feat(using-tasks): session lock guard v1.4.0

Adds `.tasks/.lock` awareness to the `using-tasks` skill:

- Session start new step 1: read `.tasks/.lock`; if type:"agent" with
  heartbeat ≤10 min → hard warning + require user confirmation; stale
  lock (TTL expired) → silently overwrite; absent/cleared → write
  type:"interactive" lock (120-min TTL).
- Session end new step 1: delete `.tasks/.lock` when type:"interactive".
- Structure section: `.lock` entry with gitignored callout.
- Rules bullet: "Honour `.tasks/.lock`".
- `.gitignore`: adds `.tasks/.lock` (ephemeral runtime state).
- dist/using-tasks.skill rebuilt.

Closes [using-tasks-session-lock].

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

skills/using-tasks/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: using-tasks
-version: 1.3.0
+version: 1.4.0
 description: >
   Policy skill for working with an existing `.tasks/` board (per-task files + STATUS.md).
   Use whenever the user is switching between tasks, resuming a paused task, starting a new
@@ -35,6 +35,7 @@ If `.tasks/` is **missing**, or `STATUS.md` exists but is non-canonical (e.g. fl
   .tasks/
     STATUS.md          ← active board: 🔴 / 🟡 / ⚪ / 🔵 blocks, sorted by priority
     <task-slug>.md     ← deep context per task, one file each
+    .lock              ← runtime session lock; **gitignored** (never committed)
     archive/
       YYYY-MM.md       ← 🟢 done blocks moved off the board, one file per month
 ```
@@ -43,6 +44,8 @@ Commit `.tasks/` to git. Decision history is valuable; diffs show how thinking e
 
 `STATUS.md` is the **active** board — it must stay lean so orientation reads stay cheap. Closed 🟢 tasks are archived to `archive/YYYY-MM.md` once they pile up; see "### Archiving done tasks".
 
+> **`.tasks/.lock` must be listed in `.gitignore`** (add `.tasks/.lock` to your project's `.gitignore`). The lock file is ephemeral runtime state, not project history — it must never be committed.
+
 ---
 
 ## STATUS.md format
@@ -115,23 +118,35 @@ Temporary hypotheses, links, names of people to consult.
 ## Agent operations
 
 ### Session start
-1. Check if `.tasks/STATUS.md` exists. If not → invoke `setup-tasks` and stop here until it returns.
-2. Read `STATUS.md` — this is the orientation read (see note below on why it's a local read, not an MCP call).
-3. If user names a task, read its `<task-slug>.md`.
-4. Confirm in one sentence: "We're in the middle of X, next step is Y."
-5. Ask if the plan is still correct before doing anything.
-6. If STATUS.md `_Updated` date is >3 days ago, flag it and ask user to confirm current state.
-7. If `STATUS.md` holds **≥ 10** 🟢 done blocks, archive them first (see "### Archiving done tasks") so the board you orient on is lean.
+1. **Session lock guard.** If `.tasks/` exists, read `.tasks/.lock`.
+   - **Active agent lock** — `type:"agent"` with `heartbeat` ≤ 10 minutes old: print the hard warning below and **require explicit user confirmation** before proceeding. Do not touch the board until the user confirms.
+     ```
+     ⚠️ поллер ведёт <slug> — нельзя работать параллельно
+     ```
+     (Substitute the `slug` field from the lock file if present, otherwise omit it.)
+   - **Stale lock** — any type whose TTL has expired (`type:"agent"` with `heartbeat` > 10 min ago; `type:"interactive"` with `started_at` > 2 h ago): silently overwrite.
+   - **Absent or stale lock** (including after user confirmation): write `.tasks/.lock`:
+     ```json
+     {"type":"interactive","started_at":"<ISO8601>","ttl_minutes":120}
+     ```
+2. Check if `.tasks/STATUS.md` exists. If not → invoke `setup-tasks` and stop here until it returns.
+3. Read `STATUS.md` — this is the orientation read (see note below on why it's a local read, not an MCP call).
+4. If user names a task, read its `<task-slug>.md`.
+5. Confirm in one sentence: "We're in the middle of X, next step is Y."
+6. Ask if the plan is still correct before doing anything.
+7. If STATUS.md `_Updated` date is >3 days ago, flag it and ask user to confirm current state.
+8. If `STATUS.md` holds **≥ 10** 🟢 done blocks, archive them first (see "### Archiving done tasks") so the board you orient on is lean.
 
 > **Orient by reading the local `STATUS.md`, not an MCP call.** It is the live board and — kept lean by archival — cheap to read. Do **not** reach for projects-meta tools to enumerate the current project's board:
 > - `tasks_aggregate` is cache-based, cross-project, and does **not** index ready/done — its own docs say to read `.tasks/STATUS.md` directly for the current project.
 > - `tasks_get_status(target_project, slug)` returns a **single** task's live status (`{status, found}`) by a slug you already know — it cannot list the board. Use it only to check **one** known task (e.g. confirm a delegated task's board state, or detect async-human parking), never for orientation.
 
 ### Session end / pause / switch
-1. Update `STATUS.md`: set current task to 🟡, update "Where I stopped" and "Next action".
-2. Append to `<task-slug>.md` Decisions log any non-obvious choices made this session.
-3. Move finished items to "Completed steps".
-4. Commit: `git add .tasks/ && git commit -m "chore: update task status [<task-slug>]"`
+1. **Release session lock.** If `.tasks/.lock` exists and contains `"type":"interactive"`: delete `.tasks/.lock`. (Stale interactive locks are cleaned up here too; silently delete any interactive lock regardless of TTL.)
+2. Update `STATUS.md`: set current task to 🟡, update "Where I stopped" and "Next action".
+3. Append to `<task-slug>.md` Decisions log any non-obvious choices made this session.
+4. Move finished items to "Completed steps".
+5. Commit: `git add .tasks/ && git commit -m "chore: update task status [<task-slug>]"`
 
 ### Task switch
 1. Perform session-end operations for the current task.
@@ -222,6 +237,7 @@ Pair: `using-projects-meta` declares local-first for **reads**; this rule extend
 
 ## Rules
 
+- **Honour `.tasks/.lock`** — read the lock at session start before touching the board; write it after clearing the guard; delete it at session end/pause. Never skip the lock check when `.tasks/` exists. The lock file must be gitignored.
 - **Never lose "Where I stopped"** — most critical field. If unclear, ask before ending session.
 - **One sentence per STATUS.md field** — compress, don't write prose.
 - **Key files must be specific** — not "auth module" but `packages/auth/src/useAuth.ts:87`.