# REPORT: Phylomemetics of the Enron corpus — where candidate deceptive/fraud-related ideas originated and how they spread

## 0. Bottom line (corpus-grounded, confidence-labeled)

Ten operationally defined idea families (F1, F2, F3, F4, F5a–F5e, F6) were tracked (not raw fraud-keyword hits).
None of the evidence below proves fraud by any named individual; it proves that
particular wordings moved between particular mailboxes at particular times, with
stated uncertainty. The strongest transmission structures are:

1. **F3 — FERC California-gas talking-points draft chain (Dec 12, 2000; 48 rows / 12 texts).**
   Earliest supported: Mary Hain's relay `dasovich-j/all_documents/4589.`
   (`<5148670.1075843071886.JavaMail.evans@thyme>`, 2000-12-12 09:58 UTC) carrying
   Leslie Lawner's 11:56 AM draft for FERC Chair Hoecker. Spread same-day through
   Nicolay → Shapiro ("delete point #3 … conjecture about market manipulation",
   `allen-p/all_documents/40.`) → Nicolay relay → Allen ("need some touch up … why
   … give our commentary on why prices are so high", `allen-p/_sent_mail/50.`).
   Confidence in the relay order: **high**. Confidence about what point #3 would
   have told FERC: **low** — the draft's enumerated points are not preserved in
   any corpus message. Moderate-confidence reading: advocacy self-censorship, not
   knowing deception (see §4/F3).
2. **F4 — California Action Update / S-T buying bridge (Jan 15, 2001; 10 rows / 2 texts).**
   Earliest supported: James Steffes memo `kean-s/all_documents/6280.`
   (`<23985935.1075847647288.JavaMail.evans@thyme>`, 2001-01-15 11:36 UTC) — "key
   issue … S-T buying needs", DWR as vehicle, $3.2B shortfall, "L-T CONTRACTS STOP
   THE BLEEDING", bankruptcy framing — relayed by Phillip Allen to the trading
   side (`allen-p/_sent_mail/563.`). A 2-exemplar cascade: 1 cluster at every
   threshold, adjacent cosine 0.814. Confidence: **moderate-high** on order;
   wider circulation outside these custodians is unobserved.
3. **F5a–F5e — LJM disclosure / CFO / preservation / restatement cascade
   (Oct 22 – Nov 29, 2001).** Five linked leadership notices with exact roots:
   Lay Oct-22 all-employee notice (`allen-p/deleted_items/109.`, 90 copies),
   Lay Oct-24 McMahon-named-CFO notice (`allen-p/deleted_items/197.`, 103 copies,
   "fundamentals of our business are strong"), Derrick Oct-25/26 preservation
   order (`allen-p/deleted_items/213.`, 101 copies + Derrick's own Oct-27 relay
   chain), Lay Nov-8 restatement notice (`arora-h/deleted_items/196.`, 48 copies:
   $1.2B equity charge; JEDI+Chewco from Nov 1997; LJM1 subsidiary; yearly
   amounts), Derrick Nov-29 correction (`baughman-d/ect_admin/7.`, 6 copies,
   10-topic hold). Spread = broadcast + forward/relay (Derrick's five Oct-27
   self-relays; preserve-acknowledgment leaves). Confidence in notice order and
