My interpretation of this note in the spec is that this central sentence should actually read "However, most
existing user agent implementations treat 302 as if it were a 303 response, performing a GET on the Location field-value even if the original request method was neither a HEAD nor GET".

So, IMHO, your bullets 1 and 3 should be merged, leaving:

1. For `GET` and `HEAD` requests we follow redirects in 301, 302, 303 and 307 responses keeping the original request method.
2. For non-`GET`/`HEAD` requests we follow redirects in 302 and 303 responses and change the request method to `GET`.
3. For all other cases we don't follow the redirect but return the response as is.

I'm find with this interpretation of the spec and behaving like "most existing user agent implementations".