nginx serves /404.html as internal-only (see docker/nginx.conf) so it preserves the real 404 status via error_page - any direct client fetch, including the service worker's install-time addAll, gets a 403. Since addAll is atomic, that one bad URL was failing precache of the entire app shell.