Thanks for the explanation of how the unit operates.
As best I can tell from those photos, the triac controls the pump and both the relays are involved in the circuit that supplies the heater.
The outer relay clearly controls the heater, but the function of the inner one is not clear. It is also in the current path to the heater, but it may also be involved with the pump. It may be being used as a changeover relay, but I can't say for sure because I can't see what tracks (if any) are on the top side of the board, underneath the relay.
It could be useful to see a photo of the top side of the board with both relays temporarily removed, if that wouldn't be too much trouble.
Looking at the coil side of the relays (the north ends, on the top side picture), they are both supplied from the same voltage rail - you can see that the cathodes (stripe end) of the diodes next to the relays are connected together. This rail should have +12V on it, relative to the main circuitry ground; I assume it does, otherwise neither relay would be working.
The relay coils and are switched by the two transistors north-east of the inner relay. They are controlled by the circuitry north-east of them; probably from outputs from the microcontroller(s) (the ICs with paper labels on them).
Can you measure the voltages on both ends of those two diodes at the coil ends of the relays (relative to circuitry ground, which will be available on the heatsink tabs of the regulators). That could be helpful. Also could you post the markings on the relays.
A photo of the top side with the relays removed might be the next step.