fix(lee,lez): apply program dispatch/bijection unification to code added after rebase

Codebase-wide rename of the stale loader_core crate name to
program_loader_core (192 call sites, plus Cargo.toml dependency
declarations), needed after the loader crate's rename landed upstream.

ping_receiver/wrapped_token's UpdateSources handler, cross_zone_inbox's
inbox_source_marker_account_id (moved from the now-superseded
cross_zone_marker crate), and several test/genesis call sites still
referenced ProgramId-bijection addresses or pre-unification struct
shapes (CrossZoneMessage.src_program_id, WrappedTokenConfig/
ReceiverConfig field types, InboxInstruction::Dispatch's tuple form)
that this branch's own dispatch-address unification had already moved
past elsewhere.

integration_tests/src/utils.rs

@@ -331,8 +331,12 @@ pub fn deploy_targets(bytecode: &[u8]) -> (AccountId, AccountId) {
         risc0_binfmt::compute_image_id(bytecode).unwrap().into();
     let header =
         program_loader_core::deploy_header_account_id(loader_id, image_id, 0, AccountId::default());
-    let segment =
-        program_loader_core::deploy_segment_account_id(loader_id, image_id, 0, AccountId::default());
+    let segment = program_loader_core::deploy_segment_account_id(
+        loader_id,
+        image_id,
+        0,
+        AccountId::default(),
+    );
     (header, segment)
 }
 

integration_tests/tests/cross_zone_state_machine.rs

@@ -12,9 +12,8 @@
 
 use cross_zone_inbox_core::{
     CrossZoneMessage, InboxConfig, Instruction as InboxInstruction, SeenShard,
-    inbox_config_account_id, inbox_seen_shard_account_id,
+    inbox_config_account_id, inbox_seen_shard_account_id, inbox_source_marker_account_id,
 };
-use cross_zone_marker_core::inbox_source_marker_account_id;
 use cross_zone_outbox_core::{OutboxRecord, outbox_pda};
 use lee::{
     AccountId, PrivateKey, PublicKey, PublicTransaction, V03State, ValidatedStateDiff,
@@ -41,6 +40,24 @@ const RECIPIENT: [u8; 32] = [9; 32];
 /// These tests drive the guest directly, so any fixed source-block hash does.
 const SRC_BLOCK_HASH: [u8; 32] = [7; 32];
 
