S00-022: Record blocked task and remediation handoff

Changes: Preserve incomplete work and blocker metadata for S00-022. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: Pinned libomemo.js@3.0.0 supplies real embedded WASM but is a different unaudited ratchet and excludes consumer SCE; no approved decision reconciles it with S00-022 retained audited engine/persistence requirement.

Task: S00-022
Agent: auto-crypto-bcd7f2a71667
Role: crypto
Action: claim
Status: blocked

Task title: Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint

planning/tasks.json

@@ -1243,7 +1243,8 @@
         "S00-001",
         "S00-002",
         "S00-021",
-        "S00-027"
+        "S00-027",
+        "S00-029"
       ],
       "requirements": [
         "ENC-003",
@@ -1597,6 +1598,62 @@
       ],
       "context_budget_chars": 48000
     },
+    {
+      "id": "S00-029",
+      "stage": "S00",
+      "kind": "blocker",
+      "root_task": "S00-004",
+      "blocker_depth": 2,
+      "unblocks": [
+        "S00-022"
+      ],
+      "role": "orchestrator",
+      "reviewer_role": "security",
+      "title": "Record an approved browser OMEMO backend sourcing strategy",
+      "outcome": "One explicit architecture/security/product-owner sourcing decision naming the retained engine browser port or authorizing bounded evaluation of an alternative, with license/support/security-assessment and persistence compatibility requirements, without waiving ENC-003/009/011.",
+      "depends_on": [
+        "S00-001",
+        "S00-002",
+        "S00-021",
+        "S00-027"
+      ],
+      "requirements": [
+        "ENC-003",
+        "ENC-009",
+        "ENC-011"
+      ],
+      "scope": [
+        "docs/decisions/0003-browser-backend-decision.md"
+      ],
+      "inputs": [
+        "docs/WEB_PROFILE.md",
+        "docs/ARCHITECTURE.md",
+        "docs/CONTRACTS.md",
+        "docs/TESTING.md",
+        "roles/crypto.md",
+        "docs/decisions/README.md",
+        "state/blockers/S00-022.md",
+        "state/blockers/S00-029.md"
+      ],
+      "spec_sections": [],
+      "ui_sections": [],
+      "steps": [
+        "Obtain explicit owner input naming a backend strategy; do not infer approval from candidate availability.",
+        "Record traceable primary sources, exact target, license/support constraints and required independent security assessment and SCE path.",
+        "If alternative engine is selected, require separate reviewed plan change for preservation wording before S00-022 resumes implementation.",
+        "Submit only the bounded decision for independent security review; do not implement crypto."
+      ],
+      "acceptance": [
+        "Explicit owner decision is recorded; the candidate is not declared audited or interoperable without evidence.",
+        "Decision preserves ENC-003/009/011 and identifies remaining browser/SCE/vector/persistence checks.",
+        "Any engine replacement is contingent on reviewed plan change; no silent replacement or implementation occurs."
+      ],
+      "checks": [
+        "Verify owner input and primary-source traceability for named target/license/support/security and SCE boundaries.",
+        "Independent security review confirms decision addresses engine/persistence preservation and contains no requirement bypass."
+      ],
+      "context_budget_chars": 48000
+    },
     {
       "id": "S00-010",
       "stage": "S00",