From ee69e1ee3df0e24d81042bb35dc9ff8b241712e0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kasper=20H=C3=A4gele?= <kasper@picqer.com>
Date: Sun, 27 Sep 2026 15:11:35 +0200
Subject: [PATCH] feat(app): send one broker to several collectors under one
 switch

DutchMeshCore is one broker with two collectors behind it, and each takes
its own stream label: collector 1 hunter, collector 2 wardriver. Until now
every config.json entry was its own row with its own switch, so the site
offered four presets and a hunter had to pick one per drive.

A config.json broker can now list streams, each with its own url and
label. It stays one entry: one row on the brokers page, one line in the
Status tab, one switch. legsOf makes a connection of each stream under the
id <broker>@<host>, so each keeps its own watermark, companion token and
socket; the drain, retention and connect code now walk connections, the
rows and switches stay brokers. A row's status folds its connections
("1 of 2 connected" in between). The add form refuses a host the site
already publishes to, since two sessions under the companion's key kick
each other. The splash and About say where receptions go, from the
brokers that are on.

Verified: 1637 app and 762 web tests, eslint, build; every new test
mutation-checked. In the browser against three local brokers: the own one
got packets, collector 1 obs under hunter, collector 2 under wardriver;
with the switch off only the own one got the next reception, and on again
both collectors caught up. Not tested against the real collectors or with
a companion signing.

Closes #704

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 AGENTS.md                                     |  17 +-
 app/changelog.json                            |   7 +
 app/index.html                                |   2 +
 app/public/config.example.json                |   9 +-
 app/src/__tests__/brokers.test.js             | 151 +++++++++++++++++-
 app/src/__tests__/config.test.js              |  33 ++++
 app/src/app.js                                |  58 +++++--
 app/src/brokers.js                            | 105 +++++++++++-
 app/src/brokersheet.js                        |  13 +-
 app/src/config.js                             |  24 ++-
 app/src/styles/app.css                        |   3 +
 ...026-09-27-12-dutchmeshcore-by-default.json |   7 +
 docs/2026-09-21-mqtt-brokers.md               |  21 ++-
 web/changelog.json                            |   7 +
 14 files changed, 426 insertions(+), 31 deletions(-)
 create mode 100644 changelog.d/2026-09-27-12-dutchmeshcore-by-default.json

diff --git a/AGENTS.md b/AGENTS.md
index e0c77960..cec134a0 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -764,6 +764,12 @@ default is `hunter`. `test` is a collector's sandbox region, not a label for liv
 either message. A broker marked `auth: "companion"` is signed in to as `v1_{PUBKEY}` with a token
 the companion signs itself (`app/src/companionsign.js`).
 
+A `config.json` broker can list `streams` instead of one `url` (#704): each stream has its own
+`url` and `label`, and the broker stays one row with one switch. Each stream is its own connection
+(`legsOf` in `app/src/brokers.js`), under the id `<broker>@<host>`, with its own watermark and
+token. The site configures DutchMeshCore this way: collector 1 under `hunter`, collector 2 under
+`wardriver`.
+
 ---
 
 ## 10. Resilience invariants (do not break)
@@ -775,11 +781,12 @@ the companion signs itself (`app/src/companionsign.js`).
   published is never deleted, however old — an offline phone keeps everything until it drains.
   IndexedDB is the working set; the backend deduplicates. Publication is tracked by a durable
   watermark, not an in-memory set, so a restart does not re-publish the store.
-  There is one watermark per broker (#554): each broker drains on its own, so one that is offline
-  does not hold the others back, and retention deletes only below the lowest watermark of the
-  brokers that are on. A broker switched off keeps its backlog for the retention window, not
-  beyond it; with every broker off, all of them count and nothing unsent is deleted
-  (`owedBrokers` in `app/src/brokers.js`).
+  There is one watermark per broker (#554), and per stream of a broker that has streams (#704):
+  each connection drains on its own, so one that is offline does not hold the others back, and
+  retention deletes only below the lowest watermark of the brokers that are on. A broker switched
+  off keeps its backlog for the retention window, not beyond it; with every broker off, all of them
+  count and nothing unsent is deleted (`owedLegs` in `app/src/brokers.js`, which asks per
+  connection, never per row).
   See `docs/2026-07-22-retention-and-bounded-reads.md` (#230); this replaces an earlier absolute
   "never deletes local rows" rule, which made the store unbounded.
 - Queue reads are **bounded** — never `getAll()` over the store. The display reads its time window via
diff --git a/app/changelog.json b/app/changelog.json
index b2ca7c2a..d15d527e 100644
--- a/app/changelog.json
+++ b/app/changelog.json
@@ -20,6 +20,13 @@
     "title": "A larger audio buffer",
     "body": "Sound uses a larger output buffer, against ticking while the app is busy right after start."
   },
+  {
+    "id": "2026-09-27-dutchmeshcore-by-default",
+    "date": "2026-09-27",
+    "where": "app",
+    "title": "Your receptions also go to DutchMeshCore",
+    "body": "Your receptions now also go to DutchMeshCore, with one switch under Manage brokers."
+  },
   {
     "id": "2026-09-26-broker-presets-shown",
     "date": "2026-09-26",
diff --git a/app/index.html b/app/index.html
index e9adb8aa..ee82ec3f 100644
--- a/app/index.html
+++ b/app/index.html
@@ -241,6 +241,8 @@ <h1 id="splash-name" class="splash-wordmark">Mesh-Hunter</h1>
              floating callouts, their copy moves into the panel instead. -->
         <ul id="splash-callout-list" class="splash-callout-list" hidden></ul>
         <p id="splash-disclaimer" class="splash-disclaimer"></p>
+        <!-- Where receptions go (#704): brokers.js sharedWith, set by app.js. -->
+        <p id="splash-shared" class="splash-disclaimer"></p>
       </div>
     </div>
     <button type="button" id="splash-close" class="splash-close" aria-label="Close" hidden>
diff --git a/app/public/config.example.json b/app/public/config.example.json
index 69f34368..30ad03b4 100644
--- a/app/public/config.example.json
+++ b/app/public/config.example.json
@@ -3,11 +3,14 @@
   "mqttUsername": "core-hunter",
   "mqttPassword": "<publish-only EMQX account>",
   "brokers": [
-    { "id": "second", "name": "Second broker", "url": "wss://second-broker.example:443", "username": "core-hunter", "password": "<publish-only account>" }
+    { "id": "second", "name": "Second broker", "url": "wss://second-broker.example:443", "username": "core-hunter", "password": "<publish-only account>" },
+    { "id": "collectors", "name": "Community collectors", "auth": "companion", "format": "wardrive", "streams": [
+      { "url": "wss://collector1.example:443", "label": "hunter" },
+      { "url": "wss://collector2.example:443", "label": "wardriver" }
+    ] }
   ],
   "brokerPresets": [
-    { "key": "collector-hunter", "name": "Community collector · hunter", "url": "wss://collector.example:443", "auth": "companion", "format": "wardrive", "label": "hunter" },
-    { "key": "collector-wardriver", "name": "Community collector · wardriver", "url": "wss://collector.example:443", "auth": "companion", "format": "wardrive", "label": "wardriver" }
+    { "key": "other-community", "name": "Another community broker", "url": "wss://other-community.example:443", "auth": "companion", "format": "wardrive", "label": "hunter" }
   ],
   "resolvers": [
     { "label": "BE", "sf": 8, "url": "https://corescope-be.example/api/nodes/resolve" },
diff --git a/app/src/__tests__/brokers.test.js b/app/src/__tests__/brokers.test.js
index 17410f0c..f983d4cf 100644
--- a/app/src/__tests__/brokers.test.js
+++ b/app/src/__tests__/brokers.test.js
@@ -1,5 +1,5 @@
 import { describe, it, expect } from 'vitest'
-import { pruneFloor, owedBrokers, dotState, parseBrokerPrefs, mergeBrokers, validateBroker, brokerStatus, probeBroker, mqttSummary, presetsFrom } from '../brokers.js'
+import { pruneFloor, owedBrokers, dotState, parseBrokerPrefs, mergeBrokers, validateBroker, brokerStatus, probeBroker, mqttSummary, presetsFrom, legsOf, foldLegs, sharedWith, hostClashes, liveBrokers, owedLegs } from '../brokers.js'
 
