Improve evidence classification and compact CLI reporting

docs/ARCHITECTURE.md

@@ -46,6 +46,8 @@ Rules consume only this model. They do not parse terminal output and do not invo
 
 Dedicated checks are registered in `rpcscope/catalog.py`. CLI NetExec checks run in single-module, bounded live-host batches; unrelated modules remain separate processes. The five bind-only exposure methods share `METHOD=All` only when the complete unchanged set was selected. Each check keeps a separate normalized result. `longlogon` is native Python and estimates a naming precondition over CLDAP, not vulnerability or patch status.
 
+`smbghost` now uses `smb_negotiate.py`: one ordinary, unauthenticated SMB2 negotiate with bounded framing/context parsing and an absolute deadline. Compression is a capability exposure, not a CVE finding. `console.py` renders compact, optional-color host results separately from the complete saved evidence. The CLI's compact progress bar suppresses individual task lines; plain/auto modes retain diagnostic events. Per-invocation timings are retained, and recognized local RPC-dump startup failures stop further queued copies without suppressing remote errors or other checks.
+
 The registry also distinguishes interface exposure and information gathering. Accepted RPC binds are `exposed`; spooler registrations and OXID interface results are `observed`. They become informational findings rather than CVE verdicts. `CheckAttempt` preserves backend-specific evidence, and conflicting positive/negative results are highlighted directly in minimal reports.
 
 `advisories.py` contains a separate review-only metadata registry for 2020–2026 issues. `sync-cves` refreshes fixed Microsoft CNA records without changing `catalog.CHECKS`, importing code, or generating host vulnerability verdicts.

docs/CHECKER_POLICY.md

@@ -4,6 +4,8 @@
 
 Every implemented check must return an explicit state:
 
+Compression capability checks additionally use `not-exposed` for a valid negotiation that did not select compression. This is not a `not-vulnerable` patch verdict.
+
 - `vulnerable`: the dedicated checker returned its documented positive marker;
 - `not-vulnerable`: the checker completed and returned its documented negative marker;
 - `suspected`: the checker found a capability or permission indicator requiring independent validation;
@@ -20,7 +22,9 @@ An exposed RPC UUID, OS banner, open port, or legacy protocol is an `EXPOSURE`,
 
 Execution completion and evidence certainty are separate: `suspected` and `inconclusive` count as completed checks, with uncertainty printed explicitly. Ordinary `skipped-*` results are excluded from the execution denominator and counted as `SKIPPED`; they never imply a negative. Failed processes, pending stages and cancellation still mark the scan partial. Closed/timed-out discovery services are completed reachability outcomes, not failed vulnerability checks; no host pipeline is queued without a reachable TCP/135 or TCP/445 service.
 
-SMBGhost's dialect/compression indicator, PrintNightmare's driver-permission probe, and noPac's PAC-size heuristic produce `suspected` results. The removed NetExec NTLM reflection module is disabled pending an adapter for its replacement.
+PrintNightmare's driver-permission probe and noPac's PAC-size heuristic produce `suspected` results. SMB compression is now measured through a bounded native, pre-login SMB2 negotiation: `exposed` / `not-exposed` describe only capability negotiation, never SMBGhost patch status. Both complete execution; neither is a vulnerability verdict. NetExec's legacy compression positive is also normalized to exposure, not critical CVE suspicion. The removed NetExec NTLM reflection module is disabled pending an adapter for its replacement.
+
+An explicit failed SMB login without module output is `skipped-auth-denied`; RPC bind access denial is `skipped-access-denied`. Neither proves patched. Zerologon's exact exhausted-attempts message yields a probabilistic `not-vulnerable` for that checker run. Its generic DCERPC exception does not prove the host is not a DC. Failed processes still yield unknown, even if partial output contains a result marker. Duration and bounded failure diagnostics are retained for troubleshooting.
 
 ## Catalog synchronization
 

docs/NETEXEC_REVIEW.md

@@ -17,7 +17,7 @@ RPCScope continues to invoke the operator's installed executable.
 | Admin checking adds an SCM RPC exchange; our adapters use `on_login`, not `on_admin_login`. | Use `--no-admin-check` only when the installed CLI advertises support. |
 | NetExec may catch individual host exceptions and still exit zero. | Attribute known host exceptions and mark that host's check failed/unknown without invalidating other hosts. |
 | Console output can contain credential echoes, truncated module labels and unrecognized messages. | Index by canonical IP/module/port once per batch; allow known label truncation; require documented full negative markers. |
-| Reviewed MS17-010 and SMBGhost modules create IPv4 sockets. | Skip these adapters explicitly on IPv6 rather than pretending a checker executed successfully. |
+| Reviewed MS17-010 and SMBGhost modules create IPv4 sockets. | MS17-010 stays IPv4-gated. SMBGhost has been replaced by a native IPv4/IPv6 negotiation capability probe; its old positive is no longer a CVE suspicion. |
 | Local socket limits and noisy subprocesses could produce misleading outcomes or excessive temporary output. | Report local resource exhaustion as an execution failure, and actively stop over-limit output. |
 
 ## Execution and budgets
@@ -43,8 +43,10 @@ compatibility. CLI defaults select batching and leave full enum to `--deep`.
 
 ## Verification and limits
 
-The mocked 32-live-host recommended scan executes 28 NetExec check invocations
-instead of the old 352 (seven module groups, four eight-host batches). All twelve
+The mocked 32-live-host recommended scan now executes 24 NetExec check invocations
+instead of the old 352 (six module groups, four eight-host batches), plus native
+compression capability and LongLogon precondition checks. The earlier batching
+version used 28 processes. All twelve
 selected results per host remain represented; inventory and capability-help
 invocations are separate from this count. This is not a wall-clock benchmark.