Reserved slugs miss `control`, `delivery`, `observe` and five top-level routes

[charlesrhoward]

Problem

A user or team can claim control, delivery, observe, signup, oauth, storage, forgot-password or reset-password as their slug. control is the default landing page for every scope (app/(dashboard)/[scope]/page.tsx:12 redirects there), so a collision makes one of the two surfaces unreachable.

Root cause: lib/dashboard-rescue.ts:8-20 is a hand-maintained list of the dashboard route segments, and lib/reserved-slugs.ts:15 spreads that list into RESERVED. The filesystem has 15 segments under app/(dashboard)/[scope]/; the list has 12. The top-level app/ directories were never added at all.

Where

• lib/dashboard-rescue.ts:8-20 (DASHBOARD_SCOPED_FIRST_SEGMENTS)
• lib/reserved-slugs.ts:15-56 (RESERVED)
• Route directories: ls app/\(dashboard\)/\[scope\]/ and ls app/

Fix

1. Add the three missing dashboard segments to DASHBOARD_SCOPED_FIRST_SEGMENTS.
2. Add the five missing top-level routes to RESERVED.
3. Write a unit test that reads the two directories from disk at test time and asserts every directory name that is not a route group ((...)) or dynamic segment ([...]) is present in RESERVED. This is the guard that stops the list drifting again.

Exit criteria

• The filesystem-vs-reserved test exists in tests/unit/reserved-slugs.test.ts (or extends the existing reserved-slug test), fails on main, passes after.
• isReservedSlug("control") and isReservedSlug("signup") return true (add both as explicit cases).
• The slug validation on signup and team creation rejects control (manual check on preview, or an e2e case in the existing team-settings spec).
• pnpm lint, pnpm typecheck, pnpm test:unit pass.

Out of scope

Mirroring the list into the database function is_reserved_slug(). The comment at lib/reserved-slugs.ts:10-14 already records that as a separate migration. Open a follow-up issue if you want to take it.

https://claude.ai/code/session_01SQ4nS96XYRztd5w9QkubPf