30-second answer

Evidence records what a collector set out to see and what it finished. Where those differ, a number in the report is a bound and is presented as one. A bound is never printed as an exact value.

Where to look before the findings

stats prints coverage before anything is evaluated:

Text
COVERAGE
  requested         2  items, permissions
  completed         2  items, permissions

requested is what the collector set out to see. completed is what it finished. Equal is complete; unequal is a bounded run, and the conclusions drawn from the gap are bounded with it.

Where bounds come from

Three of the collectors produce them by construction:

owners does not expand groups. A group owner is one principal and may be forty people, so the evidence carries expansion_complete = false and a minimum_count. A rule about "at least two administrators" reads the lower bound and may answer unknown where a naive count would have said pass.

permissions without --count-unique-scopes reports the count as not-supported. That is the truth about this run rather than a zero.

spfx page inspection is bounded by -MaxPages, declares what it managed to inspect, and marks a count that does not reconcile as invalid rather than publishing arithmetic that cannot be true.

When a bound is still enough

A lower bound settles a question whenever the bound is already past the threshold. A list known to hold at least 148,000 items is above the 100,000 limit whether or not the count finished.

The rule answers when the bound settles it and returns unknown when it does not. That is the whole discipline, and it is set out in incomplete evidence and lower bounds.

What an absent fact never becomes

An empty list in place of an error. A truncated response presented as a complete one. A zero in place of a count nobody took.

Every fact carries a collection state, and missing, not-supported and observed are different things all the way through to the report.