feat(sources): Wayback pass, automatic trimming, detention rule, ten cases re-sourced

Second and third rounds on the dossier pipeline, reviewed locally before commit.

Retrieval
- wayback_pass.py: retries every BLOCKED/DEAD/THIN/ERROR linked source through
  the Wayback Machine; blocks carry the snapshot date, archive URL and the live
  verdict. 143 slots retried: 93 fetched, 37 no snapshot, 12 script shells, 1 PDF.
- fetch_sources.py: fetch_wayback() helper.
- add_extra_sources.py: files staged extra_* finds (web search, not on the DB
  record) into the store with a provenance note.
- Cases re-sourced by web search: 248 (Oslo: Document.no, Avisa Oslo, NRK; the
  linked Le Parisien piece is case 242 and is marked OFF-CASE), 258 Kharkiv,
  260 Singapore, 358 Bangkok, 365 Las Vegas, 388 Verneuil-sur-Seine, 390 Zoersel,
  430 Homestead. 341 of 364 cases now hold a fetched article; 11, 66 and 399
  have no public text source (podcast, police video, direct victim report).

Trimming
- auto_trim.py: case-anchored furniture cut for UNTRIMMED blocks. Finds the body
  run that mentions the case, merges across subheadings and short furniture
  gaps, drops teasers, share bars, date/URL/caption lines and subscription
  pitches; refuses pages with no record term or almost no body. 302 blocks
  trimmed; 16 left on auto-trim-review.md (7 OFF-CASE suspects). Every cut is
  labelled AUTO-TRIMMED, UNREVIEWED in the dossier; the full extract stays in
  staging/. Decisions with anchors in trim-decisions-auto.json.
- build_cases.py / verify_all.py: banners for auto-trimmed and archived blocks,
  staged-file check extended to Wayback blocks, flag legend under the record.

Detention rule
- README "Definitions": the DB field `kidnappings` is the DETENTION violence
  type (victim, guard, staff or relative held to force submission or execute
  the theft), distinct from the Kidnapping scenario (taken away and held).
- detention-flag-review.md / detention-flag-corrections.json: 40 records
  reviewed with evidence; 30 set-to-1 proposals accepted by the owner on
  2026-09-06 (listed in corrections-approved.md), 10 still open.
- apply_detention_wording.py: "Violence Used" in the 70 reviewed summaries now
  names detention explicitly (62 of 70 labelled), supported by the summary's
  own text; idempotent; supersedes the batch scripts' wording.

Worklist and docs
- sofia-worklist.md: 248 decisions, detention rule item replacing the old
  "no abduction" item, fresh-search section for the textless cases.
- README-START-HERE.md: progress notes, run commands, next steps.
- Bug fixed in passing: Wayback blocks stored in-memory text with carriage
  returns; now stored as read back from disk.

verify_all.py PASSES (2321 checks).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GZZENdTLzNGsbNy4DyF1yt

