This document describes the archive as a records-and-evidence method. It uses no framing language and claims no standing that does not exist. Section 9 states the limitations, including those with no mitigation in place.
A Method for Non-State Documentation of Contested Atrocity
Source tiering, refusal recording, and non-purchasable standing in a diaspora-operated archive
Working paper, version 1.0. Figures stated as of era-day 580. Issued by TLTE C.I.C., a Community Interest Company registered in England and Wales, company number 16426152, incorporated 2 May 2025, subject to the statutory CIC asset lock.
1. Abstract and scope
This paper describes the working method of a diaspora-operated documentation archive concerning the armed conflict in Sri Lanka and its aftermath. The archive is operated by a UK-incorporated community interest company. It holds no mandate to represent any population, takes no testimony from individuals, publishes no casualty figures of its own, and reaches no findings of responsibility.
Three components of the method are presented as candidate contributions. The first is a source-tiering discipline in which every load-bearing claim resolves to an externally published source carrying a graded reliability marker, with a published rule for resolving internal disagreement. The second is a refusal record: an append-only public register of requests the archive declined, the ground on which each was declined, and the internal rule invoked. The third is a participation ledger in which recognised standing cannot be acquired with money, and in which that constraint is enforced by the absence of any schema path between financial records and standing records rather than by policy statement.
The paper also states what the archive is not. It is not accredited by any standards body. It has no formal standing before any court, treaty body, or United Nations mechanism. Its governance is materially incomplete: of the seats defined by its own published structure, one is occupied and the remainder are vacant. It is operated substantially by its founder, which is a structural limitation the method attempts to mitigate but does not remove. These facts are stated here rather than in a concluding note because they bound every claim that follows.
Section 2 sets out the problem class. Section 3 situates the work against prior art. Section 4 states the design principles. Sections 5 to 8 set out the four method components in operational detail. Section 9 states limitations and threats to validity. Section 10 addresses reproducibility and reuse by other groups. A glossary of project-specific terms appears at Section 11, and references at Section 12.
Throughout, a distinction is maintained between stated-current claims (what the system does at the stated date) and stated-target claims (what it is committed to doing but does not yet do). No claim is made in a form that blurs the two. Where a figure is given, the date on which it was read is given with it.
2. Problem statement
2.1 The problem class
Where a state is alleged to have committed serious violations against a population within its own territory, and where no domestic accountability process has produced findings accepted by the affected population, a documentary record is typically assembled by parties other than that state. Those parties include United Nations mechanisms, international non-governmental organisations, domestic civil society where it can operate, academic researchers, journalists, and diaspora organisations formed by people displaced from the territory.
Diaspora organisations occupy a distinctive and structurally difficult position in this ecology. They frequently have the strongest motivation, substantial language capability, direct familial connection to events, and durable institutional continuity in jurisdictions where they cannot be shut down by the state under scrutiny. They also carry four disabilities that are well documented in the literature on long-distance nationalism and diaspora politics, and that recur with enough regularity to be treated as structural rather than incidental.
2.2 The mandate problem
A diaspora body cannot be elected by the population it invokes. Its members are, by definition, not resident in the territory, and the resident population has no mechanism by which to authorise or withdraw authorisation. A body that nonetheless claims to speak for that population makes a claim that cannot be verified, cannot be renewed, and cannot survive a competing claim by a rival body constituted on the same basis. The historical result, across multiple diasporas, is a proliferation of bodies each asserting representativeness, none able to establish it, and an external audience that discounts all of them.
The mandate problem is not solved by internal democratic procedure. A body may run scrupulously fair elections among its own members and still be unable to establish that its members' consent extends to non-members. The problem is one of scope, not of procedural quality.
2.3 The duplication problem
Serious documentation capacity already exists. In the case addressed by this archive, the relevant bodies include the Office of the United Nations High Commissioner for Human Rights and its 2015 comprehensive investigation, the 2011 Panel of Experts report, and specialist organisations holding survivor testimony under professional protocols. Where a diaspora body produces parallel counts, parallel testimony collections, and parallel findings, it adds volume without adding reliability, and it creates the specific hazard of an assertion appearing in two places and being read as two independent confirmations of the same fact.
