Repoint the motir.co apex, issue the certificate, and update every external registration (manual)

Type: manual · Executor: human · NO PR — done on the user's confirmation.

The steps, in order — each RE-READS before it writes

1. Read the zone before touching it. dig motir.co A AAAA MX TXT and dig _dmarc.motir.co TXT. Expected, per MOTIR-2596's recorded table: MX to Spacemail; exactly one v=spf1; the Spacemail DKIM; the shared _dmarc; MOTIR-1155's google-site-verification=; and A/AAAA pointing at the motir-marketing Fly app.
2. ⚠️ Change ONLY the A and AAAA records, to the addresses of whichever application the ADR made the apex owner, read from fly ips list -a <app> at the time. Touch no MX and no TXT. Two v=spf1 at one name is a permanent SPF permerror that fails CLOSED and would take down human and transactional mail together; deleting the google-site-verification= record un-verifies the Search Console Domain property for every subdomain, permanently.
3. Issue the certificate. Add motir.co (and www.motir.co) to that application on Fly, and confirm issuance from the platform — fly certs show motir.co -a <app> reporting a configured, issued certificate, not a repository file.
4. Flip the deployed origins. Set the public-site origin and MOTIR_BASE_URL as secrets on the applications that read them, and read them back with fly secrets list -a <app>. This is the step that makes the deployed code do anything — until the public-site origin is set it resolves to the application origin, so canonicals stay on the host that answers and the redirects are inert.
5. Update the external registrations, in the same sitting — each breaks a live journey if it lags: Google OAuth authorised redirect URIs; Better-Auth trustedOrigins as deployed; the CLI and MCP default endpoints if either carries a baked-in origin.
6. Search Console. Submit https://motir.co/sitemap.xml. The Domain property already exists, is DNS-verified and covers both hosts — there is no property to create and no new token. Expect a transient "Couldn't fetch" for some minutes; confirm with a Googlebot-UA fetch before treating it as a fault.

⚠️ What this card does NOT do

It does not retire the motir-marketing Fly application. An earlier version of this card ended by destroying it, on the assumption that the landing was moving into motir-core. That direction is reversed — motir-marketing keeps the landing and gains /legal, so its application stays running and its machine pool is not this card's to touch.

Deployed-state assertions — read from the PLATFORM, never from a file in the repository

• dig +short motir.co A and AAAA return the chosen application's Fly addresses; dig motir.co TXT still returns exactly one v=spf1 plus the google-site-verification= record, byte-identical to step 1's reading.
• dig motir.co MX is unchanged.
• fly certs show motir.co -a <app> reports issued.
• fly secrets list -a <app> shows the origin secrets with a digest newer than the deploy.
• curl -sI https://motir.co/ returns 200, and curl -sI https://app.motir.co/explore returns a permanent redirect.
• Search Console reports the sitemap as Success.
• A test mail is sent and received both ways after the DNS edit, proving the mail records survived it.

Acceptance criteria

• Every reading above is taken and pasted into the card's close-out comment, with its timestamp — the platform's words, not a summary.
• The zone's MX and TXT records are byte-identical before and after; the diff is A + AAAA only.
• Human mail to and from zhuyue@motir.co still delivers, verified after the change.
• No step is marked done on the basis of a repository file or a dashboard screenshot alone.
• If any step 1 reading differs from what this card records, the card STOPS and the deviation is written up before anything is changed.

Context refs

• MOTIR-2596 — the apex record table and the SPF / DMARC warnings this card obeys
• MOTIR-1155 — the Search Console Domain property and its apex TXT
• MOTIR-1455 — added the A/AAAA this card repoints
• motir-core/docs/decisions/marketing-site-hosting.md §3 — why the apex takes A/AAAA rather than a CNAME