# Cenaca（塞纳卡）区块链白皮书
# Cenaca Blockchain White Paper

2026年10月22日 · 简体中文与 English

本文说明 Cenaca 的当前设计规则，以及 NA 钱包和外部应用访问这些规则的边界。规则仍在开发和验证中；本文不代表主网、真实资产钱包、跨链桥或银行已经投入生产，也不构成发行、收益、价格或安全保证。

This paper describes the current design rules of Cenaca and the boundaries through which the NA wallet and external applications use them. Development and validation are ongoing. It does not claim a production mainnet, live real-asset wallet, bridge or bank, and makes no issuance, return, price or security guarantee.

## 1 产品边界
### Product boundaries

New World 游戏（NW）、官网、SD 账户、Cenaca（塞纳卡）区块链及其原生币 Cenaca（CNC）、New Assets 钱包（NA）是五个独立模块，通过接口连接，分别维护代码、部署和运行责任。官网负责信息展示，SD 负责通用登录身份，NW 负责游戏，Cenaca 负责账本和链上治理，NA 负责用户的钱包操作。

The New World game (NW), official website, SD account service, Cenaca blockchain and its native coin Cenaca (CNC), and New Assets wallet (NA) are five independent modules connected by interfaces, with separate code, deployment and operational responsibilities. The website presents information; SD supplies general login identity; NW runs the game; Cenaca maintains the ledger and on-chain governance; NA provides wallet operations.

Cenaca 的共识、节点、RPC、普通地址转账和链上治理不能依赖 NW、官网或 SD 的在线状态。游戏停服不应停止 Cenaca 出块或兼容钱包转账。NW 是 Cenaca 公开接口的外部客户，游戏角色、背包、建筑、移动和战斗状态由 NW 链外管理。链持续运行本身不能证明游戏物品或灵石能够在停服时兑付。

Cenaca consensus, nodes, RPC, ordinary-address transfers and on-chain governance must operate without NW, the website or SD being online. A game outage must not stop Cenaca blocks or transfers from compatible wallets. NW is an external client of public Cenaca interfaces. Characters, inventories, buildings, movement and combat remain off-chain NW state. Continued chain operation alone does not establish offline redemption of game items or Spirit Stones.

## 2 原生链与工程目标
### Native chain and engineering targets

Cenaca 的第一代路线是基于 Cosmos SDK 与 CometBFT 的独立原生 Layer 1，优先实现原生 CNC、Gas、公开 RPC、独立节点和钱包访问。CNC 使用九位小数。EVM 兼容属于后续方向，不作为第一代验收前提。

The first generation of Cenaca follows an independent native Layer 1 design using Cosmos SDK and CometBFT, prioritizing native CNC, gas, public RPC, independent nodes and wallet access. CNC uses nine decimal places. EVM compatibility is a later direction and is not a first-generation acceptance requirement.

初期网络的工程目标是七个由独立主体运营的许可验证者、约两秒出块。节点独立性、软件兼容性、实际最终性、负载能力和运维成本都需要测试；这些数字不是已上线规模或性能保证。

Initial engineering targets are seven permissioned validators operated by distinct entities and an approximately two-second block interval. Operator independence, software compatibility, actual finality, capacity and operating cost require testing. These figures are not claims of deployed scale or guaranteed performance.

## 3 CNC 总量与网络费用
### CNC supply and network fees

CNC 的全球有效总量固定为 21,000,000 枚，精度为九位小数，最小单位为 0.000000001 CNC。采购、交易和服务报酬使用已经存在的 CNC，不为验证者报酬或游戏奖励额外增发。新注册玩家不领取免费 CNC。创世分配及其进入游戏流通的启动安排属于后期政府筹备事项。

The globally effective CNC supply is fixed at 21,000,000 units with nine decimal places; the smallest unit is 0.000000001 CNC. Procurement, trade and service payments use existing CNC. Validator compensation and game rewards do not create additional supply. Newly registered players receive no free CNC. Genesis allocation and the initial release into the game economy belong to the later government setup.

Cenaca 交易按计算、签名和区块资源消耗支付 CNC Gas，不按转账金额比例征收流通税。当前费用设计参考普通转账在正常负载下约 0.005 CNC、最低约 0.002 CNC；目标区块资源使用率为 50%，每区块基础费调整幅度不超过 12.5%，允许自愿优先费。这些是待验证参数，实际费用受资源消耗和负载影响。

Cenaca transactions pay CNC gas for computation, signatures and block resources, rather than a percentage transfer tax. Current indicative parameters are approximately 0.005 CNC for an ordinary transfer under normal load and a floor of approximately 0.002 CNC. Target block-resource utilization is 50%, with base-fee adjustment capped at 12.5% per block and optional priority fees. These parameters require validation; actual fees depend on resource use and load.

常规 Gas 按 90% 进入验证者共同奖励池、10% 分给有效出块者的方案分配，不常规销毁 CNC。费用能否覆盖验证者成本需由真实运行数据验证。所有类型组织提案须先成功扣取发起 Gas 才能创建；未成功支付不得出现生效提案。已扣取的发起费用不因提案通过、否决、到期或执行失败而退还。

The fee design allocates 90% to a shared validator reward pool and 10% to an eligible block proposer, without routine CNC burning. Whether fees cover validator costs requires operational evidence. Every organization proposal type must successfully debit initiation gas before creation; unsuccessful payment must not produce an effective proposal. The debited initiation fee is not refunded because a proposal passes, is rejected, expires or fails during execution.

