What Checkpoint checks, how often, and what it says when a check fails.

What it is

Someone pastes a token address in a group or a direct message. The bot answers with what can be read from public sources, each figure with its source and its time, and closes with Lisa's reading and the signed receipt behind it.

It does not score, rank, recommend or predict. It never links to a wallet, never sends the first message, never asks for anything. A checkpoint reads papers and stamps them; it never says pass or fail. The moment a checker starts ranking things, it stops being a checker.

What it checks, and where each figure comes from

Nine blocks. Three come from the Observatory's own reads of Robinhood Chain (chain 4663), six from Lisa on Sable's token and verdict functions. Every figure carries the name of its source and the time it was read.

Addresses on other chains (Solana, Ethereum, BNB Chain, Base and Arbitrum are detected by the token function) get the contract, market, indexed holders, namesakes and reading blocks. The bot says that the registry, controls and ledger blocks cover chain 4663 alone.

Two holder counts, on purpose

The ledger and the indexer will not match in public, and neither is wrong. The ledger counts every address above 0.001 SABLE from every Transfer since the mint, at the top of the hour, and its balances sum exactly to the supply. The indexer counts at its own moment, with its own rules for dust and contracts.

On 18 September 2026 the ledger said 495 holders at 22:03 UTC while GeckoTerminal said more than 600. The bot prints both lines, each with its source and time, and one sentence that says why they differ. What it cannot do is print one number as if it were the only truth.

Before publication both parties compare the two lists for the same hour and write the exact difference into this page.

The deployer's moves

The same ledger folds every transfer of 100,000 SABLE or more that leaves or reaches the deployer or the launch factory, and every burn of that size, each with its block, its hash read once from the node, and the block's own time. An hour in which the deployer sent more than 0.1% of supply is flagged; smaller moves stay in the list without a flag, so the mark never appears at anyone's discretion.

The words are neutral and the same on both sites: "Deployer transfer: 15.02M SABLE (1.50% of supply) to 3 wallets, 2026-09-20 22:18 to 22:23 UTC". A transfer to the Uniswap v4 pool manager is named as such. The log cannot tell a swap from a liquidity change, so neither site says "swap", "sold" or "dump".

Second order. The wallets that received a flagged deployer transfer are watched for their own moves of 100,000 SABLE or more, under the same hourly rule. That is what tells an airdrop, many small outflows to many wallets, from anything else, without a verdict. The first such flag came on 21 September 2026: one of the three recipients of 20 September sent its whole 1.11M SABLE to the pool manager between 14:44 and 14:47 UTC, in three transfers, each with its hash.

Agreed with AG on 21 September 2026. lisaonsable.com applies the same threshold and wording to its own reading of the deployer balance. Two independent systems, one vocabulary.

What "launch" means

Three moments, three block numbers. The bot names the one it uses.

How often, and what it costs

The readings run on the Lisa on Sable account and AG carries that cost. Without the cap the full budget would be about 2.90 dollars a day; the cap exists so nobody discovers a number at the end of a month. Snapshots on his side are written at most every 15 minutes per token, so polling faster adds nothing.

What it says when a check fails

Each block reports on its own. A failed source is written as "not read" with the reason. It is never dropped and never quietly replaced by an older figure. A validated failure carries the same weight as a validated success.

• Registry not readable. "Cannot confirm", never "official".
• Controls or ledger not readable. That block says so. The other blocks still go out.
• Token function not answering. The Observatory blocks still go out. The market, contract and indexed holder blocks say "not read".
• Enclave not answering within 15 seconds. The facts go out. The reading says "no reading, the engine did not answer".
• Daily cap reached. The facts go out. The reading says "no reading, daily cap reached".
• Every figure carries its own time, so a cached figure is visibly cached.

The record

Every check of a chain 4663 address is posted as a letter to the Observatory's Agent Post inbox: address, verdict, figures, receipt id, time. Never who asked. The board shows the letters with their receipts, so anyone can read what the bot said and when, and check the reading against Sable's own records.

Proposal: Checkpoint gets its own Sable passport and Agent Post handle, checkpoint, allowlisted by both sites, so the letters carry the bot's own name.

A heartbeat letter goes out once a day. If it stops, the Observatory's external uptime monitor alerts. Checks of other chains are not posted, so the board stays about Sable. Agreed.

What it never does

• Score or rank.
• Say buy, sell, hold, or where a price goes.
• Say "passed" or "cleared".
• Link to a wallet, a claim, a bridge or a "verify your wallet" flow.
• Send the first message.
• Store who asked. Telegram user ids live in memory for the 60-second cooldown and are not logged.
• Answer a private message about funds.

Who runs what

Both are credited in every answer and on this page. Both hold $SABLE. The bot's /about carries the dated disclosure line of each.

Ownership

Different contributions, equal ownership. Agreed 21 September 2026.

• The name Checkpoint is shared. Neither party uses it alone.
• Both parties are credited in every answer and on this page.
• The Observatory builds and hosts. Lisa on Sable provides the reading engine and pays for every signed reading.
• One Telegram owner, two key holders. Telegram knows one owner account per bot, so the bot is created from PrimeCircle's account, the party that hosts it, with two-step verification on. The bot token lives on the host and is shared with AG through a secure channel, never through chat. Ownership transfers to the other party on request; BotFather supports that.
• If one party steps back, the other keeps the bot running, the name stays shared, and the one who steps back keeps the credit for what he built.
• If it ever turns commercial in any form (sponsor, subscription, takeover), both parties talk first and split. The terms live in a private note both hold, not on this page.

Message shape

Verification before anyone else sees it

The expected answer per case is written down before the run. The run happens in a private group and its results are attached to this page.

• Test set. The official $SABLE address. Every address in the counterfeit ledger (26 on 20 September 2026). A non-token address. A Solana address. An address on Base. A malformed string.
• Failure drill one. Token function unreachable. The Observatory blocks must still go out.
• Failure drill two. Enclave unreachable. The facts must still go out, the reading must say so.
• Failure drill three. Daily cap reached. Same behaviour, different sentence.
• Gate. Only after all three drills pass does the bot enter a public group.

Decisions

Verification log

21 September 2026, night, before any public group. The bot runs on the Observatory's server as @CheckpointOnChainBot. Composer runs asked for no readings, so no cost fell on AG beyond the three live checks the founder made himself.

• Unit tests. 28, all green: composer, header rule, source labels, reading gate, budget, letters, formatting, Telegram rendering.
• Live checks in Telegram. The official address, one lookalike, one non-token. All three answered as this page says. Two defects found and fixed the same night: the word rule had masked a descriptive "sell" inside Lisa's sentence, so the rule changed (quoted readings are shown whole or withheld whole, never edited, because a receipt stands behind them); and a contract that could not be read printed question marks instead of "not read".
• The test set through the composer against live sources. 33 cases: the official address, every address in the counterfeit ledger (28, one of which is the official contract itself, which the watch lists too), a non-token, a Solana address, an address on Base, a malformed string. No composer error, every answer under the length limit, every verdict as expected.
• Drill one, token function unreachable. Registry, controls and ledger went out; the token blocks said "not read".
• Drill two, enclave unreachable. The facts went out; the reading said "no reading".
• Drill three, daily cap. Not run live, it needs AG to trip it. The composer path is covered by a unit test with the cap response.
• Also changed after the first checks. No reading is asked for when the token function returns no figures at all. A delta of zeros prints "nothing moved". A namesake without indexed liquidity prints "unranked". The header says since when an address is official, and for a lookalike when the counterfeit ledger last changed.

Open before publication

After that: the spec with the exact message format, then the test set, then the Telegram layer.