diff --git a/apps/api/scripts/prune-spam.ts b/apps/api/scripts/prune-spam.ts
index dbacc9e..e7cfc31 100644
--- a/apps/api/scripts/prune-spam.ts
+++ b/apps/api/scripts/prune-spam.ts
@@ -1,23 +1,30 @@
 /**
  * prune-spam.ts — Re-runnable spam-prune operator script.
  *
- * Reads spam verdicts from the `spam-detection` branch of the data repo,
- * aggregates them per the spec rule, and removes confident-spam people from
- * the `published` branch with cascaded deletes of their associated records.
+ * Reads machine spam verdicts from the private spam-detection repo and staff
+ * `human-*` votes from the data repo's served branch, aggregates them per the
+ * spec rule (a human vote is final), and removes spam people from the
+ * `published` branch with cascaded deletes of their associated records.
  *
  * Spec: specs/behaviors/spam-exclusion.md
  *
  * Usage:
  *   npm run -w apps/api script:prune-spam -- \
- *     --data-repo=/path/to/codeforphilly-data \
- *     [--evaluations-ref=spam-detection] \
+ *     --data-repo=/path/to/codeforphilly-data.git \
+ *     --evaluations-repo=/path/to/codeforphilly-spam-detection \
+ *     [--evaluations-ref=HEAD] \
+ *     [--human-votes-ref=published] \
  *     [--branch=published] \
  *     [--threshold=0.8] \
  *     [--dry-run] [--verbose]
  *
  *   --data-repo        Path to a local bare clone of the data repo.
  *                      Falls back to $CFP_DATA_REPO_PATH.
- *   --evaluations-ref  Ref to read person-evaluations from (default: spam-detection).
+ *   --evaluations-repo Repo (bare or not) holding machine person-evaluations —
+ *                      the private codeforphilly-spam-detection clone. Defaults
+ *                      to --data-repo for single-repo setups.
+ *   --evaluations-ref  Ref in --evaluations-repo to read (default: HEAD).
+ *   --human-votes-ref  Ref in --data-repo carrying staff votes (default: --branch).
  *   --branch           Branch to prune (default: published).
  *   --threshold        Spam confidence threshold (default: 0.8).
  *   --dry-run          Report without writing.
@@ -43,7 +50,11 @@ import type {
 
 interface CliArgs {
   readonly dataRepo: string;
+  /** Repo holding the machine evaluations (the private spam-detection clone). Defaults to dataRepo. */
+  readonly evaluationsRepo: string;
   readonly evaluationsRef: string;
+  /** Ref in dataRepo carrying staff `human-*` votes. Defaults to --branch. */
+  readonly humanVotesRef: string;
   readonly branch: string;
   readonly threshold: number;
   readonly dryRun: boolean;
@@ -73,16 +84,23 @@ function parseArgs(argv: readonly string[]): CliArgs {
   const threshold =
     typeof thresholdRaw === 'string' ? Number.parseFloat(thresholdRaw) : 0.8;
 
+  const branch =
+    typeof opts['branch'] === 'string' && opts['branch'] !== '' ? opts['branch'] : 'published';
   return {
     dataRepo: resolve(dataRepoRaw),
+    evaluationsRepo:
+      typeof opts['evaluations-repo'] === 'string' && opts['evaluations-repo'] !== ''
+        ? resolve(opts['evaluations-repo'])
+        : resolve(dataRepoRaw),
     evaluationsRef:
       typeof opts['evaluations-ref'] === 'string' && opts['evaluations-ref'] !== ''
         ? opts['evaluations-ref']
-        : 'spam-detection',
-    branch:
-      typeof opts['branch'] === 'string' && opts['branch'] !== ''
-        ? opts['branch']
-        : 'published',
+        : 'HEAD',
+    humanVotesRef:
+      typeof opts['human-votes-ref'] === 'string' && opts['human-votes-ref'] !== ''
+        ? opts['human-votes-ref']
+        : branch,
+    branch,
     threshold: Number.isFinite(threshold) ? threshold : 0.8,
     dryRun: opts['dry-run'] === true,
     verbose: opts['verbose'] === true,
@@ -94,22 +112,31 @@ function parseArgs(argv: readonly string[]): CliArgs {
 // ---------------------------------------------------------------------------
 
 interface PersonVerdict {
-  /** Whether any evaluator gave spam confidence >= threshold. */
+  /** Whether any machine evaluator gave spam confidence >= threshold. */
   hasConfidentSpam: boolean;
-  /** Whether any evaluator gave a legit verdict at any confidence. */
+  /** Whether any machine evaluator gave a legit verdict at any confidence. */
   hasAnyLegit: boolean;
+  /**
+   * The latest `human-*` verdict, if any. A human vote is final: `spam`
+   * prunes regardless of machine verdicts or project membership; `legit`
+   * keeps. Per specs/behaviors/spam-exclusion.md.
+   */
+  humanVerdict: string | null;
+  humanEvaluatedAt: string | null;
 }
 
