Sub-ticket of VENUS-80 404-capture: demote vuln-scanner paths to bot-probe security branch (stop false-paging). GAP: KNOWN_TOP_SEGMENTS fallback keys on first segment only, so any scanner path UNDER a legit top segment (/admin/.git/config, /informes/.env, /practicas/wp-login.php, *.php) inherits own-route -> genuine-bad-route -> alert:true page. No scanner/dotfile denylist exists; X-Audit-Probe demotion only catches our own synthetic probes. FIX: add scanner-path guard BEFORE the classifyOrigin KNOWN_TOP_SEGMENTS fallback (not-found-capture.ts ~L98 pre-filter, or classifyOrigin before not-found-classify.ts:88), demote UNCONDITIONALLY to level=info/category=security + rate-limit like existing bot-probe branch (capture.ts:108-118). Patterns: (a) any path segment matching /^[.]/ EXCEPT .well-known; (b) .php suffix; (c) token denylist wp-admin/wp-login/xmlrpc/phpmyadmin/vendor/cgi-bin/actuator. Triggered by scanner hit /admin/.git/config 2026-06-29 03:38Z id b5625a54. · venus