docs(definitions): install the paper's Appendix B glossary as the canonical definitions

merge-output/DEFINITIONS.md holds the research paper's (v5 FINAL, February 2026)
Appendix B verbatim: eleven scenario definitions and six violence categories,
plus a mapping from DB labels to glossary names and the owner's clarifications
on the Detention flag from 2026-09-06/07. The README's own paraphrase is
replaced by a pointer so there is one source of truth.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GZZENdTLzNGsbNy4DyF1yt
(cherry picked from commit e36ceae8d6)

README-START-HERE.md

@@ -58,6 +58,15 @@ tests - just Python scripts that regenerate the .txt files, plus Markdown notes.
 5. Every record-vs-article contradiction is a note for Sofia - log it, do not "resolve" it by
    guessing which side is right.
 
+### Definitions (read before classifying anything)
+The canonical definitions of the eleven scenarios and six violence categories are the research
+paper's Appendix B glossary, copied verbatim into merge-output/DEFINITIONS.md together with the
+database owner's clarifications on the Detention flag (2026-09-06/07). Use that file; do not
+paraphrase it elsewhere. The point that keeps biting: the DB field `kidnappings` is the DETENTION
+violence category (anyone held against their will, restrained, or prevented from leaving, for any
+length of time, including forced entry followed by beating or holding the victim in place), not
+the Kidnapping scenario (victim taken away to a controlled location).
+
 ### Environment
 - Windows / PowerShell, with a Bash tool available (Git Bash).
 - In the Bash tool, a "cd" inside a compound command triggers a permission prompt - always use

