diff --git a/cts/schemas/test-3/ref/role-after-failure.ref-4 b/cts/schemas/test-3/ref/role-after-failure.ref-4
index b79b10f6f9..20d2bd7c57 100644
--- a/cts/schemas/test-3/ref/role-after-failure.ref-4
+++ b/cts/schemas/test-3/ref/role-after-failure.ref-4
@@ -1,120 +1,113 @@
 <cib crm_feature_set="3.19.7" validate-with="pacemaker-4.0" epoch="8" num_updates="0" admin_epoch="0" original="1">
   <configuration original="1">
     <!-- The essential elements of this test are:
          * There are the following resources:
            * A template
            * A primitive outside of any collective resource
            * A group containing a single member
            * A cloned primitive
            * A cloned group containing a single member
            * A bundle containing a primitive
          * There is an op_defaults element.
          * Each primitive has an op element.
          * Each op and the op_defaults element have a meta_attributes element
            containing an nvpair with name="role_after_failure" and another with
            name="other".
          * There are other nvsets containing nvpairs with
            name="role_after_failure".
 
          In this situation, all role_after_failure meta-attributes within op and
          op_defaults elements should be dropped. Other meta-attributes should be
          unchanged.
       -->
     <crm_config original="1">
       <cluster_property_set id="cib-bootstrap-options" original="1">
         <nvpair id="cib-bootstrap-options-role_after_failure" name="role_after_failure" value="true" original="1"/>
       </cluster_property_set>
     </crm_config>
     <nodes original="1"/>
     <resources original="1">
       <template class="ocf" id="template1" provider="pacemaker" type="Dummy" original="1">
         <operations original="1">
           <op id="template1_monitor_20000" interval="20s" name="monitor" original="1">
             <meta_attributes id="template1_monitor_20000-meta_attributes" original="1">
-              <nvpair id="template_monitor_20000-meta_attributes-role_after_failure" name="role_after_failure" value="true" original="1"/>
               <nvpair id="template_monitor_20000-meta_attributes-other" name="other" value="true" original="1"/>
             </meta_attributes>
           </op>
         </operations>
       </template>
       <primitive class="ocf" id="rsc1" provider="pacemaker" type="Dummy" original="1">
         <operations original="1">
           <op id="rsc1_monitor_20000" interval="20s" name="monitor" original="1">
             <meta_attributes id="rsc1_monitor_20000-meta_attributes" original="1">
-              <nvpair id="rsc1_monitor_20000-meta_attributes-role_after_failure" name="role_after_failure" value="false" original="1"/>
               <nvpair id="rsc1_monitor_20000-meta_attributes-other" name="other" value="false" original="1"/>
             </meta_attributes>
           </op>
         </operations>
         <instance_attributes id="rsc1-instance_attributes" original="1">
           <nvpair id="rsc1-instance_attributes-role_after_failure" name="role_after_failure" value="true" original="1"/>
         </instance_attributes>
         <meta_attributes id="rsc1-meta_attributes" original="1">
           <nvpair id="rsc1-meta_attributes-role_after_failure" name="role_after_failure" value="true" original="1"/>
         </meta_attributes>
         <utilization id="rsc1-utilization" original="1">
           <nvpair id="rsc1-utilization-role_after_failure" name="role_after_failure" value="true" original="1"/>
         </utilization>
       </primitive>
       <group id="grp1" original="1">
         <primitive class="ocf" id="rsc2" provider="pacemaker" type="Dummy" original="1">
           <operations original="1">
             <op id="rsc2_monitor_20000" interval="20s" name="monitor" original="1">
               <meta_attributes id="rsc2_monitor_20000-meta_attributes" original="1">
-                <nvpair id="rsc2_monitor_20000-meta_attributes-role_after_failure" name="role_after_failure" value="true" original="1"/>
