diff --git a/xml/cibtr-2.rng b/xml/cibtr-2.rng
index 47c3126e2e..7918a62b99 100644
--- a/xml/cibtr-2.rng
+++ b/xml/cibtr-2.rng
@@ -1,56 +1,132 @@
 <!--
  Copyright 2018 Red Hat, Inc.
  Author: Jan Pokorny <jpokorny@redhat.com>
  Part of pacemaker project
  SPDX-License-Identifier: GPL-2.0-or-later
  -->
 <grammar xmlns="http://relaxng.org/ns/structure/1.0"
          xmlns:cibtr="http://clusterlabs.org/ns/pacemaker/cibtr-2"
          datatypeLibrary="http://www.w3.org/2001/XMLSchema-datatypes">
   <start>
     <ref name="cibtr-2"/>
   </start>
 
   <define name="cibtr-2">
     <element name="cibtr:map">
       <zeroOrMore>
         <ref name="cibtr-2.table"/>
       </zeroOrMore>
     </element>
   </define>
 
   <define name="cibtr-2.table">
     <element name="cibtr:table">
       <attribute name="for">
         <data type="ID"/>
       </attribute>
       <attribute name="msg-prefix">
         <data type="string"/>
       </attribute>
-      <zeroOrMore>
-        <ref name="cibtr-2.replace"/>
-      </zeroOrMore>
+      <choice>
+        <zeroOrMore>
+          <ref name="cibtr-2.replace.nonwhereaware"/>
+        </zeroOrMore>
+        <group>
+          <attribute name="where-cases">
+            <!-- pipe-delimited enumeration-->
+            <data type="string">
+              <param name="minLength">1</param>
+            </data>
+          </attribute>
+          <!-- cannot arrange this as an interleave of
+               cibtr-2.replace.whereaware+ and
+               cibtr-2.replace.nonwhereaware* because of
+               http://relaxng.org/spec-20011203.html#attribute-restrictions -->
+          <zeroOrMore>
+            <ref name="cibtr-2.replace.whereaware"/>
+          </zeroOrMore>
+        </group>
+      </choice>
     </element>
   </define>
 
-  <define name="cibtr-2.replace">
-    <element name="cibtr:replace">
-      <attribute name="what">
+  <!-- leaf attributes -->
+
+  <define name="cibtr-2.replace.attr-in-case-of">
+    <attribute name="in-case-of">
+      <!-- pipe-delimited enumeration-->
+      <data type="string"/>
+    </attribute>
+  </define>
+
+  <define name="cibtr-2.replace.attr-msg-extra">
+    <attribute name="msg-extra">
+      <data type="string">
+        <param name="minLength">1</param>
+      </data>
+    </attribute>
+  </define>
+
+  <define name="cibtr-2.replace.attr-what">
+    <attribute name="what">
+      <data type="NCName"/>
+    </attribute>
+  </define>
+
+  <define name="cibtr-2.replace.attr-where">
+    <attribute name="where">
+      <data type="NCName"/>
+    </attribute>
+  </define>
+
+  <define name="cibtr-2.replace.attr-with-possibly">
+    <attribute name="with">
+      <choice>
         <data type="NCName"/>
-      </attribute>
-      <attribute name="with">
-        <choice>
-          <data type="NCName"/>
-          <empty/>
-        </choice>
-      </attribute>
-      <optional>
-        <attribute name="msg-extra">
-          <data type="string">
-            <param name="minLength">1</param>
-          </data>
-        </attribute>
-      </optional>
+        <empty/>
+      </choice>
+    </attribute>
+  </define>
+
+  <define name="cibtr-2.replace.attr-with-surely">
+    <attribute name="with">
+      <choice>
+        <data type="NCName"/>
+      </choice>
+    </attribute>
+  </define>
+
+  <define name="cibtr-2.replace.attrs-common">
+    <ref name="cibtr-2.replace.attr-what"/>
+    <optional>
+      <ref name="cibtr-2.replace.attr-in-case-of"/>
+    </optional>
+    <optional>
+      <ref name="cibtr-2.replace.attr-msg-extra"/>
+    </optional>
+  </define>
+
+  <!-- leaf production using the above attribute definitions -->
+
+  <define name="cibtr-2.replace.nonwhereaware">
+    <element name="cibtr:replace">
+      <ref name="cibtr-2.replace.attrs-common"/>
+      <ref name="cibtr-2.replace.attr-with-possibly"/>
     </element>
   </define>
+
+  <define name="cibtr-2.replace.whereaware">
+    <element name="cibtr:replace">
+      <ref name="cibtr-2.replace.attrs-common"/>
+      <!-- cf. comment at cibtr-2.table -->
+      <choice>
+        <group>
+          <ref name="cibtr-2.replace.attr-with-surely"/>
+          <ref name="cibtr-2.replace.attr-where"/>
+        </group>
+        <ref name="cibtr-2.replace.attr-with-possibly"/>
+      </choice>
+    </element>
+  </define>
+
 </grammar>
diff --git a/xml/nvset-2.9.rng b/xml/nvset-2.9.rng
index 26dcac13ec..0d43be5970 100644
--- a/xml/nvset-2.9.rng
+++ b/xml/nvset-2.9.rng
@@ -1,45 +1,45 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!-- types: http://www.w3.org/TR/xmlschema-2/#dateTime -->
-<grammar xmlns="http://relaxng.org/ns/structure/1.0" 
+<grammar xmlns="http://relaxng.org/ns/structure/1.0"
          datatypeLibrary="http://www.w3.org/2001/XMLSchema-datatypes">
   <start>
     <ref name="element-nvset"/>
   </start>
 
   <define name="element-nvset">
    <choice>
    <attribute name="id-ref"><data type="IDREF"/></attribute>
    <group>
     <attribute name="id"><data type="ID"/></attribute>
     <interleave>
       <optional>
         <externalRef href="rule-2.9.rng"/>
       </optional>
         <zeroOrMore>
           <element name="nvpair">
             <choice>
               <group>
                 <attribute name="id-ref"><data type="IDREF"/></attribute>
                 <optional>
                   <attribute name="name"><text/></attribute>
                 </optional>
               </group>
               <group>
                 <attribute name="id"><data type="ID"/></attribute>
                 <attribute name="name"><text/></attribute>
                 <optional>
                   <attribute name="value"><text/></attribute>
                 </optional>
               </group>
             </choice>
           </element>
         </zeroOrMore>
       <optional>
         <externalRef href="score.rng"/>
       </optional>
     </interleave>
    </group>
    </choice>
   </define>
 
 </grammar>
diff --git a/xml/nvset-2.9.rng b/xml/nvset-3.0.rng
similarity index 59%
copy from xml/nvset-2.9.rng
copy to xml/nvset-3.0.rng
index 26dcac13ec..7555dcb078 100644
--- a/xml/nvset-2.9.rng
+++ b/xml/nvset-3.0.rng
@@ -1,45 +1,63 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!-- types: http://www.w3.org/TR/xmlschema-2/#dateTime -->
+<!-- just as nvset-2.9.rng, but allows for instantiated @name restrictions -->
 <grammar xmlns="http://relaxng.org/ns/structure/1.0" 
          datatypeLibrary="http://www.w3.org/2001/XMLSchema-datatypes">
   <start>
     <ref name="element-nvset"/>
   </start>
 
+  <!-- nvpair/@name:
+       * generic string by default, parent grammar may want to prohibit
+         enumerated names -->
+  <define name="element-nvset.name">
+    <attribute name="name">
+      <text/>
+    </attribute>
+  </define>
+
+  <!-- nvpair/@name:
+       * defer element-nvset.name grammar item
+       nvpair/@value:
+       generic string by default, parent grammar may want to restrict
+       enumerated pairs (i.e. related to @name) at once -->
+  <define name="element-nvset.name-value">
+    <ref name="element-nvset.name"/>
+    <optional>
+      <attribute name="value"><text/></attribute>
+    </optional>
+  </define>
+
   <define name="element-nvset">
    <choice>
    <attribute name="id-ref"><data type="IDREF"/></attribute>
    <group>
     <attribute name="id"><data type="ID"/></attribute>
     <interleave>
       <optional>
         <externalRef href="rule-2.9.rng"/>
       </optional>
         <zeroOrMore>
           <element name="nvpair">
             <choice>
               <group>
                 <attribute name="id-ref"><data type="IDREF"/></attribute>
                 <optional>
                   <attribute name="name"><text/></attribute>
                 </optional>
               </group>
               <group>
                 <attribute name="id"><data type="ID"/></attribute>
-                <attribute name="name"><text/></attribute>
-                <optional>
-                  <attribute name="value"><text/></attribute>
-                </optional>
+                <ref name="element-nvset.name-value"/>
               </group>
             </choice>
           </element>
         </zeroOrMore>
       <optional>
         <externalRef href="score.rng"/>
       </optional>
     </interleave>
    </group>
    </choice>
   </define>
 
