absent `Icon:` has no WidgetIcon at all.
+	Kind types.MenuIconKind
+	// Name is the qualified name, for the collection and image kinds.
+	Name string
+	// Code is the glyph's numeric character code, set only for MenuIconGlyph.
+	Code int
+}
+
 // ObjectEntryListV3 is `[(k: v, …), …]` written as a widget property VALUE —
 // a repeatable widget property (FileUploader `allowedFileFormats`, HTML Element
 // `attributes`) spelled the way a JSON author would reach for.
diff --git a/mdl/ast/ast_query.go b/mdl/ast/ast_query.go
index f9fb007194..3cdfaae337 100644
--- a/mdl/ast/ast_query.go
+++ b/mdl/ast/ast_query.go
@@ -302,6 +302,13 @@ type DescribeStmt struct {
 	// the code or name of a GLYPH (a glyph has no qualified name — it is a
 	// character code in a font, not an element in the project).
 	Qualifier string
+	// Normalized selects Mode 3 for DESCRIBE MICROFLOW: an irreducible but
+	// recombinable graph is rendered by folding the branch guards into one
+	// condition instead of being flattened. Opt-in because the output
+	// re-executes to a DIFFERENT graph — equivalent behaviour, fewer nodes —
+	// and silently reshaping someone's diagram because they asked to read it
+	// is its own guard-don't-drop violation.
+	Normalized bool
 }
 
 func (s *DescribeStmt) isStatement() {}
diff --git a/mdl/backend/modelsdk/widget_icon_test.go b/mdl/backend/modelsdk/widget_icon_test.go
new file mode 100644
index 0000000000..80a86dbfac
--- /dev/null
+++ b/mdl/backend/modelsdk/widget_icon_test.go
@@ -0,0 +1,112 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package modelsdkbackend
+
+import (
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/types"
+	"github.com/mendixlabs/mxcli/modelsdk/codec"
+	"github.com/mendixlabs/mxcli/sdk/pages"
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+// iconToGen emitted Forms$IconCollectionIcon unconditionally, which was fine
+// while that was also the only icon anyone could author, and wrong the moment
+// DESCRIBE started reading real projects: a stored image icon round-tripped into
+// a custom-icon reference and failed the build with CE1613
+// (mendixlabs/mxcli#1059).
+//
+// These assert on the ENCODED document rather than on the struct, because the
+// defect was entirely in what reached BSON — the model carried the right thing
+// the whole time.
+func TestIconToGen_EncodesEachElement(t *testing.T) {
+	cases := []struct {
+		name      string
+		icon      *pages.Icon
+		wantType  string
+		wantImage string
+		wantCode  int32
+	}{{
+		name:      "collection",
+		icon:      &pages.Icon{Kind: types.MenuIconCollection, Image: "Atlas_Core.Atlas_Filled.pencil"},
+		wantType:  "Forms$IconCollectionIcon",
+		wantImage: "Atlas_Core.Atlas_Filled.pencil",
+	}, {
+		// The reported case. Identical spelling to the row above, different
+		// document — so only the kind can separate them.
+		name:      "image",
+		icon:      &pages.Icon{Kind: types.MenuIconImage, Image: "DesignSystem.Icons_SVG.edit"},
+		wantType:  "Forms$ImageIcon",
+		wantImage: "DesignSystem.Icons_SVG.edit",
+	}, {
+		name:     "glyph",
+		icon:     &pages.Icon{Kind: types.MenuIconGlyph, Code: 57377},
+		wantType: "Forms$GlyphIcon",
+		wantCode: 57377,
+	}}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			el := iconToGen(tc.icon)
+			if el == nil {
+				t.Fatal("no icon element was built")
+			}
+			encoded, err := (&codec.Encoder{}).Encode(el)
+			if err != nil {
+				t.Fatalf("encode: %v", err)
+			}
+			raw := bson.Raw(encoded)
+			if got := lookupString(t, raw, "$Type"); got != tc.wantType {
+				t.Errorf("$Type = %q, want %q", got, tc.wantType)
+			}
+			if tc.wantImage != "" {
+				if got := lookupString(t, raw, "Image"); got != tc.wantImage {
+					t.Errorf("Image = %q, want %q", got, tc.wantImage)
+				}
+			}
+			if tc.wantCode != 0 {
+				val, err := raw.LookupErr("Code")
+				if err != nil {
+					t.Fatalf("no Code on a glyph icon — the only thing identifying it: %v", err)
+				}
+				got, ok := val.Int32OK()
+				if !ok {
+					t.Fatalf("Code is %v, want an int32", val.Type)
+				}
+				if got != tc.wantCode {
+					t.Errorf("Code = %d, want %d", got, tc.wantCode)
+				}
+			}
+		})
+	}
+}
+
+// CONTROL: an icon that identifies nothing produces no element at all, rather
+// than one nobody can see. A bare Forms$GlyphIcon builds at 0 errors and renders
+// nothing, so this failure would otherwise be invisible.
+func TestIconToGen_AnIconIdentifyingNothingBuildsNoElement(t *testing.T) {
+	for _, icon := range []*pages.Icon{
+		{Kind: types.MenuIconGlyph},
+		{Kind: types.MenuIconImage},
+		{Kind: types.MenuIconCollection},
+		{Kind: types.MenuIconKind("Forms$SomeFuture")},
+	} {
+		if el := iconToGen(icon); el != nil {
+			t.Errorf("%+v built an element, want none", icon)
+		}
+	}
+}
+
+func lookupString(t *testing.T, raw bson.Raw, key string) string {
+	t.Helper()
+	val, err := raw.LookupErr(key)
+	if err != nil {
+		t.Fatalf("no %s on the icon element: %v", key, err)
+	}
+	s, ok := val.StringValueOK()
+	if !ok {
+		t.Fatalf("%s is not a string", key)
+	}
+	return s
+}
diff --git a/mdl/backend/modelsdk/widget_write.go b/mdl/backend/modelsdk/widget_write.go
index 49e4f99dd7..242dac4242 100644
--- a/mdl/backend/modelsdk/widget_write.go
+++ b/mdl/backend/modelsdk/widget_write.go
@@ -8,6 +8,7 @@ import (
 
 	"go.mongodb.org/mongo-driver/bson"
 
+	"github.com/mendixlabs/mxcli/mdl/types"
 	"github.com/mendixlabs/mxcli/model"
 	"github.com/mendixlabs/mxcli/modelsdk/codec"
 	"github.com/mendixlabs/mxcli/modelsdk/element"
@@ -430,8 +431,13 @@ func widgetToGen(w pages.Widget) (element.Element, error) {
 		// Pro's loader rejects a ClientTemplate here with a type-cast error.
 		g.SetTooltip(captionToGen(x.Tooltip))
 		// Icon (issue #602): overrides the null-Icon TypeDefault when set.
+		// iconToGen returns nil for an icon that identifies nothing, and that nil
+		// must not be handed to SetIcon — a typed nil there is an Icon property
+		// holding a broken element rather than the null the TypeDefault gives.
 		if x.Icon != nil {
-			g.SetIcon(iconToGen(x.Icon))
+			if icon := iconToGen(x.Icon); icon != nil {
+				g.SetIcon(icon)
+			}
 		}
 		act, err := clientActionToGen(x.Action)
 		if err != nil {
@@ -997,12 +1003,44 @@ func noActionGen() element.Element {
 	return a
 }
 
-// iconToGen builds a widget Icon element. Currently supports the modern
-// icon-collection icon (Atlas icons): Forms$IconCollectionIcon{Image: QN},
-// verified against a Studio-Pro-authored button (issue #602). It has no typed
-// gen struct, so it is built as a raw element (like the workflow simple activities).
+// iconToGen builds a widget Icon element — one of Mendix's three, dispatched on
+// the kind rather than inferred from the payload.
+//
+//	Forms$IconCollectionIcon{Image: QN} -> a CustomIcons$CustomIcon
+//	Forms$ImageIcon{Image: QN}          -> an Images$Image (a DIFFERENT document)
+//	Forms$GlyphIcon{Code: int}          -> a font code point, with no name
+//
+// This emitted the first unconditionally, which was fine while it was also the
+// only one anyone could author and wrong the moment DESCRIBE started reading
+// real projects: a stored image icon round-tripped into a custom-icon reference
+// and failed the build with CE1613 (mendixlabs/mxcli#1059). The two named kinds
+// are indistinguishable by payload, so nothing but the carried kind can tell
+// them apart.
+//
+// Verified against a Studio-Pro-authored button (issue #602). None has a typed
+// gen struct, so they are built as raw elements (like the workflow simple
+// activities).
 func iconToGen(ic *pages.Icon) element.Element {
-	e := newElem("Forms$IconCollectionIcon", "")
+	storage := types.MenuIconStorageType(ic.Kind)
+	if storage == "" {
+		// A kind this build does not know. Emitting SOME icon would be guessing
+		// between variants, which is the failure that produces a document
+		// Studio Pro cannot open; the builder refuses such an icon before here.
+		return nil
+	}
+	e := newElem(storage, "")
+	if ic.Kind == types.MenuIconGlyph {
+		// A glyph with no code identifies no glyph. Emit no icon rather than an
+		// element nobody can see.
+		if ic.Code == 0 {
+			return nil
+		}
+		addInt32(e, "Code", int32(ic.Code))
+		return e
+	}
+	if ic.Image == "" {
+		return nil
+	}
 	addStr(e, "Image", ic.Image)
 	return e
 }
diff --git a/mdl/catalog/builder.go b/mdl/catalog/builder.go
index eb14751e23..1e8560cb53 100644
--- a/mdl/catalog/builder.go
+++ b/mdl/catalog/builder.go
@@ -4,6 +4,7 @@ package catalog
 
 import (
 	"fmt"
+	"strconv"
 	"strings"
 	"time"
 
@@ -600,6 +601,19 @@ func (b *Builder) Build(progress ProgressFunc) error {
 		return fmt.Errorf("failed to commit transaction: %w", err)
 	}
 	tx = nil // Prevent rollback in defer
+
+	// Same flag AddGraphAnalysis writes, for the build-it-in-one-pass route.
+	// Both routes must set it or an empty cycles table stays ambiguous down
+	// whichever one the caller took (mendixlabs/mxcli#1060).
+	if b.communitiesMode {
+		if err := b.catalog.SetMeta(MetaGraphAnalysis, time.Now().Format(time.RFC3339)); err != nil {
+			return err
+		}
+		if err := b.catalog.SetMeta(MetaGraphResolution,
+			strconv.FormatFloat(effectiveResolution(b.resolution), 'g', -1, 64)); err != nil {
+			return err
+		}
+	}
 	b.tx = nil
 
 	return nil
diff --git a/mdl/catalog/builder_graph.go b/mdl/catalog/builder_graph.go
index a0592ebd95..f02f77da4b 100644
--- a/mdl/catalog/builder_graph.go
+++ b/mdl/catalog/builder_graph.go
@@ -4,7 +4,10 @@ package catalog
 
 import (
 	"fmt"
+	"sort"
+	"strconv"
 	"strings"
+	"time"
 
 	"github.com/mendixlabs/mxcli/mdl/catalog/graph"
 )
@@ -21,10 +24,31 @@ var graphRefKinds = []string{
 	"schedule",
 }
 
+// graphRefKindsSQL renders graphRefKinds as a quoted SQL IN list, so the schema
+// and the edge loader below cannot disagree about what is in the analysis graph.
+func graphRefKindsSQL() string {
+	quoted := make([]string, len(graphRefKinds))
+	for i, k := range graphRefKinds {
+		quoted[i] = "'" + k + "'"
+	}
+	return strings.Join(quoted, ", ")
+}
+
 // betweennessNodeCap bounds the O(V*E) betweenness computation. Above it,
 // betweenness is skipped (PageRank/communities still run) to keep the pass fast.
 const betweennessNodeCap = 6000
 
+// effectiveResolution normalises the Leiden resolution. One function so the
+// value recorded in the cache is the value the pass actually used — recording
+// the caller's 0 would make a later re-run at "the same resolution" a different
+// run.
+func effectiveResolution(r float64) float64 {
+	if r <= 0 {
+		return 1.0
+	}
+	return r
+}
+
 // AddGraphAnalysis runs the graph-analysis pass (communities/cycles/layers/
 // centrality) on an already-built catalog WITHOUT re-parsing. The catalog must
 // already contain the refs table (built in full or source mode). This lets
@@ -33,6 +57,7 @@ const betweennessNodeCap = 6000
 // the source FTS data. The graph rows reuse the catalog's existing SnapshotId so
 // the snapshot-framed views resolve.
 func (c *Catalog) AddGraphAnalysis(resolution float64) error {
+	resolution = effectiveResolution(resolution)
 	var snapID string
 	if err := c.db.QueryRow("SELECT SnapshotId FROM snapshots ORDER BY rowid DESC LIMIT 1").Scan(&snapID); err != nil {
 		return fmt.Errorf("catalog has no snapshot (build full first): %w", err)
@@ -52,7 +77,17 @@ func (c *Catalog) AddGraphAnalysis(resolution float64) error {
 		_ = tx.Rollback()
 		return err
 	}
-	return tx.Commit()
+	if err := tx.Commit(); err != nil {
+		return err
+	}
+	// Record that the pass ran. An empty graph_cycles_data means "no cycles"
+	// only once this is set; before it, it means "never computed" — and the two
+	// were indistinguishable (mendixlabs/mxcli#1060). Written after the commit
+	// so the flag can never claim a pass that was rolled back.
+	if err := c.SetMeta(MetaGraphAnalysis, time.Now().Format(time.RFC3339)); err != nil {
+		return err
+	}
+	return c.SetMeta(MetaGraphResolution, strconv.FormatFloat(resolution, 'g', -1, 64))
 }
 
 // buildGraphAnalysis runs the pure-Go graph algorithms over the refs graph and
@@ -66,21 +101,26 @@ func (b *Builder) buildGraphAnalysis() error {
 	if err != nil {
 		return err
 	}
-	for _, tbl := range []string{"communities_data", "graph_cycles_data", "graph_layers_data", "graph_centrality_data"} {
+	for _, tbl := range []string{"communities_data", "graph_cycles_data", "graph_module_cycles_data", "graph_layers_data", "graph_centrality_data"} {
 		if _, err := b.tx.Exec("DELETE FROM " + tbl); err != nil {
 			return err
 		}
 	}
+	// The module pass runs on its own edge set (every reference kind), so it must
+	// not be gated on the STRUCTURAL one being non-empty — a project whose only
+	// cross-module references are navigational has an empty asset graph and a
+	// perfectly real module cycle, which is #1060's own Administration/Atlas_Core
+	// pair.
+	projectID, snapshotID := b.snapshotMeta()
+	if err := b.buildModuleCycles(projectID, snapshotID); err != nil {
+		return err
+	}
 	if len(edges) == 0 {
 		return nil
 	}
 
 	g := graph.New(edges)
-	projectID, snapshotID := b.snapshotMeta()
-	resolution := b.resolution
-	if resolution <= 0 {
-		resolution = 1.0
-	}
+	resolution := effectiveResolution(b.resolution)
 	// Communities.
 	comm := g.Communities(resolution)
 	commStmt, err := b.tx.Prepare(
@@ -159,15 +199,114 @@ func (b *Builder) buildGraphAnalysis() error {
 	return nil
 }
 
+// buildModuleCycles finds the modules that depend on each other, directly or
+// through a chain of other modules.
+//
+// Deliberately NOT derived from the asset-level SCCs above. Module A and module
+// B are in a cycle when A references B and B references A at all — through any
+// documents, which need form no cycle between themselves. That is the ordinary
+// shape of a module cycle, and reading graph_cycles for it is what produced
+// mendixlabs/mxcli#1060: the asset table was legitimately empty while
+// graph_module_coupling listed both directions of the same pair.
+//
+// Over every reference kind, matching graph_module_coupling — the table this one
+// is read beside — rather than the structural subset the clustering uses. A page
+// bound to a layout in another module really is a dependency of that module.
+func (b *Builder) buildModuleCycles(projectID, snapshotID string) error {
+	edges, kinds, err := b.loadModuleEdges()
+	if err != nil {
+		return err
+	}
+	if len(edges) == 0 {
+		return nil
+	}
+	g := graph.New(edges)
+	stmt, err := b.tx.Prepare(
+		`INSERT INTO graph_module_cycles_data (ModuleName, CycleId, CycleSize, RefKinds, ProjectId, SnapshotId) VALUES (?, ?, ?, ?, ?, ?)`)
+	if err != nil {
+		return err
+	}
+	defer stmt.Close()
+	for ci, comp := range g.Cycles() {
+		// The modules of this cycle, for deciding which of a module's outgoing
+		// kinds are the ones keeping the cycle alive.
+		inCycle := make(map[string]bool, len(comp))
+		for _, v := range comp {
+			inCycle[g.Name(v)] = true
+		}
+		for _, v := range comp {
+			name := g.Name(v)
+			var involved []string
+			for k := range kinds[name] {
+				// Only edges that stay inside the cycle: a module's references to
+				// the world outside it are not what makes it circular.
+				if kinds[name][k] != nil {
+					for target := range kinds[name][k] {
+						if inCycle[target] {
+							involved = append(involved, k)
+							break
+						}
+					}
+				}
+			}
+			sort.Strings(involved)
+			if _, err := stmt.Exec(name, ci, len(comp), strings.Join(involved, ","), projectID, snapshotID); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+// loadModuleEdges reads module→module edges (all reference kinds, cross-module
+// only) plus, per source module, which kinds reach which target module.
+func (b *Builder) loadModuleEdges() ([]graph.Edge, map[string]map[string]map[string]bool, error) {
+	stmt, err := b.tx.Prepare(
+		`SELECT substr(SourceName, 1, instr(SourceName, '.') - 1) AS SourceModule,
+			substr(TargetName, 1, instr(TargetName, '.') - 1) AS TargetModule,
+			RefKind
+		 FROM refs
+		 WHERE instr(SourceName, '.') > 0 AND instr(TargetName, '.') > 0
+			AND substr(SourceName, 1, instr(SourceName, '.') - 1)
+				!= substr(TargetName, 1, instr(TargetName, '.') - 1)`)
+	if err != nil {
+		return nil, nil, err
+	}
+	defer stmt.Close()
+	rows, err := stmt.Query()
+	if err != nil {
+		return nil, nil, err
+	}
+	defer rows.Close()
+
+	seen := map[string]bool{}
+	var edges []graph.Edge
+	kinds := map[string]map[string]map[string]bool{}
+	for rows.Next() {
+		var src, tgt, kind string
+		if err := rows.Scan(&src, &tgt, &kind); err != nil {
+			return nil, nil, err
+		}
+		if key := src + "\x00" + tgt; !seen[key] {
+			seen[key] = true
+			edges = append(edges, graph.Edge{Source: src, Target: tgt})
+		}
+		if kinds[src] == nil {
+			kinds[src] = map[string]map[string]bool{}
+		}
+		if kinds[src][kind] == nil {
+			kinds[src][kind] = map[string]bool{}
+		}
+		kinds[src][kind][tgt] = true
+	}
+	return edges, kinds, rows.Err()
+}
+
 // loadGraphEdges reads the structural edge set from the refs table.
 func (b *Builder) loadGraphEdges() ([]graph.Edge, error) {
-	quoted := make([]string, len(graphRefKinds))
-	for i, k := range graphRefKinds {
-		quoted[i] = "'" + k + "'"
-	}
 	stmt, err := b.tx.Prepare(
 		`SELECT SourceName, TargetName FROM refs
-		 WHERE SourceName != '' AND TargetName != '' AND RefKind IN (` + strings.Join(quoted, ", ") + `)`)
+		 WHERE SourceName != '' AND TargetName != '' AND RefKind IN (` + graphRefKindsSQL() + `)`)
 	if err != nil {
 		return nil, err
 	}
diff --git a/mdl/catalog/builder_module_cycles_test.go b/mdl/catalog/builder_module_cycles_test.go
new file mode 100644
index 0000000000..66a8a1efe4
--- /dev/null
+++ b/mdl/catalog/builder_module_cycles_test.go
@@ -0,0 +1,238 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package catalog
+
+import (
+	"path/filepath"
+	"sort"
+	"strings"
+	"testing"
+)
+
+type probeRef struct{ src, tgt, kind string }
+
+// moduleCycleCatalog builds a catalog holding nothing but a snapshot and the
+// given refs, then runs the graph pass over it.
+func moduleCycleCatalog(t *testing.T, refs []probeRef) *Catalog {
+	t.Helper()
+	cat, err := NewFromFile(filepath.Join(t.TempDir(), "c.db"))
+	if err != nil {
+		t.Fatalf("NewFromFile: %v", err)
+	}
+	t.Cleanup(func() { cat.Close() })
+	db := cat.CatalogDB()
+	if _, err := db.Exec(`INSERT INTO snapshots (SnapshotId, ProjectId) VALUES ('s1','default')`); err != nil {
+		t.Fatalf("insert snapshot: %v", err)
+	}
+	for _, r := range refs {
+		if _, err := db.Exec(`INSERT INTO refs
+			(SourceType, SourceId, SourceName, TargetType, TargetId, TargetName, RefKind, ModuleName, ProjectId, SnapshotId)
+			VALUES ('MICROFLOW','',?,'MICROFLOW','',?,?,?,'default','s1')`,
+			r.src, r.tgt, r.kind, moduleOf(r.src)); err != nil {
+			t.Fatalf("insert ref: %v", err)
+		}
+	}
+	if err := cat.AddGraphAnalysis(1.0); err != nil {
+		t.Fatalf("AddGraphAnalysis: %v", err)
+	}
+	return cat
+}
+
+func moduleCycleRows(t *testing.T, cat *Catalog) map[string]string {
+	t.Helper()
+	rows, err := cat.CatalogDB().Query(`SELECT ModuleName, CycleSize, RefKinds FROM graph_module_cycles_data`)
+	if err != nil {
+		t.Fatalf("query: %v", err)
+	}
+	defer rows.Close()
+	out := map[string]string{}
+	for rows.Next() {
+		var name, kinds string
+		var size int
+		if err := rows.Scan(&name, &size, &kinds); err != nil {
+			t.Fatalf("scan: %v", err)
+		}
+		out[name] = kinds
+	}
+	return out
+}
+
+func assetCycleCount(t *testing.T, cat *Catalog) int {
+	t.Helper()
+	var n int
+	if err := cat.CatalogDB().QueryRow(`SELECT COUNT(*) FROM graph_cycles_data`).Scan(&n); err != nil {
+		t.Fatalf("count: %v", err)
+	}
+	return n
+}
+
+// TestModuleCycleSurvivesWhereAssetCycleCannotExist is mendixlabs/mxcli#1060
+// reduced to its skeleton, and the reason graph_module_cycles is not a rollup of
+// graph_cycles.
+//
+// Administration references Atlas_Core from one document and Atlas_Core
+// references Administration from a DIFFERENT one. The modules depend on each
+// other; no document does. graph_cycles is therefore correctly empty — and was
+// read as "no circular dependencies" while graph_module_coupling listed the pair
+// in both directions.
+func TestModuleCycleSurvivesWhereAssetCycleCannotExist(t *testing.T) {
+	cat := moduleCycleCatalog(t, []probeRef{
+		{"Administration.A", "Atlas_Core.B", "call"},
+		{"Atlas_Core.C", "Administration.D", "call"},
+	})
+
+	if n := assetCycleCount(t, cat); n != 0 {
+		t.Fatalf("graph_cycles has %d rows; the fixture has no document-level cycle, so this test would not be about anything", n)
+	}
+	got := moduleCycleRows(t, cat)
+	want := []string{"Administration", "Atlas_Core"}
+	var names []string
+	for m := range got {
+		names = append(names, m)
+	}
+	sort.Strings(names)
+	if strings.Join(names, ",") != strings.Join(want, ",") {
+		t.Errorf("graph_module_cycles = %v, want %v", names, want)
+	}
+}
+
+// TestModuleCycleSeesKindsTheAssetGraphExcludes is the other half of the report.
+// graph_module_coupling counts every reference kind; the computed pass is
+// restricted to graphRefKinds. On ako/TestApp that is 110 of 316 edges, and
+// Administration -> Atlas_Core there is `layout`-only — one of the excluded
+// ones. A module-cycle table built on the structural subset would still have
+// answered "none" for the pair that was reported.
+func TestModuleCycleSeesKindsTheAssetGraphExcludes(t *testing.T) {
+	cat := moduleCycleCatalog(t, []probeRef{
+		{"Administration.APage", "Atlas_Core.SomeLayout", "layout"},
+		{"Atlas_Core.CPage", "Administration.DLayout", "layout"},
+	})
+
+	if n := assetCycleCount(t, cat); n != 0 {
+		t.Fatalf("graph_cycles has %d rows; `layout` is not in graphRefKinds, so it must not reach the asset graph", n)
+	}
+	got := moduleCycleRows(t, cat)
+	if len(got) != 2 {
+		t.Fatalf("graph_module_cycles = %v, want both modules", got)
+	}
+	if got["Administration"] != "layout" {
+		t.Errorf("RefKinds for Administration = %q, want \"layout\" — the row should name what keeps the cycle alive", got["Administration"])
+	}
+}
+
+// TestOneWayModuleDependencyIsNotACycle is the control that keeps the table
+// meaningful: cross-module edges alone are not circularity, or every app with a
+// dependency would be reported as tangled.
+func TestOneWayModuleDependencyIsNotACycle(t *testing.T) {
+	cat := moduleCycleCatalog(t, []probeRef{
+		{"Administration.A", "Atlas_Core.B", "call"},
+		{"Administration.E", "Atlas_Core.F", "layout"},
+	})
+	if got := moduleCycleRows(t, cat); len(got) != 0 {
+		t.Errorf("graph_module_cycles = %v, want empty for a one-way dependency", got)
+	}
+}
+
+// TestModuleCycleThroughAThirdModule: A -> B -> C -> A is a cycle even though no
+// two of them reference each other directly. Tarjan gets this for free; the test
+// exists because the tempting cheap implementation — self-joining
+// graph_module_coupling on the reversed pair, which is how the issue reporter
+// spotted the problem — finds only the two-module case.
+func TestModuleCycleThroughAThirdModule(t *testing.T) {
+	cat := moduleCycleCatalog(t, []probeRef{
+		{"A.One", "B.Two", "call"},
+		{"B.Three", "C.Four", "call"},
+		{"C.Five", "A.Six", "call"},
+		// A fourth module that only depends on the tangle is NOT part of it.
+		{"D.Seven", "A.Eight", "call"},
+	})
+	got := moduleCycleRows(t, cat)
+	var names []string
+	for m := range got {
+		names = append(names, m)
+	}
+	sort.Strings(names)
+	if strings.Join(names, ",") != "A,B,C" {
+		t.Errorf("graph_module_cycles = %v, want [A B C] — D depends on the cycle but is not in it", names)
+	}
+}
+
+// TestRefKindsNamesOnlyTheEdgesInsideTheCycle: a module's references to the
+// world outside the tangle are not what makes it circular, so listing them in
+// RefKinds would send a reader after the wrong edge.
+func TestRefKindsNamesOnlyTheEdgesInsideTheCycle(t *testing.T) {
+	cat := moduleCycleCatalog(t, []probeRef{
+		{"A.One", "B.Two", "call"},
+		{"B.Three", "A.Four", "call"},
+		// A -> Outside, a kind that appears nowhere in the cycle.
+		{"A.Five", "Outside.Six", "associate"},
+	})
+	got := moduleCycleRows(t, cat)
+	if got["A"] != "call" {
+		t.Errorf("RefKinds for A = %q, want \"call\" — `associate` leaves the cycle", got["A"])
+	}
+}
+
+// TestGraphAnalysisScopeRecordsWhatTheFilterDrops makes the disagreement between
+// the two graph families answerable from SQL. Before this there was no way to
+// find out that a third of the edges graph_module_coupling counts never reach
+// the cycles/communities/layers computation, short of reading Go source.
+func TestGraphAnalysisScopeRecordsWhatTheFilterDrops(t *testing.T) {
+	cat := moduleCycleCatalog(t, []probeRef{
+		{"A.One", "B.Two", "call"},      // structural
+		{"B.Three", "A.Four", "layout"}, // navigational
+		{"A.Five", "B.Six", "layout"},
+	})
+	rows, err := cat.CatalogDB().Query(`SELECT RefKind, Edges, InAssetGraph FROM graph_analysis_scope ORDER BY RefKind`)
+	if err != nil {
+		t.Fatalf("query: %v", err)
+	}
+	defer rows.Close()
+	got := map[string][2]int{}
+	for rows.Next() {
+		var kind string
+		var edges, in int
+		if err := rows.Scan(&kind, &edges, &in); err != nil {
+			t.Fatalf("scan: %v", err)
+		}
+		got[kind] = [2]int{edges, in}
+	}
+	if got["call"] != [2]int{1, 1} {
+		t.Errorf("call = %v, want 1 edge inside the asset graph", got["call"])
+	}
+	if got["layout"] != [2]int{2, 0} {
+		t.Errorf("layout = %v, want 2 edges outside the asset graph", got["layout"])
+	}
+}
+
+// TestGraphAnalysisScopeTracksGraphRefKinds proves the view is generated from
+// the filter rather than restating it: every kind the loader admits must report
+// InAssetGraph = 1. A kind added to graphRefKinds without the view noticing
+// would leave the documentation of the scope lying about the scope.
+func TestGraphAnalysisScopeTracksGraphRefKinds(t *testing.T) {
+	var refs []probeRef
+	for i, kind := range graphRefKinds {
+		refs = append(refs, probeRef{
+			src:  "A.S" + strings.Repeat("x", i+1),
+			tgt:  "B.T" + strings.Repeat("x", i+1),
+			kind: kind,
+		})
+	}
+	cat := moduleCycleCatalog(t, refs)
+	rows, err := cat.CatalogDB().Query(`SELECT RefKind FROM graph_analysis_scope WHERE InAssetGraph = 0`)
+	if err != nil {
+		t.Fatalf("query: %v", err)
+	}
+	defer rows.Close()
+	var excluded []string
+	for rows.Next() {
+		var k string
+		if err := rows.Scan(&k); err != nil {
+			t.Fatalf("scan: %v", err)
+		}
+		excluded = append(excluded, k)
+	}
+	if len(excluded) != 0 {
+		t.Errorf("kinds in graphRefKinds reported as outside the asset graph: %v", excluded)
+	}
+}
diff --git a/mdl/catalog/catalog.go b/mdl/catalog/catalog.go
index 728e4424e6..6e8228fb9c 100644
--- a/mdl/catalog/catalog.go
+++ b/mdl/catalog/catalog.go
@@ -6,6 +6,7 @@ package catalog
 import (
 	"database/sql"
 	"fmt"
+	"strconv"
 	"strings"
 	"time"
 )
@@ -174,6 +175,8 @@ func (c *Catalog) Tables() []string {
 		"CATALOG.COMMUNITIES",
 		"CATALOG.COMMUNITY_SUMMARY",
 		"CATALOG.GRAPH_CYCLES",
+		"CATALOG.GRAPH_MODULE_CYCLES",
+		"CATALOG.GRAPH_ANALYSIS_SCOPE",
 		"CATALOG.GRAPH_LAYERS",
 		"CATALOG.GRAPH_CENTRALITY",
 		"CATALOG.GRAPH_MODULE_DEPENDENCIES",
@@ -280,6 +283,21 @@ const (
 	MetaBuildMode     = "build_mode"
 	MetaBuildTime     = "build_time"
 	MetaBuildDuration = "build_duration"
+
+	// MetaGraphAnalysis records that AddGraphAnalysis has run against this
+	// catalog, and MetaGraphResolution the Leiden resolution it used.
+	//
+	// Deliberately NOT another build mode. fast/full/source is a LEVEL — each
+	// contains the one below, so a rank comparison decides everything. The graph
+	// pass is orthogonal: it augments whatever level is there (that is the whole
+	// point of AddGraphAnalysis being additive), so folding it into the rank
+	// would make "source" and "full+graph" incomparable. It is a flag.
+	//
+	// Without it an un-run graph pass is indistinguishable from a graph with
+	// nothing in it: the tables are empty either way, and the recorded mode still
+	// says "full" (mendixlabs/mxcli#1060).
+	MetaGraphAnalysis   = "graph_analysis"
+	MetaGraphResolution = "graph_resolution"
 )
 