merge-output/staging/423/02_ktla-com-wayback.txt

@@ -0,0 +1,87 @@
+Wealthy California crypto holders targeted in violent ‘wrench attacks’ | KTLA
+
+A series of so-called “wrench attacks,” violent robberies targeting wealthy cryptocurrency holders, are making headlines after victims in Los Angeles and the Bay Area were targeted, the San Francisco Chronicle reported.
+
+On Nov. 22, a San Francisco man was robbed of $13 million in digital currency after thieves posing as pizza delivery drivers forced their way into his home, bound him with duct tape, beat him with a firearm and threatened to cut off his fingers.
+
+The victim told investigators he had been expecting a package when a man carrying a white box arrived on the front porch of his Mission Dolores home around 5 p.m.
+
+He was reportedly pushed away from the door and overtaken. For the next hour, a suspect inside the home and another on the phone demanded his passwords and ultimately made off with $10 million in Bitcoin and $3 million in Ethereum, according to The Chronicle.
+
+Experts say the decentralized nature of cryptocurrencies and the ability to transfer large sums in irreversible transactions, features that attract speculators, also make large account holders vulnerable to bad actors.
+
+Three attempted wrench attacks in Sunnyvale, San Jose and Los Angeles that occurred in the days and weeks following the San Francisco home invasion appear to be linked.
+
+In some cases, investigators believe suspects infiltrated victims’ DoorDash or Uber Eats accounts and obtained key information, including home addresses.
+
+On Dec. 17, a San Jose man was met in his driveway by an armed suspect who ordered him into the garage and told him to close the door. He was struck on the back of the head with the gun and fell, later telling investigators he pretended to be seriously injured.
+
+The suspect and another man were spooked when an Amazon delivery van drove by, prompting them to flee.
+
+The victim also recounted two pizza deliveries to his home 11 days earlier that he had not ordered. Just two days before the attack, he was approached by individuals offering to power wash his driveway for free, an offer he declined.
+
+Five days later in Sunnyvale, another man reported that a person posing as a DoorDash driver delivering coffee brandished a gun and pushed his way inside the victim’s home. The suspect fled in a black Kia after the victim fought back.
+
+The suspect was later pulled over and arrested. He was identified as Nino Chindavanh, a 21-year-old resident of Tennessee.
+
+Eight days later, a second suspect attempted the same coffee delivery ruse at the same home.
+
+On New Year’s Eve in Los Angeles’ Brentwood neighborhood, a man posing as a delivery driver asked if he could get a drink of water. The victim obliged and was followed into the home at gunpoint.
+
+He was bound with duct tape and zip ties by the time a second suspect arrived, while a third person was contacted by phone. The suspects threatened to cut off his fingers, prompting the victim to give up his computer password, allowing them to view his cryptocurrency holdings.
+
+A witness hiding in a pantry during the ordeal managed to escape and call 911.
+
+When the suspects heard a helicopter circling overhead, they attempted to flee and were later arrested following a police pursuit.
+
+The two suspects were identified as Elijah Armstrong and Jayden Rucker, both residents of Tennessee. Rucker’s wallet and ID were also found in the black Kia Chindavanh had been driving.
+
+While the three men have been charged with robbery, burglary, assault with a firearm and attempted extortion, among other offenses, investigators believe higher-level operatives are involved in the wrench attacks, a term derived from a web comic.
+
+It’s unclear if investigators, including those at the Federal Bureau of Investigation, have identified any of the larger players in the scheme.
+
+Detectives believe all suspects involved in the in-person robberies in the Bay Area and Los Angeles have now been taken into custody.
+
+A DoorDash spokesperson told The Chronicle that the company is unable to comment on the cases as the investigation remains ongoing, but said the company is cooperating with state, local and federal investigators.
+
+2 girls severely hurt in off-road crash in Utah
+
+Adults-only cruise line kicks off new L.A.-based …
+
+Human skull found during kids’ Easter hunt at L.A. …
+
+6th rattlesnake bite reported in Ventura County
+
+Vigilante sting at Orange County park leads to arrest
+
+BestReviews.com - Top picks to make everyone happy
+
+10 last-minute Easter basket stuffers that are trending …
+
+LEGO Easter sets are perfect basket-fillers
+
+Amazon’s Easter storefront has adorable holiday decor
+
+Amazon Big Spring Sale: The best deals that are still …
+
+Amazon Big Spring Sale travel deals: Luggage, beauty, …
+
+Amazon Big Spring Sale beauty steals: Up to 50% off …
+
+Provided by Nexstar Media Group, Inc.
+
+Sign in to create your free My Nexstar account featuring exclusive livestreams
+
+Enter your email and we’ll send a secure one-click link to sign in.
+
+KTLA is provided by Nexstar Media Group, Inc., and uses the My Nexstar sign-in, which works across our media network.
+
+Learn more at nexstar.tv/privacy-policy.
+
+Nexstar Media Group, Inc. is a leading, diversified media company that produces and distributes engaging local and national news, sports, and entertainment content across its television and digital platforms. The My Nexstar sign-in works across the Nexstar network—including The CW, NewsNation, The Hill, and more. Learn more at nexstar.tv/privacy-policy.
+
+We’ve sent an email containing a verification link which expires in 10 minutes.
+
+Thanks for registering!
+
+Are you sure you want to log out?

merge-output/staging/423/index.json

@@ -19,10 +19,13 @@
     "field": "url_2",
     "url": "https://ktla.com/news/california/violent-crypto-robberies-los-angeles-bay-area/",
     "host": "ktla.com",
-    "fetched_at": "2026-08-06T13:40:55+00:00",
-    "verdict": "BLOCKED",
-    "method": "raw",
-    "http": 403,
-    "note": "raw request refused; try the WebFetch path, which is a model transcription and must be labelled as such"
+    "fetched_at": "2026-09-05T13:22:55+00:00",
+    "verdict": "FETCHED",
+    "method": "wayback",
+    "snapshot": "20260407082519",
+    "archive_url": "http://web.archive.org/web/20260407082519/https://ktla.com/news/california/violent-crypto-robberies-los-angeles-bay-area/",
+    "chars": 5673,
+    "sha256": "ee3a345bc618f856b562827b7e01a53523edb84c9c897d4ee7f4f3c421af1162",
+    "live_verdict": "BLOCKED"
   }
 ]