# Rules: ASP.NET / C#

1. **Nullability & Types:** Prefer explicit types and nullable reference type annotations where the project enables them.
2. **Data Access:** Use parameterized queries via `SqlCommand`, Dapper, or Entity Framework — never string-concatenated SQL.
3. **Async:** Use `async`/`await` for I/O-bound operations; avoid blocking calls like `.Result` or `.Wait()`.
4. **TDD:** Write the xUnit/NUnit/MSTest test first, run it and confirm it fails for the right reason, then implement the minimum code to pass it. Do not write production code without a preceding failing test.
5. **Dependency Injection:** Register services via the DI container rather than static singletons, unless working within a legacy WebForms constraint.
6. **Error Handling:** Use structured exception handling and centralized logging; do not swallow exceptions silently.
7. **Architecture:** New or substantially modified web apps use ASP.NET Core MVC or Razor Pages with controllers, models, and views kept in separate files/folders — no business logic embedded in views, no data access called directly from a view or code-behind. WebForms/legacy exceptions must be justified in the spec.
8. **Design by Contract:** Public methods validate their preconditions (e.g., via guard clauses or `ArgumentNullException`/`ArgumentException`) at the top of the method and document postconditions in XML doc comments or the spec's Technical Design section; do not rely on callers to pass valid state unchecked.