Thirty milestones. And the things each one refused to build.

A full audit before a line was written

Every existing system was mapped first — what already worked, what was duplicated, where the data gaps were. The audit is why several later milestones shipped as documentation rather than as rebuilt code: the work was already done, and claiming it twice would have been dishonest bookkeeping.

The data foundation everything else stands on

Your customers get recognised across email and phone, so the same person booking twice is one customer and not two. Every address is geocoded once. Eighteen marketing channels get normalised from whatever your lead sources actually say. And an event stream starts recording what happens, so history can be reconstructed rather than starting from the day you signed up.

RefusedAn address it can't resolve confidently is linked but kept out of every geographic total. A dimension with under 60% coverage refuses to show a breakdown at all — a chart built from a third of your jobs looks exactly like one built from all of them.

Room to extend without rewrites

Six extension points, so new capabilities plug in rather than requiring the platform to be reopened. Two of those points are deliberately sealed shut.

RefusedThird-party code can never be given the ability to message your customers, and the list of actions the AI can take is closed — which is what makes "it cannot delete anything" a structural fact rather than a promise.

The Intelligence screen itself

One screen that answers "is anything wrong, and what should I do today" — with everything else grouped behind a click, by the question it answers rather than by which part of the software produced it.

Your business, on the record

Twenty-seven things about how you operate — pricing posture, service area, deposit policy, who your customers are — asked one question at a time, with "skip" always free. Every change is logged; nothing gets quietly overwritten.

RefusedAn unanswered question stays unanswered. It never gets filled with an industry default, and if your stated answer contradicts your portal settings, it reports the conflict rather than picking a winner.

A company memory that doesn't fade

Your hundredth booking, your biggest job, your first repeat customer, a high-value cancellation — recorded permanently, dated to when they actually happened rather than when the system noticed. Kept separate from the engine's working notes, which expire.

RefusedNo personal data goes into memory text. People are referenced by link only, so your company history can never become an uncontrolled copy of customer records.

What your business actually prefers, and a twin of your fleet

Relationships learned from behaviour — which vehicle suits which occasion, which route pairs with which service — but only where the pattern is real. Plus a digital twin showing fourteen days of load per vehicle with heavy days flagged.

RefusedA pattern needs three or more observations and a clear majority. A tie claims nothing, because variety is not a preference. And the twin states plainly that it can't detect every booking clash without trip durations, instead of implying your calendar is safe.

What the AI is allowed to know

Six sources of context, each requested explicitly. Nothing gets included by accident, and if anything had to be cut for length, what was cut is recorded rather than silently dropped.

RefusedIt throws an error rather than proceeding if unframed customer text, credentials or contact details ever reach the AI's context — a hard stop, not a warning.

Every AI decision, on the record

Five reasoning modes, each with its own checks. Exactly one is allowed to talk to customers. Every call is logged — including the ones that were skipped, refused, came back invalid or errored — and the summary leads with those, because four of the five outcomes are not successes.

RefusedThe explanation engine never asks the AI to explain itself. Auditing something by asking it how it did would defeat the point. And raw prompts aren't stored — full replay was given up to keep your customer data out of a log.

The health score, the risk register and the opportunity list

Sixteen dimensions across money, sales, operations, customers, service and compliance. Weights renormalise over what could actually be measured. Risks come from real detections first and weak scores second, deduplicated so the same problem never appears twice. Opportunities are ranked by how much they'd move your score.

RefusedOpportunities are never sized in dollars. Promising revenue from a change nobody has measured is exactly the thing this platform exists not to do — so the sizing is in health points, which is arithmetic you can check.

Forecasts you can hold to account

Seven-day and month-end projections that know Saturdays aren't Tuesdays. The range around each one comes from how wrong the forecast actually was in backtesting, not from a textbook distribution. Every forecast is scored against what really happened.

RefusedA forecast is never revised after it's issued — enforced by how it's stored. That's the only reason its accuracy figure means anything. Cash flow, marketing return and annual seasonality are each named and declined, with the reason each can't yet be forecast honestly.