+/// Converts the wire-format `(zone, ProgramId)` sources an `UpdateSources`
+/// instruction carries into the `(zone, AccountId)` pairs a config stores, the
+/// same way `update_sources` itself does, so a test can compare its input
+/// against what actually landed in state.
+fn expected_sources(
+    sources: &[([u8; 32], lee_core::program::ProgramId)],
+) -> Vec<([u8; 32], AccountId)> {
+    sources
+        .iter()
+        .map(|(zone, program_id)| {
+            (
+                *zone,
+                program_loader_core::immutable_deploy_account_id(*program_id),
+            )
+        })
+        .collect()
+}
+
 /// State registering the cross-zone builtins these tests exercise.
 fn base_state() -> V03State {
     V03State::new().with_programs([
@@ -127,7 +144,9 @@ fn seed_receiver_config_with_governance(
 ) {
     let receiver_id = programs::ping_receiver().id();
     let config = ping_core::ReceiverConfig {
-        deliverer: program_loader_core::immutable_deploy_account_id(programs::cross_zone_inbox().id()),
+        deliverer: program_loader_core::immutable_deploy_account_id(
+            programs::cross_zone_inbox().id(),
+        ),
         governance,
         authority,
         sources,
@@ -175,7 +194,9 @@ fn seed_bridge_lock_config(state: &mut V03State) {
         Account {
             program_owner: program_loader_core::immutable_deploy_account_id(bridge_lock_id),
             data: bridge_lock_core::config_bytes(
-                program_loader_core::immutable_deploy_account_id(programs::cross_zone_outbox().id()),
+                program_loader_core::immutable_deploy_account_id(
+                    programs::cross_zone_outbox().id(),
+                ),
                 programs::cross_zone_outbox().id(),
                 programs::wrapped_token().id(),
             )
@@ -267,8 +288,11 @@ fn chained_via_inbox(
         src_block_id: 5,
         src_block_hash: SRC_BLOCK_HASH,
         src_tx_index: 0,
-        src_program_id: programs::bridge_lock().id(),
+        src_account_id: program_loader_core::immutable_deploy_account_id(
+            programs::bridge_lock().id(),
+        ),
         target_program_id: target,
+        target_account_id: program_loader_core::immutable_deploy_account_id(target),
         payload: words.into_iter().flat_map(u32::to_le_bytes).collect(),
         l1_inclusion_witness: None,
     };
@@ -276,7 +300,10 @@ fn chained_via_inbox(
         inbox_id.into(),
         dispatch_accounts(inbox_id, &msg, vec![config_id, authority]),
         vec![],
-        InboxInstruction::Dispatch(msg),
+        InboxInstruction::Dispatch {
+            message: msg,
+            self_program_id: inbox_id,
+        },
     )
     .expect("build dispatch message");
     PublicTransaction::new(message, WitnessSet::from_raw_parts(vec![]))
@@ -619,7 +646,9 @@ fn a_second_emit_at_the_same_slot_is_rejected() {
     let mut state = base_state().with_public_accounts([(
         holder_id,
         Account {
-            program_owner: program_loader_core::immutable_deploy_account_id(programs::bridge_lock().id()),
+            program_owner: program_loader_core::immutable_deploy_account_id(
+                programs::bridge_lock().id(),
+            ),
             balance: INITIAL_BALANCE,
             ..Default::default()
         },
@@ -1272,7 +1301,11 @@ fn the_token_authority_path_holds() {
         &state.get_account_by_id(config_id).data.into_inner(),
     )
     .expect("config decodes");
-    assert_eq!(cfg.sources, bridge_source, "the new source is authorized");
+    assert_eq!(
+        cfg.sources,
+        expected_sources(&bridge_source),
+        "the new source is authorized"
+    );
     assert_eq!(
         state.get_account_by_id(authority).program_owner,
         wrapped_token_id.into(),
@@ -1293,7 +1326,8 @@ fn the_token_authority_path_holds() {
     )
     .expect("config decodes");
     assert_eq!(
-        updated_cfg.sources, sender_source,
+        updated_cfg.sources,
+        expected_sources(&sender_source),
         "the second change took effect"
     );
     assert_eq!(
@@ -1314,12 +1348,13 @@ fn the_token_authority_path_holds() {
     .expect("config decodes");
     assert_eq!(renounced_cfg.authority, None, "the authority is gone");
     assert_eq!(
-        renounced_cfg.sources, sender_source,
+        renounced_cfg.sources,
+        expected_sources(&sender_source),
         "renouncing leaves the sources it froze"
     );
     assert_eq!(
         renounced_cfg.minter,
-        programs::cross_zone_inbox().id(),
+        program_loader_core::immutable_deploy_account_id(programs::cross_zone_inbox().id()),
         "the minter is unchanged"
     );
     rejects_at(
@@ -1352,10 +1387,14 @@ fn a_delivery_from_an_unauthorized_source_does_not_reach_ping_receiver() {
     seed_receiver_config(
         &mut state,
         None,
-        vec![(src_zone, programs::bridge_lock().id())],
+        vec![(
+            src_zone,
+            program_loader_core::immutable_deploy_account_id(programs::bridge_lock().id()),
+        )],
     );
 
     let words = risc0_zkvm::serde::to_vec(&ReceiverInstruction::Record {
+        self_program_id: receiver_id,
         payload: b"ping".to_vec(),
     })
     .expect("serialize ping instruction");
@@ -1364,8 +1403,11 @@ fn a_delivery_from_an_unauthorized_source_does_not_reach_ping_receiver() {
         src_block_id: 5,
         src_block_hash: SRC_BLOCK_HASH,
         src_tx_index: 0,
-        src_program_id: programs::ping_sender().id(),
+        src_account_id: program_loader_core::immutable_deploy_account_id(
+            programs::ping_sender().id(),
+        ),
         target_program_id: receiver_id,
+        target_account_id: program_loader_core::immutable_deploy_account_id(receiver_id),
         payload: words.iter().flat_map(|word| word.to_le_bytes()).collect(),
         l1_inclusion_witness: None,
     };
@@ -1380,7 +1422,10 @@ fn a_delivery_from_an_unauthorized_source_does_not_reach_ping_receiver() {
             ],
         ),
         vec![],
-        InboxInstruction::Dispatch(msg),
+        InboxInstruction::Dispatch {
+            message: msg,
+            self_program_id: inbox_id,
+        },
     )
     .expect("build dispatch message");
     let tx = PublicTransaction::new(message, WitnessSet::from_raw_parts(vec![]));
@@ -1407,9 +1452,17 @@ fn the_inbox_refuses_a_marker_that_does_not_match_the_message() {
 
