fix(routing): enforce slashless public URLs

www/reports/nginx-rewrites.conf

@@ -1,3 +1,17 @@
+## Include these directives inside the public HTTPS server block, before the
+## generic static `location /` handler. Root (`/`) is the only trailing-slash
+## public URL; every other terminal slash receives a query-preserving 308.
+location ~ ^(.+?)/+$ {
+  return 308 $1$is_args$args;
+}
+
+## The static handler must serve the generated directory artifact at its
+## slashless public path. Do not use `$uri/`, which permits nginx's automatic
+## directory-slash redirect before `$uri/index.html` can be served.
+location / {
+  try_files $uri $uri/index.html $uri.html =404;
+}
+
 rewrite ^/aba$ /aba-therapy permanent;
 rewrite ^/autismevaluations$ /autism-evaluations permanent;
 rewrite ^/learnersocialclub$ /learner-social-club permanent;

www/reports/phase-10-slashless-url-normalization-2026-10-25.md

@@ -0,0 +1,27 @@
+# Phase 10 Slashless URL Normalization — 2026-10-25
+
+## Scope
+
+This local-only change aligns static-serving behavior with the live site's URL convention: root remains `/`; every other public page is served at a slashless path such as `/aba-therapy` or `/lp/aba-therapy`.
+
+Astro was already configured with `trailingSlash: 'never'`. Generated canonicals, hreflang URLs, sitemap entries, and source links therefore use slashless paths. The remaining deployment requirement is that a static web server must serve a generated `path/index.html` artifact for a slashless request without first redirecting to a directory URL.
+
+## Required server contract
+
+The reviewed nginx template in `reports/nginx-rewrites.conf` must be included inside the public HTTPS server block before general static routing. It requires the server to:
+
+- return a query-preserving `308` from `/path/` to `/path`;
+- serve `/path` from `path/index.html` without nginx's automatic directory-slash redirect;
+- preserve query strings, for example `/search/?term=aba` redirects to `/search?term=aba`;
+- keep root `/` unchanged; and
+- retain explicit legacy route redirects after URL normalization.
+
+This is a deployment template only. No Contabo, nginx, DNS, TLS, Cloudflare, or live-site configuration was changed.
+
+## Regression protection
+
+`tools/phase10-artifact-verify.mjs` now rejects generated root-relative `href` or `action` URLs with a terminal slash, excluding root `/`. `tools/phase10-release-rehearsal.mjs` models the required static behavior on loopback: slashless routes return `200`, trailing variants return `308`, and query strings survive the redirect.
+
+## Acceptance still required
+
+The template must be applied and tested by the approved hosting owner on the actual Contabo staging topology. Phase 10 must verify HTTPS, canonical host behavior, cache headers, redirects, assets, real 404s, forms/counter isolation, and rollback before any production cutover. This change does not authorize deployment.