@yansigit/opencodex 2.36.1-dev.20260829.47 → 2.36.1-dev.20260829.48

package/src/providers/api-keys.ts

@@ -7,7 +7,7 @@
  * A provider with a legacy bare `apiKey` is seeded into a one-entry pool on first touch.
  */
 import { createHash } from "node:crypto";
-import { saveConfigPreservingClaudeCode } from "../config";
+import { mutatePersistedConfig } from "../config";
 import { isAzureIdentityProvider } from "../config/provider-validation";
 import type { OcxConfig, OcxProviderConfig } from "../types";
 
@@ -62,6 +62,23 @@ function activeEntryId(provider: OcxProviderConfig): string | null {
   return (pool.find(e => e.key === provider.apiKey) ?? pool[0]!).id;
 }
 
+function mutateProvider<T>(
+  config: OcxConfig,
+  name: string,
+  mutate: (provider: OcxProviderConfig) => T | null,
+): T | null {
+  const outcome = mutatePersistedConfig(fresh => {
+    const provider = fresh.providers[name];
+    if (!provider || !isKeyAuthProvider(provider)) return { changed: false, value: null };
+    const before = JSON.stringify(provider);
+    const value = mutate(provider);
+    return { changed: value !== null && JSON.stringify(provider) !== before, value: value === null ? null : { provider, value } };
+  });
+  if (outcome.status === "unavailable" || outcome.value === null) return null;
+  config.providers[name] = structuredClone(outcome.value.provider);
+  return outcome.value.value;
+}
+
 export function listProviderApiKeys(config: OcxConfig, name: string): { activeId: string | null; keys: ProviderApiKeyInfo[] } {
   const provider = config.providers[name];
   if (!provider || !isKeyAuthProvider(provider)) return { activeId: null, keys: [] };
@@ -86,56 +103,63 @@ export function addProviderApiKey(config: OcxConfig, name: string, key: string,
   if (typeof key !== "string" || !key.trim()) return { error: "key is required" };
   const trimmed = sanitizeApiKeyValue(key);
   if (!trimmed) return { error: "key must not include line breaks" };
-  const pool = ensurePool(provider);
-  const id = apiKeyPoolEntryId(trimmed);
-  const existing = pool.find(e => e.id === id);
-  if (existing) {
-    if (label?.trim()) existing.label = label.trim();
-  } else {
+  const saved = mutateProvider(config, name, fresh => {
+    const pool = ensurePool(fresh);
+    const existing = pool.find(entry => entry.key === trimmed);
+    if (existing) {
+      if (label?.trim()) existing.label = label.trim();
+      fresh.apiKey = trimmed;
+      return { id: existing.id };
+    }
+    const id = apiKeyPoolEntryId(trimmed);
+    if (pool.some(entry => entry.id === id)) return { error: "key id collision" };
     pool.push({ id, key: trimmed, ...(label?.trim() ? { label: label.trim() } : {}), addedAt: Date.now() });
-  }
-  provider.apiKey = trimmed;
-  saveConfigPreservingClaudeCode(config);
-  return { id };
+    fresh.apiKey = trimmed;
+    return { id };
+  });
+  return saved === null ? { error: "config is unavailable" } : saved;
 }
 
 /** Switch the ACTIVE key (mirrors into `provider.apiKey`). Persists config. */
 export function setActiveProviderApiKey(config: OcxConfig, name: string, id: string): boolean {
   const provider = config.providers[name];
   if (!provider || !isKeyAuthProvider(provider)) return false;
-  const entry = ensurePool(provider).find(e => e.id === id);
-  if (!entry) return false;
-  provider.apiKey = entry.key;
-  saveConfigPreservingClaudeCode(config);
-  return true;
+  return mutateProvider(config, name, fresh => {
+    const entry = ensurePool(fresh).find(candidate => candidate.id === id);
+    if (!entry) return null;
+    fresh.apiKey = entry.key;
+    return true;
+  }) === true;
 }
 
