# Architecture and invariants

## Layers

1. `model.mbt`, `enzyme.mbt`: private-field validated DNA/topology and model geometry; upstream base expansion/complement. No unchecked JSON constructors for these types.
2. `scan.mbt`: masks represent allowed bases; recognize both strands, transform offsets, retain certainty, normalize circular coordinates. Match evidence is separate from cut eligibility.
3. `digest.mbt`, `multi.mbt`: select policy-eligible cuts, retain all recognition provenance, coalesce equal geometries, reject conflicts, partition top-strand intervals.
4. `verify.mbt`: recompute recognition/cut evidence, then independently derive interval boundaries and check fragment length/content one base at a time. Shared scanner is a known common-mode risk, addressed by concrete IUPAC and metamorphic tests, not disguised as independent recognition.
5. `ends.mbt`, `partial.mbt`, `annotation.mbt`, `bands.mbt`, `compare.mbt`, `panel.mbt`: bounded domain extensions. No environment or network dependence.
6. `fasta.mbt`, `enzyme_io.mbt`, `protocol.mbt`: bounded adapters. FASTA directly imports upstream parsing; no new general-purpose FASTA parser is claimed.
7. `command.mbt`: pure portable dispatcher. `cmd/main` adapts platform argv prefixes and aborts on errors. `examples/workflow` proves library composition independent of the command dispatcher.

## Geometry

All intervals follow the supplied reference top strand. For a forward motif at s with offsets t,b, top=s+t and bottom=s+b. Reverse recognition uses top=s+m−b, bottom=s+m−t. Signed stagger is bottom−top before circular normalization.
For circular DNA, normalized cuts are in [0,n), but preserving signed stagger distinguishes geometry across the origin. Staggers spanning a full turn or longer are recognized but not cuttable. Motifs longer than the entire molecule are not scanned. Palindromic motifs are deduplicated only if strand-transformed cleavage geometry also agrees.
Linear cuts are sorted by top position and require strictly increasing bottom cuts between actual cleavage events. Natural terminal boundaries are not extra synthetic enzyme events; terminal cuts do not create zero-length top-strand fragments. Circular bottom positions are unwrapped relative to each top position and must retain cyclic order. Equal-top/equal-stagger cuts coalesce while every originating recognition event remains in `sites`.
An uncut circular source yields a circular full-length fragment. A cut circle begins output at the lowest normalized top cut; concatenation reconstructs a rotation, not necessarily the original origin. Cut fragments are not circular.

## Comparison semantics

Comparison verifies each map against its own source and model set. Source identity, topology, coordinate geometry, exact size multiset and literal fragment sequence multiset are separate flags. Geometry is coordinate-relative: rotated origins may change it. Size bands are origin-invariant. For cut circles the fragment-string multiset is rotation-invariant in covered blunt-cut tests; an **uncut** circular string is not circularly canonicalized, so two rotated uncut molecules can have unequal literal fragment strings. No biological equivalence inference is made.

## Complexity

Recognition is O(n × sum(motif lengths)) with two orientations and explicit work/site caps; sorting sites and cuts is O(s log s); constructing a complete report's fragments is O(n). Verification repeats recognition plus O(n) fragment checking. Partial output is O(k × outputs + n × outputs), k<=12. Annotation traversal is O(annotation count × n) plus output. Panel selection is greedy O(budget × columns × rows²), with rows/columns<=32.

## Tests and assurance boundaries

Focused tests cover models, reversed offsets, origin crossing, ambiguity, conflicts, ends, strict formats, partial truncation, annotation splitting, fingerprints, panels and tamper detection. White-box regressions enumerate 1,364 A/C/G/T strings (lengths 1–5), 256 four-base rings with all rotations, and 225 IUPAC observation/pattern pairs. Process acceptance runs JSON fixtures, negative exits and the multi-record workflow on each runnable target.
No fuzzing service, biological dataset validation, benchmark-derived production SLA or formal proof is claimed. This version is intended for bounded educational/offline integration rather than genome-scale processing.