Every incident requires at least one source. Verification status is explicit: UNVERIFIED records are shown as such and never feed the Risk Index.