   wording descent: **high**. True authorship (counsel/IR ghostwriting):
   **unobserved/low**.
4. **F6 — Fastow private-accountability coda (Oct 24 / Nov 1, 2001).**
   Bill White → John Arnold, `arnold-j/deleted_items/454.` (Oct 24): "no way to
   explain away the underlying conflict of interest and error in judgment of the
   fastow thing" (replying inside a thread about the Lay/Whalley meeting); and
   Brad Richter, `beck-s/inbox/591.` (Nov 1): Kiodex "about as independent as
   LJM". Two exemplars, cosine 0.132, no supported parent edge — independent
   convergence on the same accountability frame, not a lineage. Confidence:
   **low-moderate** (thin by construction); value is as a counter-narrative to F5b.
5. **F1 — Raptor/Talon/Harrier SPE equity-hedge documentation workflow
   (Apr 2000 – Oct 2001).** 93 rows / 54 distinct texts / 12 clusters at 0.35 (10/12/13 at 0.25/0.35/0.50).
   Earliest supported: Paulo Issler → Kaminski/Gibner "Talon"
   (`kaminski-v/all_documents/9694.`, 2000-04-12 16:22 UTC) forwarding a
   Ryan Siurek → Trushar Patel → PwC chain about a "draft analysis" of Raptor
   economics ($72.81 share price; LJM2 25–30% IRR) with attachment `Raptor v5.ppt`
   (absent from corpus). Operational core Aug–Sep 2000: Shackleton's
   Talon/Harrier/EBS swap-confirm build (`shackleton-s/all_documents/3017.`,
   Aug 15), price-vs-total-return dispute (`…/3077.`, Aug 18), Avici/swap-deadline
   forms (Sep 1–22), Raptor 2 hedge (Oct 2–4); coda Aug–Oct 2001 (Kaminski "Raptor
   Update", Sep-21 "unwind tax accounting" reversing a "$710 million book loss",
   Oct-24 LLC cancellations). Adjacent-cosine 0.415, p≈0.005 vs date-shuffle;
   34/53 supported edges direct-candidate, p≈0.005 vs sender-shuffle.
   Confidence in the *paperwork lineage*: **moderate**. Fraud characterization:
   **not established by email text** — routine deal correspondence; economics live
   in missing attachments; no participant is accused here.
6. **F2 — Mahonia/Stoneville/Chase prepay deal documentation
   (Jul 2000 – Mar 2001).** 170 rows / 72 texts / 24 clusters at 0.35 (19/24/26). Earliest supported:
   Mark Taylor → Teresa Bushman (`taylor-m/all_documents/2713.`, 2000-07-24)
   quoting Davis Thames's "Mahonia Prepay Restructuring" (collateral post +
   rehypothecation instead of fast-track restructuring); then Prepaid Contracts
   (Oct 11–16, Lawson/Jones/Shackleton), Mahonia rehypothecation (Nov 10–20,
   Ghosh/Lebrocq), Chase Prepay + Dec-2000 Mahonia forward-sale drafts (Dec 12,
   Garberding/Bushman), Stoneville margin threads (Jan 2001). Adjacent-cosine
   0.291, p≈0.005; 50/71 supported edges direct, p≈0.005. Confidence in the
   *paperwork lineage*: **moderate**. Debt-vs-trade characterization: **not
   established** — needs deal documents outside email text.