 describe('pruneFloor: how far retention may delete (#554)', () => {
   it('stops at the broker that is furthest behind', () => {
@@ -276,3 +276,152 @@ describe('brokerStatus tells a refusing companion from an absent one', () => {
     expect(brokerStatus({ enabled: true, connected: false, queued: 0, needsCompanion: true })).toEqual({ dot: 'warn', text: 'Connect your companion to sign in' })
   })
 })
+
+// #704: DutchMeshCore is one broker row with two collectors behind it. The row
+// and its switch are one; the connections are two, and each keeps its own
+// watermark and token, so each needs its own id.
+describe('legsOf: the connections behind one row (#704)', () => {
+  const dmc = { id: 'dmc', name: 'DutchMeshCore', url: 'wss://c1.example:443', auth: 'companion', format: 'wardrive', label: 'hunter', source: 'site', enabled: true,
+    streams: [{ url: 'wss://c1.example:443', label: 'hunter' }, { url: 'wss://c2.example:8443', label: 'wardriver' }] }
+
+  it('is one connection per stream, each with its own address, label and id', () => {
+    const legs = legsOf(dmc)
+    expect(legs.map((l) => [l.id, l.url, l.label])).toEqual([
+      // URL.host, like the user: ids: the default port is not part of it.
+      ['dmc@c1.example', 'wss://c1.example:443', 'hunter'],
+      ['dmc@c2.example:8443', 'wss://c2.example:8443', 'wardriver'],
+    ])
+  })
+
+  it('keeps the row\'s sign-in, format and switch on every connection', () => {
+    for (const l of legsOf(dmc)) {
+      expect(l).toMatchObject({ auth: 'companion', format: 'wardrive', enabled: true, source: 'site' })
+      expect('streams' in l).toBe(false)
+    }
+    expect(legsOf({ ...dmc, enabled: false }).every((l) => l.enabled === false)).toBe(true)
+  })
+
+  it('is the broker itself, under its own id, when it has no streams', () => {
+    const own = { id: 'default', url: 'wss://own.example/ws' }
+    expect(legsOf(own)).toEqual([own])
+    expect(legsOf({ ...own, streams: [] })).toEqual([{ ...own, streams: [] }])
+  })
+})
+
+describe('foldLegs: one status for a row of several connections (#704)', () => {
+  it('is connected only when every connection is, and counts how many are', () => {
+    expect(foldLegs([{ connected: true, queued: 0 }, { connected: false, queued: 0 }])).toMatchObject({ connected: false, up: 1, of: 2 })
+    expect(foldLegs([{ connected: true, queued: 0 }, { connected: true, queued: 0 }])).toMatchObject({ connected: true, up: 2, of: 2 })
+  })
+
+  // Each connection drains on its own, so the row is as far behind as its
+  // slowest one, not the sum of both.
+  it('queues what the connection furthest behind is still owed', () => {
+    expect(foldLegs([{ connected: true, queued: 12 }, { connected: true, queued: 300 }]).queued).toBe(300)
+  })
+
+  it('waits for the companion when any connection does', () => {
+    expect(foldLegs([{ connected: true, queued: 0 }, { connected: false, queued: 0, needsCompanion: true }]).needsCompanion).toBe(true)
+    expect(foldLegs([{ connected: false, queued: 0, signRefused: true }, { connected: false, queued: 0 }]).signRefused).toBe(true)
+  })
+})
+
+describe('brokerStatus for a row with several connections (#704)', () => {
+  it('says how many of its connections are up while not all of them are', () => {
+    expect(brokerStatus({ enabled: true, connected: false, up: 1, of: 2, queued: 0 })).toEqual({ dot: 'warn', text: '1 of 2 connected' })
+    expect(brokerStatus({ enabled: true, connected: false, up: 1, of: 2, queued: 40 })).toEqual({ dot: 'warn', text: '1 of 2 connected · 40 queued' })
+  })
+
+  it('reads as one broker when all or none are up', () => {
+    expect(brokerStatus({ enabled: true, connected: true, up: 2, of: 2, queued: 0 })).toEqual({ dot: 'on', text: 'Connected' })
+    expect(brokerStatus({ enabled: true, connected: false, up: 0, of: 2, queued: 0, needsCompanion: true })).toEqual({ dot: 'warn', text: 'Connect your companion to sign in' })
+  })
+
+  it('names why the other connection is down, not only the count', () => {
+    expect(brokerStatus({ enabled: true, connected: false, up: 1, of: 2, queued: 0, signRefused: true })).toEqual({ dot: 'warn', text: '1 of 2 connected · your companion could not sign in' })
+    expect(brokerStatus({ enabled: true, connected: false, up: 1, of: 2, queued: 5, needsCompanion: true })).toEqual({ dot: 'warn', text: '1 of 2 connected · connect your companion to sign in · 5 queued' })
+  })
+})
+
+// A second session under one client id kicks the first, and every broker the
+// companion signs in to uses the companion's key as its id. A hunter adding a
+// collector the site already publishes to would set the two fighting.
+describe('validateBroker refuses a host the site already publishes to (#704)', () => {
+  it('refuses the host of any site connection, port included', () => {
+    const r = validateBroker({ url: 'wss://c2.example:8443', auth: 'companion' }, [], { takenHosts: ['c1.example', 'c2.example:8443'] })
+    expect(r.ok).toBe(false)
+    expect(r.errors.url).toMatch(/already/)
+    expect(validateBroker({ url: 'wss://c2.example:9443', auth: 'companion' }, [], { takenHosts: ['c2.example:8443'] }).ok).toBe(true)
+  })
+})
+
+// The splash and About say where receptions go (#704), from the brokers that
+// are on, so a site without DutchMeshCore or a hunter who switched it off does
+// not read that it is there.
+describe('sharedWith: where receptions go, in one sentence (#704)', () => {
+  it('names every broker that is on', () => {
+    expect(sharedWith(['Mesh-Hunter'])).toBe('Your receptions are shared with Mesh-Hunter.')
+    expect(sharedWith(['Mesh-Hunter', 'DutchMeshCore'])).toBe('Your receptions are shared with Mesh-Hunter and DutchMeshCore.')
+    expect(sharedWith(['Mesh-Hunter', 'DutchMeshCore', 'BE community'])).toBe('Your receptions are shared with Mesh-Hunter, DutchMeshCore and BE community.')
+  })
+
+  it('names a broker once, and says the receptions stay put when every broker is off', () => {
+    expect(sharedWith(['Mesh-Hunter', 'Mesh-Hunter'])).toBe('Your receptions are shared with Mesh-Hunter.')