 /** Rename a key slot without changing its id, secret, or active routing state. */
 export function setProviderApiKeyLabel(config: OcxConfig, name: string, id: string, label: string | undefined): boolean {
   const provider = config.providers[name];
   if (!provider || !isKeyAuthProvider(provider)) return false;
-  const entry = ensurePool(provider).find(e => e.id === id);
-  if (!entry) return false;
-  if (label) entry.label = label;
-  else delete entry.label;
-  saveConfigPreservingClaudeCode(config);
-  return true;
+  return mutateProvider(config, name, fresh => {
+    const entry = ensurePool(fresh).find(candidate => candidate.id === id);
+    if (!entry) return null;
+    if (label) entry.label = label;
+    else delete entry.label;
+    return true;
+  }) === true;
 }
 
 /** Remove one key; removing the active one promotes the first remaining. Persists config. */
 export function removeProviderApiKey(config: OcxConfig, name: string, id: string): boolean {
   const provider = config.providers[name];
   if (!provider || !isKeyAuthProvider(provider)) return false;
-  const pool = ensurePool(provider);
-  const entry = pool.find(e => e.id === id);
-  if (!entry) return false;
-  provider.apiKeyPool = pool.filter(e => e.id !== id);
-  if (provider.apiKey === entry.key) {
-    const next = provider.apiKeyPool[0];
-    if (next) provider.apiKey = next.key;
-    else delete provider.apiKey;
-  }
-  if (provider.apiKeyPool.length === 0) delete provider.apiKeyPool;
-  saveConfigPreservingClaudeCode(config);
-  return true;
+  return mutateProvider(config, name, fresh => {
+    const pool = ensurePool(fresh);
+    const entry = pool.find(candidate => candidate.id === id);
+    if (!entry) return null;
+    fresh.apiKeyPool = pool.filter(candidate => candidate.id !== id);
+    if (fresh.apiKey === entry.key) {
+      const next = fresh.apiKeyPool[0];
+      if (next) fresh.apiKey = next.key;
+      else delete fresh.apiKey;
+    }
+    if (fresh.apiKeyPool.length === 0) delete fresh.apiKeyPool;
+    return true;
+  }) === true;
 }

package/src/providers/key-failover.ts

@@ -8,8 +8,9 @@
  *
  * Modelled after src/codex/routing.ts cooldown logic but scoped to plain API-key pools.
  */
-import { saveConfigPreservingClaudeCode } from "../config";
+import { mutatePersistedConfig } from "../config";
 import { isAzureIdentityProvider } from "../config/provider-validation";
+import { routedProviderConfig } from "../router";
 import type { OcxConfig, OcxProviderConfig, RateLimitRetryPolicy } from "../types";
 import { resolveProviderTransport, type OcxProviderTransport } from "./xai-transport";
 import { sweepExpiredOnWrite } from "../lib/state-store-sweeper";
@@ -159,50 +160,66 @@ export function rotateKeyOn429(
   if (isAzureIdentityProvider(provider)) return null;
   if (provider.authMode === "oauth" || provider.authMode === "forward") return null;
 
-  const pool = provider.apiKeyPool;
-  if (!pool || pool.length < 2) return null;
-
-  // Cool the key that ACTUALLY failed. Under concurrent 429s another request may already have
-  // rotated provider.apiKey — cooling the live key would punish an innocent replacement and can
-  // exhaust a 2-key pool from a single bad key. CAS semantics: callers pass the key they used.
   const failedKey = attemptedKey ?? provider.apiKey;
-  const currentEntry = pool.find(e => e.key === failedKey);
-  if (currentEntry) {
-    const cooldownMs = parseRetryAfterMs(retryAfterHeader, now) ?? DEFAULT_COOLDOWN_MS;
-    keyCooldowns.set(cooldownKey(providerName, currentEntry.id), {
-      cooldownUntil: now + cooldownMs,
-    });
-    sweepExpiredOnWrite(now);
-  }
+  type Rotation =
+    | { provider: OcxProviderConfig; failedId?: string; candidateId?: string }
+    | { exhaustedCount: number };
+  const outcome = mutatePersistedConfig<Rotation | null>(fresh => {
+    const freshProvider = fresh.providers[providerName];
+    if (!freshProvider || isAzureIdentityProvider(freshProvider)
+      || freshProvider.authMode === "oauth" || freshProvider.authMode === "forward") {
+      return { changed: false, value: null };
+    }
+    const pool = freshProvider.apiKeyPool;
+    if (!pool || pool.length < 2) return { changed: false, value: null };
 