                 <nvpair id="rsc2_monitor_20000-meta_attributes-other" name="other" value="true" original="1"/>
               </meta_attributes>
             </op>
           </operations>
         </primitive>
       </group>
       <clone id="clone1" original="1">
         <primitive class="ocf" id="rsc3" provider="pacemaker" type="Dummy" original="1">
           <operations original="1">
             <op id="rsc3_monitor_20000" interval="20s" name="monitor" original="1">
               <meta_attributes id="rsc3_monitor_20000-meta_attributes" original="1">
-                <nvpair id="rsc3_monitor_20000-meta_attributes-role_after_failure" name="role_after_failure" value="false" original="1"/>
                 <nvpair id="rsc3_monitor_20000-meta_attributes-other" name="other" value="false" original="1"/>
               </meta_attributes>
             </op>
           </operations>
         </primitive>
       </clone>
       <clone id="clone2" original="1">
         <group id="grp2" original="1">
           <primitive class="ocf" id="rsc4" provider="pacemaker" type="Dummy" original="1">
             <operations original="1">
               <op id="rsc4_monitor_20000" interval="20s" name="monitor" original="1">
                 <meta_attributes id="rsc4_monitor_20000-meta_attributes" original="1">
-                  <nvpair id="rsc4_monitor_20000-meta_attributes-role_after_failure" name="role_after_failure" value="true" original="1"/>
                   <nvpair id="rsc4_monitor_20000-meta_attributes-other" name="other" value="true" original="1"/>
                 </meta_attributes>
               </op>
             </operations>
           </primitive>
         </group>
       </clone>
       <bundle id="bundle1" original="1">
         <podman image="localhost/pcmktest:http" replicas="3" original="1"/>
         <primitive class="ocf" id="rsc5" provider="heartbeat" type="apache" original="1">
           <operations original="1">
             <op id="rsc5_monitor_20000" interval="20s" name="monitor" original="1">
               <meta_attributes id="rsc5_monitor_20000-meta_attributes" original="1">
-                <nvpair id="rsc5_monitor_20000-meta_attributes-role_after_failure" name="role_after_failure" value="false" original="1"/>
                 <nvpair id="rsc5_monitor_20000-meta_attributes-other" name="other" value="false" original="1"/>
               </meta_attributes>
             </op>
           </operations>
         </primitive>
       </bundle>
     </resources>
     <constraints original="1"/>
     <op_defaults original="1">
       <meta_attributes id="op_defaults-meta_attributes" original="1">
-        <nvpair id="op_defaults-meta_attributes-role_after_failure" name="role_after_failure" value="true" original="1"/>
         <nvpair id="op_defaults-meta_attributes-other" name="other" value="true" original="1"/>
       </meta_attributes>
     </op_defaults>
   </configuration>
   <status original="1"/>
 </cib>
diff --git a/cts/schemas/test-3/ref/role-after-failure.ref-99 b/cts/schemas/test-3/ref/role-after-failure.ref-99
index b228cbe259..e9037826d8 100644
--- a/cts/schemas/test-3/ref/role-after-failure.ref-99
+++ b/cts/schemas/test-3/ref/role-after-failure.ref-99
@@ -1,120 +1,113 @@
 <cib crm_feature_set="3.19.7" validate-with="pacemaker-4.0" epoch="8" num_updates="0" admin_epoch="0">
   <configuration>
     <!-- The essential elements of this test are:
          * There are the following resources:
            * A template
            * A primitive outside of any collective resource
            * A group containing a single member
            * A cloned primitive
            * A cloned group containing a single member
            * A bundle containing a primitive
          * There is an op_defaults element.
          * Each primitive has an op element.
          * Each op and the op_defaults element have a meta_attributes element
            containing an nvpair with name="role_after_failure" and another with
            name="other".
          * There are other nvsets containing nvpairs with
            name="role_after_failure".
 
