@stage5/lumine 0.3.17 → 0.3.19

package/README.md

@@ -96,8 +96,11 @@ run `lumine suggestions <build-url-or-id>` to see their open suggestion inbox.
 The inbox prints canonical follow-up commands for merging or replacing Main and
 for applying the exact frozen thumbnail shown in a suggestion. The same actions
 are also available directly as `lumine suggestions merge <id>`,
-`lumine suggestions replace-main <id>`, and
-`lumine suggestions adopt-thumbnail <id>`. Large inboxes are cursor-paginated;
+`lumine suggestions replace-main <id>`,
+`lumine suggestions adopt-thumbnail <id>`, and
+`lumine suggestions adopt-title <id>`. To pass on a branch, thumbnail or name
+suggestion, run `lumine suggestions decline <id>`; the chat card shows it was
+declined for both sides and it leaves the inbox. Large inboxes are cursor-paginated;
 the CLI prints the exact `--cursor` command for the next page.
 
 Use `lumine explore` to list public open-source Build apps that can be used as

package/lib/admin-chat-reports.js

@@ -0,0 +1,129 @@
+// Human output for `lumine admin chat-reports list|show|set`. The generic
+// printer used to fall through to the daily-run report branch for any
+// `data.report` and crash on `report.run.id`; these formatters own the
+// chat-report shapes (controllers/chat/model/messageReports.ts).
+
+function formatTime(seconds) {
+  const value = Number(seconds || 0);
+  if (!value) return "unknown time";
+  return `${new Date(value * 1000).toISOString().slice(0, 16).replace("T", " ")} UTC`;
+}
+
+function who(person) {
+  if (!person) return "unknown";
+  const id = Number(person.id || person.userId || 0);
+  if (person.username) return id ? `${person.username} (#${id})` : person.username;
+  return id ? `user #${id}` : "unknown";
+}
+
+function indent(text, prefix) {
+  return String(text ?? "")
+    .split("\n")
+    .map((line) => `${prefix}${line}`)
+    .join("\n");
+}
+
+function formatMessageLine(message, marker = " ") {
+  const author = message.username || (message.userId ? `user #${message.userId}` : "unknown");
+  const content = String(message.content ?? "").trim() || "(no text)";
+  const [first, ...rest] = content.split("\n");
+  const head = `${marker} ${formatTime(message.timeStamp)}  ${author}: ${first}`;
+  return rest.length ? `${head}\n${indent(rest.join("\n"), "      ")}` : head;
+}
+
+function where(report) {
+  const parts = [];
+  if (report.channelKind) parts.push(report.channelKind);
+  if (report.channelId) parts.push(`channel ${report.channelId}`);
+  if (report.subchannelId) parts.push(`subchannel ${report.subchannelId}`);
+  const channelName = report.message?.channelName;
+  return `${parts.join(" ")}${channelName ? ` "${channelName}"` : ""}`;
+}
+
+export function formatChatReportLine(report) {
+  const preview = String(report.message?.content ?? "")
+    .replace(/\s+/g, " ")
+    .trim();
+  const short = preview.length > 80 ? `${preview.slice(0, 79)}…` : preview;
+  return `#${report.id} ${String(report.status || "open").toUpperCase()} · ${report.reasonLabel || report.reason || "no reason"} · ${who(report.reporter)} → ${who(report.reported)} · ${formatTime(report.createdAt)}${Number(report.reportsOfThisMessage) > 1 ? ` · ${report.reportsOfThisMessage} reports of this message` : ""}${short ? `\n    "${short}"` : ""}`;
+}
+
+export function formatChatReportList(data = {}) {
+  const reports = Array.isArray(data.reports) ? data.reports : [];
+  const filter = data.filter ? `${data.filter} ` : "";
+  const lines = [
+    `${reports.length} ${filter}chat report(s)${reports.length ? ":" : "."}`,
+  ];
+  for (const report of reports) lines.push(`  ${formatChatReportLine(report)}`);
+  if (data.nextCursor) {
+    const status =
+      data.filter && data.filter !== "pending" ? ` --status ${data.filter}` : "";
+    lines.push(
+      `More: lumine admin chat-reports list${status} --cursor ${data.nextCursor}`,
+    );
+  }
+  if (reports.length) {
+    lines.push("Open one with: lumine admin chat-reports show <id>");
+  }
+  return lines;
+}
+
+export function formatChatReport(report = {}) {
+  const lines = [];
+  lines.push(
+    `Chat report #${report.id}: ${String(report.status || "open").toUpperCase()} · filed ${formatTime(report.createdAt)}${report.ownerNotifiedAt ? ` · Mikey notified ${formatTime(report.ownerNotifiedAt)}` : ""}`,
+  );
+  lines.push(`Reporter → reported: ${who(report.reporter)} → ${who(report.reported)}`);
+  lines.push(
+    `Reason: ${report.reasonLabel || report.reason || "none"}${report.reason && report.reasonLabel && report.reason !== report.reasonLabel ? ` (${report.reason})` : ""}`,
+  );
+  if (report.note) lines.push(`Reporter's note: ${report.note}`);
+  const place = where(report);
+  if (place) lines.push(`Where: ${place}`);
+  if (Number(report.reportsOfThisMessage) > 1) {
+    lines.push(`This message has ${report.reportsOfThisMessage} reports.`);
+  }
+  if (Array.isArray(report.safetyHoldIds) && report.safetyHoldIds.length) {
+    lines.push(`Safety hold(s): #${report.safetyHoldIds.join(", #")}`);
+  }
+  if (report.reviewedAt || report.reviewNote) {
+    lines.push(
+      `Review: ${formatTime(report.reviewedAt)}${report.reviewedByUserId ? ` by user #${report.reviewedByUserId}` : ""}${report.reviewNote ? ` — ${report.reviewNote}` : ""}`,
+    );
+  } else {
+    lines.push("Review: not reviewed yet.");
+  }
+
+  const message = report.message;
+  lines.push("");
+  lines.push(`Reported message${report.messageId ? ` #${report.messageId}` : ""}:`);
+  lines.push(message ? formatMessageLine(message, ">") : "  (no snapshot kept)");
+
+  const before = Array.isArray(report.context?.before) ? report.context.before : [];
+  const after = Array.isArray(report.context?.after) ? report.context.after : [];
+  if (!report.context) {
+    lines.push("");
+    lines.push("Context: none kept.");
+    return lines;
+  }
+  lines.push("");
+  lines.push(`Context before (${before.length}):`);
+  if (!before.length) lines.push("  (none)");
+  for (const item of before) lines.push(formatMessageLine(item));
+  lines.push(`Context after (${after.length}):`);
+  if (!after.length) lines.push("  (none)");
+  for (const item of after) lines.push(formatMessageLine(item));
+  return lines;
+}
+
+// Returns the lines for a chat-report operation, or null when the operation
+// is not one of these (holds/export/suspend have their own printer).
+export function formatChatReportResult({ operation, data }) {
+  if (operation?.name === "chat-reports.list") return formatChatReportList(data);
+  if (operation?.name === "chat-reports.show" || operation?.name === "chat-reports.set") {
+    const lines = data?.report ? formatChatReport(data.report) : ["No report returned."];
+    if (operation.name === "chat-reports.set") lines.unshift("Recorded.");
+    return lines;
+  }
+  return null;
+}