+    expect(sharedWith([])).toBe('Your receptions stay on this phone.')
+  })
+})
+
+// A broker a hunter added from a preset before #704 shares a host with the
+// site's stream after the deploy. Both sign in under the companion's key, so
+// the two sessions keep signing each other out, and all the hunter sees is a
+// row that blinks. The add form refuses a new one; an existing one is named
+// on its row so the hunter knows which to remove.
+describe('hostClashes names the site broker a hunter\'s own broker collides with (#704)', () => {
+  const site = { id: 'dmc', name: 'DutchMeshCore', source: 'site', url: 'wss://c1.example:443', enabled: true,
+    streams: [{ url: 'wss://c1.example:443', label: 'hunter' }, { url: 'wss://c2.example:8443', label: 'wardriver' }] }
+  const own = { id: 'default', name: 'Mesh-Hunter', source: 'site', url: 'wss://mqtt.example/ws', enabled: true }
+
+  it('finds a user broker on any host of a site broker, port included', () => {
+    const user = { id: 'user:c2.example:8443', name: 'DMC wardriver', source: 'user', url: 'wss://c2.example:8443', enabled: true }
+    expect(hostClashes([own, site, user])).toEqual(new Map([['user:c2.example:8443', 'DutchMeshCore']]))
+  })
+
+  it('names nothing for a user broker on its own host, or a site broker beside another', () => {
+    const user = { id: 'user:c2.example:9443', name: 'Mine', source: 'user', url: 'wss://c2.example:9443', enabled: true }
+    expect(hostClashes([own, site, user])).toEqual(new Map())
+    expect(hostClashes([own, site])).toEqual(new Map())
+  })
+
+  it('names the clash whether either broker is on or off', () => {
+    const user = { id: 'user:c1.example', name: 'DMC hunter', source: 'user', url: 'wss://c1.example:443', enabled: false }
+    expect(hostClashes([{ ...site, enabled: false }, user]).get('user:c1.example')).toBe('DutchMeshCore')
+  })
+})
+
+// A clashing broker a hunter added stays on its row with the hint, and is
+// never connected: both sessions sign in under the companion's key, so a
+// second one would keep signing the site's connection out (#704).
+describe('liveBrokers leaves a clashing user broker out (#704)', () => {
+  const site = { id: 'dmc', name: 'DutchMeshCore', source: 'site', url: 'wss://c1.example:443', enabled: true,
+    streams: [{ url: 'wss://c1.example:443', label: 'hunter' }, { url: 'wss://c2.example:8443', label: 'wardriver' }] }
+  const clash = { id: 'user:c2.example:8443', name: 'DMC wardriver', source: 'user', url: 'wss://c2.example:8443', enabled: true }
+  const mine = { id: 'user:mine.example', name: 'Mine', source: 'user', url: 'wss://mine.example', enabled: true }
+  it('keeps the site broker and a user broker on its own host', () => {
+    expect(liveBrokers([site, clash, mine]).map((b) => b.id)).toEqual(['dmc', 'user:mine.example'])
+  })
+})
+
+// AGENTS.md §10: a reception is pruned once every connection owed it has it,
+// and a watermark is kept per connection. So what prune asks about are the
+// connections, never the row: the row's own id has no watermark that drains.
+describe('owedLegs: what retention waits for (#704)', () => {
+  const site = { id: 'dmc', name: 'DutchMeshCore', source: 'site', url: 'wss://c1.example:443', enabled: true,
+    streams: [{ url: 'wss://c1.example:443', label: 'hunter' }, { url: 'wss://c2.example:8443', label: 'wardriver' }] }
+  const clash = { id: 'user:c1.example', name: 'DMC hunter', source: 'user', url: 'wss://c1.example:443', enabled: true }
+  it('is every connection of the brokers that are on, not the rows', () => {
+    expect(owedLegs([site]).map((l) => l.id)).toEqual(['dmc@c1.example', 'dmc@c2.example:8443'])
+  })
+  it('does not wait for a clashing broker that never connects', () => {
+    expect(owedLegs([site, clash]).map((l) => l.id)).toEqual(['dmc@c1.example', 'dmc@c2.example:8443'])
+  })
+})
diff --git a/app/src/__tests__/config.test.js b/app/src/__tests__/config.test.js
index 1e4e362f..f2e1b34e 100644
--- a/app/src/__tests__/config.test.js
+++ b/app/src/__tests__/config.test.js
@@ -126,6 +126,39 @@ describe('normalizeConfig brokers (#554)', () => {
     expect('format' in c.brokers[2]).toBe(false)
     expect('label' in c.brokers[2]).toBe(false)
   })
+
+  // #704: DutchMeshCore is one broker with two collectors behind it, each
+  // taking its own stream label. One entry, so one row and one switch.
+  it('reads a broker\'s streams, each with its own address and label', () => {
+    const c = normalizeConfig({ brokers: [{ id: 'dmc', name: 'DutchMeshCore', auth: 'companion', format: 'wardrive', streams: [
+      { url: 'wss://c1.example:443', label: 'hunter' },
+      { url: ' wss://c2.example:443 ', label: 'Wardriver' },
+    ] }] })
+    expect(c.brokers[0]).toEqual({
+      id: 'dmc', name: 'DutchMeshCore', url: 'wss://c1.example:443', auth: 'companion', format: 'wardrive', label: 'hunter',
+      streams: [{ url: 'wss://c1.example:443', label: 'hunter' }, { url: 'wss://c2.example:443', label: 'wardriver' }],
+    })
+  })
+
+  it('gives a stream without a label the broker\'s own, and drops a stream without an address', () => {
+    const c = normalizeConfig({ brokers: [{ id: 'dmc', format: 'wardrive', label: 'wardriver', streams: [
+      { url: 'wss://c1.example' }, { label: 'hunter' }, null,
+    ] }] })
+    expect(c.brokers[0].streams).toEqual([{ url: 'wss://c1.example', label: 'wardriver' }])
+  })
+
+  // A connection's id is the broker's id and the stream's host, so two
+  // streams on one host would share a publisher and a watermark.
+  it('keeps one stream per host', () => {
+    const c = normalizeConfig({ brokers: [{ id: 'dmc', format: 'wardrive', streams: [
+      { url: 'wss://c1.example:443', label: 'hunter' }, { url: 'wss://c1.example', label: 'wardriver' },
+    ] }] })
+    expect(c.brokers[0].streams).toEqual([{ url: 'wss://c1.example:443', label: 'hunter' }])
+  })
+
+  it('refuses a broker whose streams all lack an address, like one without a url', () => {
+    expect(() => normalizeConfig({ brokers: [{ id: 'dmc', streams: [{ label: 'hunter' }] }] })).toThrow(/mqttUrl/)
+  })
 })
 