          In this situation, all role_after_failure meta-attributes within op and
          op_defaults elements should be dropped. Other meta-attributes should be
          unchanged.
       -->
     <crm_config>
       <cluster_property_set id="cib-bootstrap-options">
         <nvpair id="cib-bootstrap-options-role_after_failure" name="role_after_failure" value="true"/>
       </cluster_property_set>
     </crm_config>
     <nodes/>
     <resources>
       <template class="ocf" id="template1" provider="pacemaker" type="Dummy">
         <operations>
           <op id="template1_monitor_20000" interval="20s" name="monitor">
             <meta_attributes id="template1_monitor_20000-meta_attributes">
-              <nvpair id="template_monitor_20000-meta_attributes-role_after_failure" name="role_after_failure" value="true"/>
               <nvpair id="template_monitor_20000-meta_attributes-other" name="other" value="true"/>
             </meta_attributes>
           </op>
         </operations>
       </template>
       <primitive class="ocf" id="rsc1" provider="pacemaker" type="Dummy">
         <operations>
           <op id="rsc1_monitor_20000" interval="20s" name="monitor">
             <meta_attributes id="rsc1_monitor_20000-meta_attributes">
-              <nvpair id="rsc1_monitor_20000-meta_attributes-role_after_failure" name="role_after_failure" value="false"/>
               <nvpair id="rsc1_monitor_20000-meta_attributes-other" name="other" value="false"/>
             </meta_attributes>
           </op>
         </operations>
         <instance_attributes id="rsc1-instance_attributes">
           <nvpair id="rsc1-instance_attributes-role_after_failure" name="role_after_failure" value="true"/>
         </instance_attributes>
         <meta_attributes id="rsc1-meta_attributes">
           <nvpair id="rsc1-meta_attributes-role_after_failure" name="role_after_failure" value="true"/>
         </meta_attributes>
         <utilization id="rsc1-utilization">
           <nvpair id="rsc1-utilization-role_after_failure" name="role_after_failure" value="true"/>
         </utilization>
       </primitive>
       <group id="grp1">
         <primitive class="ocf" id="rsc2" provider="pacemaker" type="Dummy">
           <operations>
             <op id="rsc2_monitor_20000" interval="20s" name="monitor">
               <meta_attributes id="rsc2_monitor_20000-meta_attributes">
-                <nvpair id="rsc2_monitor_20000-meta_attributes-role_after_failure" name="role_after_failure" value="true"/>
                 <nvpair id="rsc2_monitor_20000-meta_attributes-other" name="other" value="true"/>
               </meta_attributes>
             </op>
           </operations>
         </primitive>
       </group>
       <clone id="clone1">
         <primitive class="ocf" id="rsc3" provider="pacemaker" type="Dummy">
           <operations>
             <op id="rsc3_monitor_20000" interval="20s" name="monitor">
               <meta_attributes id="rsc3_monitor_20000-meta_attributes">
-                <nvpair id="rsc3_monitor_20000-meta_attributes-role_after_failure" name="role_after_failure" value="false"/>
                 <nvpair id="rsc3_monitor_20000-meta_attributes-other" name="other" value="false"/>
               </meta_attributes>
             </op>
           </operations>
         </primitive>
       </clone>
       <clone id="clone2">
         <group id="grp2">
           <primitive class="ocf" id="rsc4" provider="pacemaker" type="Dummy">
             <operations>
               <op id="rsc4_monitor_20000" interval="20s" name="monitor">
                 <meta_attributes id="rsc4_monitor_20000-meta_attributes">
-                  <nvpair id="rsc4_monitor_20000-meta_attributes-role_after_failure" name="role_after_failure" value="true"/>
                   <nvpair id="rsc4_monitor_20000-meta_attributes-other" name="other" value="true"/>
                 </meta_attributes>
               </op>
             </operations>
           </primitive>
         </group>
       </clone>
       <bundle id="bundle1">
         <podman image="localhost/pcmktest:http" replicas="3"/>
         <primitive class="ocf" id="rsc5" provider="heartbeat" type="apache">
           <operations>
             <op id="rsc5_monitor_20000" interval="20s" name="monitor">
               <meta_attributes id="rsc5_monitor_20000-meta_attributes">
-                <nvpair id="rsc5_monitor_20000-meta_attributes-role_after_failure" name="role_after_failure" value="false"/>
                 <nvpair id="rsc5_monitor_20000-meta_attributes-other" name="other" value="false"/>
               </meta_attributes>
             </op>
           </operations>
         </primitive>
       </bundle>
     </resources>
     <constraints/>
     <op_defaults>
       <meta_attributes id="op_defaults-meta_attributes">
-        <nvpair id="op_defaults-meta_attributes-role_after_failure" name="role_after_failure" value="true"/>
         <nvpair id="op_defaults-meta_attributes-other" name="other" value="true"/>
       </meta_attributes>
     </op_defaults>
   </configuration>
   <status/>
 </cib>
diff --git a/xml/nvset-4.0.rng b/xml/nvset-4.0.rng
index 0508a453f2..fb76e6d71c 100644
--- a/xml/nvset-4.0.rng
+++ b/xml/nvset-4.0.rng
@@ -1,105 +1,108 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!-- just as nvset-2.9.rng, but allows for instantiated @name restrictions -->
 <grammar xmlns="http://relaxng.org/ns/structure/1.0"
          datatypeLibrary="http://www.w3.org/2001/XMLSchema-datatypes">
   <start>
     <ref name="element-nvset"/>
   </start>
 