 /**
- * Parse verdict and confidence from TOML content using line-regex
- * (tolerant, avoids pulling in a full TOML parser just for two fields).
+ * Parse verdict, confidence, and evaluatedAt from TOML content using
+ * line-regex (tolerant, avoids pulling in a full TOML parser for three fields).
  */
 function parseEvaluationRecord(tomlContent: string): {
   verdict: string | null;
   confidence: number | null;
+  evaluatedAt: string | null;
 } {
   let verdict: string | null = null;
   let confidence: number | null = null;
+  let evaluatedAt: string | null = null;
 
   for (const line of tomlContent.split('\n')) {
     const trimmed = line.trim();
@@ -122,12 +149,17 @@ function parseEvaluationRecord(tomlContent: string): {
     if (confidenceMatch) {
       const parsed = Number.parseFloat(confidenceMatch[1] ?? '');
       if (Number.isFinite(parsed)) confidence = parsed;
+      continue;
     }
+    const atMatch = trimmed.match(/^evaluatedAt\s*=\s*"([^"]+)"/);
+    if (atMatch) evaluatedAt = atMatch[1] ?? null;
   }
 
-  return { verdict, confidence };
+  return { verdict, confidence, evaluatedAt };
 }
 
+const HUMAN_EVALUATOR_PREFIX = 'human-';
+
 /**
  * Read all person-evaluations from the given ref via `git cat-file` bulk read.
  * Does NOT go through gitsheets — there are ~54k records and we want a
@@ -138,8 +170,9 @@ async function aggregateVerdicts(
   evaluationsRef: string,
   threshold: number,
   log: (msg: string) => void,
+  verdictMap: Map<string, PersonVerdict> = new Map(),
 ): Promise<Map<string, PersonVerdict>> {
-  log(`[prune-spam] listing person-evaluations under ref=${evaluationsRef}`);
+  log(`[prune-spam] listing person-evaluations in ${repo} under ref=${evaluationsRef}`);
 
   // List all blobs under person-evaluations/ in the evaluations ref.
   const lsOutput = await exec(
@@ -152,7 +185,7 @@ async function aggregateVerdicts(
   log(`[prune-spam] found ${lines.length} evaluation records`);
 
   if (lines.length === 0) {
-    return new Map();
+    return verdictMap;
   }
 
   // Build a batch-check-mailbox input: one object hash per line.
@@ -174,8 +207,6 @@ async function aggregateVerdicts(
   // Use child_process.spawn for streaming instead of execFile (fits in memory for this size).
   const { spawn } = await import('node:child_process');
 
-  const verdictMap = new Map<string, PersonVerdict>();
-
   await new Promise<void>((resolvePromise, reject) => {
     const catFile = spawn('git', ['cat-file', '--batch'], { cwd: repo });
 
@@ -248,20 +279,25 @@ async function aggregateVerdicts(
           const pathParts = currentExpected.path.split('/');
           // path is like: person-evaluations/<personSlug>/<evaluator>.toml
           const personSlug = pathParts[1];
+          const evaluator = (pathParts[2] ?? '').replace(/\.toml$/, '');
           if (personSlug) {
-            const { verdict, confidence } = parseEvaluationRecord(tomlContent);
-            if (verdict !== null && confidence !== null) {
-              let entry = verdictMap.get(personSlug);
-              if (!entry) {
-                entry = { hasConfidentSpam: false, hasAnyLegit: false };
-                verdictMap.set(personSlug, entry);
-              }
-              if (verdict === 'spam' && confidence >= threshold) {
-                (entry as { hasConfidentSpam: boolean }).hasConfidentSpam = true;
-              }
-              if (verdict === 'legit') {
-                (entry as { hasAnyLegit: boolean }).hasAnyLegit = true;
+            const { verdict, confidence, evaluatedAt } = parseEvaluationRecord(tomlContent);
+            let entry = verdictMap.get(personSlug);
+            if (!entry) {
+              entry = { hasConfidentSpam: false, hasAnyLegit: false, humanVerdict: null, humanEvaluatedAt: null };
+              verdictMap.set(personSlug, entry);
+            }
+            if (evaluator.startsWith(HUMAN_EVALUATOR_PREFIX)) {
+              // Latest human vote wins; ties resolve to whichever is read last.
+              if (verdict !== null && (entry.humanEvaluatedAt === null || (evaluatedAt ?? '') >= entry.humanEvaluatedAt)) {
+                entry.humanVerdict = verdict;
+                entry.humanEvaluatedAt = evaluatedAt ?? '';
               }
+            } else if (verdict !== null && confidence !== null) {
+              // Heuristic records carry `score`, not `confidence`, and never
+              // reach here — they must be LLM-confirmed before they can prune.
+              if (verdict === 'spam' && confidence >= threshold) entry.hasConfidentSpam = true;
+              if (verdict === 'legit') entry.hasAnyLegit = true;
             }
           }
 
