Do not infer product capabilities from inaccessible source pointers

A tool that returns repository paths or URLs does not establish the contents of the referenced files. When authoritative source cannot be read, record the capability as unverified and do not reconstruct it from email or chat.

A generic reporting template may request policy version, evidence/source timestamps, evaluation time, and a source-disagreement flag. This is a request for reporting fields, not a claim that any product currently supplies them.