Negative results that matter: the famous California gaming-strategy names
("Death Star", "Fat Boy", "Get Shorty", "Ricochet" as fraud strategies) do NOT
form fraud lineages in this corpus — all 47 "Death Star" rows are IT outage
reports (E10K server "deathstar") or a Star Wars cafeteria menu; "Fat Boy" hits
are a music newsletter; the Dec-2000 Forney/Perot strategy memos are absent.
"Condor" is an options spread; Talon/Harrier are swap vehicles, not birds. These
are documented as negative controls, not findings.

## 1. Scale of the full corpus (what was read, what was excluded)

- **517,401 CSV rows** (`archive.zip` → `emails.csv`, columns `file,message`);
  **0 malformed/empty rows**; all rows parsed.
- **Message-IDs: 517,401 distinct** — no two rows share a Message-ID, so naive
  MID dedup finds nothing. Duplication is instead **mailbox copies**: normalizing
  (subject+body whitespace) yields **245,426 distinct texts**; **131,548 texts**
  appear >1 time and **403,523 rows (78%)** belong to multi-copy texts (top copy:
  112 rows). All substantive claims therefore use **distinct texts**, with row
  counts reported only as copy-inflation diagnostics.
- **Dates:** 516,596 rows (99.8%) parse to 1990–2010; **805 rows** are missing or
  out-of-range (e.g., the `kean-s/all_documents/8816.` archive-log container dated
  1979-12-31, plus 2044-dated rows) and are excluded from temporal ordering but
  counted. In-range span: **1997-01-01 – 2007-02-11 UTC** (dense 1999–2002).
- **Participants:** 20,312 distinct sender addresses; top: kay.mann (16,735),
  vince.kaminski (14,368), jeff.dasovich (11,411). Recipient universe is larger
  (To/Cc harvested per message).
- **Structure:** 103,798 rows (20.1%) carry a `Forwarded by …` block; 76,144
  (14.7%) carry `-----Original Message-----`; 20,749 (4.0%) carry `>`-quoted
  lines. Forward/quote blocks are treated as **relay evidence, never as
  independent transmissions** (lineage taxa are distinct texts, not rows).
- **Sampling:** no sampling. Every stage reads the full 517,401 rows; filtering
  happens only through the published per-family operational definitions, whose
  row/text yields are listed in `results/idea_families.csv`. Nothing is hidden
  behind full-corpus language: small families (F4: 10 rows/2 texts; F6: 2 rows/2 texts) are
  small because the definition is narrow, and the report says so.

## 2. How meme/idea variants were discovered and grouped (reproducible)

1. **Seed probes (exploratory, discarded as definitions):** ~30 regex probes over
   subject+body measured the corpus vocabulary (e.g., Raptor 647 rows, LJM 818,
   Chewco 195, Mahonia 156, "talking points" 64, Skilling 6,587). This showed raw
   keyword counting is dominated by digests (`Enron Mentions`), IT noise
   ("deathstar" server), and CC-list name-stems ("jeff mcmahon" as Treasurer in
   1999 org charts) — so keyword counts were rejected as family definitions.
2. **Operational definitions (the actual method):** each family is a conjunction
   of rare-phrase regexes over subject+body (see `analysis.py:FAMILIES`), e.g. F1
   requires `\braptor\b` AND (`talon|harrier|avici|total return|price return|swap
   confirm`) while excluding `Enron Mentions` digests and preservation
   boilerplate; F3 requires the exact draft title AND a Hoecker/fourth-point
   marker; F5a–e require the distinctive notice sentences (not the generic
   "all-employee meeting", which matches 2000 routine notices). The archive-log
   container is hard-excluded by subject guard.
3. **Taxa = distinct normalized texts** (subject+body), not rows: removes the
   78%-copy inflation. Quoted/forwarded blocks stay inside their carrier text —
   they are the mutation evidence, not extra taxa.
4. **Variant clustering:** TF-IDF cosine over word tokens plus a deterministic
   force-merge on any shared rare 8-gram; cluster counts reported at thresholds
   0.25/0.35/0.50 (**sensitivity check**): F3 1/1/1, F4 1/1/1, F5a 1/1/1, F5b
   1/1/1, F5c 1/1/1, F5d 1/1/1, F5e 1/1/1, F6 2/2/2, F1 10/12/13, F2 19/24/26 —
   exactly as recomputed in `results/idea_families.csv` —
   i.e., crisis notices are single-variant broadcasts; Raptor/Mahonia are
   genuinely multi-variant workflows. Within-family adjacent (temporal) cosine vs
   200 date-shuffles, sender-link counts vs 200 sender-shuffles (seed 150645),
   and a 2,000-pair cross-family cosine control (mean ≈ 0.09) are in
   `results/idea_families.csv`.
5. **Lineage edges:** for each exemplar (temporal order), the best prior parent
   by cosine + 0.15 address-overlap + 0.10 same-thread + 0.05 forward bonuses;
   cosine < 0.20 → independent/convergent (no parent). Classes: direct-candidate
   (address overlap), relay-candidate (forward/thread), shared-source-candidate
   (text only), independent. Every edge carries a "co-presence, not causation"
   caveat in `results/transmission_edges.csv`.