package/lib/admin-profile.js

@@ -0,0 +1,138 @@
+// `lumine admin profile show <user-id|username>`: a member's public profile as
+// a reviewer reads it (identity, rank and titles, bio, counts, and their
+// latest public subjects, comments, builds, AI stories and shared
+// reflections), for the daily run's Notable Users candidate check without a
+// browser. Read-only; a daily-run read like `brief` (content:read). The API
+// serves it as a signed-out visitor would see the profile: no emails.
+
+export const PROFILE_USAGE =
+  "Usage: lumine admin profile show <user-id|username> [--json].";
+
+const SITE_DAY_MS = 24 * 60 * 60 * 1000;
+
+function validationError(message) {
+  const error = new Error(message);
+  error.code = "CLI_ADMIN_CLI_VALIDATION";
+  return error;
+}
+
+export function buildProfileShowOperation({ action, target, extra }) {
+  const rawTarget = String(target || "").trim();
+  if (action !== "show" || !rawTarget || extra) {
+    throw validationError(PROFILE_USAGE);
+  }
+  const query = new URLSearchParams();
+  if (/^\d+$/.test(rawTarget)) {
+    const userId = Number(rawTarget);
+    if (!Number.isSafeInteger(userId) || userId < 1) {
+      throw validationError("The user ID must be a positive integer.");
+    }
+    query.set("userId", String(userId));
+  } else {
+    query.set("username", rawTarget.replace(/^@/, ""));
+  }
+  return {
+    name: "profile.show",
+    method: "GET",
+    path: `/cli/admin/profile?${query.toString()}`,
+    body: undefined,
+    mutates: false,
+  };
+}
+
+function day(seconds) {
+  const value = Number(seconds || 0);
+  return value ? new Date(value * 1000).toISOString().slice(0, 10) : "unknown";
+}
+
+function ago(seconds, now) {
+  const value = Number(seconds || 0);
+  if (!value) return "";
+  const days = Math.floor((now - value * 1000) / SITE_DAY_MS);
+  if (days <= 0) return " (under a day ago)";
+  return ` (${days} day${days === 1 ? "" : "s"} ago)`;
+}
+
+function section(lines, heading, items, describe) {
+  lines.push("");
+  lines.push(`${heading} (${items.length}):`);
+  if (!items.length) {
+    lines.push("  (none)");
+    return;
+  }
+  for (const item of items) {
+    const [head, ...rest] = describe(item);
+    lines.push(`  ${head}`);
+    for (const line of rest) if (line) lines.push(`    ${line}`);
+  }
+}
+
+function describeCommentRoot(item) {
+  if (item.subjectTitle) return `"${item.subjectTitle}"`;
+  if (item.rootType === "user") {
+    return item.rootId ? `user #${item.rootId}'s profile` : "a profile";
+  }
+  return `${item.rootType || "post"}${item.rootId ? ` ${item.rootId}` : ""}`;
+}
+
+export function formatProfileReview(data = {}, { now = Date.now() } = {}) {
+  const profile = data.profile || {};
+  const counts = data.counts || {};
+  const recent = data.recent || {};
+  const lines = [];
+  lines.push(
+    `${profile.username || "(no username)"} (#${profile.id})${profile.realName ? ` · ${profile.realName}` : ""}${profile.isNotable ? " · on Notable Users" : ""}`,
+  );
+  if (profile.url) lines.push(profile.url);
+  lines.push(
+    `Joined ${day(profile.joinedAt)}${ago(profile.joinedAt, now)} · last active ${day(profile.lastActive)}${ago(profile.lastActive, now)}`,
+  );
+  const standing = [
+    profile.rank ? `rank #${profile.rank}` : "",
+    `${Number(profile.twinkleXP || 0).toLocaleString("en-US")} XP`,
+    profile.xpThisMonth
+      ? `${Number(profile.xpThisMonth).toLocaleString("en-US")} XP this month`
+      : "",
+    `${Number(profile.achievementPoints || 0).toLocaleString("en-US")} AP`,
+    profile.userType ? `type ${profile.userType}` : "",
+    profile.title ? `title "${profile.title}"` : "",
+  ].filter(Boolean);
+  lines.push(standing.join(" · "));
+  if (Array.isArray(profile.achievements) && profile.achievements.length) {
+    lines.push(`Achievements: ${profile.achievements.join(", ")}`);
+  }
+  if (profile.isNotable && profile.notableReason) {
+    lines.push(`Notable because: ${profile.notableReason}`);
+  }
+  if (profile.statusMsg) lines.push(`Status: ${profile.statusMsg}`);
+  if (profile.greeting) lines.push(`Greeting: ${profile.greeting}`);
+  if (Array.isArray(profile.bio) && profile.bio.length) {
+    lines.push(`Bio: ${profile.bio.join(" / ")}`);
+  }
+  const links = [profile.website, profile.youtubeUrl].filter(Boolean);
+  if (links.length) lines.push(`Links: ${links.join(" · ")}`);
+  lines.push(
+    `Counts: ${counts.subjects ?? 0} subjects · ${counts.comments ?? 0} comments · ${counts.aiStories ?? 0} AI stories · ${counts.builds ?? 0} public builds · ${counts.sharedReflections ?? 0} shared reflections${profile.pictures ? ` · ${profile.pictures} profile pictures` : ""}`,
+  );
+
+  section(lines, "Recent subjects", recent.subjects || [], (item) => [
+    `${day(item.createdAt)}  ${item.title || "(untitled)"}  ${item.url}`,
+    item.excerpt,
+  ]);
+  section(lines, "Recent comments", recent.comments || [], (item) => [
+    `${day(item.createdAt)}  on ${describeCommentRoot(item)}  ${item.url}`,
+    item.excerpt,
+  ]);
+  section(lines, "Recent public builds", recent.builds || [], (item) => [
+    `${day(item.publishedAt || item.updatedAt)}  ${item.title || "(untitled)"}  ${item.url}`,
+    item.excerpt,
+  ]);
+  section(lines, "Recent AI stories", recent.aiStories || [], (item) => [
+    `${day(item.createdAt)}  ${item.title || "(no topic)"}  ${item.url}`,
+  ]);
+  section(lines, "Recent shared reflections", recent.reflections || [], (item) => [
+    `${day(item.createdAt)}  ${item.url}${item.question ? `  Q: ${item.question}` : ""}`,
+    item.excerpt ? `"${item.excerpt}"` : "",
+  ]);
+  return lines;
+}

package/lib/admin-receipts.js

@@ -0,0 +1,72 @@
+// What a write keeps on disk as its receipt (admin-request-intents.js writes
+// it to the admin work directory). Most writes keep the API's response; these
+// return private evidence (a teacher's identity facts, a reported child's
+// chat), which is printed but never persisted: the receipt keeps only what
+// proves the decision (Mikey 2026-10-07, after the identity-inspect fix).
+export function receiptToKeep(operation, result) {
+  if (!result || typeof result !== "object") return result;
+  const data = result.data || {};
+  const keep = (fields) => ({ ok: result.ok, status: result.status, changed: result.changed, data: fields });
+  switch (operation?.name) {
+    case "teachers.review":
+      return keep({
+        userId: data.teacherUserId ?? null,
+        decision: data.decision ?? null,
+        fingerprint: data.fingerprint ?? null,
+        reviewedAt: data.reviewedAt ?? null,
+        note: data.note ?? null,
+        reviewId: data.reviewId ?? null,
+        revoked: Boolean(data.revoked),
+      });
+    case "teachers.review_flagged":
+      return keep({
+        decision: data.decision ?? null,
+        note: data.note ?? null,
+        reviewed: (data.reviewed || []).map((r) => ({
+          userId: r.teacherUserId ?? null,
+          fingerprint: r.fingerprint ?? null,
+          reviewedAt: r.reviewedAt ?? null,
+        })),
+        skipped: (data.skipped || []).map((s) => ({ userId: s.userId ?? null, reason: s.reason ?? null })),
+      });
+    case "chat-reports.set": {
+      const report = data.report || {};
+      return keep({
+        reportId: report.id ?? null,
+        status: report.status ?? null,
+        reviewedAt: report.reviewedAt ?? null,
+        reviewedByUserId: report.reviewedByUserId ?? null,
+        note: report.reviewNote ?? null,
+      });
+    }
+    default:
+      // Bridge Builder writes answer with the whole crew view: members' who-
+      // are-you answers, parents' addresses and questions, held parent emails.
+      // Keep the decision only (ids, statuses, counts), never the crew.
+      if (String(operation?.name || "").startsWith("meetup.")) {
+        const crew = data.crew || {};
+        return keep({
+          crewId: crew.crewId ?? data.result?.crewId ?? null,
+          crewStatus: crew.status ?? null,
+          currentStep: crew.progress?.currentStep ?? null,
+          result: scalarsOf(data.result),
+          ...(data.slot ? { slot: scalarsOf(data.slot) } : {}),
+          ...(data.unlocks ? { unlocks: scalarsOf(data.unlocks) } : {}),
+        });
+      }
+      return result;
+  }
+}
+
+// Numbers, booleans, short status words and arrays of ids: what proves a
+// decision without copying anyone's text.
+function scalarsOf(value) {
+  if (!value || typeof value !== "object") return null;
+  const out = {};
+  for (const [key, item] of Object.entries(value)) {
+    if (typeof item === "number" || typeof item === "boolean" || item === null) out[key] = item;
+    else if (typeof item === "string" && /^[\w:.-]{0,40}$/.test(item)) out[key] = item;
+    else if (Array.isArray(item) && item.every((x) => typeof x === "number")) out[key] = item;
+  }
+  return out;
+}