merge-output/DEFINITIONS.md

@@ -0,0 +1,86 @@
+# Definitions — canonical glossary for the K&R database
+
+Source of truth: GART Research, "Physical Attacks on Cryptocurrency Holders", research paper v5
+FINAL (February 2026), Appendix B: Glossary. Copied verbatim below on 2026-09-07 from
+`03-research-and-publishing/GART Research Crypto K&R Paper /research-paper-v5-FINAL-February-2026.md`.
+If the paper's glossary changes, replace the block below; do not edit it here.
+
+Two things the paper says that govern this database:
+
+- Scenario classification: "Each case is assigned one primary scenario category based on dominant
+  characteristics. Categories are not mutually exclusive, as many attacks exhibit characteristics of
+  multiple scenarios. The single-category assignment is a methodological choice for analytical
+  clarity." (Methodology, Classification Framework.)
+- "The scenario categories used in this paper do not represent different types of crime so much as
+  different ways that kidnappings unfold ... The scenario classification describes the attack's
+  initiation method and operational pattern, not its legal character." (Findings, Attack Typology.)
+
+## Database labels vs glossary names
+
+| DB `scenario` value | Glossary entry |
+|---|---|
+| Armed Robbery in Public Space | Armed Robbery |
+| Assault - Mugging | Mugging |
+| Malicious Invitation - SocialEng | Malicious Invitation / Social Engineering |
+| all others | same name |
+
+| DB flag | Glossary violence category |
+|---|---|
+| `kidnappings` | Detention (rename the field `detention`; the scenario "Kidnapping" is a different thing) |
+| `violence_torture` | Violence/Torture |
+| `drugs_alcohol` | Drugs/Alcohol |
+| `weapons` | Weapons |
+| `theft` | Theft |
+| `life_taken` | Fatalities / Life Taken |
+
+## Owner's clarifications on the Detention flag (2026-09-06 and 2026-09-07)
+
+These apply the glossary's Detention entry to edge cases met during the flag review:
+
+1. Forced entry into the victim's space (home, office, hotel room, car) followed by beating the
+   victim or holding them there until they hand over what is wanted is detention, however short.
+   The victim would have left if they could.
+2. Who was held does not change the flag. Detention used on guards, staff, a concierge or a relative
+   to force submission or execute the theft counts as 1 even when the record's named victim was absent.
+3. Control never gained is not detention: a plot foiled before contact, an attempt the victim fought
+   off at the door or in the street, a snatch in passing, a break-in of empty premises.
+4. In summaries, "Violence Used" names detention explicitly when it occurred; kidnapped / abducted
+   are reserved for a victim taken away (the Kidnapping scenario's defining feature).
+
+---
+
+**Armed Robbery (Scenario)**: Direct, forceful theft using weapons against crypto-related businesses, facilities, or individuals in commercial or public settings. Targets include cryptocurrency exchanges, crypto ATM locations, mining facilities, blockchain company offices, or crypto traders conducting business. Unlike kidnapping scenarios, armed robberies are typically swift operations focused on immediate asset seizure rather than extended detention. Perpetrators enter premises with firearms or weapons, threaten staff or customers, and demand access to wallets, safes, or force immediate transfers. These attacks may be opportunistic or carefully planned heists against high-value targets. Violence occurs if victims resist, though the primary goal is rapid theft rather than prolonged captivity.
+
+**Authority Misuse (Scenario)**: Exploitation of real or fabricated positions of power to gain victim compliance through intimidation or false legitimacy. Attackers may be corrupt law enforcement, military personnel, government officials abusing their authority, or criminals impersonating these roles with fake badges, uniforms, or vehicles. They leverage the victim's instinct to comply with authority figures, conducting fake arrests, illegal searches, or "official investigations" that serve as covers for theft and extortion. Victims surrender crypto assets believing they're cooperating with legal procedures. This scenario is particularly effective because victims often don't resist or report incidents quickly, fearing legal consequences or not realizing they've been victimized by criminals rather than legitimate authorities.
+
+**Costly Fame (Scenario)**: Attacks targeting individuals whose public cryptocurrency activities, wealth displays, or online presence made them identifiable high-value targets. Victims include crypto influencers, exchange executives, successful traders, blockchain developers, or early Bitcoin adopters who became known through social media, conferences, interviews, or public records. Perpetrators conduct extensive digital reconnaissance, tracking victims' posts about holdings, luxury purchases, travel schedules, and personal routines. Public figures inadvertently provide attackers with targeting information through Instagram posts, Twitter discussions of portfolio gains, YouTube channel content, or media appearances. The scenario highlights the unique risks faced by visible members of the crypto community, where online prominence and wealth disclosure can translate directly into physical danger.
+
+**Detention (Violence category)**: Forceful detention where victims are held against their will, restrained, or prevented from leaving. This includes being held at a specific location (home, vehicle, unknown location) or being physically restrained during an attack. Detention may range from brief periods during a robbery to extended kidnapping scenarios lasting days or weeks.
+
+**Dodged Attack (Scenario)**: Attempted attacks that failed due to victim awareness, quick thinking, fortunate circumstances, or effective security measures. These cases provide valuable insights into attack patterns and successful defense strategies. Victims may notice surveillance, recognize social engineering attempts, escape during initial contact, or have security systems that deterred attackers. Some dodged attacks involved victims refusing to meet suspicious contacts, alerting authorities to threats, or having bodyguards present. Other cases show attackers retreating when victims proved more prepared than anticipated. While no significant harm occurred, these incidents demonstrate real targeting and criminal intent, offering important lessons for threat awareness and prevention.
+
+**Drugs/Alcohol (Violence category)**: Use of alcohol or drugs to incapacitate, impair judgment, or force victim compliance. This includes drugging beverages (spiking drinks), forced consumption of alcohol or narcotics, or administering sedatives. Attackers use these substances to lower victims' defenses, obtain access to devices or credentials, or facilitate kidnapping and theft while victims are incapacitated or disoriented.
+
