Original fictional client-side self-review. About fifteen minutes.

1. A paragraph must display the characters <b>tea</b>. Identify which kind of insertion keeps them as text and why.
2. POST /notes/12 carries the login cookie and token copper; the session expects silver. Apply the matching rule.
3. A browser preflight names an origin different from the response allow-origin. State the mismatch and what this does not establish about authorization.
4. An untrusted site tries to embed the notes page. Compare the parent policy with the color policy.
5. A connected socket from A sends an edit for note 7, owned by A. Apply the edit rule.

Rubric: text insertion preserves characters; the mismatched token fails; the preflight fails this origin check but does not supply an action-permission result; the parent policy restricts embedding; the same-owner edit satisfies the rule.
For each answer, cite the relevant fact and state that this is a model, not a live browser exchange.