## 3. Folktales-paper translation (and where the analogy breaks)

Graça da Silva & Tehrani (2016) test whether tale-type presence/absence across
50 Indo-European populations follows vertical inheritance along a language-tree
(D-statistic vs random/Brownian nulls) or horizontal spatial diffusion
(autologistic λ/θ graphs), then reconstruct ancestral states to date tales
(e.g., "Smith and the Devil" to the Bronze Age).

| Paper element | Enron analogue (this study) |
|---|---|
| Taxa (populations) | **Distinct email texts** (mailbox-copy deduped); people are carriers, not taxa |
| Traits/variants | Presence of a family's rare-phrase bundle + TF-IDF/8-gram text variant |
| Vertical descent | Forward/relay/thread copying with mutation (deadline shift, recipient-list change, point deletion, rebooking as unwind) |
| Horizontal diffusion | Broadcast (all-Enron notices), CC storms, digest republishing (`Enron Mentions`) |
| Phylogenetic signal (D) | Adjacent-temporal cosine vs date-shuffle null; link-count vs sender-shuffle null; cross-family cosine control |
| Ancestral-state / root | Earliest supported exemplar + competing-root discussion per family |
| Outgroup/rooting (Hittite) | None available — roots are "earliest supported in corpus", never absolute origins |

Breaks (load-bearing): (i) **no given tree** — the org chart is not in the
corpus, so lineages are reconstructed from time+text+address evidence, not read
off a phylogeny; (ii) **no neutral-evolution model** — email copying is
intentional, bursty, and broadcast-driven; (iii) **litigation sampling** —
custodians and holds (Oct-25/Nov-29) shape what survives; (iv) **attachments
missing** — Raptor economics (`Raptor v5.ppt`), Steffes's spreadsheet, and the
F3 enumerated points are referenced but absent, so content claims stop at the
text boundary; (v) **cc-lists ≠ readership** — receipt is not belief or action.

## 4. Family-by-family findings (origin, spread, audit trail, alternatives)

### F1 — Raptor/Talon/Harrier SPE equity-hedge workflow (93 rows / 54 texts)
- **Operational definition:** `\braptor\b` + (`talon|harrier|avici|total
  return|price return|swap confirm`), minus `Enron Mentions` digests and
  preservation boilerplate.
- **Earliest supported:** Paulo Issler → Kaminski/Gibner, "Talon",
  `kaminski-v/all_documents/9694.`, `<3422161.1075856749275.JavaMail.evans@thyme>`,
  2000-04-12 16:22 UTC: "Here is the document sent by Ryan today" → Ryan Siurek
  (04/12) → Trushar Patel (04/11) → PwC Ian D'Souza (04/04) "draft analysis …
  economics of the transaction … Enron share price … $72.81 … LJM2 distribution …
  $30m or 25% IRR … anticipated … 30% IRR" (attachment `Raptor v5.ppt`, absent).
  Confidence: **moderate** — the PwC→Patel→Siurek→Issler→Kaminski chain is
  inside one forwarded stack, but "Raptor" as a named vehicle may predate April
  (shared-source exposure outside custodians is possible; competing root:
  unobserved deal-origination discussions).
- **Spread:** Shackleton legal build: Talon/Harrier/EBS confirms
  (`shackleton-s/all_documents/3017.`, Aug 15, 2000, Sara Shackleton to
  Howard/Garland/Mordaunt/Ginty/Tiller/Vasconcellos/…); Sefton "Harrier I bank
  details" (`…/3076.`, Aug 18); price-vs-total-return dispute (`…/3077.`, Aug 18:
  "PLEASE VERIFY WHETHER THE SHARE SWAPS ARE PRICE RETURN OR TOTAL RETURN");
  Avici + Sep-22 deadlines (Cook/McKillop, Sep 1–22); Raptor 2 hedge (Oct 2–4);
  EITF 00-19 collars (Mar 16 2001); Kaminski "Raptor Update" cascade (Aug 22
  2001); unwind: "FW: Raptor unwind tax accounting" (`fischer-m/inbox/14.`,
  Oct 8 2001, "reversing the $710 million book loss") and "Cancellation of 6
  Limited Liability Companies" (Oct 24). Carriers: Cook, Shackleton, Sefton,
  McKillop, Reed, Chin, Kaminski, Baker, Fischer/Swafford. 33 direct + 1 relay +
  1 shared-source + 18 independent edges (53 supported-parent edges over 54 texts).
- **What it can/cannot establish:** establishes a dated paperwork phylogeny with
  textual mutation (price→total return, deadline escalation, unwind reversal).
  Does NOT establish fraud, knowledge, or who designed the economics — no email
  in this family states a deceptive intent, and the economics attachment is
  missing. Do not accuse correspondents: most are lawyers/ops moving
  confirmations.
- **Alternatives:** (a) single deal-team workflow (supported: address overlap,
  p_link≈0.005); (b) parallel workstreams sharing forms (supported for the 18
  independent exemplars, e.g., Avici vs CEG/RioGas hedges); (c) external counsel
  (K&E) as true root — unobserved in corpus.