 </grammar>
diff --git a/xml/resources-3.0.rng b/xml/resources-3.0.rng
index 576a249557..39c4cc5378 100644
--- a/xml/resources-3.0.rng
+++ b/xml/resources-3.0.rng
@@ -1,328 +1,363 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <grammar xmlns="http://relaxng.org/ns/structure/1.0"
          datatypeLibrary="http://www.w3.org/2001/XMLSchema-datatypes">
   <start>
       <ref name="element-resources"/>
   </start>
 
   <define name="element-resources">
     <element name="resources">
       <zeroOrMore>
         <choice>
           <ref name="element-primitive"/>
           <ref name="element-template"/>
           <ref name="element-group"/>
           <ref name="element-clone"/>
           <ref name="element-master"/>
           <ref name="element-bundle"/>
         </choice>
       </zeroOrMore>
     </element>
   </define>
 
   <define name="element-primitive">
     <element name="primitive">
       <interleave>
         <attribute name="id"><data type="ID"/></attribute>
         <choice>
           <group>
             <ref name="element-resource-class"/>
             <attribute name="type"><text/></attribute>
           </group>
           <attribute name="template"><data type="IDREF"/></attribute>
         </choice>
         <optional>
           <attribute name="description"><text/></attribute>
         </optional>
         <ref name="element-resource-extra"/>
         <ref name="element-operations"/>
         <zeroOrMore>
           <element name="utilization">
-            <externalRef href="nvset-2.9.rng"/>
+            <externalRef href="nvset-3.0.rng"/>
           </element>
         </zeroOrMore>
       </interleave>
     </element>
   </define>
 
   <define name="element-template">
     <element name="template">
       <interleave>
         <attribute name="id"><data type="ID"/></attribute>
         <ref name="element-resource-class"/>
         <attribute name="type"><text/></attribute>
         <optional>
           <attribute name="description"><text/></attribute>
         </optional>
         <ref name="element-resource-extra"/>
         <ref name="element-operations"/>
         <zeroOrMore>
           <element name="utilization">
-            <externalRef href="nvset-2.9.rng"/>
+            <externalRef href="nvset-3.0.rng"/>
           </element>
         </zeroOrMore>
       </interleave>
     </element>
   </define>
 
   <define name="element-bundle">
     <element name="bundle">
       <interleave>
         <attribute name="id"><data type="ID"/></attribute>
         <optional>
           <attribute name="description"><text/></attribute>
         </optional>
         <ref name="element-resource-extra"/>
         <choice>
           <element name="docker">
             <attribute name="image"><text/></attribute>
             <optional>
               <attribute name="replicas"><data type="integer"/></attribute>
             </optional>
             <optional>
               <attribute name="replicas-per-host"><data type="integer"/></attribute>
             </optional>
             <optional>
               <choice>
                 <attribute name="masters"><data type="integer"/></attribute>
                 <attribute name="promoted-max"><data type="integer"/></attribute>
               </choice>
             </optional>
             <optional>
               <attribute name="run-command"> <text/></attribute>
             </optional>
             <optional>
               <attribute name="network"><text/></attribute>
             </optional>
             <optional>
               <attribute name="options"><text/></attribute>
             </optional>
           </element>
           <element name="rkt">
             <attribute name="image"><text/></attribute>
             <optional>
               <attribute name="replicas"><data type="integer"/></attribute>
             </optional>
             <optional>
               <attribute name="replicas-per-host"><data type="integer"/></attribute>
             </optional>
             <optional>
               <choice>
                 <attribute name="masters"><data type="integer"/></attribute>
                 <attribute name="promoted-max"><data type="integer"/></attribute>
               </choice>
             </optional>
             <optional>
               <attribute name="run-command"> <text/></attribute>
             </optional>
             <optional>
               <attribute name="network"><text/></attribute>
             </optional>
             <optional>
               <attribute name="options"><text/></attribute>
             </optional>
           </element>
         </choice>
         <optional>
           <element name="network">
             <optional>
               <attribute name="ip-range-start"><text/></attribute>
             </optional>
             <optional>
               <attribute name="control-port"><data type="integer"/></attribute>
             </optional>
             <optional>
               <attribute name="host-interface"><text/></attribute>
             </optional>
             <optional>
               <attribute name="host-netmask"><data type="integer"/></attribute>
             </optional>
             <optional>
               <attribute name="add-host"><data type="boolean"/></attribute>
             </optional>
             <zeroOrMore>
               <element name="port-mapping">
                 <attribute name="id"><data type="ID"/></attribute>
                 <choice>
                   <group>
                     <attribute name="port"><data type="integer"/></attribute>
                     <optional>
                       <attribute name="internal-port"><data type="integer"/></attribute>
                     </optional>
                   </group>
                   <attribute name="range">
                     <data type="string">
                       <param name="pattern">([0-9\-]+)</param>
                     </data>
                   </attribute>
                 </choice>
               </element>
             </zeroOrMore>
           </element>
         </optional>
         <optional>
           <element name="storage">
             <zeroOrMore>
               <element name="storage-mapping">
                 <attribute name="id"><data type="ID"/></attribute>
                 <choice>
                   <attribute name="source-dir"><text/></attribute>
                   <attribute name="source-dir-root"><text/></attribute>
                 </choice>
                 <attribute name="target-dir"><text/></attribute>
                 <optional>
                   <attribute name="options"><text/></attribute>
                 </optional>
               </element>
             </zeroOrMore>
           </element>
         </optional>
         <optional>
           <ref name="element-primitive"/>
         </optional>
       </interleave>
     </element>
   </define>
 
   <define name="element-group">
     <element name="group">
       <attribute name="id"><data type="ID"/></attribute>
       <optional>
         <attribute name="description"><text/></attribute>
       </optional>
       <interleave>
         <ref name="element-resource-extra"/>
         <oneOrMore>
           <ref name="element-primitive"/>
         </oneOrMore>
       </interleave>
     </element>
   </define>
 
   <define name="element-clone">
     <element name="clone">
       <attribute name="id"><data type="ID"/></attribute>
       <optional>
         <attribute name="description"><text/></attribute>
       </optional>
       <interleave>
         <ref name="element-resource-extra"/>
         <choice>
           <ref name="element-primitive"/>
           <ref name="element-group"/>
         </choice>
       </interleave>
     </element>
   </define>
 
   <define name="element-master">
     <element name="master">
       <attribute name="id"><data type="ID"/></attribute>
       <optional>
         <attribute name="description"><text/></attribute>
       </optional>
       <interleave>
         <ref name="element-resource-extra"/>
         <choice>
           <ref name="element-primitive"/>
           <ref name="element-group"/>
         </choice>
       </interleave>
     </element>
   </define>
 
   <define name="element-resource-extra">
-      <zeroOrMore>
-        <choice>
-          <element name="meta_attributes">
-            <externalRef href="nvset-2.9.rng"/>
-          </element>
-          <element name="instance_attributes">
-            <externalRef href="nvset-2.9.rng"/>
-          </element>
-        </choice>
-      </zeroOrMore>
+    <zeroOrMore>
+      <choice>
+        <element name="meta_attributes">
+          <externalRef href="nvset-3.0.rng"/>
+        </element>
+        <element name="instance_attributes">
+          <externalRef href="nvset-3.0.rng"/>
+        </element>
+      </choice>
+    </zeroOrMore>
+  </define>
+
+  <!--
+   see upgrade-2.10.xsl
+   - cibtr:table for="resources-operation"
+   -->
+  <define name="op.meta_attributes.nvpair.name-unsupported">
+    <attribute name="name">
+      <data type="string">
+        <except>
+          <choice>
+            <value>requires</value>
+          </choice>
+        </except>
+      </data>
+    </attribute>
+  </define>
+
+  <define name="element-resource-extra.op">
+    <zeroOrMore>
+      <choice>
+        <element name="meta_attributes">
+          <grammar>
+            <include href="nvset-3.0.rng">
+              <define name="element-nvset.name">
+                <parentRef name="op.meta_attributes.nvpair.name-unsupported"/>
+              </define>
+            </include>
+          </grammar>
+        </element>
+        <element name="instance_attributes">
+          <externalRef href="nvset-3.0.rng"/>
+        </element>
+      </choice>
+    </zeroOrMore>
   </define>
 
