S00-004: Record blocked task and remediation handoff

Changes: Preserve incomplete work and blocker metadata for S00-004. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: Agent timed out; process terminated before escalation

Task: S00-004
Agent: auto-crypto-8bf3dcf711b9
Role: crypto
Action: claim
Status: blocked

Task title: Проверить browser OMEMO backend

state/handoffs/S00-004.md

@@ -0,0 +1,54 @@
+# Handoff S00-004 - Browser OMEMO backend spike
+
+Agent: `auto-crypto-8bf3dcf711b9`
+Role: crypto
+Status on handoff: escalated (blocker)
+
+## Result
+A focused spike established that an audited Signal session library can provide
+the session/ratchet engine and session-record persistence **without a homegrown
+ratchet** (known-answer sealed-sender roundtrip, 631-byte record, reload
+byte-for-byte). However the same spike established that a browser/worker/WASM
+deployment and the OMEMO2 wire-format layer are **not available** from any
+maintained package on the reachable registry:
+- `@signalapp/libsignal-client@0.105.0` is a Node native addon with zero `.wasm`
+  assets; it cannot run in the Web client endpoint.
+- No maintained `omemo2-js`/`omemo-wasm`/`@signalapp/libsignal`/OMEMO2 package
+  exists on the registry.
+
+Per focused-check rule ("unsupported format recorded blocker, not success") and
+the mandatory escalate protocol, the original task is blocked rather than
+claimed done.
+
+## Outputs produced (all inside accepted scope experiments/0003-crypto-library/**)
+- `experiments/0003-crypto-library/package.json` (exact
+  `@signalapp/libsignal-client@0.105.0`, `--ignore-scripts`).
+- `experiments/0003-crypto-library/session-probe/smoke.mjs` (known-answer probe,
+  mirrors Signal canonical stores).
+- `experiments/0003-crypto-library/session-probe/wasm-unsupported.mjs` (unsupported-format probe).
+- `state/evidence/S00-004-auto-crypto-8bf3dcf711b9.md` (this run's evidence).
+- ADR `docs/decisions/0003-crypto-library.md` was **not** written because the
+  decision would record an unverified/blocked majority of the acceptance (browser
+  WASM + legacy/OMEMO2) rather than a confirmed capability; the outcome must be
+  that a remediation establishes the browser-capable backend first.
+
+## Evidence
+- Known-answer probe: PASS (exit 0), stored 631 bytes, byte-for-byte reload.
+- Unsupported-format probe: exit 2 (no `.wasm`, native addon only).
+
+## Next input for the remediation
+Reproduce intent inside `experiments/0003-crypto-library/**`:
+1. `node session-probe/smoke.mjs` (expect SMOKE_PASS).
+2. `node session-probe/wasm-unsupported.mjs` (expect exit 2 / blocker line).
+3. Establish a verified browser/worker/WASM-capable OMEMO2 backend (library with
+   a real `.wasm`/web build and an OMEMO2 wire mapping), or record with traceable
+   upstream primary sources why the browser endpoint must use a maintained
+   encryption layer consistent with ENC-009/ENC-011 client-endpoint encryption.
+
+# Blocked handoff
+
+Original: S00-004; reporter: auto-crypto-8bf3dcf711b9; resolution: S00-021.
+
+Agent timed out; process terminated before escalation
+
+Next: complete and review the remediation; only a fresh session may continue.