refactor(core): extract platform auth-health lifecycle

[jamezrin]

Part of #583. Depends on #584, #585 and #593. Can ship in one PR with #596.

Problem

Auth health has no owner in the #583 plan, but it gates almost everything: ticks, channel points, the Kick challenge job, the Twitch Extensions lane, and heartbeats. It lives in the controller as authRefreshGeneration, probeAuthHealth, persistAuthHealth, beginAuthRefresh, refreshAuthHealth, reportAuthSetupFailures, checkAuthHealth and invalidateAuthHealth (roughly controller.ts lines 1860–2100 and 2990–3020 as of v1.14.0). Hosts also wrap it: the extension's invalidateAuthHealth handler calls extensionHost.invalidate({ forgetCompletion: true }) before delegating. The CLI derives credential availability from its file/env store (packages/cli/src/authStore.ts).

Auth code also calls its dependents directly: persistAuthHealth, reportAuthSetupFailures and invalidateAuthHealth each contain if (platform === "twitch") await stopTwitchChannelPointsPush(emit). That puts a Twitch-only branch and a channel-points dependency inside a platform-neutral service.

Scope

• Add a per-platform AuthHealthService that owns probe/refresh generations and persists through the refactor(core): extract state commits and event publication #585 transaction.
  • Auth transitions are commits, so dependents learn about them through refactor(core): extract state commits and event publication #585's after-commit hooks: tick coordination refactor(core): extract per-platform tick coordination #587, channel points refactor(twitch): isolate channel-points and claim-only jobs #590, Kick challenges refactor(kick): isolate challenge and page-context lifecycle policy #588, the Twitch Extensions lane fix(twitch-extensions): route the supplemental lane through the commit path #594, heartbeats refactor(core): extract tabless heartbeat ownership and publication #586.
  • Services that need a synchronous answer use the service's read-only readiness query. Nothing calls into it to mutate.
• Delete the three stopTwitchChannelPointsPush calls. The channel-points service (refactor(twitch): isolate channel-points and claim-only jobs #590) stops its push from its own after-commit hook when Twitch auth stops being healthy.
• Remove host-side wrapping of auth invalidation. Dependent services react through their after-commit hooks instead.
• Credential availability stays a host port (checkCredentialAvailability). The extension reads browser cookies and the CLI reads its credential store. Neither exports credentials.

Acceptance criteria

• A superseded probe or refresh cannot overwrite newer auth health or publish activity.
• A Twitch auth transition cannot block or change Kick, and the reverse.
• Logout and account change cancel dependent work (channel-points push, claim-only jobs, Twitch Extensions sessions, heartbeats) through after-commit hooks, with no direct calls from this service into its dependents. AuthHealthService has no platform === "twitch"/"kick" branches and no reference to channel points.
• The missing_credentials / rejected / transiently-unavailable classification is unchanged on both hosts, covered by the refactor(core): define host ports and explicit runtime capabilities for the extension and CLI #593 core contract suite for both capability sets.
• pnpm test, pnpm typecheck and the CLI tests pass. No new stored credentials or localized diagnostic keys.

Out of scope

Changing probe requests, credential sources or the auth-health model.

---

Names the direct channel-points calls to remove, from the 2026-09-25 architecture review. Generated by Claude Code