# Plan — 072 Managed Tenants workspace context enforcement

## Tech
- Laravel 12
- Filament v5 + Livewire v4
- Pest v4

## Approach
1. Treat `/admin/w/{workspace}/...` as the portfolio / workspace entry space.
2. Move Managed Tenants list/onboarding UX to workspace-scoped routes.
3. Make `/admin/managed-tenants/*` legacy-only (redirect to the correct workspace-scoped URL).
4. Enforce workspace/tenant consistency for all `/admin/t/{tenant}` routes (deny-as-not-found on mismatch).

## Key decisions
- **Workspace is not Filament tenancy**; it remains session + middleware.
- Hard enforcement is implemented in middleware that runs on tenant-scoped routes.
- Prefer redirects over removing routes immediately, to avoid breaking deep links, but ensure they are no longer primary UX.

## Files (expected)
- `routes/web.php`
- `app/Providers/Filament/AdminPanelProvider.php`
- `app/Http/Middleware/EnsureWorkspaceSelected.php`
- `app/Support/Middleware/DenyNonMemberTenantAccess.php` (or `EnsureFilamentTenantSelected.php`, depending on existing enforcement location)
- `app/Filament/Pages/ManagedTenants/*` (legacy redirects / removal)
- New/updated workspace landing page under `app/Filament/Pages/Workspaces/*` (or equivalent)
- Pest tests in `tests/Feature/Routing/` or `tests/Feature/Filament/`

## Test plan
- Feature test: `/admin/managed-tenants` redirects to `/admin/w/{workspace}/managed-tenants` when workspace is selected.
- Feature test: `/admin/t/{tenant}` returns 404 when workspace context missing.
- Feature test: `/admin/t/{tenant}` returns 404 when tenant.workspace_id != current workspace.
- Optional: workspace landing lists only workspace tenants.