Motir

Buy the base domain the ADR chose, point it and its wildcard at the motir-marketing Fly app, and get both certificates ISSUED — read back from the platform. No pull request; done on your confirmation, with the readings pasted here. Every statement below about the registrar's or Fly's CURRENT state is a hypothesis until you read it — the exits are written in.

Steps

1. Pick the name. Take the top candidate the ADR's Q1 shortlist reports as available (the decision); re-check it at the registrar before paying — RDAP said available at authoring time and availability is a moving fact.
2. Register it at Spaceship, the registrar that already holds motir.co (marketing-site-hosting.md §3 — no new vendor). Turn on auto-renew and registrar lock.
3. Point it at the marketing app. Read the app's addresses first — fly ips list -a motir-marketing — then create, in the new zone: apex A → the app's IPv4 and AAAA → its IPv6; * (wildcard) A/AAAA to the same, so every tenant subdomain lands on the app. (The shape motir.co's apex already uses — §3's table.)
4. Ask Fly for the two certificates and delegate the ACME challenge. fly certs add <base> -a motir-marketing and fly certs add "*.<base>" -a motir-marketing; the wildcard needs DNS-01, so create the _acme-challenge.<base> CNAME to the target fly certs add prints (a *.flydns.net name). Then fly certs check <base> and fly certs check "*.<base>" until both report the certificate issued — paste the outputs.
5. Mail hygiene for a domain that sends no mail: a TXT v=spf1 -all at the apex and a _dmarc TXT v=DMARC1; p=reject;. (This is a NEW zone — the do not write a second v=spf1 warning in marketing-site-hosting.md §3 is about motir.co's apex, which this card does not touch.)
6. Read it all back and paste: dig +short <base> A AAAA @1.1.1.1, dig +short random.<base> A @1.1.1.1, dig +short _acme-challenge.<base> CNAME @1.1.1.1, fly certs list -a motir-marketing. curl -sI https://anything.<base>/ should answer with a valid certificate — a 404 body is fine at this point (the router is a later card); a TLS error is not.

If a step's premise is wrong — the name is gone, Fly refuses the wildcard, the registrar has no AAAA — stop, paste what you saw, and comment; do not improvise a different domain shape than the ADR decided.

Acceptance criteria

• The registered domain is the one the ADR's Q1 shortlist ranked first among available names (or a comment explains the substitution), registered at Spaceship with auto-renew on.
• fly certs list -a motir-marketing shows BOTH <base> and *.<base> issued — the output is pasted on this card, dated.
• dig readings for the apex, a random subdomain and _acme-challenge are pasted, and curl -sI https://<random>.<base>/ completes a TLS handshake without a certificate error.
• The apex carries v=spf1 -all and _dmarc p=reject, read back with dig.
• No record on the motir.co zone was touched.

Context refs

• the decision — Q1 (the shortlist) and Q5 (why the wildcard on the marketing app)
• motir-core/docs/decisions/marketing-site-hosting.md §3 — the Spaceship zone, Fly A/AAAA, the motir.co apex records this card must not touch
• motir-marketing/fly.toml — the app name and org; motir-core/docs/decisions/application-hosting.md Amendment 7 — this file configures; it does not provision
• Fly — https://fly.io/docs/networking/custom-domain/ (wildcards need the _acme-challenge CNAME) · https://fly.io/docs/flyctl/certs/
• MOTIR-1455 — the earlier provisioning card that did this for motir.co, as the shape to copy