Mini instruction fixes

[metapileks]

Fixes on top of #477.

Liquidation

• apply_liquidation removed (instruction + event). finalize_proposal sets dao.liquidator and zeroes the spending-limit record (dirty-flagged) when a HostileLiquidate proposal passes.
• The hostile-liquidate vault transaction now contains only the IP-transfer memo; the liquidator performs the on-chain unwind through the enqueue → approve → execute cycle.
• spot_swap no longer blocks liquidated DAOs.

Buyback

• quote_amount_per_cycle → cycle_count in args, action, and memo. Validation is now: non-zero total, at least 2 cycles.
• The 25% treasury cap values the AMM position at min(quote_reserves, base_reserves × last_observation).

Large spend

• LargeSpend snapshots team_address at create. Launch fails if the team has changed (StaleTeamAddress) or the amount no longer clears the 3-month cap.

Spending limits

• New InitialSpendingLimit::validate() (non-zero monthly amount, unique members, count within bounds) runs on all write paths: initialize_dao, set_spending_limit, spending-limit-change and hostile-takeover creates.

Migration

• resize_dao reads the spending-limit record from the live canonical Squads SpendingLimit account (new read-only account, PDA-checked). Script batch size 20 → 10.
• resize_proposal: drafts take the ExecuteArbitrary catalog params; launched proposals keep their original duration and threshold.
• assert_migrated size checks on finalize_proposal, admin_cancel_proposal, and admin_enqueue_multisig_proposal_approval.

SDK

• resizeDaoIx helper, renamed buyback args, regenerated types; resizeDaos.ts uses the new helper.

Greptile Summary

The PR refines mini-instruction behavior across liquidation, buybacks, large spends, spending limits, and account migrations.

• Moves the hostile-liquidation state transition into proposal finalization and delegates treasury unwinding to the liquidator’s estate cycle.
• Adds stricter spending-limit and large-spend validation.
• Updates buyback cycle inputs and treasury valuation.
• Adds migration checks, canonical spending-limit recovery, SDK support, and corresponding tests.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
programs/futarchy/src/instructions/finalize_proposal.rs	Finalization now records the liquidator and clears the DAO-side spending-limit configuration when hostile liquidation passes; the previously raised concerns are invalidated or explicitly accepted.
programs/futarchy/src/instructions/resize_dao.rs	DAO migration now reconstructs its spending-limit record from the canonical live Squads account.
programs/futarchy/src/state/proposal_action.rs	Proposal actions now snapshot large-spend recipients, revalidate launch caps, use buyback cycle counts, and apply observation-based AMM valuation.
programs/futarchy/src/state/dao.rs	Adds reusable spending-limit validation and explicit migrated-account size checks.
sdk/src/futarchy/v0.6/FutarchyClient.ts	Updates buyback arguments and adds a resize helper that derives the canonical spending-limit account.

_{Reviews (3): Last reviewed commit: "allow spot swap for a liquidated dao" | Re-trigger Greptile}

[github-actions]

Repository Guard

• Cargo.lock: pass
• yarn.lock (root): pass
• yarn.lock (sdk): pass
• Repo guard: pass

Repository Guard

Cargo dependency pinning

• Status: pass
• Every programs/*/Cargo.toml dep uses =x.y.z, a path = .. workspace ref, or a git dep with a 40-char rev.

Cross-program Anchor/Solana version consistency

• Status: pass
• anchor-lang and anchor-spl are pinned to the version declared in repo-guard.toml across every program.

solana-program crate pin

• Status: pass
• Every solana-program = "=X" declaration is =1.17.14 (locked to match Cargo.lock).

Anchor.toml solana_version

• Status: pass
• Anchor.toml declares solana_version = "1.17.34" (local-dev install for anchor test).

Crate minimum age

• Status: pass
• All Cargo deps changed by this PR are at least 14 days old on crates.io.

Yarn package.json pinning

• Status: pass
• All package.json deps use exact versions (no ^, ~, ranges).

npm minimum age

• Status: pass
• All npm deps changed by this PR are at least 14 days old.

Workflow toolchain consistency

• Status: pass
• Every workflow declares anchor-version: 0.29.0.
• Per-file solana-cli-version values match [toolchain.workflow_solana_cli] in repo-guard.toml.

GitHub Action SHA pinning

• Status: pass
• Every third-party action is pinned to a SHA in [actions.sha_allowlist].

Sensitive program / config changes

• Status: warn
• Review hint only (CODEOWNERS is the merge gate). Lines below match heuristics for security-sensitive changes:
• High-sensitivity files touched: Anchor.toml, Cargo.lock
• programs/futarchy/src/instructions/admin_update_proposal_params.rs:7 declare_id! literal change; Hardcoded Solana address literal -> + declare_id!("6awyHMshBGVjJ3ozdSJdyyDE1CTAXUwrpNMaRGMsb4sf");
• programs/futarchy/src/instructions/initialize_hostile_liquidate_proposal.rs:7 declare_id! literal change; Hardcoded Solana address literal -> + declare_id!("6awyHMshBGVjJ3ozdSJdyyDE1CTAXUwrpNMaRGMsb4sf");
• programs/futarchy/src/instructions/initialize_hostile_takeover_proposal.rs:36 Program ID constant or variable change -> + program_id: crate::ID,
• programs/futarchy/src/instructions/initialize_hostile_takeover_proposal.rs:76 Program ID constant or variable change -> + program_id: crate::ID,
• programs/futarchy/src/instructions/initialize_mint_tokens_proposal.rs:99 Program ID constant or variable change -> + program_id: mint_governor::ID,
• programs/futarchy/src/instructions/initialize_spending_limit_change_proposal.rs:39 Program ID constant or variable change -> + program_id: crate::ID,
• tests/futarchy/integration/gatedLiquidationUnwind.test.ts:303 Program ID constant or variable change -> + squadsMultisigProgram: multisig.PROGRAM_ID,
• tests/futarchy/integration/gatedLiquidationUnwind.test.ts:526 Program ID constant or variable change -> + squadsMultisigProgram: multisig.PROGRAM_ID,
• tests/futarchy/integration/liquidationEndToEnd.test.ts:251 Program ID constant or variable change -> + squadsMultisigProgram: multisig.PROGRAM_ID,
• tests/futarchy/unit/initializeBuybackTokenProposal.test.ts:27 Hardcoded Solana address literal -> + "MemoSq4gqABAXKb96qnH8TysNcWxMyWCqXgDLGmfcHr",
• tests/futarchy/unit/initializeHostileLiquidateProposal.test.ts:66 Hardcoded Solana address literal -> + programId: new PublicKey("MemoSq4gqABAXKb96qnH8TysNcWxMyWCqXgDLGmfcHr"),
• tests/futarchy/unit/liquidatorPath.test.ts:278 Program ID constant or variable change -> + squadsMultisigProgram: multisig.PROGRAM_ID,
• tests/futarchy/unit/setSpendingLimit.test.ts:90 Program ID constant or variable change -> + squadsMultisigProgram: multisig.PROGRAM_ID,
• tests/futarchy/unit/syncSpendingLimit.test.ts:128 Program ID constant or variable change -> + squadsMultisigProgram: multisig.PROGRAM_ID,

Overall status: pass

Lockfile freshness (Cargo.lock + yarn.lock) is checked by the workflow directly and cannot be bypassed. The sensitive-diff section is a review hint - CODEOWNERS handles the actual merge gate.