Duplication also imposes a hidden cost on the mechanisms it intends to help. An investigator receiving overlapping submissions from multiple non-state bodies must expend effort establishing whether accounts are independent before they can be weighed. Poorly sourced volume is worse than silence.
2.4 The intake problem
Collecting first-person testimony from survivors of serious violations imposes obligations that most volunteer-operated bodies cannot discharge. These include trauma-informed interviewing, informed consent that survives changes of political circumstance, secure storage against state adversaries with signals capability, retention and deletion policy, data protection compliance in every jurisdiction touched, and a duty of care that persists after the interview.
Failure is not merely a compliance matter. Testimony collected without adequate protocol can expose named individuals and their relatives in the territory to reprisal, and can contaminate the same account for later use by a body that could have handled it properly. An organisation that cannot meet the standard, and collects anyway, produces net harm.
2.5 The capture problem
Documentation bodies accumulate two assets that attract capture: a record that carries reputational weight, and a membership that carries political weight. Three capture vectors recur.
Financial capture. A donor conditions support on influence over governance or output. Where influence and money share any channel, the body's independence is unverifiable from outside.
Founder capture. A body built by one person retains dependency on that person: they hold the credentials, the relationships, the institutional memory, and often the assets. The body cannot outlive them, cannot correct them, and cannot demonstrate to an external reader that it would survive their compromise.
Political capture. A party or faction seeks to associate the record with its own claim, converting an evidentiary asset into a partisan one and destroying its value to any process that must be seen to be neutral.
Each vector is normally addressed with a policy statement. Policy statements are unfalsifiable from outside: a reader cannot distinguish a body that has not been captured from one that has been captured and says otherwise.
2.6 The specific instance
The archive described here was constituted to operate under all four constraints simultaneously, on the working hypothesis that a body which refuses representation, refuses duplication, refuses intake, and makes capture structurally checkable retains a narrow but genuinely useful function: maintaining a verified, versioned, method-documented reference layer over externally published material, which other actors can use without having to trust its operator.
The remainder of the paper describes how that hypothesis was operationalised, and where it remains untested.
3. Prior art
The approach is not novel as a category. It is an application of a known category to a corpus where it has not previously been applied in this form. Five bodies of prior work are load-bearing.
3.1 Archive without mandate: the Documentation Center of Cambodia
The Documentation Center of Cambodia, established in 1995 initially as a field office of a Yale University programme and independent from 1997, assembled a large documentary corpus on the Democratic Kampuchea period. It was not created by the Cambodian state, held no mandate from the Cambodian population, and was not constituted by any treaty. Its material subsequently entered the case files of the Extraordinary Chambers in the Courts of Cambodia.
The instructive feature is the sequence. Authority did not precede the archive; it followed from it. The Center became load-bearing because a later formal process could not do its own work without the material, and the question of who had authorised the Center never became dispositive. The present method treats this sequence as its operating model rather than as an aspiration.
3.2 Standards without a state: the Yogyakarta Principles
The Yogyakarta Principles, adopted in 2006 by a group of human rights specialists meeting in Indonesia and supplemented in 2017, were authored by no state and created by no treaty. They are cited by national courts, treaty bodies, and national human rights institutions.
Three properties enabled this: the drafting group had recognised expertise, the text applied existing law rather than asserting new law, and the method of derivation was published so that a reader could check each principle against its legal source. The document did not ask to be believed. It asked to be checked. That property — an authority that accrues to checkability rather than to standing — is the second premise of this method.
3.3 Digital verification practice: Mnemonic and open-source investigation
Mnemonic, and its Syrian Archive project, established working practice for preservation and verification of open-source material relating to armed conflict: hashing at acquisition, retention of provenance metadata, documented verification steps, and clear separation between what has been verified and what has merely been collected. Parallel methodological development in open-source investigation, including the Berkeley Protocol on Digital Open Source Investigations published with the Office of the United Nations High Commissioner for Human Rights in 2020, established the standard against which such work is now assessed.
The present method borrows the principle that verification status must be a published property of each item, not an aggregate assurance about the collection.
3.4 Professional testimony handling: specialist accountability projects
Organisations including the International Truth and Justice Project and People for Equality and Relief in Lanka hold survivor testimony concerning the same conflict under professional protocols. Their existence is the reason the present archive does not collect testimony. Where an approach is received that would constitute intake, the method requires referral to a body that operates such protocols, and requires that the refusal be recorded.