-  // Lost the race: someone already rotated away from the failed key. If the live key is healthy,
-  // retry with it as-is instead of rotating a second time.
-  if (attemptedKey !== undefined && provider.apiKey !== attemptedKey) {
-    const liveEntry = pool.find(e => e.key === provider.apiKey);
-    if (liveEntry && !isKeyInCooldown(providerName, liveEntry.id, now)) {
-      return { ...provider };
+    // Cool the key that actually failed. The callback is rerun after rebasing,
+    // so both the id and the active-key comparison come from the commit preimage.
+    const failedEntry = pool.find(entry => entry.key === failedKey);
+    if (failedEntry) {
+      const cooldownMs = parseRetryAfterMs(retryAfterHeader, now) ?? DEFAULT_COOLDOWN_MS;
+      keyCooldowns.set(cooldownKey(providerName, failedEntry.id), { cooldownUntil: now + cooldownMs });
+      sweepExpiredOnWrite(now);
     }
-  }
 
-  // Pick the next key that is NOT in cooldown
-  const currentIndex = currentEntry ? pool.indexOf(currentEntry) : -1;
-  for (let i = 1; i < pool.length; i++) {
-    const candidate = pool[(currentIndex + i) % pool.length]!;
-    if (!isKeyInCooldown(providerName, candidate.id, now)) {
-      // Swap active key
-      provider.apiKey = candidate.key;
-      saveConfigPreservingClaudeCode(config);
-      console.warn(
-        // Log ids only — labels are user-supplied free text and could carry secret material.
-        `[key-failover] ${providerName}: 429 on key ${currentEntry?.id ?? "?"}; rotating to key ${candidate.id}`,
-      );
-      return { ...provider };
+    if (freshProvider.apiKey !== failedKey) {
+      const activeEntry = pool.find(entry => entry.key === freshProvider.apiKey);
+      if (activeEntry && !isKeyInCooldown(providerName, activeEntry.id, now)) {
+        return {
+          changed: false,
+          value: { provider: structuredClone(freshProvider), failedId: failedEntry?.id, candidateId: undefined },
+        };
+      }
     }
+
+    const currentIndex = failedEntry ? pool.indexOf(failedEntry) : -1;
+    const candidateCount = failedEntry ? pool.length - 1 : pool.length;
+    for (let offset = 1; offset <= candidateCount; offset += 1) {
+      const candidate = pool[(currentIndex + offset) % pool.length]!;
+      if (isKeyInCooldown(providerName, candidate.id, now)) continue;
+      freshProvider.apiKey = candidate.key;
+      return {
+        changed: true,
+        value: { provider: structuredClone(freshProvider), failedId: failedEntry?.id, candidateId: candidate.id },
+      };
+    }
+    return { changed: false, value: { exhaustedCount: pool.length } };
+  });
+  if (outcome.status === "unavailable" || outcome.value === null) return null;
+  if ("exhaustedCount" in outcome.value) {
+    console.warn(`[key-failover] ${providerName}: all ${outcome.value.exhaustedCount} keys in cooldown; returning 429 to client`);
+    return null;
   }
 
