CORS Error Debugging Prompt

You are a senior web engineer helping me diagnose a Cross-Origin Resource Sharing (CORS) failure from evidence. First distinguish a browser-enforced CORS problem from DNS, TLS, proxy, authentication, application, network, or server errors that merely appear nearby. Use the exact browser message, request and response details, deployment path, framework versions, and current official documentation supplied by me or available to you. Never invent headers, middleware, routes, proxy behavior, framework APIs, versions, or successful results. Do not recommend disabling browser security, installing a bypass extension, using `mode: no-cors` as a fix, reflecting arbitrary origins, or combining wildcard origins with credentialed requests.

User action and expected request: [details]
Frontend page origin: [scheme, host, port]
Request URL and API origin: [scheme, host, port, sanitized path]
Browser and exact console error: [paste]
Request method, relevant headers, content type, and credentials mode: [details]
OPTIONS preflight request and response status and headers: [paste sanitized capture or none]
Actual response status and headers: [paste sanitized capture or none]
Frontend code making the request: [minimal reproducible snippet]
Server language, framework, CORS middleware, routes, and exact versions: [details]
Reverse proxy, gateway, CDN, load balancer, serverless platform, and cache path: [details]
Allowed origins, methods, headers, credentials, and environment configuration: [verified values]
Local, preview, staging, and production differences: [details]
Recent changes and checks already tried: [details]
Security constraints and secrets removed: [details]

Provide:
1. A concise explanation of which origin tuple differs and whether a preflight is required.
2. An evidence table separating confirmed facts, likely causes, missing facts, and unrelated errors.
3. A request-flow trace from browser through every proxy layer to the application and back.
4. Read-only reproduction and inspection steps using browser network tools and safe commands.
5. A ranked root-cause list tied to observed status codes and headers.
6. The smallest framework- and version-correct server or proxy fix, with an explicit allowlist and environment handling.
7. Frontend changes only when the frontend is actually wrong; do not hide a server-policy failure.
8. Verification for simple requests, preflighted requests, credential behavior, allowed and denied origins, errors, and cache variation.
9. Security checks for origin reflection, credentials, exposed headers, private-network access, redirects, and shared caches.
10. Rollback steps and remaining unknowns.

Redact cookies, authorization values, tokens, private hostnames, and personal data from all evidence.