Test the lock.
Verify the limits.

Verified results

• Testnet's TokenEscrow amendment was enabled when checked.
• Early release and early cancellation were rejected.
• Expired test escrows were refunded; a replacement escrow delivered exactly 100 CTL after its maturity time.
• The disposable issuer's master key was disabled and its regular key set to a known blackhole address. No signer list, delegates or remaining issuer instructions were found in the final ledger-object check.
• A further issuance attempt was rejected with tefMASTER_DISABLED. That rejection was a server response, not a validated transaction.
• Escrow creation, release and holder-to-holder transfers continued after issuer signing was disabled.
• Balances at the end of this initial experiment: 910 CTL held by the sender and 90 CTL by the recipient; all escrows closed. The later full rehearsal below changed these balances.

What the interrupted run taught us

The first run stopped because an assertion treated holder-owned escrows listed under the issuer as issuer-created obligations. Ownership was inspected and the assertion corrected. During the pause, the first escrow expired, so its release was rejected. Both expired escrows were refunded before a new maturity test passed. The evidence includes these failures; this was not a clean first-pass run.

Proposed founder vesting

The 1 billion TSO founder allocation is approved. A 12-month cliff and 24 monthly tranches remain a proposed schedule. Exact timestamps, the first release date, claim windows, cancellation recipients and recovery rules must be finalized before implementation. These tests used seconds rather than a multi-year schedule.

Token escrows require an expiry time. An unclaimed tranche can return to its sender after expiry. A production design must clearly specify who controls that sender and whether refunded tokens must be re-escrowed. A wallet label or multisignature policy alone does not enforce a time lock.

Supply controls still pending for TSO

The original 21B test TSO issuer remains under control and its founder balance remains unvested. No Mainnet TSO exists. The disabled account in this experiment issued CTL, not the project's TSO token.

Removing issuer signing authority is irreversible. Before considering it for TSO, review every issuer setting, signing path, delegate and outstanding instruction, and verify compatibility with the chosen vesting arrangement. Existing issuer-created instructions can remain executable after signing is disabled. No production supply cap is claimed here.

The subsequent read-only Mainnet feature check is recorded below. Production wallet compatibility, security and recovery procedures, freeze interactions and independent review remain outstanding.

Transaction evidence — separate CTL experiment

Testnet issuer: r9vsAMQ8mJ6Wa12HfjXzQVSK2rQsE5KLhW. These are disposable test assets, not purchase or payment addresses.

XRPL escrow documentation · Issuer signing removal documentation

Full 24-release rehearsal · 22 September 2026

80 checks passed across 50 validated transactions, including the expected early-release rejection. All 24 escrow amounts, recipients, maturity times and expiry times were verified before the release phase. Each release succeeded and the cumulative recipient balance was checked after every payment.

At a scale of 1 CTL to 1 million proposed TSO, the first 23 tranches contained 41.666666 CTL and the final tranche 41.666682 CTL. Final balances: sender 0 CTL, recipient 1,000 CTL; no escrows remained. The original TSO wallets were unchanged.

Maturity dates were compressed into seconds, with 24-hour claim windows. This does not test multi-year operations or implement the actual founder allocation. Expiry refunds were tested separately in the earlier experiment.

Mainnet feature check · 22 September 2026

A read-only check at 2026-09-21T16:17:55.583Z confirmed TokenEscrow was enabled. Two Ripple public endpoints (s1 and s2) returned the same validated Mainnet ledger 107140122. This dated snapshot establishes feature availability at that ledger; it does not certify the complete production setup.

Live wallet creation, signing-tool compatibility, recovery testing and independent review remain outstanding. No Mainnet token has been issued by this project, and no sale is open.

Planned custody

MSMG’s owner will initially control the project signing keys. Separate addresses will distinguish fund purposes, not independent oversight. Live custody is not configured. Any future claim that founder tokens are locked must be backed by verified Mainnet escrow records.