Where the good jobs come from, on a map

An opportunity score per city and ZIP built from five weighted components, each compared against your own average rather than a national benchmark. Mapped, sized by revenue, coloured by score.

RefusedAreas with too few jobs are listed but never ranked — a 100% conversion rate from two jobs would top the chart and mean nothing. Missing data scores as average, not as bad. Competitor data and demographics are named and declined outright.

Marketing truth, and the "what if" simulator

Channel performance is always there. Return on spend appears for the months you entered spend — the one figure the platform genuinely cannot measure for you. Customers segmented by value, loyalty and recency. And the simulator: raise prices, add a vehicle, hire a driver.

RefusedOnly one of the five simulator scenarios projects anything. The rest give you a break-even, because a confident number with nothing behind it is worse than an honest threshold. Unattributed bookings get their own row and are never folded into "direct".

Thirteen analysts who wake on change, not on a timer

Each watches one part of the business. A quiet day wakes nobody and costs nothing — which is how thirteen daily analysts fit inside a flat monthly price. Every wake decision is recorded, including the times they decided to stay asleep.

RefusedAn agent may propose and may never execute. Not one of them can send an email, send a text, or change a record — checked twice, and a forged request is dropped.

What each analyst actually looks for

Thirteen analysers with per-department thresholds — Sales flags at one level, Compliance at a much stricter one. A healthy business produces zero findings, and that silence is reported as a number rather than shown as an empty screen.

RefusedNot one analyser calls the AI. The analysis is deterministic arithmetic, which is why waking an agent is free. An SEO agent was dropped because there's no SEO surface here — an agent with nothing to look at is just a name on a screen.

When two departments see the same problem

Findings that corroborate each other merge into one stronger finding. Findings that contradict each other stay visible on both sides, with their evidence intact.

RefusedConflict is surfaced, never resolved. When two parts of the business disagree, the software names the decision as yours rather than quietly picking one. And the summary never says "we recommend".

An autonomy dial with a hard ceiling

Three levels. A multi-step plan is approved as a whole, and the riskiest step in it sets the approval bar — computed from the steps, so bundling something risky with something safe can never sneak it past you.

RefusedNo level, not even the highest, sends, edits or activates anything unattended. Plans over five steps are rejected because approving them would stop being meaningful, and every plan expires after seven days.

It notices what you do over and over

Watches the event stream for repeated patterns and proposes workflows to handle them — but only workflows the platform can genuinely build, validated against the real catalogue rather than invented.

RefusedA pattern needs twenty occurrences. Three is a coincidence, and the count is always shown. Testing caught a real flaw here: it was treating the last event in every case as a stall, and proposing chase-ups for quotes that had already been answered.

Six playbooks and one approval queue

Where the plan sequencer and the pattern miner meet. Three new plans per day maximum, ordered by severity, with everything held back saying why it was held back.

RefusedThe scarce resource is your attention, so a chronic problem gets a seven-day cool-down rather than the same suggestion every morning. And it refuses the causal claim — it measures what you did with a suggestion, never what it supposedly earned you.

Features you're paying for and not using

Finds capabilities already switched on in your workspace that you've never touched — each with a threshold, a number, and no sales language. Plus a self-report on how the intelligence layer itself is performing.

RefusedThe self-report names four things it cannot tell you and leads with its worst forecast rather than its best. Feature discovery stops at a link — nothing can connect an integration for you. And when it can't read your integration state, it says so rather than telling an already-configured workspace to configure everything.

The outside world, measured against your history

A provider supplies facts — a public holiday, a big local date. Whether that fact matters to you is measured against what happened in your business last time it came around.

RefusedProm and graduation dates are deliberately absent. They're set per school district, and a national guess would look authoritative and be wrong. Four other data providers are documented with the reason each isn't built, because "didn't build" and "forgot" look identical from outside. AI cost is measured from real tokens, never estimated.

An API your other software can read

Read-only by construction — there is no write permission that could be granted, so no key can be issued that changes anything. Only the hash of a key is stored; a lost key is replaced, never recovered.

