[0.42-r2 M3] isOpenElementRedirect duck type does not validate the status whitelist

[SisyphusZheng]

Severity: medium · Category: protocol defect

Evidence. packages/app/src/authoring.ts: isOpenElementRedirect accepts any { name: 'OpenElementRedirect', location: string, status: number } — a shaped object with status: 200 or an arbitrary status takes the redirect channel, bypassing the constructor's 3xx whitelist (ADR-0121 §3).

Fix. Validate the status against the same {301,302,303,307,308} set in the duck-type branch.

---

Filed from the 0.42 round-2 review (docs/audit/2026-07-28-alpha5-round2-review.md). Target line: 0.42.0-alpha.6.

[SisyphusZheng]

Fixed and shipped in v0.42.0-alpha.6 (npm dist-tags latest/alpha at 0.42.0-alpha.6, tag ccc9407). The fix and its regression test landed via PR #594 (fixture suite 49 tests × 3 engines = 147 green, including the new round-2 specs; unit + parity suites green).