package/lib/admin.js

@@ -12,6 +12,7 @@ import {
 import path from "node:path";
 import { assertAuthScope, resolveAuth } from "./auth.js";
 import { requestJson } from "./http.js";
+import { receiptToKeep } from "./admin-receipts.js";
 import { prepareAdminMutationIntent } from "./admin-request-intents.js";
 import { formatBytes, parseStorageSizeBytes } from "./util.js";
 import {
@@ -37,6 +38,11 @@ import {
   buildOwnerTraceOperation,
   printOwnerTrace,
 } from "./admin-owner-trace.js";
+import { formatChatReportResult } from "./admin-chat-reports.js";
+import {
+  buildProfileShowOperation,
+  formatProfileReview,
+} from "./admin-profile.js";
 import {
   dailyRunGather,
   dailyRunProgress,
@@ -234,7 +240,7 @@ function parseReviewRequestRef(target, { type: fixedType, typeOption } = {}) {
 const APPROVAL_USAGE =
   "Use: lumine admin approvals list [--status pending|approved|rejected|all] [--type dob|mentor|meetup] | show <id> | approve <id> [--reason <text>] | reject <id> [--reason <text>] | supermod <id> [--reason <text>]";
 const TEACHER_USAGE =
-  "Use: lumine admin teachers audit [--limit <1-100>] | revoke <userId> --reason <text>";
+  "Use: lumine admin teachers audit [--limit <1-100>] [--cursor <c>] [--all] | revoke <userId> --reason <text> | review <userId> --decision legit|revoke --note <text> [--fingerprint <fp>] (revoke needs it) | review --all-flagged --expect <id[:fp],...> --note <text>";
 
 function parseApprovalId(target) {
   const raw = String(target || "").replace(/^approval:/, "");
@@ -356,19 +362,28 @@ function buildEnglishOperation({ action, target, options }) {
   throw cliValidationError(ENGLISH_USAGE);
 }
 
+// One audit page stays well under proxy timeouts (100 teachers took over
+// 20 s on 2026-10-05); `--all` pages through every teacher.
+const TEACHER_AUDIT_PAGE = 50;
+// the API's per-request bulk review bound (approvals.ts BULK_REVIEW_MAX)
+const TEACHER_REVIEW_BATCH = 25;
+
 function buildTeacherOperation({ action, target, options }) {
   if (!action || action === "audit") {
-    return readOperation(
+    const operation = readOperation(
       "teachers.audit",
       withQuery("/cli/admin/teachers/audit", {
-        limit: options.limit
-          ? parseRequiredInteger(options.limit, "--limit", 1, 200)
-          : "",
+        limit: options.adminAll
+          ? TEACHER_AUDIT_PAGE
+          : options.limit
+            ? parseRequiredInteger(options.limit, "--limit", 1, 100)
+            : "",
+        cursor: options.adminAll ? "" : options.adminCursor || "",
       }),
-      // Linked-account networks make large audits slow (100 teachers took
-      // over 20 s on 2026-10-05), so this read gets its own timeout.
+      // Linked-account networks make large audits slow, so this read gets its own timeout.
       { requiresRun: false, timeoutMs: 120000 },
     );
+    return options.adminAll ? { ...operation, teacherWorkflow: "audit-all" } : operation;
   }
   if (action === "revoke" || action === "remove") {
     const userId = String(target || "");
@@ -387,9 +402,232 @@ function buildTeacherOperation({ action, target, options }) {
       { requiresRun: false },
     );
   }
+  // The owner's review of an audited teacher, kept with the fingerprint of the
+  // facts he was shown: the server records nothing if they changed since.
+  if (action === "review") {
+    const note = String(options.note || "").trim();
+    if (!note) {
+      throw cliValidationError(
+        "lumine admin teachers review needs --note <text> (kept with the review).",
+      );
+    }
+    if (options.adminAllFlagged) {
+      if (target || options.adminDecision || options.adminFingerprint) {
+        throw cliValidationError(
+          "--all-flagged reviews the --expect teachers as legit; leave out <userId>, --decision and --fingerprint.",
+        );
+      }
+      return {
+        ...writeOperation(
+          "teachers.review_flagged",
+          "POST",
+          "/cli/admin/teachers/review-flagged",
+          { note },
+          { requiresRun: false, timeoutMs: 120000 },
+        ),
+        teacherWorkflow: "review-flagged",
+        expect: parseTeacherExpect(options.adminExpect),
+      };
+    }
+    const userId = String(target || "");
+    if (!/^\d+$/.test(userId)) throw cliValidationError(TEACHER_USAGE);
+    const decision = parseChoice(options.adminDecision || "", "--decision", [
+      "legit",
+      "revoke",
+    ]);
+    const fingerprint = String(options.adminFingerprint || "").trim().toLowerCase();
+    if (fingerprint && !/^[0-9a-f]{64}$/.test(fingerprint)) {
+      throw cliValidationError("--fingerprint is the 64-character fingerprint the teacher audit printed.");
+    }
+    // a revoke acts on facts Mikey read, never on an entry printed and acted on in one step
+    if (decision === "revoke" && !fingerprint) {
+      throw cliValidationError(
+        "--decision revoke needs --fingerprint <fp> from the audit entry Mikey decided on.",
+      );
+    }
+    const operation = writeOperation(
+      "teachers.review",
+      "POST",
+      `/cli/admin/teachers/${userId}/review`,
+      { decision, note, ...(fingerprint ? { fingerprint } : {}) },
+      { requiresRun: false, timeoutMs: 60000 },
+    );
+    // without --fingerprint: read and show the entry first, then send its fingerprint
+    return fingerprint ? operation : { ...operation, teacherWorkflow: "review-one", userId: Number(userId) };
+  }
   throw cliValidationError(TEACHER_USAGE);
 }
 