## 4 普通地址与密钥
### Ordinary addresses and keys

Cenaca 普通地址和组织地址都采用小写 sd 作为 Bech32 人类可读前缀，显示为 sd1…；地址不是 SDID、NWID 或用户名。普通地址由私钥控制，创建即可使用，无需激活、激活费或为自己发行任何凭证。普通地址付款由其私钥签名授权。

Both ordinary and organization Cenaca addresses use the lowercase sd Bech32 human-readable prefix and appear as sd1…. An address is distinct from an SDID, NWID or username. An ordinary address is controlled by its private key and is usable when created, with no activation, activation fee or self-issued credential. Its payments require authorization by its private-key signature.

NA 每新建一个普通地址，都生成该地址独立的新助记词和私钥，不把一个共用种子导出给多人使用。长期密钥和助记词由用户本地保管，不上传 NW 游戏服务器。SD 注册不创建钱包；SD 登录、用户名查询或 NWID 绑定都不能代替地址签名，也不能恢复丢失的私钥。

Each ordinary address created in NA receives its own newly generated mnemonic and private key; a shared seed must not be exported for multiple people to use. Users retain long-term keys and mnemonics locally, without uploading them to NW servers. SD registration does not create a wallet. SD login, username lookup and NWID binding cannot replace an address signature or recover a lost private key.

NA 可在 NW 不可用时通过独立 Cenaca 接口执行钱包操作。SD 登录或游戏绑定不赋予普通地址的私钥控制权，也不能绕过组织治理。

NA must support wallet operations through independent Cenaca interfaces while NW is unavailable. SD login or game binding grants neither private-key control of an ordinary address nor a bypass of organization governance.

## 5 组织地址与两类凭证
### Organization addresses and credential classes

每个组织只有一个正式 Cenaca 组织地址，以地址作为唯一标识。组织没有私钥或助记词，其资产和治理操作通过提案执行。创建者不保留永久控制权或绕过治理的后门。

Each organization has one official Cenaca organization address, which is its unique identifier. It has no private key or mnemonic. Its asset and governance actions execute through proposals. The creator retains no permanent control or governance bypass.

创建组织时，在钱包中设定初始股权、董事票权、各自数量、接收地址、赞成门槛与时长，并将两类链上凭证分配至指定地址。两类凭证以一张为最小单位，持有数量可以累加。董事凭证仅由普通地址持有；股权凭证可由普通地址或组织地址持有。

At creation, the wallet specifies initial equity and director voting rights, their quantities and recipient addresses, and affirmative thresholds and durations. Both on-chain credential classes are allocated to the designated addresses. Their minimum unit is one credential and balances can accumulate. Only ordinary addresses may hold director credentials; ordinary or organization addresses may hold equity credentials.

创建组织时可以勾选“禁止提前结束公示期”，默认不勾选。两种模式均允许股东投赞成签名并记录票数。未勾选时，赞成达到 T 可提前通过；勾选时，即使赞成达到 T，也须等公示完整到期后才可生效。在对应活动表决阶段，反对达到 R 在两种模式下均立即否决。设定的公示期仍至少 24 小时。开关由链上提案规则约束生效时间，不能仅靠后台选择不签名来保证。

At organization creation, the option "Prohibit early end of notice" may be selected and is unchecked by default. Both modes allow shareholders to cast affirmative signatures and have their votes recorded. If unchecked, reaching T affirmative votes permits early passage. If selected, even reaching T requires waiting for full notice expiry before the proposal can take effect. During the applicable active voting stage, reaching R opposing votes immediately rejects it in either mode. The configured notice period remains at least 24 hours. On-chain proposal rules enforce when approval takes effect; backends merely choosing not to sign are insufficient.

董事票权和股权分别按各自有效总量计算，不把董事张数与股权张数混作同一分母。持证数量决定当期比例，不保证永久百分比。例如当期总股权为 10,000 张时，700 张为 7%；总量经治理增加后，该比例会下降。

Director voting weight and equity are calculated against their own respective valid totals, never a combined denominator. A balance determines its current share, not a permanent percentage. For example, 700 of 10,000 equity credentials represents 7%; increasing the total through governance dilutes that percentage.

## 6 提案审批与股东公示
### Proposal approval and shareholder notice

组织对外付款和治理操作走董事提案审批，再进入股东公示。董事审批时长与股东公示期设为相同的 D，每段 D 至少 24 小时，24 小时本身有效。审批阶段须达到设定的董事赞成门槛才能进入公示，不能把未批准提案仅因时间届满视为通过。

Organization payments and governance actions follow board proposal approval and then shareholder notice. The board approval window and shareholder notice period use the same duration D; each D is at least 24 hours, with exactly 24 hours allowed. The configured director affirmative threshold must be met before notice begins. Mere expiry cannot approve a proposal that has not obtained board approval.

