diff --git a/CHANGELOG.md b/CHANGELOG.md
index dd2fa9c49..39e77df87 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -37,6 +37,27 @@ here.**
   [docs/features/api-contract.md](docs/features/api-contract.md#report-export) and
   [ADR-0031 Amendment 1](spec/decisions/ADR-0031-serialization-vs-data-download-boundary.md).
 
+### Changed
+
+- **A bare `verify` runs the same default gate set in every port: codegen drift, prompt
+  templates and the requirement ledger.** Until now a bare run covered one gate: `meta verify`
+  and `dotnet meta verify` ran only templates, so "run `verify` in CI" did not catch generated
+  code that had fallen behind the model; `metaobjects verify` and `mvn metaobjects:verify` ran
+  only codegen, so prompt drift passed. `--db`, `--deps` and `--replay` stay opt-in, and naming a
+  subverb still runs only the gates named. A gate the run has no configuration for is skipped
+  with a one-line note instead of failing: `meta verify` without a `metaobjects.config.ts` (a config that exists but fails to load exits 2),
+  `metaobjects verify` with no `metaobjects.config.yaml` and no `--prompts`, `dotnet meta verify`
+  without `--out <dir>` and `codegen/Generators.cs` (C# has no config-resolved output directory:
+  pass `--out <dir>` in CI to get the codegen gate), `mvn metaobjects:verify` without
+  `-Dmeta.verify.templateRoot`. Pinned per port by tests that run a bare verify over drifted
+  input. **Behaviour change:** a CI step that ran a bare `verify` and relied on the narrower
+  default can now go red where it was green, because the gate it never ran now runs. Node
+  `meta` and C# gain the codegen gate (stale generated output fails), Python and Java/Kotlin
+  gain the template gate (prompt drift fails, when a template root is configured). To keep the
+  old scope, name the gate: `meta verify --templates`, `dotnet meta verify --templates`,
+  `metaobjects verify --codegen`, `mvn metaobjects:verify -Dmeta.verify.mode=codegen`. The Maven
+  `meta.verify.mode` parameter no longer defaults to `codegen`; unset means both gates.
+
 ### Fixed
 
 - **A failed `meta deps sync` no longer leaves a lock and snapshot that cannot load.** The
@@ -49,6 +70,9 @@ here.**
 
 ### Documentation
 
+- **Two doc errors corrected against the code.** `docs/recipes/mysql.md` said Python ships a
+  Postgres driver only; it ships SQLite and MySQL drivers beside it. `docs/features/api-contract.md`
+  said only TypeScript enforces the `in`-list cap of 100; every port does.
 - **The fit-assessment prompt's capability sheet is re-checked against 1.1.4 / Maven 8.1.4**
   (it read 1.0.8, last checked 2026-09-26): reporting, the requirements gate and
   `--require-implementers`, the `wire` setting and eject in every port are now listed. The hosted
diff --git a/agent-context/skills/metaobjects-audit/references/typescript.md b/agent-context/skills/metaobjects-audit/references/typescript.md
index 8c8df4696..d4b42126a 100644
--- a/agent-context/skills/metaobjects-audit/references/typescript.md
+++ b/agent-context/skills/metaobjects-audit/references/typescript.md
@@ -41,7 +41,7 @@ meta gen                        # render → 3-way merge → write (overwrites @
 meta gen --dry-run              # preview without writing
 meta gen Author Post            # scope to named entities
 meta verify --codegen           # regenerate to temp, diff vs committed output
-meta verify --templates         # check {{field}} refs vs payload VO (bare `meta verify` default)
+meta verify --templates         # check {{field}} refs vs payload VO (a bare `meta verify` runs this and `--codegen`)
 meta verify --db                # schema drift — live DB vs metadata (requires DB connection)
 meta verify --codegen --templates --db   # all three drift checks in one pass
 ```
diff --git a/agent-context/skills/metaobjects-codegen/references/csharp.md b/agent-context/skills/metaobjects-codegen/references/csharp.md
index 32395566e..6b20b40ef 100644
--- a/agent-context/skills/metaobjects-codegen/references/csharp.md
+++ b/agent-context/skills/metaobjects-codegen/references/csharp.md
@@ -89,8 +89,9 @@ in, and C# ejects land in its `codegen/generators/` beside the `.ts` copies. The
 `Codegen.csproj` compiles only `*.cs` and `tsconfig.codegen.json` only `*.ts`. Ignore the
 build output (`codegen/bin/`, `codegen/obj/`) in `.gitignore`.
 
-`dotnet meta verify` defaults to `--templates` (the FR-004 prompt/template drift
-gate, see the prompts reference); `--codegen` is the codegen-output drift gate.
+A bare `dotnet meta verify` runs `--templates` (the FR-004 prompt/template drift
+gate, see the prompts reference) and `--codegen` (the codegen-output drift gate;
+skipped with a note unless `--out <dir>` and `codegen/Generators.cs` are present).
 **Schema migration + live-DB drift are NOT `dotnet meta`** — they run through the
 Node `meta` tool (see the migration reference).
 
diff --git a/agent-context/skills/metaobjects-fit-assessment/references/capability-sheet.md b/agent-context/skills/metaobjects-fit-assessment/references/capability-sheet.md
index 0edfb382b..2f6547716 100644
--- a/agent-context/skills/metaobjects-fit-assessment/references/capability-sheet.md
+++ b/agent-context/skills/metaobjects-fit-assessment/references/capability-sheet.md
@@ -27,8 +27,8 @@ building block. Every generator is a reference helper an adopter selects, ejects
   (`server/typescript/packages/codegen-ts/src/db-emitting.ts`).
 - **The drift gate per port** — regenerate into a temp tree and diff: `meta verify --codegen`
   (TS); `mvn metaobjects:verify` (Java/Kotlin; `codegen` is the default mode); `dotnet meta
-  verify --codegen` (C#; bare `verify` means `--templates` there); `metaobjects verify` (Python;
-  `--codegen` is the default). Source: `docs/features/cli.md`.
+  verify --codegen` (C#; bare `verify` runs it when `--out` and `codegen/Generators.cs` are present);
+  `metaobjects verify` (Python; `--codegen` is part of the default). Source: `docs/features/cli.md`.
 - **Generated code compiles**: a codegen-compile gate compiles every port's emitted model tier
   with its real compiler in CI (`docs/CONFORMANCE.md`, "Split coverage").
 - **Sharing a model** (`docs/features/metadata-dependencies.md`): in one repository, every port
diff --git a/agent-context/skills/metaobjects-verify/SKILL.md b/agent-context/skills/metaobjects-verify/SKILL.md
index bfaf94355..54ffb4673 100644
--- a/agent-context/skills/metaobjects-verify/SKILL.md
+++ b/agent-context/skills/metaobjects-verify/SKILL.md
@@ -92,15 +92,16 @@ JSON. A pass that did not run reports `status: "skipped"` and why, so an empty l
 always means "found nothing", never "never looked"; what the payload does not carry
 is named in its own `notRepresented[]`.
 
-**A bare `verify` is a partial check, not the full gate.** The Node/C# default runs
-only `--templates`; Java/Python's bare default runs only `--codegen` — either way,
-paired with the advisory anti-pattern pass above, never all three subverbs. Treat a
-bare run as a smoke test: the real done-check is running the subverbs your project
-uses explicitly — `verify --codegen`, and, where a DB exists, `verify --db <url>`.
-The Node `meta verify` ends every run, bare or not, with a `not run:` line naming
-each gate it skipped and the flag that selects it; on a model with no templates a
-bare run checks nothing but the requirement ledger and still exits 0, so never
-wire a bare `meta verify` into CI as the whole gate.
+**A bare `verify` runs the code gates, not the database gate.** In every port a bare
+run covers codegen drift (stale generated code), prompt-template drift and the
+requirement ledger, paired with the advisory anti-pattern pass above. `verify --db
+<url>`, `--deps` and `--replay` stay opt-in (`--db` is Node `meta` only). A bare run
+skips a gate it has no configuration for and says so in one line: Node `meta` with
+no `metaobjects.config.ts`, Python with no `metaobjects.config.yaml`, `dotnet meta`
+with no `--out <dir>` or `codegen/Generators.cs`, Maven with no `templateRoot`. The
+Node `meta verify` ends every run, bare or not, with a `not run:` line naming each
+gate it skipped and the flag that selects it; read it, because a skipped gate is a
+gate that did not guard the build.
 
 ## Requirements are checked on every run
 
diff --git a/docs/features/api-contract.md b/docs/features/api-contract.md
index 75422eb20..91cbcf3fe 100644
--- a/docs/features/api-contract.md
+++ b/docs/features/api-contract.md
@@ -197,9 +197,10 @@ ports accept leading wildcards, which is exactly why it is listed here as a
 TS-only extension).
 
 The **`in`-list size cap** (reject an `in` list longer than 100 → HTTP 400) is a
-safety limit, not a feature — TS enforces it, the other ports currently do not.
-Unifying that cap cross-port is the one item here worth doing regardless of
-feature demand (it is a consistency/safety divergence, not a capability).
+safety limit, not a feature, and every port enforces it: TypeScript
+(`DEFAULT_MAX_IN_LIST` in the `runtime-ts` filter parser), Python (`MAX_IN_LIST`),
+Java (`FilterParser.MAX_IN_LIST`), C# (`FilterParser.MaxInList`) and Kotlin (a generated
+file-private constant that matches the TypeScript default).