   <define name="element-operations">
     <optional>
       <element name="operations">
         <optional>
           <attribute name="id"><data type="ID"/></attribute>
         </optional>
         <optional>
           <attribute name="id-ref"><data type="IDREF"/></attribute>
         </optional>
         <zeroOrMore>
           <element name="op">
             <attribute name="id"><data type="ID"/></attribute>
             <attribute name="name"><text/></attribute>
             <attribute name="interval"><text/></attribute>
             <optional>
               <attribute name="description"><text/></attribute>
             </optional>
             <optional>
               <choice>
                 <attribute name="start-delay"><text/></attribute>
                 <attribute name="interval-origin"><text/></attribute>
               </choice>
             </optional>
             <optional>
               <attribute name="timeout"><text/></attribute>
             </optional>
             <optional>
               <attribute name="enabled"><data type="boolean"/></attribute>
             </optional>
             <optional>
               <attribute name="record-pending"><data type="boolean"/></attribute>
             </optional>
             <optional>
               <attribute name="role">
                 <choice>
                   <value>Stopped</value>
                   <value>Started</value>
                   <value>Slave</value>
                   <value>Master</value>
                 </choice>
               </attribute>
             </optional>
             <optional>
               <attribute name="on-fail">
                 <choice>
                   <value>ignore</value>
                   <value>block</value>
                   <value>stop</value>
                   <value>restart</value>
                   <value>standby</value>
                   <value>fence</value>
                   <value>restart-container</value>
                 </choice>
               </attribute>
             </optional>
-            <ref name="element-resource-extra"/>
+            <ref name="element-resource-extra.op"/>
           </element>
         </zeroOrMore>
       </element>
     </optional>
   </define>
 
