diff --git a/docs/diagrams/c10l-smart-contract-call.mmd.svg b/docs/diagrams/c10l-smart-contract-call.mmd.svg
index 030c019f..d327a2af 100644
--- a/docs/diagrams/c10l-smart-contract-call.mmd.svg
+++ b/docs/diagrams/c10l-smart-contract-call.mmd.svg
@@ -1 +1 @@
-Oasis Node Key Manager 🔒 Oasis Node Sapphire ParaTime Compute 🔒 Oasis Node Sapphire ParaTime Client Oasis Web3 Gateway Client (e.g. Node.js, MetaMask) Oasis Node Key Manager 🔒 Oasis Node Sapphire ParaTime Compute 🔒 Oasis Node Sapphire ParaTime Client Oasis Web3 Gateway Client (e.g. Node.js, MetaMask) R is cached until the end of epoch opt [Encrypt Call] opt [Sign Call] opt [Encrypted Call] opt [Encrypted Call] opt [Encrypted Call] Create call data 1 Get ephemeral public key R 2 Get ephemeral public key R 3 Get ephemeral public key R 4 Derive per-epoch per-runtime keypair R, R' 5 Ephemeral public key R 6 Ephemeral public key R 7 Ephemeral public key R 8 Generate X25519 keypair C, C' 9 Derive shared key K' = X25519(C', R) 10 Encrypt call data with Deoxys-II using shared key K' 11 Attach C 12 Sign call with User's Secp256k1/Ed25519 key 13 eth_call 14 eth_call 15 Validate call 16 eth_call 17 Get ephemeral private key R' 18 Check runtime policy for caller 19 Derive per-epoch per-runtime keypair R, R' 20 Ephemeral private key R' 21 Derive shared key K' = X25519(C, R') 22 Decrypt Deoxys-II envelope using K' 23 Get c10l contract state keypair S, S' 24 Check runtime policy for caller 25 Derive per-contract per-runtime keypair S, S' 26 Contract state keypair S, S' 27 Fetch contract code 28 C10l contract execution using S, S' to read storage 29 Encrypt call result with K' 30 Call result 31 Call result 32 Call result 33 Decrypt call result using K' 34 Oasis Node Key Manager 🔒 Oasis Node Sapphire ParaTime Compute 🔒 Oasis Node Sapphire ParaTime Client Oasis Web3 Gateway Client (e.g. Node.js, MetaMask) Oasis Node Key Manager 🔒 Oasis Node Sapphire ParaTime Compute 🔒 Oasis Node Sapphire ParaTime Client Oasis Web3 Gateway Client (e.g. Node.js, MetaMask) R is cached until the end of epoch opt [Encrypt Call] opt [Sign Call] opt [Encrypted Call] opt [Encrypted Call] opt [Encrypted Call] Create call data 1 Get ephemeral public key R 2 Get ephemeral public key R 3 Get ephemeral public key R 4 Derive per-epoch per-runtime keypair R, R' 5 Ephemeral public key R 6 Ephemeral public key R 7 Ephemeral public key R 8 Generate X25519 keypair C, C' 9 Derive shared key K' = X25519(C', R) 10 Encrypt call data with Deoxys-II using shared key K' 11 Attach C 12 Sign call with User's Secp256k1/Ed25519 key 13 eth_call 14 eth_call 15 Validate call 16 eth_call 17 Get ephemeral private key R' 18 Check runtime policy for caller 19 Derive per-epoch per-runtime keypair R, R' 20 Ephemeral private key R' 21 Derive shared key K' = X25519(C, R') 22 Decrypt Deoxys-II envelope using K' 23 Get c10l contract state keypair S, S' 24 Check runtime policy for caller 25 Derive per-contract per-runtime keypair S, S' 26 Contract state keypair S, S' 27 Fetch contract code 28 C10l contract execution using S, S' to read storage 29 Encrypt call result with K' 30 Call result 31 Call result 32 Call result 33 Decrypt call result using K' 34 Oasis Node Key Manager 🔒 Oasis Node Sapphire ParaTime Compute 🔒 Oasis Node Sapphire ParaTime Client Oasis Web3 Gateway Client (e.g. Node.js, MetaMask) Oasis