 
 ### TS-only error responses (not part of the cross-port contract)
 
diff --git a/docs/features/cli.md b/docs/features/cli.md
index 2ee3965e0..963644148 100644
--- a/docs/features/cli.md
+++ b/docs/features/cli.md
@@ -30,15 +30,15 @@ command surface splits in two:
 | **Schema migrate** | **Node `meta`** | `meta migrate` | **any backend** — schema is Node-only (ADR-0015) |
 | **Schema drift** (`verify --db`) | **Node `meta`** | `meta verify --db` | **any backend** — live-DB drift, Node-only |
 | **Codegen drift** (`verify --codegen`) | **Node `meta`** | `meta verify --codegen` | TS reference (ADR-0021 D2) — regen-to-temp + diff committed output |
-| **Template/prompt drift** (`verify --templates`) | **Node `meta`** | `meta verify --templates` | TS reference (ADR-0021 D2) — `{{field}}`↔payload; the bare-`verify` default |
+| **Template/prompt drift** (`verify --templates`) | **Node `meta`** | `meta verify --templates` | TS reference (ADR-0021 D2) — `{{field}}`↔payload; part of the bare-`verify` default |
 | **Vocabulary upgrade** (`upgrade`) | **Node `meta`** | `meta upgrade [--to <version>] [--apply]` | **any backend** — rewrites RETIRED metadata vocabulary (`@violation` → `@counterexample`, `@readOnly` → `@mutability`, dropping `@verifiedBy`) and resolves ATTRIBUTE CONTRADICTIONS (`@fields` beside `@expr` on an index key). Node-only because it edits the metadata documents themselves, which every port shares; a non-TS project runs `npx meta upgrade` against its own `metaobjects/`. **Canonical JSON and YAML alike.** Previews by default. Retirements needing a human decision are refused and the run exits non-zero, so CI cannot record a partial migration as finished |
 | **Vocabulary search** (`types`) | **Node `meta`** | `meta types [query]` | **any backend** — apropos/`kubectl explain` over the live metamodel registry (names + descriptions + when-to-use); the vocabulary is cross-port identical (registry-conformance) |
 | **Dependency sync** (`deps`) | **Node `meta`** | `meta deps sync \| check \| list` | **any backend** — resolves a declared metadata dependency's `path` transport into a committed snapshot + lock (FR-023), so `sync`/`check`/`list` themselves stay Node-only regardless of your server language. TypeScript and Python then LOAD that snapshot at every rung of their own source ladder — the two ports that implement dependency resolution in Phase 1a; Java, Kotlin, and C# don't read `dependencies` yet (Phase 2). See [`metadata-dependencies.md`](metadata-dependencies.md) |
 | **Canonical format** (`fmt`) | every port | `meta fmt` / `dotnet meta fmt` / `mvn metaobjects:fmt` / `metaobjects fmt` | (#304) ships in **every** port — the canonical serializer already exists in all five, so formatting is local, not Node-only. `--check` lists non-canonical files and exits non-zero without changing anything. Formats each file STANDALONE — own-mode, declared-here layer only (ADR-0039); an `extends` onto another file's base is preserved as-is, never resolved or erred on; a file declaring `overlay: true` anywhere — whether or not a same-file base exists — is reported as skipped rather than merged (merging would drop the overlay marker, a structural change fmt never makes). A YAML file is always skipped — no canonical YAML emitter exists (ADR-0006). Before writing, every port reloads the whole project with the candidate swapped in and refuses the write unless the reloaded model's canonical form is byte-identical to the untouched baseline — fmt never changes meaning. See [Fixture corpus](#meta-fmt--canonical-formatting-304) below and `fixtures/fmt-conformance/README.md` |
 | TS codegen | Node `meta` | `meta gen` | TS projects. **No `--template-spec` flag, deliberately** — `metaobjects.config.ts` already takes generator VALUES, so a declarative template generator is declared there (`templateGenerator()`, or `templateSpecToGenerators(parseTemplateSpec(spec))` to reuse a C#/Python spec file). Keeping it in the config is what lets `meta verify --codegen` regenerate WITH it, since that gate re-runs the config's generator list; see [declarative template scopes](codegen-concepts.md#declarative-template-scopes) |
-| C# codegen | `dotnet meta` | `dotnet meta init` / `gen` / `verify --templates` / `verify --codegen` | a .NET tool (`ToolCommandName=dotnet-meta`); invoked `dotnet meta` so it never shadows the Node `meta`; ships the ADR-0021 D2 subverbs (`--db` rejected, exit 2; bare `verify` = `--templates`). **The generator list is `codegen/Generators.cs`** (ADR-0034 Amendment 9): `dotnet meta init` writes it with `codegen/Program.cs` (two lines that run it) and `codegen/Codegen.csproj`, and `gen` / `verify --codegen` always run it through `dotnet run --project codegen`. With no `codegen/Generators.cs` they exit 2 and write nothing; `--generators` only narrows the list to declared entries. Every entry may set its own output directory (`ApiDocsGenerator { OutDir = ... }`), and `verify --codegen` compares each one. A declarative Mustache template-spec (the cross-port JSON contract shared with Python) is one more entry, `TemplateSpecGenerator { Spec = "<json>", TemplateRoot = "<dir>" }`; `gen` no longer reads `--template-spec` or a project-root `template-spec.json`, and a run that finds either with no such entry fails before writing anything; see [declarative template scopes](codegen-concepts.md#declarative-template-scopes). `dotnet meta docs` was removed in 1.1.0: it prints the line that points at [the migration section](migrations/docs-are-generators.md#c) and exits 2 |
+| C# codegen | `dotnet meta` | `dotnet meta init` / `gen` / `verify --templates` / `verify --codegen` | a .NET tool (`ToolCommandName=dotnet-meta`); invoked `dotnet meta` so it never shadows the Node `meta`; ships the ADR-0021 D2 subverbs (`--db` rejected, exit 2; bare `verify` = `--templates` plus `--codegen` when `--out` and `codegen/Generators.cs` are present). **The generator list is `codegen/Generators.cs`** (ADR-0034 Amendment 9): `dotnet meta init` writes it with `codegen/Program.cs` (two lines that run it) and `codegen/Codegen.csproj`, and `gen` / `verify --codegen` always run it through `dotnet run --project codegen`. With no `codegen/Generators.cs` they exit 2 and write nothing; `--generators` only narrows the list to declared entries. Every entry may set its own output directory (`ApiDocsGenerator { OutDir = ... }`), and `verify --codegen` compares each one. A declarative Mustache template-spec (the cross-port JSON contract shared with Python) is one more entry, `TemplateSpecGenerator { Spec = "<json>", TemplateRoot = "<dir>" }`; `gen` no longer reads `--template-spec` or a project-root `template-spec.json`, and a run that finds either with no such entry fails before writing anything; see [declarative template scopes](codegen-concepts.md#declarative-template-scopes). `dotnet meta docs` was removed in 1.1.0: it prints the line that points at [the migration section](migrations/docs-are-generators.md#c) and exits 2 |
 | Java/Kotlin codegen | Maven plugin | `mvn metaobjects:generate` (`metaobjects:generate`) | Kotlin generators run through the same goal — see below. **No `--template-spec` flag, deliberately** — `<generator>` already loads a consumer class from the project classpath, so the declarative surface is `com.metaobjects.generator.template.TemplateScopeGenerator` wired as an ordinary `<generator>` with `<template>` / `<scope>` / `<outputPattern>` / `<templatesDir>` / `<format>` args (covers BOTH Java and Kotlin); see [declarative template scopes](codegen-concepts.md#declarative-template-scopes). The `generate` and `verify` goals are declared `threadSafe` and support parallel multi-module reactor builds (`mvn -T`) (#233) |
-| Java/Kotlin verify | Maven plugin | `mvn metaobjects:verify -Dmeta.verify.mode=codegen\|templates` (`metaobjects:verify`) | parameter-driven ADR-0021 D2 modes (one goal covers BOTH Java + Kotlin): `codegen` (default, back-compat — regen + fail on drift vs committed output, generator-neutral) / `templates` (`{{field}}`↔payload drift via the render `Verify` engine). `db` rejected ("schema verify is the migrate engine, ADR-0015") |
+| Java/Kotlin verify | Maven plugin | `mvn metaobjects:verify -Dmeta.verify.mode=codegen\|templates` (`metaobjects:verify`) | parameter-driven ADR-0021 D2 modes (one goal covers BOTH Java + Kotlin): unset (default — `codegen` and `templates`; the template gate is skipped with a note when `templateRoot` is unset) / `codegen` (regen + fail on drift vs committed output, generator-neutral) / `templates` (`{{field}}`↔payload drift via the render `Verify` engine). `db` rejected ("schema verify is the migrate engine, ADR-0015") |
 | Python codegen | console-script | `metaobjects gen` / `verify --codegen` / `verify --templates` | `[project.scripts] metaobjects` — **not** `meta` (that's the Node schema CLI); ships the ADR-0021 D2 subverbs (`--db` rejected, exit 2). **The generator list is `metaobjects.config.yaml`** (ADR-0034 Amendment 9, [below](#declarative-config-metaobjectsconfigyaml--python-codegen)): `gen` and `verify --codegen` run each target's `generators` (and its `templateSpec`, the declarative Mustache template-codegen surface shared with C#) into its `outDir`, and with no config they exit 2 and write nothing. `--generators` only narrows the list to declared entries. `metaobjects docs` was removed in 1.1.0: it prints the line that points at [the migration section](migrations/docs-are-generators.md#python) and exits 2 |
 
 ## `verify` is one verb with explicit subverbs (ADR-0021 D2)
@@ -62,9 +62,19 @@ Rules of the contract:
 - **Combinations aggregate.** Pass any mix (`verify --db --codegen --templates`);
   each selected mode runs and the **exit code is non-zero if *any* mode reports
   drift**.
-- **Bare `verify` = the port's documented back-compat default.** TS/C# default to
-  `--templates`; Java/Python default to `--codegen`. In every case bare `verify`
-  also prints a one-line note advertising the explicit subverbs.
+- **Bare `verify` runs the same default gate set in every port: codegen drift,
+  prompt templates and the requirement ledger.** `--db`, `--deps` and `--replay`
+  stay opt-in. A gate the run has no configuration for is skipped with a one-line
+  note, never failed: Node `meta` needs a `metaobjects.config.ts` for codegen (a config that
+  exists but fails to load is not a missing config: it exits 2 with the load error);
+  `metaobjects verify` needs a `metaobjects.config.yaml` or `--prompts <dir>` for
+  templates; `dotnet meta verify` needs `--out <dir>` and `codegen/Generators.cs`
+  for codegen; `mvn metaobjects:verify` needs `-Dmeta.verify.templateRoot` for
+  templates. Naming a subverb still runs only the gates named. Bare `verify` also
+  prints a one-line note advertising the explicit subverbs. *Before this, a bare
+  run covered one gate (TS/C#: templates; Java/Python: codegen), so a CI step that
+  said only "run `verify`" did not catch stale generated code in TS or C#, or
+  prompt drift in Python and Java.*
 - **`--codegen` needs to know where the committed output lives.** It diffs
   against the configured `outDir` (and any per-target `outDir`) from
   `metaobjects.config.ts`. With no config it errors clearly (exit 2) rather than
@@ -192,20 +202,22 @@ which is a stricter answer to the same question and stays as it is.
 
 **Port status (staged per ADR-0021):** the **TypeScript Node `meta` is the
 reference** and implements all three subverbs today. **Python `metaobjects`
-ships the subverbs**: `verify --codegen` (regen-to-temp + diff vs `--out`, the
-historical default), `verify --templates` (each `template.*` node's `{{field}}`
+ships the subverbs**: `verify --codegen` (regen-to-temp + diff vs `--out`), `verify --templates` (each `template.*` node's `{{field}}`
 ↔ payload-VO field tree via the render `verify()` gate, resolving refs through a
 filesystem provider rooted at `--prompts`), and `verify --db` which is
 **cleanly rejected with exit 2** ("schema verify is the migrate engine,
-ADR-0015"). Bare `verify` stays `--codegen` for back-compat. The **C# `dotnet
+ADR-0015"). Bare `verify` runs `--codegen` and `--templates` (the template gate is skipped
+with a note when the run names no config and no `--prompts`). The **C# `dotnet
 meta`** port likewise ships the codegen-side subverbs: `verify --templates` (its
-historical template/prompt drift gate, the C# back-compat default), `verify
+historical template/prompt drift gate), `verify
 --codegen` (regenerate the configured generators to a temp dir and diff against
 the committed `--out` tree, never touching it), and a **clean `--db` rejection
-(exit 2)** — bare `dotnet meta verify` keeps `--templates` and prints the subverb
-note. The **Java/Kotlin `mvn metaobjects:verify`** port expresses the same vocabulary as a
-`mode` parameter (Maven goals are parameter-driven, not flag-driven): `-Dmeta.verify.mode=codegen`
-(default, byte-identical to the historical goal — regen-to-temp + diff vs committed
+(exit 2)** — bare `dotnet meta verify` runs `--templates` and, when `--out` and
+`codegen/Generators.cs` are present, `--codegen` (C# has no config-resolved output dir, so a bare run without `--out <dir>` skips the codegen gate with a note — pass `--out` in CI), and prints the subverb note. The **Java/Kotlin `mvn metaobjects:verify`** port expresses the same vocabulary as a
+`mode` parameter (Maven goals are parameter-driven, not flag-driven). With `mode` unset the goal
+runs both gates below, skipping the template gate with a note when no `templateRoot` is set.