-  // All keys in cooldown
-  console.warn(`[key-failover] ${providerName}: all ${pool.length} keys in cooldown; returning 429 to client`);
-  return null;
+  const committed = structuredClone(outcome.value.provider);
+  config.providers[providerName] = committed;
+  if (outcome.value.candidateId) {
+    console.warn(
+      // Log ids only — labels are user-supplied free text and could carry secret material.
+      `[key-failover] ${providerName}: 429 on key ${outcome.value.failedId ?? "?"}; rotating to key ${outcome.value.candidateId}`,
+    );
+  }
+  return structuredClone(committed);
 }
 
 export function sweepExpiredApiKeyCooldowns(now = Date.now()): number {
@@ -225,13 +242,9 @@ interface RotateProviderTransportOptions {
 /**
  * Rotate a failed key and re-apply provider-specific transport metadata to the replacement.
  *
- * `routedProvider` is the request's active provider (the `routedProviderConfig` output the
- * route was built with). The result inherits it and swaps ONLY the API key: the persisted
- * config that `rotateKeyOn429` snapshots predates registry backfill, so building the retry
- * provider from that snapshot would silently drop every field the registry merged in at
- * routing time (scalar flags like `promptCacheKey`/`parallelToolCalls`, merged model
- * metadata such as `noTemperatureModels`, a pinned baseUrl). Mirrors the OAuth-401 replay
- * path in src/server/responses/core.ts, which spreads `route.provider` for the same reason.
+ * Put the authoritative committed row over request-only fields and registry backfills, then
+ * route it again so concurrent provider edits take effect without losing either kind of runtime
+ * metadata.
  */
 export function rotateProviderTransportOn429(
   config: OcxConfig,
@@ -249,7 +262,7 @@ export function rotateProviderTransportOn429(
   return rotated
     ? resolveProviderTransport(
         providerName,
-        { ...routedProvider, apiKey: rotated.apiKey },
+        routedProviderConfig(providerName, { ...routedProvider, ...rotated }),
         options.promptCacheKey,
       )
     : null;

package/src/providers/model-rename-startup.ts

@@ -1,10 +1,16 @@
-import { saveConfig } from "../config";
+import { mutatePersistedConfig } from "../config";
 import { projectModelRenames } from "./model-rename-migration";
 import type { OcxConfig } from "../types";
 
 export interface ModelRenameStartupDeps {
   project: typeof projectModelRenames;
-  save: (config: OcxConfig) => void;
+  save?: (config: OcxConfig) => void;
+}
+
+function adoptConfig(target: OcxConfig, source: OcxConfig): void {
+  if (target === source) return;
+  for (const key of Object.keys(target)) delete (target as unknown as Record<string, unknown>)[key];
+  Object.assign(target, structuredClone(source));
 }
 
 /**
@@ -18,11 +24,23 @@ export interface ModelRenameStartupDeps {
  */
 export function runModelRenameStartupMigration(
   config: OcxConfig,
-  deps: ModelRenameStartupDeps = { project: projectModelRenames, save: saveConfig },
+  deps: ModelRenameStartupDeps = { project: projectModelRenames },
 ): OcxConfig {
-  const projection = deps.project(config);
-  for (const warning of projection.warnings) console.warn(`[model-rename-migration] ${warning}`);
+  const projection = deps.project(structuredClone(config));
   if (!projection.changed) return projection.config;
-  deps.save(projection.config);
-  return projection.config;
+  if (deps.save) {
+    deps.save(projection.config);
+    adoptConfig(config, projection.config);
+    for (const warning of projection.warnings) console.warn(`[model-rename-migration] ${warning}`);
+    return config;
+  }
+  const outcome = mutatePersistedConfig(fresh => {
+    const next = deps.project(fresh);
+    if (next.changed) adoptConfig(fresh, next.config);
+    return { changed: next.changed, value: next };
+  });
+  if (outcome.status === "unavailable") return config;
+  adoptConfig(config, outcome.value.config);
+  for (const warning of outcome.value.warnings) console.warn(`[model-rename-migration] ${warning}`);
+  return config;
 }