This is a deliberate scope restriction, not a capability gap presented as a virtue. It is recorded as a limitation at Section 9.
3.5 Records management as a discipline
The archival and records-management literature, and in particular the management-system standards for records (ISO 30300 series) and for information security (ISO/IEC 27001), supply the vocabulary in which this method is expressed: appraisal, provenance, fixity, retention, authenticity, and auditability.
The archive is not certified against these standards and does not claim alignment with them as a certified property. Where the method borrows a concept, the borrowing is stated so that a reader can assess the distance between the practice described and the standard from which the concept comes. Closing that distance through external assessment is a stated-target item, not a stated-current one.
4. Design principles
Five principles govern the method. Each is stated with the failure mode it addresses.
4.1 Consent governs inward; citation governs outward
The body maintains two distinct relationships and does not permit them to merge. Toward people who have voluntarily joined it and accepted its charter, it operates as a membership association with internal governance and internal obligations. Toward states, courts, treaty bodies, parliaments, journalists, and researchers, it makes a single class of claim: that the record is accurate, and that the method by which it can be checked is published.
The operative rule is that membership never converts into mandate. Growth in the number of consenting members is never reported as growth in authority to speak for non-members. This addresses the mandate problem (2.2) by declining the claim rather than attempting to substantiate it.
4.2 Restraint is recorded as evidence
Where the body declines to do something it was asked to do, the refusal is recorded and published with the ground on which it was declined. This addresses the capture problem (2.5) by converting an unfalsifiable negative ("we have not been captured") into a positive, dated, inspectable series of instances in which capture was attempted and declined.
The mechanism and its limits are detailed at Section 6.
4.3 Constraints are enforced structurally where possible
Where a constraint can be enforced by the structure of the system rather than by a rule that an operator must follow, it is enforced structurally. The governing example is the separation between financial records and standing records, where the constraint is realised as the absence of any field or join path capable of expressing money in the standing ledger (Section 7).
The principle is that a constraint an operator could violate and conceal is weaker than one the operator would have to publicly alter the system to violate. This is a difference in evidential quality, not an absolute guarantee; the limits are stated at 9.4.
4.4 Two-layer status reporting
Every substantive published statement about the body's own operations carries two layers: what is true at the stated date, and what the body is committed to achieving. The layers are visually and typographically distinct on every surface where they appear, and never merged into a single narrative.
This is a claim-hygiene device. Its function is to make it structurally awkward to present an intention as an achievement, which is the most common failure mode in self-description by advocacy bodies. Where a capability does not yet exist, the current layer reads as an explicit negative rather than as silence.
4.5 Zero is published as zero
Where a counter would read zero, zero is displayed, with the period to which it applies. Counters are read from the underlying records at request time; no figure is entered by hand into a display surface.
The failure mode addressed is the placeholder that becomes a claim. A body that shows nothing where it has nothing is checkable; a body that shows an aspirational number is not.
5. Method: source tiering
5.1 Purpose
Every load-bearing factual claim published by the archive must resolve to an identified source that exists outside the archive. The tiering discipline provides the identifier, the reliability grade, and the resolution path.
5.2 The register
Sources are held in a static, version-controlled register that ships with the published application rather than in a mutable database. Three properties follow from that decision, and each was the reason for it. Register state is diffable in version control, so any change to a source entry appears as a reviewable change. Resolution works without a network round trip, so a reader working from an offline copy can still resolve an identifier. And the register cannot be altered by any runtime process, which removes a class of silent mutation.
Each entry carries a stable identifier, title, author, publisher, primary URL, an optional archival snapshot URL, a reliability tier, the list of publications within the archive that reference it, and a short editorial note stating what the source is being used to support.
Identifiers are append-only. An entry, once published, is never repurposed. A source that is superseded gains a new entry and the old entry is annotated; it is not overwritten. This preserves the resolvability of any identifier appearing in a document already distributed.
As of era-day 580 the register holds 716 entries: 615 at Tier A, 74 at Tier B, and 27 at Tier C.
5.3 Tier definitions
Tier A. Peer-reviewed scholarship, primary archival record, or institutional record of a body with a mandate and a published methodology. This includes United Nations reports, official inquiry records, court records, government publications, and articles in peer-reviewed journals. A Tier A source may be wrong; the tier records the class of the source and the accountability attaching to its production, not the truth of its contents.