董事凭证与股权凭证分别计算门槛，不混用总量，也不只以参与投票者为分母。设某类有效整数凭证总量为 N，设定的整数赞成门槛为 T，必须满足 N / 2 < T <= N，即赞成比例严格大于 50% 且不超过 100%。反对门槛由 R = N - T + 1 派生。在对应有效表决阶段，赞成达到 T 即满足该类审批；反对达到 R 立即否决提案，R 不要求超过总量的一半。例如 N = 10,000、T = 6,000 时，6,000 张赞成即满足，4,001 张反对即否决；N = 3、T = 3 时，三张赞成才满足，一张反对即否决。

Director and equity credentials have separately calculated thresholds, using each class's own total rather than combining classes or counting only participating votes. Let N be the valid integer credential total for a class and T its configured integer affirmative threshold. It must satisfy N / 2 < T <= N: strictly more than 50% and no more than 100%. The opposing threshold is derived as R = N - T + 1. During the applicable active voting stage, reaching T affirmative votes satisfies that class's approval; reaching R opposing votes immediately rejects the proposal. R need not exceed half the total. With N = 10,000 and T = 6,000, 6,000 affirmative votes suffice and 4,001 opposing votes reject it. With N = 3 and T = 3, all three affirmative votes are required and one opposing vote rejects it.

提案创建时分别固定董事与股东两类的 N、T、派生 R、审批与公示时长、是否禁止提前结束公示期及适用规则。后续凭证转移或增发不能追溯改变该提案的 N、T、R 或已计入票数。新发行单位不能获得旧提案资格。

Proposal creation separately fixes N, T and derived R for director and shareholder classes, approval and notice durations, the prohibition or permission of early notice completion, and applicable rules. Later credential transfers or issuance cannot retroactively change that proposal's N, T, R or counted votes. Newly issued units gain no eligibility for old proposals.

提案向所有人显示统一的公共状态：审批中、公示中、已批准、已否决、已失败。已创建提案在执行阶段因余额不足、执行 Gas 不足或其他错误失败时，公共状态为“已失败”，同时保留此前批准过程、执行结果和失败原因。发起 Gas 未成功支付仍不创建提案。“已批准”表示治理通过，不等于执行成功或资金到账；后续执行失败须显示“已失败”，不能只在“已批准”的子字段隐藏失败。

A proposal has one public status for everyone: In approval, In notice, Approved, Rejected or Failed. If an existing proposal fails during execution because of insufficient balance, insufficient execution gas or another error, its public status is Failed, while its prior approval history, execution result and failure reason remain recorded. Unsuccessful payment of initiation gas still creates no proposal. Approved means governance approval, not successful execution or receipt of funds. A later execution failure must be shown as Failed, rather than hidden in a subfield of Approved.

钱包另外按当前普通地址及其董事或股东角色，独立显示“待审批”或“已审批”。该地址在该角色已有经资格校验并记录的赞成或反对（包括后补意见）即为已审批，并显示表态方向；是否影响结果另行标记，尚无记录时为待审批。“待审批”本身不授予操作权，提交仍须通过资格、签名授权与去重校验。五种公共状态各可配两种操作状态，共十种组合：审批中+待审批、审批中+已审批、公示中+待审批、公示中+已审批、已批准+待审批、已批准+已审批、已否决+待审批、已否决+已审批、已失败+待审批、已失败+已审批。

The wallet separately shows Pending review or Reviewed for the current ordinary address and its director or shareholder role. A recorded affirmative or opposing submission for that address and role that passes eligibility checks, including a late opinion, is Reviewed, with its direction visible. Whether it affects the outcome is marked separately; no record is Pending review. Pending review grants no authority by itself. Submission still requires eligibility, signature authorization and duplicate-use checks. Each of the five public statuses can have either action status, producing ten combinations: In approval+Pending review, In approval+Reviewed, In notice+Pending review, In notice+Reviewed, Approved+Pending review, Approved+Reviewed, Rejected+Pending review, Rejected+Reviewed, Failed+Pending review and Failed+Reviewed.

董事在提案进入公示后、股东在公示结束后仍可补投赞成或反对意见；提案进入已批准、已否决、已失败状态后，两类身份也可补投意见。决定票数只计对应有效表决阶段内的投票，迟到意见单独记录，不倒退阶段、不改变已决票数、治理结果或失败状态，不触发执行、重试失败或已否决的提案，也不再次付款。补投仍沿用该提案原有的凭证持有资格、签名授权和逐单位去重规则；已用票权不能重复表态，凭证转移也不能洗出新资格。

Directors may submit later affirmative or opposing opinions after a proposal enters notice, and shareholders after notice ends. Both roles may also submit opinions after the proposal becomes Approved, Rejected or Failed. Decisive tallies include only votes in the applicable active voting stage. Late opinions are recorded separately: they do not reverse a stage, alter decided tallies, governance results or failure status, trigger execution, retry a failed or rejected proposal, or pay again. Late submissions retain the proposal's original credential-holding eligibility, signature authorization and per-unit duplicate-use rules. Used voting weight cannot express another opinion, and credential transfers cannot manufacture new eligibility.

未勾选“禁止提前结束公示期”的组织，股东赞成达到 T 可提前通过；勾选的组织仍可投赞成签名并记票，但达到 T 也必须等公示完整到期才可生效。公示仍活动时，两种模式下股东反对达到 R 均立即否决提案；已获董事批准且未达到 R 的提案，在公示完整届满后通过。未投票不当作赞成或反对。两类凭证投票后仍可转移，原提案已计入的赞成或反对票保持，不因转移撤掉或复制。投票本身不限制凭证流转。

Organizations leaving "Prohibit early end of notice" unchecked allow early passage when shareholder affirmative votes reach T. Organizations selecting it still allow affirmative signatures to be cast and counted, but even reaching T requires waiting for full notice expiry before the proposal takes effect. In either mode, while notice remains active, opposing shareholder votes reaching R immediately reject it; a board-approved proposal passes after full notice expires without R being reached. Non-voting is neither an affirmative nor an opposing vote. Both credential classes remain transferable after voting. Counted affirmative or opposing votes remain with the original proposal and are neither withdrawn nor copied by transfer. Voting itself does not restrict credential transfers.