     let mut state = base_state();
     seed_inbox_config(&mut state, self_zone);
-    seed_receiver_config(&mut state, None, vec![(src_zone, sender_id)]);
+    seed_receiver_config(
+        &mut state,
+        None,
+        vec![(
+            src_zone,
+            program_loader_core::immutable_deploy_account_id(sender_id),
+        )],
+    );
 
     let words = risc0_zkvm::serde::to_vec(&ReceiverInstruction::Record {
+        self_program_id: receiver_id,
         payload: b"ping".to_vec(),
     })
     .expect("serialize ping instruction");
@@ -1418,8 +1471,9 @@ fn the_inbox_refuses_a_marker_that_does_not_match_the_message() {
         src_block_id: 5,
         src_block_hash: SRC_BLOCK_HASH,
         src_tx_index: 0,
-        src_program_id: sender_id,
+        src_account_id: program_loader_core::immutable_deploy_account_id(sender_id),
         target_program_id: receiver_id,
+        target_account_id: program_loader_core::immutable_deploy_account_id(receiver_id),
         payload: words.iter().flat_map(|word| word.to_le_bytes()).collect(),
         l1_inclusion_witness: None,
     };
@@ -1431,12 +1485,19 @@ fn the_inbox_refuses_a_marker_that_does_not_match_the_message() {
         vec![
             inbox_config_account_id(inbox_id),
             inbox_seen_shard_account_id(inbox_id, &msg.src_zone, msg.src_block_id),
-            inbox_source_marker_account_id(inbox_id, &src_zone, programs::bridge_lock().id()),
+            inbox_source_marker_account_id(
+                program_loader_core::immutable_deploy_account_id(inbox_id),
+                &src_zone,
+                program_loader_core::immutable_deploy_account_id(programs::bridge_lock().id()),
+            ),
             receiver_config_account_id(receiver_id),
             ping_record_pda(receiver_id),
         ],
         vec![],
-        InboxInstruction::Dispatch(msg),
+        InboxInstruction::Dispatch {
+            message: msg,
+            self_program_id: inbox_id,
+        },
     )
     .expect("build dispatch message");
     let tx = PublicTransaction::new(message, WitnessSet::from_raw_parts(vec![]));
@@ -1523,8 +1584,11 @@ fn the_receiver_authority_path_holds() {
         &state.get_account_by_id(config_id).data.into_inner(),
     )
     .expect("config decodes");
-    assert_eq!(cfg.sources, vec![(src_zone, sender_id)]);
-    assert_eq!(cfg.deliverer, programs::cross_zone_inbox().id());
+    assert_eq!(cfg.sources, expected_sources(&[(src_zone, sender_id)]));
+    assert_eq!(
+        cfg.deliverer,
+        program_loader_core::immutable_deploy_account_id(programs::cross_zone_inbox().id())
+    );
 
