Prompt: transfer a .ro domain away from ird, or change its holder

Have an agent move a .ro domain registered at ird to another registrar, or hand it to a new holder (a registry "trade"), without the site or mail going dark: it verifies the registrant email if the registry needs it, snapshots the zone first, sends the one registry request after showing you exactly what the CLI charges and says, follows the request, and takes the ird zone down only once the new host resolves.

Needs: the ird CLI, logged in (transfer out, trade, registry requests, nameserver changes and email verification are CLI-only); for a trade, the domain's authorization key and the years for the new holder; access to the registrant email; dig in a shell Costs: the transfer-out request (credits_prices → domains.transfer), a trade registers the domain for the new holder for YEARS (domains.trade — the book lists per_year and per_year_swap; the CLI's quote says which), the safety copy of the zone (domains.dns-snapshot); the ird zone keeps its hourly fee (recurring.dns-zone-hourly) until disabled Group: domains & dns

Paste everything below the line into a fresh conversation. Fill in the FILL IN block first.

Task

Take DOMAIN through MODE — a transfer to another registrar, or a trade to a new holder — keeping it resolving throughout. Nothing is sent to the registry or charged until I confirm the command, and the CLI's quote where it shows one.

FILL IN

DOMAIN:     example.ro
MODE:       transfer-out      # transfer-out = another registrar takes over | trade = new holder, registration stays at ird
AUTH_KEY:   FILL IN           # trade only: the domain's authorization key
YEARS:      1                 # trade only: years registered for the new holder
ZONE_PLAN:  keep              # keep = leave the ird zone serving | disable = off ird DNS once the new host resolves

Non-negotiable rules

1. My yes before every registry command. Show the exact command, wait for my yes, run it without --yes. trade then shows a quote (per its help): paste it verbatim, wait again. Whether transfer out prompts is not in its help.
2. Snapshot before any registry request. The zone is on disk before step E runs.
3. The zone outlives the request. ird dns disable only after the domain answers from its new nameservers (step G), on my yes.
4. Don't poll the registry. ird domains actions once when I ask, never in a loop; the help gives no duration for either request.
5. Unknowns stay unknown. The help says nothing about refunds, cancellation windows, or what transfer out prints. Report what the CLI shows; never guess.

Steps

A. Preflight. list_domains (CLI: ird domains list) → DOMAIN's state, expires_at, nameservers, dsdata, ownership_verification_required, registrant_email_hint. ird domains actions — a request already queued for DOMAIN = stop, show it. dns_list_zones — is DOMAIN's DNS on ird?

B. Registrant email. If ownership_verification_required is set, ird domains verify-email DOMAIN (help: "needed for some changes" — not which, nor how). Follow what it prints. If step E refuses for this reason, verify then, retry once.

C. Snapshot. ird domains dns-snapshot DOMAIN --json → save to ./dns/DOMAIN-<date>.json. If the zone is on ird, also dns_get_zone(domain=DOMAIN) (CLI: ird dns records DOMAIN --json). ird domains dsdata list DOMAIN → published DS records; ird domains hosts list DOMAIN → glue. A DS left at the registry breaks resolution once nameservers change: unless the new host serves the same keys, withdraw each with ird domains dsdata delete DOMAIN <keytag> <alg> <digest-type> <digest> on my ok.

D. Auto-renew (transfer-out). ird domains auto-renew DOMAIN off on my yes — the help doesn't say a transfer clears it.

E. The request.

• transfer-out: ird domains transfer out DOMAIN. The help has no flags and doesn't say what comes back — an authorization key, a queued request, or both. Show its output verbatim; a key goes alone in a code block, nowhere else. The transfer-in elsewhere is mine.
• trade: ird domains trade DOMAIN --auth-key AUTH_KEY --years YEARS. It shows a quote first: read from it which domains.trade key applies (per_year or per_year_swap — the help explains neither); credits_balance (stop if short). The help doesn't say which account runs it, the current or the new holder's — if refused, report. Blank AUTH_KEY = stop; the help doesn't say where ird shows the key.

F. Follow it. ird domains actions lists registry requests, ird domains actions <id> shows one, --cancel cancels a queued one — on my say only; whether that refunds is not in the help.

G. The ird zone. When I say the new side is done: dig +short NS DOMAIN @1.1.1.1 lists the new nameservers and dig +short A www.DOMAIN @<new nameserver> answers. Only then, if ZONE_PLAN is disable: ird dns disable DOMAIN (help: "take a domain off ird DNS" — your snapshot is the copy). A trade keeping ird DNS skips this.

H. Confirm. list_domains — after a transfer-out DOMAIN shows transfer_out_requested_at, or is gone; after a trade, the new expiry. ird domains info DOMAIN → registry view. ird credits ledger --kind charge --limit 30 → this run's charges.

Deliverable

MODE, the confirmation text you showed me, the registry request id and its last state, DS records withdrawn, snapshot paths, nameservers before and after, whether the ird zone still serves, credits charged per the ledger, and what is still pending on my side.