Escrow mode runs the flagship sample unchanged against an on-chain vault: the budget's cap is deposited into the BudgetVault contract, streams settle by voucher against that escrow, and closing the budget releases the unspent remainder back to the owner on-chain. The contracts hold escrow that only the rules can move — see the non-custodial posture.
Launch instances run Control Mode only: money modes are disabled at the configuration level (an instance with a half-configured money mode refuses to boot — fail closed, never a silently absent mode). Escrow is enabled per instance, on request — against a testnet first, with your own keys and a vault deployment you can verify. The contracts source is published for verification (dynamo-contracts release bundle).
Nothing in your code. openBudget({ funding: "usdc", ... }) becomes available on your instance, and the same budget → streams → vouchers → close flow settles on-chain instead of on the control ledger:
openBudget moves the cap into the vault. Thefunded ceiling is on-chain truth, not a promise.
voucher; the vault enforces caps and monotonicity in-contract.
the engine's finality states; integrators credit on final only (R2 — see the acceptance checklist).
silently kills allowances (fail closed).
The instance-side configuration is a complete set of names (RPC endpoint, vault and asset addresses, signing keys) — set by the operator when the mode is enabled, all-or-none. Your client needs nothing new: the same DYNAMO_CORE_URL + OWNER_API_TOKEN, one different funding tag.
Sandbox/testnet parity is a versioned promise (R9): the surfaces are shape-identical between a local test chain and a public network — only keys and RPC endpoints change. Next: the card sandbox.