+/**
+ * --expect for `review --all-flagged`: the teachers Mikey decided on, as
+ * `id` or `id:<fingerprint prefix, 8+ hex>` (the prefix pins the facts he
+ * read, so a flag that moved since is caught even for an expected id).
+ */
+export function parseTeacherExpect(raw) {
+  const text = String(raw || "").trim();
+  if (!text) {
+    throw cliValidationError(
+      "--all-flagged needs --expect <id[:fp],...>: the teachers Mikey decided on (from the audit he read). Only those are recorded.",
+    );
+  }
+  const expect = new Map();
+  for (const part of text.split(",").map((p) => p.trim()).filter(Boolean)) {
+    const match = part.match(/^(\d+)(?::([0-9a-fA-F]{8,64}))?$/);
+    if (!match) throw cliValidationError(`--expect entry "${part}" is not <id> or <id>:<fingerprint prefix>.`);
+    expect.set(Number(match[1]), match[2] ? match[2].toLowerCase() : "");
+  }
+  if (!expect.size) throw cliValidationError("--expect lists no teachers.");
+  return Object.fromEntries(expect);
+}
+
+/** Split the audit's new/changed teachers by --expect: what is sent, and what is not and why. */
+export function planExpectedReview(shown, expect) {
+  const send = [];
+  const notSent = [];
+  const seen = new Set();
+  for (const t of shown) {
+    seen.add(t.userId);
+    if (!(String(t.userId) in expect)) {
+      notSent.push({ userId: t.userId, reason: "new or changed now, but not in --expect: not reviewed" });
+      continue;
+    }
+    const prefix = expect[String(t.userId)];
+    if (prefix && !t.fingerprint.startsWith(prefix)) {
+      notSent.push({ userId: t.userId, reason: "changed since the fingerprint in --expect" });
+      continue;
+    }
+    send.push(t);
+  }
+  for (const id of Object.keys(expect)) {
+    if (!seen.has(Number(id))) notSent.push({ userId: Number(id), reason: "in --expect, but not new or changed in this audit" });
+  }
+  return { send, notSent };
+}
+
+const TEACHER_STATUS_ORDER = { unreviewed: 0, changed: 1, reviewed: 2, clean: 3 };
+
+/** Audit pages merged into one audit, in the server's owner order. */
+export function mergeTeacherAuditPages(pages) {
+  const teachers = pages.flatMap((page) => page.teachers || []);
+  teachers.sort(
+    (a, b) =>
+      (TEACHER_STATUS_ORDER[a.reviewStatus] ?? 9) - (TEACHER_STATUS_ORDER[b.reviewStatus] ?? 9) ||
+      (b.flags || []).length - (a.flags || []).length ||
+      Number(b.approvedAt) - Number(a.approvedAt),
+  );
+  const sum = (key) => pages.reduce((total, page) => total + Number(page[key] || 0), 0);
+  return {
+    teachers,
+    audited: sum("audited"),
+    flagged: sum("flagged"),
+    newlyFlagged: sum("newlyFlagged"),
+    changedSinceReview: sum("changedSinceReview"),
+    reviewedUnchanged: sum("reviewedUnchanged"),
+    failedUserIds: pages.flatMap((page) => page.failedUserIds || []),
+    nextCursor: null,
+    pages: pages.length,
+  };
+}
+
+/** The teachers an --all-flagged review sends: those the audit showed as new or changed. */
+export function teachersToReview(teachers) {
+  return (teachers || [])
+    .filter((t) => t.reviewStatus === "unreviewed" || t.reviewStatus === "changed")
+    .map((t) => ({ userId: Number(t.account?.userId), fingerprint: t.fingerprint }))
+    .filter((t) => t.userId > 0 && /^[0-9a-f]{64}$/.test(String(t.fingerprint || "")));
+}
+
+const unwrapAdminData = (receipt) => {
+  if (!receipt || receipt.ok !== true) {
+    const error = new Error(receipt?.error?.message || "The API did not confirm the teacher audit request.");
+    error.code = receipt?.error?.code || "CLI_ADMIN_RECEIPT_INVALID";
+    throw error;
+  }
+  return receipt.data || {};
+};
+
+/**
+ * Multi-request teacher commands: `audit --all` (every page), `review <id>`
+ * (show the entry, then send its fingerprint) and `review --all-flagged`
+ * (page the audit, print it, then send what it showed as new or changed, in
+ * bounded batches).
+ */
+export async function runTeacherWorkflow({ options, operation, authToken, requestId, request = requestJson, print = !options.json }) {
+  const call = (method, requestPath, body, key) =>
+    request({
+      method,
+      url: `${options.apiUrl}${requestPath}`,
+      authToken,
+      body,
+      headers: key ? { "x-lumine-idempotency-key": key } : {},
+      timeoutMs: Math.max(120000, Number(options.timeoutMs) || 0),
+    }).then(unwrapAdminData);
+  const auditAll = async () => {
+    const pages = [];
+    let cursor = "";
+    for (let i = 0; i < 200; i += 1) {
+      const page = await call("GET", withQuery("/cli/admin/teachers/audit", { limit: TEACHER_AUDIT_PAGE, cursor }));
+      pages.push(page);
+      if (!page.nextCursor) return mergeTeacherAuditPages(pages);
+      cursor = page.nextCursor;
+    }
+    throw new Error("The teacher audit did not finish paging; nothing was reviewed.");
+  };
+  if (operation.teacherWorkflow === "audit-all") {
+    return { ok: true, status: "success", data: await auditAll() };
+  }
+  if (operation.teacherWorkflow === "review-one") {
+    const { teacher } = await call("GET", `/cli/admin/teachers/${operation.userId}/audit`);
+    if (print) {
+      console.log("Reviewing this audit entry:");
+      printTeacherEntry(teacher, { full: true });
+      console.log("");
+    }
+    if (teacher?.evidenceGap) {
+      throw cliValidationError(`Not reviewed: ${teacher.evidenceGap}. Try again later.`);
+    }
+    const data = await call("POST", operation.path, { ...operation.body, fingerprint: teacher.fingerprint }, requestId);
+    // the entry was printed above; it is never returned (the receipt stays minimal)
+    return { ok: true, status: "success", data };
+  }
+  if (operation.teacherWorkflow === "review-flagged") {
+    const audit = await auditAll();
+    if (print) {
+      printApprovalResult({ operation: { name: "teachers.audit" }, data: audit });
+      console.log("");
+    }
+    const { send: shown, notSent } = planExpectedReview(teachersToReview(audit.teachers), operation.expect || {});
+    const total = { reviewed: [], skipped: [...notSent], changedSinceYouLooked: [] };
+    for (let i = 0; i < shown.length; i += TEACHER_REVIEW_BATCH) {
+      const batch = shown.slice(i, i + TEACHER_REVIEW_BATCH);
+      let data;
+      try {
+        data = await call("POST", operation.path, { note: operation.body.note, teachers: batch }, `${requestId}:${i / TEACHER_REVIEW_BATCH}`);
+      } catch (error) {
+        console.error(`Stopped at batch ${i / TEACHER_REVIEW_BATCH + 1}: ${total.reviewed.length} reviewed before it. ${error.message}`);
+        throw error;
+      }
+      total.reviewed.push(...(data.reviewed || []));
+      total.skipped.push(...(data.skipped || []));
+      total.changedSinceYouLooked.push(...(data.changedSinceYouLooked || []));
+    }
+    return {
+      ok: true,
+      status: "success",
+      data: {
+        decision: "legit",
+        note: operation.body.note,
+        ...total,
+        reviewedCount: total.reviewed.length,
+        sent: shown.length,
+        audited: audit.audited,
+        flagged: audit.flagged,
+      },
+    };
+  }
+  throw new Error(`Unknown teacher workflow ${operation.teacherWorkflow}`);
+}
+
 // Builds the operation for list/show/approve/reject/revoke. `fixedType` is set
 // by the per-type aliases; `listStatuses` keeps their own --status choices.
 function buildReviewRequestOperation({
@@ -1021,6 +1259,13 @@ export async function adminCommand(options) {
         runId,
         parseTarget: parseRecommendationTarget,
       });
+    } else if (operation.teacherWorkflow) {
+      result = await runTeacherWorkflow({
+        options,
+        operation,
+        authToken: auth.token,
+        requestId,
+      });
     } else if (operation.name.startsWith("runtime-logs.")) {
       result = await runAdminRuntimeLogWorkflow({
         options,
@@ -1068,7 +1313,8 @@ export async function adminCommand(options) {
       }
       result = transformResult(await fetchOperation());
     }
-    mutationIntent?.confirm(result);
+    // private evidence is printed, never kept in the receipt file
+    mutationIntent?.confirm(receiptToKeep(operation, result));
   } catch (error) {
     if (operation.name === "runtime.evidence" && error.status === 404) {
       error.code = "CLI_ADMIN_RUNTIME_EVIDENCE_NOT_DEPLOYED";
@@ -2337,7 +2583,7 @@ export function parseAdminOperation(options) {
     // reviews as the admin controls on the website quest page. Mikey's own
     // decision, any time, never in a daily run.
     const usage =
-      "Usage: lumine admin meetup list [--status review|active|completed|all] | approve-crew <crewId> | approve-grownup <crewId> | emails [list|send <id>|discard <id>|review on|off] | friends [status|on|off] | parent-reply <crewId> <memberUserId> --note <text> | funnel [--days <1-90>] | branches [list|show|approve|reject|merge] | show <crewId> | approve-plan <crewId> [--note <text>] | send-back <crewId> --note <text> | approve <crewId> --attended <userId,userId,...> [--note <text>] | slot <crewId> --confirm <slotIndex> | resend-email <crewId>.";
+      "Usage: lumine admin meetup list [--status review|active|completed|all] | approve-crew <crewId> | approve-grownup <crewId> | emails [list|send <id>|discard <id>|review on|off] | friends [status|on|off] | parent-reply <crewId> <memberUserId> --note <text> | funnel [--days <1-90>] | branches [list|show|approve|reject|merge] | show <crewId> | approve-plan <crewId> [--note <text>] | send-back <crewId> --note <text> | approve <crewId> --attended <userId,userId,...> [--note <text>] | info <crewId> <userId> --decision ask|accept|ask-again|withdraw [--note <text>] | slot <crewId> --confirm <slotIndex> | resend-email <crewId>.";
     const note = String(options.note || "").trim();
     if (note.length > 1000) {
       throw cliValidationError("--note must be at most 1000 characters.");
@@ -2502,6 +2748,29 @@ export function parseAdminOperation(options) {
         { requiresRun: false },
       );
     }
+    if (action === "info") {
+      // Staff's "who are you" check on a member (ruled 2026-10-07): the member
+      // gives their teacher's name and class name (or how they know the crew)
+      // on the crew page; the crew waits until you accept. Nobody is contacted.
+      const crewId = parseRequiredInteger(target, "Crew ID", 1);
+      const memberId = parseRequiredInteger(extra, "Member user ID", 1);
+      const decision = parseChoice(options.adminDecision || "", "--decision", [
+        "ask",
+        "accept",
+        "ask-again",
+        "withdraw",
+      ]);
+      if (decision === "ask-again" && !note) {
+        throw cliValidationError("--decision ask-again needs --note <what to tell the member>.");
+      }
+      return writeOperation(
+        "meetup.info",
+        "POST",
+        `/cli/admin/meetup-quest/crews/${crewId}/members/${memberId}/info-check`,
+        { action: decision === "ask" ? "request" : decision, note },
+        { requiresRun: false },
+      );
+    }
     if (action === "approve-crew" || action === "approve-grownup") {
       // Every step passes through the owner: the crew (members + branches) and
       // the grown-up step (parents' yes + the named adult).
@@ -3627,6 +3896,11 @@ export function parseAdminOperation(options) {
     );
   }
 
