diff --git a/cue/format/format_test.go b/cue/format/format_test.go
index 40c0373..e4e9be6 100644
--- a/cue/format/format_test.go
+++ b/cue/format/format_test.go
@@ -194,7 +194,7 @@
 
 // Use go test -update to create/update the respective golden files.
 var data = []entry{
-	{"comments.input", "comments.golden", 0},
+	{"comments.input", "comments.golden", simplify},
 	{"simplify.input", "simplify.golden", simplify},
 	{"expressions.input", "expressions.golden", 0},
 	{"values.input", "values.golden", 0},
diff --git a/cue/format/node.go b/cue/format/node.go
index ba6797d..66a7d83 100644
--- a/cue/format/node.go
+++ b/cue/format/node.go
@@ -243,6 +243,7 @@
 	obj, ok := n.Value.(*ast.StructLit)
 	if !ok || len(obj.Elts) != 1 ||
 		(obj.Lbrace.IsValid() && !f.printer.cfg.simplify) ||
+		(obj.Lbrace.IsValid() && hasDocComments(n)) ||
 		len(n.Attrs) > 0 {
 		return nil
 	}
diff --git a/cue/format/testdata/comments.golden b/cue/format/testdata/comments.golden
index e8d09b0..419f1fb 100644
--- a/cue/format/testdata/comments.golden
+++ b/cue/format/testdata/comments.golden
@@ -18,6 +18,25 @@
 b:  4   // line comment that is last in the file.
 cc: 555 // align comments
 
+// don't simplify
+a: {
+	b: 2
+}
+
+// simplify
+a: {
+	b: c: d: 1
+}
+
+// unchanged
+a: b: [1]
+
+// don't simplify
+a: b: c: 2
+
+// rewrite okay
+a: b: c: d: 2
+
 m: {
 }
 m: {
diff --git a/cue/format/testdata/comments.input b/cue/format/testdata/comments.input
index 2d3bb68..0f41c88 100644
--- a/cue/format/testdata/comments.input
+++ b/cue/format/testdata/comments.input
@@ -18,6 +18,31 @@
 b: 4 // line comment that is last in the file.
 cc: 555 // align comments
 
+// don't simplify
+a: {
+    b: 2
+}
+
+// simplify
+a: {
+    b: c: {
+        d: 1
+    }
+}
+
+// unchanged
+a: b: [1]
+
+// don't simplify
+a: b: {
+    c: 2
+}
+
+// rewrite okay
+a: b: c: {
+    d: 2
+}
+
 m: {
 }
 m: {
diff --git a/cue/format/testdata/simplify.golden b/cue/format/testdata/simplify.golden
index 17c024e..e89e4f6 100644
--- a/cue/format/testdata/simplify.golden
+++ b/cue/format/testdata/simplify.golden
@@ -46,6 +46,6 @@
 	r4:           quux
 	[baz2="str"]: 4
 	r5:           baz2
-	[baz3="bar"]: name: baz3 // TODO: treat baz3 as shadowed.
+	[baz3="bar"]: name: baz3
 	Time: time.Time
 }
diff --git a/cue/format/testdata/simplify.input b/cue/format/testdata/simplify.input
index 8b14541..a87340d 100644
--- a/cue/format/testdata/simplify.input
+++ b/cue/format/testdata/simplify.input
@@ -48,6 +48,6 @@
     r4: quux
     [baz2="str"]: 4
     r5: baz2
-    [baz3="bar"]: name: baz3 // TODO: treat baz3 as shadowed.
+    [baz3="bar"]: name: baz3
     "Time": time.Time
 }
\ No newline at end of file
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/api/core/v1/types_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/api/core/v1/types_go_gen.cue
index 9dc5eab..2e9aa65 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/api/core/v1/types_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/api/core/v1/types_go_gen.cue
@@ -5089,7 +5089,7 @@
 ResourceAttachableVolumesPrefix :: "attachable-volumes-"
 
 // ResourceList is a set of (resource name, quantity) pairs.
-ResourceList :: [string]: resource.Quantity
+ResourceList :: {[string]: resource.Quantity}
 
 // Node is a worker node in Kubernetes.
 // Each node will have a unique identifier in the cache (i.e. in etcd).
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/codec_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/codec_go_gen.cue
index cf0dbdd..881c325 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/codec_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/codec_go_gen.cue
@@ -5,7 +5,11 @@
 package runtime
 
 // NoopEncoder converts an Decoder to a Serializer or Codec for code that expects them but only uses decoding.
-NoopEncoder :: "Decoder": Decoder
+NoopEncoder :: {
+	"Decoder": Decoder
+}
 
