fix: pr-bug-scan validated finding from #6955

[buf0-bot]

Automated fix-PR from pr-bug-scan for parent #6955.

Fixer status: FIXED_WITH_CODE_PROOF
Summary: Split legacy-10800 strip out of normalizeSshTarget into a load-only migrateLegacySshTargetOnLoad wrapper so add/update/get preserve a user-entered 10800.
Blocked proof link: src/main/persistence.ts:1020-1023 — the relayGracePeriodSeconds !== LEGACY_DEFAULT(10800) strip no longer runs on the user-facing add/update/get paths (5614-5633); it now only runs during the one-time disk-load migration (line 3162), so an explicit 10800 is persisted and returned instead of stripped.
Typecheck: skipped

Proof (from validator)

• C1 — proof_type: code_analysis
  • trigger: In the SSH target form, with 'Keep terminals alive until reset' unchecked, the user types 10800 into 'Timeout after disconnect (seconds)' and saves.
  • observable: The user's intentional 3-hour bounded timeout is silently converted to unlimited (until reset): the card mislabels it 'terminals until reset' and the relay never expires idle remote PTYs, retaining remote resources indefinitely.
  • path:
    • src/renderer/src/components/settings/SshTargetForm.tsx:~200 Input min=MIN(60) max=MAX(604800) accepts 10800 as a bounded value
    • src/renderer/src/components/settings/ssh-target-draft.ts:~135 parseRelayGracePeriodSeconds returns 10800; isRelayGracePeriodValid true (60<=10800<=604800)
    • src/main/persistence.ts:5624 addSshTarget calls normalizeSshTarget
    • src/main/persistence.ts:1020-1023 guard: relayGracePeriodSeconds !== undefined && !== LEGACY_DEFAULT(10800) is false, so normalized.relayGracePeriodSeconds is NOT set (field stripped)
    • src/renderer/src/components/settings/SshTargetCard.tsx:69 graceSeconds = undefined ?? DEFAULT_SSH_RELAY_GRACE_PERIOD_SECONDS(0) -> 'terminals until reset' (SshTargetCard.tsx:71)
    • src/main/ipc/ssh.ts:151-152 relayGracePeriodForTarget returns undefined -> session.establish(conn, undefined) (ssh.ts:825)

Reproduction

pnpm test -- src/main/persistence.test.ts -t "preserves a user-entered 3-hour bounded timeout"

• before fix: getSshTarget(...).relayGracePeriodSeconds is undefined (stripped) — assertion expecting 10800 fails; card shows 'terminals until reset', relay launched with --grace-time 0
• after fix: relayGracePeriodSeconds === 10800 in memory and on disk; card shows 'terminal timeout: 3h', relay honors the 3-hour window

---

Generated by pr-bug-scan (proof-machine architecture). Human approval required before merge.

---

[stage-review]

Ready to review this PR? Stage has broken it down into 4 individual chapters for you:

	Title
1	Define migration flag for SSH relay timeout
2	Implement conditional legacy timeout migration logic
3	Wire migration into store loading process
4	Verify timeout preservation and migration behavior

_{Chapters generated by Stage for commit 6e991c3 on Jul 1, 2026 3:53am UTC.}