     let renounce_diff =
         ValidatedStateDiff::from_public_transaction(&renounce(authority, &key, 1), &state, 2, 0)
@@ -1537,7 +1601,7 @@ fn the_receiver_authority_path_holds() {
     assert_eq!(renounced_cfg.authority, None, "the authority is gone");
     assert_eq!(
         renounced_cfg.sources,
-        vec![(src_zone, sender_id)],
+        expected_sources(&[(src_zone, sender_id)]),
         "renouncing freezes the list it had"
     );
     rejects_at(&state, &update(authority, &key, 2), 3, "fixed at genesis");
@@ -1648,7 +1712,10 @@ fn the_governance_path_holds() {
         &state.get_account_by_id(config_id).data.into_inner(),
     )
     .expect("config decodes");
-    assert_eq!(cfg.sources, vec![(src_zone, programs::bridge_lock().id())]);
+    assert_eq!(
+        cfg.sources,
+        expected_sources(&[(src_zone, programs::bridge_lock().id())])
+    );
     assert_eq!(
         state.get_account_by_id(authority).program_owner,
         wrapped_token_id.into(),
@@ -1815,7 +1882,10 @@ fn the_receiver_governance_path_holds() {
         &state.get_account_by_id(config_id).data.into_inner(),
     )
     .expect("config decodes");
-    assert_eq!(cfg.sources, vec![(src_zone, programs::ping_sender().id())]);
+    assert_eq!(
+        cfg.sources,
+        expected_sources(&[(src_zone, programs::ping_sender().id())])
+    );
     assert_eq!(
         state.get_account_by_id(authority).program_owner,
         receiver_id.into(),
@@ -1883,7 +1953,7 @@ fn a_shared_authority_survives_the_first_claim() {
     .expect("config decodes");
     assert_eq!(
         receiver_cfg.sources,
-        vec![(src_zone, programs::ping_sender().id())]
+        expected_sources(&[(src_zone, programs::ping_sender().id())])
     );
     assert_eq!(
         state.get_account_by_id(authority).program_owner,
@@ -2072,7 +2142,9 @@ fn a_mint_is_refused_when_the_token_authorizes_no_source() {
         src_block_id: 5,
         src_block_hash: SRC_BLOCK_HASH,
         src_tx_index: 0,
-        src_account_id: program_loader_core::immutable_deploy_account_id(programs::bridge_lock().id()),
+        src_account_id: program_loader_core::immutable_deploy_account_id(
+            programs::bridge_lock().id(),
+        ),
         target_program_id: wrapped_token_id,
         target_account_id: program_loader_core::immutable_deploy_account_id(wrapped_token_id),
         payload: mint_payload(),
@@ -2114,7 +2186,8 @@ fn a_top_level_mint_is_refused() {
     let inbox_id = programs::cross_zone_inbox().id();
     let wrapped_token_id = programs::wrapped_token().id();
     let src_zone = [2_u8; 32];
-    let src_account_id = program_loader_core::immutable_deploy_account_id(programs::bridge_lock().id());
+    let src_account_id =
+        program_loader_core::immutable_deploy_account_id(programs::bridge_lock().id());
 
     let mut state = base_state();
     seed_wrapped_config(&mut state, None, vec![(src_zone, src_account_id)]);
@@ -2198,7 +2271,9 @@ fn a_mint_from_an_unrouted_emitter_is_rejected() {
         src_block_hash: SRC_BLOCK_HASH,
         src_tx_index: 0,
         // The emitter a user can drive directly, aimed at the bridge's target.
-        src_account_id: program_loader_core::immutable_deploy_account_id(programs::ping_sender().id()),
+        src_account_id: program_loader_core::immutable_deploy_account_id(
+            programs::ping_sender().id(),
+        ),
         target_program_id: wrapped_token_id,
         target_account_id: program_loader_core::immutable_deploy_account_id(wrapped_token_id),
         payload: mint_payload(),

integration_tests/tests/private_pda.rs

@@ -166,7 +166,8 @@ async fn private_pda_family_members_receive_and_spend() -> Result<()> {
     let seed = PdaSeed::new([42; 32]);
     let amount: u128 = 100;
 
-    let auth_transfer_account_id = program_loader_core::immutable_deploy_account_id(auth_transfer_id);
+    let auth_transfer_account_id =
+        program_loader_core::immutable_deploy_account_id(auth_transfer_id);
     let auth_transfer_program = ProgramWithDependencies::new(auth_transfer.clone(), [].into())
         .with_program_account_id(auth_transfer_account_id);
     let spend_program =

integration_tests/tests/sequencer_rejoin.rs

@@ -92,6 +92,7 @@ async fn a_sequencer_leaves_the_committee_and_rejoins() -> Result<()> {
             AccountIdentity::PublicNoSign(config_id),
         ],
         &sequencer_stake_core::Instruction::UnstakeRequest {
+            self_program_id: programs::sequencer_stake().id(),
             amount: STAKE,
             destination: settlement,
         },
@@ -137,9 +138,12 @@ async fn a_sequencer_leaves_the_committee_and_rejoins() -> Result<()> {
             AccountIdentity::PublicNoSign(config_id),
         ],
         &sequencer_stake_core::Instruction::Stake {
+            self_program_id: programs::sequencer_stake().id(),
             sequencer_key: stake_key_b,
             amount: STAKE,
-            mover_program_id: programs::authenticated_transfer().id(),
+            mover_account_id: program_loader_core::immutable_deploy_account_id(
+                programs::authenticated_transfer().id(),
+            ),
             mover_instruction_data,
         },
     )

integration_tests/tests/sequencer_stake_demo.rs

@@ -115,7 +115,7 @@ async fn stake_transaction_joins_the_bedrock_committee() -> Result<()> {
             self_program_id: programs::sequencer_stake().id(),
             sequencer_key: demo_stake_key,
             amount: FUNDING_BALANCE,
-            mover_account_id: loader_core::immutable_deploy_account_id(
+            mover_account_id: program_loader_core::immutable_deploy_account_id(
                 programs::authenticated_transfer().id(),
             ),
             mover_instruction_data,

