Original fictional edit requests. No request was sent.

Worked request
POST /notes/7
Cookie: session=ada-session
CSRF token: present, matches the session
Decision: both policy conditions hold.

Fresh guided activity
POST /notes/12
Cookie: valid login cookie
Supplied token: copper
Expected session token: silver
Compare the two values before deciding whether the edit applies.

Additional checkpoint-style evidence, without a supplied decision
POST /notes/9
Cookie: session=ada-session
CSRF token: absent