0.11.7: pin ARecordLegacy logical id; document manual main-stack patch

The 0.11.6 deploy got the cert stack through but choked on the main stack
because:

1. CFN evaluates dynamic refs in the DEPLOYED template during changeset
   creation. The old template's `{{resolve:ssm:…:1:1779216106436}}` (with a
   timestamp pin) became unresolvable once the writer rewrote the param to
   a new key. Fix: hand-patch the deployed template via
   `aws cloudformation update-stack` to replace the broken dynamic ref with
   a literal cert ARN. Done out of band — gives CDK a clean diff to deploy.

2. The original `ARecord` construct (deployed logical id `ARECORDE7B57761`,
   pointed at ght.vexom.io) was renamed in code to `ARecordLegacy`. CDK
   generated a new logical id, CFN tried to create-then-delete, and the
   create collided on the existing DNS name. Fix: `overrideLogicalId` on
   the new construct so CDK adopts the existing record without a recreate.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: StevenEmelander

CHANGELOG.md

@@ -4,6 +4,24 @@ All notable changes to this project are documented here.
 
 ## [Unreleased]
 
+## [0.11.7] - 2026-05-19
+
+Pin the legacy `ght.vexom.io` A-record's CFN logical id to its deployed value
+(`ARECORDE7B57761`). The 0.11.6 deploy got far enough to create the apex +
+`www.` ARecords, update the cross-region ExportsReader, and start the
+CloudFront distribution update — then failed when CFN tried to create
+`ARecordLegacyF2E4EB86` for ght.vexom.io while the original `ARECORDE7B57761`
+still owned that name. Same physical resource under a new construct id
+read as create-then-delete to CFN, which collides. `overrideLogicalId` lets
+CDK adopt the existing record under the new construct without a recreate.
+
+Also unblocked the deploy by manually patching the deployed main stack via
+`aws cloudformation update-stack` to replace the broken `ssm:…:1:1779216106436`
+dynamic ref with a literal cert ARN — CFN evaluates dynamic refs in the
+**deployed** template during changeset creation, and the old timestamp pin
+became unresolvable once the writer rewrote the SSM param. The literal-ARN
+detour gave CDK a clean diff to deploy from.
+
 ## [0.11.6] - 2026-05-19
 
 The **actual** fix for the cross-region writer deadlock. After staring at the

infrastructure/lib/stack.ts

@@ -213,11 +213,17 @@ export class HabitAgilityStack extends cdk.Stack {
       recordName: 'www',
       target: cfTarget,
     });
-    new route53.ARecord(this, 'ARecordLegacy', {
+    // The legacy `ght.vexom.io` record was originally a single `ARecord` construct
+    // in this stack (logical id ARECORDE7B57761). Renaming the construct would
+    // cause CFN to create-then-delete — but the create fails because the name is
+    // already taken by the existing record. Pin the logical id so CFN treats
+    // this as a no-op update on the same physical resource.
+    const aRecordLegacy = new route53.ARecord(this, 'ARecordLegacy', {
       zone: vexomZone,
       recordName: 'ght',
       target: cfTarget,
     });
+    (aRecordLegacy.node.defaultChild as cdk.CfnResource).overrideLogicalId('ARECORDE7B57761');
 
     new cdk.CfnOutput(this, 'URL', { value: 'https://habitagility.com' });
     new cdk.CfnOutput(this, 'LegacyURL', { value: 'https://ght.vexom.io' });

infrastructure/package.json

@@ -1,6 +1,6 @@
 {
   "name": "habit-agility-infrastructure",
-  "version": "0.11.6",
+  "version": "0.11.7",
   "private": true,
   "license": "MIT",
   "scripts": {

package.json

@@ -1,7 +1,7 @@
 {
   "name": "habit-agility",
   "private": true,
-  "version": "0.11.6",
+  "version": "0.11.7",
   "description": "HabitAgility — Agile-style habit tracker (sprints, burndown, retrospectives). Root tooling (lint, format, tests). Deploy lives in infrastructure/.",
   "type": "module",
   "scripts": {