+`-Dmeta.verify.mode=codegen`
+(codegen only, byte-identical to the historical goal — regen-to-temp + diff vs committed
 output; drift is computed per **unique `outputDir`** over the whole `<generators>`
 selection, so several generators may share one `outputDir` without cross-flagging each
 other's committed files as stale) and `-Dmeta.verify.mode=templates` (each `template.*` node's `{{field}}`↔payload-VO
@@ -395,8 +407,8 @@ targets:
   `--target <name>` scopes the run to a single target; `--generators <names>` narrows it to
   the declared entries named (an owned entry matches its registry name too) and refuses a
   name no target declares. A target whose `generators` is empty writes nothing and says so.
-- **`metaobjects verify --codegen`** — including bare `verify`, since `--codegen` is the
-  Python default (see above) — regenerates the same list into a temp tree (the exact `gen`
+- **`metaobjects verify --codegen`** — also run by bare `verify`, which adds `--templates`
+  (see above) — regenerates the same list into a temp tree (the exact `gen`
   pipeline, including the cross-target duplicate-output-path guard) and diffs each **unique
   `outDir`** against the union of the co-resident targets' regen, aggregating the exit code
   (non-zero if *any* outDir has drifted). Targets sharing an `outDir` are verified together,
diff --git a/docs/ports/csharp.md b/docs/ports/csharp.md
index 6fefbd874..b372d6bbe 100644
--- a/docs/ports/csharp.md
+++ b/docs/ports/csharp.md
@@ -180,7 +180,9 @@ dotnet meta verify ./metaobjects --codegen --out ./Generated
 (FR-004): it says nothing about generated code, and it fails with exit 2 when the directory it
 is given does not exist. A bare `dotnet meta verify ./metaobjects` runs that templates gate
 against `prompts/` when it exists, else `templates/`, and fails the same way when neither
-exists; pass both subverbs to run both.
+exists. It also runs the codegen gate when `--out <dir>` and `codegen/Generators.cs` are
+present, and skips it with a note otherwise (C# has no config-resolved output directory, so
+pass `--out` in CI); name both subverbs to require both.
 
 `dotnet meta gen --list` is the catalog, and it shows what each generator requires. `routes`
 requires `entity`, `db-context` and `filter-allowlist`, because the handlers it emits
diff --git a/docs/ports/python.md b/docs/ports/python.md
index d389ac0ef..391f24da2 100644
--- a/docs/ports/python.md
+++ b/docs/ports/python.md
@@ -134,7 +134,7 @@ targets:
 
 ```bash
 metaobjects gen       # runs every target's generators into its outDir
-metaobjects verify    # drift gate; bare verify means --codegen, which regenerates the same list
+metaobjects verify    # drift gate; bare verify runs --codegen, which regenerates the same list, and --templates
 ```
 
 `verify --codegen` regenerates exactly the list `gen` runs and compares, so the two can
diff --git a/docs/recipes/mysql.md b/docs/recipes/mysql.md
index 1d7df6892..a26f83a1b 100644
--- a/docs/recipes/mysql.md
+++ b/docs/recipes/mysql.md
@@ -28,7 +28,8 @@ These tests exercise the whole list against a real MySQL 8.4 server:
 
 The FR-044 report views are read on MySQL by C# (EF Core with Pomelo), Kotlin (Exposed) and
 Java (OMDB) as well, through the persistence `report-*` scenarios; C# also serves its generated
-report routes over MySQL. Python ships a Postgres driver only (pg8000), so it is not run there.
+report routes over MySQL. Python ships SQLite (stdlib `sqlite3`) and MySQL (PyMySQL) drivers beside its
+Postgres one (pg8000), and its `ObjectManager` reads the same report views through them.
 The Cube queries for the served reports are executed against a real MySQL 8.4 by the `cube` lane
 (see [features/cube-export.md](../features/cube-export.md)).
 
diff --git a/fixtures/agent-context-conformance/java-kotlin-react-tanstack/expected/.claude/skills/metaobjects-verify/SKILL.md b/fixtures/agent-context-conformance/java-kotlin-react-tanstack/expected/.claude/skills/metaobjects-verify/SKILL.md
index bfaf94355..54ffb4673 100644
--- a/fixtures/agent-context-conformance/java-kotlin-react-tanstack/expected/.claude/skills/metaobjects-verify/SKILL.md
+++ b/fixtures/agent-context-conformance/java-kotlin-react-tanstack/expected/.claude/skills/metaobjects-verify/SKILL.md
@@ -92,15 +92,16 @@ JSON. A pass that did not run reports `status: "skipped"` and why, so an empty l
 always means "found nothing", never "never looked"; what the payload does not carry
 is named in its own `notRepresented[]`.
 
-**A bare `verify` is a partial check, not the full gate.** The Node/C# default runs
-only `--templates`; Java/Python's bare default runs only `--codegen` — either way,
-paired with the advisory anti-pattern pass above, never all three subverbs. Treat a
-bare run as a smoke test: the real done-check is running the subverbs your project
-uses explicitly — `verify --codegen`, and, where a DB exists, `verify --db <url>`.
-The Node `meta verify` ends every run, bare or not, with a `not run:` line naming
-each gate it skipped and the flag that selects it; on a model with no templates a
-bare run checks nothing but the requirement ledger and still exits 0, so never
-wire a bare `meta verify` into CI as the whole gate.
+**A bare `verify` runs the code gates, not the database gate.** In every port a bare
+run covers codegen drift (stale generated code), prompt-template drift and the
+requirement ledger, paired with the advisory anti-pattern pass above. `verify --db
+<url>`, `--deps` and `--replay` stay opt-in (`--db` is Node `meta` only). A bare run
+skips a gate it has no configuration for and says so in one line: Node `meta` with
+no `metaobjects.config.ts`, Python with no `metaobjects.config.yaml`, `dotnet meta`
+with no `--out <dir>` or `codegen/Generators.cs`, Maven with no `templateRoot`. The
+Node `meta verify` ends every run, bare or not, with a `not run:` line naming each
+gate it skipped and the flag that selects it; read it, because a skipped gate is a
+gate that did not guard the build.
 
 ## Requirements are checked on every run
 
diff --git a/fixtures/agent-context-conformance/java-react/expected/.claude/skills/metaobjects-verify/SKILL.md b/fixtures/agent-context-conformance/java-react/expected/.claude/skills/metaobjects-verify/SKILL.md
index bfaf94355..54ffb4673 100644
--- a/fixtures/agent-context-conformance/java-react/expected/.claude/skills/metaobjects-verify/SKILL.md
+++ b/fixtures/agent-context-conformance/java-react/expected/.claude/skills/metaobjects-verify/SKILL.md
@@ -92,15 +92,16 @@ JSON. A pass that did not run reports `status: "skipped"` and why, so an empty l
 always means "found nothing", never "never looked"; what the payload does not carry
 is named in its own `notRepresented[]`.
 
-**A bare `verify` is a partial check, not the full gate.** The Node/C# default runs
-only `--templates`; Java/Python's bare default runs only `--codegen` — either way,
-paired with the advisory anti-pattern pass above, never all three subverbs. Treat a
-bare run as a smoke test: the real done-check is running the subverbs your project
-uses explicitly — `verify --codegen`, and, where a DB exists, `verify --db <url>`.
-The Node `meta verify` ends every run, bare or not, with a `not run:` line naming
-each gate it skipped and the flag that selects it; on a model with no templates a
-bare run checks nothing but the requirement ledger and still exits 0, so never
-wire a bare `meta verify` into CI as the whole gate.
+**A bare `verify` runs the code gates, not the database gate.** In every port a bare
+run covers codegen drift (stale generated code), prompt-template drift and the
+requirement ledger, paired with the advisory anti-pattern pass above. `verify --db
+<url>`, `--deps` and `--replay` stay opt-in (`--db` is Node `meta` only). A bare run
+skips a gate it has no configuration for and says so in one line: Node `meta` with
+no `metaobjects.config.ts`, Python with no `metaobjects.config.yaml`, `dotnet meta`
+with no `--out <dir>` or `codegen/Generators.cs`, Maven with no `templateRoot`. The
+Node `meta verify` ends every run, bare or not, with a `not run:` line naming each
+gate it skipped and the flag that selects it; read it, because a skipped gate is a
+gate that did not guard the build.
 
 ## Requirements are checked on every run
 
diff --git a/fixtures/agent-context-conformance/python/expected/.claude/skills/metaobjects-verify/SKILL.md b/fixtures/agent-context-conformance/python/expected/.claude/skills/metaobjects-verify/SKILL.md
index bfaf94355..54ffb4673 100644
--- a/fixtures/agent-context-conformance/python/expected/.claude/skills/metaobjects-verify/SKILL.md
+++ b/fixtures/agent-context-conformance/python/expected/.claude/skills/metaobjects-verify/SKILL.md
@@ -92,15 +92,16 @@ JSON. A pass that did not run reports `status: "skipped"` and why, so an empty l
 always means "found nothing", never "never looked"; what the payload does not carry
 is named in its own `notRepresented[]`.
 
-**A bare `verify` is a partial check, not the full gate.** The Node/C# default runs
-only `--templates`; Java/Python's bare default runs only `--codegen` — either way,
-paired with the advisory anti-pattern pass above, never all three subverbs. Treat a
-bare run as a smoke test: the real done-check is running the subverbs your project
-uses explicitly — `verify --codegen`, and, where a DB exists, `verify --db <url>`.
-The Node `meta verify` ends every run, bare or not, with a `not run:` line naming
-each gate it skipped and the flag that selects it; on a model with no templates a
-bare run checks nothing but the requirement ledger and still exits 0, so never
-wire a bare `meta verify` into CI as the whole gate.
+**A bare `verify` runs the code gates, not the database gate.** In every port a bare
+run covers codegen drift (stale generated code), prompt-template drift and the
+requirement ledger, paired with the advisory anti-pattern pass above. `verify --db
+<url>`, `--deps` and `--replay` stay opt-in (`--db` is Node `meta` only). A bare run
+skips a gate it has no configuration for and says so in one line: Node `meta` with
+no `metaobjects.config.ts`, Python with no `metaobjects.config.yaml`, `dotnet meta`
+with no `--out <dir>` or `codegen/Generators.cs`, Maven with no `templateRoot`. The
+Node `meta verify` ends every run, bare or not, with a `not run:` line naming each
+gate it skipped and the flag that selects it; read it, because a skipped gate is a
+gate that did not guard the build.
