The current behavior of Composr seems to be that sitemap XML ignores underscore pages, but not the menu block (which is used on the 404 page).

Obviously, underscore pages should be ignored in the XML files as these are submitted to search engines (and upon testing, they seem to work as intended including for child pages).

The block, on the other hand, works mainly by user permissions. It may want to render underscore pages in its list (which it currently does) especially for administrators / moderators so they can quickly go to them and edit them and so they know they exist. But one may argue underscore pages should also be hidden from the menu sitemap so users do not see them. However, my personal argument is that if a page shouldn't be visible for users in the 404 menu sitemap, then appropriate permissions (and validated status) should be set on the page rather than relying solely on putting an underscore on the page name.

I'm not going to make any changes for now; I'm going to consult with Chris. Feel free to give your input.

As an additional note, I was unable to isolate your specific issue where parent pages with an underscore are hidden but child pages are not.

Well I am using the _ trick for entry pages from facebook which then redirect to the actual content. I don't want them searchable just useable. Yeah the weirdness with parent pages seems new to me, but I've just created a parent page (which I will apply permissions to to stop it being public) and that solves it for me.

Sounds good. To confirm, setting permissions is doing what you want it to do?

Yes, that does that trick. Thanks.