# ADR-0004: Evidence storage — local disk, not cloud object storage

## Status

Accepted

## Context

Phase 3 of the DPS implementation plan adds evidence management (the infographic's "Evidence Collection" / "Evidence Automation" capabilities) — merchants and ops need to attach documents (receipts, delivery proof, correspondence) to a dispute case. This requires durable file storage.

No cloud storage dependency (`ExAws.S3` or similar) exists anywhere in this codebase today. The one existing precedent for storing generated/uploaded files durably is OTA package/config delivery (`TmsCore.TerminalManagement.KeysConfigService` and related MF919 pipeline modules), which write directly to local disk under `priv/ota/{serial_number}/` via `File.mkdir_p!/1` + `File.write/2`, and serve files back out by joining a configured base path/URL.

## Decision

Store dispute evidence files on local disk under `priv/dispute_evidence/{case_number}/`, following the same `File.mkdir_p!/1` + `File.write/2` convention as the OTA pipeline. File metadata (name, path, content type, doc type, uploader, timestamp) is tracked in a new `dispute_evidence` table.

## Alternatives considered

- **Introduce `ExAws.S3` (or equivalent cloud object storage) for evidence.** Rejected for the MVP — this would be a new infrastructure dependency with no existing precedent anywhere in the umbrella, adding operational surface (credentials, bucket lifecycle, network dependency for every upload/download) that isn't justified until evidence volume or durability/multi-instance requirements actually outgrow local disk.

## Consequences

- Consistent with the codebase's existing file-storage convention — no new infra dependency introduced for Phase 3.
- Evidence files live on the app server's local disk, tied to that instance/volume — this is a real constraint (no built-in redundancy, no cross-instance access without a shared volume) that should be revisited if the deployment topology changes (e.g. multiple app instances without a shared filesystem) or if evidence retention/compliance requirements demand off-instance durability.
- Revisit this ADR (supersede, don't edit) if either of the above triggers occur.