 
 ## Requirements are checked on every run
 
diff --git a/fixtures/agent-context-conformance/ts-react-tanstack/expected/.claude/skills/metaobjects-audit/references/typescript.md b/fixtures/agent-context-conformance/ts-react-tanstack/expected/.claude/skills/metaobjects-audit/references/typescript.md
index 8c8df4696..d4b42126a 100644
--- a/fixtures/agent-context-conformance/ts-react-tanstack/expected/.claude/skills/metaobjects-audit/references/typescript.md
+++ b/fixtures/agent-context-conformance/ts-react-tanstack/expected/.claude/skills/metaobjects-audit/references/typescript.md
@@ -41,7 +41,7 @@ meta gen                        # render → 3-way merge → write (overwrites @
 meta gen --dry-run              # preview without writing
 meta gen Author Post            # scope to named entities
 meta verify --codegen           # regenerate to temp, diff vs committed output
-meta verify --templates         # check {{field}} refs vs payload VO (bare `meta verify` default)
+meta verify --templates         # check {{field}} refs vs payload VO (a bare `meta verify` runs this and `--codegen`)
 meta verify --db                # schema drift — live DB vs metadata (requires DB connection)
 meta verify --codegen --templates --db   # all three drift checks in one pass
 ```
diff --git a/fixtures/agent-context-conformance/ts-react-tanstack/expected/.claude/skills/metaobjects-verify/SKILL.md b/fixtures/agent-context-conformance/ts-react-tanstack/expected/.claude/skills/metaobjects-verify/SKILL.md
index bfaf94355..54ffb4673 100644
--- a/fixtures/agent-context-conformance/ts-react-tanstack/expected/.claude/skills/metaobjects-verify/SKILL.md
+++ b/fixtures/agent-context-conformance/ts-react-tanstack/expected/.claude/skills/metaobjects-verify/SKILL.md
@@ -92,15 +92,16 @@ JSON. A pass that did not run reports `status: "skipped"` and why, so an empty l
 always means "found nothing", never "never looked"; what the payload does not carry
 is named in its own `notRepresented[]`.
 
-**A bare `verify` is a partial check, not the full gate.** The Node/C# default runs
-only `--templates`; Java/Python's bare default runs only `--codegen` — either way,
-paired with the advisory anti-pattern pass above, never all three subverbs. Treat a
-bare run as a smoke test: the real done-check is running the subverbs your project
-uses explicitly — `verify --codegen`, and, where a DB exists, `verify --db <url>`.
-The Node `meta verify` ends every run, bare or not, with a `not run:` line naming
-each gate it skipped and the flag that selects it; on a model with no templates a
-bare run checks nothing but the requirement ledger and still exits 0, so never
-wire a bare `meta verify` into CI as the whole gate.
+**A bare `verify` runs the code gates, not the database gate.** In every port a bare
+run covers codegen drift (stale generated code), prompt-template drift and the
+requirement ledger, paired with the advisory anti-pattern pass above. `verify --db
+<url>`, `--deps` and `--replay` stay opt-in (`--db` is Node `meta` only). A bare run
+skips a gate it has no configuration for and says so in one line: Node `meta` with
+no `metaobjects.config.ts`, Python with no `metaobjects.config.yaml`, `dotnet meta`
+with no `--out <dir>` or `codegen/Generators.cs`, Maven with no `templateRoot`. The
+Node `meta verify` ends every run, bare or not, with a `not run:` line naming each
+gate it skipped and the flag that selects it; read it, because a skipped gate is a
+gate that did not guard the build.
 
 ## Requirements are checked on every run
 
diff --git a/fixtures/agent-context-conformance/ts-requirements/expected/.claude/skills/metaobjects-audit/references/typescript.md b/fixtures/agent-context-conformance/ts-requirements/expected/.claude/skills/metaobjects-audit/references/typescript.md
index 8c8df4696..d4b42126a 100644
--- a/fixtures/agent-context-conformance/ts-requirements/expected/.claude/skills/metaobjects-audit/references/typescript.md
+++ b/fixtures/agent-context-conformance/ts-requirements/expected/.claude/skills/metaobjects-audit/references/typescript.md
@@ -41,7 +41,7 @@ meta gen                        # render → 3-way merge → write (overwrites @
 meta gen --dry-run              # preview without writing
 meta gen Author Post            # scope to named entities
 meta verify --codegen           # regenerate to temp, diff vs committed output
-meta verify --templates         # check {{field}} refs vs payload VO (bare `meta verify` default)
+meta verify --templates         # check {{field}} refs vs payload VO (a bare `meta verify` runs this and `--codegen`)
 meta verify --db                # schema drift — live DB vs metadata (requires DB connection)
 meta verify --codegen --templates --db   # all three drift checks in one pass
 ```
diff --git a/fixtures/agent-context-conformance/ts-requirements/expected/.claude/skills/metaobjects-verify/SKILL.md b/fixtures/agent-context-conformance/ts-requirements/expected/.claude/skills/metaobjects-verify/SKILL.md
index bfaf94355..54ffb4673 100644
--- a/fixtures/agent-context-conformance/ts-requirements/expected/.claude/skills/metaobjects-verify/SKILL.md
+++ b/fixtures/agent-context-conformance/ts-requirements/expected/.claude/skills/metaobjects-verify/SKILL.md
@@ -92,15 +92,16 @@ JSON. A pass that did not run reports `status: "skipped"` and why, so an empty l
 always means "found nothing", never "never looked"; what the payload does not carry
 is named in its own `notRepresented[]`.
 
-**A bare `verify` is a partial check, not the full gate.** The Node/C# default runs
-only `--templates`; Java/Python's bare default runs only `--codegen` — either way,
-paired with the advisory anti-pattern pass above, never all three subverbs. Treat a
-bare run as a smoke test: the real done-check is running the subverbs your project
-uses explicitly — `verify --codegen`, and, where a DB exists, `verify --db <url>`.
-The Node `meta verify` ends every run, bare or not, with a `not run:` line naming
-each gate it skipped and the flag that selects it; on a model with no templates a
-bare run checks nothing but the requirement ledger and still exits 0, so never
-wire a bare `meta verify` into CI as the whole gate.
+**A bare `verify` runs the code gates, not the database gate.** In every port a bare
+run covers codegen drift (stale generated code), prompt-template drift and the
+requirement ledger, paired with the advisory anti-pattern pass above. `verify --db
+<url>`, `--deps` and `--replay` stay opt-in (`--db` is Node `meta` only). A bare run
+skips a gate it has no configuration for and says so in one line: Node `meta` with
+no `metaobjects.config.ts`, Python with no `metaobjects.config.yaml`, `dotnet meta`
+with no `--out <dir>` or `codegen/Generators.cs`, Maven with no `templateRoot`. The
+Node `meta verify` ends every run, bare or not, with a `not run:` line naming each
+gate it skipped and the flag that selects it; read it, because a skipped gate is a
+gate that did not guard the build.
 
 ## Requirements are checked on every run
 
diff --git a/server/csharp/MetaObjects.Cli.Tests/CliSurfaceTests.cs b/server/csharp/MetaObjects.Cli.Tests/CliSurfaceTests.cs
index 9a09ca4ad..aaad2fe2a 100644
--- a/server/csharp/MetaObjects.Cli.Tests/CliSurfaceTests.cs
+++ b/server/csharp/MetaObjects.Cli.Tests/CliSurfaceTests.cs
@@ -118,6 +118,26 @@ public void A_bare_verify_runs_the_templates_default_its_help_describes()
         Directory.CreateDirectory(Path.Combine(_tmp, "prompts"));
         var (exit, stdout, stderr) = CliProcess.Run(_tmp, "verify", model);
         Assert.True(exit == 0, $"exit={exit}\nstderr={stderr}");
-        Assert.Contains("running --templates (default)", stdout);
+        Assert.Contains("running --templates --codegen (default)", stdout);
+    }
+
+    [Fact]
+    public void A_bare_verify_skips_the_codegen_gate_with_a_note_when_it_has_no_out_dir()
+    {
+        var model = WriteBlogModel();
+        Directory.CreateDirectory(Path.Combine(_tmp, "prompts"));
+        var (exit, stdout, stderr) = CliProcess.Run(_tmp, "verify", model);
+        Assert.True(exit == 0, $"exit={exit}\nstderr={stderr}");
+        Assert.Contains("codegen gate skipped: pass --out <dir>", stdout);
+    }
+
+    [Fact]
+    public void A_bare_verify_skips_the_codegen_gate_with_a_note_when_there_is_no_generator_list()
+    {
+        var model = WriteBlogModel();
+        Directory.CreateDirectory(Path.Combine(_tmp, "prompts"));
+        var (exit, stdout, stderr) = CliProcess.Run(_tmp, "verify", model, "--out", Path.Combine(_tmp, "generated"));
+        Assert.True(exit == 0, $"exit={exit}\nstderr={stderr}");
+        Assert.Contains("codegen gate skipped: no codegen/Generators.cs", stdout);
     }
 }
diff --git a/server/csharp/MetaObjects.Cli.Tests/VerifySubverbTests.cs b/server/csharp/MetaObjects.Cli.Tests/VerifySubverbTests.cs
index de1d182df..5ff48dc17 100644
--- a/server/csharp/MetaObjects.Cli.Tests/VerifySubverbTests.cs
+++ b/server/csharp/MetaObjects.Cli.Tests/VerifySubverbTests.cs
@@ -141,6 +141,29 @@ public void Bare_verify_defaults_to_templates_and_emits_the_subverb_note()
         Assert.True(r.EmittedDefaultNote);    // one-line note that subverbs exist
     }
 
+    // The cross-port default set: a bare verify runs the codegen gate beside templates, so
+    // "run `dotnet meta verify` in CI" fails on generated output that fell behind the model.
+    [Fact]
+    public void Bare_verify_runs_the_codegen_gate_beside_templates_and_fails_on_drift()
+    {
+        File.WriteAllText(Path.Combine(MetaDir, "meta.ai.json"), TemplateMetadata + "\n");
+        WriteTemplate("Hi {{name}}.");
+        GenSuite.Run(MetaDir, OutDir, "Acme.Generated");
+        var bare = TemplatesOpts(templates: false, codegen: true) with { Bare = true };
+
+        var clean = VerifyCommand.RunSubverbs(bare);
+        Assert.Equal(0, clean.ExitCode);
+        Assert.True(clean.RanTemplates);
+        Assert.True(clean.RanCodegen);
+        Assert.True(clean.EmittedDefaultNote);
+
+        foreach (var f in Directory.EnumerateFiles(OutDir, "*.g.cs", SearchOption.AllDirectories).Take(1))
+            File.AppendAllText(f, "\n// drift\n");
+        var drifted = VerifyCommand.RunSubverbs(bare);
+        Assert.NotEqual(0, drifted.ExitCode);
+        Assert.True(drifted.RanTemplates);
+    }
+
     // -------------------- --db rejected in C# --------------------------------
 
     [Fact]
diff --git a/server/csharp/MetaObjects.Cli/Program.cs b/server/csharp/MetaObjects.Cli/Program.cs
index 8f72a93cb..02297446a 100644
--- a/server/csharp/MetaObjects.Cli/Program.cs
+++ b/server/csharp/MetaObjects.Cli/Program.cs
@@ -357,7 +357,7 @@ static int AgentDocsRedirect()
 // `dotnet meta verify` — ADR-0021 D2 explicit subverbs. Parses --templates /
 // --codegen / --db, dispatches each requested gate via VerifyCommand.RunSubverbs
 // (pure logic), and aggregates the exit code (max; non-zero on any drift). A bare
-// `verify` keeps the historical default = templates + prints a one-line note.
+// `verify` runs the cross-port default set, templates + codegen, and prints a one-line note.
 static int RunVerify(string[] rest)
 {
     string? metadataDir = null;
@@ -429,7 +429,8 @@ static int RunVerify(string[] rest)
     // to verify clean, because nothing in an empty root can drift. With none named (bare
     // verify, or a bare --templates) it reads the same default `gen` does: prompts/ when that
     // directory exists, else templates/ — and neither existing fails the same way.