董事和股东凭证的赞成、签名或否决资格，都按可追溯批次或单位的持有记录核验。投票时只能使用提案创建前已进入当前地址、此后未转出、当前仍持有且尚未用于该提案的合格单位。提案后收到或新发行的单位不能替代原有票权；转出后再转回同一地址也视为新转入，不恢复对旧提案的资格。

Affirmative, signing and veto eligibility for both director and equity credentials is checked against traceable holding records for each batch or unit. At voting time, only eligible units received by the current address before proposal creation, never transferred out since, still held and not yet used on that proposal may vote. Later receipts or newly issued units cannot replace earlier voting weight. Units transferred out and returned to the same address are new receipts and do not regain eligibility for the old proposal.

对尚未投票的单位，例如提案前有三张且未转出，提案后新收两张，对旧提案最多仍可用三张；原三张全部转出再转回，则对旧提案可用零张；只转出其中一张时，未转出的两张保留资格。转移采用的批次或单位选择规则必须明确可追踪，不能用新收单位补回已转出单位的旧资格，也不能把新发行记录回填为提案前持有。

For units not yet voted, three units held before a proposal and never transferred out remain at most three eligible units after two new units arrive. If all three original units leave and return, none is eligible for the old proposal. If only one leaves, the two original units that remain retain eligibility. The rule selecting transferred batches or units must be explicit and traceable. New receipts cannot replace the old eligibility of units that left, and new issuance cannot be backdated as a pre-proposal holding.

每个提案分别记录每批次或单位已经使用的票权，禁止同一地址重复使用同一单位、转出回流再投，或用分拆合并清除已用记录、伪造旧资格。凭证投出后可以转给他人，但受让人不能据此对旧提案重复投票。不同提案分别核验资格和已用票权，不得相互挪用计票记录。

Each proposal separately records voting weight already used from each batch or unit. The same address cannot reuse a unit, transfer it out and back to vote again, or use splitting and merging to clear its used-vote record or fabricate earlier eligibility. A credential may be transferred after voting, but its recipient cannot duplicate that vote on the old proposal. Eligibility and used weight are checked separately for each proposal; their voting records cannot substitute for one another.

提案创建和凭证进入地址的先后，按链上确定性的区块高度及块内交易、事件顺序判断，不只比较墙钟时间。同一区块中，提案前的有效转入可取得资格，提案后的转入不能用于该提案。

The order of proposal creation and credential receipt is determined by deterministic block height and transaction and event order within the block, rather than wall-clock time alone. Within one block, valid receipt before a proposal can establish eligibility, while receipt after it cannot be used for that proposal.

付款对象、金额和治理内容必须与获批提案一致。链上执行要验证权限和状态；执行失败须将公共状态记为“已失败”并保留原因，不得发生只完成部分转账的结果。修改治理阈值、时长、凭证规则等必须按修改前已生效的规则审批，不能用拟议的新规则批准其自身。

Recipients, amounts and governance actions must match the approved proposal. On-chain execution must validate authority and state. Failed execution must set the public status to Failed, preserve the reason and leave no partially completed transfer. Changes to thresholds, durations or credential rules require approval under the rules already in force, not the proposed replacement rules.

## 7 凭证增发与多层持股
### Credential issuance and layered ownership

持有人可将自己的董事凭证直接转移至其他普通地址，无需组织提案或公示，已投票也可转移。链上须核验接收地址类型、有效持有和转移授权。股权可按规则转给普通或组织地址；两类凭证转移后，对既有提案的资格和已用票权仍须逐批次或单位核验。

A holder may directly transfer director credentials to another ordinary address without an organization proposal or notice period, including after voting. The chain must check recipient address type, valid holdings and transfer authorization. Equity may be transferred to ordinary or organization addresses under its rules. After either class is transferred, eligibility and used voting weight for existing proposals must still be checked by batch or unit.

董事凭证和股权凭证一旦发行，永久不可销毁，也不可经治理强制扣减。组织只能通过治理增发新凭证稀释相对票权或股权比例，不能通过替换持有人整表、删除持有人或改写余额变相销毁。原有持有数量不会因组织治理被强扣，但增发可能持续降低其相对比例，不保证固定百分比、价值或收益。

Once issued, director and equity credentials are permanently non-destructible and cannot be forcibly deducted through governance. An organization may issue additional credentials through governance to dilute relative voting or equity shares. Replacing the entire holder table, deleting a holder or rewriting balances cannot be used to destroy credentials indirectly. Governance cannot forcibly reduce existing quantities, but further issuance may continually dilute relative percentages, without a fixed-percentage, value or return guarantee.

增发提案只列明新增接收地址及各自新增数量，不提交旧持有人余额的整表覆盖。执行时读取当时的实际余额，逐项增加并记录新的发行批次，整个操作原子完成。编辑提案期间发生的正常转移不能被旧余额回写，不能造成负数或把已转出的旧余额复活。

An issuance proposal lists only the recipient addresses and quantities to add, rather than replacing a table of existing holder balances. Execution reads actual balances at that time, adds the specified quantities and records new issuance batches as one atomic operation. Legitimate transfers during proposal editing must not be overwritten by stale balances, cause negative quantities or revive balances already transferred away.