@@ -292,17 +328,30 @@ async function aggregateVerdicts(
 }
 
 /**
- * Compute the set of person slugs to prune:
- * prune iff hasConfidentSpam AND NOT hasAnyLegit.
+ * Compute the set of person slugs to prune. A human vote is final: `spam`
+ * prunes, `legit` keeps. Otherwise prune iff hasConfidentSpam AND NOT
+ * hasAnyLegit. Returns the human-spam subset too, since those bypass the
+ * project-membership protection.
  */
-function computePruneSet(verdictMap: Map<string, PersonVerdict>): Set<string> {
+function computePruneSet(verdictMap: Map<string, PersonVerdict>): {
+  pruneSet: Set<string>;
+  humanSpam: Set<string>;
+} {
   const pruneSet = new Set<string>();
+  const humanSpam = new Set<string>();
   for (const [slug, v] of verdictMap) {
+    if (v.humanVerdict !== null) {
+      if (v.humanVerdict === 'spam') {
+        pruneSet.add(slug);
+        humanSpam.add(slug);
+      }
+      continue;
+    }
     if (v.hasConfidentSpam && !v.hasAnyLegit) {
       pruneSet.add(slug);
     }
   }
-  return pruneSet;
+  return { pruneSet, humanSpam };
 }
 
 /** Minimal read surface shared by the live store and an open transaction. */
@@ -326,6 +375,7 @@ interface CandidatePerson {
 async function partitionCandidates(
   q: Queryable,
   candidateSlugs: Set<string>,
+  humanSpam: Set<string> = new Set(),
 ): Promise<{ prune: CandidatePerson[]; protectedByMembership: number }> {
   const candidates: CandidatePerson[] = [];
   for await (const person of q.people.query()) {
@@ -343,7 +393,9 @@ async function partitionCandidates(
     if (typeof pid === 'string') memberPersonIds.add(pid);
   }
 
-  const prune = candidates.filter((c) => !memberPersonIds.has(c.id));
+  // Membership protects against machine verdicts only — a human looked at the
+  // profile, so a human `spam` vote is not overridden by real-looking content.
+  const prune = candidates.filter((c) => humanSpam.has(c.slug) || !memberPersonIds.has(c.id));
   return { prune, protectedByMembership: candidates.length - prune.length };
 }
 
@@ -406,17 +458,22 @@ async function pruneSpam(args: CliArgs): Promise<PruneSummary> {
   // -------------------------------------------------------------------------
   // 1. Read verdicts from evaluations ref (efficient git read)
   // -------------------------------------------------------------------------
-  log(`[prune-spam] reading verdicts from ref=${args.evaluationsRef}, threshold=${args.threshold}`);
+  log(
+    `[prune-spam] reading machine verdicts from ${args.evaluationsRepo}@${args.evaluationsRef}, ` +
+      `human votes from ${args.dataRepo}@${args.humanVotesRef}, threshold=${args.threshold}`,
+  );
   const verdictMap = await aggregateVerdicts(
-    args.dataRepo,
+    args.evaluationsRepo,
     args.evaluationsRef,
     args.threshold,
     log,
   );
+  await aggregateVerdicts(args.dataRepo, args.humanVotesRef, args.threshold, log, verdictMap);
 
-  const pruneSet = computePruneSet(verdictMap);
+  const { pruneSet, humanSpam } = computePruneSet(verdictMap);
   log(
-    `[prune-spam] evaluated=${verdictMap.size} persons, pruneSet=${pruneSet.size} (confident spam with no legit)`,
+    `[prune-spam] evaluated=${verdictMap.size} persons, pruneSet=${pruneSet.size} ` +
+      `(${humanSpam.size} by human vote; the rest confident machine spam with no legit)`,
   );
 
   // -------------------------------------------------------------------------
@@ -443,6 +500,7 @@ async function pruneSpam(args: CliArgs): Promise<PruneSummary> {
     const { prune, protectedByMembership } = await partitionCandidates(
       store as unknown as Queryable,
       pruneSet,
+      humanSpam,
     );
     console.log(
       `[prune-spam] dry-run: would prune ${prune.length} (of ${pruneSet.size} verdict-flagged slugs); ${protectedByMembership} protected by project membership`,
@@ -492,6 +550,7 @@ async function pruneSpam(args: CliArgs): Promise<PruneSummary> {
       const { prune, protectedByMembership: protectedCount } = await partitionCandidates(
         tx as unknown as Queryable,
         pruneSet,
+        humanSpam,
       );
       protectedByMembership = protectedCount;
 
diff --git a/apps/api/src/app.ts b/apps/api/src/app.ts
index 99ea97a..cfd6e26 100644
--- a/apps/api/src/app.ts
+++ b/apps/api/src/app.ts
@@ -60,6 +60,7 @@ import { projectMembershipRoutes } from './routes/projects-members.js';
 import { previewRoutes } from './routes/preview.js';
 import { attachmentRoutes } from './routes/attachments.js';
 import { chatRoutes } from './routes/chat.js';
+import { moderationRoutes } from './routes/moderation.js';
 import { samlRoutes } from './routes/saml.js';
 import { internalRoutes } from './routes/internal.js';
 
