feat(sources): Wayback pass, automatic trimming, detention rule, ten cases re-sourced

Second and third rounds on the dossier pipeline, reviewed locally before commit.

Retrieval
- wayback_pass.py: retries every BLOCKED/DEAD/THIN/ERROR linked source through
  the Wayback Machine; blocks carry the snapshot date, archive URL and the live
  verdict. 143 slots retried: 93 fetched, 37 no snapshot, 12 script shells, 1 PDF.
- fetch_sources.py: fetch_wayback() helper.
- add_extra_sources.py: files staged extra_* finds (web search, not on the DB
  record) into the store with a provenance note.
- Cases re-sourced by web search: 248 (Oslo: Document.no, Avisa Oslo, NRK; the
  linked Le Parisien piece is case 242 and is marked OFF-CASE), 258 Kharkiv,
  260 Singapore, 358 Bangkok, 365 Las Vegas, 388 Verneuil-sur-Seine, 390 Zoersel,
  430 Homestead. 341 of 364 cases now hold a fetched article; 11, 66 and 399
  have no public text source (podcast, police video, direct victim report).

Trimming
- auto_trim.py: case-anchored furniture cut for UNTRIMMED blocks. Finds the body
  run that mentions the case, merges across subheadings and short furniture
  gaps, drops teasers, share bars, date/URL/caption lines and subscription
  pitches; refuses pages with no record term or almost no body. 302 blocks
  trimmed; 16 left on auto-trim-review.md (7 OFF-CASE suspects). Every cut is
  labelled AUTO-TRIMMED, UNREVIEWED in the dossier; the full extract stays in
  staging/. Decisions with anchors in trim-decisions-auto.json.
- build_cases.py / verify_all.py: banners for auto-trimmed and archived blocks,
  staged-file check extended to Wayback blocks, flag legend under the record.

Detention rule
- README "Definitions": the DB field `kidnappings` is the DETENTION violence
  type (victim, guard, staff or relative held to force submission or execute
  the theft), distinct from the Kidnapping scenario (taken away and held).
- detention-flag-review.md / detention-flag-corrections.json: 40 records
  reviewed with evidence; 30 set-to-1 proposals accepted by the owner on
  2026-09-06 (listed in corrections-approved.md), 10 still open.
- apply_detention_wording.py: "Violence Used" in the 70 reviewed summaries now
  names detention explicitly (62 of 70 labelled), supported by the summary's
  own text; idempotent; supersedes the batch scripts' wording.

Worklist and docs
- sofia-worklist.md: 248 decisions, detention rule item replacing the old
  "no abduction" item, fresh-search section for the textless cases.
- README-START-HERE.md: progress notes, run commands, next steps.
- Bug fixed in passing: Wayback blocks stored in-memory text with carriage
  returns; now stored as read back from disk.

verify_all.py PASSES (2321 checks).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GZZENdTLzNGsbNy4DyF1yt

