[Aschenbath]

Result / 用户结果

Closes #840

Pairing LAN and relay for the same computer now keeps both authenticated routes in one saved computer entry. Connections try LAN first, with a five-second budget before trying the saved relay. Reconnects preserve the workspace and unsent draft. Disconnected cards show “LAN + Relay”; connected cards show the active transport.

Previously overwritten credentials cannot be recovered. Pair the missing transport again once to retain both routes.

Design / 设计边界

• RelayProfile retains one alternate route for the same authenticated Noise host key. Each route keeps its own endpoint, TLS pin and credentials in the existing encrypted store; the 64-computer limit remains unchanged.
• Alternate routes are local storage metadata. QR parsing cannot import them, nested/mismatched alternates are rejected, and existing single-route records still load. Older clients discard the alternate on their next save.
• SessionRepository owns each bounded connection attempt and reuses existing reconnect backoff and stale-client checks. Certificate, authentication and protocol failures stop fallback. New invitations and edited addresses must authenticate before replacing saved routes.
• No new dependencies or wire protocol changes. The decision and compatibility limits are recorded in architecture/notes/mobile/android/app/connection/2026-11-01-paired-lan-relay-routes.md.

Evidence / 验证依据

• Kotlin 2.1.21 / JDK 17 on Linux: 7 RelayRoutesTest tests passed, covering both pairing orders, storage round trips, route replacement, legacy records, invalid alternates, LAN preference and failure boundaries.
• Linux Robolectric 4.14.1 / API 28: 7 DesktopRecoveryTest methods passed, including the new dual-route regression and existing foreground/network recovery, certificate failure, repeated pairing, stalled invitation and authenticated LAN rediscovery tests.
• These Android checks used an isolated source harness compiling the real connection/session code. Generated resource identifiers and the activity type were stand-ins; they did not build an APK or exercise Compose rendering. The added HomeSessionsTest UI regression and physical-device/network acceptance were not run.
• The original RelayProfile from base 42ffd11f fails the storage reproduction: pairing relay loses the previously saved LAN address.
• cargo test --locked -p nebula --features gpui-test-support --no-fail-fast -- --test-threads=1: 2,723 unit tests passed, 1 failed, 36 ignored; 27 integration tests passed, 1 ignored. The failure is git_completion::tests::real_branches_cache_invalidation_and_directory_context (nested release-tag completion). Its Rust source matches the PR base; this Android-only change does not alter it. The first build was killed by SIGKILL; a retry completed. Builds used one job, no incremental compilation/debug information, and constrained glibc allocator arenas.
• cargo clippy --locked -p nebula --all-targets --features gpui-test-support: blocked by 19 existing errors in nebula_terminal, whose source also matches the PR base. No lints or tests were disabled.
• python3 scripts/check_architecture.py --base 42ffd11ff95db61eacaf026319c0bfb3bed3bea1, the three architecture/governance unittest modules (55 passed), cargo fmt --all -- --check, XML parsing for both changed catalogs, and git diff --check: passed.

Required Review / 必须确认

• Followed CONTRIBUTING.md, the architecture documentation and project constraints.
• Kept storage, connection policy and UI responsibilities in their existing owners.
• Architecture checks pass without budget or exclusion changes.
• Regression coverage and validation limitations are stated above.
• New UI text uses Android string resources with English and Simplified Chinese entries.
• No governance rules changed; governance-revision requirements are not applicable.