### F2 — Mahonia/Stoneville/Chase prepay workflow (170 rows / 72 texts)
- **Earliest supported:** Mark Taylor → Teresa Bushman,
  `taylor-m/all_documents/2713.`, `<713273.1075859943135.JavaMail.evans@thyme>`,
  2000-07-24: "Mahonia Prepay Restructuring" quoting Davis Thames (07/19):
  post collateral under existing deals + Chase/Teresa credit-annex addendum for
  rehypothecation; "fast-track restructuring will not be needed at this time".
  Confidence: **moderate** (single-thread root; earlier Chase/Mahonia deals may
  predate the corpus window).
- **Spread:** Prepaid Contracts cluster (Oct 11–16: Lawson/Jones/Shackleton);
  Mahonia rehypothecation (Nov 10–20: Ghosh → Lebrocq/Harris, Shackleton,
  Bushman); Chase Prepay diagram + Dec-2000 Mahonia forward-sale drafts
  (Dec 12: Garberding/Bushman); Stoneville margin/Aegean threads (Jan 2001:
  Garberding/Griffith/Ruffer); $330M Dec-28 close memo (Dec 22). 50 direct +
  2 shared-source + 19 independent edges (71 supported-parent edges over 72 texts); adjacent-cosine p≈0.005.
- **Can/cannot:** establishes the operational prepay lineage (restructure →
  rehypothecate → forward-sale drafts → margin mechanics). Whether prepays were
  accounted as debt vs trades is **outside email text** — no finding made.