@@ -201,6 +202,7 @@ export async function buildApp(opts: BuildAppOptions = {}): Promise<FastifyInsta
   await fastify.register(previewRoutes);
   await fastify.register(attachmentRoutes);
   await fastify.register(chatRoutes);
+  await fastify.register(moderationRoutes);
   await fastify.register(samlRoutes);
   await fastify.register(internalRoutes);
 
diff --git a/apps/api/src/plugins/services.ts b/apps/api/src/plugins/services.ts
index f78d828..0b9da08 100644
--- a/apps/api/src/plugins/services.ts
+++ b/apps/api/src/plugins/services.ts
@@ -28,6 +28,7 @@ import { PersonWriteService } from '../services/person.write.js';
 import { TagWriteService } from '../services/tag.write.js';
 import { GitHubAccountService } from '../services/github-account.js';
 import { AccountClaimService } from '../services/account-claim.js';
+import { ModerationService, ModerationWriteService } from '../services/moderation.js';
 import { LoggingNotifier, type Notifier } from '../notify/index.js';
 import { EmailNotifier } from '../notify/email-notifier.js';
 import { PostmarkTransport } from '../notify/postmark-transport.js';
@@ -53,6 +54,8 @@ declare module 'fastify' {
       tagsWrite: TagWriteService;
       githubAccount: GitHubAccountService;
       accountClaim: AccountClaimService;
+      moderation: ModerationService;
+      moderationWrite: ModerationWriteService;
     };
     /** Shared in-memory state — write routes call StateApply.apply against this. */
     inMemoryState: InMemoryState;
@@ -107,6 +110,16 @@ async function servicesPlugin(fastify: FastifyInstance): Promise<void> {
     tagsWrite: new TagWriteService(state),
     githubAccount,
     accountClaim: new AccountClaimService(state, fastify.store.private, githubAccount),
+    moderation: new ModerationService(state, fastify.store.private, (personId) => {
+      // Newest sign-in from session metadata; the auth plugin decorates it
+      // after this one registers, so resolve lazily per call.
+      let latest: string | null = null;
+      for (const m of fastify.sessionMetadata?.getAll(personId) ?? []) {
+        if (!latest || m.issuedAt > latest) latest = m.issuedAt;
+      }
+      return latest;
+    }),
+    moderationWrite: new ModerationWriteService(state),
   });
 }
 