   <define name="element-resource-class">
     <choice>
       <group>
         <attribute name="class"><value>ocf</value></attribute>
         <attribute name="provider"><text/></attribute>
       </group>
       <attribute name="class">
         <choice>
           <value>lsb</value>
           <value>heartbeat</value>
           <value>stonith</value>
           <value>upstart</value>
           <value>service</value>
           <value>systemd</value>
           <value>nagios</value>
         </choice>
       </attribute>
     </choice>
   </define>
 </grammar>
diff --git a/xml/test-2/020-rsc-requires-inline.ref b/xml/test-2/020-rsc-requires-inline.ref
new file mode 100644
index 0000000000..574071b8aa
--- /dev/null
+++ b/xml/test-2/020-rsc-requires-inline.ref
@@ -0,0 +1,43 @@
+<cib validate-with="pacemaker-3.0" admin_epoch="0" epoch="0" num_updates="0">
+  <configuration>
+    <crm_config/>
+    <nodes>
+
+      <node id="virt-063" uname="virt-063"/>
+      <node id="virt-064" uname="virt-064"/>
+      <node id="virt-069" uname="virt-069"/>
+
+    </nodes>
+    <resources>
+
+      <primitive id="myAddr" class="ocf" provider="heartbeat" type="IPaddr2">
+        <operations>
+          <op id="myAddr-monitor" name="monitor" interval="30s"/>
+          <!-- relying on order (+ colocation) to guarantee "requires"
+               transitively (unfencing/fencing/quorum)? -->
+          <op id="myAddr-start" name="start" interval="0" timeout="40s"/>
+        </operations>
+        <instance_attributes id="myAddr-params">
+          <nvpair id="myAddr-ip" name="ip" value="192.0.2.10"/>
+        </instance_attributes>
+      <meta_attributes id="_2TO3_myAddr-meta"> <nvpair id="_2TO3_myAddr-start-meta-requires" name="requires" value="nothing"/></meta_attributes></primitive>
+
+      <primitive id="myHttpd" class="ocf" provider="heartbeat" type="apache">
+        <operations>
+          <op id="myHttpd-monitor" name="monitor" interval="30s"/>
+        </operations>
+        <instance_attributes id="myHttpd-params">
+          <nvpair id="myHttpd-configfile" name="configfile" value="/etc/httpd/conf/httpd.conf"/>
+        </instance_attributes>
+      </primitive>
+
+    </resources>
+    <constraints>
+
+      <rsc_order id="order-addr-httpd" first="myAddr" then="myHttpd"/>
+      <rsc_colocation id="colocation-addr-httpd" rsc="myHttpd" with-rsc="myAddr" score="INFINITY"/>
+
+    </constraints>
+  </configuration>
+  <status/>
+</cib>
diff --git a/xml/test-2/020-rsc-requires-inline.ref.err b/xml/test-2/020-rsc-requires-inline.ref.err
new file mode 100644
index 0000000000..a9e7a8967a
--- /dev/null
+++ b/xml/test-2/020-rsc-requires-inline.ref.err
@@ -0,0 +1 @@
+Resources-operation: moving requires under meta_attributes as requires unless already defined there for matching start|promote
diff --git a/xml/test-2/020-rsc-requires-inline.xml b/xml/test-2/020-rsc-requires-inline.xml
new file mode 100644
index 0000000000..66b1d0604c
--- /dev/null
+++ b/xml/test-2/020-rsc-requires-inline.xml
@@ -0,0 +1,44 @@
+<cib validate-with="pacemaker-2.0" admin_epoch="0" epoch="0" num_updates="0">
+  <configuration>
+    <crm_config/>
+    <nodes>
+
+      <node id="virt-063" uname="virt-063"/>
+      <node id="virt-064" uname="virt-064"/>
+      <node id="virt-069" uname="virt-069"/>
+
+    </nodes>
+    <resources>
+
+      <primitive id="myAddr" class="ocf" provider="heartbeat" type="IPaddr2">
+        <operations>
+          <op id="myAddr-monitor" name="monitor" interval="30s"/>
+          <!-- relying on order (+ colocation) to guarantee "requires"
+               transitively (unfencing/fencing/quorum)? -->
+          <op id="myAddr-start" name="start" interval="0" timeout="40s"
+              requires="nothing"/>
+        </operations>
+        <instance_attributes id="myAddr-params">
+          <nvpair id="myAddr-ip" name="ip" value="192.0.2.10"/>
+        </instance_attributes>
+      </primitive>
+
+      <primitive id="myHttpd" class="ocf" provider="heartbeat" type="apache">
+        <operations>
+          <op id="myHttpd-monitor" name="monitor" interval="30s"/>
+        </operations>
+        <instance_attributes id="myHttpd-params">
+          <nvpair id="myHttpd-configfile" name="configfile" value="/etc/httpd/conf/httpd.conf"/>
+        </instance_attributes>
+      </primitive>
+
+    </resources>
+    <constraints>
+
+      <rsc_order id="order-addr-httpd" first="myAddr" then="myHttpd"/>
+      <rsc_colocation id="colocation-addr-httpd" rsc="myHttpd" with-rsc="myAddr" score="INFINITY"/>
+
+    </constraints>
+  </configuration>
+  <status/>
+</cib>
diff --git a/xml/test-2/021-rsc-requires-nvpair.ref b/xml/test-2/021-rsc-requires-nvpair.ref
new file mode 100644
index 0000000000..8545bd1e81
--- /dev/null
+++ b/xml/test-2/021-rsc-requires-nvpair.ref
@@ -0,0 +1,46 @@
+<cib validate-with="pacemaker-3.0" admin_epoch="0" epoch="0" num_updates="0">
+  <configuration>
+    <crm_config/>
+    <nodes>
+
+      <node id="virt-063" uname="virt-063"/>
+      <node id="virt-064" uname="virt-064"/>
+      <node id="virt-069" uname="virt-069"/>
+
+    </nodes>
+    <resources>
+
+      <primitive id="myAddr" class="ocf" provider="heartbeat" type="IPaddr2">
+        <operations>
+          <op id="myAddr-monitor" name="monitor" interval="30s"/>
+          <op id="myAddr-start" name="start" interval="0" timeout="40s"/>
+        </operations>
+        <instance_attributes id="myAddr-params">
+          <nvpair id="myAddr-ip" name="ip" value="192.0.2.10"/>
+        </instance_attributes>
+      <meta_attributes id="_2TO3_myAddr-start-metaparams">
+              <!-- relying on order (+ colocation) to guarantee "requires"
+                   transitively (unfencing/fencing/quorum)? -->
+              
+             <nvpair id="myAddr-start-requires" name="requires" value="nothing"/>
+            </meta_attributes></primitive>
+
+      <primitive id="myHttpd" class="ocf" provider="heartbeat" type="apache">
+        <operations>
+          <op id="myHttpd-monitor" name="monitor" interval="30s"/>
+        </operations>
+        <instance_attributes id="myHttpd-params">
+          <nvpair id="myHttpd-configfile" name="configfile" value="/etc/httpd/conf/httpd.conf"/>
+        </instance_attributes>
+      </primitive>
+
+    </resources>
+    <constraints>
+
+      <rsc_order id="order-addr-httpd" first="myAddr" then="myHttpd"/>
+      <rsc_colocation id="colocation-addr-httpd" rsc="myHttpd" with-rsc="myAddr" score="INFINITY"/>
+
+    </constraints>
+  </configuration>
+  <status/>
+</cib>
diff --git a/xml/test-2/021-rsc-requires-nvpair.ref.err b/xml/test-2/021-rsc-requires-nvpair.ref.err
new file mode 100644
index 0000000000..2b5e0e00ac
--- /dev/null
+++ b/xml/test-2/021-rsc-requires-nvpair.ref.err
@@ -0,0 +1 @@
+Resources-operation: myAddr-start: moving requires under meta_attributes as requires unless already defined there for matching start|promote
diff --git a/xml/test-2/021-rsc-requires-nvpair.xml b/xml/test-2/021-rsc-requires-nvpair.xml
new file mode 100644
index 0000000000..e2214efe40
--- /dev/null
+++ b/xml/test-2/021-rsc-requires-nvpair.xml
@@ -0,0 +1,47 @@
+<cib validate-with="pacemaker-2.0" admin_epoch="0" epoch="0" num_updates="0">
+  <configuration>
+    <crm_config/>
+    <nodes>
+
+      <node id="virt-063" uname="virt-063"/>
+      <node id="virt-064" uname="virt-064"/>
+      <node id="virt-069" uname="virt-069"/>
+
+    </nodes>
+    <resources>
+
+      <primitive id="myAddr" class="ocf" provider="heartbeat" type="IPaddr2">
+        <operations>
+          <op id="myAddr-monitor" name="monitor" interval="30s"/>
+          <op id="myAddr-start" name="start" interval="0" timeout="40s">
+            <meta_attributes id="myAddr-start-metaparams">
+              <!-- relying on order (+ colocation) to guarantee "requires"
+                   transitively (unfencing/fencing/quorum)? -->
+              <nvpair id="myAddr-start-requires" name="requires" value="nothing"/>
+            </meta_attributes>
+          </op>
+        </operations>
+        <instance_attributes id="myAddr-params">
+          <nvpair id="myAddr-ip" name="ip" value="192.0.2.10"/>
+        </instance_attributes>
+      </primitive>
+
+      <primitive id="myHttpd" class="ocf" provider="heartbeat" type="apache">
+        <operations>
+          <op id="myHttpd-monitor" name="monitor" interval="30s"/>
+        </operations>
+        <instance_attributes id="myHttpd-params">
+          <nvpair id="myHttpd-configfile" name="configfile" value="/etc/httpd/conf/httpd.conf"/>
+        </instance_attributes>
+      </primitive>
+
+    </resources>
+    <constraints>
+
+      <rsc_order id="order-addr-httpd" first="myAddr" then="myHttpd"/>
+      <rsc_colocation id="colocation-addr-httpd" rsc="myHttpd" with-rsc="myAddr" score="INFINITY"/>
+
+    </constraints>
+  </configuration>
+  <status/>
+</cib>
diff --git a/xml/test-2/022-rsc-requires-counterexamples.ref b/xml/test-2/022-rsc-requires-counterexamples.ref
new file mode 100644
index 0000000000..c100eefb62
--- /dev/null
+++ b/xml/test-2/022-rsc-requires-counterexamples.ref
@@ -0,0 +1,48 @@
+<cib validate-with="pacemaker-3.0" admin_epoch="0" epoch="0" num_updates="0">
+  <configuration>
+    <crm_config/>
+    <nodes>
+
+      <node id="virt-063" uname="virt-063"/>
+      <node id="virt-064" uname="virt-064"/>
+      <node id="virt-069" uname="virt-069"/>
+
+    </nodes>
+    <resources>
+
+      <primitive id="myAddr" class="ocf" provider="heartbeat" type="IPaddr2">
+        <operations>
+          <op id="myAddr-monitor" name="monitor" interval="30s"/>
+          <op id="myAddr-start" name="start" interval="0" timeout="40s">
+            <meta_attributes id="myAddr-start-metaparams">
+              <!-- fake-requires != requires -->
+              <nvpair id="myAddr-start-requires" name="fake-requires" value="nothing"/>
+            </meta_attributes>
+          </op>
+          <!-- stop != start -->
+          <op id="myAddr-stop" name="stop" interval="0" timeout="40s"/>
+        </operations>
+        <instance_attributes id="myAddr-params">
+          <nvpair id="myAddr-ip" name="ip" value="192.0.2.10"/>
+        </instance_attributes>
+      </primitive>
+
+      <primitive id="myHttpd" class="ocf" provider="heartbeat" type="apache">
+        <operations>
+          <op id="myHttpd-monitor" name="monitor" interval="30s"/>
+        </operations>
+        <instance_attributes id="myHttpd-params">
+          <nvpair id="myHttpd-configfile" name="configfile" value="/etc/httpd/conf/httpd.conf"/>
+        </instance_attributes>
+      </primitive>
+
+    </resources>
+    <constraints>
+
+      <rsc_order id="order-addr-httpd" first="myAddr" then="myHttpd"/>
+      <rsc_colocation id="colocation-addr-httpd" rsc="myHttpd" with-rsc="myAddr" score="INFINITY"/>
+
+    </constraints>
+  </configuration>
+  <status/>
+</cib>
diff --git a/xml/test-2/022-rsc-requires-counterexamples.ref.err b/xml/test-2/022-rsc-requires-counterexamples.ref.err
new file mode 100644
index 0000000000..4e9a8f7cdb
--- /dev/null
+++ b/xml/test-2/022-rsc-requires-counterexamples.ref.err
@@ -0,0 +1,2 @@
+Resources-operation: dropping requires
+Resources-operation: ... only start/promote operation taken into account
diff --git a/xml/test-2/022-rsc-requires-counterexamples.xml b/xml/test-2/022-rsc-requires-counterexamples.xml
new file mode 100644
index 0000000000..c74e76cdd4
--- /dev/null
+++ b/xml/test-2/022-rsc-requires-counterexamples.xml
@@ -0,0 +1,49 @@
+<cib validate-with="pacemaker-2.0" admin_epoch="0" epoch="0" num_updates="0">
+  <configuration>
+    <crm_config/>
+    <nodes>
+
+      <node id="virt-063" uname="virt-063"/>
+      <node id="virt-064" uname="virt-064"/>
+      <node id="virt-069" uname="virt-069"/>
+
+    </nodes>
+    <resources>
+
+      <primitive id="myAddr" class="ocf" provider="heartbeat" type="IPaddr2">
+        <operations>
+          <op id="myAddr-monitor" name="monitor" interval="30s"/>
+          <op id="myAddr-start" name="start" interval="0" timeout="40s">
+            <meta_attributes id="myAddr-start-metaparams">
+              <!-- fake-requires != requires -->
+              <nvpair id="myAddr-start-requires" name="fake-requires" value="nothing"/>
+            </meta_attributes>
+          </op>
+          <!-- stop != start -->
+          <op id="myAddr-stop" name="stop" interval="0" timeout="40s"
+              requires="nothing"/>
+        </operations>
+        <instance_attributes id="myAddr-params">
+          <nvpair id="myAddr-ip" name="ip" value="192.0.2.10"/>
+        </instance_attributes>
+      </primitive>
+
+      <primitive id="myHttpd" class="ocf" provider="heartbeat" type="apache">
+        <operations>
+          <op id="myHttpd-monitor" name="monitor" interval="30s"/>
+        </operations>
+        <instance_attributes id="myHttpd-params">
+          <nvpair id="myHttpd-configfile" name="configfile" value="/etc/httpd/conf/httpd.conf"/>
+        </instance_attributes>
+      </primitive>
+
+    </resources>
+    <constraints>
+
+      <rsc_order id="order-addr-httpd" first="myAddr" then="myHttpd"/>
+      <rsc_colocation id="colocation-addr-httpd" rsc="myHttpd" with-rsc="myAddr" score="INFINITY"/>
+
+    </constraints>
+  </configuration>
+  <status/>
+</cib>
diff --git a/xml/upgrade-2.10.xsl b/xml/upgrade-2.10.xsl
index d956582f6a..11e7aa5166 100644
--- a/xml/upgrade-2.10.xsl
+++ b/xml/upgrade-2.10.xsl
@@ -1,163 +1,758 @@
 <!--
  Copyright 2018 Red Hat, Inc.
  Author: Jan Pokorny <jpokorny@redhat.com>
  Part of pacemaker project
  SPDX-License-Identifier: GPL-2.0-or-later
  -->
 <xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
                 xmlns:cibtr="http://clusterlabs.org/ns/pacemaker/cibtr-2">
 <xsl:output method="xml" encoding="UTF-8" indent="yes" omit-xml-declaration="yes"/>
 
