The Crisis Bulletin and the Life of a Token

Why this is a chain, not a screen

The Crisis Bulletin looks like one page: red badges, a headline percentage, a scrolling strip of tickers. Underneath it is a chain of small workers that most people never see. One watches the whole pipeline every five minutes and writes warnings. Others clean up after it: they check whether a scheduled delisting actually happened, fix tokens that were wrongly marked dead, and correct warnings that were auto-closed by mistake. This chapter follows that whole chain, including the part where NightWatch found its own headline trust number was measuring the wrong thing and said so in public.

Step 1: the five-minute loop

Everything starts with the keeper worker, which runs on a five-minute loop watching the entire scanning pipeline. Every cycle it checks for anomalies (a grade suddenly dropping, order-book depth collapsing, a spread spiking, an exchange announcement about a delisting) and, when it finds one, writes a row to a table called nw_warnings. It also sends the Telegram alerts. Its ability to auto-restart a dead worker still exists, but the list of workers it can actually restart was cut down in July 2026 to just the two services that live on Render (the API and the frontend); every trading and scanning worker now runs on the Chuncheon server under systemd, which already restarts them on its own, so keeper's restart path is a deliberate no-op for those workers. This one loop is the single source both the Crisis Bulletin's warning cards and the whole "did we call it" tracking system depend on: if keeper goes quiet, both go quiet with it, silently.

Step 2: three columns, one page

The Crisis Bulletin's main board is three columns that read left to right as a funnel: Detection (raw anomalies across the whole scanned SPOT universe), Tracking (the smaller Priority Watchlist getting closer live monitoring), and We Called It (confirmed outcomes: an ST tag, a suspension, a delisting, that a NightWatch warning came before). Below that sits a filterable Token Pulse Grid, which can be narrowed by verdict, exchange, or a search term, including a dedicated ST tab for distress-tagged tokens. A token doesn't have to move through all three columns to end up delisted; a lot of real events skip straight to "We Called It" with no prior Detection entry at all, which is exactly the gap the trust number below has to be honest about.

Since 2026-09-18 the bulletin also carries a separate Perps group: Hyperliquid main-dex and trade.xyz perpetuals, each with a Perp badge and its dex label (Hyperliquid or trade.xyz), plus a provisional marker on a grade with under 7 days of scan history. A perp is graded — the same NW Grade calculator as spot, chapter 2 — but it is not verdicted the Detection/Tracking/We-Called-It way spot rows are; it carries no crisis urgency scale, and it never counts toward the WCI or the grade-dropped warning universe below.

Step 3: the TOKEN LIFECYCLE ticker

Above the three columns runs a scrolling marquee called the Lifecycle Ticker. It is fed by one endpoint, GET /board/lifecycle_events, which independently pulls six kinds of event and fails soft: if one source query breaks, the other five still show up and the broken one just reports itself as failed rather than taking the ticker down.

One design choice is worth knowing: the promotion signal does not come from the token's own change-history log. That log was investigated and rejected, because 2,657 of its roughly 2,660 entries all share the same reason code and near-identical timestamps from a single bulk migration in December 2025, not a live stream of real events. The ticker instead reads a separately maintained "entered main board" marker that keeper updates today.

Clicking a box, or the ticker's background, opens a panel of matching events. Navigation only happens from two links inside that panel (an external "Notice" link when a source URL exists, and "Full story" to the token's own page); the boxes themselves never navigate directly, which keeps an accidental tap on the moving strip from launching you somewhere you didn't mean to go.

Step 4: the number everyone actually reads: WCI

"We Called It" (WCI) is the headline percentage: of the spot tokens that had a real bad outcome, what share did a NightWatch warning predict in advance? It sounds simple. It has not been simple to compute honestly, and the story of getting it right is the most instructive thing in this chapter.

The timeline:

At 38.4%, someone asked a harder question: why had the honest number fallen 27 percentage points since July? The answer, worked out in a full self-audit, is the platform's most detailed piece of self-auditing to date.

