📄️ The Only Missing Piece Was the DNS Record
www.csv-helper.com returned NXDOMAIN for years. The certificate already covered it and CloudFront already accepted it — every part of the fix was done except the DNS record. Then I swept the account and found four more exactly like it.
📄️ Nothing in AWS Tells You www Is Missing
Four more domains, same missing www. Every certificate already covered it and every distribution already accepted it — only the DNS record was absent. Nothing in AWS reports that state, because no single service can see it.