Private broadcasts end like recordings: Enter keeps, Escape deletes (KeepBroadcastDialog). Privacy read from YouTube; delete = videos.delete (fallback liveBroadcasts.delete on 404). Refs: https://developers.google.com/youtube/v3/docs/videos/delete https://developers.google.com/youtube/v3/live/docs/liveBroadcasts/delete (Unit: private broadcast close-out)

Services/YouTubeStreamService.cs

@@ -174,6 +174,66 @@ public class YouTubeStreamService
         return $"YouTube rejected the end transition ({(int)response.StatusCode})";
     }
 
+    /// <summary>The broadcast's current <c>status.privacyStatus</c> ("private", "unlisted",
+    /// "public"), read from YouTube rather than trusted from local state — the creator can
+    /// change visibility mid-stream from the broadcast form. Null when signed out or the
+    /// read fails (the caller then does nothing destructive).</summary>
+    public async Task<string?> GetBroadcastPrivacyAsync(string broadcastId)
+    {
+        if (!await EnsureToken()) return null;
+        _http.DefaultRequestHeaders.Authorization = new("Bearer", _auth.CurrentChannel!.AccessToken);
+        try
+        {
+            var response = await _http.GetAsync(
+                $"{ApiBase}/liveBroadcasts?part=status&id={Uri.EscapeDataString(broadcastId)}");
+            if (!response.IsSuccessStatusCode) return null;
+            var json = JsonSerializer.Deserialize<JsonElement>(await response.Content.ReadAsStringAsync());
+            if (!json.TryGetProperty("items", out var items) || items.GetArrayLength() == 0) return null;
+            if (!items[0].TryGetProperty("status", out var status)) return null;
+            return status.TryGetProperty("privacyStatus", out var privacy) ? privacy.GetString() : null;
+        }
+        catch (Exception ex)
+        {
+            AppLog.Write($"Broadcast privacy read failed: {ex.Message}");
+            return null;
+        }
+    }
+
+    /// <summary>Deletes a finished broadcast's recording from YouTube (the creator pressed
+    /// Escape / Delete on the keep-or-delete prompt). A live broadcast's id IS its video's
+    /// id, so this is <c>videos.delete</c> (Data API, 204 on success); if YouTube hasn't
+    /// created the video yet (404) it falls back to <c>liveBroadcasts.delete</c>. Returns
+    /// null on success, or an error string — never throws.
+    /// Docs: https://developers.google.com/youtube/v3/docs/videos/delete ,
+    /// https://developers.google.com/youtube/v3/live/docs/liveBroadcasts/delete</summary>
+    public async Task<string?> DeleteFinishedBroadcastAsync(string broadcastId)
+    {
+        if (!await EnsureToken()) return "not signed in";
+        _http.DefaultRequestHeaders.Authorization = new("Bearer", _auth.CurrentChannel!.AccessToken);
+        try
+        {
+            var id = Uri.EscapeDataString(broadcastId);
+            var video = await _http.DeleteAsync($"{ApiBase}/videos?id={id}");
+            if (video.IsSuccessStatusCode) return null;
+            if (video.StatusCode == System.Net.HttpStatusCode.NotFound)
+            {
+                var broadcast = await _http.DeleteAsync($"{ApiBase}/liveBroadcasts?id={id}");
+                if (broadcast.IsSuccessStatusCode) return null;
+                var bBody = await broadcast.Content.ReadAsStringAsync();
+                AppLog.Write($"liveBroadcasts.delete failed ({(int)broadcast.StatusCode}): {bBody}");
+                return $"YouTube refused to delete the broadcast ({(int)broadcast.StatusCode})";
+            }
+            var body = await video.Content.ReadAsStringAsync();
+            AppLog.Write($"videos.delete failed ({(int)video.StatusCode}): {body}");
+            return $"YouTube refused to delete the video ({(int)video.StatusCode})";
+        }
+        catch (Exception ex)
+        {
+            AppLog.Write($"Broadcast delete failed: {ex.Message}");
+            return ex.Message;
+        }
+    }
+
     /// <summary>One liveBroadcasts.list (part=status) read of the broadcast's own
     /// lifeCycleStatus — the only reliable "can we complete?" signal. Null when the
     /// list fails or the status is missing (caller degrades gracefully).</summary>

