S00-004: Record blocked task and remediation handoff

Changes: Preserve incomplete work and blocker metadata for S00-004. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: S00-004 acceptance requires establishing legacy/OMEMO2 AND worker/wasm AND persistence without a homegrown ratchet. Reproduced (this run) probes and live public-registry queries confirm only the audited session/ratchet engine + persistence are verified (@signalapp/libsignal-client@0.105.0, Node native addon, zero .wasm). The browser/worker/WASM deployment and the OMEMO/OMEMO2 wire layer are not available from any maintained package on the reachable registry (@signalapp/libsignal, @converse/omemo, @xmpp/omemo, omemo2, omemo-js, omemo-client, omemo-top, omemo-wasm all E404). ENC-009 forbids a homegrown algorithm/ratchet and ENC-011 forbids substituting media AES-GCM for the OMEMO2 wire format, so the spike cannot synthesize a browser backend inside S00-004 scope.

Task: S00-004
Agent: auto-crypto-fe1c81c17ded
Role: crypto
Action: claim
Status: blocked

Task title: Проверить browser OMEMO backend

state/evidence/S00-004-auto-crypto-fe1c81c17ded.md

@@ -0,0 +1,98 @@
+# S00-004 - Browser OMEMO backend spike - Evidence (this run)
+
+- Agent: `auto-crypto-fe1c81c17ded`
+- Role: crypto
+- Task: S00-004 "Проверить browser OMEMO backend"
+- Resumed after: S00-021 remediation (done) - S00-004 back in_progress
+- Date-of-run: 2026-10-15
+
+## 1. Reproduction of the two committed probes (from project root)
+
+### 1a. Known-answer session/ratchet + persistence probe
+Command:
+```
+node experiments/0003-crypto-library/session-probe/smoke.mjs
+```
+Actual result (exit code 0):
+```
+[log:3] Initializing libsignal version:0.105.0
+...
+KAS_OK known plaintext: known vector: OMEMO session smoke
+KAS_OK established via sealed-sender PreKey session
+KAS_OK bob stored session bytes: 631
+SMOKE_PASS
+smoke exit: 0
+```
+Verified: an audited session/ratchet engine (`@signalapp/libsignal-client` APIs)
+establishes a sealed-sender PreKey session, round-trips the known plaintext, stores
+a 631-byte session record and reloads it byte-for-byte. No homegrown ratchet.
+
+### 1b. Unsupported browser/WASM backend probe
+Command:
+```
+node experiments/0003-crypto-library/session-probe/wasm-unsupported.mjs
+```
+Actual result (exit code 2):
+```
+pkgPresent: true
+wasmFiles: 0
+prebuilds: darwin-arm64, darwin-x64, linux-arm64, linux-x64, win32-arm64, win32-x64
+UNSUPPORTED_BLOCKER: no .wasm asset ships in @signalapp/libsignal-client; the
+distribution is a Node native addon (prebuilds/*/*.node). A browser worker/WASM
+deployment is NOT established by this npm package and must be treated as a blocker
+until a verified browser/WASM distribution is found.
+wasm exit: 2
+```
+Verified: the shipped distribution is native-only (zero `.wasm` files; prebuilds
+are `*.node`) and cannot run in a browser worker/WASM endpoint.
+
+## 2. Live public-registry availability check (this run, npmjs.org)
+
+Queried directly (`npm view <pkg> version`); actual responses:
+
+| package | actual response |
+| --- | --- |
+| `@signalapp/libsignal-client` | 0.105.0 (exists; Node native addon; AGPL-3.0-only) |
+| `@signalapp/libsignal` | E404 - Not Found |
+| `@converse/omemo` | E404 - Not Found |
+| `@xmpp/omemo` | E404 - Not Found |
+| `omemo2` | E404 - Not Found |
+| `omemo-js` | E404 - Not Found |
+| `omemo-client` | E404 - Not Found |
+| `omemo-top` | E404 - Not Found |
+| `omemo-wasm` | E404 - Not Found |
+
+Confirmed again: no maintained browser/worker/WASM-capable OMEMO/OMEMO2 package is
+available on the reachable registry. `@signalapp/libsignal` (Signal's WASM web
+distribution) is not published there. The registry is live (it returns the real
+version 0.105.0 for `@signalapp/libsignal-client`), so the E404 responses are
+genuine.
+
+## 3. Scope
+
+- Wrote `state/issues/S00-004-auto-crypto-fe1c81c17ded.json` (one atomac
+  remediation) and this evidence; updated `state/handoffs/S00-004.md`.
+- No source edits outside scope. `docs/decisions/0003-crypto-library.md` and
+  `experiments/0003-crypto-library/**` unchanged (the ADR remains as recorded by
+  S00-021 and correctly lists the browser/WASM + OMEMO2 layer as a blocker).
+
+## 4. Focused checks
+
+1. Known-answer/library smoke -> smoke.mjs exit 0 (`SMOKE_PASS`, 631-byte
+   byte-for-byte session record). PASS.
+2. Unsupported format recorded as blocker, not success -> wasm-unsupported.mjs
+   exit 2 (`UNSUPPORTED_BLOCKER`, `wasmFiles: 0`). PASS.
+3. No out-of-scope edits -> only workflow metadata + this issue in working tree;
+   `experiments/**` unchanged.
+
+## 5. Honest conclusion
+
+The audited session/ratchet engine and persistence are established (verified via a
+known-answer probe). The browser/worker/WASM endpoint and the OMEMO/OMEMO2 wire
+layer are NOT available from any maintained package on the reachable registry,
+confirmed independently on the live public registry this run, and are recorded as a
+blocker (not success), consistent with ENC-009/ENC-011 and the crypto role rule
+"unsupported backend - blocker". S00-004 is therefore escalated: the residual
+blocker (absent verified browser/WASM-capable OMEMO2 backend) requires sourcing or
+an external decision (requires_user_input). S00-004 is not declared done by
+bypassing requirements.