Tier B. Strong secondary material: professional journalism from an outlet with an editorial correction process, memoir, contested account by a participant, and reporting by established non-governmental organisations that does not meet the institutional-record test.
Tier C. Open question. The claim is recorded because it is in circulation and material, but no adequate source survives, or the available sources conflict irreconcilably. A Tier C entry is a declaration of an evidentiary gap, not a weak assertion.
5.4 Assignment procedure
Tier assignment is a property of the source, not of the claim it is used to support, and not of whether the claim is convenient. Assignment proceeds in four steps.
First, the source is classified by production accountability: who produced it, under what mandate, subject to what correction process. Second, the primary URL is recorded and, where possible, an archival snapshot is captured and recorded alongside it, so that link rot does not silently degrade the register. Third, an editorial note is written stating specifically what the source is being used to support; a source adequate for one proposition is frequently inadequate for a stronger one, and the note records which proposition is in scope. Fourth, the entry is committed to version control with the publication that first references it.
5.5 The disagreement rule
Where two reviewers disagree on a tier assignment, the lower grade is published and the disagreement is recorded in the entry. The difference is not split, and the disagreement is not resolved privately in favour of the higher grade.
The rule exists because the opposite convention — resolving upward, or resolving silently — produces a register whose grades drift toward the most permissive reviewer over time, with no external signal that drift has occurred.
5.6 Re-derivation by a reader
The discipline is only worth its cost if a reader can independently reconstruct any claim. The resolution path is: the claim carries an identifier; the identifier resolves to a register entry through a public resolver; the entry gives the primary source, its snapshot, its tier, and the editorial note stating what it was used for; the reader consults the external source directly and forms their own view.
The archive is not an intermediate authority in this chain. Its function is to make the chain short and to keep it from breaking.
5.7 Constraints on derived assertion
Three constraints follow from the duplication problem (2.3) and are enforced editorially across all publications.
The archive publishes no aggregate human-cost figure of its own. Where a figure is required, the figure published by an external body is quoted with attribution and date. The archive does not sum, average, or reconcile figures across sources.
The archive publishes no finding of individual responsibility. Named individuals appear only where a Tier A body has already published the name in the relevant capacity — for example in an indictment, a court record, or an official inquiry finding — and the naming is presented as a report of that body's act, not as the archive's own conclusion.
The archive publishes no assertion derived from first-person material it holds, because it holds none (Section 6.3).
6. Method: refusal recording
6.1 The claim
This is the component the paper advances most strongly, and the one on which criticism would be most useful.
Institutions are assessed on what they do. They are feared, and restricted, on what they could do. A documentation body operating in diaspora, holding a record with reputational weight and a membership with political weight, is a legitimate object of concern to states, regulators, banks, and payment providers. That concern attaches to capability, and capability cannot be disproved by assertion.
A dated, append-only, public register of specific requests the body declined, each with the ground and the rule invoked, converts an unfalsifiable negative into a positive evidentiary series. Its value lies in three properties: it is specific rather than general, it is dated, and critically, it is published before the accusation to which it is responsive exists.
6.2 Why prospective publication differs from retrospective denial
A denial issued after an allegation is evidence of the denial and nothing more. It is produced under the incentive created by the allegation, and a reasonable assessor discounts it accordingly.
A refusal record entered before any allegation exists was produced under a different incentive structure. It documents an act of restraint at a time when there was no external pressure to perform restraint, and — because the record is append-only and the ledger is public — the body cannot retrospectively insert an entry without the insertion being visible as a later addition.
This is the same logic that gives contemporaneous records their weight in evidential contexts generally. The refusal ledger is an attempt to generate contemporaneous records of institutional conduct on purpose, rather than relying on such records existing by accident.
6.3 Categories of refusal
Five categories are currently in operation, corresponding to the five published entries. Each has a defined rule reference in the body's internal law.
Identity disclosure. Requests for the identity of a person who submitted a record to the archive. Ground: identities are sealed; no exception exists for press interest.
Purchase of standing. Offers of financial support conditional on a governance or advisory position. Ground: standing cannot be purchased; the system's financial instrument cannot acquire its standing instrument (Section 7).