About 60% of the fall was not lost skill. It was what got counted. Two things had crept into the denominator that could never have been predicted in the first place:

• Tokenized US equities on Bitget. In June 2026, 516 tickers like RAAPL and RTSLA (crypto wrappers around US stocks) were bulk-onboarded, and more arrive most weeks. They carry a different internal data shape than real crypto pairs, so the grade-based early-warning checks (grade_drop, depth_collapse, and the rest) read missing data and never fire on them. This affects specifically the roughly 83 of these tickers that were suspended with no 7-day liquidity grade ever computed for them; the rest of the tokenized-equity tickers do carry a normal grade and behave like any other token. For the affected 83, the one warning type they can still emit, zero_volume, takes two to three scan cycles to arm, so in practice it lands about one to two hours after the suspension it was supposed to warn about, not before, and so still counts as a miss. Removing this whole class of instrument from the count alone moved the rate from 38.4% to 46.9%.
• Cross-exchange notice fan-out. When one exchange announces it is delisting a pair, the system was recording that as a delisting at every other exchange that happens to list the same ticker, even when those other exchanges said nothing at all. In one worked example, a single Binance announcement about removing a handful of trading pairs turned into about twenty recorded "delistings" spread across nine venues (Binance itself plus eight others that had published no notice at all), including entries claiming a token was being delisted from an exchange that had made no such announcement.

After removing both of those distortions, the real decline was about 11 percentage points, not 27, and it splits into two separate stories rather than one. The rate decline itself is concentrated on three exchanges: KuCoin, MEXC, and Gate.io. But the pattern behind it differs by venue: on KuCoin and Coinbase specifically, tokens that were already grade-A and had been listed for 50 to 320 days were flipping straight to suspended with no liquidity warning beforehand at all, a genuine gap worth investigating, not an artifact. On MEXC the gap is a different mechanism: newly listed tokens are dying before they accumulate the seven days of trading history a liquidity grade requires, so of 22 such under-14-day deaths in the audit window, only 2 were ever called.

What changed on 2026-09-10 ("Definition B2"): the fix was not to loosen the definition. One tempting shortcut was measured and rejected: counting a warning as a "call" even if it was issued up to six hours after the bad outcome (not just before it). That variant produced a rate of 78.8%, and it was rejected on the grounds that a warning issued in the very same detection cycle as the outcome is co-detection, not prediction, and a rate built that way is not meaningfully different in kind from the pre-09-02 90%+ defect. Instead:

• suspension was removed from both ends of the calculation: it is self-referential as a denominator (grading yourself against your own detection) and too easy to co-detect as a numerator.
• The numerator now counts only genuinely predictive warning types (liquidity/depth/volume advisories, on-chain exit signals), not every warning type NightWatch has ever issued.
• Tokenized equities and cross-exchange fan-out notices are excluded from the population by name, not by guessing at a symbol pattern. From 2026-09-18, every Hyperliquid perpetual (asset class perp) is excluded the same way, by exchange name.

Measured the same day: before those pipeline repairs, B2 read 43.4% (389 of 896); after the repairs shipped, it read 51.9% (377 of 726), with an average lead time of about 30 days before the outcome (versus roughly 17 days under the old definition).

The 38.4% figure was never erased. Per NightWatch's own no-retroactive-restatement rule, a number already shown to readers stands as published; the page now carries both figures, with the new one labelled definition B2 since 2026-09-10 and the old one kept as a small secondary line rather than quietly rewritten.

The workers nobody sees

Four more workers exist purely to keep the lifecycle data (and therefore the WCI) honest, and none of them ever appear on the page directly.

Where the Crisis Ribbon shows up

The Home page ("Command Deck") leads with a Crisis Ribbon summarizing active and confirmed delisting warnings before anything else on the page. It is one of six server-rendered sections, each fetched independently with an 8-second timeout and a safe fallback, specifically so one slow data source can never freeze the whole homepage.

How to read a warning card honestly

• A badge count ("12 anomalies") mixes weak and strong signals. It does not tell you severity on its own; open the card.
• A D-N countdown on the lifecycle ticker is a notice date, not a certainty. nw_delist_expire exists precisely because scheduled dates sometimes pass with the token still trading.
• Treat the WCI percentage as two different questions blended into one number until you check the definition text under it: how good is NightWatch at predicting a liquidity-driven death (the real, defensible ~52%), versus how often does it anticipate an exchange's own business decision (close to 0%, because that is not knowable from order-book data at all)?
• A warning disappearing from view after 45 days does not mean it is forgotten; the count and outcome survive in a summary row unless the row was tied to a cited announcement, in which case it is kept in full indefinitely.

What you can do now

• Read the small print next to the WCI percentage before quoting it: it names its own definition version and effective date, because the definition has changed more than once.
• Use the Detection → Tracking → We Called It layout as a funnel for a specific token, not just three unrelated boxes.
• Click a lifecycle ticker box before treating a countdown as fact; the panel's "Notice" link shows the actual source.
• Filter the Token Pulse Grid to the ST tab if you specifically want distress-tagged listings.
• If you are an AI agent: call get_token_intel for a token to get its warning severity, convergence, and lifecycle status in one structured read, rather than parsing the page.