 // The add form reads its presets through getConfig(), which holds the
diff --git a/app/src/app.js b/app/src/app.js
index ccca2b38..b23670f9 100644
--- a/app/src/app.js
+++ b/app/src/app.js
@@ -19,7 +19,7 @@ import { classifyReception, carriesSignedIdentity, stripIdentity, undecodableRec
 import { rememberPing, matchTraceTarget } from './tracetag.js'
 import { buildRecord, shouldCapture } from './capture.js'
 import { Queue, RETENTION_MS, shouldContinueDraining, nextWatermark, DEFAULT_BROKER } from './queue.js'
-import { pruneFloor, owedBrokers, dotState, mergeBrokers, validateBroker, probeBroker, brokerStatus, mqttSummary, presetsFrom } from './brokers.js'
+import { pruneFloor, owedLegs, liveBrokers, dotState, mergeBrokers, validateBroker, probeBroker, brokerStatus, mqttSummary, presetsFrom, legsOf, foldLegs, hostOf, sharedWith } from './brokers.js'
 import { createBrokerSheet } from './brokersheet.js'
 import { createTrackWindow } from './wardrive.js'
 import { createSigner, buildBrokerToken, brokerUsername, brokerAudience, tokenUsable } from './companionsign.js'
@@ -623,11 +623,33 @@ function allBrokers() {
 }
 