Partisan association. Requests by an electoral actor to co-brand or jointly issue material. Ground: the archive does not lend its record to any electoral actor.
Location disclosure. Requests for raw geolocation of sites in the territory referenced in published material. Ground: coordinates are sealed to prevent targeting of people present at those sites.
Participation-data licensing. Requests to license participation records for commercial modelling. Ground: participation records are never sold, licensed, or transferred.
A sixth standing category governs intake: any approach that would constitute collection of first-person testimony is declined and referred to a body operating professional protocols. Referral targets are published on the relevant operational surfaces alongside emergency contact routes in the operating jurisdiction.
6.4 Entry structure and trigger
Each entry records the day on which the decision was taken, expressed on the archive's internal day count; the class of requester, recorded categorically and never by name; a summary of what was requested; the ground on which it was declined; the internal rule invoked; the outcome; and a publication flag.
Requesters are recorded by class rather than identity. Naming a requester would convert the ledger from an accountability instrument for the archive into an exposure instrument aimed at third parties, which is a different and unauthorised function.
An entry is triggered whenever a request is declined on a ground that engages a published rule. Requests declined for ordinary operational reasons — capacity, scope, timing — do not generate entries, because including them would dilute the series and make it unreadable.
As of era-day 580 the ledger holds five published entries, all recorded on era-day 580. This is the ledger's principal current weakness and is addressed at 9.5.
6.5 Append-only guarantee
The ledger is public-read. Write access is restricted to the service role; no client credential can insert, update, or delete a row. Entries are not edited after publication. Where an entry requires correction, a subsequent entry is added referencing the earlier one.
The guarantee is a property of the access configuration and of stated practice. It is not, at present, cryptographically anchored: a reader cannot yet verify from outside that no row was removed. Periodic hashing of the ledger state with external anchoring is a stated-target item.
6.6 What the mechanism cannot do
The ledger records refusals that occurred. It cannot demonstrate that all refusals were recorded, and it cannot demonstrate that no request was accepted that should have been refused. This is an instance of the general problem that negatives are unverifiable, and it is not solved by the mechanism — only narrowed.
Two partial mitigations are available and neither is yet in place. An external reviewer with access to the request stream could periodically attest to completeness. And an anchored hash chain would establish that the published series has not been edited. Both are stated-target.
The honest formulation is: the ledger raises the cost of undisclosed capture and creates a record that would be inconsistent with a later denial. It does not establish that capture has not occurred.
7. Method: non-purchasable standing
7.1 Purpose
Internal recognition within the body is tracked in a participation ledger. The governing constraint is that recognition cannot be acquired with money. The component is presented here as a general anti-capture pattern rather than as a feature of one system.
7.2 Structural rather than declarative enforcement
The constraint is realised in four ways, none of which is a policy statement.
No expressible field. The event table in which participation is recorded contains no monetary column. There is no field of any type capable of holding a currency amount, and no field whose semantics are financial. A payment cannot be recorded as a participation event because the record has nowhere to put it.
No join path. No table in the participation subsystem shares a key, foreign key, or join path with any financial table. The two subsystems cannot be joined without a schema change, and a schema change is a reviewable, public alteration to the system.
No client write. Participation events are written only through a security-definer database function that validates the qualifying act. Client credentials cannot insert events directly. A member cannot mint their own recognition, and neither can an operator acting through the client surface.
Time gating above a threshold. Above a defined rung, advancement requires a minimum elapsed period since the member's first recorded event, independent of accumulated points. Elapsed time is the one input that cannot be purchased, delegated, or accelerated.
7.3 Structure of the ladder
Recognition is expressed as ten rungs across six tracks. The tracks correspond to distinct classes of contribution: reading and demonstrated comprehension of the record; labour given to the archive such as translation and transcription correction; work that keeps the archive legible, mirrored, and survivable offline; participation in the internal bodies where decisions are recorded; verification work relied upon by others; and long-horizon contribution.
The rungs divide into three regimes.
Rungs one to four are effort-earned, with cumulative point thresholds and no time gate. Rungs five to seven add elapsed-time gates of twelve, twenty-six, and fifty-two internal weeks respectively, in addition to point thresholds. Rungs eight to ten cannot be earned at all: they are conferred by a holder of a senior rung, carry escalating elapsed-time minimums, and are unreachable by accumulation of points regardless of volume.
