I've read the pulumi architecture docs, but I'm not grokking why pulumi has this separate state off to the side reflecting the last-deployed state. AFAICT, a diff against what exists now is always required anyway?

Pulumi does not diff against the cloud by default. But even if you do do a refresh (which reconciles state with the cloud), it is frequently the case that the state recoverable from the cloud providers is not a sufficient description of the desired state, so the previously applied desired state is still necessary for diffing. You can see this in many others IaC ecosystems - Terraform of course, but also the

last-applied-configuration

annotation used by kubectl.

ah-ha, I had presumed that

update

was doing a

refresh

implicitly

Well - solutions like ARM and CloudFormation which are 100% cloud-hosted may very well be managing last applied configuration purely within the cloud backend. It would be mostly invisible to you - but could still be there. In principal, the same is true if you use the Pulumi Service backend - you effectively never need to think about state files.