package/src/providers/openai-tier-startup.ts

@@ -2,8 +2,8 @@ import {
   backupConfigBeforeOpenAiTierMigration,
   OpenAiTierBackupCollisionError,
   OpenAiTierRollbackPreserveError,
+  mutatePersistedConfig,
   preserveOpenAiTierRollbackSnapshot,
-  saveConfig,
 } from "../config";
 import type { OcxConfig } from "../types";
 import { projectOpenAiTierMigration } from "./openai-tiers";
@@ -11,7 +11,7 @@ import { projectOpenAiTierMigration } from "./openai-tiers";
 export interface OpenAiTierStartupDeps {
   project: typeof projectOpenAiTierMigration;
   backup: () => void;
-  save: (config: OcxConfig) => void;
+  save?: (config: OcxConfig) => void;
   preserveRollback?: (error: OpenAiTierBackupCollisionError) => void;
 }
 
@@ -34,23 +34,47 @@ function defaultPreserveRollback(error: OpenAiTierBackupCollisionError): void {
 const DEFAULT_DEPS: OpenAiTierStartupDeps = {
   project: projectOpenAiTierMigration,
   backup: backupConfigBeforeOpenAiTierMigration,
-  save: saveConfig,
 };
 
 export function runOpenAiTierStartupMigration(
   config: OcxConfig,
   deps: OpenAiTierStartupDeps = DEFAULT_DEPS,
 ): OcxConfig {
-  const projection = deps.project(config);
-  if (!projection.changed) return projection.config;
-  try {
-    deps.backup();
-  } catch (error) {
-    if (!(error instanceof OpenAiTierBackupCollisionError)) throw error;
-    (deps.preserveRollback ?? defaultPreserveRollback)(error);
-    deps.backup();
+  const backup = (): void => {
+    try {
+      deps.backup();
+    } catch (error) {
+      if (!(error instanceof OpenAiTierBackupCollisionError)) throw error;
+      (deps.preserveRollback ?? defaultPreserveRollback)(error);
+      deps.backup();
+    }
+  };
+  if (deps.save) {
+    const projection = deps.project(config);
+    if (!projection.changed) return projection.config;
+    backup();
+    deps.save(projection.config);
+    for (const warning of projection.warnings) console.warn(`[openai-provider-migration] ${warning}`);
+    return projection.config;
+  }
+
+  let previousSnapshot: string | undefined;
+  const outcome = mutatePersistedConfig(fresh => {
+    const snapshot = JSON.stringify(fresh);
+    const next = deps.project(fresh);
+    // mutatePersistedConfig confirms a candidate by invoking us again with the same
+    // snapshot after rebasing. Back up only that confirmed preimage.
+    if (next.changed && snapshot === previousSnapshot) backup();
+    previousSnapshot = snapshot;
+    if (next.changed) {
+      for (const key of Object.keys(fresh)) delete (fresh as unknown as Record<string, unknown>)[key];
+      Object.assign(fresh, next.config);
+    }
+    return { changed: next.changed, value: next };
+  });
+  if (outcome.status === "unavailable") return config;
+  if (outcome.status === "committed") {
+    for (const warning of outcome.value.warnings) console.warn(`[openai-provider-migration] ${warning}`);
   }
-  deps.save(projection.config);
-  for (const warning of projection.warnings) console.warn(`[openai-provider-migration] ${warning}`);
-  return projection.config;
+  return outcome.value.config;
 }

