Data table test cases, where the bulk action hits invisible rows

Selection state is the most consequential thing on this list and almost never tested. Rows are selected, then a filter changes what is visible, and the question is what happens to the selection. If hidden rows stay selected, a bulk action reaches records the user cannot see and did not intend to touch, and there is no confirmation step that would reveal it because the count still looks plausible. The related case is select all, which means two entirely different things depending on whether it covers the current page or every matching row, and the interface has to say which one and how many before a destructive action runs.

Sort stability is the quiet one. Sorting by a column where many rows share a value, with no deterministic tiebreak, produces a different ordering on each query. Paging through that result set will show some records twice and skip others, and the user has no way to tell. It looks like data loss and it is actually non determinism. Alongside it sits type aware sorting: a numeric column sorted as text puts 10 before 9, and a date column sorted by its formatted string orders by month name.

Filters interact with pagination in a way that reads as a bug to every user who hits it. Applying a filter while on page 8 of a result set that now has one page leaves an empty table, and nobody interprets that as "you are on the wrong page". Resetting to the first page on any filter change is the fix, and the empty state needs to name the active filters so a genuinely empty result is distinguishable from a failed request.

Finally, exports and permissions are where a table stops being a display concern. Row level permissions applied to the default view but not to search, filtering or export leak exactly the rows they were meant to hide, and the total count leaks their existence even when the rows themselves are absent. The export needs to honour the active filters, sort and column selection, and it needs to neutralise any cell beginning with an equals sign, because a downloaded file that executes a formula in the recipient spreadsheet is a real attack rather than a formatting quirk.