 // NoopDecoder converts an Encoder to a Serializer or Codec for code that expects them but only uses encoding.
-NoopDecoder :: "Encoder": Encoder
+NoopDecoder :: {
+	"Encoder": Encoder
+}
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/helper_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/helper_go_gen.cue
index 9ffaf82..ace575c 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/helper_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/helper_go_gen.cue
@@ -15,4 +15,6 @@
 }
 
 // WithoutVersionDecoder clears the group version kind of a deserialized object.
-WithoutVersionDecoder :: "Decoder": Decoder
+WithoutVersionDecoder :: {
+	"Decoder": Decoder
+}
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/watch/filter_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/watch/filter_go_gen.cue
index 2cf6b29..244baae 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/watch/filter_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/watch/filter_go_gen.cue
@@ -5,4 +5,6 @@
 package watch
 
 // Recorder records all events that are sent from the watch until it is closed.
-Recorder :: "Interface": Interface
+Recorder :: {
+	"Interface": Interface
+}
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/watch/watch_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/watch/watch_go_gen.cue
index ebf1576..acc7cf3 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/watch/watch_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/watch/watch_go_gen.cue
@@ -44,4 +44,6 @@
 }
 
 // RaceFreeFakeWatcher lets you test anything that consumes a watch.Interface; threadsafe.
-RaceFreeFakeWatcher :: Stopped: bool
+RaceFreeFakeWatcher :: {
+	Stopped: bool
+}
diff --git a/doc/tutorial/kubernetes/quick/services/infra/watcher/kube.cue b/doc/tutorial/kubernetes/quick/services/infra/watcher/kube.cue
index 516a5cc..dc8e60c 100644
--- a/doc/tutorial/kubernetes/quick/services/infra/watcher/kube.cue
+++ b/doc/tutorial/kubernetes/quick/services/infra/watcher/kube.cue
@@ -3,23 +3,25 @@
 deployment: watcher: spec: {
 	// podTemplate defines the 'cookie cutter' used for creating
 	// new pods when necessary
-	template: spec: {
-		volumes: [{
-			name: "secret-volume"
-			secret: secretName: "star-example-com-secrets"
-		}]
-		containers: [{
-			image: "gcr.io/myproj/watcher:v0.1.0"
-			ports: [{
-				containerPort: 7080
-			}, {
-				containerPort: 7788
+	template: {
+		spec: {
+			volumes: [{
+				name: "secret-volume"
+				secret: secretName: "star-example-com-secrets"
 			}]
-			volumeMounts: [{
-				mountPath: "/etc/ssl"
-				name:      "secret-volume"
+			containers: [{
+				image: "gcr.io/myproj/watcher:v0.1.0"
+				ports: [{
+					containerPort: 7080
+				}, {
+					containerPort: 7788
+				}]
+				volumeMounts: [{
+					mountPath: "/etc/ssl"
+					name:      "secret-volume"
+				}]
 			}]
-		}]
+		}
 	}
 }
 
diff --git a/doc/tutorial/kubernetes/quick/services/mon/prometheus/configmap.cue b/doc/tutorial/kubernetes/quick/services/mon/prometheus/configmap.cue
index 7c58f18..814b924 100644
--- a/doc/tutorial/kubernetes/quick/services/mon/prometheus/configmap.cue
+++ b/doc/tutorial/kubernetes/quick/services/mon/prometheus/configmap.cue
@@ -79,7 +79,9 @@
 				// Prometheus. The discovery auth config is automatic if Prometheus runs inside
 				// the cluster. Otherwise, more config options have to be provided within the
 				// <kubernetes_sd_config>.
-				tls_config: ca_file: "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
+				tls_config: {
+					ca_file: "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
+				}
 				// If your node certificates are self-signed or use a different CA to the
 				// master CA, then disable certificate verification below. Note that
 				// certificate verification is an integral part of a secure infrastructure
@@ -116,7 +118,9 @@
 				// Prometheus. The discovery auth config is automatic if Prometheus runs inside
 				// the cluster. Otherwise, more config options have to be provided within the
 				// <kubernetes_sd_config>.
-				tls_config: ca_file: "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
+				tls_config: {
+					ca_file: "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
+				}
 				bearer_token_file: "/var/run/secrets/kubernetes.io/serviceaccount/token"
 
 				kubernetes_sd_configs: [{
@@ -162,7 +166,9 @@
 				// Prometheus. The discovery auth config is automatic if Prometheus runs inside
 				// the cluster. Otherwise, more config options have to be provided within the
 				// <kubernetes_sd_config>.
-				tls_config: ca_file: "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
+				tls_config: {
+					ca_file: "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
+				}
 				bearer_token_file: "/var/run/secrets/kubernetes.io/serviceaccount/token"
 