增发及治理设置变更按修改前已生效的资格和门槛审批。执行时须同时核验增发后的各类整数总量 N 与拟设赞成门槛 T 合法，满足 N / 2 < T <= N，并由新 N 与 T 派生 R = N - T + 1。若治理设置修订发生冲突，明确记录失败，不覆盖较新设置，也不留下部分发行结果。新增批次不能用于更早创建的提案。

Issuance and governance-setting changes require approval under the eligibility and thresholds already in force. Execution must validate each resulting integer total N and proposed affirmative threshold T, satisfying N / 2 < T <= N, and derive R = N - T + 1 from the new N and T. Conflicting governance-setting revisions must fail explicitly, without overwriting newer settings or leaving partial issuance. Newly issued batches cannot vote on earlier proposals.

凭证发行总量与 CNC 货币总量分别管理。凭证不可销毁的规则仅适用于董事和股权凭证；CNC 跨链仍按源链销毁、目的链等额发行及全球供应守恒的独立规则执行。

Credential supply and CNC monetary supply are managed separately. The non-destruction rule applies to director and equity credentials. CNC cross-chain movement continues to follow its separate source-burn, equal-destination-issuance and global supply-conservation rules.

组织持有下级组织股权时，由该持股组织的直属董事会决定如何对外行使股东权，不再递归征求该组织自身股东。间接持股不会自动赋予个人对下级组织的直接表决权。循环或多层持股必须防止同一权益重复算票，不能复制或放大票权。

When an organization owns equity in another organization, its own immediate board determines how to exercise those external shareholder rights, without recursively polling its own shareholders. Indirect ownership does not automatically give an individual direct voting rights in a subsidiary. Circular and layered ownership must not duplicate or amplify the same voting weight.

组织对下级提案投票，还须核验实际用于投票的下级股权单位在该提案创建前已进入持股组织地址、此后未转出、投票时仍持有且尚未用于该提案。董事会批准不能让后收到的下级股权取得旧资格，转移也不能复制底层股权的历史票。

An organization voting on a subsidiary's proposal must verify that the underlying equity units arrived before that proposal, have not left since, remain held at voting time and have not already voted on it. Board approval cannot make subsequently received equity eligible for an earlier proposal, and transfers cannot copy historical votes attached to underlying equity.

## 8 钱包与游戏身份接口
### Wallet and game identity interfaces

NA 资产页提供“转账、收款、审批、组织”四个主要入口，底部为“资产、兑换、我的”。组织页只读展示董事和股东地址及持证数量，并提供创建组织、发起增发及治理设置提案；不能直接编辑持有人余额或删除持有人。普通付款选择普通地址并签名；组织付款创建提案，不能伪装成组织私钥签名。

The NA asset page provides four primary actions: Transfer, Receive, Approvals and Organizations. Bottom navigation contains Assets, Exchange and Me. Organization pages display director and shareholder addresses and balances read-only, with organization creation, issuance proposals and governance-setting proposals. They do not directly edit holder balances or delete holders. An ordinary payment selects and signs with an ordinary address; an organization payment creates a proposal rather than pretending to use an organization private key.

提案页并列展示公共提案状态与当前地址、角色的操作状态，董事和股东的记录分别判断。执行结果及失败原因另行展示；执行失败时公共状态须为“已失败”，此前批准历史仍保留。页面将决定性投票与补投意见区分显示，不能把已审批或已批准当作资金已经到账，也不能因待审批字样开放无资格的签名操作。

Proposal pages display the public proposal status alongside the current address's action status for its role, evaluating director and shareholder records separately. Execution results and failure reasons are also shown; failed execution requires the public status Failed while preserving prior approval history. Decisive votes and late opinions are distinguished. Reviewed or Approved must not be presented as proof of funds received, and Pending review must not enable an ineligible signature.

普通玩家的一个 SDID 对应一个不可变 NWID，普通 NWID 为 NW 加八位随机英数字；用户名唯一且可修改。只有普通地址能绑定 NWID；一名玩家可以绑定多个普通地址，每个地址只能绑定一名玩家。绑定由游戏发起，钱包须在 24 小时内核对相同 NWID 并签名确认，拒绝过期或重放的确认。

For ordinary players, one SDID corresponds to one immutable NWID, formed by NW followed by eight random letters or digits. Usernames are unique and changeable. Only ordinary addresses can bind to an NWID. A player may bind several addresses, each to only one player. The game initiates binding; within 24 hours the wallet must verify the matching NWID and sign confirmation. Expired or replayed confirmations must be rejected.

玩家可设置默认收款地址，以用户名查找收款人，并用于交易行收款结算；每次付款自行选择已绑定普通地址。组织不注册游戏账号，也不绑定 NWID。游戏按玩家普通地址直接持有的凭证自动展示组织，组织名单只显示地址和数量，不显示这些地址对应的玩家，即使地址已经绑定。组织备注只对填写备注的玩家自己可见；本期不提供组织经营权限。

Players can set a default receiving address for username-based recipient lookup and marketplace proceeds, and choose a bound ordinary address for each payment. Organizations have no game account or NWID binding. The game discovers organizations from credentials held directly by the player's ordinary addresses. Rosters show addresses and quantities without revealing associated players, even for bound addresses. Organization notes are private to the player who writes them. Organization operating permissions are outside the current scope.

