Creating a device key while the UI is open through a public https domain (reverse proxy) dropped that domain from the QR payload whenever the dialog passed a preferred LAN URL, leaving only the local IP and relay as transports. Carry the non-loopback request origin as an additional direct candidate (priority 20, between LAN and relay) so paired devices can keep using the same domain on any network.