 // The brokers every reception goes to: the ones that are on.
+// A broker that clashes with a site broker's host stays off the wire
+// (liveBrokers); its row says so.
 function brokerList() {
-  return allBrokers().filter((b) => b.enabled)
+  return liveBrokers(allBrokers()).filter((b) => b.enabled)
 }
 
+// The connections behind those rows (#704): one per stream of a broker that
+// has streams, the broker itself otherwise. What is per connection (the
+// socket, the watermark, the companion token) keys on these ids; a row and
+// its switch stay the broker's.
+function allLegs() {
+  return liveBrokers(allBrokers()).flatMap(legsOf)
+}
+
+function legList() {
+  return brokerList().flatMap(legsOf)
+}
+
+// A row's status, folded over its connections (#704).
 async function brokerStatusOf(id) {
+  const broker = allBrokers().find((b) => b.id === id)
+  const stats = []
+  for (const leg of broker ? legsOf(broker) : [{ id }]) stats.push(await legStatusOf(leg.id))
+  return foldLegs(stats)
+}
+
+async function legStatusOf(id) {
   let queued = 0
   try { queued = await state.queue.unpublishedCount(id) } catch (_) { queued = 0 }
   return { connected: brokerConnected(id), queued, needsCompanion: state.needsCompanion.has(id), signRefused: state.signRefused.has(id) }
@@ -675,7 +697,8 @@ async function toggleBroker(id, enabled) {
 // Connect first, store second: a broker that does not answer is never saved.
 async function saveBroker(form, editingId) {
   const taken = allBrokers().map((b) => b.id).filter((x) => x !== editingId)
-  const v = validateBroker(form, taken, { securePage: location.protocol === 'https:' })
+  const takenHosts = allLegs().filter((l) => l.source === 'site').map((l) => hostOf(l.url))
+  const v = validateBroker(form, taken, { securePage: location.protocol === 'https:', takenHosts })
   if (!v.ok) return v
   let creds = null
   try { creds = await brokerCredentials(v.broker, state.rxPubkey) } catch (e) {
@@ -723,7 +746,7 @@ function brokerConnected(id) {
 }
 
 function mqttDotState() {
-  return dotState(brokerList().map((b) => brokerConnected(b.id)))
+  return dotState(legList().map((l) => brokerConnected(l.id)))
 }
 
 // One dot for several brokers: lit when all are up, amber when one is missing.
@@ -759,7 +782,7 @@ async function renderBacklog() {
   let pending = 0
   // "Not on the map yet" is about the broker that feeds the map: the first one,
   // the site's own (#554). What another broker is owed is in the Status tab.
-  const own = brokerList()[0]
+  const own = legList()[0]
   if (!own) return
   try { pending = await state.queue.unpublishedCount(own.id) } catch (_) { return }
   const s = backlogState(pending, { connected: brokerConnected(own.id) })
@@ -1005,6 +1028,16 @@ function splashArgs(overrides) {
   }
 }
 
+// Where receptions go (#704), on the splash and in About: every broker that
+// is on, by name, from config.json and the hunter's own list.
+function renderSharedWith() {
+  const text = sharedWith(brokerList().map((b) => b.name))
+  for (const id of ['splash-shared', 'ss-about-shared']) {
+    const e = el(id)
+    if (e && e.textContent !== text) e.textContent = text
+  }
+}
+
 // Splash gate (#539): the connect block IS the splash — brand band, two
 // status rows (Bluetooth, GPS), the ways forward, one-sentence disclaimer.
 // Shown until the first GPS fix (per splashState) or the ✕; re-openable
@@ -1018,6 +1051,7 @@ function splashArgs(overrides) {
 // spotlight behaviour unchanged (body.onboarding): every control lifted and
 // ringed, the three callouts placed beside them.
 function refreshSplash() {
+  renderSharedWith()
   const s = splashState(splashArgs())
   const reopened = state.showOnboarding && s === 'hidden'
   const visible = s !== 'hidden' || reopened
@@ -1602,7 +1636,7 @@ async function drainOnce() {
   await ensureMqtt()
   draining = true
   try {
-    for (const b of brokerList().filter((b) => brokerConnected(b.id))) {
+    for (const b of legList().filter((b) => brokerConnected(b.id))) {
       if (brokerDrains.has(b.id)) continue
       const entry = state.publishers.get(b.id)
       brokerDrains.add(b.id)
@@ -1718,8 +1752,8 @@ async function pruneOnce() {
   lastPrune = now
   const cutoff = new Date(now - RETENTION_MS).toISOString()
   // A reception may only go once every broker that is owed it has it (#554).
-  // Which brokers are owed, a paused one included or not, is owedBrokers'.
-  const owedBy = owedBrokers(allBrokers())
+  // Which connections are owed, a paused one included or not, is owedLegs'.
+  const owedBy = owedLegs(allBrokers())
   const owed = []
   for (const b of owedBy) owed.push({ id: b.id, watermark: await state.queue.getWatermark(b.id) })
   const removed = await state.queue.prune(cutoff, pruneFloor(owed))
@@ -2155,7 +2189,7 @@ function applyConnectButtons() {
 // the receptions are already on disk, they were heard by a real companion, and
 // they are owed to the broker whatever the link is doing now.
 async function ensureMqtt() {
-  const on = brokerList()
+  const on = legList()
   const nowSec = Math.floor(Date.now() / 1000)
   for (const [id, entry] of [...state.publishers]) {
     const broker = on.find((b) => b.id === id)
@@ -2403,7 +2437,7 @@ function refreshConnState() {
 function renderMqttStatus() {
   const on = brokerList()
   const dot = mqttDotState()
-  el('ss-conn-mqtt').textContent = mqttSummary(on.map((b) => brokerConnected(b.id)))
+  el('ss-conn-mqtt').textContent = mqttSummary(on.map((b) => legsOf(b).every((l) => brokerConnected(l.id))))
   el('ss-mqtt-dot').classList.toggle('on', dot !== 'off')
   el('ss-mqtt-dot').classList.toggle('warn', dot === 'partial')
   const box = el('ss-mqtt-rows')
@@ -2429,6 +2463,7 @@ function renderMqttStatus() {
       row.lastChild.textContent = view.text
     }).catch(() => {})
   }
+  renderSharedWith()
   if (state.brokerSheet) state.brokerSheet.tick()
 }
 
