Custom domains on my service never finish provisioning: the certificate stays in "validating" forever. The root cause appears to be on Railway's edge — the generated *.up.railway.app CNAME target hostname itself returns 404 "Application not found", so ACME validation can never succeed.

Project / service:

• Project: lively-motivation (64472c9d-5345-4297-a5a2-88f39f564e86)
• Environment: production (a1cc8ed5-15f4-4dee-bcbc-88b5f276c8dc)
• Service: sooqnashop (ef36361c-a9ec-4ada-83b8-ede152d06b44), region ams
• The service itself is healthy: https://sooqnashop-production.up.railway.app/ answers 200.

Evidence (2026-08-16, ~08:37 UTC):

• https://qc-api.sooqnashop.com/ → {"status":"error","code":404,"message":"Application not found","request_id":"Nzl0bnMOQeO19jQOss7a6g"}

  (custom domain registration id 44f99cb1-79d0-42da-8195-10c56bfacb3f, CNAME target btgcggb7.up.railway.app)

• https://btgcggb7.up.railway.app/ → {"status":"error","code":404,"message":"Application not found","request_id":"m-Arcak9TR-h_FGsEuroCg"}

  — this is the target hostname Railway generated for the domain, queried directly.

Already ruled out (six separate domain registrations tried):

• DNS: CNAME set to exactly the requiredValue, DNS-only (Cloudflare proxy off); Railway's own dnsRecords.currentValue shows the correct value as PROPAGATED.
• No CAA records blocking issuance; DNSSEC not enabled.
• Plan: reproduced after upgrading to Hobby (ACTIVE) — including a fresh registration created hours into the active paid plan (target 23hrvtic.up.railway.app), which shows the same 404 on its generated hostname.
• Redeploys, explicit targetPort, and a fresh hostname on a fresh registration (qc-api2, since deleted) — all reproduce it.

Since the generated target hostname itself 404s at the edge before any DNS or cert step involving me, this looks like the domain→service routing entry never being created on your side. Could you check why domain registrations on this service never attach at the edge?