+**Express Kidnapping (Scenario)**: Brief, opportunistic kidnappings focused on rapid extraction of immediate available funds rather than extended ransom negotiations. Victims are forcibly detained for short periods—typically minutes to hours—and compelled to make quick withdrawals from crypto exchanges, ATMs, bank accounts, or mobile payment apps. Perpetrators choose targets based on accessibility rather than extensive planning, often grabbing victims on streets, in taxis, or parking areas. Unlike traditional kidnappings requiring secure holding locations, express kidnappings involve mobile detention in vehicles while visiting multiple ATMs or forcing mobile transactions. Once immediate accessible funds are exhausted, victims are typically released. The scenario is particularly prevalent in regions with high crime rates and reflects an adaptation of traditional express kidnapping tactics to the cryptocurrency ecosystem, where instant transfers enable rapid monetization.
+
+**Fatalities / Life Taken (Violence category)**: Cases resulting in death of victims, and in some instances, the attackers themselves. Fatalities may occur during the attack, as a result of injuries sustained, or as deliberate murder to eliminate witnesses. This includes deaths from violence, accidents during kidnapping attempts, suicide by victims under duress, and deaths of attackers during police interventions or victim resistance.
+
+**Home Invasion (Scenario)**: Attackers forcibly enter and take control of the victim's private residence, hotel room, office, or other personal space, holding occupants hostage on-site. Unlike traditional kidnapping where victims are relocated, home invasions involve prolonged detention at the victim's own location. Perpetrators often break in during night hours, restrain household members, and systematically search for hardware wallets, recovery phrases, or force victims to transfer crypto assets while held at gunpoint. These attacks exploit the victim's familiarity with their surroundings and may target multiple family members simultaneously to increase compliance. Duration ranges from quick raids lasting minutes to extended sieges spanning days.
+
+**Kidnapping (Scenario)**: Holding a person against their will, typically to extort cryptocurrency, private keys, or ransom payments for their release. Victims are forcibly taken from their location to an unknown or controlled environment where attackers can operate without detection. These operations are often premeditated, with attackers conducting surveillance on high-value targets in the crypto space. Kidnappings may last from hours to weeks, involving extended negotiations, torture for access credentials, and coordination between multiple perpetrators. This category specifically covers cases where victims were transported to an undisclosed location, distinguishing it from home invasions where victims remain at their residence.
+
+**Malicious Invitation / Social Engineering (Scenario)**: Sophisticated deception where attackers use psychological manipulation and false pretenses to lure victims into dangerous situations. Perpetrators build trust through fake investment opportunities, business meetings, romantic relationships, or social gatherings, then exploit the victim's goodwill. Common tactics include fake business proposals, dating app schemes, conference invitations, or investment meetups that lead victims into ambushes. Once isolated, victims face robbery, kidnapping, or violence. This scenario relies heavily on research of the target's interests, professional background, and social connections to craft convincing narratives that lower the victim's guard.
+
+**Mugging (Scenario)**: Opportunistic street crime where victims are physically assaulted and robbed in public spaces, often with little to no advance planning. Unlike targeted kidnappings, muggings are typically spontaneous attacks where criminals identify vulnerable individuals displaying signs of wealth or using expensive devices. Victims may be approached after crypto meetups, spotted withdrawing cash from crypto ATMs, or randomly selected in high-crime areas. Attackers use sudden violence or threats to seize phones, hardware wallets, jewelry, or force immediate crypto transfers before fleeing. These incidents occur in parking lots, public transportation, streets, or nightlife areas. While individually less sophisticated than planned operations, muggings pose persistent risks to crypto holders carrying valuable devices or visiting exchange locations.
+
+**P2P Trade Gone Wrong (Scenario)**: In-person (peer-to-peer) cryptocurrency exchanges that turn violent when one party plans to steal rather than trade. Victims agree to meet for peer-to-peer cash-for-crypto transactions through peer-to-peer or social media platforms. Attackers use these meetups as ambush opportunities, often appearing with accomplices, weapons, or choosing isolated locations. Instead of completing the trade, perpetrators rob victims of both cash and crypto, sometimes using violence or kidnapping to extract additional funds. The scenario exploits the trust inherent in face-to-face transactions and the irreversible nature of cryptocurrency transfers. Legitimate traders become victims when sellers or buyers reveal criminal intent.
+
+**Swatting (Scenario)**: A dangerous harassment tactic where attackers make false emergency reports to law enforcement, triggering heavily-armed police responses to the victim's location. Perpetrators call emergency services claiming active shooters, bomb threats, hostage situations, or other violent crimes in progress at the target's address. The goal is to endanger victims through confrontation with armed police, cause psychological trauma, doxing (exposing personal information), or create chaos that facilitates other attacks. In crypto contexts, swatting may be used for revenge against traders, intimidation of prominent figures, or as distraction during simultaneous digital attacks. The tactic weaponizes law enforcement against innocent victims, creating real risks of injury or death during high-stress police interventions. Swatting also exposes victims' physical locations and security vulnerabilities.
+
+**Theft (Violence category)**: Successful theft of cryptocurrency, digital assets, devices, or valuables from victims. This indicates whether attackers achieved their financial objective, successfully transferring crypto holdings, stealing hardware wallets, phones, computers, or forcing victims to make transactions. Theft ranges from small amounts taken during opportunistic crimes to millions of dollars stolen in sophisticated operations.
+
+**Violence/Torture (Violence category)**: Use of physical violence against victims to coerce compliance or extract information. This includes beatings, physical assault, torture techniques, and infliction of pain or injury. Violence may be used to intimidate victims into revealing passwords, seed phrases, or transferring crypto assets. The severity ranges from threats and physical intimidation to severe torture resulting in serious injuries.
+
+**Weapons (Violence category)**: Use of weapons during the attack, including firearms (handguns, rifles), knives, tasers, pepper spray, or other tools used as weapons. Weapons may be displayed as threats to intimidate victims, used to gain entry to premises, or employed to inflict harm. This category indicates cases where weapons were confirmed to be present or used, either through victim testimony, evidence, or arrests.
+
+**Wrench Attack**: Physical violence or coercion to extract cryptocurrency credentials. Named after the XKCD comic depicting a "$5 wrench" as more effective than cryptographic attacks.