[nbudin]

Part of #12260 (the first of two PRs; the code cutover is the second).

What

A runbook for moving a cloudfront_intercode deployment from the Rails-rendered shell to the static framework-mode shell one convention domain at a time: deploy/staged-rollout.md.

• Prerequisites: the repository variables and the shell bucket the earlier work already added, and the access logs and 5xx alarm to watch.
• Order: P, then I once P has been quiet through a release, then the rest of the CloudFront domains, then the v9.0.0 cutover release for everything Rails serves directly. Each step is the same three Terraform variables on one distribution.
• Checks: shell from the bucket, crawler previews from Rails, sign-in, a page that needs the API, and a stale tab across a release.
• What to watch: the existing cloudfront_intercode_logging 5xx alarm, two Logs Insights queries (5xx by host and path, and 404s under /assets/), Sentry/Rollbar, and the framework-shell-release-* jobs.
• Rollback: remove the three variables and apply. It only works while releases still build the data-mode build, so the doc says what replaces it after v9.0.0.

Linked from deploy/README.md and the cloudfront_intercode README's "Rolling back".

I first thought this PR would add a 5xx alarm to the module, but cloudfront_intercode_logging already has one (with access logs), so it only needed pointing at.

Not tested

This is documentation. I checked the commands and settings against the module README, release.yml and the logging module, but I haven't run the two Logs Insights queries (the second one is new, modelled on the logging README's example) or applied the Terraform change to a real distribution.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UKBUsutvdjZU8NZsYhk9da

[github-actions]

Code Coverage Report: Only Changed Files listed

Package	Base Coverage	New Coverage	Difference
app/graphql/concerns/cms_parent_implementation.rb	🔴 45.95%	🔴 43.24%	🔴 -2.71%
app/javascript/setupI18Next.ts	🟢 89.66%	🟢 82.76%	🔴 -6.9%
Overall Coverage	🟢 67.35%	🟢 67.34%	🔴 -0.01%

Minimum allowed coverage is 0%, this run produced 67.34%