+  // A member's public profile for review (admin-profile.js); a daily-run read.
+  if (namespace === "profile") {
+    return buildProfileShowOperation({ action, target, extra });
+  }
+
   if (namespace === "notable" && action === "status" && !extra) {
     const rawTarget = String(target || "").trim();
     if (!rawTarget) {
@@ -5465,7 +5739,7 @@ function formatMeetupMembers(members) {
   return (members || [])
     .map(
       (member) =>
-        `${member.username || `user ${member.userId}`} (${member.userId}, ${member.branch || "no branch"}${member.parentOk === undefined ? "" : member.parentOk ? ", parent OK" : ", parent not yet"}${member.attended ? ", attended" : ""})`,
+        `${member.username || `user ${member.userId}`} (${member.userId}, ${member.branch || "no branch"}${member.parentOk === undefined ? "" : member.parentOk ? ", parent OK" : ", parent not yet"}${member.attended ? ", attended" : ""}${member.infoCheck === "requested" ? ", details asked" : member.infoCheck === "answered" ? ", ANSWERED: review" : ""})`,
     )
     .join("; ");
 }
@@ -5480,6 +5754,17 @@ function printMeetupCrew(crew) {
     console.log(`  ${step.number}. ${step.label} [${step.state}] ${step.detail}`);
   }
   console.log(`  Members: ${formatMeetupMembers(crew.members)}`);
+  // staff's "who are you" checks on these members (any crew), newest first
+  for (const check of crew.memberChecks || []) {
+    const answer = check.teacherName
+      ? `teacher "${check.teacherName}", class "${check.className}"`
+      : check.relationship
+        ? `how they know the crew: "${check.relationship}"`
+        : "no answer yet";
+    console.log(
+      `  Who-are-you check #${check.checkId} · ${check.username} (${check.userId}) · crew #${check.crewId} · ${check.status}${check.askNote ? ` · asked: "${check.askNote}"` : ""} · ${answer}${check.reviewedBy ? ` · ${check.status} by ${check.reviewedBy}` : ""}${check.staffNote ? ` · note: ${check.staffNote}` : ""}`,
+    );
+  }
   for (const parent of crew.parentContacts || []) {
     console.log(
       `  Parent of ${parent.childUsername}: ${parent.status}${parent.verifiedGuardian ? " (guardian on file)" : parent.staffVerified ? " (staff verified)" : " (child-typed address: NOT verified)"} · ${parent.email}${parent.question ? ` · asks: "${parent.question}"` : ""}`,
@@ -5624,11 +5909,21 @@ function printMeetupResult({ operation, data, result }) {
     }
     if (crews.some((crew) => crew.waitingFor)) {
       console.log(
-        "Review: lumine admin meetup show <crewId>, then approve-crew | approve-plan | approve-grownup | send-back --note | approve --attended <ids> (classroom plans: approve at the headmaster desk with a room and times).",
+        "Review: lumine admin meetup show <crewId>, then approve-crew | approve-plan | approve-grownup | send-back --note | approve --attended <ids> | info <crewId> <userId> --decision accept|ask-again (a member's who-are-you answer) (classroom plans: approve at the headmaster desk with a room and times).",
       );
     }
     return;
   }
+  if (operation.name === "meetup.info") {
+    const status = data.result?.status;
+    console.log(
+      result?.changed === false
+        ? `Member ${data.result?.userId} already has an open question (${status}).`
+        : `Member ${data.result?.userId} on crew #${data.result?.crewId}: ${status === "requested" ? "asked (their crew page now asks for their teacher and class, or how they know the crew)" : status}.`,
+    );
+    if (data.crew) printMeetupCrew(data.crew);
+    return;
+  }
   if (operation.name === "meetup.show" || operation.name === "meetup.parent-reply") {
     printMeetupCrew(data.crew || {});
     return;
@@ -5861,6 +6156,39 @@ function printEvidence(evidence) {
   if (evidence.note) console.log(evidence.note);
 }
 
