Preflight

A request that isn't simple — here, a PUT — makes the browser send a preflight first: an OPTIONS request that asks the server, ahead of time, whether the real request is allowed. Only if the preflight response authorises the origin and the method (via Access-Control-Allow-Methods) does the browser send the actual request at all.

The Inspector fires a real PUT at the live demo API. In the variant=success run the preflight authorises PUT, so the browser goes on to send it — and the actual PUT returns a matching Access-Control-Allow-Origin, so it's a complete, readable round trip. In variant=missing-method the preflight's Access-Control-Allow-Methods omits PUT, so the browser never sends the actual request — it is stopped before it leaves. The console CORS error you'll see on that run is, again, the demo.