-    var wantsTemplates = templates || (!codegen && !db);
+    var bare = !templates && !codegen && !db;
+    var wantsTemplates = templates || bare;
     if (wantsTemplates)
     {
         templatesRoot ??= GenCommand.DefaultTemplateRoot();
@@ -456,11 +457,23 @@ static int RunVerify(string[] rest)
     // "no --out" usage message unchanged).
     var codegenHandedOff = false;
     var codegenHandoffExit = 0;
+    var projectRoot = metadataDir is not null
+        ? GenCommand.ProjectRootFor(metadataDir)
+        : Directory.GetCurrentDirectory();
+    // A bare verify also runs the codegen gate (the cross-port default set), but only when it
+    // has what the gate cannot do without: the committed output (--out) and a generator list.
+    // Lacking either it skips the gate with a note, where a named --codegen would refuse.
+    if (bare)
+    {
+        if (outDir is null)
+            Console.WriteLine("dotnet meta verify — codegen gate skipped: pass --out <dir> (the committed generated output to diff against) and have codegen/Generators.cs to run it");
+        else if (!CodegenHandoff.HasGeneratorList(projectRoot))
+            Console.WriteLine("dotnet meta verify — codegen gate skipped: no codegen/Generators.cs (the generator list) to regenerate from");
+        else
+            codegen = true;
+    }
     if (codegen && outDir is not null)
     {
-        var projectRoot = metadataDir is not null
-            ? GenCommand.ProjectRootFor(metadataDir)
-            : Directory.GetCurrentDirectory();
         // ADR-0034 Amendment 9: --codegen regenerates the list gen runs, so it needs that list.
         // A project without one fails this gate (exit 2) and only this gate: the requirement
         // gate below still runs, as it does on every verify.
@@ -506,6 +519,7 @@ static int RunVerify(string[] rest)
         Generators = generators,
         TemplateRoot = templateRoot,
         Templates = templates,
+        Bare = bare,
         Codegen = codegen && !codegenHandedOff,
         CodegenHandedOff = codegenHandedOff,
         Db = db,
diff --git a/server/csharp/MetaObjects.Cli/VerifyCommand.cs b/server/csharp/MetaObjects.Cli/VerifyCommand.cs
index 2640f39d0..f45a8f376 100644
--- a/server/csharp/MetaObjects.Cli/VerifyCommand.cs
+++ b/server/csharp/MetaObjects.Cli/VerifyCommand.cs
@@ -74,7 +74,7 @@ public sealed record Outcome(
 
     /// <summary>The one-line note bare <c>verify</c> prints advertising the subverbs.</summary>
     public const string SUBVERB_NOTE =
-        "dotnet meta verify — running --templates (default). Explicit subverbs: " +
+        "dotnet meta verify — running --templates --codegen (default). Explicit subverbs: " +
         "--templates (prompt drift), --codegen (regen-vs-committed drift); " +
         "--db is not supported in the C# port.";
 
@@ -154,7 +154,12 @@ public sealed record Options
         public bool CodegenHandedOff { get; init; }
 
         /// <summary>True when no explicit subverb flag was passed (bare verify).</summary>
-        public bool NoExplicitSubverb => !Templates && !Codegen && !Db && !CodegenHandedOff;
+        public bool NoExplicitSubverb => Bare || (!Templates && !Codegen && !Db && !CodegenHandedOff);
+
+        /// <summary>True when the user named no subverb. A bare verify runs the codegen gate too, in
+        /// the owned runner or here, so <see cref="Codegen"/>/<see cref="CodegenHandedOff"/> may be
+        /// set without the run having stopped being bare.</summary>
+        public bool Bare { get; init; }
     }
 
     /// <summary>The aggregate outcome of a subverb dispatch (pure; no console I/O).</summary>
@@ -187,14 +192,14 @@ public sealed record SubverbResult
     /// <summary>
     /// Dispatch the requested verify subverbs and aggregate the exit code (ADR-0021 D2).
     /// Each selected mode runs; the overall exit is the MAX (non-zero on any drift).
-    /// A bare <c>verify</c> (no explicit flag) defaults to <c>--templates</c> (back-compat)
-    /// and flags <see cref="SubverbResult.EmittedDefaultNote"/> so the caller prints the
+    /// A bare <c>verify</c> (no explicit flag) runs the default gate set, <c>--templates</c> plus
+    /// <c>--codegen</c> when the caller could configure it, and flags <see cref="SubverbResult.EmittedDefaultNote"/> so the caller prints the
     /// subverb note. <c>--db</c> is rejected with exit 2 (schema verify = the migrate engine).
     /// Pure logic — no console I/O — so it is testable.
     /// </summary>
     public static SubverbResult RunSubverbs(Options opts)
     {
-        // Bare verify defaults to templates (back-compat) + a one-line subverb note.
+        // Bare verify runs the templates gate (the codegen gate joins it in Program.cs when it can run) + a one-line subverb note.
         var defaulted = opts.NoExplicitSubverb;
         var runTemplates = opts.Templates || defaulted;
         var runCodegen = opts.Codegen;
diff --git a/server/java/maven-plugin/src/main/java/com/metaobjects/mojo/MetaDataVerifyMojo.java b/server/java/maven-plugin/src/main/java/com/metaobjects/mojo/MetaDataVerifyMojo.java
index 43c6a3be9..c5f7dc14f 100644
--- a/server/java/maven-plugin/src/main/java/com/metaobjects/mojo/MetaDataVerifyMojo.java
+++ b/server/java/maven-plugin/src/main/java/com/metaobjects/mojo/MetaDataVerifyMojo.java
@@ -62,7 +62,9 @@
  * is parameter-driven — exposes a {@code mode} parameter
  * ({@code -Dmeta.verify.mode=...}):
  * <ul>
- *   <li>{@code codegen} (DEFAULT, back-compat, byte-identical to the historical goal) —
+ *   <li>unset (DEFAULT) — the cross-port default gate set: {@code codegen}, then
+ *       {@code templates} when {@code templateRoot} is set (skipped with a note otherwise).</li>
+ *   <li>{@code codegen} (codegen only, byte-identical to the historical goal) —
  *       the regenerate-to-temp + diff-against-committed drift gate described above; covers
  *       {@code codegen-spring} AND {@code codegen-kotlin} via the shared meta:gen SPI.</li>
  *   <li>{@code templates} — template/prompt {@code {{field}}}↔payload drift, run via the
@@ -105,18 +107,20 @@ private String genGoal() {
         return GEN_GOAL;
     }
 
-    /** Verify mode: {@code codegen} (default), {@code templates}. */
+    /** Verify mode: {@code codegen}, {@code templates}; unset runs both (the default gate set). */
     static final String MODE_CODEGEN = "codegen";
     static final String MODE_TEMPLATES = "templates";
     static final String MODE_DB = "db";
 
     /**
-     * Which verify mode to run (ADR-0021 D2). {@code codegen} (default) = codegen drift;
-     * {@code templates} = template/prompt {@code {{field}}}↔payload drift. {@code db} is
-     * rejected (schema drift is the migrate engine, not the Maven port).
+     * Which verify mode to run (ADR-0021 D2). Unset (the default) runs the cross-port default
+     * gate set: codegen drift, then template drift when {@code templateRoot} is set (skipped
+     * with a note when it is not). {@code codegen} = codegen drift only; {@code templates} =
+     * template/prompt {@code {{field}}}↔payload drift only. {@code db} is rejected (schema
+     * drift is the migrate engine, not the Maven port).
      */
-    @Parameter(property = "meta.verify.mode", defaultValue = "codegen")
-    private String mode = MODE_CODEGEN;
+    @Parameter(property = "meta.verify.mode")
+    private String mode = "";
 
     public void setMode(String mode) { this.mode = mode; }
     public String getMode() { return mode; }
@@ -124,7 +128,8 @@ private String genGoal() {
     /**
      * On-disk template root the {@code templates} mode resolves each {@code @textRef}
      * against (the mustache files referenced by {@code template.prompt} nodes). Required
-     * in {@code templates} mode; ignored in {@code codegen} mode.
+     * in {@code templates} mode; ignored in {@code codegen} mode; in the default gate set
+     * it selects the template gate, which is skipped (with a note) when it is not set.
      */
     @Parameter(property = "meta.verify.templateRoot")
     private String templateRoot;
@@ -173,7 +178,12 @@ public void execute() throws MojoExecutionException, MojoFailureException {
         }
         warnIfAgentContextStale();
 
-        String m = mode == null ? MODE_CODEGEN : mode.trim();
+        advisoriesDone = false;
+        String m = mode == null ? "" : mode.trim();
+        if (m.isEmpty()) {
+            verifyDefaultSet();
+            return;
+        }
         if (MODE_TEMPLATES.equalsIgnoreCase(m)) {
             verifyTemplates();
             return;
@@ -185,13 +195,48 @@ public void execute() throws MojoExecutionException, MojoFailureException {
         }
         if (!MODE_CODEGEN.equalsIgnoreCase(m)) {
             throw new MojoFailureException(
-                    "meta:verify: unknown mode '" + mode + "'. Valid modes: 'codegen' (default), 'templates'.");
+                    "meta:verify: unknown mode '" + mode + "'. Valid modes: 'codegen', 'templates' (or unset for both).");
         }
 
         refuseSharedGeneratorDirs();
         verifyCodegen();
     }
 
+    /** Set once the field lint and requirement gate have run, so a two-gate run reports them once. */
+    private boolean advisoriesDone;
+
+    /**
+     * Mode unset: the cross-port default gate set. Codegen drift always; template drift when
+     * {@code templateRoot} is configured, else skipped with a note (there is no directory to
+     * resolve {@code @textRef}s against). Both gates run before the build fails, so one red gate
+     * does not hide the other.
+     */
+    private void verifyDefaultSet() throws MojoExecutionException, MojoFailureException {
+        refuseSharedGeneratorDirs();
+        MojoFailureException codegenFailure = null;
+        try {
+            verifyCodegen();
+        } catch (MojoFailureException e) {
+            codegenFailure = e;
+        }
+        MojoFailureException templatesFailure = null;
+        if (templateRoot == null || templateRoot.isEmpty()) {
+            getLog().info(PREFIX + "template gate skipped: no templateRoot "
+                    + "(-Dmeta.verify.templateRoot=...) to resolve @textRef against");
+        } else {
+            try {
+                verifyTemplates();
+            } catch (MojoFailureException e) {
+                templatesFailure = e;
+            }
+        }
+        if (codegenFailure != null && templatesFailure != null) {
+            throw new MojoFailureException(codegenFailure.getMessage() + "\n" + templatesFailure.getMessage());
+        }
+        if (codegenFailure != null) throw codegenFailure;
+        if (templatesFailure != null) throw templatesFailure;
+    }
+
     // ------------------------------------------------------------------------
     // the field authoring lint — advisory, every mode
     // ------------------------------------------------------------------------
@@ -202,7 +247,7 @@ public void execute() throws MojoExecutionException, MojoFailureException {
      * Warnings ONLY: this never throws and never changes the build result.
