Implement a project update that cannot silently overwrite a newer edit.

• Use the rowversion as an opaque token.
• Return 428 when If-Match is missing.
• Return 412 for a stale token.
• Never accept a version from an editable body field.

I translate the header into EF's original concurrency value. The database compares that value during update, which makes the write conditional without a check-then-update race.

app.MapGet("/projects/{id:guid}", async Task<IResult> (Guid id,
    HttpResponse response, AppDbContext db, CancellationToken ct) =>
{
    var project = await db.Projects.AsNoTracking().SingleOrDefaultAsync(x => x.Id == id, ct);
    if (project is null) return Results.NotFound();
    response.Headers.ETag = EntityTag.Format(project.Version);
    return Results.Ok(new ProjectResponse(project.Id, project.Name));
});

app.MapPut("/projects/{id:guid}", async Task<IResult> (Guid id,
    UpdateProjectRequest request, HttpContext http, AppDbContext db, CancellationToken ct) =>
{
    if (!EntityTag.TryParseSingle(http.Request.Headers.IfMatch, out var expected))
        return Results.Problem(statusCode: StatusCodes.Status428PreconditionRequired,
            title: "If-Match is required");

    var project = await db.Projects.SingleOrDefaultAsync(x => x.Id == id, ct);
    if (project is null) return Results.NotFound();

    project.Name = request.Name.Trim();
    db.Entry(project).Property(x => x.Version).OriginalValue = expected;
    try {
        await db.SaveChangesAsync(ct);
    } catch (DbUpdateConcurrencyException) {
        return Results.Problem(statusCode: StatusCodes.Status412PreconditionFailed,
            title: "Project changed since it was loaded");
    }

    http.Response.Headers.ETag = EntityTag.Format(project.Version);
    return Results.Ok(new ProjectResponse(project.Id, project.Name));
});

The database, not an earlier SELECT, arbitrates the race. Returning the new ETag lets the client continue editing from the representation it just saved.

• If-Match is malformed.
• The row is deleted after loading.
• The client sends a weak or wildcard ETag.
• A save changes the rowversion.

• Load one version and update through two DbContexts.
• Assert 428 without the header.
• Assert the response ETag changes after save.

• Checking rowversion and then issuing an unconditional update.
• Returning 409 for every precondition failure without a contract.
• Putting rowversion in a writable form field.
• Forgetting the new ETag.