diff --git a/apps/api/src/routes/moderation.ts b/apps/api/src/routes/moderation.ts
new file mode 100644
index 0000000..ddf8d62
--- /dev/null
+++ b/apps/api/src/routes/moderation.ts
@@ -0,0 +1,140 @@
+/**
+ * Moderation API — specs/api/moderation.md.
+ *
+ *   GET  /api/admin/members             — staff roster, newest signup first
+ *   GET  /api/admin/members/:slug       — one member's footprint + human votes
+ *   POST /api/admin/members/:slug/vote  — record the caller's spam/legit verdict
+ *
+ * Every route is staff/admin only and answers 404 to anyone else: like the
+ * other staff surfaces, the endpoints' existence is not a signal.
+ */
+import type { FastifyInstance, FastifyRequest } from 'fastify';
+import { ok, paginated } from '../lib/response.js';
+import { ApiNotFoundError, ApiValidationError } from '../lib/errors.js';
+import { getCallerSession } from '../services/permissions.js';
+import { buildTransactionOptions } from '../store/commit-meta.js';
+import type { VoteFilter } from '../services/moderation.js';
+
+function requireStaffOr404(request: FastifyRequest): void {
+  const level = request.session.accountLevel;
+  if (level !== 'staff' && level !== 'administrator') {
+    throw new ApiNotFoundError('Not found');
+  }
+}
+
+export async function moderationRoutes(fastify: FastifyInstance): Promise<void> {
+  fastify.get(
+    '/api/admin/members',
+    {
+      schema: {
+        tags: ['moderation'],
+        summary: 'Staff roster of members, newest signup first',
+        querystring: {
+          type: 'object',
+          properties: {
+            q: { type: 'string' },
+            vote: { type: 'string', enum: ['none', 'spam', 'legit'] },
+            joinedAfter: { type: 'string' },
+            joinedBefore: { type: 'string' },
+            includeDeactivated: { type: 'boolean' },
+            sort: { type: 'string' },
+            page: { type: 'integer', minimum: 1 },
+            perPage: { type: 'integer', minimum: 1, maximum: 200 },
+          },
+          additionalProperties: false,
+        },
+      },
+    },
+    async (request) => {
+      requireStaffOr404(request);
+      const q = request.query as Record<string, unknown>;
+      const result = await fastify.services.moderation.listMembers({
+        q: q['q'] as string | undefined,
+        vote: q['vote'] as VoteFilter | undefined,
+        joinedAfter: q['joinedAfter'] as string | undefined,
+        joinedBefore: q['joinedBefore'] as string | undefined,
+        includeDeactivated: q['includeDeactivated'] as boolean | undefined,
+        sort: q['sort'] as string | undefined,
+        page: q['page'] as number | undefined,
+        perPage: q['perPage'] as number | undefined,
+      });
+      if ('error' in result) {
+        throw new ApiValidationError('Unknown sort key', { sort: 'unknown sort key' });
+      }
+      return paginated(result.items, {
+        page: result.page,
+        perPage: result.perPage,
+        totalItems: result.totalItems,
+        totalPages: Math.max(1, Math.ceil(result.totalItems / result.perPage)),
+      });
+    },
+  );
+
+  fastify.get(
+    '/api/admin/members/:slug',
+    {
+      schema: {
+        tags: ['moderation'],
+        summary: "One member's footprint on the site and every human vote",
+        params: { type: 'object', properties: { slug: { type: 'string' } }, required: ['slug'] },
+      },
+    },
+    async (request) => {
+      requireStaffOr404(request);
+      const { slug } = request.params as { slug: string };
+      const caller = getCallerSession(request);
+      const person = await fastify.services.people.get(slug, caller);
+      const footprint = fastify.services.moderation.footprint(slug);
+      if (!person || !footprint) throw new ApiNotFoundError(`Person '${slug}' not found`);
+      return ok({
+        person,
+        footprint,
+        votes: fastify.services.moderation.humanVotes(slug),
+      });
+    },
+  );
+
+  fastify.post(
+    '/api/admin/members/:slug/vote',
+    {
+      schema: {
+        tags: ['moderation'],
+        summary: "Record the caller's spam / not-spam verdict on a member",
+        params: { type: 'object', properties: { slug: { type: 'string' } }, required: ['slug'] },
+        body: {
+          type: 'object',
+          properties: {
+            verdict: { type: 'string', enum: ['spam', 'legit'] },
+            reasoning: { type: 'string', maxLength: 1000 },
+          },
+          required: ['verdict'],
+          additionalProperties: false,
+        },
+      },
+    },
+    async (request) => {
+      requireStaffOr404(request);
+      const { slug } = request.params as { slug: string };
+      const body = request.body as { verdict: 'spam' | 'legit'; reasoning?: string };
+      const result = await fastify.store.transact(
+        buildTransactionOptions({
+          request,
+          action: 'moderation.vote',
+          subjectType: 'person',
+          subjectSlug: slug,
+          responseCode: 200,
+          summary: `${body.verdict}${body.reasoning ? `: ${body.reasoning}` : ''}`,
+        }),
+        async (tx) => fastify.services.moderationWrite.castVote(tx, slug, request.session, body),
+      );
+      result.value.stateApply.apply(fastify.inMemoryState, fastify.fts);
+      const caller = getCallerSession(request);
+      const person = await fastify.services.people.get(result.value.person.slug, caller);
+      return ok({
+        person,
+        vote: result.value.vote,
