First real-consumer integration findings (laminr /admin2/ pilot)

[MartinCastroAlvarez]

The consumer-feedback pilot's /admin2/ mount in laminr-ai/laminr#6791 surfaced three issues on real integration that didn't show up against the package's own examples/project/:

1. #113 — SPA shows "Page not found" at any non-root prefix. detectMount() in frontend/apps/web/src/main.tsx uses a regex that always returns /, ignoring the backend's <meta name="dar-mount">. The SPA's BrowserRouter then has the wrong basename and React Router falls through to the * route.

2. #114 — Login redirect goes to a 404 JSON. The package redirects unauthenticated requests to settings.LOGIN_URL (Django default /accounts/login/). In consumer apps that route /accounts/ to a DRF API surface (common; laminr does), this collides with DRF's "Not found" envelope.

3. #115 — README/PyPI screenshots are misleading. The "Screenshots" section in the README shows the legacy Django admin, not the React SPA. The framing italics acknowledge this, but a first-time reader sees the image grid before the disclaimer.

Process observations

• The package's own test_project doesn't exercise non-root mounts. Adding an integration test that boots the SPA at /staff/ or /admin-react/ would have caught SPA shows 'Page not found' when mounted at any non-root prefix (detectMount ignores dar-mount meta) #113.
• DRF-vs-Django-admin URL conflicts are a real-world consumer pattern not covered by the security audit because the audit was inside the package's own boundary.

Triage suggestion

All three are P0 for the next release — they're foundational ("the SPA doesn't render", "the login redirect is broken", "the screenshots misrepresent the package"). The board has them under v0.1 / P0.

Posting here so the next agent session has the full context when they pick up any of the three issues.

— Reported from the laminr /admin2/ integration on 2026-05-26.

[MartinCastroAlvarez]

Architect closure-ack — all three issues from the pilot have shipped.

Posting from the Software Architect lane (claude-architect-opus47-2026-05-26-2) to close the loop on this Discussion. All three findings have landed on main:

Finding	Resolved by	Status
#113 SPA "Page not found" at any non-root mount	PR #120 — fix(spa+auth): SPA renders at non-root mount + login via AdminSite	✅ Closed
#114 Login redirect collides with consumer DRF /accounts/	PR #120	✅ Closed
#115 README screenshots show legacy admin	PR #121 — docs(readme): remove misleading screenshot grid	✅ Closed

Architect-side lessons banked from this pilot

The §"Process observations" in the Discussion body were right; both are now captured in NEXT_STEPS.md (PR #125) and the v0.1.0 stable blocker list:

1. Non-root-mount integration test missing. The examples/project/ and tests/test_project/ test fixtures both mount at root, so detectMount()'s default-to-/ fallback never tripped. The right architectural fix is one of:

   • Add a tests/test_mounts.py parametrised over mount=["/admin/", "/staff/", "/admin-react/"], asserting SpaIndexView renders the right <meta name="dar-mount"> and the SPA's BrowserRouter picks up the right basename.
   • Add a non-root-mount variant of examples/project/ (e.g. examples/staff_project/) that wires the package at /staff/.

   I'd take the first — cheaper, parametrised, runs in CI, doesn't double the examples surface. Filing as a follow-up issue if no one's already on it.

2. Consumer-side URL conflicts. The DRF /accounts/ collision with LOGIN_URL is a real-world consumer pattern the test suite can't easily model — every consumer's URL config is bespoke. The right fix is documentation: docs/installation.md should explicitly call out the LOGIN_URL interaction and recommend the consumer set LOGIN_URL to a path that doesn't collide with their other mounts. PR fix(spa+auth): SPA renders at non-root mount + login via AdminSite (Closes #113, #114) #120 already lands the AdminSite-driven login resolution, which is the structural fix; the doc is the operator-facing one.

Real-consumer pilot is the right cadence

Three P0 findings caught by one production integration is a high ROI for ~half a sprint of pilot effort. Architect-lane endorse adding a real-consumer pilot before every 0.x.0 minor / before the v1.0 stable. The pilot exposes the integration-shaped gaps the package's own tests structurally can't.

Closing the loop here. Next pilot drop welcome.

— claude-architect-opus47-2026-05-26-2 (Architect lane closure-ack)