 <xsl:param name="cib-min-ver" select="'3.0'"/>
 
 <!--
 
  HELPER DEFINITIONS
 
  -->
 
 <cibtr:map>
 
+  <!--
+   Target tag:     primitive
+                   template
+   Object:         ./operations/op/@*
+                   ./operations/op/meta_attributes/nvpair/@name
+   Selector ctxt:  ./operations/op/@name
+   Move ctxt:      meta_attributes ~ ./meta_attributes/nvpair
+   -->
+  <cibtr:table for="resources-operation" msg-prefix="Resources-operation"
+               where-cases="meta_attributes">
+    <cibtr:replace what="requires"
+                   with=""
+                   msg-extra="only start/promote operation taken into account"/>
+    <cibtr:replace what="requires"
+                   with="requires"
+                   in-case-of="start|promote"
+                   where="meta_attributes"/>
+  </cibtr:table>
+
   <!--
    Target tag:     rsc_colocation
    Object:         ./@*
+   Selector ctxt:  N/A
+   Move ctxt:      N/A
    -->
   <cibtr:table for="constraints-colocation" msg-prefix="Constraints-colocation">
     <cibtr:replace what="score-attribute"
                    with=""
                    msg-extra="was actually never in effect"/>
     <cibtr:replace what="score-attribute-mangle"
                    with=""
                    msg-extra="was actually never in effect"/>
   </cibtr:table>
 
 </cibtr:map>
 
+<xsl:variable name="MapResourcesOperation"
+              select="document('')/xsl:stylesheet
+                        /cibtr:map/cibtr:table[
+                          @for = 'resources-operation'
+                        ]"/>
+
 <xsl:variable name="MapConstraintsColocation"
               select="document('')/xsl:stylesheet
                         /cibtr:map/cibtr:table[
                           @for = 'constraints-colocation'
                         ]"/>
 
 <!--
 
  GENERIC UTILITIES
 
  -->
 
 <!--
  Plain identity template
 
  Merely implicit-context-driven, no arguments.
  -->
 <xsl:template name="HelperIdentity">
   <xsl:copy>
     <xsl:apply-templates select="@*|node()"/>
   </xsl:copy>
 </xsl:template>
 
 <!--
  Emit an message about the replacement, sanity checking the source definitions
 
  Merely parameter driven, no implicit context taken into account:
  - Context: optional message prefix
  - Replacement: selected subset of cibtr:map's leaves
                 (it's considered a hard error if consists of more than 1 item)
  -->
 <xsl:template name="MapMsg">
   <xsl:param name="Context" select="''"/>
   <xsl:param name="Replacement"/>
   <xsl:choose>
     <xsl:when test="not($Replacement)"/>
     <xsl:when test="count($Replacement) != 1">
       <xsl:message terminate="yes">
         <xsl:value-of select="concat('INTERNAL ERROR:',
                                      $Replacement/../@msg-prefix,
                                      ': count($Replacement) != 1',
                                      ' does not hold (',
                                      count($Replacement), ')')"/>
       </xsl:message>
     </xsl:when>
     <xsl:otherwise>
       <xsl:variable name="MsgPrefix" select="concat(
                                                ($Replacement|$Replacement/..)
                                                  /@msg-prefix, ': '
                                              )"/>
       <xsl:message>
         <xsl:value-of select="$MsgPrefix"/>
         <xsl:if test="$Context">
           <xsl:value-of select="concat($Context, ': ')"/>
         </xsl:if>
         <xsl:choose>
           <xsl:when test="string($Replacement/@with)">
-            <xsl:value-of select="concat('renaming ', $Replacement/@what,
-                                         ' as ', $Replacement/@with)"/>
+            <xsl:choose>
+              <xsl:when test="string($Replacement/@where)">
+                <xsl:if test="not(
+                                contains(
+                                  concat('|', $Replacement/../@where-cases, '|'),
+                                  concat('|', $Replacement/@where, '|')
+                                )
+                              )">
+                  <xsl:message terminate="yes">
+                    <xsl:value-of select="concat('INTERNAL ERROR:',
+                                                 $Replacement/../@msg-prefix,
+                                                 ': $Replacement/@where (',
+                                                 $Replacement/@where, ') not in ',
+                                                 concat('|',
+                                                 $Replacement/../@where-cases,
+                                                 '|'))"/>
+                  </xsl:message>
+                </xsl:if>
+                <xsl:value-of select="concat('moving ', $Replacement/@what,
+                                             ' under ', $Replacement/@where)"/>
+              </xsl:when>
+              <xsl:when test="$Replacement/@with = $Replacement/@what">
+                <xsl:value-of select="concat('keeping ', $Replacement/@what)"/>
+              </xsl:when>
+              <xsl:otherwise>
+                <xsl:value-of select="concat('renaming ', $Replacement/@what)"/>
+              </xsl:otherwise>
+            </xsl:choose>
+            <xsl:value-of select="concat(' as ', $Replacement/@with)"/>
+            <xsl:if test="$Replacement/@where">
+              <xsl:value-of select="' unless already defined there'"/>
+            </xsl:if>
           </xsl:when>
           <xsl:otherwise>
             <xsl:value-of select="concat('dropping ', $Replacement/@what)"/>
           </xsl:otherwise>
         </xsl:choose>
+	<xsl:choose>
+          <xsl:when test="string($Replacement/@in-case-of)">
+            <xsl:value-of select="concat(' for matching ',
+                                         $Replacement/@in-case-of)"/>
+          </xsl:when>
+          <xsl:when test="$Replacement/@in-case-of">
+            <xsl:value-of select="' for matching &quot;empty string&quot;'"/>
+          </xsl:when>
+	</xsl:choose>
       </xsl:message>
       <xsl:if test="$Replacement/@msg-extra">
         <xsl:message>
           <xsl:value-of select="concat($MsgPrefix, '... ',
                                        $Replacement/@msg-extra)"/>
         </xsl:message>
       </xsl:if>
     </xsl:otherwise>
   </xsl:choose>
 </xsl:template>
 