merge-output/staging/194/01_beincrypto-com-wayback.txt

@@ -0,0 +1,55 @@
+Armed Crypto Robbery in Thailand Ends in $250,000 Theft
+
+FeedNewslettersBonus HunterTop PicksMarketsFast NewsRemote JobsSpecial Edition
+
+Ukrainian Man Forced to Transfer $250,000 in Crypto During Armed Robbery in Thailand
+
+Armed robbers in Thailand forced a Ukrainian man to transfer $250K in USDT under threat of violence.
+
+The attackers tied the victim to a bed after the transfer and fled the scene, warning him not to report the crime.
+
+Thailand Police arrested four suspects, one of whom regularly purchased USDT from the victim.
+
+A Ukrainian national, Viacheslav Leibov, fell victim to a rare case of crypto theft through physical coercion in Phuket, Thailand.
+
+Armed assailants forced him to transfer 250,000 USDT, equivalent to 8.56 million baht, under the threat of violence. On November 11, four people were arrested in association with the robbery.
+
+According to local reports, Leibov told local police that his ordeal began on Friday night when he visited his friend in his hotel room. Upon arrival, an Armenian man, Arman Grigoryan, 21, escorted Leibov to the room.
+
+Initially, the group engaged in conversation on the balcony. However, the situation escalated when Leibov went to use the bathroom. Two masked individuals ambushed him, binding his limbs with ropes and cable ties.
+
+The robbers, armed with a hammer and knife, demanded Leibov transfer 500,000 USDT. Leibov negotiated to reduce the amount, transferring the 250,000 USDT as demanded.
+
+After completing the transfer, the attackers tied him to a bed and warned him against reporting the crime.
+
+Once the assailants left, Leibov managed to free himself. He immediately rode his motorcycle and reported the incident to Kamala police.
+
+Police arrested four suspects associated with the robbery on Monday. One of the suspects regularly purchased crypto, more specifically, USDT, from Leibov. He has prior knowledge about Leibov holding large sum of stablecoins, which led to this plot.
+
+The case highlights a growing concern about the physical targeting of individuals for their digital assets as crypto becomes more mainstream.
+
+Crypto Crimes Are Becoming More Diversified
+
+With crypto adoption growing across most regions, the variety and sophistication of crimes are also increasing. There have been several occasions this year where criminals have used unconventional methods to steal cryptocurrency.
+
+The Federal Trade Commission reported that scammers stole $65 million through Bitcoin ATM schemes in the first half of 2024. These scams involve fraudsters posing as bank or government officials, convincing victims to withdraw cash and deposit it into a Bitcoin ATM.
+
+Recently, Binance also issued a global warning about a new threat called “Clipper malware.” As BeInCrypto previously reported, this malware alters wallet addresses during transactions. So, users might be sending their funds to a scammer’s wallet without realizing it.
+
+Earlier in August, reports emerged about scammers promoting a new malware on the macOS that targets crypto wallets like MetaMask. Scammers often promote this malware via Telegram and fake job offers.
+
+Conventional cyber-criminal gangs are also turning their attention to the crypto industry. Recent reports suggest that North Korea’s infamous Lazarus group and its affiliates are now targeting crypto firms through phishing campaigns.
+
+Insights, news and analysis of the crypto market straight to your inbox
+
+Best Crypto Platforms for DePIN Tokens in 2025
+
+In adherence to the Trust Project guidelines, BeInCrypto is committed to unbiased, transparent reporting. This news article aims to provide accurate, timely information. However, readers are advised to verify facts independently and consult with a professional before making any decisions based on this content. Please note that our Terms and Conditions, Privacy Policy, and Disclaimers have been updated.
+
+$3 Million XRP Hack Shows 95% of Recovery Firms May Be Predators
+
+NewsLearnMarketsLearn-to-EarnBonus HunterNewslettersTop PicksSpecial EditionFast News
+
+AdvertiseRemote JobsContact UsThe Trust ProjectVerification MethodologyAdvertiser Disclosure
+
+© 2025 BeInNews AcademyTermsPrivacyDisclaimer

merge-output/staging/194/index.json

@@ -5,10 +5,13 @@
     "field": "url",
     "url": "https://beincrypto.com/ukrainian-man-victim-of-crypto-theft-in-thailand/",
     "host": "beincrypto.com",
-    "fetched_at": "2026-09-05T12:49:52+00:00",
-    "verdict": "BLOCKED",
-    "method": "raw",
-    "http": 403,
-    "note": "raw request refused; try the WebFetch path, which is a model transcription and must be labelled as such"
+    "fetched_at": "2026-09-05T13:28:56+00:00",
+    "verdict": "FETCHED",
+    "method": "wayback",
+    "snapshot": "20251123212942",
+    "archive_url": "http://web.archive.org/web/20251123212942/https://beincrypto.com/ukrainian-man-victim-of-crypto-theft-in-thailand/",
+    "chars": 4170,
+    "sha256": "f8daa6974647090f5b82d1ad082cbc78975340c536bc6b638027b1d5aa3cac24",
+    "live_verdict": "BLOCKED"
   }
 ]