Firebase Hosting custom domain stuck in certificate provisioning after DNS provider change

After migrating a Firebase Hosting custom domain to a new DNS provider, the domain remains stuck in a pending verification or certificate provisioning state in the Firebase console. The goal is to reach a connected status with a valid managed SSL certificate without triggering unnecessary downtime or duplicate provisioning attempts.

The uncertainty is whether Firebase will automatically revalidate the existing managed certificate against the new authoritative zone once the console-specified A, AAAA, CNAME, and TXT records resolve globally, or whether the domain must be removed and re-added to force a fresh provisioning cycle. Additional variables include CAA record restrictions, split-horizon DNS, and any CDN or reverse proxy that may terminate TLS before the request reaches Firebase Hosting.

Should the existing custom domain be left in place while waiting for the managed certificate to renew against the new DNS zone, or is removing and re-adding the domain the supported path to trigger immediate revalidation? How can the certificate currently served for the hostname be distinguished from a proxy-terminated certificate during diagnosis?