+const TEACHER_REVIEW_LABELS = {
+  unreviewed: "NEW: flagged, not reviewed",
+  changed: "CHANGED since review",
+  reviewed: "reviewed, unchanged",
+  clean: "no flags",
+};
+
+export function formatTeacherAuditSummary(data) {
+  return `Audited ${data.audited || 0} approved teachers · ${data.flagged || 0} flagged: ${data.newlyFlagged || 0} new, ${data.changedSinceReview || 0} changed since review, ${data.reviewedUnchanged || 0} reviewed and unchanged${data.failedUserIds?.length ? ` · evidence failed for ${data.failedUserIds.map((id) => `#${id}`).join(", ")}` : ""}${data.moreTeachersNotRead ? " · older teachers not read (raise --limit)" : ""}`;
+}
+
+export function formatTeacherReviewLine(teacher) {
+  const a = teacher.account || {};
+  const r = teacher.review;
+  const status = TEACHER_REVIEW_LABELS[teacher.reviewStatus] || teacher.reviewStatus || "?";
+  const reviewed = r
+    ? ` · last review ${r.decision} ${approvalDate(r.reviewedAt)} by ${r.reviewedBy}${r.note ? `: "${r.note}"` : ""}`
+    : "";
+  const flags = (teacher.flags || []).length ? ` · flags ${teacher.flags.join(", ")}` : "";
+  return `[${status}] ${a.username || "?"} (#${a.userId})${flags}${reviewed}`;
+}
+
+// One audit entry: reviewed-unchanged teachers are one line (already judged);
+// the rest show what changed, the evidence and the fingerprint a review sends.
+function printTeacherEntry(teacher, { full = false } = {}) {
+  console.log(formatTeacherReviewLine(teacher));
+  if (teacher.reviewStatus === "reviewed" && !full) return;
+  for (const change of teacher.review?.changes || []) console.log(`  changed: ${change}`);
+  if (teacher.evidenceGap) console.log(`  cannot be reviewed now: ${teacher.evidenceGap}`);
+  printEvidence(teacher);
+  if (teacher.fingerprint) console.log(`Fingerprint: ${teacher.fingerprint}`);
+}
+
 function printApprovalResult({ operation, data }) {
   if (operation.name === "approvals.list") {
     const items = data.items || [];
@@ -5887,12 +6215,35 @@ function printApprovalResult({ operation, data }) {
     return;
   }
   if (operation.name === "teachers.audit") {
-    console.log(
-      `Audited ${data.audited || 0} approved teachers · ${data.flagged || 0} with flags (riskiest first).`,
-    );
+    console.log(formatTeacherAuditSummary(data));
     for (const teacher of data.teachers || []) {
       console.log("");
-      printEvidence(teacher);
+      printTeacherEntry(teacher);
+    }
+    if (data.nextCursor) console.log(`\nMore teachers: --cursor ${data.nextCursor}, or --all for every page.`);
+    return;
+  }
+  if (operation.name === "teachers.review") {
+    console.log(
+      `Reviewed #${data.teacherUserId} as ${data.decision} (fingerprint ${String(data.fingerprint || "").slice(0, 12)}; flags ${(data.flags || []).join(", ") || "none"}). Note kept: ${data.note}`,
+    );
+    if (data.revoked) {
+      console.log(
+        `Teacher status removed (achievements ${(data.revoked.removedAchievementIds || []).join(", ") || "-"}; request #${data.revoked.approvalItemId ?? "-"} marked rejected).`,
+      );
+    }
+    return;
+  }
+  if (operation.name === "teachers.review_flagged") {
+    console.log(
+      `Reviewed ${data.reviewedCount || 0} of the ${data.sent || 0} expected new or changed flagged teacher(s) shown above as legit (${data.flagged || 0} flagged, ${data.audited || 0} audited). Note: ${data.note}`,
+    );
+    for (const r of data.reviewed || []) {
+      console.log(`  - ${r.username || "?"} (#${r.teacherUserId}) · was ${r.previousStatus}`);
+    }
+    for (const s of data.skipped || []) console.log(`  skipped #${s.userId}: ${s.reason}`);
+    if ((data.changedSinceYouLooked || []).length) {
+      console.log(`  Changed since the audit above (not reviewed; audit again): ${data.changedSinceYouLooked.map((id) => `#${id}`).join(", ")}`);
     }
     return;
   }
@@ -6098,6 +6449,15 @@ function printRewardBankReport(data) {
 function printAdminResult({ operation, result }) {
   const data = result?.data || {};
   if (printChatSafetyResult({ operation, data })) return;
+  const chatReportLines = formatChatReportResult({ operation, data });
+  if (chatReportLines) {
+    for (const line of chatReportLines) console.log(line);
+    return;
+  }
+  if (operation.name === "profile.show") {
+    for (const line of formatProfileReview(data)) console.log(line);
+    return;
+  }
   if (operation.name === "reward-activity.report") {
     printRewardActivity(data);
     return;
@@ -6348,7 +6708,9 @@ function printAdminResult({ operation, result }) {
     console.log(`Checkpoint: ${data.batch.checkpointPath}`);
     return;
   }
-  if (data.report) {
+  // A daily-run report; other operations' `report` (chat reports) are
+  // printed above and must never reach this branch.
+  if (data.report?.run) {
     const report = data.report;
     const historical = report.basis?.kind === "historical_reconstruction";
     console.log(

package/lib/api.js

@@ -530,6 +530,24 @@ export async function adoptBuildTitleSuggestion({
   });
 }
 
+// The owner passing on one teammate suggestion (branch updates, thumbnail or
+// name): the card settles as declined for both sides and leaves the inbox.
+export async function declineBuildOwnerSuggestion({
+  options,
+  auth,
+  rootBuildId,
+  contributionBuildId,
+  suggestionMessageId,
+}) {
+  return await requestJson({
+    method: "POST",
+    url: `${options.apiUrl}/build/${rootBuildId}/contributions/${contributionBuildId}/decline-suggestion`,
+    authToken: auth.token,
+    body: { suggestionMessageId },
+    timeoutMs: options.timeoutMs,
+  });
+}
+
 export async function mergeContributionIntoMain({
   options,
   auth,

package/lib/commands.js

@@ -23,6 +23,7 @@ import {
 import {
   adoptBuildThumbnailSuggestion,
   adoptBuildTitleSuggestion,
+  declineBuildOwnerSuggestion,
   createBuild,
   fetchAllRuntimeAssets,
   forkBuild,
@@ -764,11 +765,50 @@ export async function suggestions(options) {
     return;
   }
 
+  if (action === "decline") {
+    const description = describeSuggestionForDecline(suggestion);
+    if (!options.assumeYes) {
+      const confirmed = await confirmPrompt(
+        `Decline suggestion #${suggestionId} (${description}) on Build #${rootBuildId}? [y/N] `,
+      );
+      if (confirmed === null) {
+        console.log("Not a TTY — re-run with --yes to decline the suggestion.");
+        return;
+      }
+      if (!confirmed) {
+        console.log("Aborted. Suggestion left open.");
+        return;
+      }
+    }
+    await declineBuildOwnerSuggestion({
+      options,
+      auth,
+      rootBuildId,
+      contributionBuildId,
+      suggestionMessageId: suggestionId,
+    });
+    console.log(
+      `Declined suggestion #${suggestionId} (${description}) on Build #${rootBuildId}.`,
+    );
+    return;
+  }
+
   throw new Error(
-    "Usage: lumine suggestions [build] | lumine suggestions merge|replace-main|adopt-thumbnail|adopt-title <suggestion-id> [--build <id>]",
+    "Usage: lumine suggestions [build] | lumine suggestions merge|replace-main|adopt-thumbnail|adopt-title|decline <suggestion-id> [--build <id>]",
   );
 }
 