lee/state_machine/src/state/mod.rs

@@ -205,16 +205,21 @@ impl V03State {
 
     /// Seeds a program directly into state in the exact two-account shape a live `Deploy`
     /// dispatch (with a default `update_auth`, i.e. no upgrade authority) would produce for the
-    /// same `image_id` (see [`Self::get_program`] and [`program_loader_core::immutable_deploy_account_id`]),
-    /// skipping only the dispatch/proving machinery genesis has no signer to drive.
+    /// same `image_id` (see [`Self::get_program`] and
+    /// [`program_loader_core::immutable_deploy_account_id`]), skipping only the
+    /// dispatch/proving machinery genesis has no signer to drive.
     pub(crate) fn insert_program(&mut self, program: &Program) {
         let image_id = program.id();
         let segment_number = 0;
         let update_auth = AccountId::default();
         let loader_id = ProgramId::from(RESERVED_DEPLOYMENT_PROGRAM_ACCOUNT_ID);
 
-        let header_account_id =
-            program_loader_core::deploy_header_account_id(loader_id, image_id, segment_number, update_auth);
+        let header_account_id = program_loader_core::deploy_header_account_id(
+            loader_id,
+            image_id,
+            segment_number,
+            update_auth,
+        );
         let header_account = Account {
             program_owner: RESERVED_DEPLOYMENT_PROGRAM_ACCOUNT_ID,
             data: Data::from(&ProgramData {

lez/cross_zone/src/lib.rs

@@ -63,7 +63,8 @@ pub struct EmissionSource {
 /// through `AccountId::from` is only exact under the legacy bijection scheme.
 #[must_use]
 pub fn is_sequencer_only_program(account_id: AccountId) -> bool {
-    account_id == program_loader_core::immutable_deploy_account_id(programs::cross_zone_inbox().id())
+    account_id
+        == program_loader_core::immutable_deploy_account_id(programs::cross_zone_inbox().id())
 }
 
 /// Extracts the cross-zone emission from a source transaction.
@@ -73,7 +74,8 @@ pub fn is_sequencer_only_program(account_id: AccountId) -> bool {
 /// they agree on what a given source tx emits.
 #[must_use]
 pub fn extract_emission(account_id: AccountId, instruction_data: &[u32]) -> Option<Emission> {
-    if account_id == program_loader_core::immutable_deploy_account_id(programs::ping_sender().id()) {
+    if account_id == program_loader_core::immutable_deploy_account_id(programs::ping_sender().id())
+    {
         // Not every transaction to an emitter emits: `InitConfig` is one of its
         // instructions, so a non-`Send` decode is an ordinary non-emitting tx.
         let Ok(ping_core::SenderInstruction::Send {
@@ -92,7 +94,9 @@ pub fn extract_emission(account_id: AccountId, instruction_data: &[u32]) -> Opti
             target_accounts,
             payload,
         })
-    } else if account_id == program_loader_core::immutable_deploy_account_id(programs::bridge_lock().id()) {
+    } else if account_id
+        == program_loader_core::immutable_deploy_account_id(programs::bridge_lock().id())
+    {
         let Ok(bridge_lock_core::Instruction::Lock {
             target_zone,
             target_program_id,
@@ -213,7 +217,9 @@ pub fn build_inbox_init_config_tx(self_zone: ZoneId) -> lee::PublicTransaction {
 #[must_use]
 pub fn build_holding_account(holder: AccountId, amount: Balance) -> (AccountId, Account) {
     let account = Account {
-        program_owner: program_loader_core::immutable_deploy_account_id(programs::bridge_lock().id()),
+        program_owner: program_loader_core::immutable_deploy_account_id(
+            programs::bridge_lock().id(),
+        ),
         balance: amount,
         ..Default::default()
     };
@@ -390,7 +396,9 @@ mod tests {
             peers: vec![CrossZonePeer {
                 channel_id: [2; 32],
                 allowed_routes: vec![cross_zone_inbox_core::CrossZoneRoute {
-                    src_program_id: programs::bridge_lock().id(),
+                    src_account_id: program_loader_core::immutable_deploy_account_id(
+                        programs::bridge_lock().id(),
+                    ),
                     target_program_id: programs::amm().id(),
                 }],
                 expected_block_signing_pubkeys: Vec::new(),

