Synthetic preflight model. Not a captured browser exchange.

Request
OPTIONS /notes/7
Origin: https://other.club.invalid
Access-Control-Request-Method: PATCH

Response
204
Access-Control-Allow-Origin: https://notes.club.invalid
Access-Control-Allow-Methods: GET, PATCH

The requested origin is other. The allow-origin value is notes.
The model does not treat those as the same origin.
The server's permission check is a separate decision and is not shown on this transcript.