国内病院の電子カルテ停止事案に学ぶ：
なぜ「閉域網のカルテ」と「バックアップ」が同時に暗号化されたのか？

#![forbid(unsafe_code)]

/// Telemetry header extracted from an incoming read-only ZFS replication delta stream.
#[derive(Debug, Clone, Copy)]
pub struct EhrReplicationDelta {
    pub snapshot_txg: u64,
    pub previous_txg: u64,
    pub modified_blocks: u64,
    pub total_dataset_blocks: u64,
    pub mean_entropy_milli_bits: u32,
}

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum VaultReplicationVerdict {
    AcceptAndHoldSnapshot { hold_tag_txg: u64 },
    QuarantineSuspectedRansomwareDelta { reason: &'static str },
    RejectNonMonotonicTransactionGroup,
}

/// Evaluates whether a pulled EHR snapshot delta exhibits ransomware mass-encryption traits
/// before rotating the primary recovery pointer in the immutable vault.
#[inline]
pub const fn evaluate_ehr_snapshot_delta(delta: &EhrReplicationDelta) -> VaultReplicationVerdict {
    if delta.snapshot_txg <= delta.previous_txg || delta.total_dataset_blocks == 0 {
        return VaultReplicationVerdict::RejectNonMonotonicTransactionGroup;
    }

    // Calculate ratio of modified blocks in basis points (0..=10_000)
    let churn_bps = (delta.modified_blocks.saturating_mul(10_000)) / delta.total_dataset_blocks;

    // If >15% of all clinical database blocks mutated in a 15-minute window AND
    // Shannon entropy exceeds 7.940 bits/byte, quarantine the delta and preserve prior snapshots.
    if churn_bps > 1_500 && delta.mean_entropy_milli_bits >= 7_940 {
        return VaultReplicationVerdict::QuarantineSuspectedRansomwareDelta {
            reason: "Mass block mutation with near-random ciphertext entropy detected",
        };
    }

    VaultReplicationVerdict::AcceptAndHoldSnapshot {
        hold_tag_txg: delta.snapshot_txg,
    }
}