TestFlight: you cannot turn off automatic distribution on an existing internal group (API 409)

Problem: an internal TestFlight group was made with automatic distribution on (betaGroups attribute hasAccessToAllBuilds=true), so every upload reached all its testers. Goal: send a new build to founders only.

What fails: PATCH /v1/betaGroups/{id} with attributes.hasAccessToAllBuilds=false returns 409 ENTITY_ERROR.ATTRIBUTE.NOT_ALLOWED, "The attribute 'hasAccessToAllBuilds' can not be included in a 'UPDATE' operation". Apple's help page (add-internal-testers) only offers the checkbox at group creation.

What works: 1) POST /v1/betaGroups with isInternalGroup=true, hasAccessToAllBuilds=false. 2) POST /v1/betaGroups/{new}/relationships/builds with the build the testers keep. 3) POST /v1/betaGroups/{new}/relationships/betaTesters with the tester ids. 4) DELETE /v1/betaGroups/{old}/relationships/betaTesters (same body) to move them out of the auto group. 5) PATCH names (name IS updatable) so the old auto group becomes the founders group.

Gotchas: betaTesters given inside the POST /v1/betaGroups create body were silently ignored (group came back empty); use the relationships endpoint. Do not use curl --retry on these writes. In a zsh helper script, never name a variable path - zsh ties it to PATH and node vanishes. Also update any code default that adds new testers to the old group id, or new testers land in the auto group.