 				kubernetes_sd_configs: [{
diff --git a/doc/tutorial/kubernetes/quick/services/proxy/authproxy/kube.cue b/doc/tutorial/kubernetes/quick/services/proxy/authproxy/kube.cue
index 7f2556c..b158fc0 100644
--- a/doc/tutorial/kubernetes/quick/services/proxy/authproxy/kube.cue
+++ b/doc/tutorial/kubernetes/quick/services/proxy/authproxy/kube.cue
@@ -3,24 +3,26 @@
 deployment: authproxy: spec: {
 	// podTemplate defines the 'cookie cutter' used for creating
 	// new pods when necessary
-	template: spec: {
-		containers: [{
-			image: "skippy/oauth2_proxy:2.0.1"
-			ports: [{
-				containerPort: 4180
-			}]
-			args: [
-				"--config=/etc/authproxy/authproxy.cfg",
-			]
+	template: {
+		spec: {
+			containers: [{
+				image: "skippy/oauth2_proxy:2.0.1"
+				ports: [{
+					containerPort: 4180
+				}]
+				args: [
+					"--config=/etc/authproxy/authproxy.cfg",
+				]
 
-			volumeMounts: [{
-				name:      "config-volume"
-				mountPath: "/etc/authproxy"
+				volumeMounts: [{
+					name:      "config-volume"
+					mountPath: "/etc/authproxy"
+				}]
 			}]
-		}]
-		volumes: [{
-			name: "config-volume"
-			configMap: name: "authproxy"
-		}]
+			volumes: [{
+				name: "config-volume"
+				configMap: name: "authproxy"
+			}]
+		}
 	}
 }
diff --git a/doc/tutorial/kubernetes/quick/services/proxy/goget/kube.cue b/doc/tutorial/kubernetes/quick/services/proxy/goget/kube.cue
index bdbbdcc..50548d6 100644
--- a/doc/tutorial/kubernetes/quick/services/proxy/goget/kube.cue
+++ b/doc/tutorial/kubernetes/quick/services/proxy/goget/kube.cue
@@ -3,20 +3,22 @@
 deployment: goget: spec: {
 	// podTemplate defines the 'cookie cutter' used for creating
 	// new pods when necessary
-	template: spec: {
-		volumes: [{
-			name: "secret-volume"
-			secret: secretName: "goget-secrets"
-		}]
-		containers: [{
-			image: "gcr.io/myproj/goget:v0.5.1"
-			ports: [{
-				containerPort: 7443
+	template: {
+		spec: {
+			volumes: [{
+				name: "secret-volume"
+				secret: secretName: "goget-secrets"
 			}]
-			volumeMounts: [{
-				mountPath: "/etc/ssl"
-				name:      "secret-volume"
+			containers: [{
+				image: "gcr.io/myproj/goget:v0.5.1"
+				ports: [{
+					containerPort: 7443
+				}]
+				volumeMounts: [{
+					mountPath: "/etc/ssl"
+					name:      "secret-volume"
+				}]
 			}]
-		}]
+		}
 	}
 }
diff --git a/doc/tutorial/kubernetes/quick/services/proxy/nginx/kube.cue b/doc/tutorial/kubernetes/quick/services/proxy/nginx/kube.cue
index fd1a1f6..e303488 100644
--- a/doc/tutorial/kubernetes/quick/services/proxy/nginx/kube.cue
+++ b/doc/tutorial/kubernetes/quick/services/proxy/nginx/kube.cue
@@ -3,29 +3,31 @@
 deployment: nginx: spec: {
 	// podTemplate defines the 'cookie cutter' used for creating
 	// new pods when necessary
-	template: spec: {
-		volumes: [{
-			name: "secret-volume"
-			secret: secretName: "proxy-secrets"
-		}, {
-			name: "config-volume"
-			configMap: name: "nginx"
-		}]
-		containers: [{
-			image: "nginx:1.11.10-alpine"
-			ports: [{
-				containerPort: 80
+	template: {
+		spec: {
+			volumes: [{
+				name: "secret-volume"
+				secret: secretName: "proxy-secrets"
 			}, {
-				containerPort: 443
+				name: "config-volume"
+				configMap: name: "nginx"
 			}]
-			volumeMounts: [{
-				mountPath: "/etc/ssl"
-				name:      "secret-volume"
-			}, {
-				name:      "config-volume"
-				mountPath: "/etc/nginx/nginx.conf"
-				subPath:   "nginx.conf"
+			containers: [{
+				image: "nginx:1.11.10-alpine"
+				ports: [{
+					containerPort: 80
+				}, {
+					containerPort: 443
+				}]
+				volumeMounts: [{
+					mountPath: "/etc/ssl"
+					name:      "secret-volume"
+				}, {
+					name:      "config-volume"
+					mountPath: "/etc/nginx/nginx.conf"
+					subPath:   "nginx.conf"
+				}]
 			}]
-		}]
+		}
 	}
 }