+function describeSuggestionForDecline(suggestion) {
+  if (suggestion.type === "title") {
+    return `name "${suggestion.suggestedTitle}"`;
+  }
+  if (suggestion.type === "thumbnail") return "thumbnail";
+  const branchNumber = Number(suggestion.branchNumber || 0);
+  return branchNumber
+    ? `updates from branch ${branchNumber}`
+    : `updates from branch #${suggestion.branchBuildId}`;
+}
+
 async function resolveSuggestionRootBuildId(options, auth) {
   const requestedBuildId = options.buildIdFlag
     ? resolveRequiredBuildId(options.buildIdFlag)
@@ -827,6 +867,9 @@ export function printBuildSuggestions({
       console.log(
         `  replace: lumine suggestions replace-main ${suggestionId} --build ${rootBuildId}`,
       );
+      console.log(
+        `  decline: lumine suggestions decline ${suggestionId} --build ${rootBuildId}`,
+      );
       continue;
     }
     if (suggestion.type === "title") {
@@ -838,6 +881,9 @@ export function printBuildSuggestions({
       console.log(
         `  apply: lumine suggestions adopt-title ${suggestionId} --build ${rootBuildId}`,
       );
+      console.log(
+        `  decline: lumine suggestions decline ${suggestionId} --build ${rootBuildId}`,
+      );
       continue;
     }
     console.log(
@@ -850,6 +896,9 @@ export function printBuildSuggestions({
     console.log(
       `  apply: lumine suggestions adopt-thumbnail ${suggestionId} --build ${rootBuildId}`,
     );
+    console.log(
+      `  decline: lumine suggestions decline ${suggestionId} --build ${rootBuildId}`,
+    );
   }
   if (hasMore && nextCursor > 0) {
     console.log(
@@ -2384,6 +2433,7 @@ export function parseArgs(args) {
     "perf",
     "includeLegacy",
     "includePrivateEvidence",
+    "allFlagged",
     "reviewed",
     "noReviewLoop",
     "acceptAgreement",
@@ -2428,6 +2478,7 @@ export function parseArgs(args) {
     "replace-main",
     "adopt-thumbnail",
     "adopt-title",
+    "decline",
   ]);
   const suggestionAction =
     command === "suggest"
@@ -2505,6 +2556,9 @@ export function parseArgs(args) {
       false,
     ),
     adminAll: Boolean(raw.all),
+    adminAllFlagged: Boolean(raw.allFlagged),
+    adminFingerprint: raw.fingerprint ? String(raw.fingerprint) : "",
+    adminExpect: raw.expect ? String(raw.expect) : "",
     adminResume: Boolean(raw.resume),
     adminCheckpoint: raw.checkpoint ? String(raw.checkpoint) : "",
     adminOutput: raw.output ? String(raw.output) : "",
@@ -2966,6 +3020,7 @@ export function printHelp() {
   lumine suggestions replace-main <suggestion-id> [--build <id>]
   lumine suggestions adopt-thumbnail <suggestion-id> [--build <id>] [--yes]
   lumine suggestions adopt-title <suggestion-id> [--build <id>] [--yes]
+  lumine suggestions decline <suggestion-id> [--build <id>] [--yes]
   lumine explore [search terms]
   lumine select [twinkle-build-url]
   lumine pull [twinkle-build-url]
@@ -3030,12 +3085,13 @@ export function printHelp() {
   lumine admin sponsor integrity review <case-id> --decision clear|hold|flag|disqualify [--note <evidence>] [--json]
   lumine admin review list [--type rewards|project|storage|cardcraft] [--status queue|pending|approved|rejected|all] [--cursor <c>] | show <type:id> [--dir <path>] | approve <type:id> [--config <rules.json>] [--size <500MB|1GB|2GB|n MB>] [--reason <text>] | reject|revoke <type:id> [--reason <text>] | propose rewards:<id> --dir <edited-snapshot> --config <rules.json>
   lumine admin approvals list [--status pending|approved|rejected|all] [--type dob|mentor|meetup] | show <id> | approve <id> [--reason <text>] | reject <id> [--reason <text>] | supermod <id> [--reason <text>]   (management approvals with evidence: birthdates, teacher signups, meetups)
-  lumine admin teachers audit [--limit <1-100>] | revoke <userId> --reason <text>   (approved teachers, riskiest first; revoke removes the status cleanly)
+  lumine admin teachers audit [--limit <1-100>] [--cursor <c>] [--all] | revoke <userId> --reason <text>   (approved teachers, a page at a time or --all: new flags first, then changed since your review; revoke removes the status cleanly)
+  lumine admin teachers review <userId> --decision legit|revoke --note <text> [--fingerprint <fp>, required for revoke] | review --all-flagged --expect <id[:fp],...> --note <text>   (record your review of the facts shown; --all-flagged records only the --expect teachers; nothing is recorded if they changed since. A reviewed teacher comes back when its flags or linked accounts change; accounts sharing a network count only when they change a network flag)
   lumine admin english import <verdicts.json> --pass a|b | adjudicate <file> | add-questions <file> | relevel <file> | mastery <userId> --reason <why> | backfill-distractors | summary | review [--limit <n>] | accept|retire <questionId> | retag <questionId> --skill <code>   (English skill tags and bank upkeep for Grammarbles; content written by Claude Code agents)
   lumine admin reward-review list [--status pending|approved|all] [--cursor <id>] [--json]
   lumine admin cardcraft-review list [--status pending|approved|all] [--cursor <id>] | show <id> | approve|reject|revoke <id> [--reason <text>]
   lumine admin storage list [--status pending|approved|rejected|all] [--cursor <id>] | show <user-id-or-username> | approve <request-id> [--size <500MB|1GB|2GB|n MB>] [--reason <text>] | reject <request-id> [--reason <text>] | grant <user-id-or-username> --size <500MB|1GB|2GB|n MB> [--reason <text>]
-  lumine admin meetup list [--status review|active|completed|all] | approve-crew <crewId> | approve-grownup <crewId> | emails [list|send <id>|discard <id>|review on|off] | friends [status|on|off] | parent-reply <crewId> <memberUserId> --note <text> | funnel [--days <1-90>] | branches [list [--status pending|official|rejected|all] | show <id> | approve <id> | reject <id> [--note <text>] | merge <id> --into <officialId>] | show <crewId> | approve-plan <crewId> [--note <text>] | send-back <crewId> --note <text> | approve <crewId> --attended <userId,userId,...> [--note <text>] | slot <crewId> --confirm <slotIndex> | resend-email <crewId>   (Bridge Builder meetup quest)
+  lumine admin meetup list [--status review|active|completed|all] | approve-crew <crewId> | approve-grownup <crewId> | emails [list|send <id>|discard <id>|review on|off] | friends [status|on|off] | parent-reply <crewId> <memberUserId> --note <text> | funnel [--days <1-90>] | branches [list [--status pending|official|rejected|all] | show <id> | approve <id> | reject <id> [--note <text>] | merge <id> --into <officialId>] | show <crewId> | approve-plan <crewId> [--note <text>] | send-back <crewId> --note <text> | approve <crewId> --attended <userId,userId,...> [--note <text>] | info <crewId> <userId> --decision ask|accept|ask-again|withdraw [--note <text>] | slot <crewId> --confirm <slotIndex> | resend-email <crewId>   (Bridge Builder meetup quest)
   lumine admin meetup story list | show <crewId> | approve <crewId> [--note <text>] [--no-announce] | send-back <crewId> --note <text> | unpublish <crewId> --note <text>   (Bridge Builder story pages: publishes only what every tagged member's parent allowed)
   lumine admin reward-activity [--date YYYY-MM-DD] [--days <1..31>] [--build <id>] [--json]
   lumine admin chat-reports list [--status pending|open|reviewing|resolved|dismissed|all] [--cursor <id>] [--json]
@@ -3109,6 +3165,7 @@ export function printHelp() {
   lumine admin news claim [--date YYYY-MM-DD] [--output <claim.json>] [--scaffold <editorial.json>] [--json]
   lumine admin news validate --claim <claim.json> --file <editorial.json> [--json]
   lumine admin news submit --claim <claim.json> --file <editorial.json> [--model <name>] [--json]
+  lumine admin profile show <user-id|username> [--json]   (public profile for review: rank, bio, counts, recent posts; daily-run read)
   lumine admin notable status <user-id|username> [--json]
   lumine admin notable add <user-id|username> --note <text> [--json]
   lumine admin notable remove <user-id|username> --note <text> [--json]

package/lib/constants.js

@@ -238,8 +238,9 @@ lumine save --summary "Describe the change"
 - On an owned canonical team project, \`lumine suggestions\` lists the owner's
   currently open branch, thumbnail and name suggestions. Act on the exact
   suggestion id it prints with \`lumine suggestions merge\`, \`replace-main\`,
-  \`adopt-thumbnail\` or \`adopt-title\`; do not infer an action from stale
-  local branch state.
+  \`adopt-thumbnail\`, \`adopt-title\` or \`decline\`; do not infer an action
+  from stale local branch state. Decline only when the user asks to pass on
+  that suggestion.
 
