Original fictional browser outcomes for the activity pairs.
Assume no special cross-origin sharing permission in these basic cases.

Pair 1: a script on the first page read the second page's text.
Pair 2: the read was blocked.
Pair 3: the read was blocked.

A form on the first page of pair 2 can still name the other port as its target.
Sending that form is a different fact from reading the response.
curl is a client outside this browser policy.
The server still decides who may read the stored row.

file:///home/desk/lab-site/note.txt
This is a file URL. It is a different reference from the origin http://127.0.0.1:9000.
Local files may have opaque origins; this card makes no browser-specific permission claim.