S00-021: Record verified browser OMEMO backend blocker for S00-004

Changes:
- Re-ran both committed probes unchanged (smoke exit 0 SMOKE_PASS; wasm-unsupported exit 2 UNSUPPORTED_BLOCKER) and recorded actual outputs in state/evidence/S00-021-auto-crypto-fcef9b6781bf.md.
- Verified on the reachable npm proxy that no maintained browser/WASM-capable OMEMO2 package exists: @signalapp/libsignal-client 0.105.0 is native-only (zero .wasm); @signalapp/libsignal, omemo-client, omemo-top, omemo-wasm, @converse/omemo are all E404.
- Wrote docs/decisions/0003-crypto-library.md (proposed) documenting the verified audited session/ratchet + persistence capability and the honest blocker for the browser/worker/WASM endpoint and OMEMO2 wire layer, with traceable primary sources.
- Wrote state/handoffs/S00-021.md with the reproducible next step for the S00-004 continuation.

Validation:
- smoke.mjs -> exit 0 (SMOKE_PASS, 631-byte record byte-for-byte reload).
- wasm-unsupported.mjs -> exit 2 (wasmFiles 0, native prebuilds only).
- npm view E404s confirmed against the same proxy that returns @signalapp/libsignal-client 0.105.0, so responses are genuine.
- make check: 72 tooling tests passed (OK).
- No source changes outside scope: experiments/** unchanged; only state/tasks.json (workflow metadata) plus the in-scope ADR. S00-004 stays blocked (honest blocker), not bypassed.

Task: S00-021
Agent: auto-crypto-fcef9b6781bf
Role: crypto
Action: claim
Status: review

Task title: Устранить прерывание: Проверить browser OMEMO backend

state/evidence/S00-021-auto-crypto-fcef9b6781bf.md

@@ -0,0 +1,93 @@
+# S00-021 - Eliminate interruption cause and prove S00-004 ready - Evidence
+
+- Agent: `auto-crypto-fcef9b6781bf`
+- Role: crypto
+- Task: S00-021 "Устранить прерывание: Проверить browser OMEMO backend"
+- Remediation of: S00-004
+- Date-of-run: 2026-10-15
+
+## 1. Reproduction of the two committed probes (run from project root)
+
+Blocker cause recorded: "Agent timed out; process terminated before escalation".
+The probes from the S00-004 handoff were re-run unchanged to confirm the current,
+reproducible state.
+
+### 1a. Known-answer session/ratchet + persistence probe
+```
+node experiments/0003-crypto-library/session-probe/smoke.mjs
+```
+Actual result (exit code 0):
+```
+[log:3] Building PreKeyWhisperMessage for: 796abedb-...-4214?.3 with preKeyId: 31337
+[log:3] decrypted PreKey message from <ACI:9d0652a3-...>.1 with current session state ...
+KAS_OK known plaintext: known vector: OMEMO session smoke
+KAS_OK established via sealed-sender PreKey session
+KAS_OK bob stored session bytes: 631
+SMOKE_PASS
+exit code: 0
+```
+Verified: an audited session/ratchet engine (real `@signalapp/libsignal-client`
+APIs) establishes a PreKey session, round-trips the known plaintext, stores a
+631-byte session record and reloads it byte-for-byte. No homegrown ratchet.
+
+### 1b. Unsupported browser/WASM backend probe
+```
+node experiments/0003-crypto-library/session-probe/wasm-unsupported.mjs
+```
+Actual result (exit code 2):
+```
+pkgPresent: true
+wasmFiles: 0
+prebuilds: darwin-arm64, darwin-x64, linux-arm64, linux-x64, win32-arm64, win32-x64
+UNSUPPORTED_BLOCKER: no .wasm asset ships in @signalapp/libsignal-client; the
+distribution is a Node native addon (prebuilds/*/*.node). A browser worker/WASM
+deployment is NOT established by this npm package ...
+exit code: 2
+```
+Verified: the shipped distribution is native-only (`dist/Native.js` loads via
+`node-gyp-build`, `prebuilds/*/*.node`, zero `.wasm` files) and cannot run in a
+browser worker/WASM endpoint.
+
+## 2. Registry/primary-source availability check (reachable npm proxy, 2026-10-15)
+
+Queried with `npm view <pkg> version`; actual responses:
+
+| package | actual response |
+| --- | --- |
+| `@signalapp/libsignal-client` | version 0.105.0, license AGPL-3.0-only (exists) |
+| `@signalapp/libsignal` | E404 Not Found |
+| `omemo-client` | E404 Not Found |
+| `omemo-top` | E404 Not Found |
+| `omemo-wasm` | E404 Not Found |
+| `@converse/omemo` | E404 Not Found |
+
+No maintained browser/WASM-capable OMEMO or OMEMO2 package is available on the
+reachable registry. Signal's WASM web distribution (`@signalapp/libsignal`) is not
+published there. Access was established earlier (S00-020, S00-019) and the same
+proxy returns the real version for `@signalapp/libsignal-client`, so the E404
+responses are genuine, not a network outage.
+
+## 3. Deliverable in scope
+
+- Wrote `docs/decisions/0003-crypto-library.md` (proposed) recording the verified
+  audited session/ratchet + persistence capability and the verified blocker for
+  the browser/worker/WASM endpoint and the OMEMO2 wire layer, with traceable
+  primary sources (docs/decisions/0003-crypto-library.md).
+- No source edits outside scope; no spec/plan/shared-contract change.
+
+## 4. Focused checks
+
+1. Reproduce interruption scenario -> both probes re-run: smoke exits 0
+   (SMOKE_PASS), wasm-unsupported exits 2 (blocker line). Reproducible.
+2. No out-of-scope changes -> git working tree contains only workflow metadata
+   (`state/tasks.json`) plus the in-scope ADR; `experiments/**` unchanged.
+
+## 5. Honest conclusion
+
+The audited session/ratchet engine and persistence are established (verified via
+known-answer probe). The browser/worker/WASM endpoint and the OMEMO2 wire layer
+are NOT available from any maintained package on the reachable registry and are
+recorded as a blocker (not success), consistent with ENC-009/ENC-011 and the
+crypto role rule "unsupported backend — blocker". S00-004 is thereby left with a
+documented, reproducible state and a clear next step rather than an
+interrupted/timeout dead-end; it is not declared done by bypassing requirements.