TLCTC Definitions

These cluster definitions reflect v2.0. v2.1 is additive and backward-compatible, introducing three operator families that appear in the per-cluster notes below where relevant:

• Transit operator (⇒): marks carriers/relays in boundary syntax — e.g. ||[human][@Att⇒@SMSProvider→@Victim]||. R-TRANSIT-3: vendor code on the target device is not transit.
• Intra-system operators (|[type][@from→@to]|): annotate sandbox / privilege / process / hypervisor boundaries inside a single host. R-INTRA-7: they never change cluster classification. R-INTRA-9: the memory type is deferred and MUST NOT be used.
• Unresolved-step operators (?, …): mark forensic uncertainty when no cluster can yet be defended. R-UNRES-9: if any cluster fits even weakly, use #X [conf=low] instead. R-UNRES-8: every ?/… requires a prose annotation.

Use the v2.1 filter toggle (above) to show or hide v2.1 notes throughout this page — useful when exporting / printing for v2.0-only audiences.