Sub-ticket of MARS-340 404 classifier scanner-probe gap: external vuln-scanner paths nested under a legit segment (/app/.git/config 29x paged 2026-06-29, /informes/.env, /<seg>/wp-login.php, .php) inherit own-route via top-segment fallback -> alert. Fix: pre-filter denylist demoting dotfiles (except .well-known), .php[0-9]*, token set (wp-admin/wp-login/xmlrpc/phpmyadmin/cgi-bin/vendor/actuator/.aws/.git) to a SILENT info/security tier (force-retain 365d, ZERO page) BEFORE the top-segment fallback. Denylist must match ANY path segment (nesting), not root-anchored. Adopt Pluto's proven SCANNER_PROBE_RE as reference (PLUTO-442/446/450). Cross-fleet defect (venus VENUS-80, pluto PLUTO-450). Reversible; ambiguity still defaults to error per 404-is-error. · mars