@@ -2802,6 +2837,7 @@ function buildSettingsSheet() {
           </div>
         </div>
         <p class="ss-about-desc">Hunt MeshCore nodes by their radio signal. Your logged receptions build a shared coverage map. Built by amateur-radio operators.</p>
+        <p class="ss-about-desc" id="ss-about-shared"></p>
         <nav class="ss-about-links">
           <button type="button" id="ss-about-howto">
             <span class="ss-link-title">How it works</span>
@@ -3783,7 +3819,7 @@ window.addEventListener('DOMContentLoaded', async () => {
   // now on, not the week already in the store (#554). Never the broker from
   // mqttUrl: it has no watermark on a phone that captured offline before it
   // ever connected, and that backlog is owed to it in full.
-  for (const b of allBrokers()) {
+  for (const b of allLegs()) {
     if (b.id === DEFAULT_BROKER) continue
     try { await state.queue.startAtHead(b.id) } catch (_) { /* retried on the next load */ }
   }
diff --git a/app/src/brokers.js b/app/src/brokers.js
index c235436f..0179021b 100644
--- a/app/src/brokers.js
+++ b/app/src/brokers.js
@@ -67,11 +67,69 @@ export function mergeBrokers(site, prefs) {
   return out
 }
 
+// legsOf is the connections behind one row (#704). A broker with streams is
+// one row and one switch, with a connection per stream, each to its own
+// address under its own stream label. A connection's id is what its watermark
+// and its companion token are stored under, so it carries the stream's host:
+// the token is signed for one host. A broker without streams is its own one
+// connection, under its own id.
+export function legsOf(broker) {
+  if (!broker) return []
+  if (!Array.isArray(broker.streams) || broker.streams.length === 0) return [broker]
+  const { streams, ...rest } = broker
+  return streams.map((s) => ({ ...rest, id: broker.id + '@' + hostOf(s.url), url: s.url, label: s.label }))
+}
+
+// hostOf is a connection's host as URL.host has it: the port only when it is
+// not the default one, like the user: ids validateBroker makes.
+export function hostOf(url) {
+  try { return new URL(url).host || url } catch (_) { return url }
+}
+
+// hostClashes names, per broker a hunter added, the site broker that already
+// publishes to its host (#704): a preset added before the site row shares a
+// host with it after the deploy. The companion's key is the client id on
+// every broker it signs in to, and a second session under one id kicks the
+// first, so the two would take turns for ever, and all the hunter sees is a
+// row that blinks. The add form refuses a new one (validateBroker); this is
+// for the one that is already there, on or off, so the row can say which of
+// the two to remove.
+export function hostClashes(brokers) {
+  const site = new Map()
+  for (const b of brokers || []) {
+    if (b.source !== 'site') continue
+    for (const leg of legsOf(b)) site.set(hostOf(leg.url), b.name)
+  }
+  const out = new Map()
+  for (const b of brokers || []) {
+    if (b.source !== 'user') continue
+    const name = site.get(hostOf(b.url))
+    if (name) out.set(b.id, name)
+  }
+  return out
+}
+
+// foldLegs is one status for a row of several connections (#704): connected
+// when every connection is, queued as far as the one furthest behind (each
+// drains on its own), and waiting on the companion when any of them is.
+export function foldLegs(stats) {
+  const s = stats || []
+  const up = s.filter((x) => x.connected).length
+  return {
+    connected: s.length > 0 && up === s.length,
+    up,
+    of: s.length,
+    queued: Math.max(0, ...s.map((x) => (Number.isFinite(x.queued) ? x.queued : 0))),
+    needsCompanion: s.some((x) => x.needsCompanion),
+    signRefused: s.some((x) => x.signRefused),
+  }
+}
+
 // validateBroker turns the add form into a broker, or into the message to put
 // under the field. `securePage` is whether the app itself is served over
 // https: a secure page cannot open a plain ws:// socket, and the browser
 // blocks it without an error worth showing.
-export function validateBroker(form, existingIds, { securePage = true } = {}) {
+export function validateBroker(form, existingIds, { securePage = true, takenHosts = [] } = {}) {
   const url = String((form && form.url) || '').trim()
   let parsed = null
   try { parsed = new URL(url) } catch (_) { parsed = null }
@@ -82,7 +140,10 @@ export function validateBroker(form, existingIds, { securePage = true } = {}) {
   // host, not hostname: it carries a non-default port, and two brokers on one
   // machine each need their own watermark.
   const id = 'user:' + parsed.host
-  if ((existingIds || []).includes(id)) {
+  // A host the site already publishes to is taken too (#704): the companion's
+  // key is the client id on every broker it signs in to, and a second session
+  // under one id kicks the first, so the two would take turns for ever.
+  if ((existingIds || []).includes(id) || (takenHosts || []).includes(parsed.host)) {
     return { ok: false, errors: { url: 'This broker is already in the list.' }, broker: null }
   }
   const broker = { id, name: String(form.name || '').trim() || parsed.hostname, url }
@@ -99,12 +160,19 @@ export function validateBroker(form, existingIds, { securePage = true } = {}) {
 }
 