+        latestVote: fastify.services.moderation.latestHumanVote(slug),
+      });
+    },
+  );
+}
diff --git a/apps/api/src/services/moderation.ts b/apps/api/src/services/moderation.ts
new file mode 100644
index 0000000..fc8de4c
--- /dev/null
+++ b/apps/api/src/services/moderation.ts
@@ -0,0 +1,412 @@
+/**
+ * Moderation: the staff members roster, per-member footprint, and human spam
+ * votes. Per specs/api/moderation.md and specs/screens/admin-members.md.
+ *
+ * Reads come entirely from in-memory state plus the private store (email)
+ * and session metadata (last sign-in). The only write is `castVote`, which
+ * records a `human-<voterSlug>` person-evaluation and applies the lifecycle
+ * side effect from specs/behaviors/person-lifecycle.md.
+ */
+import {
+  PersonSchema,
+  PersonEvaluationSchema,
+  HUMAN_EVALUATOR_PREFIX,
+  humanEvaluatorFor,
+  isHumanEvaluator,
+  type Person,
+  type PersonEvaluation,
+} from '@cfp/shared/schemas';
+import type { InMemoryState } from '../store/memory/state.js';
+import type { PrivateStore } from '../store/private/interface.js';
+import type { DualStoreTx } from '../store/store.js';
+import { StateApply } from '../store/state-apply.js';
+import type { SessionContext } from '../auth/middleware.js';
+import { ApiNotFoundError, ApiValidationError } from '../lib/errors.js';
+
+export type VoteVerdict = 'spam' | 'legit';
+export type VoteFilter = 'none' | VoteVerdict;
+
+export interface MemberListOptions {
+  readonly q?: string;
+  readonly vote?: VoteFilter;
+  readonly joinedAfter?: string;
+  readonly joinedBefore?: string;
+  readonly includeDeactivated?: boolean;
+  readonly sort?: string;
+  readonly page?: number;
+  readonly perPage?: number;
+}
+
+export interface VoterRef {
+  readonly slug: string;
+  readonly fullName: string;
+}
+
+export interface VoteView {
+  readonly verdict: 'spam' | 'legit' | 'uncertain';
+  readonly reasoning: string | null;
+  readonly voter: VoterRef;
+  readonly evaluatedAt: string;
+}
+
+export interface FootprintCounts {
+  readonly memberships: number;
+  readonly updates: number;
+  readonly buzz: number;
+  readonly blogPosts: number;
+  readonly helpWantedInterest: number;
+  readonly tags: number;
+}
+
+export interface MemberRow {
+  readonly id: string;
+  readonly slug: string;
+  readonly fullName: string;
+  readonly avatarUrl: string | null;
+  readonly createdAt: string;
+  readonly deletedAt: string | null;
+  readonly email: string | null;
+  readonly hasGitHubLink: boolean;
+  readonly lastLoginAt: string | null;
+  readonly bioExcerpt: string;
+  readonly footprint: FootprintCounts;
+  readonly latestVote: VoteView | null;
+}
+
+export interface ProjectRef {
+  readonly slug: string;
+  readonly title: string;
+}
+
+export interface MemberFootprint {
+  readonly memberships: Array<{ project: ProjectRef; role: string; joinedAt: string }>;
+  readonly updates: Array<{ project: ProjectRef; number: number; title: string; postedAt: string }>;
+  readonly buzz: Array<{ project: ProjectRef; slug: string; title: string; postedAt: string }>;
+  readonly blogPosts: Array<{ slug: string; title: string; postedAt: string }>;
+  readonly helpWantedInterest: Array<{ project: ProjectRef; role: { title: string }; createdAt: string }>;
+  readonly tags: Array<{ handle: string; type: string }>;
+}
+
+export interface MemberListResult {
+  readonly items: MemberRow[];
+  readonly totalItems: number;
+  readonly page: number;
+  readonly perPage: number;
+}
+
+/** Newest sign-in for a person, from session metadata; injected to avoid a plugin dependency. */
+export type LastLoginLookup = (personId: string) => string | null;
+
+const SORT_KEYS = new Set(['createdAt', 'fullName', 'lastLoginAt']);
+
+function parseSort(sort: string | undefined): { key: string; desc: boolean } | null {
+  const raw = sort && sort.trim() !== '' ? sort.trim() : '-createdAt';
+  const desc = raw.startsWith('-');
+  const key = desc ? raw.slice(1) : raw;
+  if (!SORT_KEYS.has(key)) return null;
+  return { key, desc };
+}
+
+/** Strip the markdown a bio typically carries and cut to ~160 chars. */
+export function bioExcerpt(bio: string | null | undefined, max = 160): string {
+  if (!bio) return '';
+  const text = bio
+    .replace(/!\[[^\]]*\]\([^)]*\)/g, '')
+    .replace(/\[([^\]]*)\]\([^)]*\)/g, '$1')
+    .replace(/[`*_>#~]/g, '')
+    .replace(/\s+/g, ' ')
+    .trim();
+  return text.length > max ? `${text.slice(0, max - 1).trimEnd()}…` : text;
+}
+
+function nowIso(): string {
+  return new Date().toISOString();
+}
+
+export class ModerationService {
+  readonly #state: InMemoryState;
+  readonly #privateStore: PrivateStore;
+  readonly #lastLogin: LastLoginLookup;
+
+  constructor(state: InMemoryState, privateStore: PrivateStore, lastLogin: LastLoginLookup) {
+    this.#state = state;
+    this.#privateStore = privateStore;
+    this.#lastLogin = lastLogin;
+  }
+
+  /** Every human vote on a person, newest first. */
+  humanVotes(personSlug: string): VoteView[] {
+    const keys = this.#state.evaluationsByPerson.get(personSlug);
+    if (!keys) return [];
+    const votes: VoteView[] = [];
+    for (const key of keys) {
+      const rec = this.#state.personEvaluations.get(key);
+      if (!rec || !isHumanEvaluator(rec.evaluator)) continue;
+      votes.push(this.#voteView(rec));
+    }
+    return votes.sort((a, b) => b.evaluatedAt.localeCompare(a.evaluatedAt));
+  }
+
+  latestHumanVote(personSlug: string): VoteView | null {
