@@ -37,6 +37,27 @@ here.**
   [docs/features/api-contract.md](docs/features/api-contract.md#report-export) and
   [ADR-0031 Amendment 1](spec/decisions/ADR-0031-serialization-vs-data-download-boundary.md).
 
+### Changed
+
+- **A bare `verify` runs the same default gate set in every port: codegen drift, prompt
+  templates and the requirement ledger.** Until now a bare run covered one gate: `meta verify`
+  and `dotnet meta verify` ran only templates, so "run `verify` in CI" did not catch generated
+  code that had fallen behind the model; `metaobjects verify` and `mvn metaobjects:verify` ran
+  only codegen, so prompt drift passed. `--db`, `--deps` and `--replay` stay opt-in, and naming a
+  subverb still runs only the gates named. A gate the run has no configuration for is skipped
+  with a one-line note instead of failing: `meta verify` without a `metaobjects.config.ts` (a config that exists but fails to load exits 2),
+  `metaobjects verify` with no `metaobjects.config.yaml` and no `--prompts`, `dotnet meta verify`
+  without `--out <dir>` and `codegen/Generators.cs` (C# has no config-resolved output directory:
+  pass `--out <dir>` in CI to get the codegen gate), `mvn metaobjects:verify` without
+  `-Dmeta.verify.templateRoot`. Pinned per port by tests that run a bare verify over drifted
+  input. **Behaviour change:** a CI step that ran a bare `verify` and relied on the narrower
+  default can now go red where it was green, because the gate it never ran now runs. Node
+  `meta` and C# gain the codegen gate (stale generated output fails), Python and Java/Kotlin
+  gain the template gate (prompt drift fails, when a template root is configured). To keep the
+  old scope, name the gate: `meta verify --templates`, `dotnet meta verify --templates`,
+  `metaobjects verify --codegen`, `mvn metaobjects:verify -Dmeta.verify.mode=codegen`. The Maven
+  `meta.verify.mode` parameter no longer defaults to `codegen`; unset means both gates.
+
 ### Fixed
 
 - **A failed `meta deps sync` no longer leaves a lock and snapshot that cannot load.** The
@@ -49,6 +70,9 @@ here.**
 
 ### Documentation
 
+- **Two doc errors corrected against the code.** `docs/recipes/mysql.md` said Python ships a
+  Postgres driver only; it ships SQLite and MySQL drivers beside it. `docs/features/api-contract.md`
+  said only TypeScript enforces the `in`-list cap of 100; every port does.
 - **The fit-assessment prompt's capability sheet is re-checked against 1.1.4 / Maven 8.1.4**
   (it read 1.0.8, last checked 2026-09-26): reporting, the requirements gate and
   `--require-implementers`, the `wire` setting and eject in every port are now listed. The hosted
 
