ランサムウェアに決して書き換えられない「データの耐火金庫」：
ZFS不変スナップショットと行単位の鍵（RLS）のしくみ

-- ============================================================================
-- 1. FreeBSD 15.1-STABLE OpenZFS Dataset Alignment for PostgreSQL 19 (db01.ok.st)
--    zfs create -o recordsize=8K -o compression=lz4 -o atime=off \
--               -o primarycache=metadata zroot/pg19/data
--    zfs create -o recordsize=128K -o compression=lz4 -o logbias=latency zroot/pg19/wal
-- ============================================================================

-- ============================================================================
-- 2. PostgreSQL 19 Strict Multi-Tenant Isolation with FORCE ROW LEVEL SECURITY
-- ============================================================================
CREATE TABLE IF NOT EXISTS ledger_journals (
    journal_id      UUID PRIMARY KEY DEFAULT uuidv7(),
    tenant_id       UUID NOT NULL,
    tx_timestamp    TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
    debit_account   VARCHAR(32) NOT NULL,
    credit_account  VARCHAR(32) NOT NULL,
    amount_jpy      BIGINT NOT NULL CHECK (amount_jpy >= 0),
    payload_sha256  BYTEA NOT NULL CHECK (octet_length(payload_sha256) = 32)
);

-- Enable AND Force RLS even for table owner / admin connections
ALTER TABLE ledger_journals ENABLE ROW LEVEL SECURITY;
ALTER TABLE ledger_journals FORCE ROW LEVEL SECURITY;

-- Fail-Closed Policy: InitPlan constant folding via scalar subquery (SELECT ...)
CREATE POLICY tenant_strict_isolation_policy ON ledger_journals
    AS RESTRICTIVE
    FOR ALL
    USING (tenant_id = (SELECT current_setting('app.tenant_id', false)::uuid))
    WITH CHECK (tenant_id = (SELECT current_setting('app.tenant_id', false)::uuid));

-- Composite index aligned with ZFS 8K recordsize and RLS leading column
CREATE INDEX CONCURRENTLY idx_ledger_journals_tenant_ts
    ON ledger_journals (tenant_id, tx_timestamp DESC)
    INCLUDE (amount_jpy, payload_sha256);

// ============================================================================
// 3. Rust 2024: OpenZFS 128-Byte Block Pointer (`blkptr_t`) Fletcher-4 Verifier
// ============================================================================
#[repr(C, align(8))]
#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct ZfsBlkptr128 {
    pub blk_dva: [[u64; 2]; 3], // 0x00..0x30 (48 bytes: 3 DVAs)
    pub blk_prop: u64,           // 0x30..0x38 (8 bytes: lsize, psize, compression, checksum type)
    pub blk_pad: [u64; 2],       // 0x38..0x48 (16 bytes)
    pub blk_phys_birth: u64,     // 0x48..0x50 (8 bytes)
    pub blk_birth: u64,          // 0x50..0x58 (8 bytes: logical birth TXG)
    pub blk_fill: u64,           // 0x58..0x60 (8 bytes: non-zero block count under subtree)
    pub blk_cksum: [u64; 4],     // 0x60..0x80 (32 bytes: 256-bit Fletcher-4 / SHA-256 Merkle hash)
}

const _: () = assert!(core::mem::size_of::<ZfsBlkptr128>() == 128);

/// Computes OpenZFS Fletcher-4 256-bit checksum over an 8KB PostgreSQL heap page
/// and verifies it against the parent block pointer's stored Merkle hash.
#[inline]
pub const fn verify_zfs_fletcher4_8k(page_words: &[u32], expected_cksum: [u64; 4]) -> bool {
    let mut a: u64 = 0;
    let mut b: u64 = 0;
    let mut c: u64 = 0;
    let mut d: u64 = 0;
    let mut i = 0;
    while i < page_words.len() {
        a = a.wrapping_add(page_words[i] as u64);
        b = b.wrapping_add(a);
        c = c.wrapping_add(b);
        d = d.wrapping_add(c);
        i += 1;
    }
    a == expected_cksum[0] && b == expected_cksum[1] && c == expected_cksum[2] && d == expected_cksum[3]
}