# ADR 0031. Group Connected partners; confirm names the cascade

## Status
Accepted (as listed in the decisions index).

ADR 0030 keeps Unlink on the PlayerPal Account, one Audience per Unlink
target, operator-led Unlink cascading provider-operator integrations for that
operator, and provider-led Unlink as that integration only. The Account list
was a flat row per connection. Unlink of the operator Party then looked like
“one item, everything gone,” because confirm named the cascade in a sentence
and not the Audiences.

`GET /v1/me` also omitted which operator Party a provider-operator
integration belongs to, so the portal could not list cascade members without
guessing labels or treating every Provider row as in-scope.

## Decision

Connected partners **groups** provider-operator integrations under the
operator Party they are scoped to. Each Unlink target remains one Audience.
Nesting is chrome, not a new Audience kind.

Unlink controls:

- **Operator parent** — Unlink of that operator Party. Confirm **names every
  Audience** that will drop (the operator Party and each nested
  provider-operator integration). Cascade is unchanged.
- **Nested provider row** — Unlink of that provider-operator integration
  only. The operator parent stays, including when it has no children left.
- **Top-level Provider row** — a provider-led integration with **no**
  operator Party connection on this Account. No synthetic operator parent.
  Unlink is that integration only.

`GET /v1/me` connections that are `provider_operator` include
`operator_audience_id`: the operator Party public id (`pp_opr_...`), the
same value as that operator row’s `audience_id`. PlayerPal sets it from
authenticated integration configuration (`operator_party_id`), never from a
partner payload. It is not a private UUID and not `pp_plr_...`.

Do not guess the cascade set from labels. Do not send `operator_id` on
Unlink; the path param is the Audience being Unlinked.

## Consequences

- Operator Unlink confirm can list the real cascade set from `/v1/me`.
- Provider-led-only integrations stay Unlinkable without inventing an
  operator Audience.
- ADR 0030 is not rewritten. Widget Unlink remains a later slice.
- Identity invariants 2, 8, and 12 still hold: no private player UUID to a
  partner, no operator scope from an untrusted provider payload, no player
  PII in the new field.