Refuse to join the pair, rather than undoing it a second later

Connecting both pods is the configuration in which the `−` pod stops
reporting its own paddle (§2.3.1). `Cmd::Seen` has always known that and
declined; an explicit `Cmd::Connect` walked straight past it, and
housekeeping then closed the redundant link a second or so later — which
looks like the app handling the case and is not the same thing. On the
tablet, 2026-08-27 15:55:39, the pair was joined for 1.4 s and the `−`
pod did not report another press for the rest of the session, across two
fresh links and an app reinstall.

So the rule now lives on both paths. `auto` is still armed by the refused
request, so the fallback stands: the moment the `−` pod goes away, the
`+` pod is taken on its next advertisement.

And the UI stops offering the trap. The `+` pod's "Connect anyway" sat
next to a working controller, which put the one action that breaks
shifting a single tap from a rider hunting for a way to fix shifting. It
now reads "Held in reserve", which is what that pod is.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src-tauri/src/controller.rs

@@ -646,10 +646,36 @@ async fn run(
                 };
                 match cmd {
                     Cmd::Connect { pod, address } => {
+                        // The rule `Cmd::Seen` has always enforced, applied
+                        // here too: with the `−` pod up there is nothing for a
+                        // `+` link to add and one specific thing for it to
+                        // break — connected as a pair, the `−` pod stops
+                        // reporting its own paddle (§2.3.1).
+                        //
+                        // Only the scan-driven path was guarded, so an explicit
+                        // request walked straight past it. Housekeeping then
+                        // closed the redundant link a second or so later, which
+                        // reads as the app handling it and is not the same
+                        // thing at all: on the tablet, 2026-08-27 15:55:39, the
+                        // pair was joined for 1.4 s and the `−` pod did not
+                        // report a press again for the rest of the session.
+                        //
+                        // `auto` is still armed below, so the fallback stands:
+                        // the moment the `−` pod goes away, the `+` pod is
+                        // taken on its next advertisement.
+                        let minus_up = !minus.idle();
                         let slot = slot_mut(&mut minus, &mut plus, pod);
                         // Asking for it by hand re-arms auto-connect, whatever
                         // came before.
                         slot.auto = true;
+                        if pod == PodId::Plus && minus_up {
+                            tracing::info!(
+                                "controller: refusing a + pod link while the − pod is up — \
+                                 it relays the pair, and joining both stops it reporting \
+                                 its own paddle"
+                            );
+                            continue;
+                        }
                         // A second click while a search is running means
                         // "connect", which is what is already happening.
                         if slot.connecting() {