Four more domains, same missing www. Every certificate already covered it and every distribution already accepted it — only the DNS record was absent. Nothing in AWS reports that state, because no single service can see it.
www.csv-helper.com returned NXDOMAIN for years. The certificate already covered it and CloudFront already accepted it — every part of the fix was done except the DNS record. Then I swept the account and found four more exactly like it.
Every modern host hands you a hostname and tells you to CNAME to it — which is exactly the one thing your bare domain cannot do. The rule is one sentence from 1987, and everything since has been a workaround.