package/src/server/index.ts

@@ -38,6 +38,11 @@ import {
   setLiveStateStoreConfig,
 } from "../lib/state-store-registrations";
 import { startUserCostOverlayReconciler } from "../usage/user-cost-overlay-reconciler";
+import {
+  getStorageCleanupPolicyJobState,
+  getStorageCleanupPolicyTestStreamResponse,
+  requestStorageCleanupPolicyRun,
+} from "../storage/policy-job";
 import {
   configureAppOwnedMemoryBudget,
   enforceAppOwnedMemoryBudget,
@@ -537,6 +542,11 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
   const managementApi: ManagementApiDeps = {
     saveConfigPreservingClaudeCode,
     mutatePersistedConfig,
+    storageCleanupPolicyJob: {
+      getState: getStorageCleanupPolicyJobState,
+      getTestStream: getStorageCleanupPolicyTestStreamResponse,
+      requestRun: requestStorageCleanupPolicyRun,
+    },
     ...deps.managementApi,
   };
   const localAttestationSecret = deps.localAttestationSecret ?? createLocalAttestationSecret();

package/src/server/management/context.ts

@@ -1,4 +1,5 @@
 import type { OcxConfig } from "../../types";
+import type { PersistedConfigMutation, PersistedConfigMutationOutcome } from "../../config";
 import type { NativeProfileApiDeps } from "../../codex/native-profile-api";
 import type { CodexLogGuardProtectionDeps } from "../../codex/log-guard/protection";
 import type { CodexLogGuardMaintenanceDeps } from "../../codex/log-guard/maintenance";
@@ -40,6 +41,12 @@ export interface ManagementApiDeps {
   saveConfigPreservingClaudeCode?: (config: OcxConfig) => void;
   /** Config-mutation seam for routes that commit through `mutatePersistedConfig`. */
   mutatePersistedConfig?: typeof import("../../config").mutatePersistedConfig;
+  /** Storage-policy job seam keeps management routes off persistence-bearing worker modules. */
+  storageCleanupPolicyJob?: {
+    getState: typeof import("../../storage/policy-job").getStorageCleanupPolicyJobState;
+    getTestStream: typeof import("../../storage/policy-job").getStorageCleanupPolicyTestStreamResponse;
+    requestRun: typeof import("../../storage/policy-job").requestStorageCleanupPolicyRun;
+  };
   /** Test-only fetch injection for Replit gateway install probes. */
   probeFetch?: typeof globalThis.fetch;
   /**
@@ -142,11 +149,11 @@ export function saveManagementConfig(deps: ManagementApiDeps, config: OcxConfig)
 /** The only locked, field-scoped on-disk mutation boundary available to management routes. */
 export function mutateManagementConfig<T>(
   deps: ManagementApiDeps,
-  mutate: Parameters<NonNullable<ManagementApiDeps["mutatePersistedConfig"]>>[0],
-): ReturnType<NonNullable<ManagementApiDeps["mutatePersistedConfig"]>> {
+  mutate: (config: OcxConfig) => PersistedConfigMutation<T>,
+): PersistedConfigMutationOutcome<T> {
   if (!deps.mutatePersistedConfig) throw new MissingManagementPersistenceError();
   try {
-    return deps.mutatePersistedConfig(mutate) as ReturnType<NonNullable<ManagementApiDeps["mutatePersistedConfig"]>>;
+    return deps.mutatePersistedConfig(mutate);
   } catch (error) {
     throw new ManagementPersistenceError(error);
   }

package/src/server/management/logs-usage-routes.ts

@@ -39,13 +39,7 @@ import { getRestoreTrashTestStreamResponse, runRestoreTrashEntryJob } from "../.
 import {
   normalizeStorageCleanupPolicy,
   parseStorageCleanupPolicyInput,
-  writeStorageCleanupPolicyToConfig,
-} from "../../storage/policy";
-import {
-  getStorageCleanupPolicyJobState,
-  getStorageCleanupPolicyTestStreamResponse,
-  requestStorageCleanupPolicyRun,
-} from "../../storage/policy-job";
+} from "../../storage/policy-input";
 import {
   currentUsageLogRevision,
   readUsageSnapshotForManagement,
@@ -77,7 +71,7 @@ import { applySystemEnvToggle } from "../system-env";
 
