docs(timapta): add timapta.org apex/www forward to ptatime.org; record dead-destination state

- timapta.org + www: proxied dummy A (192.0.2.1) + Page Rule 301 -> https://ptatime.org/$1
- All 3 PTA domains now forward to ptatime.org (6 hosts verified at CF edge)
- ptatime.org zone has zero records: all forwards land on NXDOMAIN until deployed
- timapta.org apex no longer serves the app3 site; email records untouched
- Zone IDs + page rule IDs recorded

projects/timapta.md

@@ -1,8 +1,33 @@
 # TIMAPTA — Tybee Island Maritime Academy PTA
 
 **Project owner:** Greyson's mom (PTA project)
-**Status:** LIVE (initial deployment)
+**Status:** FORWARDING TO ptatime.org (ptatime.org itself NOT yet deployed)
-**Deployed:** 2026-08-12
+**Deployed:** 2026-08-12 · **Re-pointed:** 2026-09-11
+
+## Canonical-domain change (2026-09-11)
+
+All three PTA domains now 301 to `ptatime.org`, which is the intended canonical
+domain. `ptatime.org` has an active zone but ZERO DNS records — no web, no mail —
+so every forward currently lands on a domain that does not resolve. Nothing serves
+until a site is deployed at `ptatime.org`. Only `register.timapta.org` (membership
+form on Core) is still live.
+
+| Source (apex + www) | Mechanism | Target |
+|---|---|---|
+| `timapta.org` | proxied dummy A (192.0.2.1) + Page Rule | 301 → `https://ptatime.org/$1` |
+| `ptatima.org` | proxied dummy A (192.0.2.1) + Page Rule | 301 → `https://ptatime.org/$1` |
+| `ptaoftybeeislandmaritimeeducation.org` | proxied dummy A (192.0.2.1) + Page Rule | 301 → `https://ptatime.org/$1` |
+
+Verified at the Cloudflare edge (all 6 hosts, path + query preserved):
+`GET /join/thanks?x=1` → `301 Location: https://ptatime.org/join/thanks?x=1`
+
+**timapta.org email is untouched by this change** (MX, SPF, DKIM, DMARC all intact
+and resolving; only HTTP records/Page Rules are involved).
+
+**timapta.org apex no longer serves the old site.** The apex + www A records that
+pointed at app3 were gone before this change (site returned nothing). Site files
+still exist at `/home/ippadmin/htdocs/timapta.org/` and the nginx vhost
+`timapta.org.conf` is still enabled on app3 — orphaned until removed or re-homed.
 
 ## Summary
 
@@ -15,8 +40,8 @@ MXroute with branded `mail.` and `webmail.` subdomains.
 
 | Record | Type | Value | Purpose |
 |---|---|---|---|
-| `timapta.org` | A | 152.53.241.111 | app3 site (grey-cloud) |
+| `timapta.org` | A (proxied, dummy 192.0.2.1) + Page Rule | 301 → `https://ptatime.org/$1` | forward (added 2026-09-11) |
-| `www.timapta.org` | A | 152.53.241.111 | app3 site |
+| `www.timapta.org` | A (proxied, dummy 192.0.2.1) + Page Rule | 301 → `https://ptatime.org/$1` | forward (added 2026-09-11) |
 | `ptatima.org` | A (proxied) + Page Rule | 301 → `https://ptatime.org/$1` | forward (retargeted 2026-09-11) |
 | `www.ptatima.org` | A (proxied) + Page Rule | 301 → `https://ptatime.org/$1` | forward (retargeted 2026-09-11) |
 | `ptaoftybeeislandmaritimeeducation.org` | A (proxied, dummy 192.0.2.1) + Page Rule | 301 → `https://ptatime.org/$1` | forward (added 2026-09-11) |
@@ -28,6 +53,13 @@ MXroute with branded `mail.` and `webmail.` subdomains.
 Cloudflare zone IDs:
 - timapta.org: `92d1512d07b72142551aa5306fbacb2a`
 - ptatima.org: `fe443f33606d319a35eeb473403371fe`
+- ptatime.org: `7eaa5a94be7cd74e82852f1f287a9235`
+- ptaoftybeeislandmaritimeeducation.org: `9566a9ecf7bfe5a0fad6fb808ddac616`
+
+Page rule IDs (all `forwarding_url` → `https://ptatime.org/$1`, 301):
+- timapta.org: `bce7af229a27455e7e6b0c1d2e383281` (prio 1) · www: `e36031c567a32349e19cc567e2221d5f` (prio 2)
+- ptatima.org: `a0ce055a36f1d81a124654bf71f0a156` (prio 1) · www: `149fbab978c2a869122a284c827b9e99` (prio 2)
+- ptaoftybeeislandmaritimeeducation.org: `a11f40b8da891cdde37d052e6efef981` (prio 1) · www: `d5083187d4f868f1989e50187834d146` (prio 2)
 
 ## Email (MXroute)
 
@@ -79,6 +111,8 @@ real names, meeting schedule, and a phone/address.
 
 ## Open Items / Next Steps
 
+- [ ] **Deploy a site at `ptatime.org`** — blocking; all three PTA domains 301 there and the zone has zero records
+- [ ] Decide fate of the orphaned app3 site (`/home/ippadmin/htdocs/timapta.org/` + `timapta.org.conf` vhost)
 - [ ] Move `contact@timapta.org` password into Vaultwarden
 - [ ] Activate FormSubmit endpoint (first submission + click confirmation)
 - [ ] Add real phone number + mailing address once PTA provides them
@@ -95,6 +129,14 @@ real names, meeting schedule, and a phone/address.
 - Forwarding toward `ptatime.org` (2026-09-11): `ptatime.org` zone `7eaa5a94be7cd74e82852f1f287a9235`
   exists but has ZERO DNS records — no web, no mail. Redirects land on a dead domain
   until something is deployed there.
+- Page Rule pattern `timapta.org/*` does NOT match subdomains — only the exact host.
+  Verified: `register.timapta.org` (200) and `webmail.timapta.org` (302 → MXroute
+  Roundcube) are unaffected by the new apex/www forwarding rules.
+- Adding a proxied dummy A record at the apex does NOT affect mail: MX, SPF, DKIM and
+  DMARC records are independent of the HTTP path. Confirmed resolving after the change.
+- Freshly recreated names take ~60s to appear on Cloudflare's authoritative NS. A
+  `dig @<ns>.ns.cloudflare.com` NXDOMAIN immediately after record creation is
+  propagation lag, not a failed create — re-check the API record and retry.
 - `ptatima.org` forward required a proxied dummy A record so the Cloudflare Page Rule
   can intercept before routing.
 - MXroute domain-add requires a `_da-verify-*` TXT record; the add fails until that