 // CacheInfo contains information about the cached catalog.
@@ -292,6 +310,11 @@ type CacheInfo struct {
 	BuildDuration time.Duration
 	IsValid       bool
 	InvalidReason string
+
+	// GraphAnalysis reports whether the communities/cycles/layers/centrality
+	// pass has run against this catalog, and at which resolution.
+	GraphAnalysis   bool
+	GraphResolution float64
 }
 
 // NewFromFile opens a catalog from a persisted SQLite file.
@@ -406,6 +429,7 @@ func (c *Catalog) migrateIfSchemaMismatch() error {
 	for _, key := range []string{
 		MetaMprPath, MetaMprModTime, MetaMendixVersion,
 		MetaBuildMode, MetaBuildTime, MetaBuildDuration,
+		MetaGraphAnalysis, MetaGraphResolution,
 	} {
 		if _, err := c.db.Exec(`DELETE FROM catalog_meta WHERE Key = ?`, key); err != nil {
 			return fmt.Errorf("clearing cache-info key %s: %w", key, err)
@@ -593,6 +617,12 @@ func (c *Catalog) GetCacheInfo() (*CacheInfo, error) {
 	if durationStr, _ := c.GetMeta(MetaBuildDuration); durationStr != "" {
 		info.BuildDuration, _ = time.ParseDuration(durationStr)
 	}
+	if v, _ := c.GetMeta(MetaGraphAnalysis); v != "" {
+		info.GraphAnalysis = true
+	}
+	if v, _ := c.GetMeta(MetaGraphResolution); v != "" {
+		info.GraphResolution, _ = strconv.ParseFloat(v, 64)
+	}
 
 	return info, nil
 }
diff --git a/mdl/catalog/tables.go b/mdl/catalog/tables.go
index 8432bab70e..60f1b1f59c 100644
--- a/mdl/catalog/tables.go
+++ b/mdl/catalog/tables.go
@@ -1348,6 +1348,25 @@ func (c *Catalog) createTables() error {
 			LEFT JOIN graph_centrality_data gc ON gc.AssetName = d.Asset
 			GROUP BY d.Asset`,
 
+		// graph_analysis_scope — which reference kinds reach the asset-level
+		// analysis graph, and how many edges each kind contributes.
+		//
+		// Exists because the two graph families disagree by construction and there
+		// was no way to see it from SQL: graph_module_coupling and friends read
+		// EVERY kind straight off refs, while the computed pass (communities,
+		// graph_cycles, graph_layers, graph_centrality) is restricted to the
+		// structural kinds so navigational edges do not blur the clustering. On
+		// ako/TestApp that is 110 of 316 edges — a third of the graph — excluded
+		// with nothing recording the fact (mendixlabs/mxcli#1060).
+		//
+		// The IN list is generated from graphRefKinds, so this view cannot drift
+		// from the filter it describes.
+		`CREATE VIEW IF NOT EXISTS graph_analysis_scope AS
+			SELECT RefKind, COUNT(*) AS Edges,
+				CASE WHEN RefKind IN (` + graphRefKindsSQL() + `) THEN 1 ELSE 0 END AS InAssetGraph
+			FROM refs WHERE SourceName != '' AND TargetName != ''
+			GROUP BY RefKind`,
+
 		// graph_module_coupling — cross-module edges ("surprise edges").
 		`CREATE VIEW IF NOT EXISTS graph_module_coupling AS
 			SELECT substr(SourceName, 1, instr(SourceName, '.') - 1) AS SourceModule,
@@ -1407,12 +1426,34 @@ func (c *Catalog) createTables() error {
 		viewWithFullSnapshot("communities"),
 
 		// graph_cycles — SCC membership for assets in a dependency cycle.
+		// ASSET-level, over the structural edge kinds only (graphRefKinds) — the
+		// same graph communities and layers are computed on. See
+		// graph_module_cycles for the module-level question and
+		// graph_analysis_scope for which kinds are in this graph.
 		`CREATE TABLE IF NOT EXISTS graph_cycles_data (
 			AssetName TEXT, ModuleName TEXT, CycleId INTEGER, CycleSize INTEGER,
 			ProjectId TEXT, SnapshotId TEXT
 		)`,
 		viewWithFullSnapshot("graph_cycles"),
 
+		// graph_module_cycles — SCC membership for MODULES in a dependency cycle.
+		//
+		// A separate question from graph_cycles, not a rollup of it: modules A and
+		// B can depend on each other through four documents that form no cycle
+		// between themselves, which is the ordinary shape of a module cycle and why
+		// graph_cycles stayed empty while graph_module_coupling listed both
+		// directions (mendixlabs/mxcli#1060).
+		//
+		// Computed over EVERY reference kind, matching graph_module_coupling — the
+		// table this one is read next to. A page bound to a layout in another
+		// module is a real dependency of that module even though `layout` is not a
+		// structural kind for clustering purposes.
+		`CREATE TABLE IF NOT EXISTS graph_module_cycles_data (
+			ModuleName TEXT, CycleId INTEGER, CycleSize INTEGER, RefKinds TEXT,
+			ProjectId TEXT, SnapshotId TEXT
+		)`,
+		viewWithFullSnapshot("graph_module_cycles"),
+
 		// graph_layers — topological layer (sequence number) per asset.
 		`CREATE TABLE IF NOT EXISTS graph_layers_data (
 			AssetName TEXT, ModuleName TEXT, Layer INTEGER,
diff --git a/mdl/executor/cmd_catalog.go b/mdl/executor/cmd_catalog.go
index 3fae05572f..ce14c16a28 100644
--- a/mdl/executor/cmd_catalog.go
+++ b/mdl/executor/cmd_catalog.go
@@ -91,6 +91,7 @@ var fullOnlyTables = map[string]bool{
 	"graph_dead_assets":          true,
 	"graph_refkind_distribution": true,
 	"graph_entity_hotspots":      true,
+	"graph_analysis_scope":       true,
 }
 
 // sourceOnlyTables are catalog tables only populated by REFRESH CATALOG FULL SOURCE.
@@ -98,6 +99,24 @@ var sourceOnlyTables = map[string]bool{
 	"source": true,
 }
 
+// communitiesOnlyTables are populated by the graph-analysis pass (REFRESH
+// CATALOG COMMUNITIES), not by any build mode. They were the ONLY graph tables
+// missing from the lists above, which is exactly why mendixlabs/mxcli#1060 was
+// reported the way it was: GRAPH_MODULE_COUPLING is a plain view over refs, so
+// it answered from any full catalog, while GRAPH_CYCLES answered "0 rows" — the
+// same output as "no cycles found". A query against these is a mode question no
+// rank can settle, since the pass augments fast/full/source alike; it is
+// answered by the graph-analysis flag on the catalog.
+var communitiesOnlyTables = map[string]bool{
+	"communities":               true,
+	"community_summary":         true,
+	"graph_cycles":              true,
+	"graph_module_cycles":       true,
+	"graph_layers":              true,
+	"graph_centrality":          true,
+	"graph_integration_surface": true,
+}
+
 // extractTableFromQuery extracts the table name after FROM in a converted catalog query.
 func extractTableFromQuery(query string) string {
 	lower := strings.ToLower(query)
@@ -122,17 +141,25 @@ func warnIfCatalogModeInsufficient(ctx *ExecContext, query string) {
 		return
 	}
 
-	// Determine current build mode
+	// Determine current build mode, and whether the graph pass has run.
 	buildMode := "fast"
+	graphAnalysis := false
 	if ctx.Catalog != nil {
-		if info, err := ctx.Catalog.GetCacheInfo(); err == nil && info.BuildMode != "" {
-			buildMode = info.BuildMode
+		if info, err := ctx.Catalog.GetCacheInfo(); err == nil {
+			if info.BuildMode != "" {
+				buildMode = info.BuildMode
+			}
+			graphAnalysis = info.GraphAnalysis
 		}
 	}
 
 	modeRank := map[string]int{"fast": 1, "full": 2, "source": 3}
 	currentRank := modeRank[buildMode]
 
+	if communitiesOnlyTables[table] && !graphAnalysis {
+		fmt.Fprintf(ctx.Output, "Warning: CATALOG.%s requires refresh catalog communities (not run for this catalog)\n", strings.ToUpper(table))
+		return
+	}
 	if sourceOnlyTables[table] && currentRank < modeRank["source"] {
 		fmt.Fprintf(ctx.Output, "Warning: CATALOG.%s requires refresh catalog full source (current mode: %s)\n", strings.ToUpper(table), buildMode)
 	} else if fullOnlyTables[table] && currentRank < modeRank["full"] {
@@ -172,8 +199,11 @@ func execCatalogQuery(ctx *ExecContext, query string) error {
 	return nil
 }
 
-// tableRequiredMode returns the minimum catalog build mode for a table.
+// tableRequiredMode returns the command that populates a table.
 func tableRequiredMode(table string) string {
+	if communitiesOnlyTables[table] {
+		return "refresh catalog communities"
+	}
 	if sourceOnlyTables[table] {
 		return "refresh catalog full source"
 	}
@@ -247,23 +277,33 @@ func catalogModeRank(mode string) int {
 // statement of the level this project is set up for, and that is what callers
 // here are asking about.
 func cachedCatalogMode(ctx *ExecContext) string {
+	info := cachedCatalogInfo(ctx)
+	if info == nil {
+		return ""
+	}
+	return info.BuildMode
+}
+
+// cachedCatalogInfo reads the on-disk cache's metadata, or nil when there is no
+// readable cache. Same indifference to validity as cachedCatalogMode.
+func cachedCatalogInfo(ctx *ExecContext) *catalog.CacheInfo {
 	cachePath := getCachePath(ctx)
 	if cachePath == "" {
-		return ""
+		return nil
 	}
 	if _, err := os.Stat(cachePath); err != nil {
-		return ""
+		return nil
 	}
 	cat, err := catalog.NewFromFile(cachePath)
 	if err != nil {
-		return ""
+		return nil
 	}
 	defer cat.Close()
 	info, err := cat.GetCacheInfo()
 	if err != nil {
-		return ""
+		return nil
 	}
-	return info.BuildMode
+	return info
 }
 
 // ensureCatalog ensures a catalog is available, using cache if possible.
@@ -406,12 +446,40 @@ func formatDuration(d time.Duration) string {
 	return fmt.Sprintf("%.1fd", d.Hours()/24)
 }
 
+// carryGraphAnalysis decides whether a rebuild should re-run the graph pass the
+// cache it is about to replace already had, and at which resolution.
+//
+// A rebuild starts from an empty catalog, so it drops the graph-analysis tables
+// — and the recorded mode stays "full", so nothing downstream could tell. That
+// is the same shape as #1081 (a narrower build overwriting a richer cache) and
+// the reason mendixlabs/mxcli#1060's GRAPH_CYCLES was empty on a project whose
+// GRAPH_MODULE_COUPLING had rows. Re-running re-reads the refs the rebuild just
+// wrote and re-parses nothing.
+//
+// Only for a build that is already full. A fast build must NOT be promoted: it
+// never overwrites a full cache (the #1081 guard in buildCatalog), so it has
+// nothing to preserve, and promoting it would make `mxcli check -p` pay for a
+// full parse plus a graph pass.
+func carryGraphAnalysis(prior *catalog.CacheInfo, full, communities bool) (bool, float64) {
+	if communities || !full || prior == nil || !prior.GraphAnalysis {
+		return false, 0
+	}
+	return true, prior.GraphResolution
+}
+
 // buildCatalog builds the catalog from the project.
 func buildCatalog(ctx *ExecContext, full, isSource, communities bool, resolution float64) error {
 	if isSource || communities {
 		full = true // both imply full (they read refs/source built in full mode)
 	}
 
+	if carry, res := carryGraphAnalysis(cachedCatalogInfo(ctx), full, communities); carry {
+		communities, resolution = true, res
+		if !ctx.Quiet {
+			fmt.Fprintln(ctx.Output, "Carrying over graph analysis (this catalog has it)...")
+		}
+	}
+
 	if !ctx.Quiet {
 		if isSource {
 			fmt.Fprintln(ctx.Output, "Building catalog (source mode - includes MDL source)...")
@@ -725,6 +793,15 @@ func execShowCatalogStatus(ctx *ExecContext) error {
 	} else {
 		fmt.Fprintln(ctx.Output, "Source mode: ✗ Not cached (use refresh catalog source)")
 	}
+	// Reported separately from the mode because it IS separate: the graph pass
+	// augments whatever mode is cached, so "full" says nothing about whether
+	// COMMUNITIES / GRAPH_CYCLES / GRAPH_LAYERS / GRAPH_CENTRALITY have anything
+	// in them.
+	if info.GraphAnalysis {
+		fmt.Fprintf(ctx.Output, "Graph analysis: ✓ Available (resolution %g)\n", info.GraphResolution)
+	} else {
+		fmt.Fprintln(ctx.Output, "Graph analysis: ✗ Not run (use refresh catalog communities)")
+	}
 
 	return nil
 }
diff --git a/mdl/executor/cmd_catalog_graph_test.go b/mdl/executor/cmd_catalog_graph_test.go
new file mode 100644
index 0000000000..4b9b1aeb5b
--- /dev/null
+++ b/mdl/executor/cmd_catalog_graph_test.go
@@ -0,0 +1,216 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package executor
+
+import (
+	"path/filepath"
+	"sort"
+	"strings"
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/catalog"
+)
+
+// graphProbeCatalog builds a file-backed catalog holding just a snapshot and a
+// hand-written refs graph — the state a `refresh catalog full` leaves behind,
+// with no graph-analysis pass yet.
+//
+// The edge set is shaped to populate every graph table at once, and it is also
+// mendixlabs/mxcli#1060 in miniature:
+//
+//   - two clusters, so the community split is real and
+//     graph_integration_surface has a cross-community edge to classify;
+//   - one MUTUAL asset pair, so graph_cycles is non-empty — without it the very
+//     table the issue was about would be the one the drift guard fails to cover;
+//   - a return edge from B to A whose kind is `layout`, which is NOT one of
+//     graphRefKinds. Modules A and B therefore reference each other while no
+//     document-level cycle spans them, which is exactly the shape that had
+//     graph_module_coupling listing both directions and graph_cycles empty.
+func graphProbeCatalog(t *testing.T) *catalog.Catalog {
+	t.Helper()
+	cat, err := catalog.NewFromFile(filepath.Join(t.TempDir(), "catalog.db"))
+	if err != nil {
+		t.Fatalf("NewFromFile: %v", err)
+	}
+	t.Cleanup(func() { cat.Close() })
+	db := cat.CatalogDB()
+	if _, err := db.Exec(`INSERT INTO snapshots (SnapshotId, ProjectId) VALUES ('s1','default')`); err != nil {
+		t.Fatalf("insert snapshot: %v", err)
+	}
+	edges := []struct{ src, tgt, kind string }{
+		// Cluster A, densely connected; A.1 <-> A.2 is the asset cycle.
+		{"A.1", "A.2", "call"}, {"A.2", "A.1", "call"}, {"A.2", "A.3", "call"}, {"A.3", "A.1", "call"},
+		// Cluster B, densely connected, no cycle.
+		{"B.1", "B.2", "call"}, {"B.2", "B.3", "call"}, {"B.1", "B.3", "call"},
+		// A -> B, structural: the bridge the integration surface classifies.
+		{"A.1", "B.1", "call"},
+		// B -> A, navigational: closes the MODULE cycle without closing any
+		// asset cycle, and without joining the two clusters in the asset graph.
+		{"B.3", "A.3", "layout"},
+	}
+	for _, e := range edges {
+		if _, err := db.Exec(`INSERT INTO refs
+			(SourceType, SourceId, SourceName, TargetType, TargetId, TargetName, RefKind, ModuleName, ProjectId, SnapshotId)
+			VALUES ('MICROFLOW','',?,'MICROFLOW','',?,?,?,'default','s1')`,
+			e.src, e.tgt, e.kind, strings.SplitN(e.src, ".", 2)[0]); err != nil {
+			t.Fatalf("insert ref: %v", err)
+		}
+	}
+	return cat
+}
+
+func graphProbeRowCounts(t *testing.T, cat *catalog.Catalog) map[string]int {
+	t.Helper()
+	out := map[string]int{}
+	for _, qualified := range cat.Tables() {
+		table := strings.TrimPrefix(strings.ToLower(qualified), "catalog.")
+		var n int
+		if err := cat.CatalogDB().QueryRow("SELECT COUNT(*) FROM " + table).Scan(&n); err != nil {
+			t.Fatalf("count %s: %v", table, err)
+		}
+		out[table] = n
+	}
+	return out
+}
+
+// TestCommunitiesOnlyTablesMatchWhatTheGraphPassPopulates is the drift guard for
+// mendixlabs/mxcli#1060. The bug was a classification hole, not a wrong string:
+// GRAPH_CYCLES (and its four siblings) appeared in NO mode list, so a query
+// against an un-run graph pass answered "0 rows" — the same output as "no cycles
+// found" — while GRAPH_MODULE_COUPLING, which *is* listed, answered properly
+// from the same catalog. That asymmetry is what got reported.
+//
+// So the set is not asserted against a second hand-written list, which would
+// drift in lockstep with the first. It is MEASURED: run the pass and see which
+// tables went from empty to non-empty. A graph table added later without a
+// classification fails here.
+func TestCommunitiesOnlyTablesMatchWhatTheGraphPassPopulates(t *testing.T) {
+	cat := graphProbeCatalog(t)
+
+	before := graphProbeRowCounts(t, cat)
+	// Control: with the pass not yet run, every table this test is about is
+	// empty — so "gained rows" below really is the pass's doing.
+	for table := range communitiesOnlyTables {
+		if before[table] != 0 {
+			t.Fatalf("%s already has %d rows before the graph pass", table, before[table])
+		}
+	}
+
+	if err := cat.AddGraphAnalysis(1.0); err != nil {
+		t.Fatalf("AddGraphAnalysis: %v", err)
+	}
+	after := graphProbeRowCounts(t, cat)
+
+	var gained []string
+	for table, n := range after {
+		if n > 0 && before[table] == 0 {
+			gained = append(gained, table)
+		}
+	}
+	sort.Strings(gained)
+
+	var classified []string
+	for table := range communitiesOnlyTables {
+		classified = append(classified, table)
+	}
+	sort.Strings(classified)
+
+	if strings.Join(gained, ",") != strings.Join(classified, ",") {
+		t.Errorf("tables populated by the graph pass = %v\ncommunitiesOnlyTables   = %v\n"+
+			"every table the pass fills must be classified, or a query against it "+
+			"reports 0 rows instead of \"requires refresh catalog communities\"", gained, classified)
+	}
+}
+
+// TestGraphAnalysisFlagDistinguishesEmptyFromNeverRun pins the distinction the
+// whole fix rests on. Before #1060 there was nothing to read here: the pass left
+// no trace, so an empty graph_cycles_data was ambiguous and the recorded build
+// mode still said "full".
+func TestGraphAnalysisFlagDistinguishesEmptyFromNeverRun(t *testing.T) {
+	cat := graphProbeCatalog(t)
+
+	info, err := cat.GetCacheInfo()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if info.GraphAnalysis {
+		t.Fatal("a catalog that has never run the pass must not claim graph analysis")
+	}
+
+	if err := cat.AddGraphAnalysis(0.42); err != nil {
+		t.Fatalf("AddGraphAnalysis: %v", err)
+	}
+	info, err = cat.GetCacheInfo()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !info.GraphAnalysis {
+		t.Error("graph analysis ran but the catalog does not record it")
+	}
+	if info.GraphResolution != 0.42 {
+		t.Errorf("GraphResolution = %v, want 0.42 — a carried-over re-run must use the same resolution", info.GraphResolution)
+	}
+}
+
+// TestGraphResolutionRecordsTheEffectiveValue: callers pass 0 to mean "default".
+// Recording the 0 would make a carried-over re-run at "the same resolution" a
+// different run from the original.
+func TestGraphResolutionRecordsTheEffectiveValue(t *testing.T) {
+	cat := graphProbeCatalog(t)
+	if err := cat.AddGraphAnalysis(0); err != nil {
+		t.Fatalf("AddGraphAnalysis: %v", err)
+	}
+	info, err := cat.GetCacheInfo()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if info.GraphResolution != 1.0 {
+		t.Errorf("GraphResolution = %v, want the effective 1.0 rather than the caller's 0", info.GraphResolution)
+	}
+}
+
+func TestTableRequiredModeNamesTheCommandThatPopulates(t *testing.T) {
+	for table, want := range map[string]string{
+		"graph_cycles": "refresh catalog communities",
+		"communities":  "refresh catalog communities",
+		// Controls: the neighbours that were already classified must not move.
+		"graph_module_coupling": "refresh catalog full",
+		"source":                "refresh catalog full source",
+		"entities":              "refresh catalog",
+	} {
+		if got := tableRequiredMode(table); got != want {
+			t.Errorf("tableRequiredMode(%q) = %q, want %q", table, got, want)
+		}
+	}
+}
+
+// TestCarryGraphAnalysis covers the second half of #1060: a plain full rebuild
+// used to drop the graph tables silently, leaving the mode reading "full" so
+// nothing downstream could notice.
+func TestCarryGraphAnalysis(t *testing.T) {
+	with := &catalog.CacheInfo{GraphAnalysis: true, GraphResolution: 1.25}
+	without := &catalog.CacheInfo{}
+
+	cases := []struct {
+		name              string
+		prior             *catalog.CacheInfo
+		full, communities bool
+		wantCarry         bool
+		wantRes           float64
+	}{
+		{"full rebuild over a graph cache carries it", with, true, false, true, 1.25},
+		// Controls, one per reason not to carry:
+		{"no prior cache", nil, true, false, false, 0},
+		{"prior cache never ran the pass", without, true, false, false, 0},
+		{"a fast build is not promoted", with, false, false, false, 0},
+		{"an explicit communities run needs no carry", with, true, true, false, 0},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			carry, res := carryGraphAnalysis(c.prior, c.full, c.communities)
+			if carry != c.wantCarry || res != c.wantRes {
+				t.Errorf("carryGraphAnalysis = (%v, %v), want (%v, %v)", carry, res, c.wantCarry, c.wantRes)
+			}
+		})
+	}
+}
diff --git a/mdl/executor/cmd_microflows_normalize.go b/mdl/executor/cmd_microflows_normalize.go
new file mode 100644
index 0000000000..669ec47328
--- /dev/null
+++ b/mdl/executor/cmd_microflows_normalize.go
@@ -0,0 +1,340 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package executor
+
+// Mode 3 of PROPOSAL_structured_microflow_description.md: render an irreducible
+// but RECOMBINABLE graph by folding its branch guards into one condition,
+// instead of flattening it into MDL that means something else.
+//
+// The approach is deliberately not a second describer. It rewrites a COPY of
+// the graph into the equivalent properly-nested one and hands that to the
+// describer that already exists, so Mode 3 inherits every activity renderer,
+// annotation and layout rule for free and cannot drift from Mode 1. What the
+// describer sees is an ordinary `if <folded> then … end if`.
+//
+// Opt-in, and that is load-bearing rather than a convenience: the output
+// re-executes to a DIFFERENT graph — same behaviour, fewer nodes, different
+// layout. Someone describing a microflow to change one activity must not have
+// their canvas rebuilt as a side effect.
+
+import (
+	"fmt"
+
+	"github.com/mendixlabs/mxcli/mdl/microflowgraph"
+	"github.com/mendixlabs/mxcli/mdl/microflownorm"
+	"github.com/mendixlabs/mxcli/model"
+	"github.com/mendixlabs/mxcli/sdk/microflows"
+)
+
+// normalizeCollection folds every recombinable split it can and returns the
+// rewritten collection plus one note per fold, for the description's header.
+//
+// It never mutates the input: the stored model is not touched by a DESCRIBE.
+// A split it cannot fold is left exactly as it was, so the output degrades to
+// Mode 1 (with the existing MDL-FLOW01 warning) rather than to something wrong.
+func normalizeCollection(oc *microflows.MicroflowObjectCollection) (*microflows.MicroflowObjectCollection, []string) {
+	if oc == nil {
+		return nil, nil
+	}
+	findings := microflowgraph.Analyze(oc.Objects, oc.Flows)
+	if len(findings) == 0 {
+		return oc, nil
+	}
+
+	work := shallowCopyCollection(oc)
+	var notes []string
+	for _, f := range findings {
+		if f.Class != microflowgraph.Recombinable || len(f.Entries) != 1 {
+			// Interleaved needs a duplicated activity or an invented boolean
+			// (Böhm-Jacopini), and neither is a description. Left alone.
+			continue
+		}
+		note, err := foldSplit(work, f)
+		if err != nil {
+			notes = append(notes, fmt.Sprintf(
+				"-- NOTE: the decision at %s could not be normalized (%v); it is rendered as-is",
+				positionOf(f.Split), err))
+			continue
+		}
+		notes = append(notes, note)
+	}
+	return work, notes
+}
+
+func positionOf(obj microflows.MicroflowObject) string {
+	if obj == nil {
+		return "an unknown position"
+	}
+	p := obj.GetPosition()
+	return fmt.Sprintf("(%d, %d)", p.X, p.Y)
+}
+
+// foldSplit rewrites one recombinable split in place within `work`.
+//
+// The shape being folded, with S the split, E the single entry to the shared
+// suffix and J the split's post-dominator:
+//
+//	S …only splits and merges… ─→ E   (the shared suffix)
+//	                            └─→ J   (everything that misses it)
+//
+// becomes
+//
+//	S(folded) ─true→ E
+//	          └false→ J
+//
+// which is properly nested and describes as an ordinary `if`.
+func foldSplit(work *microflows.MicroflowObjectCollection, f microflowgraph.Finding) (string, error) {
+	entry := f.Entries[0]
+	join := f.JoinID
+	if join == "" {
+		return "", fmt.Errorf("the branches never rejoin")
+	}
+
+	nodes := map[model.ID]microflows.MicroflowObject{}
+	for _, o := range work.Objects {
+		if o != nil {
+			nodes[o.GetID()] = o
+		}
+	}
+	succ := map[model.ID][]*microflows.SequenceFlow{}
+	for _, fl := range work.Flows {
+		if fl != nil && !fl.IsErrorHandler {
+			succ[fl.OriginID] = append(succ[fl.OriginID], fl)
+		}
+	}
+
+	// The region is everything strictly between the split and the entry.
+	region, err := collectRegion(f.SplitID, entry, join, nodes, succ)
+	if err != nil {
+		return "", err
+	}
+
+	cond, err := microflownorm.RegionCondition(region, f.SplitID, entry)
+	if err != nil {
+		return "", err
+	}
+	if lit, ok := cond.(microflownorm.Lit); ok && !bool(lit) {
+		return "", fmt.Errorf("the shared suffix is unreachable")
+	}
+
+	split, ok := nodes[f.SplitID].(*microflows.ExclusiveSplit)
+	if !ok {
+		return "", fmt.Errorf("only an exclusive split can carry a folded condition")
+	}
+
+	// Rewrite: the split keeps its identity, position and annotations, and
+	// gains the folded guard.
+	split.SplitCondition = &microflows.ExpressionSplitCondition{Expression: cond.String()}
+	// The stored caption is Studio Pro's label for the ORIGINAL guard. Keeping
+	// it next to the folded one puts two different conditions on one decision,
+	// with the wrong one in the more prominent place.
+	split.Caption = ""
+
+	// Drop every node of the region except the split itself, and every flow
+	// that starts inside it.
+	drop := map[model.ID]bool{}
+	for id := range region {
+		if id != f.SplitID {
+			drop[id] = true
+		}
+	}
+	var keptObjects []microflows.MicroflowObject
+	for _, o := range work.Objects {
+		if o != nil && drop[o.GetID()] {
+			continue
+		}
+		keptObjects = append(keptObjects, o)
+	}
+	var keptFlows []*microflows.SequenceFlow
+	for _, fl := range work.Flows {
+		if fl == nil {
+			continue
+		}
+		if drop[fl.OriginID] || drop[fl.DestinationID] || fl.OriginID == f.SplitID {
+			continue
+		}
+		keptFlows = append(keptFlows, fl)
+	}
+
+	keptFlows = append(keptFlows,
+		branchFlow(f.SplitID, entry, true),
+		branchFlow(f.SplitID, join, false),
+	)
+	// The entry merge now has one predecessor (this split) and is a pure
+	// pass-through the describer would walk straight through — and that
+	// describe → exec would then delete. Splice it out here instead, so the
+	// graph Mode 3 renders is exactly the graph re-executing its output builds.
+	keptObjects, keptFlows = spliceRedundantMerge(entry, keptObjects, keptFlows)
+
+	work.Objects = keptObjects
+	work.Flows = keptFlows
+
+	return fmt.Sprintf(
+		"-- NOTE: the decision at %s was NORMALIZED - its branches were folded into one condition. "+
+			"This is equivalent to the microflow but is NOT its shape: re-executing this MDL builds "+
+			"a graph with fewer nodes and a different layout (mxcli #923, Mode 3)",
+		positionOf(f.Split)), nil
+}
+
+// collectRegion walks from the split to the entry, gathering the nodes to fold
+// and refusing anything that would make folding unsound.
+//
+// Two refusals, both of which would otherwise produce a plausible wrong guard:
+// an activity in the region (folding would move its side effect — see
+// microflownorm.ErrImpureRegion) and a rule-based split (its condition is a
+// rule call, which cannot be written inside a Mendix boolean expression, so
+// there is no text to fold it into).
+func collectRegion(
+	splitID, entry, join model.ID,
+	nodes map[model.ID]microflows.MicroflowObject,
+	succ map[model.ID][]*microflows.SequenceFlow,
+) (microflownorm.Region, error) {
+	region := microflownorm.Region{}
+	seen := map[model.ID]bool{}
+
+	var walk func(id model.ID) error
+	walk = func(id model.ID) error {
+		if id == entry || id == join || id == "" {
+			return nil
+		}
+		if seen[id] {
+			return nil
+		}
+		seen[id] = true
+
+		obj, ok := nodes[id]
+		if !ok {
+			return fmt.Errorf("the branches leave the microflow before rejoining")
+		}
+
+		switch n := obj.(type) {
+		case *microflows.ExclusiveSplit:
+			expr, ok := n.SplitCondition.(*microflows.ExpressionSplitCondition)
+			if !ok {
+				return fmt.Errorf("a decision in the region is rule-based, so its guard cannot be folded into an expression")
+			}
+			t, fl := findBranchFlows(succ[id])
+			if t == nil || fl == nil {
+				return fmt.Errorf("a decision in the region does not have both branches")
+			}
+			region[id] = microflownorm.Node{
+				Kind:      microflownorm.KindSplit,
+				Condition: expr.Expression,
+				True:      t.DestinationID,
+				False:     fl.DestinationID,
+			}
+			if err := walk(t.DestinationID); err != nil {
+				return err
+			}
+			return walk(fl.DestinationID)
+
+		case *microflows.ExclusiveMerge:
+			out := succ[id]
+			if len(out) != 1 {
+				return fmt.Errorf("a merge in the region does not have exactly one successor")
+			}
+			region[id] = microflownorm.Node{Kind: microflownorm.KindMerge, Next: out[0].DestinationID}
+			return walk(out[0].DestinationID)
+
+		default:
+			// An activity. Folding would run it under a different condition,
+			// or not at all.
+			return microflownorm.ErrImpureRegion
+		}
+	}
+
+	if err := walk(splitID); err != nil {
+		return nil, err
+	}
+	return region, nil
+}
+
+func branchFlow(from, to model.ID, isTrue bool) *microflows.SequenceFlow {
+	expr := "false"
+	if isTrue {
+		expr = "true"
+	}
+	return &microflows.SequenceFlow{
+		OriginID:      from,
+		DestinationID: to,
+		CaseValue:     &microflows.ExpressionCase{Expression: expr},
+	}
+}
+
+// shallowCopyCollection copies the slices and the objects the fold mutates, so
+// normalizing never reaches the stored model. Objects the fold does not touch
+// are shared, which is safe because DESCRIBE only reads them.
+func shallowCopyCollection(oc *microflows.MicroflowObjectCollection) *microflows.MicroflowObjectCollection {
+	out := &microflows.MicroflowObjectCollection{
+		Objects: make([]microflows.MicroflowObject, 0, len(oc.Objects)),
+		Flows:   make([]*microflows.SequenceFlow, 0, len(oc.Flows)),
+	}
+	for _, o := range oc.Objects {
+		if split, ok := o.(*microflows.ExclusiveSplit); ok {
+			clone := *split
+			out.Objects = append(out.Objects, &clone)
+			continue
+		}
+		out.Objects = append(out.Objects, o)
+	}
+	out.Flows = append(out.Flows, oc.Flows...)
+	return out
+}
+
+// spliceRedundantMerge removes a merge left with a single incoming and a single
+// outgoing flow, rewiring its predecessor straight to its successor.
+//
+// Folding routinely creates one: the entry to the shared suffix had several
+// predecessors before the fold and has exactly one after it. Leaving it in
+// would make Mode 3's output describe a node that its own re-execution drops.
+func spliceRedundantMerge(
+	id model.ID,
+	objects []microflows.MicroflowObject,
+	flows []*microflows.SequenceFlow,
+) ([]microflows.MicroflowObject, []*microflows.SequenceFlow) {
+	isMerge := false
+	for _, o := range objects {
+		if o != nil && o.GetID() == id {
+			_, isMerge = o.(*microflows.ExclusiveMerge)
+			break
+		}
+	}
+	if !isMerge {
+		return objects, flows
+	}
+
+	var incoming, outgoing []*microflows.SequenceFlow
+	for _, fl := range flows {
+		if fl == nil {
+			continue
+		}
+		if fl.DestinationID == id {
+			incoming = append(incoming, fl)
+		}
+		if fl.OriginID == id {
+			outgoing = append(outgoing, fl)
+		}
+	}
+	if len(incoming) != 1 || len(outgoing) != 1 {
+		return objects, flows
+	}
+
+	// Rewire the one predecessor past the merge, preserving its branch label.
+	incoming[0].DestinationID = outgoing[0].DestinationID
+
+	var keptObjects []microflows.MicroflowObject
+	for _, o := range objects {
+		if o != nil && o.GetID() == id {
+			continue
+		}
+		keptObjects = append(keptObjects, o)
+	}
+	var keptFlows []*microflows.SequenceFlow
+	for _, fl := range flows {
+		if fl == outgoing[0] {
+			continue
+		}
+		keptFlows = append(keptFlows, fl)
+	}
+	return keptObjects, keptFlows
+}
diff --git a/mdl/executor/cmd_microflows_normalize_test.go b/mdl/executor/cmd_microflows_normalize_test.go
new file mode 100644
index 0000000000..bddcf71a6a
--- /dev/null
+++ b/mdl/executor/cmd_microflows_normalize_test.go
@@ -0,0 +1,218 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package executor
+
+// Mode 3 rewrites a copy of the graph and lets the ordinary describer render
+// it. These tests pin the rewrite; the folding algebra itself is tested in
+// mdl/microflownorm (including a truth-table check over 3000 random formulas).
+//
+// The refusals matter as much as the fold. Every one of them is a case where
+// producing a guard anyway would give output that looks right and is not.
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/mendixlabs/mxcli/sdk/microflows"
+)
+
+// reporterGraph builds mendixlabs/mxcli#923's graph:
+//
+//	split1 : true → split2      false → merge1
+//	split2 : true → merge1      false → merge2
+//	merge1 → act → merge2 → end
+//
+// `act` runs on ¬c1 ∨ c2. Nested ifs describe it as c1 ∧ c2 — the defect.
+func reporterGraph(innerCond string) *rejoinFixture {
+	f := newRejoinFixture()
+	f.add("start", &microflows.StartEvent{BaseMicroflowObject: f.base(0)})
+	f.add("split1", &microflows.ExclusiveSplit{
+		BaseMicroflowObject: f.base(100),
+		SplitCondition:      &microflows.ExpressionSplitCondition{Expression: "$A"},
+	})
+	f.add("split2", &microflows.ExclusiveSplit{
+		BaseMicroflowObject: f.base(200),
+		SplitCondition:      &microflows.ExpressionSplitCondition{Expression: innerCond},
+	})
+	f.add("merge1", &microflows.ExclusiveMerge{BaseMicroflowObject: f.base(300)})
+	f.add("act", &microflows.ActionActivity{BaseActivity: microflows.BaseActivity{BaseMicroflowObject: f.base(350)}})
+	f.add("merge2", &microflows.ExclusiveMerge{BaseMicroflowObject: f.base(400)})
+	f.add("end", &microflows.EndEvent{BaseMicroflowObject: f.base(500)})
+	f.edge("start", "split1", false)
+	f.branch("split1", "split2", true)
+	f.branch("split1", "merge1", false)
+	f.branch("split2", "merge1", true)
+	f.branch("split2", "merge2", false)
+	f.edge("merge1", "act", false)
+	f.edge("act", "merge2", false)
+	f.edge("merge2", "end", false)
+	return f
+}
+
+func TestNormalizeCollection_FoldsTheReportersGraph(t *testing.T) {
+	f := reporterGraph("$B")
+	got, notes := normalizeCollection(f.col)
+
+	if len(notes) != 1 || !strings.Contains(notes[0], "NORMALIZED") {
+		t.Fatalf("expected one NORMALIZED note, got %v", notes)
+	}
+
+	var folded *microflows.ExclusiveSplit
+	splits := 0
+	for _, o := range got.Objects {
+		if s, ok := o.(*microflows.ExclusiveSplit); ok {
+			splits++
+			folded = s
+		}
+	}
+	if splits != 1 {
+		t.Fatalf("got %d splits after folding, want 1 — the inner split should be gone", splits)
+	}
+	expr, ok := folded.SplitCondition.(*microflows.ExpressionSplitCondition)
+	if !ok {
+		t.Fatal("folded split lost its expression condition")
+	}
+	if want := "$B or not($A)"; expr.Expression != want {
+		t.Errorf("folded condition = %q, want %q", expr.Expression, want)
+	}
+	// The #923 misdescription, stated so a regression names itself.
+	if expr.Expression == "$A and $B" {
+		t.Error("folded to the conjunction — this is the bug Mode 3 exists to fix")
+	}
+}
+
+// DESCRIBE must not touch the stored model, so the fold works on a copy.
+func TestNormalizeCollection_DoesNotMutateInput(t *testing.T) {
+	f := reporterGraph("$B")
+	before := len(f.col.Objects)
+	var originalCond string
+	for _, o := range f.col.Objects {
+		if s, ok := o.(*microflows.ExclusiveSplit); ok {
+			if e, ok := s.SplitCondition.(*microflows.ExpressionSplitCondition); ok && e.Expression == "$A" {
+				originalCond = e.Expression
+			}
+		}
+	}
+
+	normalizeCollection(f.col)
+
+	if len(f.col.Objects) != before {
+		t.Errorf("input collection lost objects: %d -> %d", before, len(f.col.Objects))
+	}
+	for _, o := range f.col.Objects {
+		if s, ok := o.(*microflows.ExclusiveSplit); ok {
+			if e, ok := s.SplitCondition.(*microflows.ExpressionSplitCondition); ok && e.Expression == "$B or not($A)" {
+				t.Fatal("the fold wrote its condition back into the input — a DESCRIBE must not mutate the model")
+			}
+		}
+	}
+	if originalCond != "$A" {
+		t.Fatalf("fixture is wrong: outer condition was %q", originalCond)
+	}
+}
+
+// A properly nested graph has nothing to fold, and Mode 3 must leave it exactly
+// as Mode 1 renders it. This is the regression risk of the whole feature.
+func TestNormalizeCollection_LeavesNestedGraphAlone(t *testing.T) {
+	f := newRejoinFixture()
+	f.add("start", &microflows.StartEvent{BaseMicroflowObject: f.base(0)})
+	f.add("split", &microflows.ExclusiveSplit{
+		BaseMicroflowObject: f.base(100),
+		SplitCondition:      &microflows.ExpressionSplitCondition{Expression: "$X"},
+	})
+	f.add("then", &microflows.ActionActivity{BaseActivity: microflows.BaseActivity{BaseMicroflowObject: f.base(150)}})
+	f.add("merge", &microflows.ExclusiveMerge{BaseMicroflowObject: f.base(200)})
+	f.add("end", &microflows.EndEvent{BaseMicroflowObject: f.base(300)})
+	f.edge("start", "split", false)
+	f.branch("split", "then", true)
+	f.branch("split", "merge", false)
+	f.edge("then", "merge", false)
+	f.edge("merge", "end", false)
+
+	got, notes := normalizeCollection(f.col)
+	if len(notes) != 0 {
+		t.Errorf("a properly nested graph produced notes: %v", notes)
+	}
+	if len(got.Objects) != len(f.col.Objects) {
+		t.Errorf("a properly nested graph was rewritten: %d -> %d objects", len(f.col.Objects), len(got.Objects))
+	}
+}
+
+// THE PRECONDITION, at the executor level. An activity between the split and
+// the shared suffix means folding would move a side effect, so the fold must
+// refuse and say so rather than hoisting it.
+func TestNormalizeCollection_RefusesToFoldOverAnActivity(t *testing.T) {
+	f := newRejoinFixture()
+	f.add("start", &microflows.StartEvent{BaseMicroflowObject: f.base(0)})
+	f.add("split1", &microflows.ExclusiveSplit{
+		BaseMicroflowObject: f.base(100),
+		SplitCondition:      &microflows.ExpressionSplitCondition{Expression: "$A"},
+	})
+	// A create-object sits on the path to the inner split.
+	f.add("create", &microflows.ActionActivity{BaseActivity: microflows.BaseActivity{BaseMicroflowObject: f.base(150)}})
+	f.add("split2", &microflows.ExclusiveSplit{
+		BaseMicroflowObject: f.base(200),
+		SplitCondition:      &microflows.ExpressionSplitCondition{Expression: "$B"},
+	})
+	f.add("merge1", &microflows.ExclusiveMerge{BaseMicroflowObject: f.base(300)})
+	f.add("act", &microflows.ActionActivity{BaseActivity: microflows.BaseActivity{BaseMicroflowObject: f.base(350)}})
+	f.add("merge2", &microflows.ExclusiveMerge{BaseMicroflowObject: f.base(400)})
+	f.add("end", &microflows.EndEvent{BaseMicroflowObject: f.base(500)})
+	f.edge("start", "split1", false)
+	f.branch("split1", "create", true)
+	f.branch("split1", "merge1", false)
+	f.edge("create", "split2", false)
+	f.branch("split2", "merge1", true)
+	f.branch("split2", "merge2", false)
+	f.edge("merge1", "act", false)
+	f.edge("act", "merge2", false)
+	f.edge("merge2", "end", false)
+
+	_, notes := normalizeCollection(f.col)
+	if len(notes) != 1 || !strings.Contains(notes[0], "could not be normalized") {
+		t.Fatalf("expected a refusal note, got %v", notes)
+	}
+	if !strings.Contains(notes[0], "side effect") {
+		t.Errorf("the refusal does not say why: %q", notes[0])
+	}
+}
+
+// A rule-based decision has no expression to fold into, so it is refused rather
+// than rendered with an invented condition.
+func TestNormalizeCollection_RefusesRuleBasedDecision(t *testing.T) {
+	f := reporterGraph("$B")
+	for _, o := range f.col.Objects {
+		if s, ok := o.(*microflows.ExclusiveSplit); ok {
+			if e, ok := s.SplitCondition.(*microflows.ExpressionSplitCondition); ok && e.Expression == "$B" {
+				s.SplitCondition = &microflows.RuleSplitCondition{}
+			}
+		}
+	}
+	_, notes := normalizeCollection(f.col)
+	if len(notes) != 1 || !strings.Contains(notes[0], "rule-based") {
+		t.Fatalf("expected a rule-based refusal, got %v", notes)
+	}
+}
+
+// Folding is deterministic, so DESCRIBE stays a fixed point.
+func TestNormalizeCollection_IsDeterministic(t *testing.T) {
+	first := ""
+	for i := 0; i < 25; i++ {
+		got, _ := normalizeCollection(reporterGraph("$B").col)
+		var cond string
+		for _, o := range got.Objects {
+			if s, ok := o.(*microflows.ExclusiveSplit); ok {
+				if e, ok := s.SplitCondition.(*microflows.ExpressionSplitCondition); ok {
+					cond = e.Expression
+				}
+			}
+		}
+		if i == 0 {
+			first = cond
+			continue
+		}
+		if cond != first {
+			t.Fatalf("run %d folded to %q, first run gave %q", i, cond, first)
+		}
+	}
+}
diff --git a/mdl/executor/cmd_microflows_show.go b/mdl/executor/cmd_microflows_show.go
index 8f40142186..b922474dad 100644
--- a/mdl/executor/cmd_microflows_show.go
+++ b/mdl/executor/cmd_microflows_show.go
@@ -193,7 +193,15 @@ func calculateNanoflowComplexity(nf *microflows.Nanoflow) int {
 }
 