The three regimes address three distinct capture routes. Point thresholds alone are defeated by volume. Time gates defeat volume but not coordination. Human conferral introduces a judgement that cannot be automated against, at the cost of introducing the discretion problem discussed at 9.6.
7.4 Exclusion of atrocity work from recognition
Certain areas of the archive's work emit no recognition points at all. These are the areas concerning mass graves, gendered violence, enforced disappearances, and the death of a named child in custody.
The exclusion is deliberate and is published on the relevant surfaces. Its rationale is that attaching an advancement incentive to work on material of this kind creates pressure toward volume, toward premature publication, and toward competitive engagement with material where all three are harmful. The cost of the exclusion is that the archive's most demanding work is also its least recognised, which is accepted.
7.5 The pattern, stated generally
Where an institution wishes to guarantee that one asset cannot acquire another — money cannot acquire governance weight, volume cannot acquire editorial authority — the guarantee is stronger when the acquisition is inexpressible in the data model than when it is prohibited by rule.
The general form is: identify the two assets; place them in subsystems with no shared identifier; ensure neither subsystem contains a field capable of expressing the other; route all writes to the protected subsystem through validated server-side functions; and gate the highest tiers on an input that cannot be transacted, such as elapsed time or third-party conferral.
The pattern is portable. Its principal limitation is that it constrains the recorded system and not the world: an off-ledger arrangement remains possible (9.4).
8. Method: continuity and custody
8.1 Purpose
The founder-capture vector (2.5) is addressed by two mechanisms: a public change record, and a published custody position that a reader can check rather than accept.
8.2 Change record
Substantive changes to the body's published position are recorded in an append-only change log with the internal day count. Entries are not edited after publication; corrections are issued as later entries referencing earlier ones.
The purpose is to make position drift visible. A body that quietly amends its stated position is difficult to hold to any position. A body whose amendments are enumerated can be assessed on the pattern of its amendments, which is a stronger form of accountability than consistency claimed in the present tense.
8.3 Custody position
The published position is that the founder holds no assets of the body and no sole credentials over its critical systems, and occupies the lowest structural position compatible with operating it.
The mechanisms stated in support are: incorporation as a community interest company subject to the statutory asset lock, which constrains distribution of assets independently of any internal undertaking; distribution of custody over critical credentials across multiple holders and jurisdictions, such that no single holder can act alone; and publication of the custody arrangement itself, so that a departure from it would require either a public amendment or a concealment.
8.4 What a reader can check, and what they cannot
A reader can independently verify the corporate form, the company number, the registered office, the incorporation date, the directors, and the statutory asset lock, all from the public register maintained by the registrar of companies in England and Wales. A reader can verify that the custody doctrine is published and can read what it commits to.
A reader cannot currently verify, from outside, that the distributed custody arrangement is operating as described. Verification of that depends on external attestation, which does not exist at the stated date. This is a material gap and is recorded at 9.3.
8.5 Governance completeness, stated plainly
Of the seats defined in the body's published governance structure, the founder occupies the governance seat. The four publicly recruited senior seats are vacant, and all five hundred assembly seats are vacant.
The gap between published structure and occupied structure is stated on the body's own surfaces and is stated here. A governance structure that exists on paper is a commitment, not a control. The controls currently operating are the corporate form, the asset lock, the published record, and the refusal ledger — not the internal governance bodies, which are not yet constituted.
9. Limitations and threats to validity
This section is intended to be the most useful part of the paper. Each limitation is stated with its mitigation, or with an explicit statement that no mitigation is in place.
9.1 Researcher as founder; self-audit circularity
The method is described by the person who designed and operates the system it describes. The self-audit surfaces are built, populated, and maintained by the same party they are intended to hold to account. No amount of internal rigour resolves this: the account of the auditor is given by the auditor.
Mitigations in place: externally verifiable facts are used wherever a claim can be anchored outside the body — corporate registry data, external source URLs, archival snapshots. Internal figures are read from underlying records at request time rather than asserted. The refusal ledger and change log are append-only and public.
Not mitigated: no external party currently attests to any internal claim. Until one does, every internal-state claim in this paper rests on the operator's word plus the difficulty of concealing a contradiction across public surfaces. A reader should weight it accordingly.
