v0.98.27

Fixed

• Takeover is now atomic from every other session's point of view: the hub
  rebinds the name to the new socket before the eviction close handshake
  awaits (swap-then-close). Previously the identity→socket map kept pointing
  at the dying socket across that await, so a directed message racing the
  takeover could be sent to the evicted socket (and lost), and two takeovers
  racing the same name could each "evict" the same stale owner and co-bind
  two live sockets to one identity. Pinned against a live hub: a probe one
  scheduler step into the eviction sees the new owner, and racing takeovers
  end with exactly one bound survivor that receives directed mail.

Added

• A coverage-exclusion ledger gate: every pragma: no cover in src/ (49,
  audited — Protocol bodies, optional-dependency import guards, typing-only
  imports, entry points, environment-defensive branches) and every
  conditional test skip (32 — platform guards, optional-dependency guards,
  operator-triggered real provider smokes; zero unconditional skips, zero
  xfails) is now enumerated with a justification class in
  tests/test_coverage_exclusion_ledger.py, and the suite fails the moment
  the tree and the ledger disagree — exclusion counts can never drift
  silently in either direction again.

Changed

• The vanished-recipient branches of the hub's directed send
  (send_to_agent: recipient with no live socket; socket that died before
  the hub pruned its binding) are now pinned by real tests — an actually
  closed server-side connection and a genuinely empty registry — instead of
  being excluded from coverage as "unreachable"; a channel member that
  disconnects mid fan-out reaches the first branch through public routing.
  Both misses report False to the caller, never raise.
• The legacy broad project-scoped arm detector
  (legacy_project_scoped_terminal_sidecar) now lives once in
  waiter_identity — the module that owns the -rx sidecar naming
  convention — instead of as two byte-identical private copies inside
  arm and wait dispatch. No behaviour change; both commands refuse
  the legacy shape exactly as before.