   <!-- nvpair/@name:
        * generic string by default, parent grammar may want to prohibit
          enumerated names -->
   <define name="element-nvset.name">
     <attribute name="name">
       <text/>
     </attribute>
   </define>
 
   <define name="element-nvset.value">
     <attribute name="value">
       <text/>
     </attribute>
   </define>
 
   <!-- nvpair/@name:
        * defer element-nvset.name grammar item
        nvpair/@value:
        generic string by default, parent grammar may want to restrict
        enumerated pairs (i.e. related to @name) at once -->
   <define name="element-nvset.name-value">
     <ref name="element-nvset.name"/>
     <ref name="element-nvset.value"/>
   </define>
 
   <!-- Allow easy redefinition in parent grammars -->
   <define name="element-nvset.rule">
     <externalRef href="rule-4.0.rng"/>
   </define>
 
   <!--
    Disallow resource meta-attribute name-value pairs for which support was
    recently dropped. The idea is to prevent a user from adding the option under
    the belief that it will still affect behavior. Sometime in the future,
    re-allow these as custom meta-attributes or values.
    -->
   <define name="rsc_meta_attributes.nvpair.unsupported">
     <group>
       <attribute name="name">
         <data type="string">
           <except>
             <value>restart-type</value>
           </except>
         </data>
       </attribute>
       <ref name="element-nvset.value"/>
     </group>
   </define>
 
   <!--
    Disallow operation meta-attribute name-value pairs for which support was
    recently dropped. The idea is to prevent a user from adding the option under
    the belief that it will still affect behavior. Sometime in the future,
    re-allow these as custom meta-attributes or values.
    -->
   <define name="op_meta_attributes.nvpair.unsupported">
     <group>
       <attribute name="name">
         <data type="string">
           <except>
-            <value>can_fail</value>
+            <choice>
+              <value>can_fail</value>
+              <value>role_after_failure</value>
+            </choice>
           </except>
         </data>
       </attribute>
       <ref name="element-nvset.value"/>
     </group>
   </define>
 
   <define name="element-nvset">
    <choice>
    <attribute name="id-ref"><data type="IDREF"/></attribute>
    <group>
     <attribute name="id"><data type="ID"/></attribute>
     <interleave>
       <optional>
         <ref name="element-nvset.rule"/>
       </optional>
       <zeroOrMore>
         <element name="nvpair">
           <choice>
             <attribute name="id-ref"><data type="IDREF"/></attribute>
             <group>
               <attribute name="id"><data type="ID"/></attribute>
               <ref name="element-nvset.name-value"/>
             </group>
           </choice>
         </element>
       </zeroOrMore>
       <optional>
         <externalRef href="score.rng"/>
       </optional>
     </interleave>
    </group>
    </choice>
   </define>
 
