fix: extend the token, verifier and compliance ttl

[hpmaxi]

Summary

aha D: "Is it intended that the share token, the compliance stub and the identity verifier never extend their instance TTL?" No. The vault and oracle extend theirs; these three did not, and on testnet their instances already read as archived. Every call that does work on them now extends the instance to 30 days, like the vault. This PR answers aha's comment D; the runbook and the written TTL policy follow in the next PR.

Changes

• The share token extends its instance on transfer, transfer_from, approve and every role call.
• The identity verifier extends it on allow, is_allowed and verify_identity.
• The compliance stub extends it on every hook the token calls and on its admin calls.
• TESTING.md lists the new tests.

Acceptance criteria

• Each of the three contracts extends its instance on the calls listed above
• One test per contract shows a call restoring a decayed instance

Test plan

Automated tests

1. SOROBAN_SDK_BUILD_SYSTEM_SUPPORTS_SPEC_SHAKING_V2=1 nix develop -c cargo test --locked
2. All suites pass; the new tests are the *_instance_ttl ones.

Manual verification

None; the testnet redeploy comes with the group release.

Breaking changes

None.

Checklist

• Self-reviewed my own diff
• Tests added or updated
• Docs updated (if applicable)
• No unrelated changes bundled in

Screenshots

None.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
strata-vault-kit-app	Ready	Preview	Oct 16, 2026 11:27pm UTC