Known limitations

Kept deliberately blunt.

Launch blockers

Plouto should not be described as production-ready until every one of these is resolved.

1. No external audit: Unaudited 179 passing tests is not a substitute. See audit status.
2. Privileged roles on a hot wallet: On deployment every role is granted to a single admin address. Until they are transferred to a multisig behind a timelock, one key can pause staking, alter buyback parameters and grant roles.
3. Governor and guardian not separated: The reserve veto only means something if the two roles are held by different signers. Not enforceable in code.
4. Registry not initialized: Until setPloutoTokenOnce runs, staking and routing are inert by design.
5. No real fee cycle observed: Every link in the chain is verified against real contracts, but the full cycle has never run with organically generated mainnet fees.
6. Canonical addresses unpublished: Nothing is deployed, so there is nothing to publish. Until there is, a user has no reference to verify a frontend against.
7. Pons V2 audit status: External, and not verifiable from chain state. Consult the official Pons documentation.

Deliberate choices with real costs:

No early exit. Outside a declared emergency, a lock cannot be broken. There is no penalty-based early withdrawal.
Positions are non-transferable. No secondary market, no NFT wrapper.
No auto-compounding. Rewards are ETH; principal is PLOUTO. There is nothing to compound into.
No fourth lock term. Adding one would require a new contract.
No migration path. If Pons redeploys, the immutable references become stale.
Buybacks pause during graduation. Phases 1 and 3 have no tradeable route.

Unswept fees are unknowable. Shown as an em dash, never estimated.
Estimated circulating supply is an over-count. It cannot subtract tokens in the Pons launch locker or the bonding curve. True free float is lower.
Reward dust accumulates. Rounding always favours solvency, so the contract holds slightly more than it owes. Distributable, not individually recoverable.
The dead-address balance includes other people's transfers. Reported separately from what Plouto retired.

The curve ABI is recovered, not verified. Selector extraction plus a 4-byte lookup. Mitigated by fork tests that execute a real buy.
No Universal Router. None is documented for Robinhood Chain, so the post-graduation route settles directly against the PoolManager rather than assuming an address.
The keeper is a script, not infrastructure. No retry logic, alerting or redundancy. Operational maturity is a task, not a feature.

Items 1–3 are operational and can be resolved before launch. Items 4–6 resolve as part of launching. Item 7 is external.

The design and accounting limitations are permanent properties of this version, and are documented rather than hidden.