I have read that Ceibo ICEs use a Philips MCU in some special mode for emulation

Is that really some "special mode" of standard production chips, or are you thinking of the special "bond-out" chips which are specifically manufactured for use in emulators (that being one of the reasons why real emulators are expensive!)

I have read that ONCE mode simply left the ports in a hi-Z state

You couldn't call that "ONCE" - ON-Chip Emulation - that's just a way of disabling the chip so that another processor (or emulator) can take full control of the target.
That must be the ultimate in off-chip emulation! ;-)

There's some good stuff at the Macraigor site about BDM, on-chip debug, JTAG, etc, etc:
http://www.macraigor.com

In particular, check out their "Zen of BDM" paper.