 </grammar>
diff --git a/xml/upgrade-3.10-4.xsl b/xml/upgrade-3.10-4.xsl
index d585daad08..d69f669ff8 100644
--- a/xml/upgrade-3.10-4.xsl
+++ b/xml/upgrade-3.10-4.xsl
@@ -1,187 +1,193 @@
 <?xml version="1.0" encoding="UTF-8"?>
 
 <!--
  Use comments liberally as future maintainers may be unfamiliar with XSLT.
  -->
 
 <!--
  upgrade-3.10-4.xsl
 
  Guarantees after this transformation:
  * There are no nagios-class or upstart-class resources. If there were any prior
    to this transformation, they have been dropped.
  * There are no bundle resources based on rkt containers. If there were any
    prior to this transformation, they have been dropped.
  * The restart-type resource meta-attribute is not present.
  * The can_fail operation meta-attribute is not present.
+ * The role_after_failure operation meta-attribute is not present.
  -->
 
 <xsl:stylesheet version="1.0"
                 xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
 
 <xsl:import href="upgrade-3.10-common.xsl"/>
 
 <!-- XSLT 1.0 lacks upper-case() and lower-case() functions -->
 <xsl:variable name="upper" select="'ABCDEFGHIJKLMNOPQRSTUVWXYZ'"/>
 <xsl:variable name="lower" select="'abcdefghijklmnopqrstuvwxyz'"/>
 
 <!-- Index all resource templates by ID -->
 <xsl:key name="template_id" match="template" use="@id"/>
 
 <!-- Copy everything unaltered by default -->
 <xsl:template match="/|@*|node()">
     <xsl:call-template name="identity"/>
 </xsl:template>
 
 
 <!-- Resources -->
 
 <!-- The following XSL templates use XPath 1.0 set intersection idioms -->
 
 <!-- Upstart-class templates -->
 <xsl:variable name="dropped_templates"
               select="//template
                       [(translate(@class, $upper, $lower) = 'nagios')
                        or (translate(@class, $upper, $lower) = 'upstart')]"/>
 
 <!-- Upstart-class primitives -->
 <xsl:variable name="dropped_primitives"
               select="//primitive
                       [(translate(@class, $upper, $lower) = 'nagios')
                        or (translate(@class, $upper, $lower) = 'upstart')
                        or (@template
                            and (count(key('template_id', @template)
                                       |$dropped_templates)
                                 = count($dropped_templates)))]"/>
 
 <!-- Groups containing only nagios- and upstart-class primitives -->
 <xsl:variable name="dropped_groups"
               select="//group[count(primitive|$dropped_primitives)
                               = count($dropped_primitives)]"/>
 
 <!-- Clones containing only nagios- and upstart-class primitives -->
 <xsl:variable name="dropped_clones"
               select="//clone[count(.//primitive|$dropped_primitives)
                               = count($dropped_primitives)]"/>
 
 <!-- All dropped resources -->
 <xsl:variable name="dropped_resources"
               select="$dropped_primitives
                       |$dropped_groups
                       |$dropped_clones
                       |//bundle[rkt]"/>
 
 <!-- Drop nagios- and upstart-class resource templates -->
 <xsl:template match="template">
     <xsl:if test="count(.|$dropped_templates) != count($dropped_templates)">
         <xsl:call-template name="identity"/>
     </xsl:if>
 </xsl:template>
 
 <!-- Drop nagios- and upstart-class primitives -->
 <xsl:template match="primitive">
     <xsl:if test="count(.|$dropped_primitives) != count($dropped_primitives)">
         <xsl:call-template name="identity"/>
     </xsl:if>
 </xsl:template>
 
 <!-- Drop groups that would become empty -->
 <xsl:template match="group">
     <xsl:if test="count(.|$dropped_groups) != count($dropped_groups)">
         <xsl:call-template name="identity"/>
     </xsl:if>
 </xsl:template>
 
