An unreached host is never clean.
A host that was never audited has zero findings by definition. Reporting that as clean is the single most dangerous thing an audit tool can do. The forest coverage ledger treats "we could not reach it" as its own verdict and puts the number first.
Audited, no findings
The host was reached, every selected provider ran, and no rule tripped. This is the only disposition that may be read as clean.
Audited, with findings
The host was reached and at least one rule tripped. Findings carry severity, evidence, and a hand-off.
Never audited
Offline, access denied, WinRM blocked, name did not resolve, or out of scope. Zero findings, and the report says so rather than folding it into clean.
Invoke-SpnForestAudit takes an explicit computer list. Every name on the list ends in exactly one disposition, and the ledger header shows all three counts before any finding. A report whose unreached count is not zero is not a clean report, whatever the findings column says.
The reason for each unreached host is recorded so the second run can be targeted at the gap instead of repeating the whole scan.
Audit tools are judged on what they find. The incentive is to show a short findings list, and the easiest way to shorten one is to skip the hosts that are hard to reach. SpnManager makes the skipped hosts the loudest line on the page.
This also changes what "done" means for an audit: not zero findings, but zero unreached.