AddOpenApi() pre-start ApiExplorer freeze is only half-closed by 6.17.2 on hybrid hosts — the document looks populated but silently omits every minimal-API/MVC route

[jeremydmiller]

Surfaced while writing the CritterWatch docs entry for the #3371 / #3373 fix (CritterWatch#689, PR JasperFx/CritterWatch#711). This is a gap in the existing fix, not a new regression.

What 6.17.2 actually fixed

#3373 made Wolverine's own endpoint descriptions start-independent, so a pre-start ApiExplorer read no longer yields an empty document for a Wolverine-only host.

What it does not fix

On a hybrid host — Wolverine HTTP endpoints alongside minimal-API and/or MVC routes — the freeze doesn't go away. It changes shape:

• The pre-start ApiExplorer read still happens. (CritterWatch's AspNetEndpointDiscovery triggers it deliberately, precisely in order to describe the non-Wolverine endpoints.)
• ASP.NET caches the ApiDescription collection for the host lifetime once read.
• ASP.NET's own IApiDescriptionProviders still compose at server start — which is after that read.

So Wolverine's descriptions are now present, and everyone else's are still missing. The document goes from "empty" to "Wolverine routes present, every minimal-API/MVC route absent."

That is strictly more deceptive than the original bug. An empty document is obviously broken and gets investigated in thirty seconds. A document that lists a plausible subset of your routes looks correct, and the missing half gets discovered much later — by a client team that can't find an endpoint, or by a generated SDK that silently lacks it.

Ask

Two parts, and the first matters more than the second:

1. Decide whether Wolverine should refuse to serve a pre-start ApiExplorer read at all rather than serving a knowingly-partial document. A loud failure ("the OpenAPI document was requested before the host started; it would be incomplete") is far kinder than a quiet subset. This is the same move as the managed-distribution daemon guard in Refuse a competing Marten daemon under managed distribution (GH-3388) #3400 — convert a silent wrong-answer into an actionable startup error.
2. If we keep serving it, document the hybrid-host shape explicitly, because the current docs imply 6.17.2 closes the issue outright and on a hybrid host it does not.

Note the awkward wrinkle for part 1: the pre-start read is not a mistake by the caller. CritterWatch does it on purpose, because that is the only way it can enumerate non-Wolverine endpoints for its capability snapshot. So "just don't read pre-start" isn't a complete answer either — whatever we decide has to leave a legitimate way to describe a hybrid host's full route table.

Refs #3371, #3373, JasperFx/CritterWatch#689.