When a remote patch was built against an older version of a resource and the resource has since changed, the server should reject the patch whenever its edits collide with those later changes. It should never overwrite them silently. Only changes that are provably independent of the intervening edits should be combined automatically, and only when the application defines the rules for doing so. In every other case the server should return the current state, or a conflict description, so the client can rebuild its change against what is actually there.
Why a patch needs a known base
A patch is a description of a change, not a copy of the result. Lines such as “replace the third item”, “set status to closed“, or “insert a paragraph after heading B” only make sense relative to the state the author saw. If that state has moved on, the same instructions can land in the wrong place or contradict an edit the author never saw.
As an Amazon Associate I earn from qualifying purchases.
The fix starts before the patch is sent. The client reads the target, keeps a version identifier for what it read, and builds the patch against that base. For HTTP resources, the natural identifier is a strong ETag. For systems that version objects internally, it is a field such as Kubernetes resourceVersion. Without this identifier the server has no way to tell whether the patch still describes reality.
Check the precondition before applying anything
The PATCH method specification, RFC 5789, supports conditional requests for patch formats that depend on a known base point. A client can send the stored tag in an If-Match header. If the current representation no longer matches, the precondition fails and the server does not apply the change. This turns a silent lost update into an explicit, recoverable failure.
#1 Best Overall
The check and the write must be part of the same operation. A check that runs, then a separate write that does not re-verify the version, reintroduces the race the check was meant to close.
Apply the change atomically
RFC 5789 requires that a patch be all-or-nothing. In its words: “The server MUST apply the entire set of changes atomically and never provide (e.g., in response to a GET during this operation) a partially modified representation.” In practice this means a rejected patch leaves no partial edits behind, and a concurrent reader never sees half of the change. A partially applied patch is harder to recover from than a rejected one, so atomicity matters as much as the version check.
A stale version is a signal, not proof of overlap
A version mismatch only tells you that something changed. It does not tell you whether the changes conflict. Two edits to different paragraphs of a document, or to different fields of a record, may both be safe to keep, while a version bump caused by a single edit to the same field is a real collision.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesTwo well-known systems show the two extremes. Kubernetes rejects an update whose resourceVersion is stale with a 409 Conflict, and the client is expected to re-read and retry (see Kubernetes API Concepts). Git, by contrast, can incorporate changes that touch different regions of a file, and only stops when the same region was edited on both sides (see the git-merge documentation). Neither behavior is wrong; each is right for its own data model.
Do not treat every version increment as a conflict, and do not treat textual separation as proof of safety. Structured data can carry semantic dependencies between fields: changing a quantity may invalidate a total that the patch did not touch. Whether two operations are independent is a property of your data model, and no universal algorithm settles it.
Handling real overlap
When the intervening edits and the incoming patch touch the same thing, the server should preserve both versions for reconciliation rather than choosing one. Git marks such regions as conflicts for resolution. GitHub lists two common causes in pull requests: competing changes to the same line, and an edit on one side against a deletion on the other (see GitHub’s merge conflict reference). VS Code offers a review interface for these regions, with actions to accept the current change, the incoming change, or both (see Resolve merge conflicts in VS Code).
A resolution action only chooses among text fragments. It does not check that the combined result is valid. If the merged document or record breaks a rule, the server or the client must validate it again before saving.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Choosing a strategy
| Approach | How it decides | Protection against lost updates | Work left to the client | Documented examples |
|---|---|---|---|---|
| Strict optimistic concurrency | Rejects any mutation whose base version is stale | Strong, because nothing stale is applied | Re-read, reapply the change, retry | Kubernetes API Concepts; AWS AppSync conflict handling |
| Three-way or operation-aware merge | Compares base, current, and incoming; applies disjoint changes and flags overlaps | Strong only if overlap detection is correct for the data model | Review and resolve flagged overlaps | Git merge; VS Code conflict resolution |
Strict rejection is simpler and easier to make correct, but it puts more retry work on clients. A merge can reduce that work, but it is only as safe as the rules that define independence. Choose based on whether you can state those rules for your resource.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Implementation flow
- Read the target and store its version, such as a strong ETag or
resourceVersion, alongside the content you based the change on. - Construct the patch against that base, and send the version as a precondition (for HTTP, an
If-Matchheader). - On the server, verify the precondition and apply the whole change set in one atomic step.
- If the precondition fails, decide whether merging is allowed for this resource. If it is not, stop here.
- If merging is allowed, compare the patch’s affected fields or regions with every edit made since the base. Apply only operations that are independent under rules you have defined, and re-validate the result.
- For any overlap, or if independence cannot be established, reject the patch without changing state. Return the current representation or a conflict description.
- The client refreshes, reapplies its intent to the current state, and retries with the new precondition.
If overlap cannot be computed reliably, reject the stale operation and require a refresh. Guessing is worse than asking the client to try again.
Choosing the right status code
- 412 Precondition Failed fits when the client sent an explicit precondition, such as
If-Match, and it did not hold. This is the most direct signal in the HTTP PATCH context, as described in RFC 5789. - 409 Conflict can be used when the server detects a possible conflicting modification and no precondition was supplied, and in API families such as Kubernetes where stale versions are reported this way.
- Match the status to the contract you publish. Clients need one predictable meaning for each code, and the response body should include the current state or the conflicting fields so the retry is informed.
What to tell clients to do
Treat a rejected patch as a normal outcome, not an error to hide. The client should discard its stale draft of the change, load the current representation, show the user what changed if a human is involved, and rebuild the patch against the new version. Retries should be bounded, and a repeated conflict on the same resource should be surfaced to the user rather than retried indefinitely.
Quick Recap
“
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →
