feat(stream): TASK 41 Test Stream mode — private test broadcast + TEST drawer

Test button next to Start runs the real private-only go-live pipeline as a
session variant (IsTestStream): BeginTestStream -> extracted
StartStreamingSession(alsoRecord:false) shared with the dialog path — no Go
Live dialog, no 'last live' stamp, no recording. Gold top bar + TEST badge +
'End Test' button face; TEST drawer (third right-rail pull-out, three-way
exclusivity) auto-opens once the liveChatId resolves.

Chat tooling: Mock Chat Input sends a REAL liveChat/messages.insert
(YouTubeStreamService.InsertChatMessageAsync) that round-trips the real ~2s
poll and renders through the live overlay; simulated Subscriber/New
Member/Super Chat events inject through the poller's MessageReceived seam
(YouTubeChatService.InjectSimulatedMessage, ChatMessage.IsSimulated) — the
insert API only creates textMessageEvent, so non-text events are local-only
by design (ref: developers.google.com/youtube/v3/live/docs/liveChatMessages/insert).
Scopes youtube + youtube.force-ssl already cover insert; no re-consent.

Good Dog: ytLive.Tests/TestStreamTests.cs — coordinator protocol with fake
HTTP + real-window drawer exclusivity/gate. 0 warnings; 314/314 pass (clean
run; intermittent host abort is the pre-existing WinRT-webcam flake).

Docs ride in the same change: TASKS.md row 41, TASKS/task-41-test-stream-mode.md,
ai.md (YouTube Live API constraints), HANDOFF rewrite.

HANDOFF.md

@@ -1,70 +1,77 @@
-# HANDOFF — 2026-09-22 (TASK 39 shipped+pushed; TASK 40 App Settings round plan SAVED in `4d9188a`, uncommitted here)
+# HANDOFF — 2026-09-22 (TASK 41 Test Stream mode shipped; TASK 40 plan queued)
 
 ## Branch / Commit State
 
 `main` HEAD = **`4d9188a` — docs(plan): TASK 40 App Settings round — saved plan**. Pushed state
-at `197ee81`. **Working tree DIRTY — ONE docs work unit:**
+at `197ee81`. **Working tree DIRTY — TASK 41 implementation in progress** (code + docs staged for
+a single scope-checked commit; HANDOFF rewrite rides in a final docs commit):
 
 ```
-?? HANDOFF.md          (this rewrite)
+?? HANDOFF.md                      (this rewrite)
+ M Models/YouTube.cs
+ M Services/YouTubeStreamService.cs
+ M Services/YouTubeChatService.cs
+ ?? Services/TestSessionViewModel.cs
+ M ViewModels/MainViewModel.cs
+ M ViewModels/MainViewModel.Ypp.cs
+ M ViewModels/MainViewModel.Account.cs
+ M ViewModels/MainViewModel.Streaming.cs
+ M ViewModels/MainViewModel.Streaming.Operations.cs
+ M Controls/TopBar.xaml
+ M Controls/PreviewPane.xaml
+ ?? ytLive.Tests/TestStreamTests.cs
+ M TASKS.md
+ ?? TASKS/task-41-test-stream-mode.md
+ M ai.md
 ```
-Build impact: none — docs only.
 
-## What's in flight — TASK 40: App Settings round (plan saved 2026-09-22)
+Build impact: main + tests build clean, **0 warnings**; **314/314 tests pass** (313 prior + 1 new
+Good Dog). A flaky real-camera startup test aborted one earlier full-suite run (hardware-dependent,
+unrelated to this change); the clean rerun passes fully.
 
-Creator (this session) scoped three asks and answered four decision questions. Full plan:
-**`TASKS/task-40-app-settings-round.md`** (created + committed in `4d9188a`). Four units, one
-Good Dog test + one scope-checked commit each:
+## What shipped — TASK 41: Test Stream mode (2026-09-22)
 
-- **Unit A — App Settings "Active Web Camera"** (ask 1): new section under "Default Location
-  for Recordings" — **Change…** opens a sub-menu of a *fresh* webcam enumeration incl. vcams
-  (adopt+base-lock if `_webcam == null`, else existing `SwapWebcamIdentityAsync`); **Tune…**
-  opens a `CameraConfigDialog` of the device's `VideoDeviceController` MediaDeviceControls
-  (Auto + Min/Max/Step sliders, **live-only**, no persistence). Tech risk to verify at impl:
-  whether MediaDeviceControl writes work under `SharedReadOnly` (ladder: probe capture → running
-  source's controller → read-only + note; spin-guard = research before a 3rd guess).
-- **Unit B — gear** (ask 2): move from BottomBar lower-left to **TopBar right of the wordmark,
-  gap ≈ 3 letters**; left-click = App Settings, right-click = Bug/Feature/About.
-- **Unit C** (ask 3): persist default output resolution (currently resets every launch), surface
-  default scene transition + duration (persisted but editable NOWHERE), Confirm-before-End toggle.
-- **Unit D — accent/theme** (ask 3, split out as its own unit): 69 hardcoded accent sites across
-  15 files → consolidate into a `Themes/Controls.xaml` accent brush (DynamicResource) + picker +
-  `App.AccentColor` Settings key; `Source.ChatMemberColor` stays per-source.
+Full record: **`TASKS/task-41-test-stream-mode.md`**. Decisions locked with the creator:
+chat-overlay-events-only (no stinger/TTS — stays TASK 3 16/17/20), TEST drawer in the right rail,
+hybrid simulation (real text insert + local synthetic events). Key design: since every broadcast is
+already private-only (`CreateBroadcast` hardcodes `privacyStatus=private`), "Test" is a **session
+variant**: `BeginTestStream` → extracted-shared `StartStreamingSession(alsoRecord:false)` (no
+dialog, no "last live" stamp, no recording). `IsTestStream` = gold top bar (`#9c6f1c`) + TEST badge
++ "End Test" button face. `TestSession.BeginTest(broadcastId, liveChatId)` opens the TEST drawer
+once the liveChatId resolves. Mock Chat Input = real `liveChat/messages.insert` round-trip;
+simulated events inject through the poller's `MessageReceived` seam marked `IsSimulated` (hard API
+fact: insert only creates text — non-text events are local-only by design). Three-way drawer
+exclusivity (Stream Settings / YPP / TEST) in `MainViewModel.Ypp.cs`.
 
