Every tier bills on the same two units.

One full engine cycle on one outcome: leak-guard, discovery, calibration re-fit, out-of-time validation, and the gate checks. A run that ends in an honest-empty refusal costs zero credits.

You get a structured refusal with the recorded reasons — the best candidate lift, the surfacing bar it missed, and the failing gate. The run is not billed and the candidate is re-checked on the next cycle.

No. Raw data is processed for the run and then discarded; we retain derived facts and entity IDs only. Entity IDs are kept on purpose — an action cannot target an account without one.

Yes, on MCP. Pro is sales-led because it involves warehouse connectors and audit commitments.

No, deliberately. It re-validates on fresh data every run; it doesn’t silently drift. There is no self-improvement loop to quietly change what a score meant last quarter.

Adoption. The architecture cannot force operators to act on a staged action, and value depends on findings reaching the workflow people actually use. We would rather name that now than discover it at renewal.