 // describeMicroflow handles DESCRIBE MICROFLOW command - outputs MDL source code.
+// describeMicroflow renders a microflow as MDL (Mode 1 / Mode 2). It keeps this
+// exact signature because the catalog dispatches on it by name.
 func describeMicroflow(ctx *ExecContext, name ast.QualifiedName) error {
+	return describeMicroflowMode(ctx, name, false)
+}
+
+// describeMicroflowMode adds Mode 3: with normalized set, a recombinable
+// irreducible split is folded into a single condition rather than flattened.
+func describeMicroflowMode(ctx *ExecContext, name ast.QualifiedName, normalized bool) error {
 	// Get hierarchy for module/folder resolution
 	h, err := getHierarchy(ctx)
 	if err != nil {
@@ -230,8 +238,20 @@ func describeMicroflow(ctx *ExecContext, name ast.QualifiedName) error {
 		return mdlerrors.NewNotFound("microflow", name.String())
 	}
 
+	// Mode 3. Fold the guards of any recombinable split into one condition and
+	// describe the resulting properly-nested graph, rather than flattening the
+	// real one into MDL that means something else. Works on a copy: a DESCRIBE
+	// never touches the stored model.
+	var normalizeNotes []string
+	if normalized {
+		clone := *targetMf
+		clone.ObjectCollection, normalizeNotes = normalizeCollection(targetMf.ObjectCollection)
+		targetMf = &clone
+	}
+
 	// Generate MDL output
 	var lines []string
+	lines = append(lines, normalizeNotes...)
 
 	// Documentation
 	if targetMf.Documentation != "" {
@@ -758,6 +778,7 @@ func formatMicroflowActivities(
 	var lines []string
 	lines = append(lines, duplicateOutputVariableWarnings(mf.ObjectCollection)...)
 	lines = append(lines, irreducibleGraphWarnings(mf.ObjectCollection)...)
+	lines = append(lines, droppedMergeWarnings(ctx, mf.ObjectCollection, labelRejoinMerges(mf.ObjectCollection))...)
 
 	// Sort flows by OriginConnectionIndex for each origin
 	for originID := range flowsByOrigin {
@@ -996,6 +1017,7 @@ func formatMicroflowActivitiesWithSourceMap(
 	var lines []string
 	lines = append(lines, duplicateOutputVariableWarnings(mf.ObjectCollection)...)
 	lines = append(lines, irreducibleGraphWarnings(mf.ObjectCollection)...)
+	lines = append(lines, droppedMergeWarnings(ctx, mf.ObjectCollection, labelRejoinMerges(mf.ObjectCollection))...)
 
 	for originID := range flowsByOrigin {
 		flows := flowsByOrigin[originID]
diff --git a/mdl/executor/cmd_microflows_show_dropped_merge_test.go b/mdl/executor/cmd_microflows_show_dropped_merge_test.go
new file mode 100644
index 0000000000..3fa298b4b7
--- /dev/null
+++ b/mdl/executor/cmd_microflows_show_dropped_merge_test.go
@@ -0,0 +1,174 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package executor
+
+// A merge the description does not represent is DELETED by describe -> exec,
+// and used to be deleted silently.
+//
+// Measured on Mendix 11.14.0 before this warning existed: a microflow authored
+// with two merges — one a 2-input error rejoin, one a 1-input pass-through —
+// described to ONE `merge`, and executing that output left the model with one.
+// No MDL-FLOW01 (the graph is perfectly reducible), no warning on exec, just
+// `Replaced microflow` a node lighter.
+//
+// The negative controls matter more than the positive one here. This warning
+// prints on every DESCRIBE of a real microflow if it is wrong about what
+// "represented" means, so the ordinary if/else merge and the labelled rejoin
+// each get a test proving they stay quiet.
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/mendixlabs/mxcli/model"
+	"github.com/mendixlabs/mxcli/sdk/microflows"
+)
+
+// The defect. A merge with one incoming path, reached by neither a split nor an
+// error handler, is represented by nothing in the emitted MDL.
+func TestDroppedMergeWarnings_PassThroughMergeIsFlagged(t *testing.T) {
+	f := newRejoinFixture()
+	f.add("start", &microflows.StartEvent{BaseMicroflowObject: f.base(0)})
+	f.add("act", &microflows.ActionActivity{BaseActivity: microflows.BaseActivity{BaseMicroflowObject: f.base(100)}})
+	f.add("merge", &microflows.ExclusiveMerge{BaseMicroflowObject: f.base(200)})
+	f.add("end", &microflows.EndEvent{BaseMicroflowObject: f.base(300)})
+	f.edge("start", "act", false)
+	f.edge("act", "merge", false)
+	f.edge("merge", "end", false)
+
+	warnings := droppedMergeWarnings(nil, f.col, labelRejoinMerges(f.col))
+	if len(warnings) != 1 {
+		t.Fatalf("got %d warnings, want 1: %v", len(warnings), warnings)
+	}
+	if !strings.Contains(warnings[0], "WARNING") || !strings.Contains(warnings[0], "merge") {
+		t.Errorf("warning does not name the problem: %q", warnings[0])
+	}
+	// The position is what lets someone find the node in Studio Pro.
+	if !strings.Contains(warnings[0], "(200, 100)") {
+		t.Errorf("warning does not carry the merge's position: %q", warnings[0])
+	}
+}
+
+// NEGATIVE CONTROL, and the important one: the merge that closes an ordinary
+// if/else is represented by `end if`, so it round-trips. Every microflow with a
+// decision has one of these, and warning on them would make the warning noise.
+func TestDroppedMergeWarnings_IfElseMergeIsNotFlagged(t *testing.T) {
+	f := newRejoinFixture()
+	f.add("start", &microflows.StartEvent{BaseMicroflowObject: f.base(0)})
+	f.add("split", &microflows.ExclusiveSplit{BaseMicroflowObject: f.base(100)})
+	f.add("then", &microflows.ActionActivity{BaseActivity: microflows.BaseActivity{BaseMicroflowObject: f.base(150)}})
+	f.add("else", &microflows.ActionActivity{BaseActivity: microflows.BaseActivity{BaseMicroflowObject: f.base(150)}})
+	f.add("merge", &microflows.ExclusiveMerge{BaseMicroflowObject: f.base(200)})
+	f.add("end", &microflows.EndEvent{BaseMicroflowObject: f.base(300)})
+	f.edge("start", "split", false)
+	f.edge("split", "then", false)
+	f.edge("split", "else", false)
+	f.edge("then", "merge", false)
+	f.edge("else", "merge", false)
+	f.edge("merge", "end", false)
+
+	if got := droppedMergeWarnings(nil, f.col, labelRejoinMerges(f.col)); len(got) != 0 {
+		t.Errorf("flagged the merge of an ordinary if/else: %v", got)
+	}
+}
+
+// NEGATIVE CONTROL: a labelled error rejoin is emitted as `merge <label>`, so it
+// is represented and must stay quiet.
+func TestDroppedMergeWarnings_LabelledRejoinIsNotFlagged(t *testing.T) {
+	f := newRejoinFixture()
+	f.add("start", &microflows.StartEvent{BaseMicroflowObject: f.base(0)})
+	f.add("call", &microflows.ActionActivity{BaseActivity: microflows.BaseActivity{BaseMicroflowObject: f.base(100)}})
+	f.add("handler", &microflows.ActionActivity{BaseActivity: microflows.BaseActivity{BaseMicroflowObject: f.base(100)}})
+	f.add("merge", &microflows.ExclusiveMerge{BaseMicroflowObject: f.base(200)})
+	f.add("end", &microflows.EndEvent{BaseMicroflowObject: f.base(300)})
+	f.edge("start", "call", false)
+	f.edge("call", "merge", false)
+	f.edge("call", "handler", true)
+	f.edge("handler", "merge", false)
+	f.edge("merge", "end", false)
+
+	labels := labelRejoinMerges(f.col)
+	if len(labels) != 1 {
+		t.Fatalf("fixture is wrong: expected the rejoin to be labelled, got %d labels", len(labels))
+	}
+	if got := droppedMergeWarnings(nil, f.col, labels); len(got) != 0 {
+		t.Errorf("flagged a merge that DESCRIBE emits as `merge <label>`: %v", got)
+	}
+}
+
+// A merge inside a loop body is described by the loop's own traversal, which has
+// its own object collection. Recursing is what keeps this from reporting every
+// in-loop merge as dropped.
+func TestDroppedMergeWarnings_RecursesIntoLoopBodies(t *testing.T) {
+	inner := &microflows.MicroflowObjectCollection{}
+	innerSplit := &microflows.ExclusiveSplit{BaseMicroflowObject: microflows.BaseMicroflowObject{
+		BaseElement: model.BaseElement{ID: model.ID(randomTestID())}, Position: model.Point{X: 10, Y: 10}}}
+	innerA := &microflows.ActionActivity{BaseActivity: microflows.BaseActivity{BaseMicroflowObject: microflows.BaseMicroflowObject{
+		BaseElement: model.BaseElement{ID: model.ID(randomTestID())}, Position: model.Point{X: 20, Y: 5}}}}
+	innerB := &microflows.ActionActivity{BaseActivity: microflows.BaseActivity{BaseMicroflowObject: microflows.BaseMicroflowObject{
+		BaseElement: model.BaseElement{ID: model.ID(randomTestID())}, Position: model.Point{X: 20, Y: 15}}}}
+	innerMerge := &microflows.ExclusiveMerge{BaseMicroflowObject: microflows.BaseMicroflowObject{
+		BaseElement: model.BaseElement{ID: model.ID(randomTestID())}, Position: model.Point{X: 30, Y: 10}}}
+	inner.Objects = append(inner.Objects, innerSplit, innerA, innerB, innerMerge)
+	edge := func(from, to microflows.MicroflowObject) {
+		inner.Flows = append(inner.Flows, &microflows.SequenceFlow{
+			BaseElement:   model.BaseElement{ID: model.ID(randomTestID())},
+			OriginID:      from.GetID(),
+			DestinationID: to.GetID(),
+		})
+	}
+	edge(innerSplit, innerA)
+	edge(innerSplit, innerB)
+	edge(innerA, innerMerge)
+	edge(innerB, innerMerge)
+
+	f := newRejoinFixture()
+	f.add("start", &microflows.StartEvent{BaseMicroflowObject: f.base(0)})
+	f.add("loop", &microflows.LoopedActivity{
+		BaseMicroflowObject: f.base(100),
+		ObjectCollection:    inner,
+	})
+	f.add("end", &microflows.EndEvent{BaseMicroflowObject: f.base(300)})
+	f.edge("start", "loop", false)
+	f.edge("loop", "end", false)
+
+	if got := droppedMergeWarnings(nil, f.col, labelRejoinMerges(f.col)); len(got) != 0 {
+		t.Errorf("flagged an if/else merge inside a loop body: %v", got)
+	}
+}
+
+// NEGATIVE CONTROL taken from real code, and the one that a purely
+// split-join-based rule gets wrong: a split where one branch RETURNS. There is
+// then no join common to all branches, so findMergeForSplit pairs nothing, yet
+// the merge is still emitted as the continuation after the split closes and
+// survives describe → exec with its $ID intact.
+//
+// Shape of Administration.ManageMyAccount (Administration 4.3.2), measured:
+// merge $ID 9b634100… identical before and after the round trip. Flagging it
+// would put a warning on ordinary Marketplace code.
+func TestDroppedMergeWarnings_SplitWithReturningBranchIsNotFlagged(t *testing.T) {
+	f := newRejoinFixture()
+	f.add("start", &microflows.StartEvent{BaseMicroflowObject: f.base(0)})
+	f.add("split", &microflows.ExclusiveSplit{BaseMicroflowObject: f.base(100)})
+	f.add("act", &microflows.ActionActivity{BaseActivity: microflows.BaseActivity{BaseMicroflowObject: f.base(150)}})
+	f.add("earlyReturn", &microflows.EndEvent{BaseMicroflowObject: f.base(200)})
+	f.add("merge", &microflows.ExclusiveMerge{BaseMicroflowObject: f.base(250)})
+	f.add("tail", &microflows.ActionActivity{BaseActivity: microflows.BaseActivity{BaseMicroflowObject: f.base(300)}})
+	f.add("end", &microflows.EndEvent{BaseMicroflowObject: f.base(350)})
+	f.edge("start", "split", false)
+	// One branch terminates, so no join is common to all of them and
+	// findMergeForSplit pairs nothing...
+	f.edge("split", "act", false)
+	f.edge("act", "earlyReturn", false)
+	// ...but the other two converge on the merge, which is what keeps it real.
+	// ManageMyAccount's merge has in-degree 2 for exactly this reason.
+	f.edge("split", "merge", false)
+	f.edge("split", "merge", false)
+	f.edge("merge", "tail", false)
+	f.edge("tail", "end", false)
+
+	// Precondition: the fixture really is the shape that defeats split pairing.
+	if got := droppedMergeWarnings(nil, f.col, labelRejoinMerges(f.col)); len(got) != 0 {
+		t.Errorf("flagged a merge that survives the round trip: %v", got)
+	}
+}
diff --git a/mdl/executor/cmd_microflows_show_merge.go b/mdl/executor/cmd_microflows_show_merge.go
index 3305595e00..e46c556afd 100644
--- a/mdl/executor/cmd_microflows_show_merge.go
+++ b/mdl/executor/cmd_microflows_show_merge.go
@@ -187,3 +187,103 @@ func mergeDeclarationLines(indent int, label string, obj microflows.MicroflowObj
 		pad + "merge " + label + ";",
 	}
 }
+
+// droppedMergeWarnings flags every ExclusiveMerge the description does not
+// represent — and which a describe → exec round trip therefore DELETES.
+//
+// Three shapes are represented and must stay quiet, because between them they
+// cover every merge in a real project that survives the round trip:
+//
+//   - the join point of an exclusive/inheritance split, rendered implicitly by
+//     `end if` / `end split`;
+//   - a labelled error rejoin, rendered explicitly as `merge <label>`; and
+//   - any merge with two or more incoming flows, which is a genuine convergence
+//     the describer renders as the continuation of whatever construct it closes.
+//
+// That last one is not redundant with the first, and the case that proves it is
+// a split where one branch `return`s: findMergeForSplit needs a join common to
+// ALL branches, so it finds none, yet the merge is still emitted as the
+// continuation after `end split` and survives. Measured on
+// Administration.ManageMyAccount (Administration 4.3.2), whose merge keeps its
+// $ID across describe → exec; without the in-degree clause it is a false
+// positive, and a warning that cries wolf on ordinary Marketplace code is worse
+// than no warning.
+//
+// What is left — a merge with a SINGLE incoming path — is walked straight
+// through by the describer and represented by nothing at all. Measured across
+// the microflows of a blank 11.14 app plus FeedbackModule: every one-input
+// merge is deleted by describe → exec (7 of 7) and every other survivor keeps
+// its $ID. It is behaviourally harmless (a one-input merge is a no-op) but it
+// deletes a node the user drew, which is what guard-don't-drop exists to
+// prevent. MDL-FLOW01 does not cover it: the graph is perfectly reducible, so
+// the irreducibility detector is right to stay silent and something else has to
+// speak.
+//
+// Deliberately NOT covered here: a merge lost to the flattening of an
+// IRREDUCIBLE graph (one two-input merge of
+// FeedbackModule.SUB_Feedback_SendToServer goes this way). That microflow
+// already carries MDL-FLOW01, which says the description is not equivalent and
+// must not be re-executed at all — a strictly stronger statement than this
+// warning, and the right owner for it.
+//
+// Loop bodies are recursed into because a LoopedActivity owns its own object
+// collection and its own traversal; without that every in-loop if/else merge
+// would report as dropped.
+func droppedMergeWarnings(ctx *ExecContext, oc *microflows.MicroflowObjectCollection, labels mergeLabels) []string {
+	if oc == nil {
+		return nil
+	}
+
+	activityMap := map[model.ID]microflows.MicroflowObject{}
+	for _, o := range oc.Objects {
+		if o != nil {
+			activityMap[o.GetID()] = o
+		}
+	}
+
+	// Merges that a split joins on are spelled by `end if` / `end split`.
+	represented := map[model.ID]bool{}
+	for _, mergeID := range findSplitMergePoints(ctx, oc, activityMap) {
+		represented[mergeID] = true
+	}
+
+	// A merge two or more paths arrive at is a real convergence and is rendered
+	// as the continuation of whatever construct closes there — including the
+	// split-with-a-returning-branch that findSplitMergePoints cannot pair up.
+	inDegree := map[model.ID]int{}
+	for _, f := range oc.Flows {
+		if f != nil {
+			inDegree[f.DestinationID]++
+		}
+	}
+
+	var out []string
+	for _, o := range oc.Objects {
+		merge, ok := o.(*microflows.ExclusiveMerge)
+		if !ok {
+			continue
+		}
+		if represented[merge.GetID()] || inDegree[merge.GetID()] >= 2 {
+			continue
+		}
+		if _, labelled := labels.of(merge.GetID()); labelled {
+			continue
+		}
+		p := merge.GetPosition()
+		out = append(out, fmt.Sprintf(
+			"-- WARNING: the merge at (%d, %d) is not represented in this description - "+
+				"it joins no decision and no error handler, so re-executing this MDL DELETES it. "+
+				"The microflow behaves the same either way (a merge with one incoming path is a no-op), "+
+				"but the node disappears from the diagram (mxcli #923)",
+			p.X, p.Y))
+	}
+
+	// A loop body is described by its own traversal, so its merges are judged
+	// against its own collection.
+	for _, o := range oc.Objects {
+		if loop, ok := o.(*microflows.LoopedActivity); ok {
+			out = append(out, droppedMergeWarnings(ctx, loop.ObjectCollection, labels)...)
+		}
+	}
+	return out
+}
diff --git a/mdl/executor/cmd_microflows_show_merge_test.go b/mdl/executor/cmd_microflows_show_merge_test.go
index a0a75ceb49..c0849186f0 100644
--- a/mdl/executor/cmd_microflows_show_merge_test.go
+++ b/mdl/executor/cmd_microflows_show_merge_test.go
@@ -52,6 +52,21 @@ func (f *rejoinFixture) edge(from, to string, isError bool) {
 	})
 }
 