## 9 跨链与总量守恒
### Cross-chain movement and supply conservation

Cenaca 原生 CNC 与官方支持外链上的对应 CNC 通过源链真实销毁、目的链核验后等额发行连接。跨链权利属于当前合法控制并授权销毁相应 CNC 的地址，不永久归最初的跨链发起人。每笔任务必须有唯一标识、有效销毁证明、足够最终性、目的链去重和失败恢复路径。

Native Cenaca CNC and corresponding CNC on officially supported external chains connect through actual source-chain burning and equal destination-chain issuance after verification. The right to move funds belongs to their current legitimate controller authorizing the burn, not permanently to the first bridge user. Each operation requires a unique identifier, valid burn evidence, sufficient finality, destination replay protection and a recovery path.

跨链设计必须保持 S_Cenaca + ΣS_external + P_pending = 21,000,000 CNC；P_pending 是已销毁但尚未完成目的链发行的有效在途金额，不可再次支出或重复兑付。外链回到 Cenaca 通过独立 DApp 处理，各链支付其适用网络费用。

The cross-chain design must preserve S_Cenaca + ΣS_external + P_pending = 21,000,000 CNC. P_pending represents valid amounts already burned but awaiting destination issuance; it is neither spendable again nor redeemable twice. Return from external chains to Cenaca uses an independent DApp. Each chain charges its applicable network fees.

接入方向为先验证 Cenaca 与 Ethereum，再考虑 Solana；初步风控参考全网每滚动 24 小时最多处理 100,000 CNC，须在部署前验证。Sepolia 可用于测试探索，不构成发行或部署承诺。当前没有在本文中确认已部署或已审计的跨链桥。

The integration direction is to validate Cenaca and Ethereum first, then consider Solana. A preliminary risk-control reference is a network-wide maximum of 100,000 CNC per rolling 24 hours, requiring validation before deployment. Sepolia may be used for test exploration; it is not an issuance or deployment commitment. This paper confirms no deployed or audited bridge.

## 10 后期公共机构方向
### Later public institution plans

政府与银行分别规划一个独立链上组织，初期每个组织使用 6 个普通地址：3 个董事地址与另外 3 个股东地址，两组织共 12 个普通地址。每个组织初始董事凭证和股权凭证各三张，各地址接收对应类别的一张；两类均设置 N = 3、T = 3，派生 R = 1。用户以后自行设立这些地址及 12 台服务器，并自行安全配置对应地址的私钥。每台服务器运行一个“审判者程序”，独立运行且只控制自己的一个普通地址；其中 6 台服务政府，另外 6 台服务银行。政府由公司运营团队治理，玩家不参与政府共同治理；政府与银行资金保持分离。组织本身没有私钥，审判者程序不能绕过链上治理。这些地址、服务器和程序尚未部署，具体授权与团队分配仍需落实。

Government and bank are planned as separate on-chain organizations, initially using six ordinary addresses each: three director addresses and three different shareholder addresses, for 12 ordinary addresses in total. Each organization initially issues three director and three equity credentials, allocating one of the corresponding class to each address. Both classes use N = 3 and T = 3, deriving R = 1. The user will establish these addresses and 12 servers later and securely configure the corresponding private keys. Each server runs one independent Judge Program controlling only its own ordinary address; six serve government and the other six serve bank. The company's operations team governs government without shared player governance, and government and bank funds remain separate. The organizations themselves have no private key, and Judge Programs cannot bypass on-chain governance. These addresses, servers and programs are not deployed; authorization and team assignments still require implementation.

审判者程序的配套恢复设计包括健康监控：检查进程是否在线，发现离线或进程被终止时尝试自动拉起。监控与拉起仅恢复程序运行，不代替安全审核，也不自动批准或签名。进程在线不等于完成审核；整机故障、断电或网络中断可能使恢复无法完成。该恢复机制仍需实现和验证，不构成可用性或安全保证。

The Judge recovery design includes health monitoring that checks whether a process is online and attempts to restart it when offline or terminated. Monitoring and restart restore program operation; they do not substitute for security review or automatically approve or sign. An online process does not mean a review is complete. Whole-machine failure, power loss or network interruption may prevent recovery. This mechanism still requires implementation and validation, without an availability or security guarantee.

政府方案拟保留九组特殊身份映射：SD11111/NW11111、SD22222/NW22222、SD33333/NW33333、SD44444/NW44444、SD55555/NW55555、SD66666/NW66666、SD77777/NW77777、SD88888/NW88888、SD99999/NW99999。这是普通玩家 NW 加八位随机英数字格式之外的设计保留例外，不表示这些账户已经存在、可以免认证登录或已经取得实际操作权限。普通玩家的 NWID 规则不变。

The government design reserves nine proposed identity pairs: SD11111/NW11111, SD22222/NW22222, SD33333/NW33333, SD44444/NW44444, SD55555/NW55555, SD66666/NW66666, SD77777/NW77777, SD88888/NW88888 and SD99999/NW99999. This is a reserved design exception to the ordinary player format of NW plus eight random letters or digits. It does not claim that these accounts exist, permit unauthenticated login or already have operational authority. Ordinary player NWID rules remain unchanged.

