more ucp

cmd/cart/main.go

@@ -305,8 +305,17 @@ func main() {
 		cartUCP = ucp.WithSigning(cartUCP, signer)
 		log.Print("ucp signing enabled")
 	}
-	mux.Handle("/ucp/v1/carts", cartUCP)
-	mux.Handle("/ucp/v1/carts/", cartUCP)
+	// StripPrefix is required because the sub-mux (CartHandler) registers
+	// routes like "GET /{id}" which expect a relative path; Go's ServeMux
+	// passes the full request path (e.g. /ucp/v1/carts/123) without stripping
+	// the prefix, so the sub-mux would never match.
+	//
+	// Only the subtree pattern (/ucp/v1/carts/) is registered, NOT the exact
+	// pattern (/ucp/v1/carts), because registering both causes Go's ServeMux
+	// to redirect the exact match to the subtree root, and StripPrefix
+	// interferes with the redirect target (producing a 307 to "/" instead
+	// of "/ucp/v1/carts/"). Consumers should use the trailing-slash variant.
+	mux.Handle("/ucp/v1/carts/", http.StripPrefix("/ucp/v1/carts", cartUCP))
 
 	// Stateless promotion evaluation: POST a (possibly partial) eval context and
 	// get back the resulting totals plus the applied/pending effect breakdown,