+    return this.humanVotes(personSlug)[0] ?? null;
+  }
+
+  async listMembers(opts: MemberListOptions): Promise<MemberListResult | { error: 'invalid_sort' }> {
+    const sort = parseSort(opts.sort);
+    if (!sort) return { error: 'invalid_sort' };
+
+    const includeDeactivated = opts.includeDeactivated ?? true;
+    const q = opts.q?.trim().toLowerCase() ?? '';
+    const emailSearch = q.includes('@');
+
+    let people = [...this.#state.people.values()];
+    if (!includeDeactivated) people = people.filter((p) => !p.deletedAt);
+    if (opts.joinedAfter) people = people.filter((p) => p.createdAt >= opts.joinedAfter!);
+    if (opts.joinedBefore) people = people.filter((p) => p.createdAt <= opts.joinedBefore!);
+    if (opts.vote) {
+      people = people.filter((p) => {
+        const latest = this.latestHumanVote(p.slug);
+        if (opts.vote === 'none') return latest === null;
+        return latest?.verdict === opts.vote;
+      });
+    }
+
+    const authored = this.#authoredCounts();
+    const lastLogins = new Map<string, string | null>();
+    const emails = new Map<string, string | null>();
+    const emailOf = async (p: Person): Promise<string | null> => {
+      if (!emails.has(p.id)) emails.set(p.id, (await this.#privateStore.getProfile(p.id))?.email ?? null);
+      return emails.get(p.id) ?? null;
+    };
+
+    if (q) {
+      const matched: Person[] = [];
+      for (const p of people) {
+        const hay = `${p.fullName} ${p.slug} ${p.bio ?? ''}`.toLowerCase();
+        if (hay.includes(q)) {
+          matched.push(p);
+          continue;
+        }
+        if (emailSearch) {
+          const email = await emailOf(p);
+          if (email && email.toLowerCase().includes(q)) matched.push(p);
+        }
+      }
+      people = matched;
+    }
+
+    const lastLoginOf = (p: Person): string | null => {
+      if (!lastLogins.has(p.id)) lastLogins.set(p.id, this.#lastLogin(p.id));
+      return lastLogins.get(p.id) ?? null;
+    };
+
+    people.sort((a, b) => {
+      let cmp: number;
+      if (sort.key === 'fullName') cmp = a.fullName.localeCompare(b.fullName);
+      else if (sort.key === 'lastLoginAt') cmp = (lastLoginOf(a) ?? '').localeCompare(lastLoginOf(b) ?? '');
+      else cmp = a.createdAt.localeCompare(b.createdAt);
+      if (cmp === 0) cmp = a.slug.localeCompare(b.slug);
+      return sort.desc ? -cmp : cmp;
+    });
+
+    const page = Math.max(1, opts.page ?? 1);
+    const perPage = Math.min(200, Math.max(1, opts.perPage ?? 50));
+    const slice = people.slice((page - 1) * perPage, page * perPage);
+
+    const items: MemberRow[] = [];
+    for (const p of slice) {
+      items.push({
+        id: p.id,
+        slug: p.slug,
+        fullName: p.fullName,
+        avatarUrl: p.avatarKey ? `/api/attachments/${p.avatarKey}` : null,
+        createdAt: p.createdAt,
+        deletedAt: p.deletedAt ?? null,
+        email: await emailOf(p),
+        hasGitHubLink: typeof p.githubUserId === 'number',
+        lastLoginAt: lastLoginOf(p),
+        bioExcerpt: bioExcerpt(p.bio),
+        footprint: {
+          memberships: this.#state.membershipsByPerson.get(p.id)?.size ?? 0,
+          updates: authored.updates.get(p.id) ?? 0,
+          buzz: authored.buzz.get(p.id) ?? 0,
+          blogPosts: authored.blogPosts.get(p.id) ?? 0,
+          helpWantedInterest: authored.interest.get(p.id) ?? 0,
+          tags: this.#state.tagAssignmentsByTaggable.get(p.id)?.size ?? 0,
+        },
+        latestVote: this.latestHumanVote(p.slug),
+      });
+    }
+
+    return { items, totalItems: people.length, page, perPage };
+  }
+
+  /** Full footprint for one member (deactivated included — this is moderation). */
+  footprint(slug: string): MemberFootprint | null {
+    const id = this.#state.personIdBySlug.get(slug);
+    if (!id) return null;
+    const s = this.#state;
+    const projectRef = (projectId: string): ProjectRef | null => {
+      const project = s.projects.get(projectId);
+      return project ? { slug: project.slug, title: project.title } : null;
+    };
+
+    const memberships = [...(s.membershipsByPerson.get(id) ?? [])]
+      .map((mid) => s.projectMemberships.get(mid))
+      .flatMap((m) => {
+        const project = m ? projectRef(m.projectId) : null;
+        return m && project ? [{ project, role: m.role ?? (m.isMaintainer ? 'maintainer' : 'member'), joinedAt: m.joinedAt }] : [];
+      });
+
+    const updates = [...s.projectUpdates.values()]
+      .filter((u) => u.authorId === id)
+      .flatMap((u) => {
+        const project = projectRef(u.projectId);
+        // Updates have no title; the excerpt of the body stands in for one.
+        return project ? [{ project, number: u.number, title: bioExcerpt(u.body, 80), postedAt: u.createdAt }] : [];
+      })
+      .sort((a, b) => b.postedAt.localeCompare(a.postedAt));
+
+    const buzz = [...s.projectBuzz.values()]
+      .filter((b) => b.postedById === id)
+      .flatMap((b) => {
+        const project = projectRef(b.projectId);
+        return project ? [{ project, slug: b.slug, title: b.headline, postedAt: b.publishedAt }] : [];
+      })
+      .sort((a, b) => b.postedAt.localeCompare(a.postedAt));
+
+    const blogPosts = [...s.blogPosts.values()]
+      .filter((bp) => bp.authorId === id)
+      .map((bp) => ({ slug: bp.slug, title: bp.title, postedAt: bp.postedAt }))
+      .sort((a, b) => b.postedAt.localeCompare(a.postedAt));
+
+    const helpWantedInterest = [...s.helpWantedInterest.values()]
