The frontend fallback served index.html (200) for any path not in the bundle, including paths that are plainly files: a VOD blob or segment URL that reached the node's app handler, a hashed asset from an old deploy. Behind a CDN that is poison: the app page gets cached at the file's URL for as long as the CDN keeps a 200 (a month here), and the player then reads HTML as an init segment. Paths ending in a media, script, style, image, font or data extension that are not in the bundle now 404; app routes, including handles that end in a TLD, still get the shell (cherry picked from commit 2a36b8af864c14c02d7cf1b34d9b259bfced2180)