S00-004: Record blocked task and remediation handoff

Changes: Preserve incomplete work and blocker metadata for S00-004. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: S00-004 acceptance requires establishing legacy/OMEMO2 AND worker/wasm AND persistence without a homegrown ratchet. Reproduced (this run) probes and live public-registry queries confirm only the audited session/ratchet engine + persistence are verified (@signalapp/libsignal-client@0.105.0, Node native addon, zero .wasm). The browser/worker/WASM deployment and the OMEMO/OMEMO2 wire layer are not available from any maintained package on the reachable registry (@signalapp/libsignal, @converse/omemo, @xmpp/omemo, omemo2, omemo-js, omemo-client, omemo-top, omemo-wasm all E404). ENC-009 forbids a homegrown algorithm/ratchet and ENC-011 forbids substituting media AES-GCM for the OMEMO2 wire format, so the spike cannot synthesize a browser backend inside S00-004 scope.

Task: S00-004
Agent: auto-crypto-fe1c81c17ded
Role: crypto
Action: claim
Status: blocked

Task title: Проверить browser OMEMO backend

state/handoffs/S00-004.md

@@ -1,54 +1,49 @@
 # Handoff S00-004 - Browser OMEMO backend spike
 
-Agent: `auto-crypto-8bf3dcf711b9`
+Agent: `auto-crypto-fe1c81c17ded`
 Role: crypto
 Status on handoff: escalated (blocker)
 
-## Result
-A focused spike established that an audited Signal session library can provide
-the session/ratchet engine and session-record persistence **without a homegrown
-ratchet** (known-answer sealed-sender roundtrip, 631-byte record, reload
-byte-for-byte). However the same spike established that a browser/worker/WASM
-deployment and the OMEMO2 wire-format layer are **not available** from any
-maintained package on the reachable registry:
-- `@signalapp/libsignal-client@0.105.0` is a Node native addon with zero `.wasm`
-  assets; it cannot run in the Web client endpoint.
-- No maintained `omemo2-js`/`omemo-wasm`/`@signalapp/libsignal`/OMEMO2 package
-  exists on the registry.
+## Result this run
+Re-ran both committed probes unchanged from the S00-021 remediation and confirmed
+the reproduced state. A verified audited session/ratchet engine and session-record
+persistence are established (`@signalapp/libsignal-client@0.105.0`, known-answer
+sealed-sender roundtrip, 631-byte session record reloaded byte-for-byte). The
+browser/worker/WASM deployment and the legacy/OMEMO2 wire layer remain **not
+available** from any maintained package on the reachable registry.
 
-Per focused-check rule ("unsupported format recorded blocker, not success") and
-the mandatory escalate protocol, the original task is blocked rather than
-claimed done.
+Per focused-check rule ("unsupported format recorded blocker, not success") and the
+mandatory escalate protocol, S00-004 is escalated as blocked rather than claimed
+done: the acceptance (legacy/OMEMO2 AND worker/wasm AND persistence) still lacks a
+verified browser/WASM-capable OMEMO2 backend.
 
-## Outputs produced (all inside accepted scope experiments/0003-crypto-library/**)
-- `experiments/0003-crypto-library/package.json` (exact
-  `@signalapp/libsignal-client@0.105.0`, `--ignore-scripts`).
-- `experiments/0003-crypto-library/session-probe/smoke.mjs` (known-answer probe,
-  mirrors Signal canonical stores).
-- `experiments/0003-crypto-library/session-probe/wasm-unsupported.mjs` (unsupported-format probe).
-- `state/evidence/S00-004-auto-crypto-8bf3dcf711b9.md` (this run's evidence).
-- ADR `docs/decisions/0003-crypto-library.md` was **not** written because the
-  decision would record an unverified/blocked majority of the acceptance (browser
-  WASM + legacy/OMEMO2) rather than a confirmed capability; the outcome must be
-  that a remediation establishes the browser-capable backend first.
+## Reproduction this run (all from project root)
+1. `node experiments/0003-crypto-library/session-probe/smoke.mjs` -> exit 0,
+   `SMOKE_PASS`, `KAS_OK bob stored session bytes: 631`.
+2. `node experiments/0003-crypto-library/session-probe/wasm-unsupported.mjs`
+   -> exit 2, `UNSUPPORTED_BLOCKER`, `pkgPresent: true`, `wasmFiles: 0`, prebuilds
+   native `*.node` only.
+3. Live public registry (`npm view <pkg> version`):
+   - `@signalapp/libsignal-client` = 0.105.0 (Node native addon, AGPL-3.0-only).
+   - `@signalapp/libsignal`, `@converse/omemo`, `@xmpp/omemo`, `omemo2`,
+     `omemo-js`, `omemo-client`, `omemo-top`, `omemo-wasm` -> all E404.
 
-## Evidence
-- Known-answer probe: PASS (exit 0), stored 631 bytes, byte-for-byte reload.
-- Unsupported-format probe: exit 2 (no `.wasm`, native addon only).
+## Outputs produced (all inside accepted scope)
+- `state/issues/S00-004-auto-crypto-fe1c81c17ded.json` (one atomac remediation).
+- `state/evidence/S00-004-auto-crypto-fe1c81c17ded.md` (this run's evidence).
+- No source changes elsewhere; `docs/decisions/0003-crypto-library.md` and
+  `experiments/0003-crypto-library/**` unchanged (edits outside this escalation are
+  prohibited for this run).
 
 ## Next input for the remediation
-Reproduce intent inside `experiments/0003-crypto-library/**`:
-1. `node session-probe/smoke.mjs` (expect SMOKE_PASS).
-2. `node session-probe/wasm-unsupported.mjs` (expect exit 2 / blocker line).
-3. Establish a verified browser/worker/WASM-capable OMEMO2 backend (library with
-   a real `.wasm`/web build and an OMEMO2 wire mapping), or record with traceable
-   upstream primary sources why the browser endpoint must use a maintained
-   encryption layer consistent with ENC-009/ENC-011 client-endpoint encryption.
-
-# Blocked handoff
-
-Original: S00-004; reporter: auto-crypto-8bf3dcf711b9; resolution: S00-021.
-
-Agent timed out; process terminated before escalation
-
-Next: complete and review the remediation; only a fresh session may continue.
+1. Confirm `node experiments/0003-crypto-library/session-probe/smoke.mjs` (0) and
+   `.../wasm-unsupported.mjs` (2) from project root.
+2. Source or confirm a maintained browser/worker/WASM-capable OMEMO2 backend (real
+   web/WASM build + OMEMO2/S ce-format mapping from traceable primary sources,
+   license/support/browser constraints checked), or record the specific external
+   product/administrative decision (library/provider/license) needed to bring such
+   a backend in. Requires user/external input.
+3. Run a focused known-answer OMEMO2 roundtrip in the web target and record actual
+   results; unsupported format remains a blocker, not success.
+4. Only then may acceptance-1 (legacy/OMEMO2 AND worker/wasm AND persistence) be
+   re-evaluated; do not declare S00-004 done on the persistence+Ratchet part alone.