lez/indexer/core/src/lib.rs

@@ -770,7 +770,9 @@ mod tests {
                 src_block_id: 5,
                 src_block_hash: [3; 32],
                 src_tx_index: 0,
-                src_program_id: programs::ping_sender().id(),
+                src_account_id: program_loader_core::immutable_deploy_account_id(
+                    programs::ping_sender().id(),
+                ),
             },
             receiver_id,
             &[

lez/indexer/service/protocol/src/convert.rs

@@ -8,9 +8,8 @@ use crate::{
     HashType, IndexerStatus, IndexerSyncState, Nullifier, PeerHealth, PeerStatus,
     PrivacyPreservingMessage, PrivacyPreservingTransaction, PrivateAction,
     ProgramDeploymentMessage, ProgramDeploymentTransaction, ProgramId, ProgramImageClaim, Proof,
-    PublicActionWithID,
-    PublicKey, PublicMessage, PublicTransaction, Signature, StallReason, Transaction,
-    ValidityWindow, WitnessSet,
+    PublicActionWithID, PublicKey, PublicMessage, PublicTransaction, Signature, StallReason,
+    Transaction, ValidityWindow, WitnessSet,
 };
 
 // ============================================================================

lez/programs/Cargo.toml

@@ -120,6 +120,7 @@ programs = [
   "dep:wrapped_token_core",
   "dep:ping_core",
   "dep:sequencer_stake_core",
+  "dep:program_loader_core",
 ]
 
 [dependencies]
@@ -141,6 +142,7 @@ bridge_lock_core = { workspace = true, optional = true }
 wrapped_token_core = { workspace = true, optional = true }
 ping_core = { workspace = true, optional = true }
 sequencer_stake_core = { workspace = true, optional = true }
+program_loader_core = { workspace = true, optional = true }
 
 amm_program = { path = "amm", optional = true }
 associated_token_account_program = { path = "associated_token_account", optional = true }

lez/programs/cross_zone_inbox/Cargo.toml

@@ -8,6 +8,5 @@ license = { workspace = true }
 workspace = true
 
 [dependencies]
-cross_zone_marker_core.workspace = true
 lee_core.workspace = true
 cross_zone_inbox_core.workspace = true

lez/programs/cross_zone_inbox/src/main.rs

@@ -1,8 +1,8 @@
 use cross_zone_inbox_core::{
     CrossZoneMessage, InboxConfig, Instruction, SeenShard, inbox_config_account_id,
     inbox_config_seed, inbox_seen_shard_account_id, inbox_seen_shard_seed,
+    inbox_source_marker_account_id,
 };
-use cross_zone_marker_core::inbox_source_marker_account_id;
 use lee_core::{
     account::{Account, AccountId, AccountWithMetadata},
     program::{

lez/programs/ping_receiver/Cargo.toml

@@ -8,6 +8,7 @@ license = { workspace = true }
 workspace = true
 
 [dependencies]
-cross_zone_marker_core.workspace = true
+cross_zone_inbox_core.workspace = true
 lee_core.workspace = true
 ping_core.workspace = true
+program_loader_core.workspace = true

lez/programs/ping_receiver/src/main.rs

@@ -1,4 +1,4 @@
-use cross_zone_marker_core::inbox_source_marker_account_id;
+use cross_zone_inbox_core::inbox_source_marker_account_id;
 use lee_core::{
     account::{Account, AccountId, AccountWithMetadata},
     program::{
@@ -248,7 +248,15 @@ fn update_sources(
         "the configured authority must authorize a source change"
     );
 
-    cfg.sources = sources;
+    cfg.sources = sources
+        .into_iter()
+        .map(|(zone, program_id)| {
+            (
+                zone,
+                program_loader_core::immutable_deploy_account_id(program_id),
+            )
+        })
+        .collect();
     let mut config_account = config.account.clone();
     config_account.data = cfg
         .to_bytes()

lez/programs/program_loader/core/src/lib.rs

@@ -125,10 +125,11 @@ pub fn immutable_deploy_account_id(image_id: ProgramId) -> AccountId {
     deploy_header_account_id(loader_id, image_id, 0, AccountId::default())
 }
 
