[edo-chan]

The mainnet upgrade workflow stopped when the new binary exceeded ProgramData capacity (release run 42054905703 needed 139,176 more bytes). CI now runs swig-release prepare before creating a tag or uploading a buffer. Preparation validates the deployment and full funding requirement, pays any required expansion from the existing proposer, confirms capacity, and refreshes the verification preflight because extension updates ProgramData's slot. Squads approval and execution of the upgrade remain unchanged.

Reuse the devnet sizing and confirmed transaction submission code in one shared program module. Expansion follows the existing 10,240-byte rounding policy, includes rent and transaction reserves, and is skipped when live capacity is sufficient. Preserve the public signature before submission and archive expansion receipts even if a later check fails. Unknown outcomes stop the run; no automatic resubmission is added.

Validation: cargo test --manifest-path tools/release/Cargo.toml --locked (56 passed), formatter, Clippy with -D warnings, actionlint .github/workflows/propose-upgrade.yml, and git diff --check. Unit RPC fixtures cover the observed shortfall, exact/no-op capacity, rent/funding boundaries, payer and authority binding, refreshed slot metadata, failed/processed/uncertain transactions, and post-confirmation verification. No live extension was submitted. Independent review passed with no blocking findings at 462c98e74b3032e850eb3e9417f53afb8bb0e001 against a05a9aa84661087a5d1e6eb9536f0ce76fc50ef9; it independently reproduced all local checks. Exact-head Build and Test, release-cli and Test Results and lint all passed.

Loader behavior checked against Agave v4.2.2: ExtendProgram permits the payer to fund expansion while retaining the upgrade authority, enforces allocation limits, and updates ProgramData's slot.

Area	Checked	Evidence
Stored and wire layout	yes	Existing loader instruction builder and signed transaction assertions in preparation_extends_with_proposer_and_refreshes_slot_bound_preflight; no Swig layout changes.
Stored-state lifecycle and version overlays	N/A	No Swig stored layout or version changes.
Account contract and ordering	yes	Existing program, ProgramData, Squads, proposer and metadata checks run before extension; preparation rejection matrix and instruction message assertion pass.
Atomic batch or migration preflight	N/A	Single loader extension; proposal submission remains a separate existing operation.
Close/drain funds and rent routing	N/A	No close or drain change; expansion rent is funded by the proposer.
Auth and replay binding	yes	Existing upgrade-authority and Squads checks retained; signed transaction recovery identifier and fresh blockhash; failure and output-reuse cases pass.
Permission and delta accounting	N/A	No wallet permissions or spend-accounting changes.
Grow and shrink reallocations	yes	Growth/no-op, 139,176-byte shortfall, rounded rent, total-size boundary and post-confirmation capacity tests pass; no shrink behavior.
CPI and SignV2 enforcement	N/A	No on-chain Swig changes.
IDL and SDK compatibility	N/A	Release CLI only; no Swig ABI or SDK changes.
Compute units	N/A	No Swig execution-path changes.
Design conflicts resolved	yes	Ed explicitly requested automatic CI program expansion. Upgrade approval remains with Squads.
Final-head required gates	yes	Head 462c98e74b3032e850eb3e9417f53afb8bb0e001, base a05a9aa84661087a5d1e6eb9536f0ce76fc50ef9: local tests, fmt, Clippy, actionlint, independent review, Build and Test, release-cli, Test Results, and lint all pass. Full CI includes standard, ProgramScope, SDK and stake suites.

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}