Two operational guards for misconfigured rollouts:
1. Drop the MOLLIFIER_REDIS_* fallback to the main REDIS_* cluster.
The mollifier writes to a dedicated Redis to keep burst traffic off
the engine's primary queue — silently colocating with the main Redis
when MOLLIFIER_REDIS_HOST is unset defeats the design.
2. Degrade gracefully instead of crashing the pod. If MOLLIFIER_ENABLED
was flipped on without setting MOLLIFIER_REDIS_HOST, the buffer
returns null (with a one-shot warn log per process) and the drainer
no-ops. No crash loops, no failed deploys, no traffic impact —
operators see the warn line and fix the misconfig in a follow-up
deploy.
The drainer's previously-unreachable "env vars inconsistent" throw
becomes reachable in this degraded mode; replace it with a null return
so worker.server.ts's existing null check short-circuits cleanly.
Dan Sutton
5f06709a59