9.2 No external accreditation
The body is not certified against any records-management or information-security standard, is not accredited by any accreditation body, and has no formal standing before any court, treaty body, or United Nations mechanism.
Mitigation: the paper states this rather than implying alignment. Certification readiness is a stated-target item with no completion date.
9.3 Custody arrangement not externally attested
As stated at 8.4, the distributed-custody claim cannot be verified from outside.
Mitigation: the corporate asset lock is externally verifiable and constrains the most consequential class of abuse independently of the custody arrangement.
Not mitigated: the credential-distribution claim itself. Independent attestation, or a published rehearsal of a continuity handover observed by a third party, would close this. Neither has occurred.
9.4 Structural enforcement constrains the system, not the world
The schema-level separation described at Section 7 guarantees that a payment cannot be recorded as recognition within the system. It does not prevent an arrangement conducted entirely outside the system in which money changes hands and recognition is subsequently conferred through a legitimate-looking path.
Mitigation: conferral above rung seven is attributable to a named conferring party and recorded; the refusal ledger records attempts of this kind that reach the body as explicit offers.
Not mitigated: an arrangement that is never expressed as an offer and never recorded. The claim is bounded to: money cannot buy standing through the system, and attempts to buy it that reach the body are recorded.
9.5 The refusal ledger is young and thin
Five entries, all recorded on a single day, is a seed rather than a series. A ledger of this size demonstrates the mechanism but does not yet demonstrate a practice, and its evidentiary value grows only with elapsed time and accumulated entries under varied conditions.
Mitigation: the entry structure, trigger rule, and access configuration are fixed and published now, so that later entries are governed by rules that predate them.
Not mitigated: time. This limitation resolves only by continuing to operate.
9.6 Human conferral reintroduces discretion
Gating the top rungs on conferral defeats accumulation-based capture but introduces discretionary power in the conferring party, which is the oldest failure mode in institutional design.
Mitigation: conferrals are attributable and recorded; conferral capacity is itself gated on elapsed time.
Not mitigated: no appeal body currently exists, because the governance seats that would constitute one are vacant (8.5). The published disciplinary procedure specifies complaint, independent review, right of response, logged decision, and time-bounded appeal; the review quorum it presumes is not yet seated. This is a commitment, not an operating control.
9.7 Selection bias in the source base
The register reflects what is available in English and Tamil, published online, and retrievable by the operator. Material in Sinhala, material in physical archives in the territory, and material held by parties who do not publish is systematically under-represented. Tier A availability is also uneven across subject areas: some fronts have extensive United Nations coverage, others have almost none, and the register's tier distribution reflects coverage rather than importance.
Mitigation: the Tier C category exists precisely to record where a material question has no adequate source, so that gaps appear as entries rather than as silence.
Not mitigated: the underlying asymmetry.
9.8 Scope restriction as a limitation
The decision not to collect testimony (3.4, 6.3) is presented in this paper as prudent. It is also a limitation: the archive cannot surface material that has not already been published by someone else, and is therefore structurally incapable of originating a finding. It is a reference layer over other people's work. That is the intended function, but it should not be mistaken for comprehensiveness.
9.9 Single-jurisdiction incorporation
The body is incorporated in one jurisdiction. Regulatory, banking, or hosting action in that jurisdiction would affect the whole institution. Distribution of custody across jurisdictions partially addresses the credential risk but not the corporate risk.
Not mitigated at the corporate level.
9.10 Register format trade-off
Holding the source register as a version-controlled static file gives diffability and offline resolution (5.2) at the cost of requiring a deployment to add or amend an entry. This slows correction. The trade-off was made deliberately in favour of tamper-evidence over speed, and is recorded here so that a reader adopting the method can make the opposite choice knowingly.
10. Reproducibility and reuse
10.1 What is portable
Four components transfer to any contested-documentation context with no dependence on this corpus.
The tiering discipline — a version-controlled register of externally published sources with stable append-only identifiers, graded by production accountability, resolved through a public resolver, with a published lower-grade-wins disagreement rule.
The refusal record — an append-only public register of declined requests with class-not-identity requester recording, ground, rule reference, and date, published prospectively.
The non-purchasable standing pattern — the five-step general form stated at 7.5.
