The generated refusal read "point at a app within range". Also adds LiveCompatTest, which checks the half a unit test cannot reach: that two independently-built artifacts agree on the window, that the profile stays readable for a version the server refuses, and that both bounds are enforced. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>