fix(routing): enforce slashless public URLs

www/tools/phase10-artifact.test.mjs

@@ -49,6 +49,14 @@ test('artifact rejects live form mode and production API origin', async () => {
   assert.ok(result.errors.some((error) => error.includes('unsafe artifact signals')));
 });
 
+test('artifact rejects root-relative URLs with terminal slashes', async () => {
+  const root = await fixture('staging');
+  await fs.appendFile(path.join(root, 'index.html'), '<a href="/lp/aba-therapy/">Campaign</a>');
+  const result = await verifyArtifact(root, 'staging');
+  assert.equal(result.passed, false);
+  assert.ok(result.errors.some((error) => error.includes('root-relative URL(s) end in a slash')));
+});
+
 test('artifact digest is deterministic for unchanged files', async () => {
   const root = await fixture('staging');
   const first = await verifyArtifact(root, 'staging');