The two-layer reporting convention — a typographic and editorial discipline separating stated-current from stated-target on every self-descriptive surface.
10.2 What is corpus-specific
The tier boundaries as drawn here reflect the source ecology of this particular conflict, in which a small number of United Nations investigations dominate the Tier A population. A corpus with a different ecology — a domestic conflict with extensive court records, for example — would need different boundaries.
The refusal categories reflect the specific pressures this body has encountered. Another body would derive its own from its own experience, and should not adopt these.
The exclusion of specific subject areas from recognition (7.4) reflects a judgement about which material is harmed by incentive pressure in this context.
10.3 Adoption sequence
For a group adopting the method, the recommended order is: establish the tiering register and resolver before publishing any substantive claim, so that no unsourced claim is ever in circulation; establish the refusal ledger before the body has anything worth capturing, so that early entries predate any pressure; establish the two-layer convention at the first self-descriptive page, because retrofitting it requires rewriting everything; and defer the standing ledger until there is a membership, since the pattern is a constraint on growth rather than a driver of it.
10.4 Cost
The method's cost is dominated by tiering. Each substantive publication requires source identification, snapshot capture, editorial note drafting, and register commitment for every load-bearing claim. In practice this exceeds the cost of drafting. A group without capacity for that overhead should not adopt the tiering discipline partially: a register that covers some claims and not others is worse than none, because it implies coverage it does not have.
10.5 Citation of this paper
Suggested form:
TLTE C.I.C. (Aarambam era). A Method for Non-State Documentation of Contested Atrocity: source tiering, refusal recording, and non-purchasable standing in a diaspora-operated archive. Working paper v1.0, era-day 580. docs.tlte.cloud/standard/method
Corrections and challenges to any factual statement in this paper are sought. A challenge that identifies an unstated limitation is of more value to this method than agreement with it.
11. Glossary
Project-specific terms are glossed once here and used sparingly in the body of the paper.
| Term | Plain-English meaning |
|---|---|
| Aarambam (ஆரம்பம்) | The body's designation for its current founding period. Used as a status marker, not a date. |
| Nilaiththanmai (நிலைத்தன்மை) | The body's designation for its stated-target end state. |
| Era-day | An integer day count from the body's founding epoch, used instead of calendar dates on internal records. Era-day 580 corresponds to 2 August 2026. |
| Era-week | Seven era-days. Used for elapsed-time gates in the standing ladder. |
| Two-layer | The convention of publishing stated-current and stated-target status side by side (4.4). |
| Refusal ledger | The append-only public register of declined requests (Section 6). |
| Standing ledger | The participation record in which recognition is tracked (Section 7). |
| Tier A / B / C | Source reliability grades defined at 5.3. |
| Conferral | Award of a top-three rung by a holder of a senior rung; not earnable by accumulation (7.3). |
| CIC | Community Interest Company: a UK corporate form carrying a statutory asset lock. |
12. References
Berkeley Protocol on Digital Open Source Investigations. Human Rights Center, UC Berkeley School of Law, and Office of the United Nations High Commissioner for Human Rights, 2020.
Documentation Center of Cambodia. Institutional history and archival holdings. dccam.org
Extraordinary Chambers in the Courts of Cambodia. Case file records.
International Organization for Standardization. ISO 30300 series, Information and documentation — Records management.
International Organization for Standardization / International Electrotechnical Commission. ISO/IEC 27001, Information security management systems — Requirements.
International Truth and Justice Project. Published methodology and reports. itjpsl.com
Mnemonic / Syrian Archive. Verification and preservation methodology. mnemonic.org
Office of the United Nations High Commissioner for Human Rights. Report of the OHCHR Investigation on Sri Lanka (OISL), A/HRC/30/CRP.2, 2015.
People for Equality and Relief in Lanka. Published research and submissions. pearlaction.org
Report of the Secretary-General's Panel of Experts on Accountability in Sri Lanka. United Nations, 2011.
The Yogyakarta Principles on the Application of International Human Rights Law in relation to Sexual Orientation and Gender Identity, 2006; Yogyakarta Principles plus 10, 2017.
UK Companies House. TLTE C.I.C., company number 16426152.
End of working paper v1.0. Figures stated as of era-day 580. This document is superseded by any later version bearing a higher version number; earlier versions remain resolvable.