05 · Authorship theories

Metadata supports theories. It does not convict an author.

The strongest reading: a production-chain model with source material, final assembly, transmission, and a derivative discovery artifact.

These percentages are analytical weights, not measured probabilities. They summarize how currently available evidence fits competing theories. New evidence should change them.

Probability ranges

The evidence supports a layered authorship model. Four theories with estimated weight ranges:

Theory	Weight	Evidence for	Evidence against
Armes source layer + Flores final assembly	45–55%	RSID piecemeal assembly; Armes’ testimony; Flores’ “my plan” texts; Grammarly on Flores’ install	No direct proof Armes’ document was the source; Flores could have written everything
Armes precursor + Flores/unknown operationalization	25–35%	Scattered RSID clusters from different sources; intelligence language possibly from third party	No identified third party; Flores claimed authorship directly
Flores sole primary author	15–20%	DOCX metadata (Eryka Gemma); Grammarly artifacts; “my plan” texts; sending path	Short editing window (125 min); limited Word proficiency; Armes contradicts
Unknown third-party final author	5–10%	RSIDs from other documents on same machine; intelligence terminology not in Flores’ known writing	No third party identified; weakest evidential support

Key evidence for the source-layer model

Source-like structure. The text reads as a scenario exercise: objective, terrain, phases, roles, contingencies, and assignment logic. This is closer to Armes’ described precursor style than Flores’ known public writing on crypto and monetary policy.

Flores metadata and send path. The native DOCX creator field, Grammarly session data, and Telegram transfer path all place Flores near final assembly and delivery. The RSID record shows her building the document in phases, not opening a finished file.

Foreign RSIDs and mixed image sources. The DOCX contains RSIDs from other documents on the same Word installation, and image files from at least two different capture resolutions. This is consistent with companion material being incorporated.

Strongest counterarguments

A serious investigation must state rival explanations. Each of these remains plausible.

Fresh Word profile does not prove a VM

A low object counter could mean a new computer, new Office install, new user profile, or a reset environment—not a golden-image VM or any coordinated setup.

Foreign RSIDs do not prove conspiracy

They can show pasted or imported material, but that material could be the author’s own prior drafts, templates, notes, or ordinary collaborator material.

Short edit time does not prove non-authorship

Someone can prepare notes elsewhere, then quickly assemble a final DOCX. A short visible window measures this file’s edit time, not total preparation.

Travel timing weakens but does not disprove final assembly

Flores’ travel context (airport selfie, airplane mode, sleeping on a plane) complicates a sole-authorship story, but does not make final assembly impossible.

Metadata can mislead without source files

Strong claims need reproducible methodology and should stay separated from interpretive conclusions.

Authorship is a theory space, not a solved identity proof.Next: FAQ →