C# Advanced Capstone: Ship a Production API

The capstone is an order API with create, retrieve, list, cancel, and summary operations. The domain protects valid order state; application handlers coordinate transactions; adapters own EF Core, HTTP, time, identity, and telemetry.

Advanced C# work improves when you separate language syntax, runtime behavior, and application policy. Write down which layer owns the guarantee in this lesson. Then identify the observable evidence—a compiler rejection, test result, generated query, trace, or measurement—that would prove the model correct.

Implement one vertical slice at a time. Define the HTTP contract and acceptance examples, write the domain rule, persist it, expose the endpoint, and add unit plus integration coverage before starting the next slice. Maintain a schema migration and seed only non-sensitive demonstration data.

The starter isolates one part of the mental model so it can run in the browser. The exercise moves the same rule into a current local .NET project where packages, framework hosting, diagnostics, and multi-file tests are available.

using System;
using System.Collections.Generic;

class Order
{
  public string Id { get; private set; }
  public bool Cancelled { get; private set; }
  public Order(string id) { if (string.IsNullOrWhiteSpace(id)) throw new ArgumentException("id"); Id = id; }
  public void Cancel() { if (Cancelled) throw new InvalidOperationException("Already cancelled."); Cancelled = true; }
}
class Program
{
  static void Main()
  {
      var order = new Order("ORD-1001");
      order.Cancel();
      Console.WriteLine(order.Id + ":" + order.Cancelled);
  }
}

ORD-1001:True

Reject duplicate idempotency keys, unauthorized cross-user access, invalid transitions, malformed payloads, missing records, optimistic concurrency conflicts, dependency timeouts, and shutdown cancellation. No handler may swallow an exception or return secret diagnostics.

Classify each failure as a contract violation, transient operational failure, permanent dependency response, concurrency conflict, or programmer defect. That classification determines whether to reject, retry, compensate, cancel, or fail fast. A generic catch-and-continue policy destroys the information needed to make that decision.

Publish a container and documented local stack, validate configuration at startup, run migrations through a controlled step, expose separate liveness and readiness probes, and create a dashboard or query set for request rate, errors, latency, dependency failures, and queue or database pressure.

Finish by making the result operable. Add structured diagnostics at the boundary, propagate cancellation, avoid sensitive data, and record SDK and dependency versions. Test the public behavior instead of private implementation details. If a framework or provider performs translation, serialization, concurrency, or I/O, include at least one test against the real production technology.

A senior-level review should be able to answer four questions: what contract is promised, who owns lifetime and cleanup, how failures become visible, and what evidence supports the design. If any answer depends on “the framework probably handles it,” inspect the documentation or runtime behavior and turn the assumption into a checked decision.