+// branch adds a labelled edge out of a split, which is how the describer tells
+// the true arm from the false one.
+func (f *rejoinFixture) branch(from, to string, isTrue bool) {
+	expr := "false"
+	if isTrue {
+		expr = "true"
+	}
+	f.col.Flows = append(f.col.Flows, &microflows.SequenceFlow{
+		BaseElement:   model.BaseElement{ID: model.ID(randomTestID())},
+		OriginID:      f.ids[from],
+		DestinationID: f.ids[to],
+		CaseValue:     &microflows.ExpressionCase{Expression: expr},
+	})
+}
+
 var testIDCounter int
 
 func randomTestID() string {
diff --git a/mdl/executor/cmd_pages_builder_v3_widgets.go b/mdl/executor/cmd_pages_builder_v3_widgets.go
index 1939ba1617..0aee2b63b1 100644
--- a/mdl/executor/cmd_pages_builder_v3_widgets.go
+++ b/mdl/executor/cmd_pages_builder_v3_widgets.go
@@ -945,19 +945,12 @@ func (pb *pageBuilder) buildButtonV3(w *ast.WidgetV3) (*pages.ActionButton, erro
 		btn.Action = act
 	}
 
-	// Handle Icon (issue #602): an icon-collection reference (a modern Atlas
-	// icon) — e.g. `icon: 'Atlas_Core.Atlas_Filled.pencil'` — serialized as a
-	// Forms$IconCollectionIcon.
-	if iconRef := strings.Trim(strings.TrimSpace(w.GetStringProp("icon")), "'\""); iconRef != "" {
-		btn.Icon = &pages.Icon{
-			BaseElement: model.BaseElement{
-				ID:       model.ID(types.GenerateID()),
-				TypeName: "Forms$IconCollectionIcon",
-			},
-			Type:  pages.IconTypeIconCollection,
-			Image: iconRef,
-		}
+	// Handle Icon (#602, #1059): one of Mendix's three icon elements.
+	icon, err := buildWidgetIcon(w)
+	if err != nil {
+		return nil, err
 	}
+	btn.Icon = icon
 
 	if err := pb.registerWidgetName(w.Name, btn.ID); err != nil {
 		return nil, err
@@ -1314,3 +1307,76 @@ func propBool(v any) (bool, error) {
 	}
 	return false, fmt.Errorf("invalid value %v (expected true or false)", v)
 }
+
+// buildWidgetIcon turns a widget's `Icon:` property into the icon element it
+// names, or nil when the widget carries none.
+//
+// It dispatches on the KIND the author wrote rather than inferring one from the
+// payload, because there is nothing in the payload to infer from: an
+// icon-collection icon and an image icon are both a Module.Collection.Name, into
+// two different documents. Writing the wrong one is not a cosmetic error — a
+// name stored as a custom-icon reference that is really an image fails the build
+// with CE1613, which is how this was reported (mendixlabs/mxcli#1059).
+//
+// A bare name with no kind is the collection icon, so every script written
+// against the original `Icon: 'Atlas_Core.Atlas_Filled.pencil'` keeps its
+// meaning. That legacy string form is still accepted here, and not only for
+// scripts: several callers build a WidgetV3 directly.
+func buildWidgetIcon(w *ast.WidgetV3) (*pages.Icon, error) {
+	spec := widgetIconSpec(w)
+	if spec == nil {
+		return nil, nil
+	}
+	icon := &pages.Icon{
+		BaseElement: model.BaseElement{
+			ID:       model.ID(types.GenerateID()),
+			TypeName: types.MenuIconStorageType(spec.Kind),
+		},
+		Kind:  spec.Kind,
+		Image: spec.Name,
+		Code:  spec.Code,
+	}
+	// Refuse an icon that names nothing rather than writing an element nobody can
+	// see. A glyph is identified by its code ALONE, so a missing code is as fatal
+	// there as a missing name is for the other two — and the failure would be
+	// invisible: a bare Forms$GlyphIcon builds cleanly and renders nothing.
+	switch spec.Kind {
+	case types.MenuIconGlyph:
+		if spec.Code == 0 {
+			return nil, mdlerrors.NewValidationf(
+				"button %q: `Icon: glyph` needs a character code, e.g. `Icon: glyph 57377` — "+
+					"a glyph icon carries no name, so the code is the only thing that identifies it", w.Name)
+		}
+	default:
+		if spec.Name == "" {
+			return nil, mdlerrors.NewValidationf(
+				"button %q: `Icon:` needs a qualified name, e.g. `Icon: 'Atlas_Core.Atlas_Filled.pencil'`", w.Name)
+		}
+	}
+	if icon.TypeName == "" {
+		return nil, mdlerrors.NewValidationf("button %q: unsupported icon kind %q", w.Name, spec.Kind)
+	}
+	return icon, nil
+}
+
+// widgetIconSpec reads the `Icon:` property in either shape: the typed value the
+// visitor produces, or the plain string the property carried before the kinds
+// existed. Returns nil when there is no icon.
+func widgetIconSpec(w *ast.WidgetV3) *ast.WidgetIcon {
+	for _, key := range []string{"Icon", "icon"} {
+		switch v := w.Properties[key].(type) {
+		case *ast.WidgetIcon:
+			if v != nil {
+				return v
+			}
+		case ast.WidgetIcon:
+			spec := v
+			return &spec
+		case string:
+			if name := strings.Trim(strings.TrimSpace(v), "'\""); name != "" {
+				return &ast.WidgetIcon{Kind: types.MenuIconCollection, Name: name}
+			}
+		}
+	}
+	return nil
+}
diff --git a/mdl/executor/cmd_pages_describe.go b/mdl/executor/cmd_pages_describe.go
index 3a7a7d0439..e1c0f6c06b 100644
--- a/mdl/executor/cmd_pages_describe.go
+++ b/mdl/executor/cmd_pages_describe.go
@@ -595,14 +595,23 @@ type rawDataGridColumn struct {
 
 // rawWidget represents a widget from raw BSON data for MDL output.
 type rawWidget struct {
-	Type            string
-	Name            string
-	Content         string
-	Caption         string
-	RenderMode      string
-	Action          string
-	ButtonStyle     string
-	Icon            string // Icon-collection reference on a button (e.g. Atlas_Core.Atlas_Filled.pencil)
+	Type        string
+	Name        string
+	Content     string
+	Caption     string
+	RenderMode  string
+	Action      string
+	ButtonStyle string
+	// Icon is the qualified name an icon-collection or image icon points at.
+	// Empty for no icon and for a glyph icon, which carries a numeric Code
+	// instead. IconType keeps the storage $Type so the emitter can tell the
+	// three apart — only Forms$IconCollectionIcon is authorable, and the two
+	// named variants are spelled identically, so a reader that keeps the name
+	// without the kind cannot avoid converting one into the other
+	// (mendixlabs/mxcli#1059). Same split as types.NavMenuItem's.
+	Icon            string // e.g. Atlas_Core.Atlas_Filled.pencil
+	IconType        string // storage $Type, "" when the widget carries no icon
+	IconCode        int    // Forms$GlyphIcon's Code — the only identity a glyph icon has
 	Selection       string // For Gallery selection mode (Single, Multi, None)
 	Class           string // CSS class from Appearance
 	Style           string // Inline CSS style from Appearance
diff --git a/mdl/executor/cmd_pages_describe_icon_test.go b/mdl/executor/cmd_pages_describe_icon_test.go
new file mode 100644
index 0000000000..07719424d6
--- /dev/null
+++ b/mdl/executor/cmd_pages_describe_icon_test.go
@@ -0,0 +1,218 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package executor
+
+import (
+	"bytes"
+	"strings"
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/visitor"
+	"github.com/mendixlabs/mxcli/model"
+	"github.com/mendixlabs/mxcli/sdk/pages"
+)
+
+// mendixlabs/mxcli#1059: `describe page` -> `create or replace page` turned a
+// button's icon into a broken reference, and the build was the first thing that
+// said so:
+//
+//	[error] [CE1613] "The selected custom icon 'DesignSystem.Icons_SVG.edit'
+//	no longer exists."
+//
+// Mendix stores THREE icon elements and two of them put a qualified name under
+// the same BSON key:
+//
+//	Forms$IconCollectionIcon{Image} -> CustomIcons$CustomIcon
+//	Forms$ImageIcon{Image}          -> Images$Image        (a DIFFERENT document)
+//	Forms$GlyphIcon{Code}           -> a font code point, no name at all
+//
+// DESCRIBE read `Image` off whichever element was there and the page builder
+// wrote Forms$IconCollectionIcon unconditionally, so an image icon came back as
+// a custom-icon reference — the silent variant swap. The same three-way split
+// was already understood one layer over, in navigation
+// (types.MenuIconKindOf, cmd_navigation_icon_roundtrip_test.go); the page path
+// never received it.
+//
+// These tests assert on the emitted MDL rather than on the extractor, because
+// the defect was that read, emit and write disagreed about what an icon IS.
+
+// iconButton is one stored Forms$ActionButton carrying one icon element.
+func iconButton(iconType, image string, code int) map[string]any {
+	icon := map[string]any{"$Type": iconType}
+	if image != "" {
+		icon["Image"] = image
+	}
+	if code != 0 {
+		icon["Code"] = code
+	}
+	return map[string]any{
+		"$Type": "Forms$ActionButton",
+		"Name":  "btnEdit",
+		"Icon":  icon,
+	}
+}
+
+// describeButton runs the real describe path over a stored widget map.
+func describeButton(t *testing.T, w map[string]any) string {
+	t.Helper()
+	ctx, _ := newMockCtx(t)
+	var buf bytes.Buffer
+	ctx.Output = &buf
+	for _, rw := range parseRawWidget(ctx, w) {
+		outputWidgetMDLV3(ctx, rw, 0)
+	}
+	return buf.String()
+}
+
+// TestDescribeButtonIcon_RoundTripsEveryVariant is the whole point: DESCRIBE's
+// output, re-executed, has to rebuild the SAME element — not merely something
+// that parses.
+//
+// That is the assertion the reported bug would have failed. An image icon came
+// out spelled exactly like an icon-collection reference, so it parsed, executed
+// and produced a document whose build said `[CE1613] "The selected custom icon
+// 'DesignSystem.Icons_SVG.edit' no longer exists."` A glyph icon came out as
+// nothing at all and replay deleted it.
+//
+// The round trip runs the real parser and the real page builder, because the
+// defect was that read, emit and write each had a different idea of what an icon
+// is — asserting on any one of them alone is what let them drift.
+func TestDescribeButtonIcon_RoundTripsEveryVariant(t *testing.T) {
+	cases := []struct {
+		name     string
+		stored   map[string]any
+		wantMDL  string
+		wantType string
+		wantName string
+		wantCode int
+	}{{
+		name:     "collection",
+		stored:   iconButton("Forms$IconCollectionIcon", "Atlas_Core.Atlas_Filled.pencil", 0),
+		wantMDL:  "Icon: 'Atlas_Core.Atlas_Filled.pencil'",
+		wantType: "Forms$IconCollectionIcon",
+		wantName: "Atlas_Core.Atlas_Filled.pencil",
+	}, {
+		// The reported case. Same spelling as the row above until the keyword
+		// tells them apart.
+		name:     "image",
+		stored:   iconButton("Forms$ImageIcon", "DesignSystem.Icons_SVG.edit", 0),
+		wantMDL:  "Icon: image 'DesignSystem.Icons_SVG.edit'",
+		wantType: "Forms$ImageIcon",
+		wantName: "DesignSystem.Icons_SVG.edit",
+	}, {
+		// The half that was worse than reported: no name, so nothing to emit,
+		// so silence — and CREATE OR REPLACE PAGE is a full replacement.
+		name:     "glyph",
+		stored:   iconButton("Forms$GlyphIcon", "", 57377),
+		wantMDL:  "Icon: glyph 57377",
+		wantType: "Forms$GlyphIcon",
+		wantCode: 57377,
+	}}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			out := describeButton(t, tc.stored)
+			if !strings.Contains(out, tc.wantMDL) {
+				t.Fatalf("describe did not emit %q:\n%s", tc.wantMDL, out)
+			}
+			if strings.Contains(out, "NOT re-executable") {
+				t.Errorf("an authorable icon was flagged as unauthorable:\n%s", out)
+			}
+
+			icon := rebuildButtonIcon(t, tc.wantMDL)
+			if icon == nil {
+				t.Fatal("re-executing DESCRIBE's own output produced no icon")
+			}
+			if icon.TypeName != tc.wantType {
+				t.Errorf("replay rebuilt %s, want %s — a silent variant swap",
+					icon.TypeName, tc.wantType)
+			}
+			if icon.Image != tc.wantName {
+				t.Errorf("replay rebuilt Image %q, want %q", icon.Image, tc.wantName)
+			}
+			if icon.Code != tc.wantCode {
+				t.Errorf("replay rebuilt Code %d, want %d", icon.Code, tc.wantCode)
+			}
+		})
+	}
+}
+
+// rebuildButtonIcon parses one `Icon:` clause inside a real page statement and
+// runs the page builder over it, returning the icon element replay would store.
+func rebuildButtonIcon(t *testing.T, iconClause string) *pages.Icon {
+	t.Helper()
+	src := "create page Mod.P (Title: 'T') {\n  actionbutton btnEdit (Caption: 'Edit', " + iconClause + ")\n}"
+	prog, errs := visitor.Build(src)
+	if len(errs) > 0 {
+		t.Fatalf("DESCRIBE emitted MDL that does not parse (%q): %v", iconClause, errs)
+	}
+	page := prog.Statements[0].(*ast.CreatePageStmtV3)
+	pb := &pageBuilder{widgetScope: map[string]model.ID{}}
+	widget, err := pb.buildWidgetV3(page.Widgets[0])
+	if err != nil {
+		t.Fatalf("building %q: %v", iconClause, err)
+	}
+	return widget.(*pages.ActionButton).Icon
+}
+
+// TestDescribeButtonIcon_UnknownTypeIsFlagged pins the reason the note is keyed
+// on the KIND rather than on a list of known-bad types: a stored $Type this
+// build does not recognise must be reported, never treated as "no icon". That is
+// how a future fourth variant would be silently dropped.
+func TestDescribeButtonIcon_UnknownTypeIsFlagged(t *testing.T) {
+	got := describeButton(t, iconButton("Forms$SomeFutureIcon", "Mod.Coll.thing", 0))
+	if strings.Contains(got, "Icon: 'Mod.Coll.thing'") || strings.Contains(got, "Icon: image") {
+		t.Errorf("an unrecognised icon element was emitted as one of the known kinds:\n%s", got)
+	}
+	assertIconNote(t, got, "Mod.Coll.thing", "Forms$SomeFutureIcon")
+}
+
+// TestDescribeButtonIcon_NoIconIsSilent is the second CONTROL: a button with no
+// icon at all must produce neither a clause nor a note. Without it the note
+// could fire unconditionally and every test above would still pass.
+func TestDescribeButtonIcon_NoIconIsSilent(t *testing.T) {
+	got := describeButton(t, map[string]any{
+		"$Type": "Forms$ActionButton",
+		"Name":  "btnEdit",
+	})
+	if strings.Contains(got, "Icon") || strings.Contains(got, "NOT re-executable") {
+		t.Errorf("an iconless button produced icon output:\n%s", got)
+	}
+}
+
+// TestDescribeButtonIcon_MalformedPayloadIsFlagged covers the other half of what
+// a note is still for. A stored element of a KNOWN kind whose payload is missing
+// — a glyph with no Code, a named icon with no name — cannot be emitted as a
+// clause: there is nothing in it to rebuild the same icon from, and a clause
+// with a guessed payload would rebuild a different one. So it is reported rather
+// than either dropped or invented.
+func TestDescribeButtonIcon_MalformedPayloadIsFlagged(t *testing.T) {
+	t.Run("glyph with no code", func(t *testing.T) {
+		got := describeButton(t, iconButton("Forms$GlyphIcon", "", 0))
+		if strings.Contains(got, "Icon: glyph") {
+			t.Errorf("a glyph with no code was emitted as a clause:\n%s", got)
+		}
+		assertIconNote(t, got, "no reference stored", "Forms$GlyphIcon")
+	})
+	t.Run("image with no name", func(t *testing.T) {
+		got := describeButton(t, iconButton("Forms$ImageIcon", "", 0))
+		if strings.Contains(got, "Icon: image") {
+			t.Errorf("an image icon with no name was emitted as a clause:\n%s", got)
+		}
+		assertIconNote(t, got, "no reference stored", "Forms$ImageIcon")
+	})
+}
+
+func assertIconNote(t *testing.T, got, wantTarget, wantType string) {
+	t.Helper()
+	if !strings.Contains(got, "NOT re-executable") {
+		t.Errorf("no NOT re-executable note — re-running this output drops the icon silently:\n%s", got)
+		return
+	}
+	for _, want := range []string{wantTarget, wantType} {
+		if !strings.Contains(got, want) {
+			t.Errorf("the note does not name %q, so it cannot be acted on:\n%s", want, got)
+		}
+	}
+}
diff --git a/mdl/executor/cmd_pages_describe_output.go b/mdl/executor/cmd_pages_describe_output.go
index 613bd8f48a..5dc16b38df 100644
--- a/mdl/executor/cmd_pages_describe_output.go
+++ b/mdl/executor/cmd_pages_describe_output.go
@@ -10,6 +10,7 @@ import (
 	"strconv"
 	"strings"
 
+	"github.com/mendixlabs/mxcli/mdl/types"
 	"github.com/mendixlabs/mxcli/model"
 
 	"go.mongodb.org/mongo-driver/bson/primitive"
@@ -429,11 +430,14 @@ func outputWidgetMDLV3(ctx *ExecContext, w rawWidget, indent int) {
 		if w.ButtonStyle != "" && w.ButtonStyle != "Default" {
 			props = append(props, fmt.Sprintf("ButtonStyle: %s", w.ButtonStyle))
 		}
-		if w.Icon != "" {
-			props = append(props, fmt.Sprintf("Icon: %s", mdlQuote(w.Icon)))
+		if clause := widgetIconMDL(w); clause != "" {
+			props = append(props, clause)
 		}
 		props = appendAppearanceProps(props, w)
 		formatWidgetProps(ctx.Output, prefix, header, props, "\n")
+		if note := widgetIconNote(w); note != "" {
+			fmt.Fprintf(ctx.Output, "%s%s\n", prefix, note)
+		}
 
 	case "Forms$Text", "Pages$Text":
 		props := []string{}
@@ -1033,21 +1037,91 @@ func extractButtonStyle(ctx *ExecContext, w map[string]any) string {
 	return "Default"
 }
 
-// extractIconRef reads a button's Icon element and returns its icon-collection
-// reference (the `Image` qualified name, e.g. Atlas_Core.Atlas_Filled.pencil),
-// or "" when there is no icon. Currently only Forms$IconCollectionIcon is
-// reconstructed (the modern Atlas icon; issue #602).
-func extractIconRef(w map[string]any) string {
+// extractButtonIcon reads a button's Icon element: the qualified name it points
+// at, the stored $Type, and a glyph icon's Code. All three are needed, and the
+// reason is in the storage (mendixlabs/mxcli#1059):
+//
+//	Forms$IconCollectionIcon{Image} -> CustomIcons$CustomIcon
+//	Forms$ImageIcon{Image}          -> Images$Image   (a DIFFERENT document)
+//	Forms$GlyphIcon{Code}           -> a font code point, with no name at all
+//
+// The two named variants are indistinguishable by their payload, so a reader
+// that returns only `Image` hands the emitter a name it cannot place. That is
+// what made an image icon re-execute as a custom-icon reference and fail the
+// build with CE1613. Returning the $Type is what lets the emitter decline.
+func extractButtonIcon(w map[string]any) (name, iconType string, code int) {
 	icon, ok := w["Icon"].(map[string]any)
 	if !ok {
-		return ""
+		return "", "", 0
 	}
-	if img, ok := icon["Image"].(string); ok {
-		return img
+	iconType, _ = icon["$Type"].(string)
+	name, _ = icon["Image"].(string)
+	return name, iconType, bsonInt(icon["Code"])
+}
+
+// widgetIconMDL renders the `Icon:` property for a widget, or "" when there is
+// nothing CREATE PAGE can reproduce.
+//
+// All three of Mendix's icon elements have a form now. Only the collection one
+// used to, so an image icon came out spelled exactly like a collection
+// reference and re-executed as one (CE1613), and a glyph icon — which has no
+// name at all — came out as nothing and was deleted on replay
+// (mendixlabs/mxcli#1059).
+//
+// The kind word is what rebuilds the same ELEMENT rather than something that
+// merely parses. The bare form stays the collection icon, so existing output
+// still means what it did.
+func widgetIconMDL(w rawWidget) string {
+	switch types.MenuIconKindOf(w.IconType) {
+	case types.MenuIconGlyph:
+		// The code is the whole identity of a glyph. Without it there is nothing
+		// to emit that would rebuild the same icon, so fall through to the note.
+		if w.IconCode == 0 {
+			return ""
+		}
+		return fmt.Sprintf("Icon: glyph %d", w.IconCode)
+	case types.MenuIconImage:
+		if w.Icon == "" {
+			return ""
+		}
+		return fmt.Sprintf("Icon: image %s", mdlQuote(w.Icon))
+	case types.MenuIconCollection:
+		if w.Icon == "" {
+			return ""
+		}
+		return fmt.Sprintf("Icon: %s", mdlQuote(w.Icon))
 	}
 	return ""
 }
 
+// widgetIconNote flags an icon DESCRIBE still cannot round-trip, so re-running
+// the output loses it visibly rather than silently.
+//
+// CREATE OR REPLACE PAGE is a full replacement, which is what makes silence
+// expensive: an icon the writer will not emit is an icon the replay DELETES,
+// with an exit 0 and a success message.
+//
+// All three icon elements are reproducible now, so this fires only on what is
+// genuinely beyond the language: a stored $Type this build does not know, or a
+// variant whose payload is missing (a glyph with no Code, a named icon with no
+// name) — where emitting a clause would rebuild a DIFFERENT icon rather than the
+// same one. Reporting a variant this build does not recognise as "no icon" is
+// how the next one Mendix adds would be dropped in turn.
+func widgetIconNote(w rawWidget) string {
+	if w.IconType == "" || widgetIconMDL(w) != "" {
+		return ""
+	}
+	target := w.Icon
+	if target == "" && w.IconCode != 0 {
+		target = fmt.Sprintf("glyph %d", w.IconCode)
+	}
+	if target == "" {
+		target = "(no reference stored)"
+	}
+	return fmt.Sprintf("-- NOT re-executable: icon %s (%s) — mxcli cannot author this "+
+		"icon element, so re-running this script would drop it", target, w.IconType)
+}
+
 func extractButtonAction(ctx *ExecContext, w map[string]any) string {
 	return renderClientActionMDL(ctx, actionMapForKey(w, "Action"))
 }
diff --git a/mdl/executor/cmd_pages_describe_parse.go b/mdl/executor/cmd_pages_describe_parse.go
index 4c9b24bfe2..6d3cfbca7b 100644
--- a/mdl/executor/cmd_pages_describe_parse.go
+++ b/mdl/executor/cmd_pages_describe_parse.go
@@ -299,7 +299,7 @@ func parseRawWidget(ctx *ExecContext, w map[string]any, parentEntityContext ...s
 		if rt, ok := w["RenderType"].(string); ok {
 			widget.RenderMode = rt
 		}
-		widget.Icon = extractIconRef(w)
+		widget.Icon, widget.IconType, widget.IconCode = extractButtonIcon(w)
 		return []rawWidget{widget}
 
 	case "Forms$Text", "Pages$Text":
diff --git a/mdl/executor/cmd_pages_icon_authoring_test.go b/mdl/executor/cmd_pages_icon_authoring_test.go
new file mode 100644
index 0000000000..ef6ab3db61
--- /dev/null
+++ b/mdl/executor/cmd_pages_icon_authoring_test.go
@@ -0,0 +1,145 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package executor
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/types"
+	"github.com/mendixlabs/mxcli/model"
+	"github.com/mendixlabs/mxcli/sdk/pages"
+)
+
+// mendixlabs/mxcli#1059, second half: authoring the two icon elements MDL could
+// not spell.
+//
+// Making the loss visible (the `-- NOT re-executable` note) stopped describe ->
+// exec from destroying an icon, but it did not let anyone WRITE one. These pin
+// the builder: the kind the author wrote must reach the element `$Type`, since
+// the two named kinds are spelled identically and only the kind separates a
+// custom-icon reference from an image one.
+
+func buildIconButton(t *testing.T, icon any) (*pages.ActionButton, error) {
+	t.Helper()
+	pb := &pageBuilder{widgetScope: map[string]model.ID{}}
+	props := map[string]any{"Caption": "Edit"}
+	if icon != nil {
+		props["Icon"] = icon
+	}
+	widget, err := pb.buildWidgetV3(&ast.WidgetV3{Type: "actionbutton", Name: "btnEdit", Properties: props})
+	if err != nil {
+		return nil, err
+	}
+	return widget.(*pages.ActionButton), nil
+}
+
+func TestBuildWidgetIcon_EachKindBuildsItsOwnElement(t *testing.T) {
+	cases := []struct {
+		name      string
+		icon      *ast.WidgetIcon
+		wantType  string
+		wantImage string
+		wantCode  int
+	}{{
+		name:      "collection",
+		icon:      &ast.WidgetIcon{Kind: types.MenuIconCollection, Name: "Atlas_Core.Atlas_Filled.pencil"},
+		wantType:  "Forms$IconCollectionIcon",
+		wantImage: "Atlas_Core.Atlas_Filled.pencil",
+	}, {
+		// The one the report hit. Same spelling as the line above, different
+		// document, different element — CE1613 if it lands as a collection icon.
+		name:      "image",
+		icon:      &ast.WidgetIcon{Kind: types.MenuIconImage, Name: "DesignSystem.Icons_SVG.edit"},
+		wantType:  "Forms$ImageIcon",
+		wantImage: "DesignSystem.Icons_SVG.edit",
+	}, {
+		name:     "glyph",
+		icon:     &ast.WidgetIcon{Kind: types.MenuIconGlyph, Code: 57377},
+		wantType: "Forms$GlyphIcon",
+		wantCode: 57377,
+	}}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			btn, err := buildIconButton(t, tc.icon)
+			if err != nil {
+				t.Fatalf("build: %v", err)
+			}
+			if btn.Icon == nil {
+				t.Fatal("icon dropped")
+			}
+			if btn.Icon.TypeName != tc.wantType {
+				t.Errorf("$Type = %q, want %q", btn.Icon.TypeName, tc.wantType)
+			}
+			if btn.Icon.Image != tc.wantImage {
+				t.Errorf("Image = %q, want %q", btn.Icon.Image, tc.wantImage)
+			}
+			if btn.Icon.Code != tc.wantCode {
+				t.Errorf("Code = %d, want %d", btn.Icon.Code, tc.wantCode)
+			}
+		})
+	}
+}
+
+// TestBuildWidgetIcon_LegacyStringIsStillTheCollectionIcon is the compatibility
+// CONTROL. `Icon:` has carried a plain quoted string since #602, in scripts and
+// in callers that build a WidgetV3 directly, and that string has only ever meant
+// an icon-collection icon. If this stops holding, every existing page script
+// silently changes meaning.
+func TestBuildWidgetIcon_LegacyStringIsStillTheCollectionIcon(t *testing.T) {
+	for _, raw := range []string{"Atlas_Core.Atlas_Filled.pencil", "'Atlas_Core.Atlas_Filled.pencil'"} {
+		btn, err := buildIconButton(t, raw)
+		if err != nil {
+			t.Fatalf("build %q: %v", raw, err)
+		}
+		if btn.Icon == nil {
+			t.Fatalf("%q: icon dropped", raw)
+		}
+		if btn.Icon.TypeName != "Forms$IconCollectionIcon" || btn.Icon.Image != "Atlas_Core.Atlas_Filled.pencil" {
+			t.Errorf("%q built %s{%s}, want Forms$IconCollectionIcon{Atlas_Core.Atlas_Filled.pencil}",
+				raw, btn.Icon.TypeName, btn.Icon.Image)
+		}
+	}
+}
+
+// TestBuildWidgetIcon_NoIconIsNoElement is the second CONTROL: a button without
+// an `Icon:` must carry no icon element at all, not an empty one.
+func TestBuildWidgetIcon_NoIconIsNoElement(t *testing.T) {
+	btn, err := buildIconButton(t, nil)
+	if err != nil {
+		t.Fatalf("build: %v", err)
+	}
+	if btn.Icon != nil {
+		t.Errorf("an iconless button got an icon element: %+v", btn.Icon)
+	}
+}
+
+// TestBuildWidgetIcon_RefusesAnIconThatIdentifiesNothing covers the failure that
+// would otherwise be invisible. A bare Forms$GlyphIcon with no Code, or a named
+// icon with no name, builds at 0 errors and renders nothing — so the author sees
+// a button with no icon and no reason for it. A glyph's code is not a detail: it
+// is the ONLY thing that identifies a glyph icon.
+func TestBuildWidgetIcon_RefusesAnIconThatIdentifiesNothing(t *testing.T) {
+	cases := []struct {
+		name string
+		icon *ast.WidgetIcon
+		want string
+	}{
+		{"glyph with no code", &ast.WidgetIcon{Kind: types.MenuIconGlyph}, "character code"},
+		{"image with no name", &ast.WidgetIcon{Kind: types.MenuIconImage}, "qualified name"},
+		{"collection with no name", &ast.WidgetIcon{Kind: types.MenuIconCollection}, "qualified name"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			_, err := buildIconButton(t, tc.icon)
+			if err == nil {
+				t.Fatal("an icon identifying nothing was accepted")
+			}
+			if !strings.Contains(err.Error(), tc.want) {
+				t.Errorf("error %q does not say what to write (want %q in it)", err, tc.want)
+			}
+		})
+	}
+}
diff --git a/mdl/executor/cmd_pages_linkbutton_test.go b/mdl/executor/cmd_pages_linkbutton_test.go
index c8e393c4c4..6aa9f3ea7a 100644
--- a/mdl/executor/cmd_pages_linkbutton_test.go
+++ b/mdl/executor/cmd_pages_linkbutton_test.go
@@ -8,6 +8,7 @@ import (
 	"testing"
 
