# ADR 0032. Demo Bucks unlink notice and alias reconcile

## Status

Accepted.

## Context

Unlink commits on PlayerPal (`revoked_at`) and may notify the partner asynchronously
(spec §36.6.5). Failure of that notice must not fail Unlink. Play at the partner
continues. ADR 0030 allowed casino chrome to stay stale-linked until Bucks knew.

Demo Bucks only read a local alias row. `notifyRevoked` was a no-op, so Account and
Game kept showing Connected after PlayerPal Unlink. Casino chrome must not wait on
Unlink, must not call PlayerPal on every wager, and must never send the private
player UUID. Audience for partner APIs comes from authenticated client headers,
not from an untrusted `operator_id` body field.

## Decision

PlayerPal pushes a fire-and-forget status delta to demo Bucks after Unlink
(`POST /v1/player-link-notices` with `MACHINE_API_KEY`, lookup by `pp_plr_opr_…` /
`pp_plr_prv_…`). Unlink HTTP success does not wait on that POST.

Bucks does not expose `DELETE /v1/player-links/:playerRef`. Casino Account/Game
still refresh `GET /v1/player-links/:playerRef`. After a local hit, Bucks
reconciles once with PlayerPal `GET /v1/aliases/:playerAlias` (operator or
integration header). `revoked` or `404` applies the same cache update as the
notice. PlayerPal network/5xx keeps last known (stale-linked).

Delete Account still does not command partner erasure.

Demo routing uses `BUCKS_UNLINK_NOTICE_URL` for `pp_opr_01DEMOBUCKS` and
`pp_int_ORBIT_BUCKS` only. Per-party webhook URLs and OAuth machine clients are
later.

## Consequences

- Connect returns on Bucks when the notice lands or the next status refresh
  reconciles a missed notice.
- Stale-linked remains when the notice fails and PlayerPal is unreachable.
- Compose Nest reaches host Bucks via `host.docker.internal:3002` unless
  `BUCKS_UNLINK_NOTICE_URL` is set otherwise.