Document protected circuit groups

docs/circuit-list-editor-api.md

@@ -59,16 +59,23 @@ this value for optimistic concurrency checks.
   - clients cannot submit arbitrary `project.restore-state` payloads through
     the generic command endpoint
 
-The public dispatcher currently supports `circuit.update`, `circuit.insert`,
-`circuit.delete`, `circuit-device-row.update`,
-`circuit-device-row.insert`, `circuit-device-row.delete`,
-`circuit-device-row.move`, `circuit-device-row.move-with-new-circuit`,
-`circuit.reorder-section`, `circuit.reorder-sections`,
-`circuit.renumber-section` and
-`project-device.update`, `project-device.insert`, `project-device.delete` and
-`project-device.sync-rows` as well as `project.update-settings`, all with
-schema version `1`. Other command types
-are rejected. Insert commands contain the complete entity or circuit block
+The public dispatcher supports the Circuit and CircuitDeviceRow commands
+`circuit.update`, `circuit.insert`, `circuit.delete`,
+`circuit-device-row.update`, `circuit-device-row.insert`,
+`circuit-device-row.delete`, `circuit-device-row.move`,
+`circuit-device-row.move-with-new-circuit`, `circuit.reorder-section`,
+`circuit.reorder-sections` and `circuit.renumber-section`.
+
+Protected-board structure uses
+`distribution-board-component.insert|update|delete`,
+`circuit-group.insert|update|delete|reorder|renumber`,
+`circuit.move-group`, `circuit-group.delete-subtree` and
+`circuit-protection.update`. A subtree restore is normally emitted only as the
+persisted inverse of a delete. The dispatcher also supports the documented
+project-device, project settings, distribution-board and project-location
+commands. The generic editor commands listed here use schema version `1`;
+older stored formats can remain supported by their owning command boundary.
+Unsupported types are rejected. Insert commands contain the complete entity or circuit block
 with stable ids; delete commands include the expected parent identity. Circuit
 snapshots contain zero, one or multiple complete device rows. Move commands
 contain each row's expected and target circuit plus its exact expected and
@@ -101,6 +108,24 @@ targets occupied by other sections, then applies swaps through collision-safe
 temporary identifiers. Undo restores the exact prior identifiers; sort
 positions and device rows remain unchanged.
 
+`circuit-group.reorder` changes only complete group sort assignments.
+`circuit-group.renumber` carries every affected group, child circuit and group
+component with expected and target identifiers so swaps can be applied
+collision-safely. `circuit.move-group` changes one complete circuit's group,
+BMK and position and stores the deterministic target BMK. The target group must
+have the same category.
+
+`circuit-group.delete-subtree` carries the complete warned group state,
+including both protection layers and every device-row link/override value. The
+server captures the current subtree again inside the transaction and rejects a
+stale or incomplete snapshot. Undo restores the same UUIDs through the stored
+inverse command.
+
+`circuit-protection.update` inserts or replaces the complete validated
+one-to-one circuit protection state. Users cannot remove the required
+protection row; removal is available only to a stored inverse when undoing its
+initial creation.
+
 `project-device.sync-rows` represents `synchronize`, `disconnect` and
 `reconnect` operations. Every selected row carries complete expected and target
 snapshots of all ProjectDevice-sync fields, the link and `overriddenFields`.