404 /.well-known/mcp pages at warn tier: WELLKNOWN_BENIGN_RE is a closed 3-member set over a namespace that grows by external publication

Triaged from a live applog warn page, 2026-09-12 02:19 ART: 404 /.well-known/mcp (navigation/404), appEvents id b9d535ce-83bf-42bc-8290-332ec7796f80. VERDICT: benign, not operator-actionable, but it PAGED. Mars is not an MCP server; /.well-known/mcp is an unsolicited external DISCOVERY-CONVENTION probe, the same class as the apple-touch-icon family already dropped by ICON_PROBE_RE. It is NOT a hostile credential probe, so SCANNER_PROBE_RE is the wrong home for it. WHY IT REACHED WARN TIER (read, not inferred, src/lib/not-found-classify.ts): SCANNER_PROBE_RE line 125 matches BARE /.well-known only, deliberately - its own comment says "NOT the WELLKNOWN_BENIGN_RE RFC-file space". WELLKNOWN_BENIGN_RE (line 304) enumerates exactly three members: assetlinks.json, apple-app-site-association, security.txt. /.well-known/mcp is in neither, so it falls through to navigation/404 at warn tier and pages the rail. THE ACTUAL SHAPE OF THE GAP, which is why this is a row and not a one-line regex edit: WELLKNOWN_BENIGN_RE is a CLOSED SET over a namespace that GROWS BY EXTERNAL PUBLICATION. Every rule in that file is evidence-driven by design (.hg/.bzr are deliberately out for exactly this reason), so the set is correct the day it is written and silently one member short every time a new platform convention ships - and the only signal is a page. That is a maintenance shape, not a bug: the /.well-known namespace is IANA-registered and third parties add to it without asking us. TWO OPTIONS, NOT YET DECIDED - pick at implementation time: (1) Add /.well-known/mcp to WELLKNOWN_BENIGN_RE. Minimal, evidence-driven, consistent with how every other member got there. Costs one page per future convention, forever. (2) Treat an UNKNOWN /.well-known/* member as its own tier (info, not warn), keeping the three known-good ones benign-dropped and never silently widening to a bare-namespace allow. This ends the page-per-convention tax without blinding the namespace - a /.well-known/ path that is genuinely worth seeing still lands a row, just not a page. Option 2 is the better shape and needs the counter-argument checked: does anything Mars ADVERTISES live under /.well-known? MARS-587's advertised-URL set is the place to check, and that check must be run before 2 ships, because subtracting advertised URLs from a benign filter is exactly what MARS-587 exists to protect. DO NOT implement under the fleet-wide STOP. Filed so the finding is not silently dropped; one occurrence is thin evidence on its own, so a second hit before implementation would settle option 1 vs 2 on frequency rather than on argument.