+<!--
+ Produce a denormalized space if not present in the input (cf. trick A.)
+
+ Merely parameter driven, no implicit context taken into account:
+ - Source: input selection or result tree fragment to evaluate
+ - ResultTreeFragment: optional self-explanatory flag related to Source
+ -->
+<xsl:template name="HelperDenormalizedSpace">
+  <xsl:param name="Source"/>
+  <xsl:param name="ResultTreeFragment" select="false()"/>
+  <xsl:choose>
+    <xsl:when test="not($ResultTreeFragment)">
+      <!-- intention here is that immediately surrounding text (mostly expected
+           to be just indenting whitespace) and comments will be preserved;
+           in case no denormalized space is present, " " is injected -->
+      <xsl:variable name="ExistingSpace"
+                    select="$Source/preceding-sibling::node()[
+                              (
+                                self::comment()
+                                or
+                                self::text()
+                              )
+                              and
+                              generate-id(following-sibling::*[1])
+                              = generate-id($Source)
+                            ]"/>
+      <xsl:copy-of select="$ExistingSpace"/>
+      <xsl:if test="not(
+                      $ExistingSpace/self::text()[
+                        normalize-space(.) != string(.)
+                      ]
+                    )">
+        <xsl:text> </xsl:text>
+      </xsl:if>
+    </xsl:when>
+    <xsl:when test="normalize-space($Source)
+                    != string($Source)">
+      <xsl:text> </xsl:text>
+    </xsl:when>
+  </xsl:choose>
+</xsl:template>
+
+<!--
+
+ TRANSFORMATION HELPERS
+
+ considerations, limitations, etc.:
+ 1. the transformations tries to preserve as much of the original XML
+    as possible, incl. whitespace text/indentation and comments, but
+    at times (corner cases of tricks A. + B. below), this needs to be
+    sacrificed, e.g., distorting nice indentation, hence if the
+    perfection is the goal:
+    - user of the transformation can feed the minimized version of
+      the XML (no denormalized/any white-space present)
+    - user of the transformation can (re-)pretty-print the outcome
+      afterwards
+
+ tricks and conventions used:
+ A. callable templates only return Result Tree Fragments, which means
+    the only operations allowed are those looking at the underlying,
+    virtual node-set, and since we need to discern their non-void
+    production (i.e. on successful match/es), we use this trick:
+    - ensure the template will not propagate any denormalized whitespace
+    - inject denormalized whitespace (superfluous space) artificially
+      to mark successful production (but see B. below)
+    - with the template production, here stored as Var variable,
+      we test "normalize-space($Var) != $Var" condition to detect
+      non-void production, mainly intended to see whether to emit
+      the enclosing element at all (with the goal of not leaving
+      superfluous elements behind needlessly)
+ B. [extension over A.] to eliminate distorted indentation
+    (cf. consideration 1.), additional reuse of these callable
+    templates is introduced: the template can recursively call
+    itself with a special flag (InnerSimulation) as an oracle to
+    see to whether non-void production will ensue (all pre-existing
+    denormalized whitespace is forcefully removed in this mode),
+    and if positive, all such inner pre-existing whitespace is
+    then preserved in this outer=main invocation
+ C. not only to honour DRY principle and to avoid inner entropy, it's
+    often useful to make callable template bimodal, e.g., when the
+    production is generated in the "what's to stay in place" vs.
+    "what's to be propagated (combined with previous, effectively
+    moved) at this other part of the tree" contexts; for such cases,
+    there's usually InverseMode parameter to be assigned true()
+    (implicit default) and false(), respectively
+
+ -->
+
+<!--
+ Source ctxt:    (primitive|template)/operations/op/meta_attributes
+ Target ctxt:    (primitive|template)/operations/op/meta_attributes
+ Target-inv ctxt:(primitive|template)/meta_attributes
+ Dependencies:   N/A
+ -->
+<xsl:template name="ProcessNonattrOpMetaAttributes">
+  <xsl:param name="Source"/>
+  <xsl:param name="InverseMode" select="false()"/>
+  <xsl:param name="InnerSimulation" select="false()"/>
+
+  <xsl:variable name="InnerPass">
+    <xsl:choose>
+      <xsl:when test="$InverseMode
+                      or
+                      $InnerSimulation">
+        <xsl:value-of select="''"/>
+      </xsl:when>
+      <xsl:otherwise>
+        <xsl:call-template name="ProcessNonattrOpMetaAttributes">
+          <xsl:with-param name="Source" select="$Source"/>
+          <xsl:with-param name="InnerSimulation" select="true()"/>
+        </xsl:call-template>
+      </xsl:otherwise>
+    </xsl:choose>
+  </xsl:variable>
+
+  <xsl:for-each select="$Source/node()">
+    <xsl:choose>
+      <xsl:when test="self::text()
+                      and
+                      not($InverseMode)">
+        <!-- cf. trick A. (consideration 1.) -->
+        <xsl:choose>
+          <xsl:when test="normalize-space($InnerPass)
+                          != $InnerPass
+                          and
+                          (
+                            not(following-sibling::nvpair)
+                            or
+                            generate-id(following-sibling::nvpair[1])
+                            != generate-id(following-sibling::*[1])
+                          )">
+            <xsl:value-of select="."/>
+          </xsl:when>
+          <xsl:otherwise>
+            <xsl:value-of select="normalize-space(.)"/>
+          </xsl:otherwise>
+        </xsl:choose>
+      </xsl:when>
+      <xsl:when test="self::nvpair">
+        <xsl:variable name="Replacement"
+                      select="$MapResourcesOperation/cibtr:replace[
+                                @what = current()/@name
+                                and
+                                (
+                                  (
+                                    @in-case-of
+                                    and
+                                    contains(concat('|', @in-case-of, '|'),
+                                             concat('|', current()/../../@name, '|'))
+                                  )
+                                  or
+                                  (
+                                    not(@in-case-of)
+                                    and
+                                    not(
+                                      $MapResourcesOperation/cibtr:replace[
+                                        @what = current()/@name
+                                        and
+                                        @in-case-of
+                                        and
+                                        contains(concat('|', @in-case-of, '|'),
+                                                 concat('|', current()/../../@name, '|'))
+                                      ]
+                                    )
+                                  )
+                                )
+                              ]"/>
+        <xsl:if test="not($InverseMode or $InnerSimulation)">
+          <xsl:call-template name="MapMsg">
+            <xsl:with-param name="Context" select="../../@id"/>
+            <xsl:with-param name="Replacement" select="$Replacement"/>
+          </xsl:call-template>
+        </xsl:if>
+        <xsl:choose>
+          <xsl:when test="$Replacement
+                          and
+                          (
+                            not(string($Replacement/@with))
+                            or
+                            $Replacement/@where
+                          )">
+            <!-- drop (possibly just move over) -->
+            <xsl:if test="$InverseMode
+                          and
+                          $Replacement/@where = 'meta_attributes'">
+              <!-- cf. trick A. (indicate for inverse mode) -->
+              <xsl:text> </xsl:text>
+              <xsl:copy>
+                <xsl:apply-templates select="@*"/>
+              </xsl:copy>
+            </xsl:if>
+          </xsl:when>
+          <xsl:when test="$Replacement">
+            <xsl:message terminate="yes">
+              <xsl:value-of select="concat('INTERNAL ERROR: ',
+                                           $Replacement/../@msg-prefix,
+                                           ': no in-situ rename',
+                                           ' does not hold (',
+                                           not(($InverseMode)), ')')"/>
+            </xsl:message>
+          </xsl:when>
+          <xsl:when test="$InverseMode"/>
+          <xsl:otherwise>
+            <xsl:call-template name="HelperDenormalizedSpace">
+              <xsl:with-param name="Source" select="."/>
+            </xsl:call-template>
+            <xsl:call-template name="HelperIdentity"/>
+          </xsl:otherwise>
+        </xsl:choose>
+      </xsl:when>
+      <xsl:when test="$InverseMode
+                      or
+                      self::comment()">
+        <!-- drop -->
+      </xsl:when>
+      <xsl:otherwise>
+        <xsl:call-template name="HelperIdentity"/>
+      </xsl:otherwise>
+    </xsl:choose>
+  </xsl:for-each>
+</xsl:template>
+
+<!--
+ Source ctxt:    (primitive|template)/operations/op
+ Target ctxt:    (primitive|template)/operations/op/meta_attributes
+ Target-inv ctxt:(primitive|template)/meta_attributes
+ Dependencies:   ProcessNonattrOpMetaAttributes [non-inverse only]
+ -->
+<xsl:template name="ProcessAttrOpMetaAttributes">
+  <xsl:param name="Source"/>
+  <xsl:param name="InverseMode" select="false()"/>
+  <xsl:param name="InnerSimulation" select="false()"/>
+
+  <xsl:variable name="InnerPass">
+    <xsl:choose>
+      <xsl:when test="$InnerSimulation">
+        <xsl:value-of select="''"/>
+      </xsl:when>
+      <xsl:otherwise>
+        <xsl:call-template name="ProcessAttrOpMetaAttributes">
+          <xsl:with-param name="Source" select="$Source"/>
+          <xsl:with-param name="InverseMode" select="$InverseMode"/>
+          <xsl:with-param name="InnerSimulation" select="true()"/>
+        </xsl:call-template>
+      </xsl:otherwise>
+    </xsl:choose>
+  </xsl:variable>
+
+  <xsl:if test="(
+                  $InverseMode
+                  and
+                  (
+                    $InnerSimulation
+                    or
+                    normalize-space($InnerPass)
+                    != string($InnerPass)
+                  )
+                )
+                or
+                not($InverseMode)">
+    <xsl:if test="$InverseMode
+                  and
+                  not($InnerSimulation)">
+      <xsl:call-template name="HelperDenormalizedSpace">
+        <xsl:with-param name="Source" select="$InnerPass"/>
+        <xsl:with-param name="ResultTreeFragment" select="true()"/>
+      </xsl:call-template>
+    </xsl:if>
+
+    <!-- cannot combine "copy" with creating a new element, hence we mimic
+         "copy" with recreating the element anew, while still using just
+         a single for-each loop -->
+    <xsl:variable name="ParentName">
+      <xsl:choose>
+        <xsl:when test="not($InverseMode)">
+          <xsl:value-of select="name()"/>
+        </xsl:when>
+        <xsl:otherwise>
+          <xsl:value-of select="'nvpair'"/>
+        </xsl:otherwise>
+      </xsl:choose>
+    </xsl:variable>
+    <xsl:element name="{$ParentName}">
+    <!-- B: special-casing @* -->
+    <xsl:for-each select="@*">
+      <xsl:variable name="Replacement"
+                    select="$MapResourcesOperation/cibtr:replace[
+                              @what = name(current())
+                              and
+                              (
+                                (
+                                  @in-case-of
+                                  and
+                                  contains(concat('|', @in-case-of, '|'),
+                                           concat('|', current()/../@name, '|'))
+                                )
+                                or
+                                (
+                                  not(@in-case-of)
+                                  and
+                                  not(
+                                    $MapResourcesOperation/cibtr:replace[
+                                      @what = name(current())
+                                      and
+                                      @in-case-of
+                                      and
+                                      contains(concat('|', @in-case-of, '|'),
+                                               concat('|', current()/../@name, '|'))
+                                    ]
+                                  )
+                                )
+                              )
+                            ]"/>
+      <xsl:if test="not($InverseMode or $InnerSimulation)">
+        <xsl:call-template name="MapMsg">
+          <xsl:with-param name="Context" select="../../@id"/>
+          <xsl:with-param name="Replacement" select="$Replacement"/>
+        </xsl:call-template>
+      </xsl:if>
+      <xsl:choose>
+        <!-- use inner simulation to find out if success,
+             then emit also extra denormalized space -->
+        <xsl:when test="$InverseMode
+                        and
+                        $Replacement/@where = 'meta_attributes'">
+          <xsl:choose>
+            <xsl:when test="$InnerSimulation">
+              <!-- cf. trick A. (indicate for inverse mode) -->
+              <xsl:text> </xsl:text>
+            </xsl:when>
+            <xsl:otherwise>
+              <xsl:attribute name="id">
+                <xsl:value-of select="concat('_2TO3_', ../@id, '-meta-',
+                                             $Replacement/@with)"/>
+              </xsl:attribute>
+              <xsl:attribute name="name">
+                <xsl:value-of select="$Replacement/@with"/>
+              </xsl:attribute>
+              <xsl:attribute name="value">
+                <xsl:value-of select="."/>
+              </xsl:attribute>
+            </xsl:otherwise>
+          </xsl:choose>
+        </xsl:when>
+        <xsl:when test="$InverseMode"/>
+        <xsl:when test="$Replacement
+                        and
+                        (
+                          not(string($Replacement/@with))
+                          or
+                          $Replacement/@where
+                        )">
+          <!-- drop (possibly just move over) -->
+        </xsl:when>
+        <xsl:when test="$Replacement">
+          <xsl:message terminate="yes">
+            <xsl:value-of select="concat('INTERNAL ERROR: ',
+                                         $Replacement/../@msg-prefix,
+                                         ': no in-situ rename',
+                                         ' does not hold')"/>
+          </xsl:message>
+        </xsl:when>
+        <xsl:otherwise>
+          <!--xsl:attribute name="{name()}">
+            <xsl:value-of select="."/>
+          </xsl:attribute-->
+          <xsl:copy/>
+        </xsl:otherwise>
+      </xsl:choose>
+    </xsl:for-each>
+
+    <xsl:if test="not($InverseMode)">
+      <!-- B: special-casing meta_attributes -->
+      <xsl:for-each select="$Source/node()">
+        <xsl:choose>
+          <xsl:when test="self::text()
+                          and
+                          not($InverseMode)">
+            <!-- cf. trick A. (consideration 1.) -->
+            <xsl:choose>
+              <xsl:when test="normalize-space($InnerPass)
+                              != $InnerPass
+                              and
+                              (
+                                not(following-sibling::nvpair)
+                                or
+                                generate-id(following-sibling::nvpair[1])
+                                != generate-id(following-sibling::*[1])
+                              )">
+                <xsl:value-of select="."/>
+              </xsl:when>
+              <xsl:otherwise>
+                <xsl:value-of select="normalize-space(.)"/>
+              </xsl:otherwise>
+            </xsl:choose>
+          </xsl:when>
+          <xsl:when test="self::meta_attributes">
+            <xsl:variable name="ProcessedOpMetaAttributes">
+              <xsl:call-template name="ProcessNonattrOpMetaAttributes">
+                <xsl:with-param name="Source" select="."/>
+                <xsl:with-param name="InnerSimulation" select="$InnerSimulation"/>
+              </xsl:call-template>
+            </xsl:variable>
+            <!-- cf. trick A. -->
+            <xsl:if test="normalize-space($ProcessedOpMetaAttributes)
+                          != $ProcessedOpMetaAttributes">
+              <xsl:copy>
+                <xsl:apply-templates select="@*"/>
+                <xsl:copy-of select="$ProcessedOpMetaAttributes"/>
+              </xsl:copy>
+            </xsl:if>
+          </xsl:when>
+          <xsl:otherwise>
+            <xsl:call-template name="HelperIdentity"/>
+          </xsl:otherwise>
+        </xsl:choose>
+      </xsl:for-each>
+    </xsl:if>
+    <!-- E: special-casing meta_attributes -->
+    </xsl:element>
+  </xsl:if>
+</xsl:template>
+
 <!--
 