 // brokerStatus is the one line under a broker's name.
-export function brokerStatus({ enabled, connected, queued, needsCompanion = false, signRefused = false }) {
+export function brokerStatus({ enabled, connected, queued, needsCompanion = false, signRefused = false, up = null, of = null }) {
   if (!enabled) return { dot: 'off', text: 'Off' }
-  if (!connected && signRefused) return { dot: 'warn', text: 'Your companion could not sign in' }
-  if (!connected && needsCompanion) return { dot: 'warn', text: 'Connect your companion to sign in' }
   const n = Number.isFinite(queued) ? Math.max(0, Math.trunc(queued)) : 0
   const waiting = n > 0 ? ` · ${n.toLocaleString('en')} queued` : ''
+  // A row with several connections (#704) that has some of them up says how
+  // many: one collector down is something to see, not a broker that is off.
+  // The reason the others are down rides with the count.
+  if (of > 1 && up > 0 && up < of) {
+    const why = signRefused ? ' · your companion could not sign in' : needsCompanion ? ' · connect your companion to sign in' : ''
+    return { dot: 'warn', text: `${up} of ${of} connected${why}${waiting}` }
+  }
+  if (!connected && signRefused) return { dot: 'warn', text: 'Your companion could not sign in' }
+  if (!connected && needsCompanion) return { dot: 'warn', text: 'Connect your companion to sign in' }
   // Amber means receptions are waiting. Not connected with nothing owed is the
   // resting state without a companion, not a fault.
   const dot = connected ? 'on' : (n > 0 ? 'warn' : 'off')
@@ -166,3 +234,30 @@ export function presetsFrom(cfg) {
   }
   return out
 }
+
+// sharedWith is what the splash and About say about where receptions go
+// (#704): every broker that is on, by name, so a site without DutchMeshCore or
+// a hunter who switched it off does not read that it is there. With every
+// broker off nothing leaves the phone yet.
+export function sharedWith(names) {
+  const n = [...new Set((names || []).filter(Boolean))]
+  if (n.length === 0) return 'Your receptions stay on this phone.'
+  const list = n.length === 1 ? n[0] : n.slice(0, -1).join(', ') + ' and ' + n[n.length - 1]
+  return `Your receptions are shared with ${list}.`
+}
+
+// liveBrokers: the brokers that may connect. A broker a hunter added on a
+// host a site broker publishes to (hostClashes) stays on its row, with the
+// hint to remove it, and never connects: under the companion's key as its
+// client id, the two sessions would keep signing each other out (#704).
+export function liveBrokers(brokers) {
+  const clash = hostClashes(brokers)
+  return (brokers || []).filter((b) => !clash.has(b.id))
+}
+
+// owedLegs: the connections a reception waits for before it may be pruned
+// (AGENTS.md §10). Per connection, since each keeps its own watermark: the
+// row of a broker with streams has none that drains.
+export function owedLegs(brokers) {
+  return owedBrokers(liveBrokers(brokers).flatMap(legsOf))
+}
diff --git a/app/src/brokersheet.js b/app/src/brokersheet.js
index c233a981..043be643 100644
--- a/app/src/brokersheet.js
+++ b/app/src/brokersheet.js
@@ -2,7 +2,7 @@
 // reception goes to, a switch per broker, and a form to add one. DOM glue only;
 // what a row says and whether a form is valid are brokers.js decisions, and
 // storing, probing and connecting are the caller's.
-import { brokerStatus } from './brokers.js'
+import { brokerStatus, hostClashes } from './brokers.js'
 
 const BACK = '<svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M15 6l-6 6 6 6"/></svg>'
 
