[douglasjarquin]

HC's pre-creation no holder refusal left a saved coordinator attempt that blocked every later start.
Add coordinator recover --attempt to preserve and archive that failed attempt only after exact machine/core observation proves there is no matching terminal.
Lost replies, in-flight launches, receipts, existing coordinator authority and conflicting terminals remain blocked.

Add native profiles for Grok Build 1.0.67 stable, Claude Code 2.1.316 and local Devin CLI 3000.11.234 alongside Codex 0.166.0.
Bind the inspected config environment into the hashed template command, use each profile's submit key throughout coordinator/worker/reviewer initialization and returns, reject unsupported input/config overrides, and retain permission-override disclosure.

Validation:

• Canonical verify_run.py --base 29e912fc1d183ca92f9d2a1a9982fdd391c02a90: passed at 80bfe43 (Go, Python, web; 241 scenarios pass, 45 manual scenarios not-run).
• mise run lint: passed.
• Canonical record: .artifacts/verification/20261031T155245Z-54b0f49f/run.json; clean candidate, no missing required evidence.
• Before/after compiled-CLI recovery capture: red-green.
  Required existing nonvisual captures: before-also-passes, with saved-view-only limits for human actions/review threads and no live GitHub observations.
• Public CLI regressions cover recovery/refusal, all four launch/init/Done return paths, config/version drift, wrong inherited config roots, blocked dialogs and alternate CLI settings refusal.
• Isolated published HC 0.1.14 smoke and incarnation canaries: passed, model-free, both private cores stopped.
• Full model-free Sum lifecycle over published HC with private Git and strict local fake GitHub: passed; its private core stopped.
• Independent source review approved 80bfe43, including the verification policy and feature-map edits.

The record correctly requires root review for VERIFY.md and the coordination feature map; independent review inspected and approved those policy changes.
The candidate does not certify its own changed standard.

Authenticated model turns for the new profiles remain unrun.
Local/offline proof does not certify production acceptance.
No merge, live state recovery, core restart or installation activation is included.
The new recovery command becomes available only after the change is merged and explicitly picked up by the installation.