fix(contracts): move per-token bookkeeping to persistent storage

.lintstagedrc.js

@@ -1,12 +1,17 @@
 export default {
+  // Use frontend's own prettier binary (its package.json pins a newer
+  // version than the repo root) for every frontend-scoped step below, so
+  // formatting decisions match `npm run format:check` in CI exactly. The
+  // root-level `prettier --write` steps further down are fine as-is since
+  // they only ever touch non-frontend files.
   "frontend/**/*.{js,jsx,ts,tsx}": [
     "bash -c 'cd frontend && ./node_modules/.bin/eslint --fix \"$@\"' --",
-    "prettier --write",
+    "bash -c 'cd frontend && ./node_modules/.bin/prettier --write \"$@\"' --",
   ],
   "**/*.{json,css,md}": ["prettier --write"],
   "*.{js,ts,mjs,cjs}": ["prettier --write"],
   "frontend/src/i18n/*.json": [
     "bash -c 'cd frontend && node scripts/check-i18n-parity.mjs'",
-    "prettier --write",
+    "bash -c 'cd frontend && ./node_modules/.bin/prettier --write \"$@\"' --",
   ],
 };

README.md

@@ -32,7 +32,7 @@ The `token-factory` Soroban contract (`contracts/token-factory/src/lib.rs`) is d
 1. Holds a `token_wasm_hash`: the hash of a separately-deployed, audited SEP-41 token contract WASM.
 2. On `create_token`, uses Soroban's deterministic deployer (`env.deployer().with_address(creator, salt)`) to instantiate a **new, independent contract instance** of that WASM, owned at an address derived from `(creator, salt)`.
 3. Initializes the new token contract with the requested `name`, `symbol`, and `decimals`, and optionally mints the caller an `initial_supply`.
-4. Records bookkeeping for the new token in its own storage: a `TokenInfo` record (name, symbol, decimals, creator, timestamp, burn flag, optional max supply), a reverse `token_address → index` lookup, and an append-only `creator → [indices]` list for "my tokens" queries.
+4. Records bookkeeping for the new token in `persistent` storage (see [Storage architecture](./docs/contract-abi.md#storage-architecture)): a `TokenInfo` record (name, symbol, decimals, creator, timestamp, burn flag, optional max supply), a reverse `token_address → index` lookup, and a paginated `creator → [indices]` list for "my tokens" queries.
 
 Every token deployed this way is a fully standalone contract on the ledger — it can be transferred, held, and queried through the standard SEP-41 interface by any Stellar wallet or tool, independent of StellarForge.
 
@@ -948,6 +948,11 @@ The factory contract supports in-place WASM upgrades without redeploying or migr
 
 `FactoryState` carries a `schema_version: u32` field. The constant `CURRENT_SCHEMA_VERSION` in `lib.rs` is the source of truth. `__constructor` stamps the current version on every fresh deployment. `migrate` reads the on-chain version from a standalone `"sv"` storage key and applies each pending upgrade step in order, making it safe to call multiple times (idempotent).
 
+| Version | Change                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| 1       | Initial versioned schema — added `schema_version` field to `FactoryState`                                                                                                                                                                                                                                                                                                                                                                                                  |
+| 2       | Max-supply accounting fix (issue #1006) — `deploy_one` now seeds the per-token supply counter with `initial_supply`; version bump only, no `FactoryState` field changes. Pre-fix capped tokens must be back-filled individually via `backfill_capped_supply` (see [docs/contract-abi.md](./docs/contract-abi.md#supply-cap-accounting))                                                                                                                                    |
+| 3       | Persistent-storage migration (issue #1007) — per-token bookkeeping (`TokenInfo`, `TokenIndex`, `Metadata`, `owner`, `supply`, `CreatorTokens`) moves out of the shared `instance` ledger entry into `persistent` storage, keeping `instance` storage O(1) in `token_count`. `TokenInfo` migrates in bounded, resumable chunks per `migrate` call; everything else migrates lazily on next access (see [docs/contract-abi.md](./docs/contract-abi.md#storage-architecture)) |
 | Version | Change                                                                                                                                                                                                                                                                                                                                  |
 | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | 1       | Initial versioned schema — added `schema_version` field to `FactoryState`                                                                                                                                                                                                                                                               |

contracts/Cargo.toml

@@ -3,3 +3,19 @@ members = [
     "token-factory",
 ]
 resolver = "2"
+
+# Standard Soroban size-optimized release profile. Without these overrides
+# the default release profile (opt-level = 3, no LTO, unstripped, unwinding
+# panics) produces a WASM binary large enough to threaten the 64 KiB
+# Soroban contract-data size limit checked in CI (see
+# scripts/check-wasm-size.mjs) well before the contract's logic itself grows
+# meaningfully.
+[profile.release]
+opt-level = "z"
+overflow-checks = true
+debug = 0
+strip = "symbols"
+debug-assertions = false
+panic = "abort"
+codegen-units = 1
+lto = true