Separate model correctness, Component wiring, Preview behavior, network/backend behavior, and deployed-origin policy. A success at one layer does not prove the others.
Confirm the mounted API reference, trigger, method, host/path, credentials mode, and supplied header/query/body types. Verify the request in a safe environment and inspect browser/network policy; CORS, cookies, authentication, and endpoint availability are outside the schema alone.
Compare the deployed origin, URL/environment values, CORS response, cookie attributes, HTTPS policy, and whether a required secret was incorrectly expected in frontend code. Move server-only credentials behind a backend you control.
Inspect the source schema and IDs. Renaming, deleting, or changing the datatype of an API, Storage, Content, or database field can invalidate Component bindings and generated consumers. Repair the source contract first, then remount/rebind and rerun diagnostics.
Datatype changes can transform or clear incompatible values. Stop further migrations, inspect current records and history/backup options, and restore or correct the affected data deliberately. Undoing a schema definition does not automatically reverse an external/runtime write.
Review returned fields, access rules, filters, and identity paths. Secret/protected values should never be part of a readable result. Test public, signed-out, allowed, and denied identities separately.
That is a current product boundary. Component authentication actions export a TODO rather than a complete client flow, the public backend action engine is unfinished, and safe Users-data export is not complete. Do not ship real credentials through this path.
table-run-action is an explicit runtime write and can have effects outside design-file history. Record the selected project/table/action, parameters, identity, affected records, and backend environment; use the destination's recovery procedure rather than Component Undo.