What is the difference between calls on `builder.Services` and calls on `app` in an ASP.NET Core `Program.cs` file?

In a larger service I keep this composition visible enough to audit. Feature-specific registration methods can group options, handlers, validators, and health checks, while pipeline extensions can group a carefully documented middleware sequence. I avoid extensions that silently add unrelated behavior because startup order, lifetime ownership, and security boundaries become difficult to review. Some framework behavior is inserted or wired automatically by modern hosting, so I test observable behavior instead of assuming every application must copy an old Startup.cs sequence. Composition tests can build the host, resolve required services, inspect mapped endpoints, and send representative requests through WebApplicationFactory. When authentication, CORS, rate limiting, or exception handling fails only in one environment, I check both halves: whether the required services and options were registered, and whether the matching middleware or endpoint metadata participates in the actual request path.