 ## Assets (Runtime Media)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage5/lumine",
-  "version": "0.3.17",
+  "version": "0.3.19",
   "description": "Command line tools for launching Lumine builds on Twinkle.",
   "type": "module",
   "bin": {

package/sdk/BUILD_SDK_INDEX.md

@@ -2,7 +2,7 @@
 
 Version: 1.63.0
 Updated: 2026-09-28
-Generated: 2026-10-06T10:12:09.371Z
+Generated: 2026-10-07T07:52:06.040Z
 
 ## Notes
 - This SDK is injected into Build iframes via the Build preview/runtime.
@@ -257,6 +257,7 @@ files:read, media:read, media:write, live:read, live:write, user:read, users:rea
   - title/body are accepted as aliases for label/summary.
   - target is accepted as a backwards-compatible alias for launchTarget.
   - Twinkle applies app API rate limits, a stricter notification emit rate limit, and existing notification mutes.
+  - Twinkle shows the acting member's username right before `summary` in the notification row, so write `summary` as a predicate ('posted in Lobby', 'responded to the Twinkle Newspaper'), never starting with the member's name (otherwise it reads 'Liki Liki responded…').
   - Example: await Twinkle.notifications.notifySubscribers('room.message', { targetKey: 'room:lobby', eventKey: 'room.message.created', label: 'Room messages', summary: 'posted in Lobby', launchTarget: { view: 'room', roomId: 'lobby', messageId } });
 - async getSubjectUpdateSubscription(subjectId) | scopes: notifications:read
   - Returns: { subscription }

package/sdk/LUMINE_ADMIN.md

@@ -1174,8 +1174,10 @@ Birthdate, teacher-signup (`mentor`) and meetup-achievement requests, each with
 lumine admin approvals list [--status pending|approved|rejected|all] [--type dob|mentor|meetup]
 lumine admin approvals show <id>
 lumine admin approvals approve|reject <id> [--reason <text>]
-lumine admin teachers audit [--limit 1-100]
+lumine admin teachers audit [--limit 1-100] [--cursor <c>] [--all]
 lumine admin teachers revoke <userId> --reason <text>
+lumine admin teachers review <userId> --decision legit|revoke --note <text> [--fingerprint <fp>]   # revoke requires --fingerprint
+lumine admin teachers review --all-flagged --expect <id[:fp],...> --note <text>
 lumine admin identity network <userId|username> --reason <text> [--include-private-evidence]
 ```
 
@@ -1191,7 +1193,14 @@ lumine admin identity network <userId|username> --reason <text> [--include-priva
 - `linked_account_is_minor`, `own_birthdate_is_minor`, `new_account_with_linked_accounts`, `real_name_differs_from_profile`, `banned_account_in_family`.
 
 - Flags are pointers, not verdicts: a school device can link strangers. Judge each case, recommend, and act only on Mikey's decision.
-- `teachers audit` lists approved teachers, riskiest first.
+- `teachers audit` reads approved teachers a page at a time (newest approval first, up to 100 per page; `--cursor` continues, `--all` pages through every teacher). Each page lists, in this order: flagged and never reviewed (`NEW`), reviewed but materially changed since (`CHANGED`, each change listed), reviewed and unchanged (one line, no evidence), then teachers with no flags. `--all` merges the pages in that order. Counts: `audited`, `flagged`, `newlyFlagged`, `changedSinceReview`, `reviewedUnchanged`. Each entry carries its `fingerprint`.
+- `teachers review` records Mikey's review (added 2026-10-07) of the facts he was shown. The fingerprint covers the flag set and the linked accounts (who, linked how, and whether each has a recorded age under 14 or under 18). Activity, last-active time, addresses and shared-device counts are not part of it. **Accounts that only share a network with the teacher count only when they change a network flag** (`shares_small_network_with_…`): a new sibling on a home address that already raised the member flag does not reopen a review, by design, because network sharers churn. The latest review per teacher wins; a teacher reappears when those facts change, or when a teacher reviewed as `revoke` holds the status again.
+  - `review <userId>` reads and prints that teacher's current entry, then sends its fingerprint; `--fingerprint <fp>` sends the one from the audit Mikey read instead. If the facts changed since, nothing is recorded (409: read it again).
+  - `--decision legit` keeps the teacher. `--decision revoke` **requires `--fingerprint`** from the entry Mikey decided on, then runs the same clean removal as `teachers revoke` (the note is its reason) and records the review.
+  - `--all-flagged --expect <id[:fp],...>` pages the whole audit, prints it, and reviews as legit, with one note, only the `--expect` teachers that it shows as new or changed. Give each as `id:<fingerprint prefix>` (8+ hex from the audit Mikey read) to pin the facts he judged. Anything else is listed and not reviewed: new or changed but not expected; expected but its fingerprint moved; expected but not new or changed now. The server also skips, and lists, any whose facts changed between the printed audit and the write, whose last review was a revoke, or whose evidence is incomplete. Sent in batches of 25.
+  - The write receipts these leave on disk hold only the decision (teacher id, decision, fingerprint, time, note); the evidence is printed, never saved.
+  - Incomplete evidence is never compared or recorded: unread network evidence, or a linked-account family truncated at the identity inspection's cap. Such a teacher keeps showing until the evidence reads in full.
+  - Record a review only on Mikey's decision for those accounts.
 - `teachers revoke` removes a teacher status cleanly:
   - the mentor achievement, plus the teenager/adult achievements the teacher approval gave unless a separately approved birthdate supports them;
   - the teacher title and the public "unlocked" posts;
@@ -3294,6 +3303,7 @@ lumine admin brief --days 3 --json
 lumine admin ai-costs monthly --json
 lumine admin media-costs monthly --json
 lumine admin notable status Stealth --json
+lumine admin profile show Stealth            # public profile for the candidate check
 lumine admin notable add 12647 --note "Top authored-activity kid of the window: 11 subjects, 61 comments." --json
 lumine admin notable add Minecrarft_guy --note "Helped three new builders debug their projects and gave detailed feedback on five posts." --json
 ```
@@ -3870,8 +3880,9 @@ farm-signal sections added that day; AI Card summon watch added 2026-08-24):
   re-read its canonical members. This duty applies even when no group crossed
   three cards, because the new enforcement prevents already-bucketed siblings
   from producing an over-limit row.
-- `notableCandidates` — kids (never bots, staff `userType`s, or users already
-  on the Notable Users list) ranked by authored activity in the window, with
+- `notableCandidates` — kids (never bots, staff `userType`s, approved teachers
+  — anyone holding the mentor or sage achievement — or users already on the
+  Notable Users list) ranked by authored activity in the window, with
   `isNewUser` marking window-new signups. Use it to find the overlooked and
   rising users the editorial priorities exist for, and propose additions to
   Mikey's Notable Users list in the report. When Mikey approves additions,
@@ -3888,6 +3899,14 @@ farm-signal sections added that day; AI Card summon watch added 2026-08-24):
   canonical writer and returns only the resolved public account identity,
   current membership, and the roster rationale/timestamps when present; it
   does not expose the private roster fields.
+  Before proposing a candidate, read their profile with
+  `lumine admin profile show <userId|username> [--json]` (a daily-run read,
+  like `brief`): username, real name as the public profile shows it, join and
+  last-active dates, rank/XP/title/achievements, status and bio lines, counts
+  (subjects, comments, AI stories, public builds, shared reflections) and
+  their latest ten of each with dates, excerpts and links. It serves the
+  profile as a signed-out visitor sees it: no emails, no secret answers, no
+  unshared reflections, and only comments on public surfaces.
   When Mikey authorizes removal, use `lumine admin notable remove <userId|username> --note "<why removed>" --json`. It is run-independent, transactionally audited as `notable.remove`, verifies canonical absence, and is idempotent. Never use SQL to work around a missing CLI verb. Mikey is the administrator, not a Notable candidate; do not include him in blanket roster additions.
   **Always pass `--note`** with a concrete one-or-two-sentence record of what
   made them notable — real numbers and specifics from the brief window, not
@@ -4045,6 +4064,9 @@ type InsightsBrief = Success<{
     isNewUser: boolean;
     lastActive: number | null;
   }>;
+  // Approved teachers that would otherwise have ranked into the list; counts
+  // only those met while filling it, not every active teacher.
+  notableCandidateTeachersExcluded: number;
   teachers: {
     genuinelyInterested: TeacherInsight[];
     workOnly: TeacherInsight[];