政府创建时勾选“禁止提前结束公示期”。政府游戏内付款仍先由九个特殊游戏账户中的五个批准，再将请求随机交给政府组织中一个拥有董事凭证的普通地址所对应的审判者程序。该程序先在本地进行安全审核，通过后才提交链上提案；其余董事审判者也各自独立审核，并按审核结果投票，不要求强制串行。初期取得三张董事凭证的有效链上赞成后进入完整公示，一张董事反对即达到 R = 1 并否决。股东审判者独立审核，可以提交赞成签名并记票；即使赞成达到 T = 3，也须等待完整公示届满，不能提前执行。发现异常时投拒绝票；一张股权凭证反对即达到 R = 1 并立即否决提案。公示至少 24 小时，不允许通过赞成提前结束，完整届满且未达到否决门槛后才按链上规则继续执行。特殊游戏审批是政府审判者提交申请前的应用层流程，不赋予政府额外链上特权，也不改变 Cenaca 独立运行的边界。

Government selects "Prohibit early end of notice" at creation. An in-game government payment still first requires approval from five of the nine special game accounts. Its request is then assigned at random to the Judge Program for an ordinary address holding director credentials in the government organization. That program performs a local security review before submitting an on-chain proposal. The other director Judges independently review and vote according to their own findings, without a mandatory sequential order. Initially, three valid director-credential affirmative votes move the proposal into full notice; one opposing director vote reaches R = 1 and rejects it. Shareholder Judges independently review and may cast affirmative signatures that are recorded as votes. Even if affirmative votes reach T = 3, the proposal must wait for full notice expiry and cannot execute early. They oppose it when an anomaly is found. One opposing equity-credential vote reaches R = 1 and immediately rejects the proposal. Notice lasts at least 24 hours and cannot end early through affirmative votes. Only after full expiry without the opposing threshold being reached does execution continue under on-chain rules. Special game-account approval is an application-layer gate before government Judge submission, not extra on-chain privilege or a change to Cenaca's independent operation.

政府另规划一个独立巡检程序，读取政府组织提案的链上状态。董事仅在审批中、股东仅在公示中属于巡检的活动表决阶段。对该阶段有有效投票资格、尚无已确认赞成或反对记录的身份，董事从提案创建起、股东从进入公示起计时，超过 1 小时无票则告警并排查；不追查后补意见或终态表态。无票是异常信号，不证明进程已停止；先核对 RPC、未确认交易、Gas 和进程，再按有限恢复与退避策略尝试恢复。已终止提案、不适用阶段或无有效资格的身份不计超时。巡检不代签、不改变链上治理或执行条件，也不保证故障及时恢复；这仅是政府运营规划，尚未生产部署。用户将配置公司全员邮箱名单；发生异常时，巡检程序拟向名单全部收件人发送紧急告警，列明提案、组织、审判者、时间和恢复状态，不含私钥等秘密。同一故障合并提醒，恢复后通知；真实邮箱与发信服务尚未配置或部署。

Government also plans an independent inspection program that reads the on-chain state of government-organization proposals. For inspection, directors are in an active voting stage only during In approval, and shareholders only during In notice. For an identity with valid eligibility in that stage and no confirmed affirmative or opposing vote, the timer starts at proposal creation for directors and at entry into notice for shareholders. More than one hour without a vote triggers an alert and investigation. Late opinions and expressions after a terminal outcome are not pursued. Missing votes signal an anomaly, not proof that a process has stopped. RPC, unconfirmed transactions, gas and process status are checked before bounded recovery attempts with backoff. Terminated proposals, inapplicable stages and identities without valid eligibility are excluded from timeout checks. Inspection does not sign on anyone's behalf, change on-chain governance or execution conditions, or guarantee timely recovery. This is a government operating plan and is not deployed in production. The user will configure a company-wide email recipient list; on an anomaly, the inspection program is planned to send urgent alerts to every listed recipient, including the proposal, organization, Judge, time and recovery status, without private keys or other secrets. Repeated alerts for the same fault are consolidated and recovery notices are sent; actual email addresses and the sending service are not configured or deployed.

财政设计的创世启动分配由政府持有全部 21,000,000 CNC，再通过真实采购等经济活动进入流通；成熟期可用财政储备目标为约 7,000,000 至 14,000,000 CNC。成熟期区间属于财政管理目标，不是收益或安全保证，也不是链上硬性约束，不改变全球固定总量。本设计不表示创世分配已经完成。

The fiscal design allocates all 21,000,000 CNC to government in the genesis startup phase, followed by circulation through genuine procurement and other economic activity. The mature treasury's available reserve target is approximately 7,000,000 to 14,000,000 CNC. This is a fiscal management target, not a return or safety guarantee or a hard on-chain constraint, and does not change the fixed global supply. The design does not claim that genesis allocation has occurred.

公司承担现实中的服务器运行费用、人员工资等必要运营支出，计划通过出售政府组织地址中已持有的 CNC 获取现实运营资金。出售的是现有 CNC，不是增发；这些 CNC 进入市场后由玩家自由交易，政府再通过拍卖枪械生产配方回收 CNC。政府资金的链上转出仍须遵守组织治理。现实收支、CNC 价格和兑换流动性均不作保证，回收 CNC 不等于取得现实现金营收；银行存款储备不得用于公司的运营开支。这是财政与运营设计，不表示已执行出售。

The company bears necessary real-world operating expenses, including server costs and staff wages, and plans to obtain operating funds by selling CNC already held by the government organization. These sales use existing CNC, not new issuance. Sold CNC enters the market for players to trade freely, while government recovers CNC through auctions of weapon-production blueprints. On-chain transfers of government funds remain subject to organization governance. Real-world income and expenses, the CNC price and conversion liquidity are not guaranteed. Recovering CNC is not the same as earning real-world cash revenue, and bank deposit reserves must not fund company operations. This is a fiscal and operating design, not a claim that sales have occurred.