-/// Executes the `Deploy` instruction: verifies `bytecode` decodes as a valid RISC0 program
-/// binary, derives its header and segment PDAs, and claims both. Called natively from
-/// dispatch's `RESERVED_DEPLOYMENT_PROGRAM_ACCOUNT_ID` shortcut (see that constant's doc
-/// comment in `lee_core::program`).
+/// Executes the `Deploy` instruction.
+///
+/// Verifies `bytecode` decodes as a valid RISC0 program binary, derives its header and segment
+/// PDAs, and claims both. Called natively from dispatch's `RESERVED_DEPLOYMENT_PROGRAM_ACCOUNT_ID`
+/// shortcut, which runs this instead of interpreting a guest ELF.
 #[must_use]
 pub fn execute_deploy(
     self_program_id: ProgramId,

lez/programs/sequencer_stake/src/main.rs

@@ -108,8 +108,7 @@ fn decode_config(
         "not the sequencer_stake config account"
     );
     assert_eq!(
-        config_account.account.program_owner,
-        self_account_id,
+        config_account.account.program_owner, self_account_id,
         "config account is not owned by sequencer_stake"
     );
     SequencerStakeConfig::from_bytes(config_account.account.data.as_ref())
@@ -148,8 +147,7 @@ fn stake(
     let is_claimed = ownership_account.account.program_owner != DEFAULT_PROGRAM_OWNER;
     if is_claimed {
         assert_eq!(
-            ownership_account.account.program_owner,
-            self_account_id,
+            ownership_account.account.program_owner, self_account_id,
             "not a sequencer_stake ownership account"
         );
         let record = StakeRecord::from_bytes(ownership_account.account.data.as_ref())
@@ -281,8 +279,7 @@ fn unstake_request(
         "must sign for the ownership account"
     );
     assert_eq!(
-        ownership_account.account.program_owner,
-        self_account_id,
+        ownership_account.account.program_owner, self_account_id,
         "not a sequencer_stake ownership account"
     );
 
@@ -351,8 +348,7 @@ fn finalize_unstake(
         );
 
     assert_eq!(
-        ownership_account.account.program_owner,
-        self_account_id,
+        ownership_account.account.program_owner, self_account_id,
         "not a sequencer_stake ownership account"
     );
 

lez/programs/wrapped_token/Cargo.toml

@@ -8,6 +8,7 @@ license = { workspace = true }
 workspace = true
 
 [dependencies]
-cross_zone_marker_core.workspace = true
+cross_zone_inbox_core.workspace = true
 lee_core.workspace = true
 wrapped_token_core.workspace = true
+program_loader_core.workspace = true

lez/programs/wrapped_token/src/main.rs

@@ -1,4 +1,4 @@
-use cross_zone_marker_core::inbox_source_marker_account_id;
+use cross_zone_inbox_core::inbox_source_marker_account_id;
 use lee_core::{
     account::{Account, AccountWithMetadata},
     program::{
@@ -269,7 +269,15 @@ fn update_sources(
         "the configured authority must authorize a source change"
     );
 
-    cfg.sources = sources;
+    cfg.sources = sources
+        .into_iter()
+        .map(|(zone, program_id)| {
+            (
+                zone,
+                program_loader_core::immutable_deploy_account_id(program_id),
+            )
+        })
+        .collect();
     let mut config_account = config.account.clone();
     config_account.data = cfg
         .to_bytes()

lez/sequencer/core/Cargo.toml

@@ -27,6 +27,7 @@ system_accounts.workspace = true
 cross_zone.workspace = true
 cross_zone_inbox_core.workspace = true
 sequencer_stake_core.workspace = true
+program_loader_core.workspace = true
 
 logos-blockchain-key-management-system-service.workspace = true
 logos-blockchain-core.workspace = true
@@ -70,5 +71,4 @@ lee = { workspace = true, features = ["test-utils"] }
 key_protocol.workspace = true
 token_core.workspace = true
 ping_core.workspace = true
-program_loader_core.workspace = true
 risc0-binfmt.workspace = true

lez/sequencer/core/src/lib.rs

@@ -1964,7 +1964,7 @@ fn genesis_stake_message(
         .expect("genesis funding nonce overflow");
 
