From 23554c33a58741187e8757b5c4b4240530388724 Mon Sep 17 00:00:00 2001
From: k5-audit <k5@local>
Date: Tue, 6 Oct 2026 11:32:49 +0530
Subject: [PATCH] docs: replace invented mount output with real transcripts;
 drop dead guard
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The README showed a `taproot mount` transcript that the CLI cannot produce:
a "materialized: 2.4 GB (lazy)" line, a `[s]ync · [f]ork · [d]etach`
prompt, and a claim that mount blocks execution on drift. None of that
exists. `grep` finds no fork or detach command, and `mount --no-fuse`
writes a 605-byte directory holding seven files. The transcript below is
pasted from a real run of the current binary.

Also drops an unreachable branch in validate_non_empty. An empty path
segment means the value starts with '/', ends with '/', or contains '//',
and all three are rejected before the loop. An exhaustive sweep over the
alphabet {a, /, ., empty} at lengths 1-6 (19530 inputs) finds no input
that reaches it, while the sibling '.'/'..' branch stays reachable. This
removes a check without weakening one: every value it would have rejected
is still rejected by an earlier guard.
---
 README.md   | 28 ++++++++++++++++++----------
 src/util.rs |  5 -----
 2 files changed, 18 insertions(+), 15 deletions(-)

diff --git a/README.md b/README.md
index 6026bc3..2e83b77 100644
--- a/README.md
+++ b/README.md
@@ -32,26 +32,34 @@ $ taproot scan .
   containers: 1
     db                    postgres:15.3 → 15.3
 
-$ taproot mount ~/projects/myapp
+$ taproot mount --no-fuse
 
   TAPROOT MOUNT
   ─────────────────────────────────────────
   repo:       myapp
   base:       main@9f3a2c1
-  state:      signed · sha256:b2c1...
-  materialized: 2.4 GB (lazy)
+  state:      signed · sha256:c9e22766863c
+  runtimes:   2
+    - node: 20.5.0 (pinned=true)
+    - python: 3.11.4 (pinned=true)
+  containers: 1
+    - db: 15.3 (postgres:15.3)
+  env-vars:   3
 
-  python:     3.11.4 (pinned)
-  node:       20.5.0 (pinned)
-  postgres:   15.3 (container, signed)
-  env-vars:   12 loaded from baseline
+  mount:      (none — materializing a tree)
+  hash:       c9e22766863c0424e6713f324c5dfcedcb82187e2f6786190dace3c4fd54e416
 
+  (no-fuse — wrote tree to /home/you/myapp/.taproot/mnt)
+  env:        /home/you/myapp/.taproot/mnt/env (writable — edit, then run `taproot sync --from-dir`)
   status:     ▶ INHERITED — ready to work
-
-  [s]ync · [f]ork · [d]etach
 ```
 
-If the state has drifted from the signed baseline, Taproot blocks execution and offers a sync.
+The mount writes a real directory, not a lazy 2.4 GB tree: `README.taproot`, `state.json`,
+`env`, `hash`, `version`, `runtimes/`, and `containers/`. Only `env` is writable.
+
+Drift is not detected at mount time. `taproot check` compares a state against a baseline,
+and `taproot sync` adopts edits captured from a materialized tree. There is no interactive
+`sync`/`fork`/`detach` prompt.
 
 ## Status
 
diff --git a/src/util.rs b/src/util.rs
index 61508f8..c67629d 100644
--- a/src/util.rs
+++ b/src/util.rs
@@ -65,11 +65,6 @@ pub(crate) fn validate_non_empty(field: &str, value: &str) -> Result<(), Taproot
                 "{field} segment must not be '.' or '..'"
             )));
         }
-        if seg.is_empty() && value.contains('/') {
-            return Err(TaprootError::InvalidKey(format!(
-                "{field} contains empty segment"
-            )));
-        }
     }
     Ok(())
 }