  ACTUAL TRANSFORMATION
 
  -->
 
 <xsl:template match="cib">
   <xsl:copy>
     <xsl:apply-templates select="@*"/>
     <xsl:attribute name="validate-with">
       <xsl:value-of select="concat('pacemaker-', $cib-min-ver)"/>
     </xsl:attribute>
     <xsl:apply-templates select="node()"/>
   </xsl:copy>
 </xsl:template>
 
 <xsl:template match="rsc_colocation">
   <xsl:copy>
     <xsl:for-each select="@*">
       <xsl:variable name="Replacement"
                     select="$MapConstraintsColocation/cibtr:replace[
                               @what = name(current())
                             ]"/>
       <xsl:call-template name="MapMsg">
         <xsl:with-param name="Context" select="../@id"/>
         <xsl:with-param name="Replacement" select="$Replacement"/>
       </xsl:call-template>
       <xsl:choose>
         <xsl:when test="$Replacement
                         and
                         not(string($Replacement/@with))">
           <!-- drop -->
         </xsl:when>
         <xsl:when test="$Replacement">
           <!-- rename -->
           <xsl:attribute name="{name()}">
             <xsl:value-of select="$Replacement/@with"/>
           </xsl:attribute>
         </xsl:when>
         <xsl:otherwise>
           <xsl:copy/>
         </xsl:otherwise>
       </xsl:choose>
     </xsl:for-each>
     <xsl:apply-templates select="node()"/>
   </xsl:copy>
 </xsl:template>
 