      */
     private void runFieldLintAdvisory(MetaDataLoader loader) {
-        if (noFieldLint || "1".equals(System.getenv(FieldLint.ENV_OPT_OUT))) return;
+        if (advisoriesDone || noFieldLint || "1".equals(System.getenv(FieldLint.ENV_OPT_OUT))) return;
         List<FieldLint.Finding> findings = new ArrayList<>();
         try {
             findings.addAll(FieldLint.lintReferenceFields(loader));
@@ -245,6 +290,9 @@ private static List<Path> sourceFiles(MetaDataLoader loader) {
      * @return the number of errors found; the caller fails the build once its own gate has reported
      */
     private int runRequirementGate(MetaDataLoader loader) {
+        // A default-set run reaches here once per gate; the ledger is one report, not two.
+        if (advisoriesDone) return 0;
+        advisoriesDone = true;
         RequirementCheck.Scan scan = RequirementCheck.scan(loader.getRoot(),
                 new RequirementCheck.Options(null,
                         requireImplementers || "1".equals(getEnv(ENV_REQUIRE_IMPLEMENTERS))));
@@ -323,7 +371,7 @@ private void verifyTemplates() throws MojoExecutionException, MojoFailureExcepti
     }
 
     // ------------------------------------------------------------------------
-    // mode=codegen (default) — regenerate-to-temp + diff vs committed (UNCHANGED)
+    // mode=codegen — regenerate-to-temp + diff vs committed (UNCHANGED)
     // ------------------------------------------------------------------------
 
     private void verifyCodegen() throws MojoExecutionException, MojoFailureException {
diff --git a/server/java/maven-plugin/src/test/java/com/metaobjects/mojo/MetaDataVerifyTemplatesModeTest.java b/server/java/maven-plugin/src/test/java/com/metaobjects/mojo/MetaDataVerifyTemplatesModeTest.java
index 633bcc6db..11fba6440 100644
--- a/server/java/maven-plugin/src/test/java/com/metaobjects/mojo/MetaDataVerifyTemplatesModeTest.java
+++ b/server/java/maven-plugin/src/test/java/com/metaobjects/mojo/MetaDataVerifyTemplatesModeTest.java
@@ -14,7 +14,7 @@
 /**
  * Tests {@code meta:verify -Dmeta.verify.mode=templates} — the NEW template/prompt
  * drift mode (ADR-0021 D2 fan-out) — plus the {@code mode} dispatch itself
- * (unknown / {@code db} → clear failure; default stays {@code codegen}).
+ * (unknown / {@code db} → clear failure; unset runs the codegen and template gates).
  *
  * <p>The Mojo's {@code project}/{@code execution} fields are left null so
  * {@code createProjectClassLoader()} falls back to the test classloader (which can
@@ -126,6 +126,42 @@ public void dbModeFailsAsUnsupported() throws Exception {
         }
     }
 
+    // === the default gate set (mode unset) ==================================
+
+    @Test
+    public void defaultModeRunsTheTemplateGateWhenATemplateRootIsSet() throws Exception {
+        Path templateRoot = writeTemplate("ai/greeting", "Hello {{title}} — {{subject}}");
+
+        MetaDataVerifyMojo verify = new MetaDataVerifyMojo();
+        configureTemplates(verify, templateRoot);
+        verify.setMode("");
+        try {
+            verify.execute();
+            fail("expected the default gate set to fail on template drift");
+        } catch (MojoFailureException e) {
+            assertTrue(e.getMessage().contains("ERR_VAR_NOT_ON_PAYLOAD"));
+        }
+    }
+
+    @Test
+    public void defaultModePassesWhenBothGatesAreClean() throws Exception {
+        MetaDataVerifyMojo verify = new MetaDataVerifyMojo();
+        configureTemplates(verify, writeTemplate("ai/greeting", "Hello {{title}} — {{body}}"));
+        verify.setMode("");
+        verify.execute();
+    }
+
+    @Test
+    public void defaultModeSkipsTheTemplateGateWithoutATemplateRoot() throws Exception {
+        // Not configured is not failed: the codegen gate (no generators here) still runs and passes.
+        MetaDataVerifyMojo verify = new MetaDataVerifyMojo();
+        configureTemplates(verify, Files.createTempDirectory("verify-no-root"));
+        verify.setMode("");
+        verify.setTemplateRoot(null);
+        verify.execute();
+        assertTrue(new MetaDataVerifyMojo().getMode().isEmpty());
+    }
+
     // === helpers ============================================================
 
     private static Path writeTemplate(String ref, String body) throws IOException {
diff --git a/server/python/src/metaobjects/cli.py b/server/python/src/metaobjects/cli.py
index bdbf69870..e23551624 100644
--- a/server/python/src/metaobjects/cli.py
+++ b/server/python/src/metaobjects/cli.py
@@ -21,7 +21,7 @@
       across ports):
 
         --codegen    regenerate into a temp dir + diff against the committed
-                     ``--out`` tree (Python's historical default behavior).
+                     ``--out`` tree.
                      The column naming comes from ``naming.columns`` in
                      ``.metaobjects/config.json`` (ADR-0058), the same setting
                      ``gen`` reads, so the ``names`` generator's constants match
@@ -38,9 +38,9 @@
                      migrate engine (ADR-0015), not this CLI.
 
       Combining flags runs each requested mode and aggregates the exit code
-      (non-zero if ANY mode drifts). A bare ``verify`` keeps the historical
-      default = ``--codegen`` (back-compat) and prints a one-line note that the
-      explicit subverbs exist.
+      (non-zero if ANY mode drifts). A bare ``verify`` runs ``--codegen`` and
+      ``--templates`` (the cross-port default gate set) and prints a one-line
+      note that the explicit subverbs exist.
 
 Named ``metaobjects``, NOT ``meta``: ``meta`` is the Node schema CLI. This CLI
 intentionally has NO ``migrate`` subcommand — schema is owned by the Node
@@ -2668,8 +2668,11 @@ def _verify_requirements(args: argparse.Namespace, model: "_VerifyModel | None")
 
 def _cmd_verify(args: argparse.Namespace) -> int:
     """Subverb dispatch (ADR-0021 D2). Run each requested mode; aggregate exit =
-    max (non-zero if ANY mode drifts). Bare ``verify`` (no subverb) keeps the
-    historical default = ``--codegen`` + a one-line note advertising the subverbs.
+    max (non-zero if ANY mode drifts). Bare ``verify`` (no subverb) runs the
+    cross-port default gate set, ``--codegen`` + ``--templates`` (the requirement
+    ledger runs on every verify) + a one-line note advertising the subverbs.
+    ``--templates`` is skipped with a note when the run names no config and no
+    ``--prompts`` root, since there is then no template directory to resolve.
     """
     naming_refusal = _refuse_column_naming_flag(args)
     if naming_refusal is not None:
@@ -2684,12 +2687,24 @@ def _cmd_verify(args: argparse.Namespace) -> int:
 
     if not any_explicit:
         print(
-            "metaobjects verify — running --codegen (default). Explicit "
+            "metaobjects verify — running --codegen --templates (default). Explicit "
             "subverbs: --codegen (codegen drift), --templates (template/prompt "
             "drift), --db (schema drift — not supported in Python).",
             file=sys.stderr,
         )
         run_codegen = True
+        if args.metadata_dir is None:
+            has_template_root = _find_config(args) is not None
+        else:
+            has_template_root = bool(getattr(args, "templates_root", None))
+        if not has_template_root:
+            print(
+                "metaobjects verify — template gate skipped: no metaobjects.config.yaml "
+                "and no --prompts directory, so there is no template root to resolve against.",
+                file=sys.stderr,
+            )
+        else:
+            run_templates = True
 
     exit_code = 0
     gates_stderr = _RecordedStderr(sys.stderr)
@@ -2850,7 +2865,7 @@ def _build_parser() -> argparse.ArgumentParser:
         "verify",
         help=(
             "drift gate — explicit subverbs --codegen / --templates / --db "
-            "(ADR-0021 D2); bare verify defaults to --codegen"
+            "(ADR-0021 D2); bare verify runs --codegen and --templates"
         ),
     )
     verify.add_argument(
diff --git a/server/python/tests/codegen/test_cli_config_verify.py b/server/python/tests/codegen/test_cli_config_verify.py
index fb947c362..a49ff6512 100644
--- a/server/python/tests/codegen/test_cli_config_verify.py
+++ b/server/python/tests/codegen/test_cli_config_verify.py
@@ -61,7 +61,7 @@ def test_verify_codegen_bare_defaults_to_codegen(tmp_path: Path, monkeypatch) ->
     _project(tmp_path)
     monkeypatch.chdir(tmp_path)
     assert main(["gen"]) == 0
-    assert main(["verify"]) == 0  # bare verify → --codegen default, config-driven
+    assert main(["verify"]) == 0  # bare verify → --codegen (config-driven), plus --templates
 
 
 def test_verify_codegen_detects_drift_in_one_target(tmp_path: Path, capsys) -> None:
diff --git a/server/python/tests/codegen/test_cli_verify_subverbs.py b/server/python/tests/codegen/test_cli_verify_subverbs.py
index c732f89c0..d73bbbae9 100644
--- a/server/python/tests/codegen/test_cli_verify_subverbs.py
+++ b/server/python/tests/codegen/test_cli_verify_subverbs.py
@@ -10,8 +10,10 @@
   verify --db        REJECTED in the Python port (exit 2): schema verify is the
                      migrate engine (ADR-0015), not this CLI.
 
-A bare `verify` keeps the historical default = codegen (back-compat) and prints
-a one-line note advertising the explicit subverbs. Combining flags runs each and
+A bare `verify` runs the cross-port default gate set, codegen + templates (the
+requirement ledger runs on every verify), and prints a one-line note advertising
+the explicit subverbs. `--templates` is skipped with a note when the run names no
+config and no template root. Combining flags runs each and
 aggregates the exit code (non-zero if ANY drift).
 """
 
@@ -272,6 +274,32 @@ def test_bare_verify_detects_codegen_drift(tmp_path: Path) -> None:
     assert main(as_config(["verify", "--generators", GEN_SUITE, meta_dir, "--out", str(out)])) != 0
 
 
+def test_bare_verify_runs_the_template_gate(tmp_path: Path, capsys) -> None:
+    """The headline gap: bare verify used to be codegen only, so prompt drift passed CI."""
+    meta_dir = _meta_dir_with(tmp_path, _META_CLEAN)
+    troot = _templates_dir(tmp_path, "Hello {{missing}}")
+    out = tmp_path / "out"
+    out.mkdir()
+    rc = main(as_config(["verify", "--generators", GEN_SUITE, meta_dir, "--out", str(out), "--templates-root", troot]))
+    assert rc != 0
+    assert "missing" in capsys.readouterr().err
+
+
+def test_bare_verify_template_gate_passes_when_clean(tmp_path: Path) -> None:
+    meta_dir = _meta_dir_with(tmp_path, _META_CLEAN)
+    troot = _templates_dir(tmp_path, "Hello {{name}}")
+    out = tmp_path / "out"
+    assert main(as_config(["gen", "--generators", GEN_SUITE, meta_dir, "--out", str(out)])) == 0
+    assert main(as_config(["verify", "--generators", GEN_SUITE, meta_dir, "--out", str(out), "--templates-root", troot])) == 0
+
+
+def test_bare_verify_skips_templates_with_a_note_when_no_root_is_known(tmp_path: Path, capsys) -> None:
+    """Named <metadata_dir> and no --prompts: nothing to resolve refs against, so skip, do not fail."""
