The full order of operations:
1 Unlock the domain at WordPress.com, get the EPP / auth code
2 Add the domain as a Free zone in Cloudflare
3 Stage the redirect in Cloudflare (before flipping nameservers)
4 Change nameservers at WordPress.com to Cloudflare’s pair
5 Wait for the Cloudflare zone to go Active
6 Initiate the transfer in Cloudflare, paste the EPP code, pay
7 Approve / expedite the transfer on the WordPress.com side
8 Verify: registrar, new expiry, redirect, DNSSEC
Step 1. In WordPress.com under Upgrades > Domains, open the domain, turn off Transfer lock, then start the transfer-out flow far enough to reveal the EPP / auth code. Copy it. Do not let WordPress walk you all the way through its own wizard, you only want the code.
Step 2. In the Cloudflare dashboard, Add a domain, choose the Free plan. Cloudflare scans existing DNS and assigns you two nameservers like name.ns.cloudflare.com. Note them.
Step 3. If the domain is a redirect (common when it just points at another site of yours), rebuild that redirect in Cloudflare now while it sits idle. See section 4.
Step 4. Back at WordPress.com, switch the nameservers from WordPress to the two Cloudflare nameservers.
Step 5. Cloudflare flips the zone to Active once it sees the nameserver change, usually under an hour. The transfer option stays greyed out until then.
Step 6. Once Active, go to Domain Registration > Transfer Domains, select the domain, paste the EPP code, and pay the at-cost fee. This payment includes the added year.
Step 7. Watch for the confirmation from the losing registrar. WordPress.com surfaces a Transfer Management page with an Accept Transfer button. Clicking it skips the 5-day wait and completes the transfer in minutes.
Done. The registry should now show the registrar as Cloudflare, status Active, and the expiry rolled forward by a year.