fix(modules): collision gate false-positives on published static assets — ci.3958 boot refusal

[rbuergi]

The incident

The first image carrying the endpoint-contribution hook (3.0.0-rc3.ci.3958) crash-loops on every published deployment: memex-cloud's new pod refused to serve with

crit: MeshWeaver.Hosting.AspNetCore.MeshModuleEndpointExtensions[0]
      Endpoint route collision(s) after module contributions — refusing to serve:
      GET Memex.Portal.Distributed.styles.css ← [ |  | ]; GET _content/BlazorMonaco/... ← [ |  | ]; ...

memex/atioz are still on ci.3909 only because their self-update poll hadn't fired yet.

Root cause

FindRouteCollisions asserted the whole endpoint table for duplicate (verb, pattern). A published app's MapStaticAssets legitimately registers one endpoint per precompressed variant — identity/gzip/brotli — on the same route, disambiguated by Accept-Encoding content negotiation (the three anonymous parties in the [ | | ] groups). Dev runs have no precompressed variants, so every local run and CI test passed while every published deployment refused.

Fix

The gate's design scope is the #683 class — a module contribution shadowing (or shadowed by) another route. So:

• every module group now stamps MeshModuleEndpointMetadata(moduleName)
• FindRouteCollisions only flags duplicate groups involving ≥1 module-contributed endpoint, and names the module in the refusal
• platform-only duplicates (the published static-asset shape) are exempt

Regression pinned with the exact prod shape: 3× GET + 3× HEAD on one asset route with no module party → clean; the same route colliding with a module endpoint → still refuses. Plus a discovery test that contributed endpoints carry the marker.

Tests: ModuleEndpointContributionTest — 4/4 green locally (Release).

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Fixes a production startup crash-loop caused by the module endpoint collision gate flagging legitimate duplicate static-asset endpoints that appear only in published deployments (precompressed identity/gzip/brotli variants), while preserving the original safety goal of detecting route shadowing involving module-contributed endpoints.

Changes:

• Introduce MeshModuleEndpointMetadata and stamp it onto endpoints contributed via MapMeshModuleEndpoints.
• Narrow FindRouteCollisions to only treat duplicates as collisions when at least one endpoint in the duplicate group is module-contributed, and include the module name in the collision detail.
• Add regression tests covering the published static-asset duplicate shape and module-vs-platform collision behavior; document the fix in What’s New.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
test/MeshWeaver.Hosting.Monolith.Test/ModuleEndpointContributionTest.cs	Adds regression tests for published static-asset duplicates and validates module endpoint marker + collision reporting.
src/MeshWeaver.Hosting.AspNetCore/MeshModuleEndpointMetadata.cs	Adds marker metadata type used to scope collision detection to module-contributed endpoints.
src/MeshWeaver.Hosting.AspNetCore/MeshModuleEndpointExtensions.cs	Stamps module marker metadata on contributed endpoints and updates collision detection + reporting to avoid static-asset false positives.
src/MeshWeaver.Documentation/Data/WhatsNew/2026-08-16-endpoint-gate-published-assets.md	Documents the startup fix for published deployments in What’s New.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

Test Results (shard 0)

919 tests   918 ✅  10m 33s ⏱️
 10 suites    1 💤
 10 files      0 ❌

Results for commit aa8df0c.

[github-actions]

Test Results (shard 4)

1 604 tests   1 598 ✅  7m 5s ⏱️
   11 suites      6 💤
   11 files        0 ❌

Results for commit aa8df0c.

[github-actions]

Test Results (shard 5)

1 371 tests   1 370 ✅  5m 50s ⏱️
   11 suites      1 💤
   11 files        0 ❌

Results for commit aa8df0c.

[github-actions]

Test Results (shard 3)

   11 files     11 suites   6m 9s ⏱️
2 197 tests 2 006 ✅ 191 💤 0 ❌
2 563 runs  2 372 ✅ 191 💤 0 ❌

Results for commit aa8df0c.

[github-actions]

Test Results (shard 1)

2 148 tests   2 045 ✅  6m 44s ⏱️
   11 suites    103 💤
   11 files        0 ❌

Results for commit aa8df0c.

[github-actions]

Test Results (shard 2)

2 440 tests   2 436 ✅  8m 14s ⏱️
   11 suites      4 💤
   11 files        0 ❌

Results for commit aa8df0c.

[github-actions]

Test Results

    65 files      65 suites   44m 39s ⏱️
10 679 tests 10 373 ✅ 306 💤 0 ❌
11 045 runs  10 739 ✅ 306 💤 0 ❌

Results for commit aa8df0c.