### F3 — FERC talking-points draft chain (38 rows / 9 texts; 1 cluster)
- **Earliest supported:** Mary Hain → Dasovich relay,
  `dasovich-j/all_documents/4589.`, `<5148670.1075843071886.JavaMail.evans@thyme>`,
  2000-12-12 09:58 UTC, carrying the two competing roots: (A) Nicolay's Hoecker
  cover ("give Chair Hoecker talking points with any numbers that Enron
  provides … visit … before 3:00") and (B) Lawner's 11:56 AM FERC draft ("my stab
  at the talking points to be sent in to FERC along with the gas pricing info").
  Both wordings co-occur from the first exemplar — **competing roots inside one
  carrier**, so neither "originated" the idea alone.
- **Spread (same-day, 11 of 12 exemplars linked, all direct-candidate backbone):**
  Hain "fourth point" hesitation (`hain-m/_sent_mail/320.`, 10:22); Nicolay
  broadcast of the Hoecker cover (`kean-s/all_documents/2227.`, 11:56); Shapiro's
  self-censorship ("after seeing point #3 in writing, I would be extremely
  reluctant to submit. This kind of conjecture about market manipulation, coming
  from us, would only serve to fuel the fires of the naysayers — I would
  delete", `allen-p/all_documents/40.`, 12:02, also carried inside the
  `kean-s/all_documents/2228.` relay); Allen's pushback ("need some touch up …
  why … give our commentary on why prices are so high", `allen-p/_sent_mail/50.`,
  12:03); Nicolay's pro-disclosure counter ("give Chair Hoecker our spin …
  Better if it coincides with Enron's view and is not anti-market",
  `allen-p/all_documents/38.`, 12:41); Shapiro agreement (`kean-s/all_documents/2239.`,
  13:51) + Dasovich/Kean/Lawner technical thread into the evening
  (Dasovich `dasovich-j/all_documents/4613.` 14:40, Kean `…/4616.` 15:07, Lawner
  `kean-s/all_documents/2259.` + `dasovich-j/all_documents/4651.` 21:37–21:38,
  storage/"electric disconnect" language). Adjacent-cosine 0.677, p≈0.015 vs
  date-shuffle; 11 linked edges, p≈0.005 vs sender-shuffle.
- **Can/cannot:** proves an advocacy-mutation event (submit-everything →
  delete-point-#3) with named authors and timestamps. Cannot say what point #3
  asserted (enumeration absent) or what FERC received. Honest reading:
  **reputational self-censorship under regulatory scrutiny**; "knowing deception"
  requires the missing draft — explicitly not claimed.

### F4 — California Action Update (10 rows / 2 texts; 1 cluster)
- **Root:** Steffes → Kean/Shapiro/McCubbin/Dasovich/…,
  `kean-s/all_documents/6280.`, `<23985935.1075847647288.JavaMail.evans@thyme>`,
  2001-01-15 11:36 UTC (TALKING POINTS: DWR S-T vehicle, $3.2B shortfall, L-T
  contracts "STOP THE BLEEDING", bankruptcy removes Legislature authority;
  ACTION ITEMS: bankruptcy participation agreement, CDWR language, Sacramento
  team, UDC outreach, unit-update roster) → Allen relay to Grigsby/Holst
  (`allen-p/_sent_mail/563.`, Jan-16). Confidence **moderate-high** on order;
  content confidence bounded by the missing spreadsheet.
- **Note:** a Jan-13 Davis–Summers summit summary (Kean → Lay/Skilling/…,
  `allen-p/_sent_mail/564.`) travels adjacent but is a separate text — possible
  shared-source exposure, not a parent.

### F5a–e + F6 — crisis cascade and accountability coda (Oct–Nov 2001)
- **F5a (98 rows/8 texts):** Lay Oct-22 notice (`allen-p/deleted_items/109.`,
  90 copies): Q3 earnings + "media reports discussing transactions with LJM, a
  related party previously managed by our chief financial officer" + "request for
  information from the SEC regarding related party transactions" → reschedule
  leaves quoting it verbatim (ring-r, Mainzer), Beck's ENW lunch follow-up,
  Davidson videoconference notice. Root confidence **high**.
- **F5b (109/5):** Lay Oct-24 McMahon notice (`allen-p/deleted_items/197.`,
  103 copies): Fastow to leave of absence; "fundamentals of our business are
  strong" → Harris relay, Mainzer/Olson/Barrow replies. **High**.
- **F5c (118/17):** Derrick Oct-25 preservation order
  (`allen-p/deleted_items/213.`, 101 copies): PSLRA hold on LJM1/LJM2 formation,
  transactions, accounting + do-not-discuss → acknowledgment leaves (Smith,
  Lockman, Cilento) + Derrick's five Oct-27 self-relays + Rieker "REVISED after
  discussion with J. McMahon" (Glisan to brief BoD on Chewco/Whitewing/Marlin).
  **High** on order; counsel-drafted authorship unobserved.
- **F5d (49/2):** Lay Nov-8 restatement (`arora-h/deleted_items/196.`, 48
  copies): $1.2B equity charge; restate 1997–Q2-2001 (yearly deltas quoted);
  consolidate JEDI+Chewco (Nov 1997), LJM1 subsidiary; +$561–711M debt by year →
  Farmer relay. **High** on notice lineage; 8-K accuracy not verified here.
- **F5e (6/1):** Derrick Nov-29 correction (`baughman-d/ect_admin/7.`): 10-topic
  hold (LJM/Chewco voicemails+emails, Dynegy merger, savings plan, EBS/Azurix/
  NewPower statements) with routing addresses. Single-text broadcast. **High**.
- **F6 (2/2):** White→Arnold "error in judgment of the fastow thing"
  (`arnold-j/deleted_items/454.`, Oct 24) and Richter's Kiodex/LJM joke
  (`beck-s/inbox/591.`, Nov 1) — no supported edge (cosine 0.132); independent
  convergence, **low-moderate** weight, reported as the peer counter-narrative,
  not a lineage.