+    meta_dir = _meta_dir_with(tmp_path, _META_CLEAN)
+    main(["verify", "--generators", GEN_SUITE, meta_dir, "--out", str(tmp_path / "out")])
+    assert "template gate skipped" in capsys.readouterr().err
+
+
 # --- 4. --db is rejected in the Python port (exit 2) ------------------------
 
 
diff --git a/server/typescript/packages/cli/src/commands/verify.ts b/server/typescript/packages/cli/src/commands/verify.ts
index 0bc013a8c..c027beae4 100644
--- a/server/typescript/packages/cli/src/commands/verify.ts
+++ b/server/typescript/packages/cli/src/commands/verify.ts
@@ -7,6 +7,7 @@
 // silently break a prompt" guarantee, enforced at the last fixed point before
 // the text ships. Required-slot misses are warnings (don't fail the build).
 
+import { existsSync } from "node:fs";
 import { join, relative, resolve as resolvePath } from "node:path";
 import { parseVerifyArgs, type MigrateFlags } from "../lib/args.js";
 import { log } from "../lib/log.js";
@@ -199,20 +200,24 @@ export async function verifyCommand(
 
   // ADR-0021 D2 — explicit verify subverbs. Each flag selects one drift mode;
   // any combination runs each and the overall exit code is the MAX (non-zero on
-  // any drift). A bare `verify` (no explicit subverb) keeps its documented
-  // back-compat default: the template/prompt drift gate — plus a one-line note
-  // advertising the explicit subverbs.
+  // any drift). A bare `verify` (no explicit subverb) runs the cross-port default
+  // gate set: codegen drift, the template/prompt drift gate and the requirement
+  // ledger — plus a one-line note advertising the explicit subverbs. `--db`,
+  // `--deps` and `--replay` stay opt-in.
   const runTemplates = flags.templates || !flags.anyExplicit;
   // The schema gate is selected by the presence of --db, or --dialect d1 (#225 —
   // D1 has no URL connection); that check lives inside runSchemaVerify.
-  const runCodegen = flags.codegen;
+  // Selected by `--codegen`, or by a bare run that has a `metaobjects.config.ts` to
+  // regenerate from (decided below, once the config has been read). A bare run with no
+  // config skips the gate with a note instead of failing it.
+  let runCodegen = flags.codegen;
   // Task 15 — same shape as --codegen: selected ONLY by its own flag,
   // never folded into the bare-verify default (it needs the publisher
   // reachable, which CI may not have — see the VerifyFlags doc on `deps`).
   const runDeps = flags.deps;
   if (!flags.anyExplicit) {
     say(
-      "meta verify — running --templates (default). Explicit subverbs: " +
+      "meta verify — running --codegen --templates (default). Explicit subverbs: " +
         "--templates (prompt drift), --db/--dialect d1 (schema drift), " +
         "--codegen (drift of everything `generators` declares, documentation included), --deps (dependency drift), " +
         "--replay/--replay-snapshot (the committed migration chain replays from empty).",
@@ -280,6 +285,7 @@ export async function verifyCommand(
   // If absent/invalid we fall back to defaults; `--codegen` then reports a clear
   // error (it can't diff without knowing where the committed output lives).
   let forgeConfig: MetaobjectsGenConfig | undefined;
+  let configLoadError: unknown;
   try {
     forgeConfig = await loadMetaobjectsConfig(genConfigDir);
   } catch (e) {
@@ -290,12 +296,27 @@ export async function verifyCommand(
       return 2;
     }
     forgeConfig = undefined;
+    configLoadError = e;
   }
   // Both of the gen config's contributions to the load, together — see
   // `loadMemoryOptionsFrom`. Threading `providers` and forgetting `libraries` is how
   // a shipped library became unloadable through the CLI (#333).
   const configLoadOptions = loadMemoryOptionsFrom(forgeConfig);
 
+  // The bare run's codegen gate: on whenever there is a config to diff against. An
+  // adopter with metadata but no generators (nothing generated, nothing to go stale)
+  // keeps a passing bare verify; the note says what was skipped and why.
+  if (!flags.anyExplicit) {
+    if (forgeConfig !== undefined) runCodegen = true;
+    else if (existsSync(join(genConfigDir, "metaobjects.config.ts"))) {
+      log.error(
+        "meta verify: metaobjects.config.ts exists but failed to load, so the codegen gate cannot run: " +
+          (configLoadError instanceof Error ? configLoadError.message : String(configLoadError)),
+      );
+      return 2;
+    } else say("meta verify — codegen gate skipped: no metaobjects.config.ts found, so there is no generated output to diff against");
+  }
+
   // ADR-0023 strict-by-default (#96): verify loads strict unless --lax is passed,
   // so an undeclared/typo'd own @attr fails verify (matching Java's Maven goal).
   let root: Awaited<ReturnType<typeof loadMemory>>;
@@ -1964,7 +1985,7 @@ export function notRunNote(
     return flag !== undefined ? `${g.gate} (${flag})` : g.gate;
   });
   const tail = opts.bare === true
-    ? " — a bare 'meta verify' runs only the template gate (plus the requirement ledger); " +
+    ? " — a bare 'meta verify' runs the codegen and template gates (plus the requirement ledger); " +
       "name each gate to run it"
     : "";
   return `meta verify — not run: ${named.join(", ")}${tail}`;
diff --git a/server/typescript/packages/cli/src/index.ts b/server/typescript/packages/cli/src/index.ts
index 3f1b29b15..fb3327cec 100644
--- a/server/typescript/packages/cli/src/index.ts
+++ b/server/typescript/packages/cli/src/index.ts
@@ -42,7 +42,7 @@ COMMANDS:
   types [query]         Search the metadata vocabulary (types, subtypes, @attrs) by name or description
   export                Flatten loaded metadata to one canonical JSON artifact
   fmt [<file>...]       Rewrite metadata files into canonical form; --check lists drift, exits non-zero
-  verify                Drift gate — subverbs: --templates / --db / --codegen / --deps (bare = --templates)
+  verify                Drift gate — subverbs: --templates / --db / --codegen / --deps (bare = --codegen --templates)
   upgrade               Rewrite retired metadata vocabulary (previews; --apply writes)
   prompt-snapshot       Snapshot rendered template.* output; --check gates drift
   migrate               Diff metadata vs live DB; emit migration SQL files
diff --git a/server/typescript/packages/cli/src/lib/args.ts b/server/typescript/packages/cli/src/lib/args.ts
index 52be9ee20..80f626008 100644
--- a/server/typescript/packages/cli/src/lib/args.ts
+++ b/server/typescript/packages/cli/src/lib/args.ts
@@ -357,7 +357,7 @@ export interface VerifyFlags {
   // ADR-0021 D2 — explicit verify subverbs. Each selects one drift mode; any
   // combination may be passed and the exit code aggregates (non-zero on any
   // drift). The boolean flags record which modes were explicitly requested; the
-  // command layer applies the bare-verify default (= --templates) when none are.
+  // command layer applies the bare-verify default (= --codegen --templates) when none are.
   /** Run the template/prompt {{field}}↔payload drift gate. */
   templates: boolean;
   /** Run the codegen-drift gate: is the GENERATED contribution of each file current? */
diff --git a/server/typescript/packages/cli/test/__snapshots__/cli.test.ts.snap b/server/typescript/packages/cli/test/__snapshots__/cli.test.ts.snap
index 9d5be11f7..cb6959984 100644
--- a/server/typescript/packages/cli/test/__snapshots__/cli.test.ts.snap
+++ b/server/typescript/packages/cli/test/__snapshots__/cli.test.ts.snap
@@ -22,7 +22,7 @@ COMMANDS:
   types [query]         Search the metadata vocabulary (types, subtypes, @attrs) by name or description
   export                Flatten loaded metadata to one canonical JSON artifact
   fmt [<file>...]       Rewrite metadata files into canonical form; --check lists drift, exits non-zero
-  verify                Drift gate — subverbs: --templates / --db / --codegen / --deps (bare = --templates)
+  verify                Drift gate — subverbs: --templates / --db / --codegen / --deps (bare = --codegen --templates)
   upgrade               Rewrite retired metadata vocabulary (previews; --apply writes)
   prompt-snapshot       Snapshot rendered template.* output; --check gates drift
   migrate               Diff metadata vs live DB; emit migration SQL files
diff --git a/server/typescript/packages/cli/test/advisory-structured-output.test.ts b/server/typescript/packages/cli/test/advisory-structured-output.test.ts
index b10f72f22..6aa739cce 100644
--- a/server/typescript/packages/cli/test/advisory-structured-output.test.ts
+++ b/server/typescript/packages/cli/test/advisory-structured-output.test.ts
@@ -112,6 +112,18 @@ async function capture(argv: string[]): Promise<{ exit: number; out: string; err
   return { exit, out: outLines.join("\n"), err: errLines.join("\n") };
 }
 
+/**
+ * `project()` with its generated output on disk. A bare `meta verify` diffs that output
+ * against a fresh regen, so a verify test that is about the advisory sections needs the
+ * codegen gate to find nothing stale.
+ */
+async function generatedProject(extraConfig = "", baseUrlSites = 0): Promise<string> {
+  const dir = project(extraConfig, baseUrlSites);
+  const { exit } = await capture(["gen", "--cwd", dir]);
+  if (exit !== 0) throw new Error(`fixture gen failed with exit ${exit}`);
+  return dir;
+}
+
 interface FindingRow {
   file: string; line: number; rule: string; construct: string; message: string;
 }
@@ -179,7 +191,7 @@ describe("meta gen --format json carries the advisory findings", () => {
 
 describe("meta verify --format json emits a structured result", () => {
   test("stdout is one JSON document — gates, findings, and what is NOT represented", async () => {
-    const dir = project();
+    const dir = await generatedProject();
     try {
       const { exit, out, err } = await capture(["verify", "--format", "json", "--cwd", dir]);
 
@@ -217,14 +229,14 @@ describe("meta verify --format json emits a structured result", () => {
 
       // Narration moved to stderr so it cannot corrupt the document.
       expect(err).toContain("meta verify");
-      expect(out).not.toContain("running --templates");
+      expect(out).not.toContain("running --codegen --templates");
     } finally {
       rmSync(dir, { recursive: true, force: true });
     }
   }, TIMEOUT_MS);
 
   test("--format toon emits a TOON document with a tabular findings block", async () => {
-    const dir = project();
+    const dir = await generatedProject();
     try {
       const { exit, out } = await capture(["verify", "--format", "toon", "--cwd", dir]);
       expect(exit).toBe(0);
@@ -257,7 +269,7 @@ describe("text mode caps, --limit raises it, and every site honors one constant"
   }, TIMEOUT_MS);
 
   test("meta verify text output caps at the same default — one constant, not one per site", async () => {
-    const dir = project();
+    const dir = await generatedProject();
     try {
       const { exit, err } = await capture(["verify", "--format", "text", "--cwd", dir]);
       expect(exit).toBe(0);
@@ -300,7 +312,7 @@ describe("text mode caps, --limit raises it, and every site honors one constant"
     // one that silently drops the API prefix from every generated hook. Starving the small
     // list is the worse failure, so each list gets its own budget and the section total can
     // reach a multiple of the cap.