 	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/types"
 	"github.com/mendixlabs/mxcli/model"
 	"github.com/mendixlabs/mxcli/sdk/pages"
 )
@@ -69,8 +70,8 @@ func TestBuildButtonV3_Icon(t *testing.T) {
 	if btn.Icon == nil {
 		t.Fatal("button Icon is nil — the `icon` property was dropped (#602)")
 	}
-	if btn.Icon.Type != pages.IconTypeIconCollection {
-		t.Errorf("Icon.Type = %q, want IconCollection", btn.Icon.Type)
+	if btn.Icon.Kind != types.MenuIconCollection {
+		t.Errorf("Icon.Kind = %q, want collection", btn.Icon.Kind)
 	}
 	if btn.Icon.Image != "Atlas_Core.Atlas_Filled.pencil" {
 		t.Errorf("Icon.Image = %q, want Atlas_Core.Atlas_Filled.pencil", btn.Icon.Image)
@@ -85,7 +86,16 @@ func TestBuildButtonV3_Icon(t *testing.T) {
 func TestOutputWidgetMDLV3_ButtonIcon(t *testing.T) {
 	var buf bytes.Buffer
 	ctx := &ExecContext{Output: &buf}
-	w := rawWidget{Type: "Forms$ActionButton", Name: "btn", Icon: "Atlas_Core.Atlas_Filled.pencil"}
+	// IconType is load-bearing, not decoration: an icon name alone does not say
+	// which of Mendix's three icon elements holds it, and only the collection one
+	// is authorable (mendixlabs/mxcli#1059). A stored icon always carries a
+	// $Type, so a fixture without one is not a shape describe can encounter.
+	w := rawWidget{
+		Type:     "Forms$ActionButton",
+		Name:     "btn",
+		Icon:     "Atlas_Core.Atlas_Filled.pencil",
+		IconType: "Forms$IconCollectionIcon",
+	}
 	outputWidgetMDLV3(ctx, w, 0)
 	if got := buf.String(); !strings.Contains(got, "Icon: 'Atlas_Core.Atlas_Filled.pencil'") {
 		t.Errorf("output %q does not contain the Icon clause", got)
diff --git a/mdl/executor/editorconfig_extract.go b/mdl/executor/editorconfig_extract.go
index f559460d86..5bf4eea6d4 100644
--- a/mdl/executor/editorconfig_extract.go
+++ b/mdl/executor/editorconfig_extract.go
@@ -138,6 +138,7 @@ func extractVisibilityRulesFromJS(js string) ([]types.WidgetVisibilityRule, edit
 	var stats editorConfigExtractStats
 	var pending []ternaryThenCandidate // resolved after the loop
 	seen := map[string]bool{}          // dedupe propertyKey+condition
+	consts := stringArrayConsts(js)    // module-level arrays, for `[…].concat(N)`
 
 	for _, loc := range hideCallRE.FindAllStringIndex(js, -1) {
 		stats.TotalHideCalls++
@@ -147,7 +148,7 @@ func extractVisibilityRulesFromJS(js string) ([]types.WidgetVisibilityRule, edit
 			stats.SkippedComplex++
 			continue
 		}
-		listKey, keys, condKeys, ok := hideTargetKeys(args)
+		listKey, keys, condKeys, ok := hideTargetKeys(args, consts)
 		if !ok || (len(keys) == 0 && len(condKeys) == 0) {
 			stats.SkippedComplex++
 			continue
@@ -387,7 +388,7 @@ func negate(c types.WidgetVisibilityCondition) (types.WidgetVisibilityCondition,
 //
 // ok is false for a shape it does not recognize; the caller counts it as skipped
 // and emits no rule, which degrades to "not hidden".
-func hideTargetKeys(args string) (listKey string, keys []string, condKeys []ternaryKey, ok bool) {
+func hideTargetKeys(args string, consts map[string][]string) (listKey string, keys []string, condKeys []ternaryKey, ok bool) {
 	parts := splitTopLevelCommas(args)
 	// Collect string-literal positional args and any array literal.
 	var stringArgs []string
@@ -395,7 +396,20 @@ func hideTargetKeys(args string) (listKey string, keys []string, condKeys []tern
 	for _, p := range parts {
 		p = strings.TrimSpace(p)
 		if strings.HasPrefix(p, "[") {
-			for _, el := range splitTopLevelCommas(strings.TrimSuffix(strings.TrimPrefix(strings.TrimSpace(p), "["), "]")) {
+			// The argument may be `[…].concat(N, W)`, so read the literal with a
+			// balanced scan and resolve the concatenated arrays separately —
+			// trimming a trailing "]" would stop at the first element and drop
+			// everything after it.
+			body, bodyOK := balancedArgs(p, 1)
+			if !bodyOK {
+				body = strings.TrimSuffix(strings.TrimPrefix(p, "["), "]")
+			}
+			if bodyOK {
+				if extra, extraOK := concatMembers(p[len(body)+2:], consts); extraOK {
+					arrayKeys = append(arrayKeys, extra...)
+				}
+			}
+			for _, el := range splitTopLevelCommas(body) {
 				if tk, ok := ternaryElement(el); ok {
 					// `cond ? "a" : "b"` as an array ELEMENT. Harvesting its string
 					// literals would invent a key from the comparison value and mark
@@ -433,6 +447,119 @@ func hideTargetKeys(args string) (listKey string, keys []string, condKeys []tern
 	}
 }
 
+// arrayDeclRE finds a module-level array binding — `z=["lazyLoading",…]` in the
+// minified bundle. Combo box's biggest hide lists are built by concatenating
+// three such arrays onto a literal one, so without resolving them the call is
+// counted as recognized while most of its properties are silently dropped.
+var arrayDeclRE = regexp.MustCompile(`(?:^|[,;({=\s])([A-Za-z_$][\w$]*)\s*=\s*\[`)
+
+// concatCallRE matches the `.concat(` that follows a hide call's array argument.
+var concatCallRE = regexp.MustCompile(`^\s*\.concat\(`)
+
+// stringArrayConsts maps each identifier bound to an array of STRING LITERALS to
+// its members. An identifier bound more than once is dropped rather than
+// guessed at: the minifier reuses short names across scopes, and resolving one
+// to the wrong array would invent hide rules for properties the editor shows.
+// Arrays holding anything but string literals (an element list, a data URI
+// built by a call) are skipped for the same reason.
+func stringArrayConsts(js string) map[string][]string {
+	out := map[string][]string{}
+	ambiguous := map[string]bool{}
+	for _, loc := range arrayDeclRE.FindAllStringSubmatchIndex(js, -1) {
+		name := js[loc[2]:loc[3]]
+		if ambiguous[name] {
+			continue
+		}
+		body, ok := balancedArgs(js, loc[1]) // loc[1] is just past the '['
+		if !ok {
+			continue
+		}
+		members, ok := stringArrayMembers(body)
+		if !ok {
+			continue
+		}
+		if prev, seen := out[name]; seen && !sameStrings(prev, members) {
+			delete(out, name)
+			ambiguous[name] = true
+			continue
+		}
+		out[name] = members
+	}
+	return out
+}
+
+// stringArrayMembers reads an array literal's body as a list of string literals.
+// ok is false if ANY element is something else — a partial read would drop
+// members without saying so, which is the defect this exists to fix.
+func stringArrayMembers(body string) ([]string, bool) {
+	if strings.TrimSpace(body) == "" {
+		return nil, false
+	}
+	var out []string
+	for _, el := range splitTopLevelCommas(body) {
+		el = strings.TrimSpace(el)
+		m := stringLitRE.FindStringSubmatch(el)
+		if m == nil || !strings.HasPrefix(el, `"`) || len(m[0]) != len(el) {
+			return nil, false
+		}
+		out = append(out, m[1])
+	}
+	return out, true
+}
+
+func sameStrings(a, b []string) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for i := range a {
+		if a[i] != b[i] {
+			return false
+		}
+	}
+	return true
+}
+
+// concatMembers reads the `.concat(a, b)` chain trailing an array literal and
+// returns the members its arguments contribute. Each argument must be either an
+// inline string array or an identifier in consts; anything else (a call such as
+// `.concat(i(a))`) yields ok=false, and the caller keeps the literal keys alone
+// rather than emitting a list it knows to be short.
+func concatMembers(tail string, consts map[string][]string) ([]string, bool) {
+	var out []string
+	for {
+		m := concatCallRE.FindStringIndex(tail)
+		if m == nil {
+			return out, true
+		}
+		args, ok := balancedArgs(tail, m[1])
+		if !ok {
+			return out, false
+		}
+		for _, a := range splitTopLevelCommas(args) {
+			a = strings.TrimSpace(a)
+			switch {
+			case strings.HasPrefix(a, "["):
+				body, ok := balancedArgs(a, 1)
+				if !ok {
+					return out, false
+				}
+				members, ok := stringArrayMembers(body)
+				if !ok {
+					return out, false
+				}
+				out = append(out, members...)
+			default:
+				members, ok := consts[a]
+				if !ok {
+					return out, false
+				}
+				out = append(out, members...)
+			}
+		}
+		tail = tail[m[1]+len(args)+1:] // past the closing ')', for a chained .concat
+	}
+}
+
 // ternaryKey is an array element of the form `cond ? "a" : "b"` — a hide whose
 // TARGET depends on a condition, rather than the whole call being guarded. Each
 // branch becomes its own rule carrying that condition (the then-branch when the
diff --git a/mdl/executor/editorconfig_shapes_test.go b/mdl/executor/editorconfig_shapes_test.go
index d4884ccb62..23f9bf88f8 100644
--- a/mdl/executor/editorconfig_shapes_test.go
+++ b/mdl/executor/editorconfig_shapes_test.go
@@ -382,3 +382,112 @@ func TestChainedTernaryBranchConditionIsLifted(t *testing.T) {
 		}
 	}
 }
+
+func TestConcatenatedHideListsAreResolved(t *testing.T) {
+	js, err := mpk.ReadEditorConfig(
+		"../../testdata/expr-checker/widgets/com.mendix.widget.web.Combobox.mpk",
+		"com.mendix.widget.web.combobox.Combobox")
+	if err != nil || js == "" {
+		t.Fatalf("read Combo box editorConfig: %v", err)
+	}
+	rules, _ := extractVisibilityRulesFromJS(js)
+
+	// Combo box builds its biggest hide lists by concatenating module-level
+	// arrays onto the literal one:
+	//
+	//	"context" === t.source && hidePropertiesIn(e, t, [ …3 literals… ].concat(N))
+	//
+	// where N is ten database properties. Reading only the literal array counts
+	// the call as recognized and silently drops the rest, so the describe output
+	// says nothing about them — and the generated example then offers properties
+	// the editor does not show.
+	want := []struct {
+		prop, guard string
+	}{
+		// …].concat(N) under `"context" === t.source`
+		{"optionsSourceDatabaseDataSource", "source"},
+		{"optionsSourceDatabaseItemSelection", "source"},
+		{"onChangeDatabaseEvent", "source"},
+		{"optionsSourceDatabaseCaptionType", "source"},
+		{"databaseAttributeString", "source"},
+		// …].concat(W, z) under `["enumeration","boolean"].includes(optionsSourceType)`
+		{"attributeAssociation", "optionsSourceType"},
+		{"optionsSourceAssociationDataSource", "optionsSourceType"},
+		{"lazyLoading", "optionsSourceType"},
+	}
+	for _, w := range want {
+		var found bool
+		for _, r := range rules {
+			if r.PropertyKey != w.prop {
+				continue
+			}
+			for _, c := range r.Conditions() {
+				if c.PropertyKey == w.guard {
+					found = true
+				}
+			}
+		}
+		if !found {
+			t.Errorf("no rule lifted for %s guarded by %s — concat member dropped", w.prop, w.guard)
+		}
+	}
+}
+
+func TestConcatResolverRefusesWhatItCannotRead(t *testing.T) {
+	cases := []struct {
+		name   string
+		js     string
+		want   []string // property keys that MUST be lifted
+		reject []string // keys that must NOT appear — inventing one is worse than missing it
+	}{{
+		name: "inline array literal",
+		js:   `f=function(t,e){"a"===t.mode&&hidePropertiesIn(e,t,["p"].concat(["q","r"]))}`,
+		want: []string{"p", "q", "r"},
+	}, {
+		name: "chained concat of two consts",
+		js:   `A=["q"],B=["r"];f=function(t,e){"a"===t.mode&&hidePropertiesIn(e,t,["p"].concat(A).concat(B))}`,
+		want: []string{"p", "q", "r"},
+	}, {
+		// `.concat(n(x))` — a call on a computed key. Resolving it would mean
+		// evaluating the widget's own code, so the literal keys stand alone and
+		// nothing is invented. Eight such sites exist across the fixture.
+		name:   "computed concat argument",
+		js:     `A=["q"];f=function(t,e){"a"===t.mode&&hidePropertiesIn(e,t,["p"].concat(n(A[t.kind])))}`,
+		want:   []string{"p"},
+		reject: []string{"q"},
+	}, {
+		// The minifier reuses short names across scopes. A name bound to two
+		// different arrays is dropped rather than guessed at — picking either
+		// would hide properties the editor shows.
+		name:   "identifier bound twice to different arrays",
+		js:     `A=["q"];g=function(){A=["zzz"]};f=function(t,e){"a"===t.mode&&hidePropertiesIn(e,t,["p"].concat(A))}`,
+		want:   []string{"p"},
+		reject: []string{"q", "zzz"},
+	}, {
+		// Not every array is a property list.
+		name:   "array of non-strings",
+		js:     `A=[1,2];f=function(t,e){"a"===t.mode&&hidePropertiesIn(e,t,["p"].concat(A))}`,
+		want:   []string{"p"},
+		reject: []string{"1"},
+	}}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			rules, _ := extractVisibilityRulesFromJS(tc.js)
+			got := map[string]bool{}
+			for _, r := range rules {
+				got[r.PropertyKey] = true
+			}
+			for _, w := range tc.want {
+				if !got[w] {
+					t.Errorf("missing rule for %q (got %v)", w, got)
+				}
+			}
+			for _, b := range tc.reject {
+				if got[b] {
+					t.Errorf("invented a rule for %q — the resolver must withhold, not guess (got %v)", b, got)
+				}
+			}
+		})
+	}
+}
diff --git a/mdl/executor/executor_query.go b/mdl/executor/executor_query.go
index f612eb1aa1..d5f2d5b279 100644
--- a/mdl/executor/executor_query.go
+++ b/mdl/executor/executor_query.go
@@ -209,7 +209,7 @@ func execDescribe(ctx *ExecContext, s *ast.DescribeStmt) error {
 		case ast.DescribeAssociation:
 			return describeAssociation(ctx, s.Name)
 		case ast.DescribeMicroflow:
-			return describeMicroflow(ctx, s.Name)
+			return describeMicroflowMode(ctx, s.Name, s.Normalized)
 		case ast.DescribeNanoflow:
 			return describeNanoflow(ctx, s.Name)
 		case ast.DescribeRule:
diff --git a/mdl/executor/glyph_icons.go b/mdl/executor/glyph_icons.go
index 126d68272c..9a9988ae23 100644
--- a/mdl/executor/glyph_icons.go
+++ b/mdl/executor/glyph_icons.go
@@ -21,7 +21,7 @@ type GlyphIcon struct {
 // Both halves come from assets Mendix ships rather than from a hand-written
 // list. The CODES are the private-use range of the cmap in Atlas_Core's
 // glyphicons-halflings-regular.woff — the same table mxbuild resolves against,
-// verified on two full deploy builds (see validateMenuItemGlyphCodes). The NAMES
+// verified on two full deploy builds (see validateGlyphCodes). The NAMES
 // are the `.glyphicon-<name>:before { content: "\eXXX" }` rules in Atlas_Core's
 // bundled Bootstrap stylesheet, which covers all 247 with none left over.
 //
diff --git a/mdl/executor/validate_glyph_codes.go b/mdl/executor/validate_glyph_codes.go
index d0ffa540c5..4610ac1a35 100644
--- a/mdl/executor/validate_glyph_codes.go
+++ b/mdl/executor/validate_glyph_codes.go
@@ -10,8 +10,9 @@ import (
 	"github.com/mendixlabs/mxcli/mdl/types"
 )
 
-// validateMenuItemGlyphCodes (MDL078) flags `icon glyph <n>` with a code the
-// Mendix glyph font does not define.
+// validateGlyphCodes (MDL078) flags a glyph icon whose code the Mendix glyph
+// font does not define — on a navigation menu item, a menu document, or a page
+// widget.
 //
 // # Why this needs its own rule
 //
@@ -26,6 +27,15 @@ import (
 // Neither the navigation nor the menu item is mentioned. Bisecting it cost three
 // build cycles (ako/CapTrackV4 007, R2).
 //
+// A glyph on a page WIDGET fails the same way and names the page instead —
+// measured on 11.13.0 with `Icon: glyph 57562` on an action button:
+//
+//	(An exception occurred while exporting page 'MyFirstModule.IconProbe'.)
+//	 ---> System.InvalidOperationException: Sequence contains no matching element
+//
+// So the message must not promise "layout": the document named is whichever one
+// contains the icon, which is exactly the document the author will not suspect.
+//
 // # The mechanism, and why a code-point table is the right check
 //
 // mxbuild resolves the code through GlyphFont.GetClass(Int32), which is a LINQ
@@ -45,43 +55,36 @@ import (
 //
 // The code is in the script. This runs in the project-free pass alongside
 // MDL077, which is how CI reaches it.
-func validateMenuItemGlyphCodes(stmt ast.Statement) []linter.Violation {
-	var items []ast.NavMenuItemDef
-	var where string
-
-	switch s := stmt.(type) {
-	case *ast.AlterNavigationStmt:
-		items, where = s.MenuItems, "navigation "+s.ProfileName
-	case *ast.CreateMenuStmt:
-		items, where = s.Items, "menu "+s.Name.String()
-	default:
-		return nil
-	}
-
+//
+// # One walk
+//
+// The statements are enumerated by iconRefsInStatement, the package's single
+// icon walk, rather than by a second switch here. This rule covered menu items
+// only while menus were the only place a glyph could be authored; the day
+// `Icon: glyph <n>` landed on a widget (mendixlabs/mxcli#1059) a private walk
+// would have kept passing every widget glyph in silence, which is the drift the
+// shared walk exists to prevent.
+func validateGlyphCodes(stmt ast.Statement) []linter.Violation {
 	var out []linter.Violation
-	var walk func(list []ast.NavMenuItemDef)
-	walk = func(list []ast.NavMenuItemDef) {
-		for _, item := range list {
-			if item.IconKind == types.MenuIconGlyph && !glyphCodeDefined(item.IconCode) {
-				out = append(out, linter.Violation{
-					RuleID:   "MDL078",
-					Severity: linter.SeverityWarning,
-					Message: fmt.Sprintf(
-						"%s: menu item %q uses `icon glyph %d`, which the Mendix glyph font does not "+
-							"define — the build fails at `mxbuild --target=deploy` with "+
-							"\"An exception occurred while exporting layout '<some layout>'\", naming a "+
-							"document that is not the cause",
-						where, item.Caption, item.IconCode),
-					Suggestion: "prefer an icon collection reference, which IS resolved before anything " +
-						"is written: `icon Atlas_Core.Atlas.<name>` (list them with " +
-						"`describe icon collection Atlas_Core.Atlas`). To keep a glyph, pick a code from " +
-						"`show glyphs` — the font's codes are sparse, so nearby numbers are usually " +
-						"not defined either.",
-				})
-			}
-			walk(item.Items)
+	for _, ref := range iconRefsInStatement(stmt) {
+		if ref.kind != types.MenuIconGlyph || glyphCodeDefined(ref.code) {
+			continue
 		}
+		out = append(out, linter.Violation{
+			RuleID:   "MDL078",
+			Severity: linter.SeverityWarning,
+			Message: fmt.Sprintf(
+				"%s uses glyph %d, which the Mendix glyph font does not define — the build fails "+
+					"at `mxbuild --target=deploy` with \"An exception occurred while exporting "+
+					"<page or layout> '<name>'\" and \"Sequence contains no matching element\", "+
+					"which names the document the icon is IN and never the icon",
+				ref.where, ref.code),
+			Suggestion: "prefer an icon collection reference, which IS resolved before anything " +
+				"is written: `Atlas_Core.Atlas.<name>` (list them with " +
+				"`describe icon collection Atlas_Core.Atlas`). To keep a glyph, pick a code from " +
+				"`show glyphs` — the font's codes are sparse, so nearby numbers are usually " +
+				"not defined either.",
+		})
 	}
-	walk(items)
 	return out
 }
diff --git a/mdl/executor/validate_glyph_codes_test.go b/mdl/executor/validate_glyph_codes_test.go
index 83a7b5f5bc..923bdffc53 100644
--- a/mdl/executor/validate_glyph_codes_test.go
+++ b/mdl/executor/validate_glyph_codes_test.go
@@ -41,7 +41,7 @@ func glyphStmt(code int) *ast.AlterNavigationStmt {
 }
 
 func TestMDL078_ReportsACodeTheFontDoesNotDefine(t *testing.T) {
-	v := validateMenuItemGlyphCodes(glyphStmt(57562))
+	v := validateGlyphCodes(glyphStmt(57562))
 	if len(v) != 1 {
 		t.Fatalf("got %d violations, want 1 — this code breaks the deploy and every "+
 			"static gate passes it", len(v))
@@ -67,7 +67,7 @@ func TestMDL078_SilentOnCodesTheFontDefines(t *testing.T) {
 		63743, // 0xF8FF — the outlier at the end of the private use area
 		57440, // 0xE060 — a single-code run, the shape a range check gets wrong
 	} {
-		if v := validateMenuItemGlyphCodes(glyphStmt(code)); len(v) != 0 {
+		if v := validateGlyphCodes(glyphStmt(code)); len(v) != 0 {
 			t.Errorf("glyph %d was reported but the font defines it: %s", code, v[0].Message)
 		}
 	}
@@ -82,7 +82,7 @@ func TestMDL078_ReportsCodesInsideTheGaps(t *testing.T) {
 		57750, // 0xE196 — inside the 0xE190-0xE199 gap
 		57800, // 0xE1C8 — between the 0xE1xx and 0xE2xx blocks
 	} {
-		if v := validateMenuItemGlyphCodes(glyphStmt(code)); len(v) != 1 {
+		if v := validateGlyphCodes(glyphStmt(code)); len(v) != 1 {
 			t.Errorf("glyph %d was accepted, but it falls in a gap the font does not fill", code)
 		}
 	}
@@ -95,12 +95,12 @@ func TestMDL078_IgnoresNonGlyphIcons(t *testing.T) {
 	for _, kind := range []types.MenuIconKind{types.MenuIconNone, types.MenuIconCollection} {
 		stmt := glyphStmt(57562)
 		stmt.MenuItems[0].IconKind = kind
-		if v := validateMenuItemGlyphCodes(stmt); len(v) != 0 {
+		if v := validateGlyphCodes(stmt); len(v) != 0 {
 			t.Errorf("icon kind %v was reported by the glyph rule: %s", kind, v[0].Message)
 		}
 	}
 	// ...and neither is a statement of another type.
-	if v := validateMenuItemGlyphCodes(&ast.CreateEntityStmt{}); len(v) != 0 {
+	if v := validateGlyphCodes(&ast.CreateEntityStmt{}); len(v) != 0 {
 		t.Errorf("a non-navigation statement was reported: %+v", v)
 	}
 }
@@ -121,7 +121,7 @@ func TestMDL078_WalksSubItems(t *testing.T) {
 			}},
 		}},
 	}
-	v := validateMenuItemGlyphCodes(stmt)
+	v := validateGlyphCodes(stmt)
 	if len(v) != 1 || !strings.Contains(v[0].Message, "Nested") {
 		t.Errorf("a sub-item's bad glyph was missed: %+v", v)
 	}
@@ -171,3 +171,40 @@ func TestGlyphIconsMatchTheFont(t *testing.T) {
 		t.Errorf("bitcoin lost its aliases: %+v — `show glyphs like 'btc'` then finds nothing", g)
 	}
 }
+
+// TestMDL078_ReachesAWidgetGlyph is the reason this rule stopped walking the
+// statements itself.
+//
+// A glyph on a page widget fails the build exactly as a glyph on a menu item
+// does — mxbuild resolves both through the same GlyphFont.GetClass — but the
+// rule enumerated navigation and menu statements only, so the day
+// `Icon: glyph <n>` became authorable on a widget (mendixlabs/mxcli#1059) every
+// widget glyph would have passed in silence. It now reads the package's single
+// icon walk, so a statement kind that walk learns about, this rule learns about.
+func TestMDL078_ReachesAWidgetGlyph(t *testing.T) {
+	btn := func(name string, code int) *ast.WidgetV3 {
+		return &ast.WidgetV3{Type: "ACTIONBUTTON", Name: name, Properties: map[string]any{
+			"Icon": &ast.WidgetIcon{Kind: types.MenuIconGlyph, Code: code},
+		}}
+	}
+	stmt := &ast.CreatePageStmtV3{Widgets: []*ast.WidgetV3{
+		btn("btnGood", 57377), // in the font
+		{Type: "CONTAINER", Name: "c1", Children: []*ast.WidgetV3{
+			btn("btnBad", 57562), // past the font's end
+		}},
+	}}
+
+	v := validateGlyphCodes(stmt)
+	if len(v) != 1 {
+		t.Fatalf("got %d violations, want exactly 1 (the nested bad code): %+v", len(v), v)
+	}
+	if !strings.Contains(v[0].Message, "btnBad") {
+		t.Errorf("the violation does not name the widget: %q", v[0].Message)
+	}
+	if !strings.Contains(v[0].Message, "57562") {
+		t.Errorf("the violation does not name the code: %q", v[0].Message)
+	}
+	if v[0].RuleID != "MDL078" {
+		t.Errorf("RuleID = %q, want MDL078", v[0].RuleID)
+	}
+}
diff --git a/mdl/executor/validate_icon_refs.go b/mdl/executor/validate_icon_refs.go
index 1aea9a9f44..1be30eaf5a 100644
--- a/mdl/executor/validate_icon_refs.go
+++ b/mdl/executor/validate_icon_refs.go
@@ -22,54 +22,90 @@ import (
 	"github.com/mendixlabs/mxcli/mdl/ast"
 	mdlerrors "github.com/mendixlabs/mxcli/mdl/errors"
 	"github.com/mendixlabs/mxcli/mdl/types"
+	"github.com/mendixlabs/mxcli/model"
 )
 
-// iconIndex holds the project's icon collections, keyed by qualified collection
-// name (Module.Collection) → set of icon names.
+// iconIndex holds the project's icon collections AND its image collections,
+// each keyed by qualified collection name (Module.Collection) → set of member
+// names.
+//
+// Both are needed because a widget icon can point into either, and they are
+// DIFFERENT documents: `Icon: 'Mod.Coll.name'` is a CustomIcons$CustomIcon and
+// `Icon: image Mod.Coll.name` is an Images$Image. Resolving one against the
+// other's listing reports a correct reference as a typo — which is the mirror
+// image of the defect that made these kinds distinguishable in the first place
+// (mendixlabs/mxcli#1059).
 type iconIndex struct {
 	collections map[string]map[string]bool
-	// order preserves a stable listing for error messages.
-	order []string
+	images      map[string]map[string]bool
+	// order and imageOrder preserve a stable listing for error messages.
+	order      []string
+	imageOrder []string
 }
 
-// buildIconIndex reads the project's icon collections once per validation run.
-// Returns nil when the project exposes none, which disables the check rather
-// than reporting every icon as unknown.
+// buildIconIndex reads the project's icon and image collections once per
+// validation run. Returns nil when the project exposes neither, which disables
+// the check rather than reporting every icon as unknown.
+//
+// An EMPTY listing means the backend could not answer, not that the project has
+// none — reporting every reference as unknown on that basis is the false error
+// the third state exists to prevent. Each half is therefore independent: a
+// project that yields icon collections but no image collections still has its
+// collection references resolved, and its image references left alone.
 func buildIconIndex(ctx *ExecContext) *iconIndex {
-	cols, err := ctx.Backend.ListIconCollections()
-	if err != nil || len(cols) == 0 {
-		return nil
-	}
 	h, err := getHierarchy(ctx)
 	if err != nil {
 		return nil
 	}
-	idx := &iconIndex{collections: make(map[string]map[string]bool, len(cols))}
-	for _, c := range cols {
-		qn := iconCollectionQualifiedName(h, c)
-		if qn == "" {
-			continue
+	idx := &iconIndex{
+		collections: map[string]map[string]bool{},
+		images:      map[string]map[string]bool{},
+	}
+
+	if cols, err := ctx.Backend.ListIconCollections(); err == nil {
+		for _, c := range cols {
+			qn := iconCollectionQualifiedName(h, c.ContainerID, c.Name)
+			if qn == "" {
+				continue
+			}
+			names := make(map[string]bool, len(c.Icons))
+			for _, ic := range c.Icons {
+				names[ic.Name] = true
+			}
+			idx.collections[qn] = names
+			idx.order = append(idx.order, qn)
 		}
-		names := make(map[string]bool, len(c.Icons))
-		for _, ic := range c.Icons {
-			names[ic.Name] = true
+	}
+
+	if cols, err := ctx.Backend.ListImageCollections(); err == nil {
+		for _, c := range cols {
+			qn := iconCollectionQualifiedName(h, c.ContainerID, c.Name)
+			if qn == "" {
+				continue
+			}
+			names := make(map[string]bool, len(c.Images))
+			for _, img := range c.Images {
+				names[img.Name] = true
+			}
+			idx.images[qn] = names
+			idx.imageOrder = append(idx.imageOrder, qn)
 		}
-		idx.collections[qn] = names
-		idx.order = append(idx.order, qn)
 	}
+
 	sort.Strings(idx.order)
-	if len(idx.collections) == 0 {
+	sort.Strings(idx.imageOrder)
+	if len(idx.collections) == 0 && len(idx.images) == 0 {
 		return nil
 	}
 	return idx
 }
 
-func iconCollectionQualifiedName(h *ContainerHierarchy, c *types.IconCollection) string {
-	mod := h.GetModuleName(h.FindModuleID(c.ContainerID))
-	if mod == "" || c.Name == "" {
+func iconCollectionQualifiedName(h *ContainerHierarchy, container model.ID, name string) string {
+	mod := h.GetModuleName(h.FindModuleID(container))
+	if mod == "" || name == "" {
 		return ""
 	}
-	return mod + "." + c.Name
+	return mod + "." + name
 }
 
 // validateIconRefs resolves every icon reference in the program against the
@@ -86,6 +122,11 @@ func validateIconRefs(ctx *ExecContext, prog *ast.Program) []error {
 	var errs []error
 	for i, stmt := range prog.Statements {
 		for _, ref := range iconRefsInStatement(stmt) {
+			// A glyph names no document. MDL078 checks its code against the
+			// font's own table; there is nothing for this pass to resolve.
+			if ref.kind == types.MenuIconGlyph {
+				continue
+			}
 			if err := idx.check(ref); err != nil {
 				errs = append(errs, fmt.Errorf("statement %d: %w", i+1, err))
 			}
@@ -96,13 +137,21 @@ func validateIconRefs(ctx *ExecContext, prog *ast.Program) []error {
 
 // iconRef is one icon reference and where it was written, for the message.
 type iconRef struct {
-	value string // as authored, e.g. Atlas_Core.Atlas_Filled.pencil
-	where string // e.g. `button "btnSave"` or `menu item 'Home'`
+	value string             // as authored, e.g. Atlas_Core.Atlas_Filled.pencil
+	kind  types.MenuIconKind // which document the name lives in
+	code  int                // the character code, for MenuIconGlyph (which has no name)
+	where string             // e.g. `button "btnSave"` or `menu item 'Home'`
 }
 
-// iconRefsInStatement collects icon references from the statements that can
-// carry one: page/snippet/layout widget trees, navigation menus and menu
-// documents.
+// iconRefsInStatement collects EVERY icon in a statement — page/snippet/layout
+// widget trees, navigation menus and menu documents — glyphs included, even
+// though a glyph resolves against no document.
+//
+// It is deliberately the single icon walk in this package. MDL078 (glyph codes)
+// consumes the same list, because a second walk over the same statements is how
+// one of them comes to know about a widget kind the other does not: the icon
+// reference check already had to be widened once for a field it was not looking
+// at, and that escape is silent both ways.
 //
 // Every widget-bearing field has to be walked, not just the obvious one. A
 // reference the walker misses is a reference nothing checks, and the escape is
@@ -147,8 +196,9 @@ func iconRefsInStatement(stmt ast.Statement) []iconRef {
 		for _, op := range s.Operations {
 			switch o := op.(type) {
 			case *ast.SetPropertyOp:
-				if v := iconPropValue(o.Properties); v != "" {
-					out = append(out, iconRef{value: v, where: "widget " + quoteName(o.Target.Name())})
+				if ref, ok := iconPropRef(o.Properties); ok {
+					ref.where = "widget " + quoteName(o.Target.Name())
+					out = append(out, ref)
 				}
 			case *ast.InsertWidgetOp:
 				for _, w := range o.Widgets {
@@ -173,8 +223,9 @@ func iconRefsInWidget(w *ast.WidgetV3) []iconRef {
 		return nil
 	}
 	var out []iconRef
-	if v := iconPropValue(w.Properties); v != "" {
-		out = append(out, iconRef{value: v, where: strings.ToLower(w.Type) + " " + quoteName(w.Name)})
+	if ref, ok := iconPropRef(w.Properties); ok {
+		ref.where = strings.ToLower(w.Type) + " " + quoteName(w.Name)
+		out = append(out, ref)
 	}
 	for _, c := range w.Children {
 		out = append(out, iconRefsInWidget(c)...)
@@ -184,8 +235,21 @@ func iconRefsInWidget(w *ast.WidgetV3) []iconRef {
 
 func iconRefsInMenu(item ast.NavMenuItemDef) []iconRef {
 	var out []iconRef
-	if ref := normalizeIconRef(item.Icon); ref != "" {
-		out = append(out, iconRef{value: ref, where: "menu item " + quoteName(item.Caption)})
+	where := "menu item " + quoteName(item.Caption)
+	switch {
+	case item.IconKind == types.MenuIconGlyph:
+		// A glyph has a code and no name. It resolves against no document, so
+		// validateIconRefs skips it — but it is walked here so MDL078 can read it
+		// from the same list rather than keeping a second walk of its own.
+		out = append(out, iconRef{kind: types.MenuIconGlyph, code: item.IconCode, where: where})
+	case normalizeIconRef(item.Icon) != "":
+		kind := item.IconKind
+		if kind == types.MenuIconNone {
+			// An item built before the kind existed carries a name and nothing
+			// else, and that name has only ever meant a collection icon.
+			kind = types.MenuIconCollection
+		}
+		out = append(out, iconRef{value: normalizeIconRef(item.Icon), kind: kind, where: where})
 	}
 	for _, sub := range item.Items {
 		out = append(out, iconRefsInMenu(sub)...)
@@ -193,23 +257,40 @@ func iconRefsInMenu(item ast.NavMenuItemDef) []iconRef {
 	return out
 }
 
