Improve evidence classification and compact CLI reporting

docs/CHECKER_POLICY.md

@@ -4,6 +4,8 @@
 
 Every implemented check must return an explicit state:
 
+Compression capability checks additionally use `not-exposed` for a valid negotiation that did not select compression. This is not a `not-vulnerable` patch verdict.
+
 - `vulnerable`: the dedicated checker returned its documented positive marker;
 - `not-vulnerable`: the checker completed and returned its documented negative marker;
 - `suspected`: the checker found a capability or permission indicator requiring independent validation;
@@ -20,7 +22,9 @@ An exposed RPC UUID, OS banner, open port, or legacy protocol is an `EXPOSURE`,
 
 Execution completion and evidence certainty are separate: `suspected` and `inconclusive` count as completed checks, with uncertainty printed explicitly. Ordinary `skipped-*` results are excluded from the execution denominator and counted as `SKIPPED`; they never imply a negative. Failed processes, pending stages and cancellation still mark the scan partial. Closed/timed-out discovery services are completed reachability outcomes, not failed vulnerability checks; no host pipeline is queued without a reachable TCP/135 or TCP/445 service.
 
-SMBGhost's dialect/compression indicator, PrintNightmare's driver-permission probe, and noPac's PAC-size heuristic produce `suspected` results. The removed NetExec NTLM reflection module is disabled pending an adapter for its replacement.
+PrintNightmare's driver-permission probe and noPac's PAC-size heuristic produce `suspected` results. SMB compression is now measured through a bounded native, pre-login SMB2 negotiation: `exposed` / `not-exposed` describe only capability negotiation, never SMBGhost patch status. Both complete execution; neither is a vulnerability verdict. NetExec's legacy compression positive is also normalized to exposure, not critical CVE suspicion. The removed NetExec NTLM reflection module is disabled pending an adapter for its replacement.
+
+An explicit failed SMB login without module output is `skipped-auth-denied`; RPC bind access denial is `skipped-access-denied`. Neither proves patched. Zerologon's exact exhausted-attempts message yields a probabilistic `not-vulnerable` for that checker run. Its generic DCERPC exception does not prove the host is not a DC. Failed processes still yield unknown, even if partial output contains a result marker. Duration and bounded failure diagnostics are retained for troubleshooting.
 
 ## Catalog synchronization