backstage-incident-debuglisted

# Backstage Incident Debugging Narrow a failing Backstage deployment to one layer with evidence before proposing a cause. Read-only by default; anything that mutates a shared environment stops for authorization. ## Preconditions - The exact symptom, its first-seen timestamp, and which environment. Without a timestamp you cannot correlate with deploys, and correlation is most of the diagnosis. - Read access to the failing environment's **merged** config, not the repo's `app-config.yaml`. `app-config.production.yaml` overrides nearly everything that matters. - Backend reachability plus a token if auth is enforced. A `401` with `Missing credentials` from every endpoint is your missing token, not the incident. External callers use `backend.auth.externalAccess` — `type: static` (with `token`, `subject`, optional `accessRestrictions`) or `type: jwks`. - Release line from `backstage.json`, and `yarn backstage-cli info --format json` for Node, CLI, and resolved `@backstage/*` versions. - Generation, because half the diagnostics below do not exist in the other one. Backend: `createBackend()` in `packages/backend/src/index.ts` is the new backend system; `createRouter` files under `packages/backend/src/plugins/` are legacy. Frontend: `createApp` from `@backstage/frontend-defaults` is NFS (default since v1.49); `@backstage/app-defaults` plus `<FlatRoutes>` is legacy. ## Procedure 1. **Record symptom and blast radius before forming any hypothesis.** One entity, one user, one plugin,