 <!-- Drop clones that would become empty -->
 <xsl:template match="clone">
     <xsl:if test="count(.|$dropped_clones) != count($dropped_clones)">
         <xsl:call-template name="identity"/>
     </xsl:if>
 </xsl:template>
 
 <!-- Drop rkt bundles -->
 <xsl:template match="bundle[rkt]"/>
 
 <!-- Drop restart-type resource meta-attribute -->
 <xsl:template match="template/meta_attributes/nvpair[@name = 'restart-type']
                      |primitive/meta_attributes/nvpair[@name = 'restart-type']
                      |group/meta_attributes/nvpair[@name = 'restart-type']
                      |clone/meta_attributes/nvpair[@name = 'restart-type']
                      |bundle/meta_attributes/nvpair[@name = 'restart-type']
                      |rsc_defaults/meta_attributes/nvpair
                          [@name = 'restart-type']"/>
 
 <!-- Drop can_fail operation meta-attribute -->
 <xsl:template match="op/meta_attributes/nvpair[@name = 'can_fail']
                      |op_defaults/meta_attributes/nvpair[@name = 'can_fail']"/>
 
+<!-- Drop role_after_failure operation meta-attribute -->
+<xsl:template match="op/meta_attributes/nvpair[@name = 'role_after_failure']
+                     |op_defaults/meta_attributes/nvpair
+                         [@name = 'role_after_failure']"/>
+
 
 <!-- Constraints -->
 
 <!-- Drop resource refs that refer to dropped resources -->
 <xsl:variable name="dropped_resource_refs"
               select="//resource_ref[@id = $dropped_resources/@id]"/>
 
 <xsl:template match="resource_ref">
     <xsl:if test="count(.|$dropped_resource_refs)
                   != count($dropped_resource_refs)">
         <xsl:call-template name="identity"/>
     </xsl:if>
 </xsl:template>
 
 <!-- Drop resource sets that would become empty -->
 <xsl:variable name="dropped_resource_sets"
               select="//resource_set
                       [count(resource_ref|$dropped_resource_refs)
                        = count($dropped_resource_refs)]"/>
 
 <xsl:template match="resource_set">
     <xsl:if test="count(.|$dropped_resource_sets)
                   != count($dropped_resource_sets)">
         <xsl:call-template name="identity"/>
     </xsl:if>
 </xsl:template>
 
 <!-- Drop constraints that would contain no valid resource references -->
 <xsl:template match="rsc_location|rsc_ticket">
     <xsl:choose>
         <xsl:when test="@rsc = $dropped_resources/@id"/>
 
         <!-- The constraint contained resource sets, and they're all dropped -->
         <xsl:when test="resource_set
                         and (count(resource_set|$dropped_resource_sets)
                              = count($dropped_resource_sets))"/>
 
         <xsl:otherwise>
             <xsl:call-template name="identity"/>
         </xsl:otherwise>
     </xsl:choose>
 </xsl:template>
 
 <xsl:template match="rsc_colocation">
     <xsl:choose>
         <xsl:when test="@rsc = $dropped_resources/@id"/>
         <xsl:when test="@with-rsc = $dropped_resources/@id"/>
         <xsl:when test="resource_set
                         and (count(resource_set|$dropped_resource_sets)
                              = count($dropped_resource_sets))"/>
         <xsl:otherwise>
             <xsl:call-template name="identity"/>
         </xsl:otherwise>
     </xsl:choose>
 </xsl:template>
 
 <xsl:template match="rsc_order">
     <xsl:choose>
         <xsl:when test="@first = $dropped_resources/@id"/>
         <xsl:when test="@then = $dropped_resources/@id"/>
         <xsl:when test="resource_set
                         and (count(resource_set|$dropped_resource_sets)
                              = count($dropped_resource_sets))"/>
         <xsl:otherwise>
             <xsl:call-template name="identity"/>
         </xsl:otherwise>
     </xsl:choose>
 </xsl:template>
 
 </xsl:stylesheet>