## 5. Nulls, sensitivity, and what would overturn the findings

- Adjacent-temporal cosine beats 200 date-shuffles for F1 (0.415, p≈0.005),
  F2 (0.291, p≈0.005), F3 (0.677, p≈0.015); F4/F5-singletons/F6 cannot beat
  shuffles by construction (n≤5 or single-variant broadcasts) — correctly
  reported as non-significant order statistics with strong text-similarity
  instead (F4 0.814, F5d 0.974).
- Link-count (direct+relay edges) beats 200 sender-shuffles for F1 (34,
  p≈0.005), F2 (50, p≈0.005), F3 (11, p≈0.005), F5a (4, p≈0.005), F5b (3,
  p≈0.005), F5c (16, p≈0.005) — address+thread structure is not chance
  co-presence.
- Cross-family cosine mean ≈ 0.09 (0.094 recomputed) vs within-family adjacent 0.29–0.97:
  families are textually disjoint (negative control passes).
- Sensitivity: cluster counts stable across 0.25/0.35/0.50 for 8 of 10 families;
  F1 (10/12/13) and F2 (19/24/26) vary only in fine splits, never in root or
  carrier claims.
- Overturn conditions: (i) production of the missing attachments/drafts (Raptor
  v5.ppt, Steffes spreadsheet, F3 enumerated points) could re-date roots or flip
  F3's characterization; (ii) non-custodian mailboxes could supply earlier roots
  (all roots are "earliest supported", never absolute); (iii) a 0.20 edge floor
  change moves only the independent/shared-source boundary, not the
  direct-candidate backbone.

## 6. Limits (must-read)

- Custodian/litigation sample; sender = mailbox author, not proven writer;
  CC ≠ readership; forwards compress multiple hands into one timestamp.
- No org chart in corpus: "spread between people" means mailbox co-presence +
  text descent, never proven face-to-face transmission.
- "Fraudulent" was tested per-message and **withheld** where text is routine
  (F1/F2), missing (F3 points), or leadership-framed (F5): the report accuses no
  person. Treat every origin/edge claim as the best-supported reconstruction
  with theAlternatives in §4, auditable in `results/evidence_messages.csv` and
  `results/transmission_edges.csv`.

## 7. Files, figures, and how to inspect a claim

- `results/idea_families.csv` — per-family definition, earliest evidence,
  confidence, reach, null statistics, caveats.
- `results/transmission_edges.csv` — every edge: parent/child dates, senders,
  subjects, Message-IDs, file paths, cosine, class, caveat.
- `results/evidence_messages.csv` — every distinct-text exemplar with role,
  copies, excerpt.
- `figures/timeline.svg` — time view: F1's long Apr-2000→Oct-2001 workflow vs
  F3's single-day burst vs F5's Oct–Nov cascade (hollow ticks = bulk/digest).
- `figures/lineage.svg` — tree view: layered best-parent forest per family
  (solid = direct/relay, dashed = shared-source; F6's pair correctly unlinked).
- Reproduce: `python3 analysis.py` (stdlib only, offline; seed 150645).