@@ -41,7 +41,7 @@ meta gen                        # render → 3-way merge → write (overwrites @
 meta gen --dry-run              # preview without writing
 meta gen Author Post            # scope to named entities
 meta verify --codegen           # regenerate to temp, diff vs committed output
-meta verify --templates         # check {{field}} refs vs payload VO (bare `meta verify` default)
+meta verify --templates         # check {{field}} refs vs payload VO (a bare `meta verify` runs this and `--codegen`)
 meta verify --db                # schema drift — live DB vs metadata (requires DB connection)
 meta verify --codegen --templates --db   # all three drift checks in one pass
 ```
 
@@ -89,8 +89,9 @@ in, and C# ejects land in its `codegen/generators/` beside the `.ts` copies. The
 `Codegen.csproj` compiles only `*.cs` and `tsconfig.codegen.json` only `*.ts`. Ignore the
 build output (`codegen/bin/`, `codegen/obj/`) in `.gitignore`.
 
-`dotnet meta verify` defaults to `--templates` (the FR-004 prompt/template drift
-gate, see the prompts reference); `--codegen` is the codegen-output drift gate.
+A bare `dotnet meta verify` runs `--templates` (the FR-004 prompt/template drift
+gate, see the prompts reference) and `--codegen` (the codegen-output drift gate;
+skipped with a note unless `--out <dir>` and `codegen/Generators.cs` are present).
 **Schema migration + live-DB drift are NOT `dotnet meta`** — they run through the
 Node `meta` tool (see the migration reference).
 
 
@@ -27,8 +27,8 @@ building block. Every generator is a reference helper an adopter selects, ejects
   (`server/typescript/packages/codegen-ts/src/db-emitting.ts`).
 - **The drift gate per port** — regenerate into a temp tree and diff: `meta verify --codegen`
   (TS); `mvn metaobjects:verify` (Java/Kotlin; `codegen` is the default mode); `dotnet meta
-  verify --codegen` (C#; bare `verify` means `--templates` there); `metaobjects verify` (Python;
-  `--codegen` is the default). Source: `docs/features/cli.md`.
+  verify --codegen` (C#; bare `verify` runs it when `--out` and `codegen/Generators.cs` are present);
+  `metaobjects verify` (Python; `--codegen` is part of the default). Source: `docs/features/cli.md`.
 - **Generated code compiles**: a codegen-compile gate compiles every port's emitted model tier
   with its real compiler in CI (`docs/CONFORMANCE.md`, "Split coverage").
 - **Sharing a model** (`docs/features/metadata-dependencies.md`): in one repository, every port
 
@@ -92,15 +92,16 @@ JSON. A pass that did not run reports `status: "skipped"` and why, so an empty l
 always means "found nothing", never "never looked"; what the payload does not carry
 is named in its own `notRepresented[]`.
 
-**A bare `verify` is a partial check, not the full gate.** The Node/C# default runs
-only `--templates`; Java/Python's bare default runs only `--codegen` — either way,
-paired with the advisory anti-pattern pass above, never all three subverbs. Treat a
-bare run as a smoke test: the real done-check is running the subverbs your project
-uses explicitly — `verify --codegen`, and, where a DB exists, `verify --db <url>`.
-The Node `meta verify` ends every run, bare or not, with a `not run:` line naming
-each gate it skipped and the flag that selects it; on a model with no templates a
-bare run checks nothing but the requirement ledger and still exits 0, so never
-wire a bare `meta verify` into CI as the whole gate.
+**A bare `verify` runs the code gates, not the database gate.** In every port a bare
+run covers codegen drift (stale generated code), prompt-template drift and the
+requirement ledger, paired with the advisory anti-pattern pass above. `verify --db
+<url>`, `--deps` and `--replay` stay opt-in (`--db` is Node `meta` only). A bare run
+skips a gate it has no configuration for and says so in one line: Node `meta` with
+no `metaobjects.config.ts`, Python with no `metaobjects.config.yaml`, `dotnet meta`
+with no `--out <dir>` or `codegen/Generators.cs`, Maven with no `templateRoot`. The
+Node `meta verify` ends every run, bare or not, with a `not run:` line naming each
+gate it skipped and the flag that selects it; read it, because a skipped gate is a
+gate that did not guard the build.
 
 ## Requirements are checked on every run
 
 
@@ -197,9 +197,10 @@ ports accept leading wildcards, which is exactly why it is listed here as a
 TS-only extension).
 
 The **`in`-list size cap** (reject an `in` list longer than 100 → HTTP 400) is a
-safety limit, not a feature — TS enforces it, the other ports currently do not.
-Unifying that cap cross-port is the one item here worth doing regardless of
-feature demand (it is a consistency/safety divergence, not a capability).
+safety limit, not a feature, and every port enforces it: TypeScript
+(`DEFAULT_MAX_IN_LIST` in the `runtime-ts` filter parser), Python (`MAX_IN_LIST`),
+Java (`FilterParser.MAX_IN_LIST`), C# (`FilterParser.MaxInList`) and Kotlin (a generated
+file-private constant that matches the TypeScript default).
 
 ### TS-only error responses (not part of the cross-port contract)