-// iconPropValue pulls the icon property out of a widget property map. MDL
+// iconPropRef pulls a widget's icon property out as a resolvable reference. MDL
 // property keys are case-insensitive, so both `Icon:` and `icon:` are accepted.
-func iconPropValue(props map[string]any) string {
+//
+// A glyph is returned too, carrying its code and no name: it resolves against no
+// document, so validateIconRefs skips it, but MDL078 reads it from the same walk.
+// Reports ok=false only when the widget carries no icon at all.
+//
+// The plain-string shape is still handled: `Icon:` carried one before the kinds
+// existed, and callers that build a WidgetV3 directly still pass one. A reader
+// that handles ONLY the typed shape stops resolving icons entirely and says
+// nothing about it, which is how this check would quietly become a no-op.
+func iconPropRef(props map[string]any) (iconRef, bool) {
 	if props == nil {
-		return ""
+		return iconRef{}, false
 	}
 	for k, v := range props {
 		if !strings.EqualFold(k, "icon") {
 			continue
 		}
-		s, ok := v.(string)
-		if !ok {
-			continue
+		switch val := v.(type) {
+		case *ast.WidgetIcon:
+			if val == nil {
+				return iconRef{}, false
+			}
+			return widgetIconRef(*val)
+		case ast.WidgetIcon:
+			return widgetIconRef(val)
+		case string:
+			if name := normalizeIconRef(val); name != "" {
+				return iconRef{value: name, kind: types.MenuIconCollection}, true
+			}
 		}
-		return normalizeIconRef(s)
 	}
-	return ""
+	return iconRef{}, false
 }
 
 // normalizeIconRef strips the quoting MDL allows around an icon reference.
@@ -224,40 +305,94 @@ func quoteName(s string) string {
 	return "'" + s + "'"
 }
 
+// widgetIconRef turns one parsed icon into a walkable reference.
+func widgetIconRef(icon ast.WidgetIcon) (iconRef, bool) {
+	if icon.Kind == types.MenuIconGlyph {
+		return iconRef{kind: types.MenuIconGlyph, code: icon.Code}, true
+	}
+	if icon.Name == "" {
+		return iconRef{}, false
+	}
+	return iconRef{value: normalizeIconRef(icon.Name), kind: icon.Kind}, true
+}
+
 // check resolves one reference, distinguishing an unknown collection from an
-// unknown icon within a known one — the two need different fixes.
+// unknown member within a known one — the two need different fixes.
+//
+// Which listing it resolves against is decided by the reference's KIND, not by
+// trying both: a collection icon and an image icon are spelled identically and
+// live in different documents, so resolving one against the other's listing
+// turns a correct reference into a reported typo. That is the same conflation,
+// pointed the other way, that made an image icon re-execute as a custom icon.
 func (idx *iconIndex) check(ref iconRef) error {
-	// Module.Collection.IconName — the icon name is the last segment, and the
+	listing, order, what, lister := idx.collections, idx.order, "icon collection", "describe icon collection"
+	if ref.kind == types.MenuIconImage {
+		listing, order, what, lister = idx.images, idx.imageOrder, "image collection", "describe image collection"
+	}
+	// An empty listing means the backend could not answer, not that the project
+	// has none — reporting every reference as unknown on that basis is a false
+	// error blocking a script that builds cleanly.
+	if len(listing) == 0 {
+		return nil
+	}
+
+	// Module.Collection.Name — the member name is the last segment, and the
 	// collection is everything before it. Splitting from the right keeps working
 	// if a module name ever contains a dot.
 	dot := strings.LastIndex(ref.value, ".")
 	if dot <= 0 || dot == len(ref.value)-1 {
 		return mdlerrors.NewValidation(fmt.Sprintf(
-			"%s: icon %q is not a qualified icon reference — write Module.Collection.IconName, "+
-				"for example 'Atlas_Core.Atlas_Filled.pencil'.\n  Collections in this project: %s",
-			ref.where, ref.value, strings.Join(idx.order, ", ")))
+			"%s: icon %q is not a qualified reference — write Module.Collection.Name, "+
+				"for example 'Atlas_Core.Atlas_Filled.pencil'.\n  %ss in this project: %s",
+			ref.where, ref.value, strings.Title(what), strings.Join(order, ", ")))
 	}
-	collection, icon := ref.value[:dot], ref.value[dot+1:]
+	collection, member := ref.value[:dot], ref.value[dot+1:]
 
-	icons, known := idx.collections[collection]
+	members, known := listing[collection]
 	if !known {
-		return mdlerrors.NewValidation(fmt.Sprintf(
-			"%s: unknown icon collection %q in icon reference %q.\n  Collections in this project: %s",
-			ref.where, collection, ref.value, strings.Join(idx.order, ", ")))
+		msg := fmt.Sprintf("%s: unknown %s %q in icon reference %q.\n  %ss in this project: %s",
+			ref.where, what, collection, ref.value, strings.Title(what), strings.Join(order, ", "))
+		// The likeliest cause of this exact miss is the wrong KIND rather than a
+		// typo: the name resolves, just in the other kind of collection. Saying so
+		// is the difference between a two-second fix and a hunt.
+		if other := idx.otherKindHint(ref, collection); other != "" {
+			msg += "\n  " + other
+		}
+		return mdlerrors.NewValidation(msg)
 	}
-	if icons[icon] {
+	if members[member] {
 		return nil
 	}
 
-	msg := fmt.Sprintf("%s: icon %q does not exist in collection %q (MxBuild reports this as CE1613)",
-		ref.where, icon, collection)
-	if near := nearestIcons(icons, icon); len(near) > 0 {
+	msg := fmt.Sprintf("%s: %q does not exist in %s %q (MxBuild reports this as CE1613)",
+		ref.where, member, what, collection)
+	if near := nearestIcons(members, member); len(near) > 0 {
 		msg += ".\n  Did you mean: " + strings.Join(near, ", ")
 	}
-	msg += fmt.Sprintf(".\n  List the collection's icons with: describe icon collection %s", collection)
+	msg += fmt.Sprintf(".\n  List it with: %s %s", lister, collection)
 	return mdlerrors.NewValidation(msg)
 }
 
+// otherKindHint names the fix when a reference resolves under the OTHER kind:
+// the author wrote `Icon: 'Mod.Coll.x'` for what is really an image, or
+// `Icon: image Mod.Coll.x` for what is really a collection icon. Both spell the
+// same name, so the miss looks like a typo and is not one.
+func (idx *iconIndex) otherKindHint(ref iconRef, collection string) string {
+	if ref.kind == types.MenuIconImage {
+		if _, ok := idx.collections[collection]; ok {
+			return fmt.Sprintf("%q IS an icon collection — write `Icon: '%s'` (no `image`) for a "+
+				"CustomIcons$CustomIcon.", collection, ref.value)
+		}
+		return ""
+	}
+	if _, ok := idx.images[collection]; ok {
+		return fmt.Sprintf("%q IS an image collection — write `Icon: image %s` for an Images$Image. "+
+			"Writing it as a plain icon reference stores a custom-icon reference, which fails the "+
+			"build with CE1613.", collection, ref.value)
+	}
+	return ""
+}
+
 // nearestIcons suggests up to five icons whose names are close to the one
 // written. Substring matching in both directions covers the common typos
 // (a truncated name, an extra qualifier) without needing an edit-distance table.
diff --git a/mdl/executor/validate_icon_refs_test.go b/mdl/executor/validate_icon_refs_test.go
index 34b8d1b3bf..192da267a0 100644
--- a/mdl/executor/validate_icon_refs_test.go
+++ b/mdl/executor/validate_icon_refs_test.go
@@ -7,6 +7,7 @@ import (
 	"testing"
 
 	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/types"
 )
 
 func testIconIndex() *iconIndex {
@@ -15,7 +16,12 @@ func testIconIndex() *iconIndex {
 			"Atlas_Core.Atlas":        {"home": true, "pencil": true, "pencil-write-paper": true},
 			"Atlas_Core.Atlas_Filled": {"home": true, "pencil": true},
 		},
-		order: []string{"Atlas_Core.Atlas", "Atlas_Core.Atlas_Filled"},
+		images: map[string]map[string]bool{
+			"MyModule.Images":        {"logo": true},
+			"DesignSystem.Icons_SVG": {"edit": true},
+		},
+		order:      []string{"Atlas_Core.Atlas", "Atlas_Core.Atlas_Filled"},
+		imageOrder: []string{"DesignSystem.Icons_SVG", "MyModule.Images"},
 	}
 }
 
@@ -56,19 +62,19 @@ func TestIconIndexCheck(t *testing.T) {
 			name:      "not a qualified reference",
 			value:     "pencil",
 			wantErr:   true,
-			wantParts: []string{"not a qualified icon reference", "Module.Collection.IconName"},
+			wantParts: []string{"not a qualified reference", "Module.Collection.Name"},
 		},
 		{
 			name:      "trailing dot",
 			value:     "Atlas_Core.Atlas.",
 			wantErr:   true,
-			wantParts: []string{"not a qualified icon reference"},
+			wantParts: []string{"not a qualified reference"},
 		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			err := idx.check(iconRef{value: tt.value, where: "actionbutton 'btn'"})
+			err := idx.check(iconRef{value: tt.value, kind: types.MenuIconCollection, where: "actionbutton 'btn'"})
 			if !tt.wantErr {
 				if err != nil {
 					t.Fatalf("unexpected error for %q: %v", tt.value, err)
@@ -234,24 +240,102 @@ func TestIconRefsInStatement(t *testing.T) {
 	}
 }
 
-// TestIconPropValue covers the quoting and casing MDL allows — `Icon:` and
-// `icon:` are the same property, and the value may arrive quoted.
-func TestIconPropValue(t *testing.T) {
+// TestIconPropRef covers the quoting and casing MDL allows — `Icon:` and `icon:`
+// are the same property, and the value may arrive quoted — and, since #1059, the
+// two SHAPES the property can hold.
+//
+// The plain-string rows are not legacy trivia. `Icon:` carried a string before
+// the kinds existed and several callers still build a WidgetV3 that way, so a
+// reader handling only the typed shape stops resolving icons entirely — and says
+// nothing about it, because "no reference found" and "no icon" look identical
+// from here.
+func TestIconPropRef(t *testing.T) {
 	tests := []struct {
-		props map[string]any
-		want  string
+		name     string
+		props    map[string]any
+		wantOK   bool
+		wantName string
+		wantKind types.MenuIconKind
 	}{
-		{map[string]any{"Icon": "Atlas_Core.Atlas.home"}, "Atlas_Core.Atlas.home"},
-		{map[string]any{"icon": "Atlas_Core.Atlas.home"}, "Atlas_Core.Atlas.home"},
-		{map[string]any{"ICON": "'Atlas_Core.Atlas.home'"}, "Atlas_Core.Atlas.home"},
-		{map[string]any{"Icon": "  Atlas_Core.Atlas.home  "}, "Atlas_Core.Atlas.home"},
-		{map[string]any{"Caption": "not an icon"}, ""},
-		{map[string]any{"Icon": 42}, ""}, // non-string must not panic
-		{nil, ""},
+		{"string is the collection kind", map[string]any{"Icon": "Atlas_Core.Atlas.home"}, true, "Atlas_Core.Atlas.home", types.MenuIconCollection},
+		{"lowercase key", map[string]any{"icon": "Atlas_Core.Atlas.home"}, true, "Atlas_Core.Atlas.home", types.MenuIconCollection},
+		{"quoted value", map[string]any{"ICON": "'Atlas_Core.Atlas.home'"}, true, "Atlas_Core.Atlas.home", types.MenuIconCollection},
+		{"padded value", map[string]any{"Icon": "  Atlas_Core.Atlas.home  "}, true, "Atlas_Core.Atlas.home", types.MenuIconCollection},
+		{"typed collection", map[string]any{"Icon": &ast.WidgetIcon{Kind: types.MenuIconCollection, Name: "Atlas_Core.Atlas.home"}}, true, "Atlas_Core.Atlas.home", types.MenuIconCollection},
+		{"typed image keeps its kind", map[string]any{"Icon": &ast.WidgetIcon{Kind: types.MenuIconImage, Name: "MyModule.Images.logo"}}, true, "MyModule.Images.logo", types.MenuIconImage},
+		// A glyph names no document, so there is no name to resolve — but it IS
+		// returned, carrying its code, because MDL078 reads glyphs off this same
+		// walk. A private second walk is how that rule came to know about menu
+		// items and not about widgets.
+		{"glyph is walked, with a code and no name", map[string]any{"Icon": &ast.WidgetIcon{Kind: types.MenuIconGlyph, Code: 57377}}, true, "", types.MenuIconGlyph},
+		{"no icon property", map[string]any{"Caption": "not an icon"}, false, "", ""},
+		{"non-string must not panic", map[string]any{"Icon": 42}, false, "", ""},
+		{"nil properties", nil, false, "", ""},
 	}
 	for _, tt := range tests {
-		if got := iconPropValue(tt.props); got != tt.want {
-			t.Errorf("iconPropValue(%v) = %q, want %q", tt.props, got, tt.want)
+		t.Run(tt.name, func(t *testing.T) {
+			got, ok := iconPropRef(tt.props)
+			if ok != tt.wantOK {
+				t.Fatalf("ok = %v, want %v (ref %+v)", ok, tt.wantOK, got)
+			}
+			if !ok {
+				return
+			}
+			if got.value != tt.wantName || got.kind != tt.wantKind {
+				t.Errorf("got (%q, %q), want (%q, %q)", got.value, got.kind, tt.wantName, tt.wantKind)
+			}
+		})
+	}
+}
+
+// TestIconIndexCheck_ResolvesEachKindAgainstItsOwnDocument is the rule the kinds
+// exist for. The two named kinds are spelled identically and live in different
+// documents, so resolving one against the other's listing reports a correct
+// reference as a typo — the same conflation as the original bug, pointed the
+// other way.
+func TestIconIndexCheck_ResolvesEachKindAgainstItsOwnDocument(t *testing.T) {
+	idx := testIconIndex()
+
+	if err := idx.check(iconRef{value: "DesignSystem.Icons_SVG.edit", kind: types.MenuIconImage, where: "actionbutton 'btn'"}); err != nil {
+		t.Errorf("a valid image reference was rejected: %v", err)
+	}
+	if err := idx.check(iconRef{value: "Atlas_Core.Atlas.home", kind: types.MenuIconCollection, where: "actionbutton 'btn'"}); err != nil {
+		t.Errorf("a valid collection reference was rejected: %v", err)
+	}
+
+	// Written without `image`, an image collection is not an icon collection —
+	// and this is exactly the mistake #1059 reported, so the message has to name
+	// the remedy rather than leave it looking like a typo.
+	err := idx.check(iconRef{value: "DesignSystem.Icons_SVG.edit", kind: types.MenuIconCollection, where: "actionbutton 'btn'"})
+	if err == nil {
+		t.Fatal("an image reference written as a collection reference was accepted — that is CE1613")
+	}
+	for _, want := range []string{"IS an image collection", "Icon: image", "CE1613"} {
+		if !strings.Contains(err.Error(), want) {
+			t.Errorf("error %q does not mention %q", err, want)
 		}
 	}
+
+	// And the reverse.
+	err = idx.check(iconRef{value: "Atlas_Core.Atlas.home", kind: types.MenuIconImage, where: "actionbutton 'btn'"})
+	if err == nil {
+		t.Fatal("a collection reference written as an image reference was accepted")
+	}
+	if !strings.Contains(err.Error(), "IS an icon collection") {
+		t.Errorf("error %q does not name the remedy", err)
+	}
+}
+
+// CONTROL: an empty listing means the backend could not answer, not that the
+// project has none. Reporting every reference as unknown on that basis is a
+// false error blocking a script that builds cleanly — the third state
+// ("could not establish") that the check-vs-mxbuild class turns on.
+func TestIconIndexCheck_EmptyListingResolvesNothing(t *testing.T) {
+	idx := &iconIndex{collections: map[string]map[string]bool{}, images: map[string]map[string]bool{}}
+	if err := idx.check(iconRef{value: "Whatever.Coll.name", kind: types.MenuIconCollection, where: "actionbutton 'btn'"}); err != nil {
+		t.Errorf("an unresolvable listing reported an error: %v", err)
+	}
+	if err := idx.check(iconRef{value: "Whatever.Coll.name", kind: types.MenuIconImage, where: "actionbutton 'btn'"}); err != nil {
+		t.Errorf("an unresolvable image listing reported an error: %v", err)
+	}
 }
diff --git a/mdl/executor/validate_program.go b/mdl/executor/validate_program.go
index a046efeee4..5cd7346d5d 100644
--- a/mdl/executor/validate_program.go
+++ b/mdl/executor/validate_program.go
@@ -56,7 +56,7 @@ func ValidateProgram(prog *ast.Program, projectPath string) []linter.Violation {
 		// collapsed to its icon rail (MDL077). Covers both statements that carry
 		// menu items, which share one AST node so they cannot diverge.
 		violations = append(violations, validateMenuItemIcons(stmt)...)
-		violations = append(violations, validateMenuItemGlyphCodes(stmt)...)
+		violations = append(violations, validateGlyphCodes(stmt)...)
 		// A page with parameters and a Url must name each parameter in it (CE5601).
 		if pageStmt, ok := stmt.(*ast.CreatePageStmtV3); ok {
 			violations = append(violations, ValidatePageURLParameters(pageStmt)...)
diff --git a/mdl/executor/validate_widget_object_property.go b/mdl/executor/validate_widget_object_property.go
index c5db5ed657..c4c3e5ada5 100644
--- a/mdl/executor/validate_widget_object_property.go
+++ b/mdl/executor/validate_widget_object_property.go
@@ -74,23 +74,97 @@ func validateObjectEntryProperties(w *ast.WidgetV3, registry *WidgetRegistry, lo
 
 	var out []linter.Violation
 	for _, key := range keys {
-		entries, ok := w.Properties[key].(*ast.ObjectEntryListV3)
-		if !ok || entries == nil {
-			continue
+		value := w.Properties[key]
+		// One violation per property, so the three shapes below are exclusive:
+		// an empty list on a declared container matches two of them.
+		switch {
+		case isObjectEntryList(value):
+			entries, _ := value.(*ast.ObjectEntryListV3)
+			out = append(out, linter.Violation{
+				RuleID:   "MDL-WIDGET27",
+				Severity: linter.SeverityError,
+				Message: fmt.Sprintf(
+					"%s: widget `%s` property `%s` is a repeated entry written as a property value — "+
+						"MDL writes these as %s in the widget body, and a value here is discarded on write",
+					locationPrefix, w.Name, key, objectEntryRemedy(w, registry, key)),
+				Suggestion: objectEntryExample(w, registry, key, entries),
+			})
+		case isEmptyListValue(value):
+			// `p: []`. The generic `[expr, …]` branch of the visitor turns this
+			// into an empty []string that no writer claims, so it is #999's
+			// silent drop reached by a different spelling (mendixlabs/mxcli#1056).
+			// Keyed on EMPTINESS, never on the brackets: `visible: [expr]` and a
+			// filter's `attributes: [Name]` are how MDL spells those properties.
+			out = append(out, linter.Violation{
+				RuleID:   "MDL-WIDGET27",
+				Severity: linter.SeverityError,
+				Message: fmt.Sprintf(
+					"%s: widget `%s` property `%s` is an empty list value, which writes nothing — "+
+						"%s",
+					locationPrefix, w.Name, key, emptyListRemedy(w, registry, key)),
+				Suggestion: objectEntryExample(w, registry, key, nil),
+			})
+		case isDeclaredContainer(w, registry, key):
+			// The definition says this property holds repeated entries or child
+			// widgets, so NO value in the property list can reach storage. Only
+			// knowable with a project; without one `p: 'x'` is the ordinary
+			// property form and flagging it would be a guess.
+			out = append(out, linter.Violation{
+				RuleID:   "MDL-WIDGET27",
+				Severity: linter.SeverityError,
+				Message: fmt.Sprintf(
+					"%s: widget `%s` property `%s` holds %s, not a value — "+
+						"a value here is discarded on write",
+					locationPrefix, w.Name, key, containerNoun(w, registry, key)),
+				Suggestion: objectEntryExample(w, registry, key, nil),
+			})
 		}
-		out = append(out, linter.Violation{
-			RuleID:   "MDL-WIDGET27",
-			Severity: linter.SeverityError,
-			Message: fmt.Sprintf(
-				"%s: widget `%s` property `%s` is a repeated entry written as a property value — "+
-					"MDL writes these as %s in the widget body, and a value here is discarded on write",
-				locationPrefix, w.Name, key, objectEntryRemedy(w, registry, key)),
-			Suggestion: objectEntryExample(w, registry, key, entries),
-		})
 	}
 	return out
 }
 
+func isObjectEntryList(v any) bool {
+	entries, ok := v.(*ast.ObjectEntryListV3)
+	return ok && entries != nil
+}
+
+// isEmptyListValue reports `p: []`. The visitor renders a bracketed value with
+// no elements as an empty []string — the one shape that can produce one.
+func isEmptyListValue(v any) bool {
+	items, ok := v.([]string)
+	return ok && len(items) == 0
+}
+
+// isDeclaredContainer reports whether the widget's definition declares this
+// property as an object list or a child slot. False without a definition, which
+// is what keeps the scalar case project-gated.
+func isDeclaredContainer(w *ast.WidgetV3, registry *WidgetRegistry, propertyKey string) bool {
+	kw, _ := containerKeyword(w, registry, propertyKey)
+	return kw != ""
+}
+
+// containerNoun describes what the property holds, for the message.
+func containerNoun(w *ast.WidgetV3, registry *WidgetRegistry, propertyKey string) string {
+	if _, slot := containerKeyword(w, registry, propertyKey); slot {
+		return "child widgets"
+	}
+	return "repeated entries"
+}
+
+// emptyListRemedy names the container when the definition declares one, and
+// otherwise says only what is certain: the value does not reach storage.
+func emptyListRemedy(w *ast.WidgetV3, registry *WidgetRegistry, propertyKey string) string {
+	kw, slot := containerKeyword(w, registry, propertyKey)
+	switch {
+	case kw != "" && slot:
+		return fmt.Sprintf("`%s` holds child widgets, written as `%s <name> { … }` in the widget body", propertyKey, kw)
+	case kw != "":
+		return fmt.Sprintf("`%s` holds repeated entries, written as `%s <name> (…)` in the widget body", propertyKey, kw)
+	}
+	return "remove it, or — if this property takes repeated entries or child widgets — " +
+		"write them as blocks in the widget body"
+}
+
 // objectEntryRemedy names the container keyword when the widget's definition
 // declares one, and describes the shape when it does not — with no project there
 // is no definition to consult, and naming a keyword that might be wrong is worse
@@ -105,28 +179,47 @@ func objectEntryRemedy(w *ast.WidgetV3, registry *WidgetRegistry, propertyKey st
 // objectEntryKeyword resolves the property key to the MDL container keyword the
 // widget declares for it, or "" when it cannot be known.
 func objectEntryKeyword(w *ast.WidgetV3, registry *WidgetRegistry, propertyKey string) string {
+	kw, _ := containerKeyword(w, registry, propertyKey)
+	return kw
+}
+
+// containerKeyword resolves a property key to the MDL container keyword the
+// widget's definition declares for it, and reports whether that container is a
+// CHILD SLOT (holds widgets, written as `kw name { … }`) rather than an object
+// list (holds entries, written as `kw name (…)`). The two spell their remedy
+// differently, so a rule that conflated them would print an example that does
+// not parse. Returns "" when there is no definition to consult.
+func containerKeyword(w *ast.WidgetV3, registry *WidgetRegistry, propertyKey string) (keyword string, isSlot bool) {
 	def := lookupWidgetDef(w, registry)
 	if def == nil {
-		return ""
+		return "", false
 	}
 	for _, ol := range def.ObjectLists {
 		if strings.EqualFold(ol.PropertyKey, propertyKey) {
-			return strings.ToLower(ol.MDLContainer)
+			return strings.ToLower(ol.MDLContainer), false
+		}
+	}
+	for _, cs := range def.ChildSlots {
+		if strings.EqualFold(cs.PropertyKey, propertyKey) {
+			return strings.ToLower(cs.MDLContainer), true
 		}
 	}
-	return ""
+	return "", false
 }
 
 // objectEntryExample rewrites what the author wrote into the form that works, so
 // the fix is a copy rather than a translation exercise. Falls back to naming the
 // discovery command when the keyword is unknown.
 func objectEntryExample(w *ast.WidgetV3, registry *WidgetRegistry, propertyKey string, entries *ast.ObjectEntryListV3) string {
-	kw := objectEntryKeyword(w, registry, propertyKey)
+	kw, slot := containerKeyword(w, registry, propertyKey)
 	if kw == "" {
 		return "move the entries into the widget body as container blocks; " +
 			"`mxcli widget describe <widget> -p <project.mpr>` lists the container keywords"
 	}
-	if len(entries.Entries) == 0 {
+	if slot {
+		return fmt.Sprintf("write `%s %s1 { … }` inside the widget body, holding the child widgets", kw, kw)
+	}
+	if entries == nil || len(entries.Entries) == 0 {
 		return fmt.Sprintf("write `%s %s1 (…)` inside the widget body", kw, kw)
 	}
 	var parts []string
diff --git a/mdl/executor/validate_widget_object_property_test.go b/mdl/executor/validate_widget_object_property_test.go
index c82db220bb..56348e3b68 100644
--- a/mdl/executor/validate_widget_object_property_test.go
+++ b/mdl/executor/validate_widget_object_property_test.go
@@ -3,6 +3,8 @@
 package executor
 
 import (
+	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 
@@ -11,13 +13,41 @@ import (
 	"github.com/mendixlabs/mxcli/mdl/visitor"
 )
 
+// fixtureProjectWithDefs copies the fixture to a temp dir and DERIVES its widget
+// definitions from the tracked `.mpk` files.
+//
+// `testdata/expr-checker/.mxcli/` is gitignored: the `.def.json` files are
+// generated, and a developer who has ever run `mxcli widget docs` against the
+// fixture has them while CI never does. Reading them ambiently makes a test pass
+// locally and fail on the runner — which is exactly how the three tests below
+// first shipped red. Deriving them here depends only on tracked inputs, and the
+// copy keeps the generated files out of the fixture other tests copy.
+func fixtureProjectWithDefs(t *testing.T) string {
+	t.Helper()
+	src := filepath.Dir(fixtureProject(t))
+	dst := t.TempDir()
+	if err := os.CopyFS(dst, os.DirFS(src)); err != nil {
+		t.Fatalf("copy fixture: %v", err)
+	}
+	// Start from no definitions whatever the developer's tree holds, so the
+	// test sees the same inputs here and on the runner.
+	if err := os.RemoveAll(filepath.Join(dst, ".mxcli")); err != nil {
+		t.Fatalf("clear derived definitions: %v", err)
+	}
+	proj := filepath.Join(dst, "minimal.mpr")
+	if _, err := RefreshWidgetDefinitions(proj, true, nil); err != nil {
+		t.Fatalf("derive widget definitions from the tracked .mpk files: %v", err)
+	}
+	return proj
+}
+
 func widget27(t *testing.T, src string) []linter.Violation {
 	t.Helper()
 	prog, errs := visitor.Build(src)
 	if len(errs) > 0 {
 		t.Fatalf("parsing: %v", errs)
 	}
-	registry := LoadWidgetRegistry(fixtureProject(t))
+	registry := LoadWidgetRegistry(fixtureProjectWithDefs(t))
 	if registry == nil {
 		t.Fatal("no registry")
 	}
@@ -57,8 +87,12 @@ func TestObjectEntryProperty_IsReported(t *testing.T) {
 			"page and discard the entries, which is the bug", got[0].Severity)
 	}
 	// The message has to name the container keyword, or it says "wrong" without
-	// saying what right looks like.
-	if !strings.Contains(got[0].Message, "attribute") {
+	// saying what right looks like. Assert the KEYWORD IN ITS REMEDY, not a bare
+	// "attribute": the property is called `attributes`, so a substring check for
+	// "attribute" is satisfied by the property name and passes with no definition
+	// loaded at all — which is how the definition-dependent tests below shipped
+	// green locally and red in CI.
+	if !strings.Contains(got[0].Message, "`attribute <name> (…)` blocks") {
 		t.Errorf("message does not name the container keyword: %q", got[0].Message)
 	}
 	if !strings.Contains(got[0].Message, "attributes") {
@@ -206,3 +240,105 @@ func TestOrdinaryArrayKeepsItsAstShape(t *testing.T) {
 			w2.Properties["DesignProperties"])
 	}
 }
+
+// mendixlabs/mxcli#1056. #999's fix keyed on the `[(k: v)]` shape, so it needed
+// at least one parenthesised entry. The reporter of #1056 reached for the EMPTY
+// form instead — `customAllSelected: []` — after the slot syntax their own
+// generated docs showed was rejected by the parser (that half is fixed; the
+// grammar took generic container names in bca5466e). The empty form fell
+// through to the generic `[expr, …]` branch, became a nil []string no writer
+// claims, and reproduced #999 exactly: check clean, exec successful, nothing
+// written — then 3x CE0642 at build time because the slots are required.
+func TestEmptyListProperty_IsReported(t *testing.T) {
+	got := widget27(t, strings.Replace(page27, "%s", `attributes: []`, 1))
+	if len(got) != 1 {
+		t.Fatalf("got %d MDL-WIDGET27 for `attributes: []`, want 1: %+v", len(got), got)
+	}
+	if got[0].Severity != linter.SeverityError {
+		t.Errorf("severity = %v, want error — a warning lets exec write the page "+
+			"with the property discarded, which is the whole defect", got[0].Severity)
+	}
+	if !strings.Contains(got[0].Suggestion, "attribute") {
+		t.Errorf("suggestion must name the container keyword, got %q", got[0].Suggestion)
+	}
+}
+
+// A widgets-typed slot is the same mistake wearing a different type: the
+// property holds CHILD WIDGETS, so no value written in the property list can
+// ever reach storage. This is the exact property from #1056.
+func TestEmptyListOnWidgetSlot_IsReported(t *testing.T) {
+	src := `create page M.P (Title: 'x', Layout: Atlas_Core.Atlas_Default) {
+  pluggablewidget 'com.mendix.widget.web.selectionhelper.SelectionHelper' sh (
+    renderStyle: 'custom', customAllSelected: []
+  )
+}`
+	got := widget27(t, src)
+	if len(got) != 1 {
+		t.Fatalf("got %d MDL-WIDGET27 for `customAllSelected: []`, want 1: %+v", len(got), got)
+	}
+	if !strings.Contains(got[0].Suggestion, "customallselected") {
+		t.Errorf("suggestion must name the slot's container keyword, got %q", got[0].Suggestion)
+	}
+}
+
+// A scalar cannot reach a container-typed property either, and this one is only
+// knowable from the definition — which is why it is reported ONLY when the
+// widget resolves. Without that, `p: 'x'` is the ordinary property form and
+// flagging it would be a guess.
+func TestScalarOnContainerProperty_IsReported(t *testing.T) {
+	src := `create page M.P (Title: 'x', Layout: Atlas_Core.Atlas_Default) {
+  pluggablewidget 'com.mendix.widget.web.selectionhelper.SelectionHelper' sh (
+    renderStyle: 'custom', customAllSelected: 'something'
+  )
+}`
+	got := widget27(t, src)
+	if len(got) != 1 {
+		t.Fatalf("got %d MDL-WIDGET27 for `customAllSelected: 'something'`, want 1: %+v", len(got), got)
+	}
+}
+
+// The bracket form is how MDL writes a conditional expression and a filter's
+// attribute list. Reporting those would break the corpus, so the rule must key
+// on EMPTINESS, never on the brackets.
+func TestNonEmptyBracketValuesAreNotReported(t *testing.T) {
+	for _, prop := range []string{
+		`visible: [$currentObject/Name != '']`,
+		`editable: [true]`,
+	} {
+		if got := widget27(t, strings.Replace(page27, "%s", prop, 1)); len(got) != 0 {
+			t.Errorf("%s: got %d MDL-WIDGET27, want 0: %+v", prop, len(got), got)
+		}
+	}
+	filter := `create page M.P (Title: 'x', Layout: Atlas_Core.Atlas_Default) {
+  datagrid2 dg (DataSource: database, Entity: MyFirstModule.Expense) {
+    column c1 (Attribute: Name) { textfilter tf (attributes: [Name]) }
+  }
+}`
+	if got := widget27(t, filter); len(got) != 0 {
+		t.Errorf("filter attribute list: got %d MDL-WIDGET27, want 0: %+v", len(got), got)
+	}
+}
+
+// The other half of mendixlabs/mxcli#1056: the slot syntax the widget docs
+// generate must PARSE. It did not on the reporter's build (`mismatched input
+// 'customallselected' expecting '}'`), which is why they reached for
+// `customAllSelected: []` at all. bca5466e made generic container names parse;
+// this pins it, so the two halves cannot regress independently — a parser that
+// rejects the right spelling turns MDL-WIDGET27 into a dead end.
+func TestDocumentedSlotSyntaxParses(t *testing.T) {
+	src := `create page M.P (Title: 'x', Layout: Atlas_Core.Atlas_Default) {
+  pluggablewidget 'com.mendix.widget.web.selectionhelper.SelectionHelper' sh (
+    renderStyle: 'custom'
+  ) {
+    customallselected s1 { dynamictext d1 (Content: 'All') }
+    customsomeselected s2 { dynamictext d2 (Content: 'Some') }
+    customnoneselected s3 { dynamictext d3 (Content: 'None') }
+  }
+}`
+	if _, errs := visitor.Build(src); len(errs) > 0 {
+		t.Fatalf("the slot form `mxcli widget docs` emits must parse, got: %v", errs)
+	}
+	if got := widget27(t, src); len(got) != 0 {
+		t.Errorf("the correct form must not be reported, got %d: %+v", len(got), got)
+	}
+}
diff --git a/mdl/grammar/MDLLexer.g4 b/mdl/grammar/MDLLexer.g4
index a089d8f7c9..350612db9b 100644
--- a/mdl/grammar/MDLLexer.g4
+++ b/mdl/grammar/MDLLexer.g4
@@ -61,6 +61,11 @@ MODIFY: M O D I F Y;
 // `keyword` (so an entity or variable called "merge" still parses).
 MERGE: M E R G E;
 
