fix(hub): refuse to start with more than one worker

`_connected_nodes`, `_node_groups`, `_webrtc_answers` and the relay registry
are per-process dictionaries. With two workers a node registers in one and
the WebRTC offers for it arrive at the other, so the symptom is a node that
is intermittently offline for half its members — which reads as a network
problem, a NAT problem, anything but a configuration line.

`server.workers` has always defaulted to 1 and the constraint was written
down nowhere. One line at startup, and a function rather than an inline check
so it can be tested.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T4YmK41VsEURWFdop4EEeT

1 files changed, 22 insertions, 0 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/daemon.py b/packages/meshbay-hub/src/meshbay_hub/daemon.py
index 4af26f5..024ca78 100644
--- a/packages/meshbay-hub/src/meshbay_hub/daemon.py
+++ b/packages/meshbay-hub/src/meshbay_hub/daemon.py
@@ -47,6 +47,8 @@ def main() -> None:
     if args.command == "prune-groups":
         sys.exit(asyncio.run(_prune_groups(cfg, args.days, args.dry_run)))
 
+    single_worker_or_exit(cfg.server.workers)
+
     uvicorn.run(
         "meshbay_hub.app:create_app",
         factory=True,
@@ -57,6 +59,26 @@ def main() -> None:
     )
 
 
+def single_worker_or_exit(workers: int) -> None:
+    """Refuse to start with more than one worker.
+
+    Not a preference. `_connected_nodes`, `_node_groups`, `_webrtc_answers`
+    and the relay registry are per-process dictionaries: with two workers a
+    node registers in one and the WebRTC offers for it arrive at the other, so
+    the symptom is a node that is intermittently "offline" for half its
+    members. The mail allowance is in the database and would survive; nothing
+    else here would.
+
+    Refused at startup, where it is one line, rather than found later in a
+    report that describes something else entirely.
+    """
+    if workers != 1:
+        print(f"meshbay-hub: server.workers is {workers}. This hub keeps its "
+              f"node registry and signaling state in memory and supports "
+              f"exactly one worker.", file=sys.stderr)
+        sys.exit(2)
+
+
 async def _prune_groups(cfg, days: int | None, dry_run: bool) -> int:
     """Collect groups that were created and never given a node.