verify: track in/out MRs separately, enforce MR1 only for the "in" message

And then only when there is a sublabel.