+// `describe microflow X normalized` selects Mode 3 rendering. Like MERGE it is
+// a word people already use as a name, so it goes in `keyword` too and an
+// entity or variable called "normalized" still parses.
+NORMALIZED: N O R M A L I Z E D;
+
 ENTITY: E N T I T Y;
 PERSISTENT: P E R S I S T E N T;
 VIEW: V I E W;
diff --git a/mdl/grammar/domains/MDLCatalog.g4 b/mdl/grammar/domains/MDLCatalog.g4
index 88b696975c..a7a1d2a0ad 100644
--- a/mdl/grammar/domains/MDLCatalog.g4
+++ b/mdl/grammar/domains/MDLCatalog.g4
@@ -156,7 +156,7 @@ describeStatement
     | DESCRIBE CONTRACT MESSAGE qualifiedName    // DESCRIBE CONTRACT MESSAGE Module.Service.MessageName
     | DESCRIBE ENTITY qualifiedName
     | DESCRIBE ASSOCIATION qualifiedName
-    | DESCRIBE MICROFLOW qualifiedName
+    | DESCRIBE MICROFLOW qualifiedName NORMALIZED?   // NORMALIZED folds a recombinable irreducible graph into nested ifs (Mode 3)
     | DESCRIBE NANOFLOW qualifiedName
     | DESCRIBE RULE qualifiedName
     | DESCRIBE WORKFLOW qualifiedName
diff --git a/mdl/grammar/domains/MDLPage.g4 b/mdl/grammar/domains/MDLPage.g4
index e498d12df5..f4ae8a7295 100644
--- a/mdl/grammar/domains/MDLPage.g4
+++ b/mdl/grammar/domains/MDLPage.g4
@@ -480,6 +480,7 @@ widgetPropertyV3
     // what separates them (#956).
     | (IDENTIFIER | keyword) COLON paramListV3        // <Name>Params: [{1} = Attr]
     | BUTTONSTYLE COLON buttonStyleV3                  // ButtonStyle: Primary
+    | ICON COLON widgetIconV3                          // Icon: 'Atlas_Core.Atlas_Filled.pencil' | image Mod.Images.logo | glyph 57377
     | CLASS COLON STRING_LITERAL                       // Class: 'my-class'
     | STYLE COLON STRING_LITERAL                       // Style: 'color: red'
     | DESKTOPWIDTH COLON desktopWidthV3               // DesktopWidth: 6 | AutoFill
@@ -520,6 +521,42 @@ widgetPropertyV3
     | keyword COLON propertyValueV3                  // Generic: keyword as property name (for pluggable widgets)
     ;
 
+
+// Mendix stores three DIFFERENT icon elements on a widget, exactly as it does on
+// a navigation menu item (navMenuIcon in MDLParser.g4), and they are not
+// variants of one value: an icon-collection icon and an image icon each hold a
+// qualified name — into an icon collection and an image collection, which are
+// different documents — while a glyph icon holds a numeric character code and no
+// name at all.
+//
+//   Icon: 'Atlas_Core.Atlas_Filled.pencil'   Forms$IconCollectionIcon
+//   Icon: image MyModule.Images.logo         Forms$ImageIcon
+//   Icon: glyph 57377                        Forms$GlyphIcon
+//
+// Only the first was expressible, so a stored image icon came back out of
+// DESCRIBE spelled like a collection reference and re-executed as one —
+// CE1613 "The selected custom icon … no longer exists" — and a glyph icon was
+// emitted as nothing at all and deleted on replay (mendixlabs/mxcli#1059).
+//
+// The bare form stays the collection icon, so every existing script means what
+// it did. Both the quoted and unquoted spellings are accepted: `Icon:` has
+// carried a quoted string since #602, while a reference into the model is
+// spelled as a qualifiedName everywhere else (ADR-0003). An Atlas icon name
+// carries hyphens, which IDENTIFIER cannot lex, so those segments are
+// double-quoted per segment: image Mod.Images."my-logo".
+//
+// The keyword-led alternatives come FIRST. qualifiedName accepts a keyword as a
+// name segment (identifierOrKeyword), so `image Mod.Images.logo` also matches
+// the bare form with `image` read as the first segment of the name; listing the
+// specific alternatives ahead of the general one is what settles it. Same trap,
+// same remedy, as navMenuIcon.
+widgetIconV3
+    : GLYPH NUMBER_LITERAL
+    | IMAGE (qualifiedName | STRING_LITERAL)
+    | qualifiedName
+    | STRING_LITERAL
+    ;
+
 // Filter type values - handle keywords like CONTAINS that are also filter types
 filterTypeValue
     : CONTAINS      // contains
diff --git a/mdl/grammar/domains/MDLSettings.g4 b/mdl/grammar/domains/MDLSettings.g4
index eb43d3e206..6dd6b973cf 100644
--- a/mdl/grammar/domains/MDLSettings.g4
+++ b/mdl/grammar/domains/MDLSettings.g4
@@ -583,6 +583,7 @@ keyword
     | CALL | LOG | TRACE | WITH | FOR | TO | OF | RETURNING | RETURNS
     | NOTHING | EXPRESSION | JAVASCRIPT
     | MERGE
+    | NORMALIZED
 
     // Query / SQL
     | SELECT | FROM | WHERE | JOIN | LEFT | RIGHT | INNER | OUTER | FULL | CROSS
diff --git a/mdl/linter/catalog_mode_test.go b/mdl/linter/catalog_mode_test.go
index 4f07db2c0a..2c966bac15 100644
--- a/mdl/linter/catalog_mode_test.go
+++ b/mdl/linter/catalog_mode_test.go
@@ -37,6 +37,7 @@ func TestDetectRequiredCatalogMode(t *testing.T) {
 		{"refs_from", "def check():\n  refs_from(x)", CatalogFull},
 		{"cycles", "def check():\n  for c in cycles(): pass", CatalogCommunities},
 		{"module_dependencies", "def check():\n  module_dependencies()", CatalogCommunities},
+		{"module_cycles", "def check():\n  for c in module_cycles(): pass", CatalogCommunities},
 		{"community_beats_refs", "def check():\n  refs_to(x); cycles()", CatalogCommunities},
 		// A substring that isn't a call must not trigger (needs the "(").
 		{"mention_only", "# refs_to is documented here", CatalogFast},
diff --git a/mdl/linter/starlark.go b/mdl/linter/starlark.go
index 7e12169588..a74745b641 100644
--- a/mdl/linter/starlark.go
+++ b/mdl/linter/starlark.go
@@ -157,7 +157,7 @@ func (r *StarlarkRule) convertViolation(v starlark.Value) *Violation {
 // LoadStarlarkRule loads a Starlark rule from a file.
 // communityBuiltins need REFRESH CATALOG COMMUNITIES (the graph_* tables).
 var communityBuiltins = []string{
-	"cycles", "module_dependencies", "community_of", "layer_of",
+	"cycles", "module_cycles", "module_dependencies", "community_of", "layer_of",
 	"centrality", "god_nodes", "integration_surface",
 }
 
@@ -334,6 +334,7 @@ func (r *StarlarkRule) buildPredeclared() starlark.StringDict {
 		"community_of":         starlark.NewBuiltin("community_of", r.builtinCommunityOf),
 		"layer_of":             starlark.NewBuiltin("layer_of", r.builtinLayerOf),
 		"cycles":               starlark.NewBuiltin("cycles", r.builtinCycles),
+		"module_cycles":        starlark.NewBuiltin("module_cycles", r.builtinModuleCycles),
 		"module_dependencies":  starlark.NewBuiltin("module_dependencies", r.builtinModuleDependencies),
 		"centrality":           starlark.NewBuiltin("centrality", r.builtinCentrality),
 		"god_nodes":            starlark.NewBuiltin("god_nodes", r.builtinGodNodes),
diff --git a/mdl/linter/starlark_graph.go b/mdl/linter/starlark_graph.go
index f0fc072110..44892772c6 100644
--- a/mdl/linter/starlark_graph.go
+++ b/mdl/linter/starlark_graph.go
@@ -135,6 +135,35 @@ func (r *StarlarkRule) builtinCycles(_ *starlark.Thread, _ *starlark.Builtin, ar
 	return starlark.NewList(vals), nil
 }
 
+// module_cycles() -> list of struct{id, size, members (list of module names)}.
+//
+// Separate from cycles(): that one is asset-level over the structural edge
+// kinds, this one is module-level over every kind, matching
+// graph_module_coupling. A "no circular module dependencies" rule wants this —
+// modules reference each other through documents that need form no cycle
+// themselves, so cycles() answers "none" for a genuinely tangled pair
+// (mendixlabs/mxcli#1060).
+func (r *StarlarkRule) builtinModuleCycles(_ *starlark.Thread, _ *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error) {
+	rows := r.graphRows(
+		`SELECT CycleId AS id, CycleSize AS size, group_concat(ModuleName) AS members
+		 FROM graph_module_cycles_data GROUP BY CycleId ORDER BY size DESC`)
+	vals := make([]starlark.Value, 0, len(rows))
+	for _, m := range rows {
+		members := []starlark.Value{}
+		if s, ok := m["members"].(string); ok && s != "" {
+			for _, name := range strings.Split(s, ",") {
+				members = append(members, starlark.String(name))
+			}
+		}
+		vals = append(vals, starlarkstruct.FromStringDict(starlark.String("module_cycle"), starlark.StringDict{
+			"id":      anyToStarlark(m["id"]),
+			"size":    anyToStarlark(m["size"]),
+			"members": starlark.NewList(members),
+		}))
+	}
+	return starlark.NewList(vals), nil
+}
+
 // module_dependencies() -> list of struct{source_module, target_module, ref_kind, edges}.
 func (r *StarlarkRule) builtinModuleDependencies(_ *starlark.Thread, _ *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error) {
 	rows := r.graphRows(
diff --git a/mdl/microflownorm/formula.go b/mdl/microflownorm/formula.go
new file mode 100644
index 0000000000..587217f1bb
--- /dev/null
+++ b/mdl/microflownorm/formula.go
@@ -0,0 +1,171 @@
+// SPDX-License-Identifier: Apache-2.0
+
+// Package microflownorm folds the guards of a recombinable microflow graph into
+// one condition, so a graph that nested `if`s cannot describe can still be
+// described without duplicating an activity.
+//
+// This is Mode 3 of PROPOSAL_structured_microflow_description.md. The graph it
+// exists for is mendixlabs/mxcli#923's:
+//
+//	split1 : true → split2      false → merge1
+//	split2 : true → merge1      false → merge2
+//	merge1 → log → merge2
+//
+// `log` runs when control reaches merge1, which is `¬c1 ∨ (c1 ∧ c2)` — and no
+// nesting of if/then/else expresses that without emitting `log` twice. Folding
+// the guards does, and Böhm-Jacopini says folding is available exactly when the
+// overlap is a shared suffix (one entry).
+//
+// # Why folding is sound here
+//
+// Two preconditions, both from the proposal, and neither optional:
+//
+//  1. **Short-circuit.** The folded form may evaluate a condition the original
+//     skipped. MEASURED on Mendix 11.14.0 (fixtures
+//     mdl-examples/bug-tests/923-short-circuit-semantics{,.test}.mdl): both
+//     `and` and `or` short-circuit, so `¬c1 ∨ c2` does not evaluate `c2` when
+//     `c1` is false, exactly as the original graph did not. Had they been eager,
+//     folding would introduce an error the original avoided and this package
+//     could not exist in this form.
+//
+//  2. **Purity and ordering.** Re-evaluating a Mendix split condition is safe
+//     (they are pure expressions), but only if nothing else in the folded region
+//     runs. If a branch performs a `create object` before reaching the shared
+//     suffix, folding moves a side effect. RegionCondition therefore REFUSES a
+//     region containing anything but splits and merges, rather than folding and
+//     hoping.
+//
+// The package is dependency-light on purpose (model only): it is a pure
+// function of a graph description, so it can be tested without a project, a
+// describer, or a runtime.
+package microflownorm
+
+import (
+	"sort"
+	"strings"
+)
+
+// Formula is a boolean combination of opaque condition atoms.
+//
+// An atom is a Mendix expression as the describer already renders it — this
+// package never parses one. That keeps the folding independent of expression
+// syntax: it reasons about the SHAPE of the guard, and treats the guard's text
+// as a symbol it may only copy, negate, and compare for equality.
+type Formula interface {
+	isFormula()
+	// String renders the formula as an MDL condition expression.
+	String() string
+}
+
+// Lit is a constant. It appears from folding, not from any graph node.
+type Lit bool
+
+// Atom is one split's condition, verbatim as the describer renders it.
+type Atom string
+
+// Not negates.
+type Not struct{ X Formula }
+
+// And is an n-ary conjunction.
+type And struct{ Xs []Formula }
+
+// Or is an n-ary disjunction.
+type Or struct{ Xs []Formula }
+
+func (Lit) isFormula()  {}
+func (Atom) isFormula() {}
+func (Not) isFormula()  {}
+func (And) isFormula()  {}
+func (Or) isFormula()   {}
+
+func (l Lit) String() string {
+	if bool(l) {
+		return "true"
+	}
+	return "false"
+}
+
+func (a Atom) String() string { return string(a) }
+
+// String renders a negation as Mendix's `not(...)`, and collapses the double
+// negation folding routinely produces (a false branch of a false branch).
+func (n Not) String() string {
+	if inner, ok := n.X.(Not); ok {
+		return inner.X.String()
+	}
+	return "not(" + parenthesize(n.X) + ")"
+}
+
+func (a And) String() string { return join(a.Xs, " and ") }
+func (o Or) String() string  { return join(o.Xs, " or ") }
+
+func join(xs []Formula, sep string) string {
+	if len(xs) == 0 {
+		// An empty conjunction is true and an empty disjunction is false, but
+		// Simplify never produces either — this is belt and braces.
+		if sep == " and " {
+			return "true"
+		}
+		return "false"
+	}
+	if len(xs) == 1 {
+		return xs[0].String()
+	}
+	parts := make([]string, 0, len(xs))
+	for _, x := range xs {
+		parts = append(parts, parenthesize(x))
+	}
+	return strings.Join(parts, sep)
+}
+
+// parenthesize brackets a term only when it could otherwise re-associate.
+// An atom is copied verbatim: it is the describer's own rendering and may
+// already carry whatever brackets it needs.
+func parenthesize(f Formula) string {
+	switch f.(type) {
+	case And, Or:
+		return "(" + f.String() + ")"
+	default:
+		return f.String()
+	}
+}
+
+// key is a canonical form used for equality and de-duplication. Two formulas
+// with the same key are the same formula; the ordering it induces is arbitrary
+// but stable, which is what keeps the rendered output deterministic.
+func key(f Formula) string {
+	switch v := f.(type) {
+	case Lit:
+		return "L" + v.String()
+	case Atom:
+		return "A" + string(v)
+	case Not:
+		return "N(" + key(v.X) + ")"
+	case And:
+		return "&(" + joinKeys(v.Xs) + ")"
+	case Or:
+		return "|(" + joinKeys(v.Xs) + ")"
+	}
+	return "?"
+}
+
+func joinKeys(xs []Formula) string {
+	ks := make([]string, 0, len(xs))
+	for _, x := range xs {
+		ks = append(ks, key(x))
+	}
+	sort.Strings(ks)
+	return strings.Join(ks, ",")
+}
+
+// negate returns the negation, pushing it through a literal or a double Not so
+// the result stays readable rather than accumulating wrappers.
+func negate(f Formula) Formula {
+	switch v := f.(type) {
+	case Lit:
+		return Lit(!bool(v))
+	case Not:
+		return v.X
+	}
+	return Not{X: f}
+}
diff --git a/mdl/microflownorm/region.go b/mdl/microflownorm/region.go
new file mode 100644
index 0000000000..49d664bbb0
--- /dev/null
+++ b/mdl/microflownorm/region.go
@@ -0,0 +1,123 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package microflownorm
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/mendixlabs/mxcli/model"
+)
+
+// Kind is what a node in the folded region is.
+type Kind int
+
+const (
+	// KindSplit is a two-way decision. Only Split carries a Condition.
+	KindSplit Kind = iota
+	// KindMerge is an ExclusiveMerge: one successor, no condition.
+	KindMerge
+	// KindOther is anything else. Its presence inside a region is what makes
+	// that region unfoldable — see ErrImpureRegion.
+	KindOther
+)
+
+// Node describes one node of the region being folded. The caller builds these
+// from the model; this package never touches sdk/microflows, which is what lets
+// the whole fold be unit-tested from a literal.
+type Node struct {
+	Kind Kind
+	// Condition is the split's guard, rendered exactly as DESCRIBE renders it.
+	Condition string
+	// True and False are the split's branch targets.
+	True, False model.ID
+	// Next is the single successor of a merge or other node. Empty means the
+	// path ends here (a return or an end event).
+	Next model.ID
+}
+
+// Region is the sub-graph between a split and the entry to its shared suffix.
+type Region map[model.ID]Node
+
+var (
+	// ErrImpureRegion reports a region carrying something other than splits and
+	// merges. Folding it would re-order or duplicate a side effect, so the
+	// caller must fall back to a faithful rendering instead.
+	ErrImpureRegion = errors.New("region contains an activity, so folding it would move a side effect")
+
+	// ErrCyclicRegion reports a back edge. A loop is not a guard and cannot be
+	// folded into one.
+	ErrCyclicRegion = errors.New("region is cyclic")
+)
+
+// RegionCondition returns the condition under which control, starting at
+// `from`, reaches `target`.
+//
+// The recurrence is the obvious one, which is why the interesting work is in
+// the preconditions and in Simplify rather than here:
+//
+//	reach(target)      = true
+//	reach(merge m)     = reach(next(m))
+//	reach(split s)     = (c ∧ reach(true(s))) ∨ (¬c ∧ reach(false(s)))
+//	reach(dead end)    = false
+//
+// It REFUSES rather than guesses in two cases, both of which would otherwise
+// produce a plausible and wrong guard:
+//
+//   - a node that is neither a split nor a merge (ErrImpureRegion), because the
+//     activity would either run under a different condition or not at all; and
+//   - a cycle (ErrCyclicRegion), because the recurrence does not terminate and
+//     a retry loop is not expressible as a guard.
+//
+// The returned formula is simplified.
+func RegionCondition(r Region, from, target model.ID) (Formula, error) {
+	f, err := reach(r, from, target, map[model.ID]bool{})
+	if err != nil {
+		return nil, err
+	}
+	return Simplify(f), nil
+}
+
+func reach(r Region, at, target model.ID, onPath map[model.ID]bool) (Formula, error) {
+	if at == target {
+		return Lit(true), nil
+	}
+	if at == "" {
+		return Lit(false), nil
+	}
+	if onPath[at] {
+		return nil, fmt.Errorf("%w: at %s", ErrCyclicRegion, at)
+	}
+	n, ok := r[at]
+	if !ok {
+		// Outside the region and not the target: this path leaves without
+		// reaching the shared suffix.
+		return Lit(false), nil
+	}
+
+	onPath[at] = true
+	defer delete(onPath, at)
+
+	switch n.Kind {
+	case KindMerge:
+		return reach(r, n.Next, target, onPath)
+
+	case KindSplit:
+		c := Atom(n.Condition)
+		t, err := reach(r, n.True, target, onPath)
+		if err != nil {
+			return nil, err
+		}
+		fBranch, err := reach(r, n.False, target, onPath)
+		if err != nil {
+			return nil, err
+		}
+		return Or{Xs: []Formula{
+			And{Xs: []Formula{c, t}},
+			And{Xs: []Formula{negate(c), fBranch}},
+		}}, nil
+
+	default:
+		return nil, fmt.Errorf("%w: at %s", ErrImpureRegion, at)
+	}
+}
diff --git a/mdl/microflownorm/region_test.go b/mdl/microflownorm/region_test.go
new file mode 100644
index 0000000000..38187ba1ab
--- /dev/null
+++ b/mdl/microflownorm/region_test.go
@@ -0,0 +1,164 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package microflownorm
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/mendixlabs/mxcli/model"
+)
+
+// The reporter's graph, mendixlabs/mxcli#923:
+//
+//	split1 : true → split2      false → merge1
+//	split2 : true → merge1      false → merge2
+//
+// `log` sits on merge1, so it runs on reach(merge1) = ¬c1 ∨ (c1 ∧ c2), which
+// must fold to ¬c1 ∨ c2. Describing it as `c1 ∧ c2` is the actual bug: with the
+// reporter's expressions, a program that always logs described as one that
+// never does.
+func TestRegionCondition_ReportersGraph(t *testing.T) {
+	r := Region{
+		"split1": {Kind: KindSplit, Condition: "$a > 1", True: "split2", False: "merge1"},
+		"split2": {Kind: KindSplit, Condition: "$b > 2", True: "merge1", False: "merge2"},
+		"merge2": {Kind: KindMerge, Next: ""},
+	}
+	got, err := RegionCondition(r, "split1", "merge1")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if want := "$b > 2 or not($a > 1)"; got.String() != want {
+		t.Errorf("condition = %q, want %q", got.String(), want)
+	}
+}
+
+// The negative control for the case above: describing that graph as the
+// conjunction is the #923 defect, so the fold must NOT produce it.
+func TestRegionCondition_IsNotTheConjunction(t *testing.T) {
+	r := Region{
+		"split1": {Kind: KindSplit, Condition: "$a", True: "split2", False: "merge1"},
+		"split2": {Kind: KindSplit, Condition: "$b", True: "merge1", False: "merge2"},
+		"merge2": {Kind: KindMerge, Next: ""},
+	}
+	got, _ := RegionCondition(r, "split1", "merge1")
+	if got.String() == "$a and $b" {
+		t.Fatal("folded to the conjunction — this is exactly the #923 misdescription")
+	}
+}
+
+// A plain nested if: only the true branch reaches the target, so the guard is
+// just the condition. Nothing to fold, and folding must not invent structure.
+func TestRegionCondition_SingleSplit(t *testing.T) {
+	r := Region{
+		"s": {Kind: KindSplit, Condition: "$x = 1", True: "target", False: "other"},
+	}
+	got, err := RegionCondition(r, "s", "target")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if want := "$x = 1"; got.String() != want {
+		t.Errorf("condition = %q, want %q", got.String(), want)
+	}
+}
+
+// Both branches reach the target, so the guard is vacuously true. Emitting
+// `if true then` would be silly; the caller uses Lit(true) to skip the wrapper.
+func TestRegionCondition_BothBranchesReachTarget(t *testing.T) {
+	r := Region{
+		"s": {Kind: KindSplit, Condition: "$x", True: "target", False: "target"},
+	}
+	got, err := RegionCondition(r, "s", "target")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if got.String() != "true" {
+		t.Errorf("condition = %q, want true", got.String())
+	}
+}
+
+// THE PRECONDITION. An activity inside the region means folding would move a
+// side effect, so this must refuse rather than produce a guard. Without it,
+// Mode 3 would silently hoist a `create object` out of a branch.
+func TestRegionCondition_RefusesImpureRegion(t *testing.T) {
+	r := Region{
+		"s":      {Kind: KindSplit, Condition: "$x", True: "create", False: "target"},
+		"create": {Kind: KindOther, Next: "target"},
+	}
+	_, err := RegionCondition(r, "s", "target")
+	if !errors.Is(err, ErrImpureRegion) {
+		t.Fatalf("error = %v, want ErrImpureRegion — folding a region with an activity moves a side effect", err)
+	}
+}
+
+// A back edge is a loop, not a guard.
+func TestRegionCondition_RefusesCycle(t *testing.T) {
+	r := Region{
+		"s": {Kind: KindSplit, Condition: "$x", True: "m", False: "target"},
+		"m": {Kind: KindMerge, Next: "s"},
+	}
+	_, err := RegionCondition(r, "s", "target")
+	if !errors.Is(err, ErrCyclicRegion) {
+		t.Fatalf("error = %v, want ErrCyclicRegion", err)
+	}
+}
+
+// A path that leaves the region without reaching the target contributes
+// nothing — it must not be mistaken for a path that arrives.
+func TestRegionCondition_PathLeavingRegionIsFalse(t *testing.T) {
+	r := Region{
+		"s": {Kind: KindSplit, Condition: "$x", True: "elsewhere", False: "target"},
+	}
+	got, err := RegionCondition(r, "s", "target")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if want := "not($x)"; got.String() != want {
+		t.Errorf("condition = %q, want %q", got.String(), want)
+	}
+}
+
+// DESCRIBE must be a fixed point, so folding the same graph twice must give the
+// same text — no map iteration leaking into the output.
+func TestRegionCondition_IsDeterministic(t *testing.T) {
+	build := func() Region {
+		return Region{
+			"split1": {Kind: KindSplit, Condition: "$a", True: "split2", False: "merge1"},
+			"split2": {Kind: KindSplit, Condition: "$b", True: "merge1", False: "m2"},
+			"m2":     {Kind: KindMerge, Next: ""},
+		}
+	}
+	first, err := RegionCondition(build(), "split1", "merge1")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for i := 0; i < 50; i++ {
+		got, err := RegionCondition(build(), "split1", "merge1")
+		if err != nil {
+			t.Fatal(err)
+		}
+		if got.String() != first.String() {
+			t.Fatalf("run %d gave %q, first gave %q", i, got.String(), first.String())
+		}
+	}
+}
+
+// Three levels deep, to show the fold is not special-cased to the two-split
+// shape it was derived from.
+func TestRegionCondition_ThreeSplits(t *testing.T) {
+	r := Region{
+		"s1": {Kind: KindSplit, Condition: "$a", True: "s2", False: "target"},
+		"s2": {Kind: KindSplit, Condition: "$b", True: "s3", False: "target"},
+		"s3": {Kind: KindSplit, Condition: "$c", True: "target", False: "out"},
+	}
+	got, err := RegionCondition(r, "s1", "target")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	// reach = ¬a ∨ (a ∧ ¬b) ∨ (a ∧ b ∧ c) ≡ ¬a ∨ ¬b ∨ c
+	if want := "$c or not($a) or not($b)"; got.String() != want {
+		t.Errorf("condition = %q, want %q", got.String(), want)
+	}
+}
+
+var _ = model.ID("")
diff --git a/mdl/microflownorm/simplify.go b/mdl/microflownorm/simplify.go
new file mode 100644
index 0000000000..a24f47f750
--- /dev/null
+++ b/mdl/microflownorm/simplify.go
@@ -0,0 +1,266 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package microflownorm
+
+import "sort"
+
+// Simplify reduces a folded guard to something a person would have written.
+//
+// It is deliberately a small set of sound rewrites rather than a general
+// boolean minimiser. Every rule below preserves meaning in both directions, so
+// the worst outcome of a rule not firing is a verbose condition — never a wrong
+// one. That asymmetry is the whole design: a describer that renders an ugly but
+// correct guard is a cosmetic problem, one that renders a pretty wrong guard is
+// #923 again.
+//
+// The rule that earns its place is absorption-with-negation,
+// `¬a ∨ (a ∧ b) ≡ ¬a ∨ b`. It is what takes the reporter's graph from
+// `¬c1 ∨ (c1 ∧ c2)` — which is what walking the graph produces — to the
+// `¬c1 ∨ c2` the proposal promises.
+//
+// Simplify is idempotent: simplifying twice gives the same formula, which is
+// what lets DESCRIBE be a fixed point.
+func Simplify(f Formula) Formula {
+	for i := 0; i < 10; i++ { // converges in one or two passes; the bound is a guard against a rule cycling
+		next := simplifyOnce(f)
+		if key(next) == key(f) {
+			return next
+		}
+		f = next
+	}
+	return f
+}
+
+func simplifyOnce(f Formula) Formula {
+	switch v := f.(type) {
+	case Not:
+		return negate(simplifyOnce(v.X))
+	case And:
+		return simplifyAnd(v)
+	case Or:
+		return simplifyOr(v)
+	}
+	return f
+}
+
+// flatten pulls the children of a same-kind node up into the parent, so
+// `a ∨ (b ∨ c)` is one three-term disjunction and the pairwise rules below see
+// every pair.
+func flatten(xs []Formula, isOr bool) []Formula {
+	var out []Formula
+	for _, x := range xs {
+		x = simplifyOnce(x)
+		if isOr {
+			if o, ok := x.(Or); ok {
+				out = append(out, o.Xs...)
+				continue
+			}
+		} else {
+			if a, ok := x.(And); ok {
+				out = append(out, a.Xs...)
+				continue
+			}
+		}
+		out = append(out, x)
+	}
+	return out
+}
+
+// dedupe removes repeated terms (`a ∨ a ≡ a`) and keeps a stable order so the
+// rendered condition does not depend on map iteration.
+func dedupe(xs []Formula) []Formula {
+	seen := map[string]bool{}
+	var out []Formula
+	for _, x := range xs {
+		k := key(x)
+		if seen[k] {
+			continue
+		}
+		seen[k] = true
+		out = append(out, x)
+	}
+	sort.SliceStable(out, func(i, j int) bool { return key(out[i]) < key(out[j]) })
+	return out
+}
+
+func simplifyOr(o Or) Formula {
+	xs := dedupe(flatten(o.Xs, true))
+
+	// Constants: `x ∨ true ≡ true`, and false terms drop out.
+	var kept []Formula
+	for _, x := range xs {
+		if l, ok := x.(Lit); ok {
+			if bool(l) {
+				return Lit(true)
+			}
+			continue
+		}
+		kept = append(kept, x)
+	}
+	xs = kept
+
+	// Complementary pair: `a ∨ ¬a ≡ true`.
+	present := map[string]bool{}
+	for _, x := range xs {
+		present[key(x)] = true
+	}
+	for _, x := range xs {
+		if present[key(negate(x))] {
+			return Lit(true)
+		}
+	}
+
+	xs = absorb(xs, true)
+
+	switch len(xs) {
+	case 0:
+		return Lit(false)
+	case 1:
+		return xs[0]
+	}
+	return Or{Xs: xs}
+}
+
+func simplifyAnd(a And) Formula {
+	xs := dedupe(flatten(a.Xs, false))
+
+	var kept []Formula
+	for _, x := range xs {
+		if l, ok := x.(Lit); ok {
+			if !bool(l) {
+				return Lit(false)
+			}
+			continue
+		}
+		kept = append(kept, x)
+	}
+	xs = kept
+
+	present := map[string]bool{}
+	for _, x := range xs {
+		present[key(x)] = true
+	}
+	for _, x := range xs {
+		if present[key(negate(x))] {
+			return Lit(false)
+		}
+	}
+
+	xs = absorb(xs, false)
+
+	switch len(xs) {
+	case 0:
+		return Lit(true)
+	case 1:
+		return xs[0]
+	}
+	return And{Xs: xs}
+}
+
+// absorb applies the two absorption laws to every pair of terms.
+//
+// For a disjunction (isOr), with `t` a term and `c` a conjunction:
+//
+//	t ∨ (t ∧ …)   ≡ t          -- plain absorption, drop the conjunction
+//	¬t ∨ (t ∧ b)  ≡ ¬t ∨ b     -- absorption with negation, drop t from inside
+//
+// and dually for a conjunction. The second is the one that matters: it is what
+// removes the guard a path has already decided, which is precisely the
+// redundancy that walking a recombinable graph introduces.
+func absorb(xs []Formula, isOr bool) []Formula {
+	changed := true
+	for changed {
+		changed = false
+		for i := 0; i < len(xs) && !changed; i++ {
+			for j := 0; j < len(xs); j++ {
+				if i == j {
+					continue
+				}
+				// Inside a disjunction the absorbable terms are conjunctions,
+				// and dually. Passing !isOr here looks at the wrong node type
+				// and quietly disables every absorption.
+				inner, ok := childTerms(xs[j], isOr)
+				if !ok {
+					continue
+				}
+				ti, tneg := key(xs[i]), key(negate(xs[i]))
+
+				// t ∨ (t ∧ …) ≡ t
+				for _, c := range inner {
+					if key(c) == ti {
+						xs = append(xs[:j], xs[j+1:]...)
+						changed = true
+						break
+					}
+				}
+				if changed {
+					break
+				}
+
+				// ¬t ∨ (t ∧ b) ≡ ¬t ∨ b
+				var rest []Formula
+				dropped := false
+				for _, c := range inner {
+					if key(c) == tneg {
+						dropped = true
+						continue
+					}
+					rest = append(rest, c)
+				}
+				if !dropped {
+					continue
+				}
+				var replacement Formula
+				switch len(rest) {
+				case 0:
+					// The whole conjunction was the complement, so the term
+					// contributes nothing beyond what xs[i] already covers.
+					replacement = Lit(!isOr)
+				case 1:
+					replacement = rest[0]
+				default:
+					if isOr {
+						replacement = And{Xs: rest}
+					} else {
+						replacement = Or{Xs: rest}
+					}
+				}
+				xs[j] = replacement
+				changed = true
+				break
+			}
+		}
+		if changed {
+			// Re-normalise: the replacement may itself be absorbable.
+			xs = dedupe(flatten(xs, isOr))
+			var kept []Formula
+			for _, x := range xs {
+				if l, ok := x.(Lit); ok {
+					if isOr && !bool(l) {
+						continue
+					}
+					if !isOr && bool(l) {
+						continue
+					}
+				}
+				kept = append(kept, x)
+			}
+			xs = kept
+		}
+	}
+	return xs
+}
+
+// childTerms returns the operands of a conjunction (wantAnd) or disjunction.
+func childTerms(f Formula, wantAnd bool) ([]Formula, bool) {
+	if wantAnd {
+		if a, ok := f.(And); ok {
+			return a.Xs, true
+		}
+		return nil, false
+	}
+	if o, ok := f.(Or); ok {
+		return o.Xs, true
+	}
+	return nil, false
+}
diff --git a/mdl/microflownorm/simplify_test.go b/mdl/microflownorm/simplify_test.go
new file mode 100644
index 0000000000..95afdfc55b
--- /dev/null
+++ b/mdl/microflownorm/simplify_test.go
@@ -0,0 +1,183 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package microflownorm
+
+import (
+	"fmt"
+	"math/rand"
+	"sort"
+	"testing"
+)
+
+// eval interprets a formula under an assignment of its atoms. Test-only: the
+// package never evaluates a Mendix expression, it only rearranges guards.
+func eval(f Formula, env map[string]bool) bool {
+	switch v := f.(type) {
+	case Lit:
+		return bool(v)
+	case Atom:
+		return env[string(v)]
+	case Not:
+		return !eval(v.X, env)
+	case And:
+		for _, x := range v.Xs {
+			if !eval(x, env) {
+				return false
+			}
+		}
+		return true
+	case Or:
+		for _, x := range v.Xs {
+			if eval(x, env) {
+				return true
+			}
+		}
+		return false
+	}
+	panic("unknown formula")
+}
+
+func atomsOf(f Formula, into map[string]bool) {
+	switch v := f.(type) {
+	case Atom:
+		into[string(v)] = true
+	case Not:
+		atomsOf(v.X, into)
+	case And:
+		for _, x := range v.Xs {
+			atomsOf(x, into)
+		}
+	case Or:
+		for _, x := range v.Xs {
+			atomsOf(x, into)
+		}
+	}
+}
+
+// assertEquivalent enumerates every assignment of the atoms and fails on the
+// first one where the two formulas disagree.
+func assertEquivalent(t *testing.T, a, b Formula) {
+	t.Helper()
+	set := map[string]bool{}
+	atomsOf(a, set)
+	atomsOf(b, set)
+	names := make([]string, 0, len(set))
+	for n := range set {
+		names = append(names, n)
+	}
+	sort.Strings(names)
+	if len(names) > 16 {
+		t.Fatalf("too many atoms to enumerate: %d", len(names))
+	}
+	for mask := 0; mask < 1<<len(names); mask++ {
+		env := map[string]bool{}
+		for i, n := range names {
+			env[n] = mask&(1<<i) != 0
+		}
+		if eval(a, env) != eval(b, env) {
+			t.Fatalf("simplification changed meaning at %v:\n  before %s\n  after  %s", env, a.String(), b.String())
+		}
+	}
+}
+
+// THE control for the whole simplifier. A rewrite rule that is merely
+// plausible produces a pretty, wrong guard — which is #923 again, from the
+// other direction. Rather than trusting each rule's algebra, generate formulas
+// and check the truth tables agree.
+func TestSimplify_PreservesMeaningOnRandomFormulas(t *testing.T) {
+	rng := rand.New(rand.NewSource(20260913))
+	atoms := []Formula{Atom("a"), Atom("b"), Atom("c"), Atom("d")}
+
+	var gen func(depth int) Formula
+	gen = func(depth int) Formula {
+		if depth == 0 || rng.Intn(4) == 0 {
+			if rng.Intn(12) == 0 {
+				return Lit(rng.Intn(2) == 0)
+			}
+			return atoms[rng.Intn(len(atoms))]
+		}
+		switch rng.Intn(3) {
+		case 0:
+			return Not{X: gen(depth - 1)}
+		case 1:
+			n := 2 + rng.Intn(2)
+			xs := make([]Formula, n)
+			for i := range xs {
+				xs[i] = gen(depth - 1)
+			}
+			return And{Xs: xs}
+		default:
+			n := 2 + rng.Intn(2)
+			xs := make([]Formula, n)
+			for i := range xs {
+				xs[i] = gen(depth - 1)
+			}
+			return Or{Xs: xs}
+		}
+	}
+
+	for i := 0; i < 3000; i++ {
+		f := gen(4)
+		assertEquivalent(t, f, Simplify(f))
+	}
+}
+
+// DESCRIBE has to be a fixed point, so simplifying an already-simplified guard
+// must change nothing. Without this, re-describing an unchanged microflow could
+// produce a diff.
+func TestSimplify_IsIdempotent(t *testing.T) {
+	rng := rand.New(rand.NewSource(7))
+	atoms := []Formula{Atom("a"), Atom("b"), Atom("c")}
+	var gen func(depth int) Formula
+	gen = func(depth int) Formula {
+		if depth == 0 || rng.Intn(3) == 0 {
+			return atoms[rng.Intn(len(atoms))]
+		}
+		switch rng.Intn(3) {
+		case 0:
+			return Not{X: gen(depth - 1)}
+		case 1:
+			return And{Xs: []Formula{gen(depth - 1), gen(depth - 1)}}
+		default:
+			return Or{Xs: []Formula{gen(depth - 1), gen(depth - 1)}}
+		}
+	}
+	for i := 0; i < 1000; i++ {
+		once := Simplify(gen(4))
+		twice := Simplify(once)
+		if once.String() != twice.String() {
+			t.Fatalf("not idempotent:\n  once  %s\n  twice %s", once.String(), twice.String())
+		}
+	}
+}
+
+// The absorption laws stated directly, so a failure names the rule rather than
+// a random formula.
+func TestSimplify_AbsorptionLaws(t *testing.T) {
+	a, b := Atom("a"), Atom("b")
+	cases := []struct {
+		name string
+		in   Formula
+		want string
+	}{
+		{"a or (a and b) = a", Or{Xs: []Formula{a, And{Xs: []Formula{a, b}}}}, "a"},
+		{"not(a) or (a and b) = not(a) or b", Or{Xs: []Formula{Not{X: a}, And{Xs: []Formula{a, b}}}}, "b or not(a)"},
+		{"a and (a or b) = a", And{Xs: []Formula{a, Or{Xs: []Formula{a, b}}}}, "a"},
+		{"a or not(a) = true", Or{Xs: []Formula{a, Not{X: a}}}, "true"},
+		{"a and not(a) = false", And{Xs: []Formula{a, Not{X: a}}}, "false"},
+		{"a or false = a", Or{Xs: []Formula{a, Lit(false)}}, "a"},
+		{"a and true = a", And{Xs: []Formula{a, Lit(true)}}, "a"},
+		{"not(not(a)) = a", Not{X: Not{X: a}}, "a"},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			got := Simplify(c.in)
+			if got.String() != c.want {
+				t.Errorf("got %q, want %q", got.String(), c.want)
+			}
+			assertEquivalent(t, c.in, got)
+		})
+	}
+}
+
+var _ = fmt.Sprintf
diff --git a/mdl/visitor/visitor_page_v3.go b/mdl/visitor/visitor_page_v3.go
index b5f16e5fa5..cb22afcaca 100644
--- a/mdl/visitor/visitor_page_v3.go
+++ b/mdl/visitor/visitor_page_v3.go
@@ -13,6 +13,7 @@ import (
 