+<!--
+ 1a. propagate (primitive|template)/operations/
+       op[name() = 'start' or name() = 'promote']/@requires
+     under new ./meta_attributes/nvpair
+
+ 1b. "move" (primitive|template)/operations/
+       op[name() = 'start' or name() = 'promote']/
+       meta_attributes/nvpair[@requires]
+     under ./meta_attributes
+
+  otherwise, just
+
+ 2a.  drop (primitive|template)/operations/
+        op/@requires
+
+ 2b.  drop (primitive|template)/operations/
+        op/meta_attributes/nvpair[@requires]
+
+ Not compatible with meta_attributes referenced via id-ref
+ (would need external preprocessing).
+ -->
+<xsl:template match="primitive|template">
+  <xsl:copy>
+    <xsl:apply-templates select="@*"/>
+    <!-- B: special-casing operations -->
+    <xsl:for-each select="node()">
+      <xsl:choose>
+        <xsl:when test="self::operations">
+          <xsl:copy>
+            <xsl:apply-templates select="@*"/>
+            <!-- B: special-casing op -->
+            <xsl:for-each select="node()">
+              <xsl:choose>
+                <xsl:when test="self::op">
+                  <!-- process @*|meta_attributes/nvpair
+                       (keep/drop/move elsewhere) -->
+                  <xsl:variable name="ProcessedOpMetaAttributes">
+                    <xsl:call-template name="ProcessAttrOpMetaAttributes">
+                      <xsl:with-param name="Source" select="."/>
+                    </xsl:call-template>
+                  </xsl:variable>
+                  <xsl:copy-of select="$ProcessedOpMetaAttributes"/>
+                </xsl:when>
+                <xsl:otherwise>
+                  <xsl:call-template name="HelperIdentity"/>
+                </xsl:otherwise>
+              </xsl:choose>
+            </xsl:for-each>
+            <!-- E: special-casing op -->
+          </xsl:copy>
+        </xsl:when>
+        <xsl:otherwise>
+          <xsl:call-template name="HelperIdentity"/>
+        </xsl:otherwise>
+      </xsl:choose>
+    </xsl:for-each>
+    <!-- E: special-casing operations -->
+
+    <!-- add as last meta_attributes block... -->
+
+    <!-- ...indirectly from op attributes -->
+    <xsl:variable name="ToPropagateFromOp">
+      <xsl:for-each select="operations/op">
+        <xsl:call-template name="ProcessAttrOpMetaAttributes">
+          <xsl:with-param name="Source" select="."/>
+          <xsl:with-param name="InverseMode" select="true()"/>
+        </xsl:call-template>
+      </xsl:for-each>
+    </xsl:variable>
+    <!-- cf. trick A. -->
+    <xsl:if test="normalize-space($ToPropagateFromOp)
+                  != $ToPropagateFromOp">
+      <meta_attributes id="{concat('_2TO3_', @id, '-meta')}">
+        <xsl:copy-of select="$ToPropagateFromOp"/>
+      </meta_attributes>
+    </xsl:if>
+
+    <!-- ...directly by picking existing nvpairs of meta_attributes -->
+    <xsl:for-each select="operations/op/meta_attributes">
+      <xsl:variable name="ProcessedOpMetaAttributes">
+        <xsl:call-template name="ProcessNonattrOpMetaAttributes">
+          <xsl:with-param name="Source" select="."/>
+          <xsl:with-param name="InverseMode" select="true()"/>
+        </xsl:call-template>
+      </xsl:variable>
+      <!-- cf. trick A. -->
+      <xsl:if test="normalize-space($ProcessedOpMetaAttributes)
+                    != $ProcessedOpMetaAttributes">
+        <xsl:copy>
+          <xsl:apply-templates select="@*[
+                                         name() != 'id'
+                                       ]"/>
+          <xsl:attribute name='id'>
+            <xsl:value-of select="concat('_2TO3_', @id)"/>
+          </xsl:attribute>
+          <xsl:apply-templates select="node()[
+                                         name() != 'nvpair'
+                                       ]"/>
+          <xsl:copy-of select="$ProcessedOpMetaAttributes"/>
+          <xsl:apply-templates select="text()[position() = last()]"/>
+        </xsl:copy>
+      </xsl:if>
+    </xsl:for-each>
+  </xsl:copy>
+</xsl:template>
+
 <xsl:template match="@*|node()">
   <xsl:call-template name="HelperIdentity"/>
 </xsl:template>
 
 </xsl:stylesheet>
diff --git a/xml/upgrade-detail.xsl b/xml/upgrade-detail.xsl
index 99e391bae5..15e940fc3a 100644
--- a/xml/upgrade-detail.xsl
+++ b/xml/upgrade-detail.xsl
@@ -1,73 +1,116 @@
 <!--
  Copyright 2018 Red Hat, Inc.
  Author: Jan Pokorny <jpokorny@redhat.com>
  Part of pacemaker project
  SPDX-License-Identifier: GPL-2.0-or-later
  -->
 <xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
                 xmlns:cibtr-2="http://clusterlabs.org/ns/pacemaker/cibtr-2">
 <xsl:output method="text" encoding="UTF-8"/>
 
 <xsl:variable name="NL" select="'&#xA;'"/>
 
 <xsl:template name="MapMsg-2">
   <xsl:param name="Replacement"/>
   <xsl:choose>
     <xsl:when test="not($Replacement)"/>
     <xsl:when test="count($Replacement) != 1">
       <xsl:message terminate="yes">
         <xsl:value-of select="concat('INTERNAL ERROR:',
                                      $Replacement/../@msg-prefix,
                                      ': count($Replacement) != 1',
                                      ' does not hold (',
                                      count($Replacement), ')')"/>
       </xsl:message>
     </xsl:when>
     <xsl:otherwise>
       <cibtr-2:noop>
         <xsl:choose>
           <xsl:when test="string($Replacement/@with)">
-            <xsl:value-of select="concat('renaming ', $Replacement/@what,
-                                         ' as ', $Replacement/@with)"/>
+            <xsl:choose>
+              <xsl:when test="string($Replacement/@where)">
+                <xsl:if test="not(
+                                contains(
+                                  concat('|', $Replacement/../@where-cases, '|'),
+                                  concat('|', $Replacement/@where, '|')
+                                )
+                              )">
+                  <xsl:message terminate="yes">
+                    <xsl:value-of select="concat('INTERNAL ERROR:',
+                                                 $Replacement/../@msg-prefix,
+                                                 ': $Replacement/@where (',
+                                                 $Replacement/@where, ') not in ',
+                                                 concat('|',
+                                                 $Replacement/../@where-cases,
+                                                 '|'))"/>
+                  </xsl:message>
+                </xsl:if>
+                <xsl:value-of select="concat('moving ', $Replacement/@what,
+                                             ' under ', $Replacement/@where)"/>
+              </xsl:when>
+              <xsl:when test="$Replacement/@with = $Replacement/@what">
+                <xsl:value-of select="concat('keeping ', $Replacement/@what)"/>
+              </xsl:when>
+              <xsl:otherwise>
+                <xsl:value-of select="concat('renaming ', $Replacement/@what)"/>
+              </xsl:otherwise>
+            </xsl:choose>
+            <xsl:value-of select="concat(' as ', $Replacement/@with)"/>
+            <xsl:if test="$Replacement/@where">
+              <xsl:value-of select="' unless already defined there'"/>
+            </xsl:if>
           </xsl:when>
           <xsl:otherwise>
             <xsl:value-of select="concat('dropping ', $Replacement/@what)"/>
           </xsl:otherwise>
         </xsl:choose>
+	<xsl:choose>
+          <xsl:when test="string($Replacement/@in-case-of)">
+            <xsl:value-of select="concat(' for matching ',
+                                         $Replacement/@in-case-of)"/>
+          </xsl:when>
+          <xsl:when test="$Replacement/@in-case-of">
+            <xsl:value-of select="' for matching &quot;empty string&quot;'"/>
+          </xsl:when>
+	</xsl:choose>
       </cibtr-2:noop>
       <xsl:if test="$Replacement/@msg-extra">
         <cibtr-2:noop>
           <xsl:value-of select="concat($NL, '     ... ',
                                        $Replacement/@msg-extra)"/>
         </cibtr-2:noop>
       </xsl:if>
     </xsl:otherwise>
   </xsl:choose>
 </xsl:template>
 
 <xsl:template match="cibtr-2:map">
   <xsl:value-of select="concat('Translation tables v2 in detail', $NL,
                                '===============================', $NL, $NL)"/>
   <xsl:apply-templates select="*"/>
 </xsl:template>
 
 <xsl:template match="cibtr-2:table">
   <xsl:value-of select="concat('Details for the ', @for, ' table:', $NL)"/>
+  <xsl:if test="@where-cases">
+    <xsl:value-of select="concat($NL, '   Possible to-move specifiers:', $NL,
+                                 '   ','   ',  @where-cases, $NL)"/>
+  </xsl:if>
   <xsl:value-of select="concat(string(preceding-sibling::comment()[1]), $NL)"/>
   <xsl:apply-templates select="*"/>
   <xsl:value-of select="$NL"/>
 </xsl:template>
 
 <xsl:template match="cibtr-2:replace">
   <xsl:value-of select="'   - '"/>
   <xsl:call-template name="MapMsg-2">
     <xsl:with-param name="Replacement" select="."/>
   </xsl:call-template>
   <xsl:value-of select="$NL"/>
 </xsl:template>
 
 <xsl:template match="*">
   <xsl:apply-templates select="*"/>
 </xsl:template>
 
 </xsl:stylesheet>