 import { isPlainRecord, parseDebugLogQuery, tokPerSecondResult, unavailableCostReason, costResult, requestLogDto, stripRegistryOnlyStaticHeaders, fetchAllModels } from "./shared";
 import type { MetricUnavailableReason, TokPerSecondResult, CostEstimateReason, CostResult, MetricSource } from "./shared";
-import type { ManagementContext } from "./context";
+import { MissingManagementPersistenceError, mutateManagementConfig, type ManagementContext } from "./context";
 import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
 import {
   discardUsageSummaryCacheEntry,
@@ -131,6 +125,7 @@ function snapshotWindow(entries: PersistedUsageEntry[]): { start: number | null;
 
 export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url, config, deps, syncClaudeAgentDefsBestEffort } = ctx;
+  const storagePolicyJobState = () => deps.storageCleanupPolicyJob?.getState() ?? { status: "idle" as const };
 
   if (url.pathname === "/api/logs" && req.method === "GET") {
     const all = getRequestLogEntries();
@@ -555,7 +550,7 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
   }
 
   if (url.pathname === "/api/storage/cleanup-policy/test-stream" && req.method === "GET") {
-    const stream = getStorageCleanupPolicyTestStreamResponse();
+    const stream = deps.storageCleanupPolicyJob?.getTestStream();
     if (stream) return stream;
     // Production: hook is off. Return an explicit JSON 404 — do not fall through to the GUI.
     return jsonResponse({ error: "not_found" }, 404);
@@ -565,7 +560,7 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
     const policy = normalizeStorageCleanupPolicy(config.storageCleanupPolicy);
     return jsonResponse({
       ...policy,
-      job: getStorageCleanupPolicyJobState(),
+      job: storagePolicyJobState(),
     });
   }
 
@@ -575,17 +570,25 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
     const previous = normalizeStorageCleanupPolicy(config.storageCleanupPolicy);
     const parsed = parseStorageCleanupPolicyInput(raw, previous);
     if (!parsed.ok) return jsonResponse({ error: parsed.error }, 400);
-    // Never enable implicitly: if client omitted enabled, keep previous (default false).
     const body = raw as Record<string, unknown>;
-    if (body.enabled === undefined) parsed.policy.enabled = previous.enabled;
-    const saved = writeStorageCleanupPolicyToConfig(parsed.policy);
-    config.storageCleanupPolicy = saved;
-    return jsonResponse({ ok: true, policy: saved, job: getStorageCleanupPolicyJobState() });
+    const persisted = mutateManagementConfig(deps, disk => {
+      const latest = normalizeStorageCleanupPolicy(disk.storageCleanupPolicy);
+      const rebased = parseStorageCleanupPolicyInput(raw, latest);
+      if (!rebased.ok) throw new Error(rebased.error);
+      // Never enable implicitly: if client omitted enabled, keep the latest persisted value.
+      if (body.enabled === undefined) rebased.policy.enabled = latest.enabled;
+      disk.storageCleanupPolicy = rebased.policy;
+      return { changed: true, value: structuredClone(rebased.policy) };
+    });
+    if (persisted.status === "unavailable") return jsonResponse({ error: "management persistence unavailable" }, 500);
+    config.storageCleanupPolicy = persisted.value;
+    return jsonResponse({ ok: true, policy: persisted.value, job: storagePolicyJobState() });
   }
 
   if (url.pathname === "/api/storage/cleanup-policy/run" && req.method === "POST") {
     try {
-      const accepted = requestStorageCleanupPolicyRun({ reason: "manual", force: true });
+      if (!deps.storageCleanupPolicyJob) throw new MissingManagementPersistenceError();
+      const accepted = deps.storageCleanupPolicyJob.requestRun({ reason: "manual", force: true });
       if (!accepted.accepted) {
         return jsonResponse({
           ok: false,