 	"github.com/mendixlabs/mxcli/mdl/ast"
 	"github.com/mendixlabs/mxcli/mdl/grammar/parser"
+	"github.com/mendixlabs/mxcli/mdl/types"
 )
 
 // parseQualifiedName converts a string like "Module.Name" to ast.QualifiedName.
@@ -722,6 +723,14 @@ func parseWidgetPropertyV3(ctx parser.IWidgetPropertyV3Context, widget *ast.Widg
 		return
 	}
 
+	// Icon: 'Mod.Coll.name' | image Mod.Images.logo | glyph 57377
+	if propCtx.ICON() != nil {
+		if icon := buildWidgetIconV3(propCtx.WidgetIconV3()); icon != nil {
+			widget.Properties["Icon"] = icon
+		}
+		return
+	}
+
 	// ButtonStyle: ...
 	if propCtx.BUTTONSTYLE() != nil {
 		if styleCtx := propCtx.ButtonStyleV3(); styleCtx != nil {
@@ -1884,3 +1893,56 @@ func buildObjectEntryListV3(ctx parser.IObjectEntryListV3Context) *ast.ObjectEnt
 	}
 	return out
 }
+
+// buildWidgetIconV3 reads a widget's `Icon:` value onto a typed WidgetIcon.
+//
+// Mendix stores three different icon ELEMENTS, not three spellings of one value,
+// so the KIND is recorded and the writer emits the matching $Type. Collapsing
+// them onto one string is what made describe -> exec rewrite an image icon as a
+// custom-icon reference (CE1613) and delete a glyph icon outright
+// (mendixlabs/mxcli#1059).
+//
+// The bare form is the collection icon, which keeps every existing script
+// meaning exactly what it did. Both spellings of a name are accepted — quoted,
+// as `Icon:` has taken since #602, and bare, as every other reference into the
+// model is written.
+func buildWidgetIconV3(ctx parser.IWidgetIconV3Context) *ast.WidgetIcon {
+	if ctx == nil {
+		return nil
+	}
+	c, ok := ctx.(*parser.WidgetIconV3Context)
+	if !ok {
+		return nil
+	}
+	icon := &ast.WidgetIcon{}
+	switch {
+	case c.GLYPH() != nil:
+		icon.Kind = types.MenuIconGlyph
+		if n := c.NUMBER_LITERAL(); n != nil {
+			// A glyph code is a character code: whole, and small. A fractional or
+			// unparseable literal leaves the code at zero rather than guessing,
+			// and the builder refuses to write a glyph without one.
+			if v, err := strconv.Atoi(n.GetText()); err == nil {
+				icon.Code = v
+			}
+		}
+	case c.IMAGE() != nil:
+		icon.Kind = types.MenuIconImage
+		icon.Name = widgetIconName(c)
+	default:
+		icon.Kind = types.MenuIconCollection
+		icon.Name = widgetIconName(c)
+	}
+	return icon
+}
+
+// widgetIconName reads the qualified name out of whichever spelling was used.
+func widgetIconName(c *parser.WidgetIconV3Context) string {
+	if qn := c.QualifiedName(); qn != nil {
+		return buildQualifiedName(qn).String()
+	}
+	if str := c.STRING_LITERAL(); str != nil {
+		return unquoteString(str.GetText())
+	}
+	return ""
+}
diff --git a/mdl/visitor/visitor_query.go b/mdl/visitor/visitor_query.go
index 904bb15207..fdc86fdd5c 100644
--- a/mdl/visitor/visitor_query.go
+++ b/mdl/visitor/visitor_query.go
@@ -1167,6 +1167,7 @@ func (b *Builder) ExitDescribeStatement(ctx *parser.DescribeStatementContext) {
 		b.statements = append(b.statements, &ast.DescribeStmt{
 			ObjectType: ast.DescribeMicroflow,
 			Name:       name,
+			Normalized: ctx.NORMALIZED() != nil,
 		})
 	} else if ctx.NANOFLOW() != nil {
 		b.statements = append(b.statements, &ast.DescribeStmt{
diff --git a/mdl/visitor/visitor_widget_icon_test.go b/mdl/visitor/visitor_widget_icon_test.go
new file mode 100644
index 0000000000..146eb37107
--- /dev/null
+++ b/mdl/visitor/visitor_widget_icon_test.go
@@ -0,0 +1,115 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package visitor
+
+import (
+	"testing"
+
+	"github.com/mendixlabs/mxcli/mdl/ast"
+	"github.com/mendixlabs/mxcli/mdl/types"
+)
+
+// A widget's `Icon:` has to say WHICH of Mendix's three icon elements it means
+// (mendixlabs/mxcli#1059). The two named kinds are spelled identically — both
+// are a Module.Collection.Name — so the keyword is the only thing that
+// distinguishes an icon-collection reference from an image-collection one, and
+// getting it wrong is a document that builds as CE1613.
+//
+// The invariant these assert is the parse, not the wording: `image` and `glyph`
+// must reach the AST as KINDS, and the bare form must still mean what it has
+// meant since #602.
+func TestWidgetIconV3_ParsesEveryVariant(t *testing.T) {
+	cases := []struct {
+		name string
+		mdl  string
+		want ast.WidgetIcon
+	}{{
+		// The form every existing script and every DESCRIBE output uses.
+		name: "quoted bare is the collection icon",
+		mdl:  `Icon: 'Atlas_Core.Atlas_Filled.pencil'`,
+		want: ast.WidgetIcon{Kind: types.MenuIconCollection, Name: "Atlas_Core.Atlas_Filled.pencil"},
+	}, {
+		// A reference into the model is spelled as a qualified name everywhere
+		// else (ADR-0003), so the unquoted form is accepted too.
+		name: "unquoted bare is the collection icon",
+		mdl:  `Icon: Atlas_Core.Atlas_Filled.pencil`,
+		want: ast.WidgetIcon{Kind: types.MenuIconCollection, Name: "Atlas_Core.Atlas_Filled.pencil"},
+	}, {
+		name: "image names an image collection",
+		mdl:  `Icon: image MyModule.Images.logo`,
+		want: ast.WidgetIcon{Kind: types.MenuIconImage, Name: "MyModule.Images.logo"},
+	}, {
+		name: "image accepts the quoted spelling too",
+		mdl:  `Icon: image 'MyModule.Images.logo'`,
+		want: ast.WidgetIcon{Kind: types.MenuIconImage, Name: "MyModule.Images.logo"},
+	}, {
+		// A glyph has a code and NO name — the whole reason one string could
+		// never carry all three.
+		name: "glyph carries a code",
+		mdl:  `Icon: glyph 57377`,
+		want: ast.WidgetIcon{Kind: types.MenuIconGlyph, Code: 57377},
+	}, {
+		// Atlas icon names are hyphenated and IDENTIFIER cannot lex a hyphen, so
+		// that segment is double-quoted — per segment, as qualifiedName allows.
+		// The quotes are SPELLING and do not survive into the AST: what reaches
+		// BSON is the plain name, and re-quoting on the way out is the emitter's
+		// job (quoteQualifiedName). A Name still carrying quotes here would be
+		// written into the document verbatim and resolve to nothing.
+		name: "a hyphenated segment is quoted on its own",
+		mdl:  `Icon: Atlas_Core.Atlas."align-center"`,
+		want: ast.WidgetIcon{Kind: types.MenuIconCollection, Name: "Atlas_Core.Atlas.align-center"},
+	}}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := parseButtonIcon(t, tc.mdl)
+			if got == nil {
+				t.Fatal("Icon: produced no WidgetIcon")
+			}
+			if *got != tc.want {
+				t.Errorf("got %+v, want %+v", *got, tc.want)
+			}
+		})
+	}
+}
+
+// TestWidgetIconV3_ImageIsAKeywordNotANameSegment pins the ANTLR ordering trap
+// that navMenuIcon documents: qualifiedName accepts a keyword as a name segment,
+// so `image Mod.Images.logo` ALSO matches the bare alternative with `image` read
+// as the first segment. Listing the keyword-led alternatives first is what
+// settles it — and if that ordering is ever lost, this is the test that says so
+// rather than a mis-typed icon reaching a project.
+func TestWidgetIconV3_ImageIsAKeywordNotANameSegment(t *testing.T) {
+	got := parseButtonIcon(t, `Icon: image MyModule.Images.logo`)
+	if got == nil {
+		t.Fatal("Icon: produced no WidgetIcon")
+	}
+	if got.Kind != types.MenuIconImage {
+		t.Fatalf("kind = %q, want image — `image` was read as a name segment", got.Kind)
+	}
+	if got.Name == "image.MyModule.Images.logo" {
+		t.Errorf("the keyword was swallowed into the name: %q", got.Name)
+	}
+}
+
+// parseButtonIcon runs the real parser over a button carrying one Icon property.
+func parseButtonIcon(t *testing.T, iconProp string) *ast.WidgetIcon {
+	t.Helper()
+	src := "create page Mod.P (Title: 'T') {\n  actionbutton btn (Caption: 'X', " + iconProp + ")\n}"
+	prog, errs := Build(src)
+	if len(errs) > 0 {
+		t.Fatalf("parse %q: %v", iconProp, errs)
+	}
+	if len(prog.Statements) != 1 {
+		t.Fatalf("got %d statements, want 1", len(prog.Statements))
+	}
+	page, ok := prog.Statements[0].(*ast.CreatePageStmtV3)
+	if !ok {
+		t.Fatalf("got %T, want *ast.CreatePageStmtV3", prog.Statements[0])
+	}
+	if len(page.Widgets) != 1 {
+		t.Fatalf("got %d widgets, want 1", len(page.Widgets))
+	}
+	icon, _ := page.Widgets[0].Properties["Icon"].(*ast.WidgetIcon)
+	return icon
+}
diff --git a/sdk/mpr/writer_widgets_display.go b/sdk/mpr/writer_widgets_display.go
index 85b638e550..0e4106374d 100644
--- a/sdk/mpr/writer_widgets_display.go
+++ b/sdk/mpr/writer_widgets_display.go
@@ -5,6 +5,7 @@ package mpr
 import (
 	"strings"
 
+	"github.com/mendixlabs/mxcli/mdl/types"
 	"github.com/mendixlabs/mxcli/model"
 	"github.com/mendixlabs/mxcli/sdk/pages"
 
@@ -359,7 +360,7 @@ func serializeActionButton(ab *pages.ActionButton) bson.D {
 		{Key: "ButtonStyle", Value: buttonStyle},
 		{Key: "CaptionTemplate", Value: caption}, // Must be CaptionTemplate, not Caption
 		{Key: "ConditionalVisibilitySettings", Value: nil},
-		{Key: "Icon", Value: nil},
+		{Key: "Icon", Value: buildWidgetIconBson(ab.Icon)},
 		{Key: "Name", Value: ab.Name},
 		{Key: "NativeAccessibilitySettings", Value: nil},
 		{Key: "RenderType", Value: renderType},
@@ -373,6 +374,45 @@ func serializeActionButton(ab *pages.ActionButton) bson.D {
 	return doc
 }
 
+// buildWidgetIconBson serializes a widget's icon element, or nil when there is
+// none.
+//
+// This key was hardcoded to nil, so under `--engine legacy` a button's icon was
+// dropped on every write — silently, since a null Icon is what an iconless
+// button stores and nothing downstream could tell the two apart. The icon-
+// collection form has been authorable since #602 and was only ever written by
+// the modelsdk engine.
+//
+// It dispatches on the kind for the same reason buildMenuIconBson does: an
+// icon-collection icon and an image icon are both a qualified name, into
+// different documents, so nothing in the payload distinguishes them and a writer
+// that guesses turns one into the other (mendixlabs/mxcli#1059).
+func buildWidgetIconBson(icon *pages.Icon) interface{} {
+	if icon == nil {
+		return nil
+	}
+	storage := types.MenuIconStorageType(icon.Kind)
+	if storage == "" {
+		return nil
+	}
+	doc := bson.D{
+		{Key: "$ID", Value: idToBsonBinary(generateUUID())},
+		{Key: "$Type", Value: storage},
+	}
+	if icon.Kind == types.MenuIconGlyph {
+		// A glyph with no code identifies no glyph. Emit no icon rather than an
+		// element nobody can see.
+		if icon.Code == 0 {
+			return nil
+		}
+		return append(doc, bson.E{Key: "Code", Value: int32(icon.Code)})
+	}
+	if icon.Image == "" {
+		return nil
+	}
+	return append(doc, bson.E{Key: "Image", Value: icon.Image})
+}
+
 // serializeStaticText serializes a static Text widget.
 func serializeStaticText(t *pages.Text) bson.D {
 	textValue := "Text"
diff --git a/sdk/mpr/writer_widgets_icon_test.go b/sdk/mpr/writer_widgets_icon_test.go
new file mode 100644
index 0000000000..42516b2f0e
--- /dev/null
+++ b/sdk/mpr/writer_widgets_icon_test.go
@@ -0,0 +1,127 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package mpr
+
+import (
+	"testing"
+
+	"go.mongodb.org/mongo-driver/bson"
+
+	"github.com/mendixlabs/mxcli/mdl/types"
+	"github.com/mendixlabs/mxcli/sdk/pages"
+)
+
+// The legacy engine wrote `Icon: nil` on every action button, unconditionally.
+// A button's icon has been authorable since #602 and only the modelsdk engine
+// ever wrote one, so under `--engine legacy` the icon was dropped on every
+// write — silently, because a null Icon is exactly what an iconless button
+// stores and nothing downstream could tell the two apart (mendixlabs/mxcli#1059).
+//
+// These assert on the encoded document, which is the layer the defect lived in:
+// the model carried the icon correctly the whole time.
+
+// iconOf serializes a button and returns its Icon element as a plain map, or
+// nil when the icon was written as null.
+func iconOf(t *testing.T, icon *pages.Icon) map[string]any {
+	t.Helper()
+	doc := serializeActionButton(&pages.ActionButton{
+		BaseWidget: pages.BaseWidget{Name: "btnEdit"},
+		Icon:       icon,
+	})
+	for _, e := range doc {
+		if e.Key != "Icon" {
+			continue
+		}
+		if e.Value == nil {
+			return nil
+		}
+		nested, ok := e.Value.(bson.D)
+		if !ok {
+			t.Fatalf("Icon is a %T, want bson.D", e.Value)
+		}
+		out := make(map[string]any, len(nested))
+		for _, f := range nested {
+			out[f.Key] = f.Value
+		}
+		return out
+	}
+	t.Fatal("serialized button has no Icon key at all")
+	return nil
+}
+
+func TestSerializeActionButton_WritesEachIconElement(t *testing.T) {
+	cases := []struct {
+		name      string
+		icon      *pages.Icon
+		wantType  string
+		wantImage string
+		wantCode  int32
+	}{{
+		name:      "collection",
+		icon:      &pages.Icon{Kind: types.MenuIconCollection, Image: "Atlas_Core.Atlas_Filled.pencil"},
+		wantType:  "Forms$IconCollectionIcon",
+		wantImage: "Atlas_Core.Atlas_Filled.pencil",
+	}, {
+		name:      "image",
+		icon:      &pages.Icon{Kind: types.MenuIconImage, Image: "DesignSystem.Icons_SVG.edit"},
+		wantType:  "Forms$ImageIcon",
+		wantImage: "DesignSystem.Icons_SVG.edit",
+	}, {
+		name:     "glyph",
+		icon:     &pages.Icon{Kind: types.MenuIconGlyph, Code: 57377},
+		wantType: "Forms$GlyphIcon",
+		wantCode: 57377,
+	}}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := iconOf(t, tc.icon)
+			if got == nil {
+				t.Fatal("the icon was written as null — the legacy drop")
+			}
+			if got["$Type"] != tc.wantType {
+				t.Errorf("$Type = %v, want %q", got["$Type"], tc.wantType)
+			}
+			if tc.wantImage != "" && got["Image"] != tc.wantImage {
+				t.Errorf("Image = %v, want %q", got["Image"], tc.wantImage)
+			}
+			if tc.wantCode != 0 && got["Code"] != tc.wantCode {
+				t.Errorf("Code = %v (%T), want %d as int32", got["Code"], got["Code"], tc.wantCode)
+			}
+			// A glyph has no name and a named icon has no code. Writing the
+			// other variant's payload alongside is how a reader would then have
+			// to guess which one the element really is.
+			if tc.wantCode == 0 && got["Code"] != nil {
+				t.Errorf("a named icon carries Code = %v", got["Code"])
+			}
+			if tc.wantImage == "" && got["Image"] != nil {
+				t.Errorf("a glyph icon carries Image = %v", got["Image"])
+			}
+		})
+	}
+}
+
+// CONTROL: an iconless button must still write a null Icon — that is what
+// Studio Pro stores, and it is the TypeDefault the rest of the document expects.
+func TestSerializeActionButton_NoIconStaysNull(t *testing.T) {
+	if got := iconOf(t, nil); got != nil {
+		t.Errorf("an iconless button wrote an icon element: %v", got)
+	}
+}
+
+// CONTROL: an icon that identifies nothing is written as no icon rather than as
+// an element nobody can see. The executor refuses these before they get here, so
+// this pins the writer's own behaviour for the paths that build a pages.Icon
+// directly.
+func TestSerializeActionButton_AnIconIdentifyingNothingIsNotWritten(t *testing.T) {
+	for _, icon := range []*pages.Icon{
+		{Kind: types.MenuIconGlyph},                    // no code
+		{Kind: types.MenuIconImage},                    // no name
+		{Kind: types.MenuIconCollection},               // no name
+		{Kind: types.MenuIconKind("Forms$SomeFuture")}, // a kind this build does not know
+	} {
+		if got := iconOf(t, icon); got != nil {
+			t.Errorf("%+v was written as %v, want no icon", icon, got)
+		}
+	}
+}
diff --git a/sdk/pages/pages_widgets_action.go b/sdk/pages/pages_widgets_action.go
index 10c08eed17..a1c9c88c1c 100644
--- a/sdk/pages/pages_widgets_action.go
+++ b/sdk/pages/pages_widgets_action.go
@@ -5,6 +5,7 @@ package pages
 import (
 	"strings"
 
+	"github.com/mendixlabs/mxcli/mdl/types"
 	"github.com/mendixlabs/mxcli/model"
 )
 
@@ -75,27 +76,33 @@ const (
 )
 
 // Icon represents a widget icon (e.g. on an action/link button).
+//
+// Mendix has three icon ELEMENTS and they are not variants of one value: an
+// icon-collection icon and an image icon each hold a qualified name — into an
+// icon collection and an image collection, which are different documents —
+// while a glyph icon holds a numeric character code and no name at all. Kind
+// says which, and the writers dispatch on it rather than inferring from the
+// payload: the two named kinds are indistinguishable by their payload, so a
+// writer that guesses produces a document mxbuild accepts and Studio Pro
+// cannot open (mendixlabs/mxcli#1059).
+//
+// The vocabulary is types.MenuIconKind — Mendix's kinds, not navigation's —
+// shared rather than restated. This type carried its own three-value enum until
+// the page and navigation paths were found to disagree about the same three
+// things, which is exactly the drift a second copy invites.
 type Icon struct {
 	model.BaseElement
-	Type IconType `json:"type"`
-	// Image is the qualified name of the referenced icon/image for
-	// IconCollection and Image icons, e.g. "Atlas_Core.Atlas_Filled.pencil".
-	Image   string   `json:"image,omitempty"`
+	Kind types.MenuIconKind `json:"kind"`
+	// Image is the qualified name of the referenced icon/image for the
+	// collection and image kinds, e.g. "Atlas_Core.Atlas_Filled.pencil".
+	Image string `json:"image,omitempty"`
+	// Code is the glyph's numeric character code, set only for MenuIconGlyph.
+	// It is the ONLY thing identifying a glyph icon.
+	Code    int      `json:"code,omitempty"`
 	Name    string   `json:"name,omitempty"`    // glyph name (legacy Glyph icons)
 	ImageID model.ID `json:"imageId,omitempty"` // legacy image id
 }
 
-// IconType represents the type of icon.
-type IconType string
-
-const (
-	IconTypeGlyph IconType = "Glyph"
-	IconTypeImage IconType = "Image"
-	// IconTypeIconCollection is the modern Atlas icon: a by-name reference into
-	// an icon collection (serialized as Forms$IconCollectionIcon).
-	IconTypeIconCollection IconType = "IconCollection"
-)
-
 // DropDownButton represents a dropdown button.
 type DropDownButton struct {
 	BaseWidget