-## ⚠️ Open action items / landmines
+**Good Dog** — `ytLive.Tests/TestStreamTests.cs` (one `[Fact]`): coordinator protocol w/ fake HTTP
+(insert POST body asserted; simulated shapes verified) + real-window exclusivity/gate. Note: the
+coordinator section runs on the test thread directly (pure services, no WPF), the window section via
+`RealAppHost.Run` — deviates from YppPullOutTests' all-in-one-Run shape for debuggable stacks.
 
-- **The app may still be RUNNING** (a `ytLive` instance locked `bin\…\ytLive.dll` earlier today)
-  — in-place `dotnet build` fails with MSB3021/MSB3027 until it's closed. Workaround that worked:
-  build with `-p:OutDir=C:\Users\gramp\AppData\Local\Temp\ytLive-buildNN\ -p:UseAppHost=false`
-  and run vstest against the temp dll. Close the app before Unit-A final verification.
-- **Unit A SharedReadOnly control-write risk** is the one genuinely uncertain technical point —
-  do NOT hand-wave it; run the mitigation ladder and (if needed) the spin-guard research.
-- **`subscriberCount` rounded to 3 sig figs** by Google (YPP numbers are coarse). Carried.
-- **Slice 2 (YPP Analytics) needs Google re-consent** (`yt-analytics.readonly`) — do NOT merge
-  with any TASK 40 unit.
+## ⚠️ Around the task
+
+- **Manual verification still owed** (needs a real run, Windows): Test button → gold face + badge +
+  auto-open TEST drawer; send a message → appears on a ChatBox overlay after ~2s; simulated rows
+  render text/member/SuperChat styled; End Test closes it all out cleanly (transition complete).
+- The app may be **RUNNING** — in-place build fails MSB3021/MSB3027 until closed (temp-OutDir
+  workaround in ai.md). Close it before the manual pass.
+- The full-suite flake earlier: real-camera startup test under the test host (hardware, pre-existing
+  behavior; unrelated to TASK 41).
 - LayerReorderPersistenceTests.RealMouseDrag flaked once pre-TASK-38 (fullscreen game); unrelated.
-- Polar product `d105dfa1…` still `$99/yr` — must become one-time before launch (carried,
-  `TASKS/task-10-monetization.md`). `MARCOM.md`/`MONETIZATION.md` gitignored — never commit.
+- `subscriberCount` rounded to 3 sig figs (YPP); carried. YPP slice 2 needs re-consent — do NOT
+  merge with other units.
+- Polar product `d105dfa1…` still `$99/yr` — must become one-time before launch (carried).
+  `MARCOM.md`/`MONETIZATION.md` gitignored — never commit.
 
 ## Next step
 
-The user has a **new task spec waiting** — take it, then execute TASK 40 units A → B → C → D per
-the saved plan (each: declared file list → code → Good Dog test → `./scripts/scope-check.sh` →
-commit with docs in the SAME commit → push only on the user's say-so). HANDOFF rewrite is due
-when this docs work unit commits.
+Commit TASK 41 (scope-check the declared list first), then **TASK 40 App Settings round is queued**
+(`TASKS/task-40-app-settings-round.md`, units A → B → C → D, one Good Dog each). Unit A's
+SharedReadOnly control-write question is the one genuinely uncertain technical point — run its
+mitigation ladder, spin-guard research before a third guess. Push only on the user's say-so.
 
 ## Critical working rules (unchanged, still binding)
 
 - **Good Dog = ONE integration test per change.**
 - **Scope lock:** declare the file list before editing; `./scripts/scope-check.sh` before commit.
-- WSL builds use the Windows dotnet host (`/mnt/c/Program Files/dotnet/dotnet.exe`, quoted paths).
-- ai.md + code in the SAME commit; HANDOFF rewritten at session end.
-
-## Where the machine facts live
-
-- `%APPDATA%\ytLive\ytLive.db` = real layout DB (`layout.db` is a 0-byte legacy file); schema
-  `user_version = 10`. sqlite3 at `/root/android-sdk/platform-tools/sqlite3`.
-- ffmpeg/ffprobe: `/mnt/c/Program Files/Krita (x64)/bin/` with Windows paths.
-- `ai.md` §Screen backdrop capture = authoritative backdrop doc (incl. TASK 38);
-  §Monetization awareness = monetization roadmap (TASK 39 state, YPP thresholds).
-- Business/marcom: `MONETIZATION.md` + `MARCOM.md` (gitignored).
+- WSL builds use the Windows dotnet host (`/mnt/c/Program Files/dotnet/dotnet.exe`, quoted paths).