EvidenceLocker incident snapshot mode

EvidenceLocker has a configuration-bound forensic snapshot mode. It is not an operator-owned incident-management or evidence-lock service.

Supported behavior

Configuration lives under EvidenceLocker:Incident:

"EvidenceLocker": {
  "Incident": {
    "Enabled": true,
    "RetentionExtensionDays": 60,
    "CaptureRequestSnapshot": true
  }
}

IncidentModeManager is the singleton IIncidentModeState. It reads the current options at startup and watches live IOptionsMonitor changes. Its snapshot contains:

• IsActive;
• ChangedAt, assigned by the service when the configuration snapshot is observed;
• RetentionExtensionDays, clamped to zero or greater;
• CaptureRequestSnapshot.

When Enabled changes, the manager publishes an IncidentModeChange to IEvidenceTimelinePublisher and IEvidenceIncidentNotifier. Timeline delivery is optional and uses the configured Timeline adapter. The default notifier is NullEvidenceIncidentNotifier, so EvidenceLocker does not currently deliver incident notifications to Notify.

While active, EvidenceSnapshotService changes only newly created snapshot bundles:

1. It extends ExpiresAt by RetentionExtensionDays.
2. It writes incident.mode, incident.changedAt, and incident.retentionExtensionDays into manifest metadata.
3. When capture is enabled, it stores a normalized incident/request-*.json artifact and includes it in the manifest/package.

These hooks do not mutate already sealed evidence.

Explicit non-capabilities

• No EvidenceLocker HTTP or CLI command activates or deactivates the mode.
• No actor, reason, fresh-auth, authorization, or idempotent transition-write contract exists.
• IEvidenceIncidentNotifier reports mode changes only; it does not define evidence-integrity-violation alerts, and the default adapter is a no-op.
• Incident mode does not add a delete/update lock. Evidence bundle immutability and object-store retention are separate controls.
• EvidenceAuditLogger does not record incident transitions. Optional Timeline events and ordinary service logs are not a durable audit record.
• Runtime transitions are not stored in PostgreSQL. A restarted service reads the then-current external configuration; it does not recover manager-owned state.
• The earlier EB7 signed activation/exit design (activatedBy, reason, signer, and transparency policy) is not implemented.

Verification

Focused manager tests cover live activation/deactivation, exact state values and timestamps, Timeline/notifier interface fanout, and manager recreation from current configuration. An in-process HTTP test covers active-mode retention extension and request-artifact capture.

Evidence and the aggregate disposition: docs/qa/feature-checks/runs/evidencelocker/incident-mode/run-002/README.md.