@@ -154,16 +154,25 @@ export function createBrokerSheet({ root, getBrokers, getStatus, onToggle, onSav
   async function refresh() {
     const rows = $('bk-rows')
     const brokers = getBrokers()
+    const clashes = hostClashes(brokers)
     updaters = []
     rows.replaceChildren(...brokers.map((b) => {
       const row = node('div', 'bk-row')
       row.dataset.id = b.id
       const dot = node('i', 'ss-state-dot bk-dot')
       const txt = node('div', 'bk-txt')
-      txt.append(node('span', 'bk-name', b.name), node('span', 'bk-host', host(b.url)))
+      // A broker with streams (#704) sends to each of its servers under that
+      // stream's label, so the row names every one, with its label.
+      const hosts = Array.isArray(b.streams) && b.streams.length
+        ? b.streams.map((s) => host(s.url) + ' · ' + s.label)
+        : [host(b.url)]
+      txt.append(node('span', 'bk-name', b.name), ...hosts.map((h) => node('span', 'bk-host', h)))
       const status = node('span', 'bk-status', (b.source === 'site' ? 'From this site' : 'Added by you'))
       txt.append(status)
       if (b.auth === 'companion') txt.append(node('span', 'bk-status', "Signs in with your companion's key"))
+      // A broker on a host the site already publishes to (#704): the two
+      // sessions keep signing each other out, so the row says which to remove.
+      if (clashes.has(b.id)) txt.append(node('span', 'bk-status bk-clash', `Same host as ${clashes.get(b.id)}: remove this one, or the two keep signing each other out.`))
       if (b.source === 'user') {
         txt.classList.add('bk-tappable')
         txt.tabIndex = 0
diff --git a/app/src/config.js b/app/src/config.js
index 6fe3c41b..466185e7 100644
--- a/app/src/config.js
+++ b/app/src/config.js
@@ -25,8 +25,15 @@ export function normalizeConfig(raw) {
   // under, so a second entry reusing one is dropped rather than sharing it.
   c.brokers = [];
   const addBroker = (b) => {
-    if (!b || typeof b.url !== 'string' || !b.url.trim()) return;
-    const url = b.url.trim();
+    if (!b) return;
+    // streams (#704): one broker with several collectors behind it, each its
+    // own address and stream label. It stays one entry, so one row and one
+    // switch; brokers.js legsOf makes a connection of each stream.
+    const streams = Array.isArray(b.streams)
+      ? b.streams.filter((s) => s && typeof s.url === 'string' && s.url.trim()).map((s) => ({ url: s.url.trim(), label: s.label }))
+      : [];
+    const url = streams.length ? streams[0].url : (typeof b.url === 'string' ? b.url.trim() : '');
+    if (!url) return;
     let host = url;
     try { host = new URL(url).hostname || url; } catch (_) { /* keep the raw string as the name */ }
     const id = String(b.id || host).trim();
@@ -45,6 +52,19 @@ export function normalizeConfig(raw) {
       entry.format = 'wardrive';
       entry.label = String(b.label || 'hunter').trim().toLowerCase();
     }
+    if (streams.length) {
+      // One stream per host: a connection's id is the broker's and the
+      // host's (brokers.js legsOf), so a second stream on it would share the
+      // first one's publisher and watermark.
+      const hosts = new Set();
+      entry.streams = streams.filter((s) => {
+        let h = s.url;
+        try { h = new URL(s.url).host || s.url; } catch (_) { /* keep the raw string */ }
+        if (hosts.has(h)) return false;
+        hosts.add(h);
+        return true;
+      }).map((s) => ({ url: s.url, label: String(s.label || entry.label || 'hunter').trim().toLowerCase() }));
+    }
     c.brokers.push(entry);
   };
   // The mqttUrl broker has no name field of its own; it is the app's own.
diff --git a/app/src/styles/app.css b/app/src/styles/app.css
index 98e3e830..b7507213 100644
--- a/app/src/styles/app.css
+++ b/app/src/styles/app.css
@@ -478,6 +478,9 @@ html, body { margin: 0; height: 100%; background: var(--ch-bg); color: var(--ch-
 .bk-name { font-weight: 600; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
 .bk-status, .bk-host { font-size: 12px; color: var(--ch-muted); min-width: 0;
   overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+/* A broker on a host the site already publishes to (#704): amber, the alert
+   token, because the row asks for a hand. */
+.bk-clash { color: var(--ch-accent-2); }
 .bk-host { font-family: ui-monospace, "SF Mono", SFMono-Regular, Menlo, Consolas, monospace; }
 .bk-manage { display: flex; align-items: center; justify-content: space-between; width: 100%; min-height: 44px;
   margin-top: 4px; padding: 0; border: none; border-top: 1px solid var(--ch-border); background: transparent;
diff --git a/changelog.d/2026-09-27-12-dutchmeshcore-by-default.json b/changelog.d/2026-09-27-12-dutchmeshcore-by-default.json
new file mode 100644
index 00000000..7c3dde00
--- /dev/null
+++ b/changelog.d/2026-09-27-12-dutchmeshcore-by-default.json
@@ -0,0 +1,7 @@
+{
+  "id": "2026-09-27-dutchmeshcore-by-default",
+  "date": "2026-09-27",
+  "where": "app",
+  "title": "Your receptions also go to DutchMeshCore",
+  "body": "Your receptions now also go to DutchMeshCore, with one switch under Manage brokers."
+}
diff --git a/docs/2026-09-21-mqtt-brokers.md b/docs/2026-09-21-mqtt-brokers.md
index 507c9b3c..f8dd72d3 100644
--- a/docs/2026-09-21-mqtt-brokers.md
+++ b/docs/2026-09-21-mqtt-brokers.md
@@ -93,6 +93,22 @@ DutchMeshCore (DMC) is the first such broker, and it reads a different message t
   > hunt to a coverage drive means removing the broker and adding the other preset. Like any new
   > broker, that one starts at the newest reception, and whatever the removed one was still owed
   > is not sent.
+  >
+  > **Amended 2026-09-27 (#704, Kasper).** DutchMeshCore is one broker, on by default like the
+  > site's own, and publishes under both labels at once: collector 1 gets `hunter`, collector 2
+  > gets `wardriver`. DMC's advice is to publish to both collectors, and this sends each of them
+  > one label, so a hunter no longer swaps presets between a hunt and a coverage drive. A
+  > `config.json` broker can list `streams`, each with its own `url` and `label`. It stays one
+  > entry, so one row on the brokers page, one line in the Status tab and one switch; `legsOf`
+  > (`brokers.js`) makes a connection of each stream, with its own id (`<broker>@<host>`), so each
+  > has its own watermark, its own companion token (signed for its host) and its own socket. The
+  > row's status folds them (`foldLegs`): connected when all are, "1 of 2 connected" in between.
+  > The site drops its four DutchMeshCore presets. The add form refuses a host the site already
+  > publishes to: the companion's key is the client id on every broker it signs in to, and a
+  > second session under one id kicks the first. A preset added before this is not migrated: the
+  > app is in development, and whoever added one removes it; its row says so (`hostClashes`). Until
+  > then it does not connect (`liveBrokers`), so it cannot sign the site's connection out, and
+  > retention does not wait for it.
 - **One signature at a time.** The companion has a single sign buffer and a second
   `CMD_SIGN_START` empties it, so two brokers that both need a token queue up.
 - **Each broker drains on its own promise** (2026-09-23, review of #671). A broker whose every
@@ -119,8 +135,9 @@ DutchMeshCore (DMC) is the first such broker, and it reads a different message t
 
 - Subscribing to the DutchMeshCore feed (#374).
 - Regions, owner and clock of a repeater (#552).
-- The splash and About do not name DutchMeshCore: it is a preset a hunter adds, not something that
-  is on by default. The brokers page says where receptions go.
+- ~~The splash and About do not name DutchMeshCore: it is a preset a hunter adds, not something that
+  is on by default.~~ Since #704 DutchMeshCore is on by default, and the splash and About say
+  where receptions go: every broker that is on, by name (`sharedWith` in `brokers.js`).
 
 ## Verified, and not
 
diff --git a/web/changelog.json b/web/changelog.json
index b2ca7c2a..d15d527e 100644
--- a/web/changelog.json
+++ b/web/changelog.json
@@ -20,6 +20,13 @@
     "title": "A larger audio buffer",
     "body": "Sound uses a larger output buffer, against ticking while the app is busy right after start."
   },
+  {
+    "id": "2026-09-27-dutchmeshcore-by-default",
+    "date": "2026-09-27",
+    "where": "app",
+    "title": "Your receptions also go to DutchMeshCore",
+    "body": "Your receptions now also go to DutchMeshCore, with one switch under Manage brokers."
+  },
   {
     "id": "2026-09-26-broker-presets-shown",
     "date": "2026-09-26",