Node Key Manager 🔒 Oasis Node Sapphire ParaTime Compute 🔒 Oasis Node Sapphire ParaTime Client Oasis Web3 Gateway Client (e.g. Node.js, MetaMask) R is cached until the end of epoch opt [Encrypt Transaction] opt [Encrypted Transaction] alt [Encrypted Transaction] [Unencrypted Transaction] Proposer node adds transaction, state and receipt in new block Wait for new block opt [Encrypted Transaction- ] Create transaction call data 1 Get ephemeral public key R 2 Get ephemeral public key R 3 Get ephemeral public key R 4 Derive per-epoch per-runtime keypair R, R' 5 Ephemeral public key R 6 Ephemeral public key R 7 Ephemeral public key R 8 Generate X25519 keypair C, C' 9 Derive shared key K' = X25519(C', R) 10 Encrypt call data with Deoxys-II using shared key K' 11 Attach C 12 Sign transaction with User's Secp256k1/Ed25519 key 13 eth_sendRawTx 14 eth_sendRawTx 15 Validate transaction 16 eth_sendRawTx 17 Get ephemeral private key R' 18 Check runtime policy for caller 19 Derive per-epoch per-runtime keypair R, R' 20 Ephemeral private key R' 21 Derive shared key K' = X25519(C, R') 22 Decrypt Deoxys-II envelope using K' 23 Get c10l contract state keypair S, S' 24 Check runtime policy for caller 25 Derive per-contract per-runtime keypair S, S' 26 Contract state keypair S, S' 27 Fetch contract code 28 C10l contract execution using S, S' to read and write storage 29 Obtain new state root 30 Transaction receipt: encrypt tx status with K', unencrypted logs 31 Transaction receipt: unencrypted tx status and logs 32 Transaction receipt 33 Decrypt tx status from receipt using K' 34 Oasis Node Key Manager 🔒 Oasis Node Sapphire ParaTime Compute 🔒 Oasis Node Sapphire ParaTime Client Oasis Web3 Gateway Client (e.g. Node.js, MetaMask) Oasis Node Key Manager 🔒 Oasis Node Sapphire ParaTime Compute 🔒 Oasis Node Sapphire ParaTime Client Oasis Web3 Gateway Client (e.g. Node.js, MetaMask) R is cached until the end of epoch opt [Encrypt Transaction] opt [Encrypted Transaction] alt [Encrypted Transaction] [Unencrypted Transaction] Proposer node adds transaction, state and receipt in new block Wait for new block opt [Encrypted Transaction- ] Create transaction call data 1 Get ephemeral public key R 2 Get ephemeral public key R 3 Get ephemeral public key R 4 Derive per-epoch per-runtime keypair R, R' 5 Ephemeral public key R 6 Ephemeral public key R 7 Ephemeral public key R 8 Generate X25519 keypair C, C' 9 Derive shared key K' = X25519(C', R) 10 Encrypt call data with Deoxys-II using shared key K' 11 Attach C 12 Sign transaction with User's Secp256k1/Ed25519 key 13 eth_sendRawTx 14 eth_sendRawTx 15 Validate transaction 16 eth_sendRawTx 17 Get ephemeral private key R' 18 Check runtime policy for caller 19 Derive per-epoch per-runtime keypair R, R' 20 Ephemeral private key R' 21 Derive shared key K' = X25519(C, R') 22 Decrypt Deoxys-II envelope using K' 23 Get c10l contract state keypair S, S' 24 Check runtime policy for caller 25 Derive per-contract per-runtime keypair S, S' 26 Contract state keypair S, S' 27 Fetch contract code 28 C10l contract execution using S, S' to read and write storage 29 Obtain new state root 30 Transaction receipt: encrypt tx status with K', unencrypted logs 31 Transaction receipt: unencrypted tx status and logs 32 Transaction receipt 33 Decrypt tx status from receipt using K' 34