Add subscription gateway account pool core

[happylinks]

Summary

• add the private @tellahq/subscription-gateway workspace package
• add provider-neutral account routing for pins, ownership, designations, paid-capacity ordering, LRU selection, and Codex-compatible HRW affinity
• add durable account and model cooldowns with safe wedge rollback
• add an unbounded account walk that stops retries after client-visible output

Testing

• bun run check
• 15 focused package tests

Stack 1 of 2. The next PR adds the OpenAI Chat Completions wire mapping.

Started by Michiel Westerbeek in this OS session

[open-session-os-tella-dev]

🤖 OS review · request changes · confidence 2/5

Safe once the persistence failure and cancellation handling below are fixed. The package cleanly separates routing, cooldowns, and account walking, but two partial-failure paths can leave routing state incorrect, and its tests are not included in the required CI suite.
3 inline comments below.

💡 Labels: os-auto-fix — I fix these and push until CI passes · os-adversarial — deeper two-pass review · os-simplify — quality cleanup pass.
_{Reviewed 20bad97 · GPT-5.6 Sol · earlier reviews collapse above · open session}

🔁 Not merge-ready and no live session owns this branch — add the os-auto-fix label and I'll fix the findings automatically.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
opensession	Ready	Preview	Sep 1, 2026 9:24pm UTC

[open-session-os-tella-dev]

OS review · 20bad97

[open-session-os-tella-dev]

🔴 P1 — Failed persistence leaves an unrollbackable wedge active

markWedged mutates #records before saving, but returns the rollback token only after the save succeeds. If the JSON write fails because the state directory is read-only or the disk is full, markWedged("account-a", 300_000) rejects while isActive("account-a") remains true. The caller receives no token to clear, so a sole account remains unavailable for five minutes despite the operation reporting failure; a later successful mutation can also silently persist that failed wedge. markExhausted and clearWedge have the same in-memory/disk divergence. Serialize each mutation with its save and restore the prior record when persistence fails, without clobbering a newer queued mutation.

[open-session-os-tella-dev]

🟠 P2 — Cancellation during account acquisition still starts a provider attempt

The loop checks the signal before await options.acquire, but not after it. Since acquire is explicitly allowed to be asynchronous, a request aborted while account discovery is pending still invokes attempt once acquisition resolves, potentially starting a paid provider request after the client disconnected. Recheck the signal immediately after acquisition and return aborted before examining or attempting the selected account.

Suggested change

	while (!options.signal?.aborted) {
	const resolution = await options.acquire(excludedIds);
	if (options.signal?.aborted) return { kind: "aborted" };

[open-session-os-tella-dev]

🟠 P2 — The new package tests are excluded from required CI

All three new test files live under packages/core/subscription-gateway/src, but scripts/test-unit-isolated.sh, used by both bun run check and the required CI unit-test step, only searches packages/core/opensession-server/src and scripts. The root bun test script has the same exclusion, so these routing, retry, and durability regressions can merge with green required checks. Add the subscription-gateway source directory to find_tests or invoke a package-specific test script from the required check.