feat(app): send one broker to several collectors under one switch

[khagele]

Closes #704

What was wrong

DutchMeshCore takes two stream labels on two collectors, and every config.json broker was its own row with its own switch. The site therefore offered four presets, and a hunter picked one collector and one label per drive.

What this changes

• streams on a config broker. One entry, one row on the brokers page, one line in the Status tab, one switch. legsOf (app/src/brokers.js) turns each stream into a connection with the id <broker>@<host>, so each keeps its own watermark, companion token (signed for its host) and socket. Drain, retention, connect and the startup watermarks now walk connections; rows and switches stay brokers.
• Row status folds its connections (foldLegs): connected when all are, 1 of 2 connected in between, queued as far as the slowest connection.
• Brokers page lists each stream as host · label.
• Add form refuses a host the site already publishes to. The companion's key is the client id on every broker it signs in to, and two sessions under one id kick each other.
• Splash and About say where receptions go, from the brokers that are on: "Your receptions are shared with Mesh-Hunter and DutchMeshCore." With every broker off: "Your receptions stay on this phone."
• Docs: docs/2026-09-21-mqtt-brokers.md amended, AGENTS.md §9 and §10, config.example.json, one changelog entry.

Deploy: the site's config.json

The DutchMeshCore hosts stay out of the repo, so the live config.json needs this at deploy, with the collector addresses the current presets use:

{ "id": "dutchmeshcore", "name": "DutchMeshCore", "auth": "companion", "format": "wardrive",
  "streams": [ { "url": "<collector 1>", "label": "hunter" }, { "url": "<collector 2>", "label": "wardriver" } ] }

The four DutchMeshCore entries leave brokerPresets.

Choices worth a look

• A broker a hunter added from a preset before this is not migrated. After the deploy it shares a host with the site row, so whoever added one removes it once; its row says so. The app is in development, and stored state gets no shims.
• The row counts queued as the maximum over its connections, not the sum: each drains on its own.

Verification

• app: 1640 tests (17 new), eslint, build. web: 762 tests (changelog parity), eslint.
• Every new test mutation-checked: 15 mutations, each red on the test it is about.
• In the browser against three local brokers: the own one got packets, collector 1 got wardriver/obs under meshcore/hunter/…, collector 2 under meshcore/wardriver/…. With the switch off only the own broker got the next reception; switched on again, both collectors caught up. The add form refused collector 2's host.
• Not tested: the real collectors, and a companion signing two tokens in a row.

Overlap

app/changelog.json and web/changelog.json are regenerated here, as in #710 to #718. Whichever merges second reruns node scripts/build-changelog.mjs.

🤖 Generated with Claude Code

[khagele]

Amended (9519f45), three changes:

• changelog.d/2026-09-27-12-dutchmeshcore-by-default.json: the entry moves from 07 to 12. 07 is fix(app,web): put the caret in the target picker's search when it opens #721's, and 08 to 11 belong to fix(app,web): hang a Discover-heard repeater's star from its own position #724 to feat(web): export what the map's filters select, heard and not heard #729.
• A broker a hunter added before this that shares a host with a site stream (the old DutchMeshCore presets) now says so on its row: "Same host as DutchMeshCore: remove this one, or the two keep signing each other out." hostClashes in brokers.js, three tests, each red with the lookup removed. The add form already refused a new one; this is for the one that is already there.
• AGENTS.md §10: the retention paragraph wraps at 100 columns again.

App: 1640 tests (17 new), eslint, build. Web: 762 tests, eslint.

[efiten]

Review before merge: one point to change, one suggestion, three small ones. DutchMeshCore on by default is confirmed on the maintainer side.

1. An existing DutchMeshCore preset keeps signing the new default connection out (change requested)
A hunter who added a DMC preset before this keeps a user:<collector-host> broker that stays on, next to the new site connection dutchmeshcore@<collector-host>. Both connect with clientId: owner (app/src/app.js:2252), so they take turns kicking each other off until the hunter removes theirs. hostClashes (app/src/brokers.js:91) only drives the row message; ensureMqtt (app.js:2190, over legList()) still connects both. On deploy day this reaches every current DMC user.
Proposed: skip clashing user brokers in legList() (for example brokerList().filter(b => !hostClashes(all).has(b.id))), so they stay inert with the "remove this one" hint, plus a test.

2. Suggestion: pin the retention path over connections
Drain, prune and ensureMqtt now iterate connections (legList()/allLegs()) instead of brokers. That is the AGENTS.md §10 watermark invariant, and no test pins it: if prune went back to brokerList() it would read the dutchmeshcore watermark, which never drains, and nothing turns red. A pure owedLegs(brokers) with a test would pin it.

3. Small ones

• Two streams on the same host inside one broker give the same leg id (brokers.js:80), so they share a publisher and a watermark and one label is lost. normalizeConfig could de-duplicate them as it does broker ids.
• brokers.js:170: the "N of M connected" branch comes before signRefused/needsCompanion, so with 1 of 2 up and the other refused by the companion, the row hides the reason.
• row: broker.id on a leg (brokers.js:80) is only read by a test.

[khagele]

Pushed ee69e1e for the review, rebased on master. Per point:

1. A clashing preset signs the default out. liveBrokers in brokers.js leaves a user broker on a site broker's host out of brokerList() and allLegs(), so ensureMqtt never connects it and retention does not wait for it. Its row keeps the "Same host as DutchMeshCore: remove this one" line. Test: the site broker and a user broker on its own host stay, the clashing one goes. Red with the filter removed.
2. Retention over connections. owedLegs(brokers) is what pruneOnce asks: the connections of the live brokers that are on. Tests: a site broker with two streams owes dmc@c1.example and dmc@c2.example:8443, never dmc, and a clashing broker is not owed. Red when it goes back to the rows. AGENTS.md §10 names it.
3. Small ones.
   • normalizeConfig keeps one stream per host (URL.host, the port counts), the first one. Tested.
   • "1 of 2 connected" carries the reason: "· your companion could not sign in" or "· connect your companion to sign in", before the queue count. Tested.
   • row is gone from the legs, and its test with it.

App: 1650 tests, eslint, build. Web: 762 tests, eslint.