refactor(webapp): split mollifier drainer factory into create + start

initializeMollifierDrainer() no longer calls drainer.start() — it
returns a configured-but-stopped drainer. worker.server.ts init() now
invokes drainer.start() AFTER the SIGTERM/SIGINT handlers are
registered, gated on the same __mollifierShutdownRegistered__ guard so
dev hot-reloads can't double-start.

Closes the residual race window between drainer.start() (previously
fired inside the singleton factory) and process.once("SIGTERM",
stopDrainer) in worker.server.ts. With construction and starting
separated, a signal landing during boot can never find the polling
loop running without a graceful-stop path.

Author: d-cs

apps/webapp/app/services/worker.server.ts

@@ -142,9 +142,15 @@ export async function init() {
   try {
     // getMollifierDrainer() runs the singleton factory, which validates the
     // shutdown-timeout reconciliation against GRACEFUL_SHUTDOWN_TIMEOUT and
-    // throws BEFORE starting the polling loop if it's misconfigured. The
+    // throws BEFORE constructing the drainer if it's misconfigured. The
     // outer catch below logs and aborts drainer registration on either that
-    // validation error or a Redis init failure — no half-started state.
+    // validation error or a Redis init failure — no half-started state. The
+    // returned drainer is configured-but-stopped; start() runs below, AFTER
+    // the SIGTERM/SIGINT handlers are registered, so a signal landing during
+    // boot can never find the polling loop running without a graceful-stop
+    // path. Same `__mollifierShutdownRegistered__` guard owns both the
+    // handler registration and the start() call so dev hot-reloads don't
+    // double-register or double-start.
     const drainer = getMollifierDrainer();
     if (drainer && !global.__mollifierShutdownRegistered__) {
       // The drainer owns a polling loop and a Redis client; let it drain
@@ -168,6 +174,7 @@ export async function init() {
       process.once("SIGTERM", stopDrainer);
       process.once("SIGINT", stopDrainer);
       global.__mollifierShutdownRegistered__ = true;
+      drainer.start();
     }
   } catch (error) {
     logger.error("Failed to initialise mollifier drainer", { error });

apps/webapp/app/v3/mollifier/mollifierDrainer.server.ts

@@ -83,10 +83,16 @@ function initializeMollifierDrainer(): MollifierDrainer<BufferedTriggerPayload>
     isRetryable: () => false,
   });
 
-  drainer.start();
   return drainer;
 }
 
+// Returns a configured-but-stopped drainer. Callers MUST register their
+// SIGTERM / SIGINT shutdown handlers before invoking `drainer.start()` —
+// see `apps/webapp/app/services/worker.server.ts`. Starting inside the
+// singleton factory would put the polling loop ahead of handler
+// registration, leaving a narrow window where a SIGTERM landing between
+// `start()` and `process.once("SIGTERM", ...)` would skip the graceful
+// stop. The split is intentional.
 export function getMollifierDrainer(): MollifierDrainer<BufferedTriggerPayload> | null {
   if (env.MOLLIFIER_ENABLED !== "1") return null;
   return singleton("mollifierDrainer", initializeMollifierDrainer);