-    const dir = project(`\n  apiPrefix: "/api",`, 5);
+    const dir = await generatedProject(`\n  apiPrefix: "/api",`, 5);
     try {
       const { exit, err } = await capture(["verify", "--format", "text", "--limit", "3", "--cwd", dir]);
       expect(exit).toBe(0);
@@ -318,7 +330,7 @@ describe("text mode caps, --limit raises it, and every site honors one constant"
   }, TIMEOUT_MS);
 
   test("...and the structured payload still carries both lists in ONE section, uncapped", async () => {
-    const dir = project(`\n  apiPrefix: "/api",`, 5);
+    const dir = await generatedProject(`\n  apiPrefix: "/api",`, 5);
     try {
       const { exit, out } = await capture(["verify", "--format", "json", "--limit", "1", "--cwd", dir]);
       expect(exit).toBe(0);
@@ -333,7 +345,7 @@ describe("text mode caps, --limit raises it, and every site honors one constant"
   }, TIMEOUT_MS);
 
   test("--limit never truncates a structured payload, whatever it is set to", async () => {
-    const dir = project();
+    const dir = await generatedProject();
     try {
       const { exit, out } = await capture(["verify", "--format", "json", "--limit", "1", "--cwd", dir]);
       expect(exit).toBe(0);
@@ -597,14 +609,14 @@ describe("verify.antiPatternIgnore reaches the scan from metaobjects.config.ts",
 describe("verify wires the base-URL advisory", () => {
   const PROVIDER = `<EntityFetcherProvider fetcher={fetcher}>\n  <App />\n</EntityFetcherProvider>\n`;
 
-  function withProvider(apiPrefix: string): string {
-    const dir = project(`\n  apiPrefix: ${JSON.stringify(apiPrefix)},`);
+  async function withProvider(apiPrefix: string): Promise<string> {
+    const dir = await generatedProject(`\n  apiPrefix: ${JSON.stringify(apiPrefix)},`);
     writeFileSync(join(dir, "src", "main.tsx"), PROVIDER);
     return dir;
   }
 
   test("a non-empty apiPrefix + a provider with no baseUrl reaches the payload", async () => {
-    const dir = withProvider("/api");
+    const dir = await withProvider("/api");
     try {
       const { exit, out } = await capture(["verify", "--cwd", dir, "--format", "json"]);
       const payload = JSON.parse(out) as { antiPatterns: AdvisoryBlock };
@@ -619,7 +631,7 @@ describe("verify wires the base-URL advisory", () => {
   });
 
   test("the text header names the count and the prefix", async () => {
-    const dir = withProvider("/api");
+    const dir = await withProvider("/api");
     try {
       const { err } = await capture(["verify", "--cwd", dir]);
       expect(err).toContain("entity-fetcher provider(s) mounted with no baseUrl");
@@ -628,7 +640,7 @@ describe("verify wires the base-URL advisory", () => {
   });
 
   test("an empty apiPrefix emits nothing — the meta init scaffold is not nagged", async () => {
-    const dir = withProvider("");
+    const dir = await withProvider("");
     try {
       const { out } = await capture(["verify", "--cwd", dir, "--format", "json"]);
       const payload = JSON.parse(out) as { antiPatterns: AdvisoryBlock };
@@ -637,7 +649,7 @@ describe("verify wires the base-URL advisory", () => {
   });
 
   test("--no-antipatterns suppresses it, which is why the migration note says so", async () => {
-    const dir = withProvider("/api");
+    const dir = await withProvider("/api");
     try {
       const { out } = await capture(["verify", "--cwd", dir, "--format", "json", "--no-antipatterns"]);
       const payload = JSON.parse(out) as { antiPatterns: AdvisoryBlock };
diff --git a/server/typescript/packages/cli/test/integration/verify-subverbs.test.ts b/server/typescript/packages/cli/test/integration/verify-subverbs.test.ts
index 315553cb2..b8cf8ce3a 100644
--- a/server/typescript/packages/cli/test/integration/verify-subverbs.test.ts
+++ b/server/typescript/packages/cli/test/integration/verify-subverbs.test.ts
@@ -3,7 +3,7 @@
  *
  * Asserts the explicit-subverb contract:
  *   - `verify --templates` runs the template/prompt drift gate (clean → 0, drift → 1).
- *   - bare `verify` is back-compat (= --templates) and prints the subverb note.
+ *   - bare `verify` runs the default gate set (--codegen --templates) and prints the subverb note.
  *   - `verify --codegen` regenerates to a temp dir and diffs the committed output:
  *       committed == fresh regen → 0; generated content that has gone STALE against
  *       the metadata → 1, naming the drifted file. A hand-edited generated file is
@@ -124,8 +124,8 @@ describe("meta verify — subverbs (ADR-0021 D2)", () => {
     }
   });
 
-  // 3. Bare verify = --templates (back-compat) + prints the subverb note.
-  test("bare verify behaves as --templates and prints the subverb note", async () => {
+  // 3. Bare verify = the default gate set + prints the subverb note.
+  test("bare verify runs the template gate and prints the subverb note", async () => {
     const tmp = setupTemplateRepo("Hi {{notARealField}}.");
     try {
       expect(await run(["verify", "--cwd", tmp])).toBe(1);
diff --git a/server/typescript/packages/cli/test/verify-bare-default-gates.test.ts b/server/typescript/packages/cli/test/verify-bare-default-gates.test.ts
new file mode 100644
index 000000000..bb63a91ab
--- /dev/null
+++ b/server/typescript/packages/cli/test/verify-bare-default-gates.test.ts
@@ -0,0 +1,124 @@
+/**
+ * A bare `meta verify` runs the cross-port default gate set — codegen drift, prompt
+ * templates, the requirement ledger — so "run `meta verify` in CI" catches a model that
+ * changed without `meta gen` being re-run. `--db`, `--deps` and `--replay` stay opt-in; a
+ * project with no `metaobjects.config.ts` has nothing generated to diff, so the codegen
+ * gate is skipped with a note rather than failed. Naming a gate still runs only that gate.
+ */
+import { describe, test, expect, beforeEach, afterEach } from "bun:test";
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { run } from "../src/index.js";
+
+const entity = (extra: unknown[] = []): string => JSON.stringify({
+  "metadata.root": {
+    package: "app",
+    children: [
+      {
+        "object.entity": {
+          name: "Order",
+          children: [
+            { "source.rdb": { "@table": "orders" } },
+            { "field.long": { name: "id" } },
+            ...extra,
+            { "identity.primary": { name: "pk", "@fields": ["id"] } },
+          ],
+        },
+      },
+    ],
+  },
+});
+
+function setupRepo(opts: { withConfig: boolean }): string {
+  const root = mkdtempSync(join(tmpdir(), "verify-bare-default-"));
+  mkdirSync(join(root, "metaobjects"), { recursive: true });
+  writeFileSync(join(root, "metaobjects", "meta.app.json"), entity(), "utf8");
+  if (opts.withConfig) {
+    writeFileSync(
+      join(root, "metaobjects.config.ts"),
+      `import { defineConfig } from "@metaobjectsdev/codegen-ts";
+export default defineConfig({
+  outDir: ${JSON.stringify(join(root, "generated", "db"))},
+  dialect: "sqlite",
+  dbImport: "~/db",
+  extStyle: "none",
+  generators: ["entity"],
+});
+`,
+    );
+  }
+  return root;
+}
+
+/** Change the model after `meta gen`, leaving the generated output stale. */
+function staleTheModel(root: string): void {
+  writeFileSync(
+    join(root, "metaobjects", "meta.app.json"),
+    entity([{ "field.string": { name: "note" } }]),
+    "utf8",
+  );
+}
+
+let out: string[];
+let origLog: typeof console.log;
+let origErr: typeof console.error;
+beforeEach(() => {
+  out = [];
+  origLog = console.log;
+  origErr = console.error;
+  console.log = (...a: unknown[]) => { out.push(a.map(String).join(" ")); };
+  console.error = (...a: unknown[]) => { out.push(a.map(String).join(" ")); };
+});
+afterEach(() => {
+  console.log = origLog;
+  console.error = origErr;
+});
+
+describe("meta verify — the bare run's default gate set", () => {
+  test("bare verify fails on stale generated code", async () => {
+    const root = setupRepo({ withConfig: true });
+    try {
+      expect(await run(["gen", "--cwd", root])).toBe(0);
+      expect(await run(["verify", "--cwd", root])).toBe(0);
+      staleTheModel(root);
+      out = [];
+      expect(await run(["verify", "--cwd", root])).toBe(1);
+      expect(out.join("\n")).toContain("Order.ts");
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  test("naming --templates still runs only the template gate", async () => {
+    const root = setupRepo({ withConfig: true });
+    try {
+      expect(await run(["gen", "--cwd", root])).toBe(0);
+      staleTheModel(root);
+      expect(await run(["verify", "--cwd", root, "--templates"])).toBe(0);
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  test("a bare run with no metaobjects.config.ts skips codegen with a note and passes", async () => {
+    const root = setupRepo({ withConfig: false });
+    try {
+      expect(await run(["verify", "--cwd", root])).toBe(0);
+      expect(out.join("\n")).toContain("codegen gate skipped: no metaobjects.config.ts");
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  test("a bare run with a metaobjects.config.ts that fails to load exits 2 with the load error", async () => {
+    const root = setupRepo({ withConfig: false });
+    try {
+      writeFileSync(join(root, "metaobjects.config.ts"), `export default { this is not valid typescript`, "utf8");
+      expect(await run(["verify", "--cwd", root])).toBe(2);
+      expect(out.join("\n")).toContain("failed to load");
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+});
diff --git a/server/typescript/packages/cli/test/verify-not-run-note.test.ts b/server/typescript/packages/cli/test/verify-not-run-note.test.ts
index fc9d18d3c..86bfe0a68 100644
--- a/server/typescript/packages/cli/test/verify-not-run-note.test.ts
+++ b/server/typescript/packages/cli/test/verify-not-run-note.test.ts
@@ -84,6 +84,6 @@ describe("meta verify — a partial run names the gates that did not run", () =>
     for (const gate of ["codegen (--codegen)", "schema (--db <url>)", "deps (--deps)", "replay (--replay)"]) {
       expect(line).toContain(gate);
     }
-    expect(line).toContain("a bare 'meta verify' runs only the template gate");
+    expect(line).toContain("a bare 'meta verify' runs the codegen and template gates");
   });
 });
diff --git a/spec/decisions/ADR-0021-codegen-surface-coherence.md b/spec/decisions/ADR-0021-codegen-surface-coherence.md
index a2a75f87a..0cc15365b 100644
--- a/spec/decisions/ADR-0021-codegen-surface-coherence.md
+++ b/spec/decisions/ADR-0021-codegen-surface-coherence.md
@@ -57,6 +57,10 @@ A bare `verify` keeps a documented default per port (back-compat) but the
 explicit subverbs are the contract. C#'s current `verify` (template drift)
 becomes `verify --templates`; ports add `--codegen` for parity over time.
 
+*Amendment (unreleased): a bare `verify` no longer has a per-port default. Every port runs the
+same set (codegen drift, templates, the requirement ledger) and skips a gate it has no
+configuration for, with a note. See [cli.md](../../docs/features/cli.md).*
+
 ### D3 — Uniform generator selection by STABLE NAME + a registry + `--list`
 Generators are selected by a **stable string id** (e.g. `entity`, `routes`,
 `render-helper`, `extractor`), not by language-specific factory imports / FQNs /