银行创建时不勾选“禁止提前结束公示期”。玩家发起有效提款申请后，请求随机交给银行组织中一个拥有董事凭证的普通地址所对应的审判者程序，不要求五个特殊管理员账户人工同意。该程序先在本地安全审核，通过后才提交链上提案；各董事审判者独立审核，安全则赞成、异常则拒绝，不要求强制串行。初期三张董事凭证有效赞成后进入公示，一张董事反对即达到 R = 1 并否决。股东审判者独立审核，安全则赞成、异常则拒绝；三张股权凭证赞成可提前通过，一张反对即达到 R = 1 并立即否决。设定的公示期仍至少 24 小时。存款由玩家签名付款，确认真实到账后按 NWID 记账，可提到本人其他绑定普通地址。提前通过与自动提交不能保证即时到账，仍取决于链上确认、审判者程序在线、审批及提案成功执行。授权部署和具体托管控制仍需实现验证，不承诺绝对安全或非托管。

Bank leaves "Prohibit early end of notice" unchecked at creation. A valid player withdrawal request is assigned at random to the Judge Program for an ordinary address holding director credentials in the bank organization, without manual agreement from five special administrator accounts. That program performs a local security review before submitting an on-chain proposal. Director Judges independently review, approving when safe and opposing when an anomaly is found, without a mandatory sequential order. Initially, three valid director-credential affirmative votes begin notice; one opposing director vote reaches R = 1 and rejects it. Shareholder Judges independently review and approve when safe or oppose anomalies. Three equity-credential affirmative votes may pass the proposal early, while one opposing vote reaches R = 1 and immediately rejects it. The configured notice period remains at least 24 hours. Players sign deposit payments, actual receipts are credited by NWID, and withdrawals may go to another ordinary address bound to the same player. Early passage and automatic submission do not guarantee immediate receipt, which still depends on chain confirmation, Judge availability, approval and successful execution. Authorization deployment and custody controls require implementation and validation, without absolute-safety or non-custodial promises.

所有类型提案，包括转账、治理设置、增发和权利类提案，均须先成功扣取 Gas 后才能创建；未成功支付不得出现生效提案。已扣取的发起 Gas 不因最终通过、否决、到期或执行失败而退还。组织提案发起所需 Gas 高于普通转账，具体费率、倍率和资源计量仍待校准，不在此固定数值。提案、投票等链上操作按网络资源消耗承担费用；服务器中的链下安全审核和健康监控本身不消耗链上 Gas，服务器运营成本单独核算。同一已受理请求的重试须幂等处理，防止重复扣取发起 Gas、重复创建生效提案或重复付款。

Every proposal type, including transfers, governance settings, issuance and rights proposals, must successfully debit gas before creation; unsuccessful payment must not produce an effective proposal. Debited initiation gas is not refunded because a proposal passes, is rejected, expires or fails during execution. Organization proposal initiation requires more gas than an ordinary transfer. Exact rates, multipliers and resource metering remain subject to calibration, without fixed figures here. On-chain operations such as proposals and votes incur network-resource fees. Off-chain security review and health monitoring on servers do not themselves consume on-chain gas, and server operating costs are accounted for separately. Retries of the same accepted request must be idempotent, preventing duplicate initiation-gas debits, duplicate effective proposals or duplicate payments.

银行仅按实际收到的 CNC 记录存款负债，保持足额可兑付储备，不贷款、不创造信用、不挪用储户本金。政府、银行和游戏灵石储备资金分别管理，不能混用。上述机构属于后期筹备，不是当前已开通的资产服务。

The bank would record deposit liabilities only against actual CNC receipts, maintaining fully redeemable reserves without lending, credit creation or diversion of customer principal. Government, bank and game Spirit Stone reserves remain separate and cannot be mixed. These institutions are later plans, not currently available asset services.

## 11 实施与风险边界
### Implementation and risk boundaries

账户拆分、钱包界面和链上签名闭环已有本地开发验证，完整凭证治理、真实钱包签名与跨模块联调仍在开发。界面样例、测试数据或隔离测试不能当作生产可用证据。Cenaca 独立性须以停止 NW 及其数据库后仍可出块、转账和使用治理凭证的演练验证。

Local development has exercised account separation, wallet interfaces and isolated on-chain signature flows. Complete credential governance, real wallet signing and cross-module integration remain in development. Interface examples, fixtures and isolated tests are not evidence of production readiness. Cenaca independence requires drills showing continued blocks, transfers and governance credential use with NW and its database stopped.

跨链授权、投票资格与已用票权记账、组织执行原子性、密钥备份恢复、银行托管和灵石停服兑付均需要专项验证。私钥遗失、恶意提案、持续增发稀释、跨链消息错误和链外服务中断可能导致损失。上线前须评估实际运营适用的发行、交易、托管和游戏监管要求；本文不保证资产升值、流动性或交付日期。

Cross-chain authorization, voting eligibility and used-weight accounting, atomic organization execution, key backup and recovery, bank custody, and Spirit Stone redemption during game outages require specific validation. Lost keys, malicious proposals, continued issuance dilution, cross-chain message errors and off-chain outages can cause losses. Applicable issuance, trading, custody and gaming requirements must be assessed before operation. This paper guarantees no appreciation, liquidity or delivery date.