marvin/incremental-updates-2 was not cargo +nightly fmt --check clean;
these files had drifted since the last fmt pass (mostly unwrapped
long import lists). No functional changes.
Rebasing onto marvin/incremental-updates-1's AccountDiff.diff_data:
Option<Data> change (was Option<Vec<u8>>) needed real fixes, not just a
mechanical rebase: every program's update_from_diff and every
diff_data-constructing call site was still written against the old
Vec<u8> shape. Several sites were doing a pointless Data -> Vec<u8> ->
Data round trip to satisfy the old field type; those now just pass the
Data value straight through. The host-side
execute_update_from_diff/prove_update_from_diff/write_update_from_diff_inputs
in lee/state_machine move to Data too, matching what now flows from
lee_core.
Programs now report AccountDiff/AccountDiffOutput instead of full
post-states; balance changes are applied via apply_balance_diff's
checked arithmetic at the protocol level rather than checked in-guest,
and data changes are materialized through a new update_from_diff
guest entrypoint (trusted execution for public transactions, proven
via a recursive receipt for the privacy-preserving circuit). All 15
production programs and test/example guest programs are converted;
attack-surface guest programs that are now structurally impossible
(nonce/program_owner mutation) or redundant (manual balance-sufficiency
bypass) are moved to a dormant/ directory rather than deleted outright.
BREAKING CHANGE: WrappedTokenConfig and ReceiverConfig gain a governance field and CrossZoneConfig gains source_governance, so the config layouts change and every program image id moves.
jonesmarvin8