S00-004: Record blocked task and remediation handoff

Changes: Preserve incomplete work and blocker metadata for S00-004. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: Agent timed out; process terminated before escalation

Task: S00-004
Agent: auto-crypto-8bf3dcf711b9
Role: crypto
Action: claim
Status: blocked

Task title: Проверить browser OMEMO backend

state/evidence/S00-004-auto-crypto-8bf3dcf711b9.md

@@ -0,0 +1,105 @@
+# S00-004 - Browser OMEMO backend spike - Evidence
+
+- Agent: `auto-crypto-8bf3dcf711b9`
+- Role: crypto
+- Task: S00-004 "Проверить browser OMEMO backend"
+- Date-of-run: 2026-10-15
+
+## 1. Known-answer session/ratchet + persistence probe (PASS)
+
+Command and result:
+
+```
+cd experiments/0003-crypto-library
+node session-probe/smoke.mjs
+```
+
+Actual output (native libsignal trace + KAS lines):
+
+```
+[log:3] Building PreKeyWhisperMessage for: 796abedb-...-4214?.3 with preKeyId: 31337 (session created at 1792052846)
+[log:3] decrypted PreKey message from <ACI:9d0652a3-...>.1 with current session state ...
+KAS_OK known plaintext: known vector: OMEMO session smoke
+KAS_OK established via sealed-sender PreKey session
+KAS_OK bob stored session bytes: 631
+SMOKE_PASS
+exit code: 0
+```
+
+What is shown: using the canonical real library API
+(`sealedSenderEncryptMessage`/`sealedSenderDecryptMessage`) an independent
+A/B pair established a PreKey session; the exact known plaintext string
+(`known vector: OMEMO session smoke`) round-tripped; the decrypted-stored
+session record serialized to 631 non-empty bytes and reloaded byte-for-byte
+via `SessionRecord.deserialize`.
+
+Verified capability: session/ratchet establishment and session-record
+persistence on a real, unmodified, audited Signal session library. **No
+homegrown ratchet.**
+
+## 2. Unsupported format/backend probe (BLOCKER, exit 2)
+
+Command and result:
+
+```
+cd experiments/0003-crypto-library
+node session-probe/wasm-unsupported.mjs
+```
+
+Actual output:
+
+```
+pkgPresent: true
+wasmFiles: 0
+prebuilds: darwin-arm64, darwin-x64, linux-arm64, linux-x64, win32-arm64, win32-x64
+UNSUPPORTED_BLOCKER: no .wasm asset ships in @signalapp/libsignal-client; the
+distribution is a Node native addon (prebuilds/*/*.node). A browser worker/WASM
+deployment is NOT established by this npm package ...
+exit code: 2
+```
+
+What is shown: the only maintained, installable, audited session library in
+this registry (`@signalapp/libsignal-client@0.105.0`, AGPL-3.0-only) ships as a
+Node native addon and contains no WebAssembly asset. It therefore cannot execute
+in a browser worker as required by the Web client-endpoint.
+
+## 3. OMEMO2 wire-format candidate search (no maintained package)
+
+Registry queries (via proxy, real responses):
+
+| package | result |
+| --- | --- |
+| `omemo2-js` | 404 Not Found |
+| `@oxjs/omemo` | 404 Not Found |
+| `omemo-wasm` | 404 Not Found |
+| `@signalapp/libsignal` | 404 Not Found |
+| `@signalapp/libsignal-client@0.105.0` | exists (AGPL-3.0-only, native addon) |
+| `signal-protocol@0.1.3` | exists (GPL-3.0, 2017-era, unmaintained; not a viable maintained OMEMO2 candidate) |
+
+No maintained browser/WASM-capable OMEMO or OMEMO2 wire-format package is
+available on the reachable registry. `@signalapp/libsignal-client` provides the
+session/ratchet engine but does not provide the OMEMO/OMEMO2 XMPP wire mapping
+(ENC-009/ENC-011 SCE payload/key/MAC stanzas).
+
+## 4. Honest conclusion (blocker, not success)
+
+Feasible and verified:
+- Audited session/ratchet engine + secure session-record persistence (real API,
+  known-answer roundtrip, no homegrown ratchet).
+
+NOT established and therefore a blocker (per focused-check rule "unsupported
+format recorded blocker, not success"):
+- Browser/worker/WASM deployment: distribution is a Node native addon, zero
+  `.wasm` assets; cannot run in the Web client endpoint.
+- OMEMO/OMEMO2 wire-format layer: no maintained browser-capable OMEMO2 package
+  on the registry; raw `signalDecryptPreKey` re-initiation nuance observed during
+  development was not treated as the acceptance path.
+
+Task acceptance-1 requires legacy/OMEMO2 AND worker/wasm AND persistence. Two of
+the three are not established -> escalate a focused remediation that provides or
+records a verified browser/WASM-capable OMEMO backend and the OMEMO2 wire layer.
+
+## Reproduction for reviewer
+- `node experiments/0003-crypto-library/session-probe/smoke.mjs` -> SMOKE_PASS (0)
+- `node experiments/0003-crypto-library/session-probe/wasm-unsupported.mjs` -> exit 2
+- `npm view omemo2-js version` -> 404 (proxy-connected registry)