Transfers, sync and limiters

C0187How does data move between clinics?

Through an authority record first, then a secret-shared package over three simultaneous streams with decoy padding, authenticated encryption and hybrid key exchange, verified by a hash on delivery. Designed, not built.

C0188Do decoys make data confidential?

No. Decoys raise the cost of traffic analysis only. Confidentiality comes from secret sharing and authenticated encryption.

C0189What is the secret-sharing threshold?

Open. Two of three is the recommendation, and the decoy ratio will be set by testing.

C0190What does the read-side limiter do?

It limits reads and pulls, not writes, using oscillating time windows. Tripping it pauses only cloud and clinic-to-clinic sync, never local care.

C0191What are the limiter numbers?

Open: window length, oscillation pattern, per-role and per-terminal quotas. Until set the design runs it in log-only mode with counters and a weekly reminder that values are unset.

C0192Will a busy morning clinic trip the limiter?

The quotas must be chosen against real clinical workloads so legitimate peaks do not trip it. That tuning has not been done.

C0193What is the scroll-rate lock?

A re-authentication prompt when history is paged faster than a threshold, computed on the server by information rendered, with lighter weights for result triage. Threshold is open.

C0194Can one person export all patients?

No. Individual bulk export is disabled and bulk operations need a quorum-approved workflow.

C0195How does a paused sync resume?

By multi-key corroboration and an audit entry, and it is refused if the underlying integrity alarm remains unresolved.

C0196Are sync bundles tamper-proof?

Each bundle is encrypted, signed, hash-chained with gapless sequence numbers and replay protection, and the backup range is anchored on the ledger.

C0197Does sync leak activity patterns?

Bundle size and timing can reveal activity; padding and jitter give limited protection, which the design states honestly.