chore(release): prepare v0.20.3 - dot-prefixed repo name fix

Version bump for f425a11 (coord-send.sh/coord-count.sh/coord-sweep.sh
dot-prefixed repo name fix). Bumps plugin.json, package.json, README
badge, and the three skill frontmatters together; CHANGELOG entry added.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CHmf1VfCvaYXamJxe5y6Vt

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "repo-mailbox",
-  "version": "0.20.2",
+  "version": "0.20.3",
   "description": "Local mailbox for coordination between Claude Code sessions in different repositories. Directed messages and broadcasts as plain Markdown files on your own disk, injected as context at session start. Local, private, no network.",
   "author": {
     "name": "Kjell Tore Guttormsen"

CHANGELOG.md

@@ -5,6 +5,27 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.20.3] - 2026-08-09
+
+### Fixed
+
+- **`coord-send.sh` rejected every dot-prefixed repo name, not just `.` and
+  `..`.** The `--to` guard used a `.*` case arm, so a real repo identity that
+  happens to be a hidden directory (basename of a git toplevel, e.g.
+  `~/.claude`) could never be addressed. Reported by morning-driver via
+  coord message. Narrowed to reject exactly `.` and `..`, matching the
+  equivalent guards already used elsewhere in `coord-send.sh` and in
+  `coord-done.sh`.
+- **`coord-count.sh` and `coord-sweep.sh` could not see a dot-prefixed
+  mailbox either.** Both enumerate the mailbox root with a bare `"$COORD"/*`
+  glob, which by construction never matches a dot-prefixed directory
+  (confirmed empirically before the fix). Fixing only the send-side guard
+  would have let a dot-prefixed mailbox receive mail neither script could
+  ever report or close on its grace window. Both now also glob
+  `"$COORD"/.[!.]*`.
+
+`coord-selftest.sh`: 183 -> 191 checks.
+
 ## [0.20.2] - 2026-08-03
 
 ### Added

README.md

@@ -10,7 +10,7 @@ Session A in repo X leaves a message for repo Y; the next session in repo Y gets
 
 *AI-generated: all code produced by Claude Code through dialog-driven development.*
 
-![Version](https://img.shields.io/badge/version-0.20.2-blue)
+![Version](https://img.shields.io/badge/version-0.20.3-blue)
 ![Hooks](https://img.shields.io/badge/hooks-1-green)
 ![Skills](https://img.shields.io/badge/skills-3-orange)
 ![CLI scripts](https://img.shields.io/badge/CLI_scripts-8-blue)

package.json

@@ -1,6 +1,6 @@
 {
   "name": "repo-mailbox",
-  "version": "0.20.2",
+  "version": "0.20.3",
   "private": true,
   "type": "module",
   "engines": {

skills/board/SKILL.md

@@ -20,7 +20,7 @@ description: >-
   user names no repo and no tool — choosing *between* repos is this skill. Not for
   "where were we" inside the current repo: that is this repo's own STATE.md,
   already injected at session start.
-version: "0.20.2"
+version: "0.20.3"
 ---
 
 # board — which repo deserves the next session

skills/coord-send/SKILL.md

@@ -15,7 +15,7 @@ description: >-
   covers retiring a broadcast that has become wrong or obsolete: "retract that
   broadcast", "that announcement is outdated, pull it", "trekk tilbake kringkastingen",
   "den broadcasten er utdatert".
-version: "0.20.2"
+version: "0.20.3"
 ---
 
 # coord-send — natural-language front door for inter-repo messages

skills/route/SKILL.md

@@ -14,7 +14,7 @@ description: >-
   the operator names no model and no tool — choosing the model for the next
   session IS this skill. Not for choosing which REPO gets the next session:
   that is the `board` skill.
-version: "0.20.2"
+version: "0.20.3"
 ---
 
 # route — what the next session should run with