The same "diff_data is already the fully-computed encoding, so this is
a passthrough" explanation was copy-pasted across 13 update_from_diff
implementations. The general contract is already documented once,
centrally, on ProgramCall::UpdateFromDiff in lee_core; each per-program
repeat added nothing beyond what the unused _pre_state parameter and a
one-line body already convey.
Programs now report AccountDiff/AccountDiffOutput instead of full
post-states; balance changes are applied via apply_balance_diff's
checked arithmetic at the protocol level rather than checked in-guest,
and data changes are materialized through a new update_from_diff
guest entrypoint (trusted execution for public transactions, proven
via a recursive receipt for the privacy-preserving circuit). All 15
production programs and test/example guest programs are converted;
attack-surface guest programs that are now structurally impossible
(nonce/program_owner mutation) or redundant (manual balance-sufficiency
bypass) are moved to a dormant/ directory rather than deleted outright.
Marvin Jones