RefusedThere is no marketplace, and that's the finding. A storefront with nothing on the shelves would be the most convincing fake in the product — an empty marketplace looks exactly like a busy one nobody has used yet.

Goals the platform can actually track

Seven metrics you can set a goal against, with the baseline frozen the moment you create it and measured on the server — so a drifting baseline can never move your own starting line.

RefusedFree-text goals are declined. A progress bar driven by nothing is worse than no progress bar, because it looks like tracking. Goals have three states, not two — on track, would miss, and cannot be judged — and "cannot be judged" never quietly becomes "failing".

See what a plan would do before it does it

A sandbox that previews every step of a plan against your real data, sharing exactly the same validation path as the real executor — so the preview can never be kinder than reality.

RefusedThe sandbox writes nothing, and that's verified against the source rather than trusted. Where a plan would fail, later steps are shown as "not reached" rather than previewed as succeeding.

Your data cannot reach another operator's

Every one of the 173 database queries in the intelligence engine is machine-checked to carry your business's identity. Not held by developer discipline — verified on every build.

RefusedNo module is exempt, and every exception in the allow-list must match a real, flagged line of code — which immediately caught a stale one. The scan found no cross-tenant leak, but it took three corrections to the scanner itself to be able to say that honestly.

The story of your business, in order

Six sources feeding one timeline — the moments that mattered, dated to when they happened, so an imported history lands on its real dates rather than all on the day you signed up.

RefusedNot everything is an event. Each source states on screen what it deliberately leaves out, because an absence with no explanation reads as a bug. Search is a plain text match and says so — someone typing a synonym would otherwise conclude their history was missing.

What it's actually like to deal with you

Conversion tells you how many booked. This tells you the shape of the journey — where people got lost, and where they were simply kept waiting. Two different problems with two different fixes, and a single number would hide whichever one mattered.

RefusedUnder ten cases you get the count and not the percentage. A rate from eight jobs looks identical to a rate from eight hundred, and only one of them is worth acting on.

Paying down the screen's own debt

The Intelligence tab had promised an answer in about five seconds and had quietly grown to sixteen panels, thirteen of them loading at once. No single milestone did anything wrong — each added one reasonable panel and nothing watched the total. Now sections don't load until you open them.

RefusedThe honest finding was published rather than buried. A "Labs" feature-flag system was declined because there's nothing to put in it yet — an empty flag system is the empty-marketplace problem all over again.

Integrations that tell you when they've stopped working

For years the only question asked was "is a credential present?" — so a token revoked three weeks ago still read as connected. The failure mode wasn't a loud break; it was the platform continuing to tell you everything was fine. Now there are five states, and only one of them is red.

RefusedSome integrations genuinely can't be judged, and they report unknowable rather than guessing from something adjacent. Nothing is sent or written to prove an integration works — a health check that generates its own evidence is measuring itself.

"Take me off your list" now has somewhere to go

The finding that stopped this milestone in its tracks: the platform had been able to send email and text since day one and had nowhere to record a person asking it to stop. Now it does — per channel, because "stop texting me" isn't "stop emailing me", and matched across formatting so an opt-out on one phone format doesn't miss the same number written differently.

RefusedThis is not a compliance system and says so everywhere it could be misread. The absence of an opt-out is the absence of a record, not evidence of consent — a green tick would manufacture a legal claim out of an empty table. And approval is not a bypass: a safeguard a human can click past is one that gets clicked past.

A spending limit is never a reason to lose a customer

The finding: the platform could stop answering customers when it hit a spending cap, and nothing told the operator it had. One path returned "success" to a mail forwarder and destroyed the enquiry — with a code that meant it would never be retried. Now a refusal is visible on the main screen without a click, and it says which of the three reasons it was.

RefusedA spending control is never a data-deletion policy. A refused enquiry is stored unread and marked as such, a refused call keeps its transcript, a refused reply is already in your inbox — only the AI step is skipped. And an unspent token and a lost customer are counted as two separate numbers, because summing them would hide the second inside the first.