     Message::try_new(
-        loader_core::immutable_deploy_account_id(programs::sequencer_stake().id()),
+        program_loader_core::immutable_deploy_account_id(programs::sequencer_stake().id()),
         vec![
             genesis_stake_funding_account(),
             ownership_id,
@@ -1978,7 +1978,7 @@ fn genesis_stake_message(
             self_program_id: programs::sequencer_stake().id(),
             sequencer_key,
             amount,
-            mover_account_id: loader_core::immutable_deploy_account_id(
+            mover_account_id: program_loader_core::immutable_deploy_account_id(
                 programs::authenticated_transfer().id(),
             ),
             mover_instruction_data,
@@ -2203,7 +2203,7 @@ fn finalize_unstake_ownership_account(tx: &LeeTransaction) -> Option<AccountId>
 
     let message = tx.message();
     if message.program_account_id
-        != loader_core::immutable_deploy_account_id(programs::sequencer_stake().id())
+        != program_loader_core::immutable_deploy_account_id(programs::sequencer_stake().id())
     {
         return None;
     }
@@ -2238,7 +2238,7 @@ fn build_finalize_unstake_tx(
     pending: sequencer_stake_core::PendingUnstake,
 ) -> Result<LeeTransaction> {
     let message = Message::try_new(
-        loader_core::immutable_deploy_account_id(programs::sequencer_stake().id()),
+        program_loader_core::immutable_deploy_account_id(programs::sequencer_stake().id()),
         vec![
             ownership_id,
             pending.destination,

lez/sequencer/service/Cargo.toml

@@ -19,6 +19,7 @@ system_accounts = { workspace = true, optional = true }
 wallet = { workspace = true, optional = true }
 sequencer_stake_core = { workspace = true, optional = true }
 authenticated_transfer_core = { workspace = true, optional = true }
+program_loader_core = { workspace = true, optional = true }
 
 clap = { workspace = true, features = ["derive", "env"] }
 anyhow.workspace = true
@@ -51,4 +52,5 @@ submit_stake = [
   "dep:wallet",
   "dep:sequencer_stake_core",
   "dep:authenticated_transfer_core",
+  "dep:program_loader_core",
 ]

lez/sequencer/service/src/bin/submit_stake.rs

@@ -91,7 +91,7 @@ async fn main() -> Result<()> {
                     self_program_id: programs::sequencer_stake().id(),
                     sequencer_key,
                     amount,
-                    mover_account_id: loader_core::immutable_deploy_account_id(
+                    mover_account_id: program_loader_core::immutable_deploy_account_id(
                         programs::authenticated_transfer().id(),
                     ),
                     mover_instruction_data,

lez/system_accounts/src/lib.rs

@@ -86,7 +86,9 @@ pub fn sequencer_stake_config_account_id() -> AccountId {
 #[must_use]
 pub fn sequencer_stake_config_account() -> Account {
     Account {
-        program_owner: loader_core::immutable_deploy_account_id(programs::sequencer_stake().id()),
+        program_owner: program_loader_core::immutable_deploy_account_id(
+            programs::sequencer_stake().id(),
+        ),
         data: sequencer_stake_core::SequencerStakeConfig {
             minimum_sequencer_stake: DEFAULT_MINIMUM_SEQUENCER_STAKE,
             entries: BTreeMap::new(),

lez/testnet_initial_state/src/lib.rs

@@ -154,8 +154,9 @@ fn initial_private_accounts() -> Vec<(lee_core::Commitment, lee_core::Nullifier)
 
             let mut acc = init_comm_data.account.clone();
 
-            acc.program_owner =
-                program_loader_core::immutable_deploy_account_id(programs::authenticated_transfer().id());
+            acc.program_owner = program_loader_core::immutable_deploy_account_id(
+                programs::authenticated_transfer().id(),
+            );
 
             (
                 lee_core::Commitment::new(&account_id, &acc),

lez/wallet-ffi/src/generic_transaction.rs

@@ -95,8 +95,11 @@ impl TryFrom<&FfiProgramWithDependencies> for ProgramWithDependencies {
             );
         }
 
-        Ok(Self::new(orig_program, program_map)
-            .with_program_account_id(program_loader_core::immutable_deploy_account_id(orig_program_id)))
+        Ok(
+            Self::new(orig_program, program_map).with_program_account_id(
+                program_loader_core::immutable_deploy_account_id(orig_program_id),
+            ),
+        )
     }
 }
 

lez/wallet/src/program_facades/ata.rs

@@ -223,7 +223,10 @@ impl Ata<'_> {
 fn ata_with_token_dependency() -> ProgramWithDependencies {
     let token = programs::token();
     let mut deps = HashMap::new();
-    deps.insert(program_loader_core::immutable_deploy_account_id(token.id()), token);
+    deps.insert(
+        program_loader_core::immutable_deploy_account_id(token.id()),
+        token,
+    );
     ProgramWithDependencies::new(programs::ata(), deps).with_program_account_id(
         program_loader_core::immutable_deploy_account_id(programs::ata().id()),
     )