Trust boundaries

An honest map of what you must trust to use Plouto.

Trustless

Enforced by code, not by anyone's behaviour:

The 60/30/10 split: constant values compiled into the bytecode. No storage slot, no setter, no upgrade path.
Your principal: Held by the staking contract and returnable only to the position owner, only at maturity. No role can move it.
Reward arithmetic: Rounding always favours solvency. Invariants assert the contract can never owe more than it holds.
Token immutability: After setPloutoTokenOnce, no address in the protocol can be repointed at a different token.
Buyback bounds: Size, slippage, deadline and price impact are enforced on chain. A compromised keeper cannot exceed them.
Retirement: Acquired tokens are retired in the same transaction. The executor holding a balance between executions is an invariant violation.

Things that depend on a party behaving:

The admin (multisig): Can pause staking, adjust buyback safety parameters, and grant or revoke roles. Cannot touch the split, principal, or the registered token.
The registry owner: Performs the one-time initialization. A compromised owner could register a token that passes every validation — that is, a genuine Pons launch paying fees to the real router. Bounded, but not zero.
The reserve governor and guardian: Between them control reserve outflows, subject to a 2-day timelock and a mutual veto. If one party holds both roles, that protection is gone.
The keeper: Chooses when and how much to buy, within the on-chain bounds. Can grief by repeatedly executing at maximum tolerated impact.

Outside Plouto's control entirely:

Pons V2: The token contract, the fee schedule, sweep timing, the escrow and the curve. If Pons redeploys, Plouto's immutable references become stale with no in-protocol migration.
The Pons sweep operator: Post-graduation fee conversion may depend on it. If it stops, fees accumulate unclaimable.
Uniswap v4 core: The PoolManager the post-graduation route settles against.
Robinhood Chain: Liveness, finality and RPC availability.

The registry address the interface is using.
That ploutoToken() matches the token you intend to stake.
That record.creatorFeeRecipient on the Pons factory is the Revenue Router.
Who currently holds DEFAULT_ADMIN_ROLE on each contract — watch RoleGranted and RoleRevoked.
That the reserve's governor and guardian are different addresses.

None of these requires trusting this documentation.