# Contract & resilience

Source: https://gortexa.sheng.page/en/examples/resilience/

## 04 breaking-gate — the contract-breaking gate

Proves `gortexa regen`'s buf breaking gate blocks compatibility-breaking proto edits and allows additive ones. This scenario also exercises `regen`'s `isGitToplevel()` path (a macOS `/tmp` → `/private/tmp` symlink once made the gate skip silently; fixed).

```bash
gortexa create bg --module github.com/me/bg --repo "$REPO" --ref main
cd bg && make gen                 # first gen: no main ref yet, gate skips (expected)
git add -A && git commit -m base && git branch -M main

# delete Resource's owner field (tag 3) — a breaking edit
gortexa regen                     # non-zero exit: gate BLOCKS the breaking edit
```

An additive edit (a new field) passes `regen` cleanly. The gate reads proto from the git `main` ref, not from `gen/`.

## 05 resilience-shutdown — graceful drain on SIGTERM

Authenticated mixed load is interrupted mid-flight with SIGTERM; the server must drain in-flight requests within `shutdown_timeout`, exit 0, not panic, and recover on restart.

```bash
./server &                        # a real binary, so SIGTERM lands on the server (not a go run wrapper)
./loadgen ...                     # authenticated load
kill -TERM $SRV                   # SIGTERM while load is in flight
wait $SRV                         # exit 0, drain complete, drain time <= shutdown_timeout
```

A real binary (not `go run`) is used so the exit code is unambiguous — `go run` wraps the server in an extra process.