Services/index.md

@@ -7,6 +7,7 @@ External-facing logic: YouTube API, persistence. See
 |------|---------|
 | `YouTubeAuthService.cs` | OAuth2 via Google: loopback callback (`http://localhost:8765/oauth2/callback`), token exchange, refresh, channel fetch. Constructor takes optional `HttpClient` + `sessionChanged` callback (test seam + save hook); session persists via `Helpers/TokenStore` (DPAPI); `ClearSession()` signs out (called by `MainViewModel.StopStream` on End Livestream) |
 | `YouTubeStreamService.cs` | Broadcast/stream management via the v3 API. **`CreateBroadcast` always sends `privacyStatus = "private"`** (ship step 7 — private-only until v1) and the one-click v3 flags (`enableAutoStart/Stop`, `enableMonitorStream=false`, `latencyPreference=low`); injectable `HttpClient? http = null` ctor seam so tests can fake the API. **`GetOrCreateReusableStreamAsync` (TASK 9, shipped 2026-08-16)** returns the channel's `ReusableStream` — lists `liveStreams?mine=true` and reuses the existing `cdn.isReusable` stream, inserting once only on first use (`resolution=variable`, `frameRate=variable`, `isReusable=true`); a stream id given to `CreateBroadcast` binds at insert via `contentDetails.boundStreamId`. RTMP URL = `ingestionAddress + "/" + streamName`. **`GetStreamHealthAsync(streamId)` (TASK 9 item 3, shipped 2026-08-16)** polls `liveStreams?part=status` → `StreamHealth` with parsed `configurationIssues[]` (NOTE 2026-09-22: the real API nests `status.healthStatus = {status, lastUpdateTimeSeconds, configurationIssues[]}` as an OBJECT — the parse reads the nested `.status` and tolerates the old flat-string shape; the object shape used to crash every poll) | **`EndBroadcastAsync` (2026-09-01; hardened 2026-09-22)** posts `liveBroadcasts/transition?broadcastStatus=complete&part=status` AFTER RTMP EOF with a pre-flight `liveBroadcasts.list` read of the broadcast's OWN `lifeCycleStatus`: only transitions from `live`/`testing`, skips already-complete broadcasts silently (2026-09-22: every blind end logged `invalidTransition` — autoStop races us to complete); `enableAutoStop` finishes every skip |
+| `YouTubeStreamService.cs` (2026-10-09 additions) | `GetBroadcastPrivacyAsync(id)` (`liveBroadcasts.list part=status` → privacyStatus) and `DeleteFinishedBroadcastAsync(id)` (`videos.delete`, fallback `liveBroadcasts.delete` on 404; never throws) — the private-broadcast keep-or-delete close-out |
 | `StreamHealthReporter.cs` | Pure report-by-exception decision (TASK 9 item 3): `BannerFor(issues)` → `HealthIssueReport(Text?, IsError)` — null text on good/ok/noData/info-only, first warning/error issue produces its type text, error beats warning for color |
 | `YouTubeChatService.cs` | Polls `liveChat/messages`, raises `MessageReceived`; `IDisposable`. **TASK 43 rewrite (2026-09-24):** re-arms its one-shot poll on the server's `pollingIntervalMillis` (streamList semantics — reconnect on that cadence with `nextPageToken`, clamp 1000–6000ms, `maxResults=2000`); `ParsePage` (internal static seam) decodes **all six** event types into `ChatMessage.Kind`/fields (superChat / superSticker / newSponsor / membershipGifting / giftMembershipReceived / memberMilestoneChat + milestone months best-effort regex); optional `HttpClient` ctor seam endures; `InjectSimulatedMessage` (TASK 41) preserved |
 | `ChatBoxRenderer.cs` | Chat overlay rasterizer (WPF FormattedText → BGRA `VideoFrame`), live rows + Super Chat/member styling |