nx_http_redirect.nx

nx_http_redirect.nx -- HTTP 3xx redirect emitter. Five sealed-enum redirect types per RFC 7231 §6.4: 301 Moved Permanently -- old URL is permanently gone; UA + cache both update. Method MAY change to GET. 302 Found -- temporary; UA does not cache; some UAs historically change POST->GET. 303 See Other -- POST-then-GET pattern. UA always switches to GET. Standard for after- form-submit. 307 Temporary Redirect -- like 302 but PRESERVES method (POST stays POST). Per RFC 7231 §6.4.7. 308 Permanent Redirect -- like 301 but PRESERVES method. Per RFC 7538. Choice matrix: permanent? method-preserving? -> 308 permanent? method-may-change? -> 301 temporary? method-preserving? -> 307 temporary? method-may-change? -> 302 POST-form-submit? -> 303 Substrate's structural safety: - Location value is validated: REJECTS bytes that would inject CR or LF into the response header (preventing CRLF injection vulnerability class). - Location value should ALSO be passed through scheme allowlist to prevent open-redirect attacks; that's a CALLER decision (substrate doesn't impose a policy). Per cardinal feedback-no-third-party-trust-native-or-nothing: substrate's own redirect emitter; no res.redirect() framework, no nginx return-directive translation. nx_capability_claims: needs: [sealed_enum, byte_ops] provides: [http_redirect_emit, crlf_injection_prevention] safety: [no_unchecked_deref, no_floating_point, no_syscall, bounded_iteration, crlf_injection_rejected]