+      .filter((i) => i.personId === id)
+      .flatMap((i) => {
+        const role = s.helpWantedRoles.get(i.roleId);
+        const project = role ? projectRef(role.projectId) : null;
+        return role && project ? [{ project, role: { title: role.title }, createdAt: i.createdAt }] : [];
+      })
+      .sort((a, b) => b.createdAt.localeCompare(a.createdAt));
+
+    const tags = [...(s.tagAssignmentsByTaggable.get(id) ?? [])]
+      .map((taId) => s.tagAssignments.get(taId))
+      .flatMap((ta) => {
+        const tag = ta ? s.tags.get(ta.tagId) : undefined;
+        return tag ? [{ handle: `${tag.namespace}.${tag.slug}`, type: tag.namespace }] : [];
+      });
+
+    return { memberships, updates, buzz, blogPosts, helpWantedInterest, tags };
+  }
+
+  #voteView(rec: PersonEvaluation): VoteView {
+    const voterSlug = rec.evaluator.slice(HUMAN_EVALUATOR_PREFIX.length);
+    const voterId = this.#state.personIdBySlug.get(voterSlug);
+    const voter = voterId ? this.#state.people.get(voterId) : undefined;
+    return {
+      verdict: rec.verdict,
+      reasoning: rec.reasoning ?? null,
+      voter: { slug: voterSlug, fullName: voter?.fullName ?? voterSlug },
+      evaluatedAt: rec.evaluatedAt,
+    };
+  }
+
+  #authoredCounts(): {
+    updates: Map<string, number>;
+    buzz: Map<string, number>;
+    blogPosts: Map<string, number>;
+    interest: Map<string, number>;
+  } {
+    const bump = (m: Map<string, number>, k: string | null | undefined): void => {
+      if (k) m.set(k, (m.get(k) ?? 0) + 1);
+    };
+    const updates = new Map<string, number>();
+    const buzz = new Map<string, number>();
+    const blogPosts = new Map<string, number>();
+    const interest = new Map<string, number>();
+    for (const u of this.#state.projectUpdates.values()) bump(updates, u.authorId);
+    for (const b of this.#state.projectBuzz.values()) bump(buzz, b.postedById);
+    for (const bp of this.#state.blogPosts.values()) bump(blogPosts, bp.authorId);
+    for (const i of this.#state.helpWantedInterest.values()) bump(interest, i.personId);
+    return { updates, buzz, blogPosts, interest };
+  }
+}
+
+export interface CastVoteInput {
+  readonly verdict: VoteVerdict;
+  readonly reasoning?: string;
+}
+
+export class ModerationWriteService {
+  readonly #state: InMemoryState;
+
+  constructor(state: InMemoryState) {
+    this.#state = state;
+  }
+
+  /**
+   * Record the caller's verdict as `person-evaluations/<slug>/human-<caller>`
+   * and apply the lifecycle side effect: spam → deactivate; legit → reactivate
+   * only when the previous latest human vote was spam (a self-deactivation is
+   * never undone by a vote). One record per voter; re-voting replaces it.
+   */
+  async castVote(
+    tx: DualStoreTx,
+    slug: string,
+    session: SessionContext,
+    input: CastVoteInput,
+  ): Promise<{ person: Person; vote: PersonEvaluation; stateApply: StateApply }> {
+    const voter = session.person;
+    if (!voter) throw new ApiNotFoundError(`Person '${slug}' not found`);
+
+    const id = this.#state.personIdBySlug.get(slug);
+    const existing = id ? this.#state.people.get(id) : undefined;
+    if (!existing) throw new ApiNotFoundError(`Person '${slug}' not found`);
+    if (existing.id === voter.id) {
+      throw new ApiValidationError('You cannot vote on your own account', { slug: 'self' });
+    }
+    if (input.reasoning !== undefined && input.reasoning.length > 1000) {
+      throw new ApiValidationError('Reasoning is too long', { reasoning: 'max 1000 characters' });
+    }
+
+    const previousLatest = latestHumanVerdict(this.#state, slug);
+    const now = nowIso();
+    const vote: PersonEvaluation = PersonEvaluationSchema.parse({
+      personSlug: slug,
+      evaluator: humanEvaluatorFor(voter.slug),
+      verdict: input.verdict,
+      confidence: 1,
+      flags: ['manual-override'],
+      ...(input.reasoning && input.reasoning.trim() !== '' ? { reasoning: input.reasoning.trim() } : {}),
+      evaluatedAt: now,
+    });
+
+    await tx.public['person-evaluations'].upsert(vote);
+    const stateApply = new StateApply().upsertPersonEvaluation(vote);
+
+    let person = existing;
+    if (input.verdict === 'spam' && !existing.deletedAt) {
+      person = PersonSchema.parse({ ...existing, deletedAt: now, updatedAt: now });
+    } else if (input.verdict === 'legit' && existing.deletedAt && previousLatest === 'spam') {
+      person = PersonSchema.parse({ ...existing, deletedAt: null, updatedAt: now });
+    }
+    if (person !== existing) {
+      await tx.public.people.upsert(person);
+      stateApply.upsertPerson(person);
+    }
+
+    return { person, vote, stateApply };
+  }
+}
+
+function latestHumanVerdict(state: InMemoryState, personSlug: string): PersonEvaluation['verdict'] | null {
+  const keys = state.evaluationsByPerson.get(personSlug);
+  if (!keys) return null;
+  let latest: PersonEvaluation | null = null;
+  for (const key of keys) {
+    const rec = state.personEvaluations.get(key);
+    if (!rec || !isHumanEvaluator(rec.evaluator)) continue;
+    if (!latest || rec.evaluatedAt > latest.evaluatedAt) latest = rec;
+  }
+  return latest?.verdict ?? null;
+}
diff --git a/apps/api/src/store/memory/loader.ts b/apps/api/src/store/memory/loader.ts
index 156c87e..d7e0ef0 100644
--- a/apps/api/src/store/memory/loader.ts
+++ b/apps/api/src/store/memory/loader.ts
@@ -12,6 +12,7 @@ import {
   indexHelpWantedRole,
   indexMembership,
   indexPerson,
+  indexPersonEvaluation,
   indexProject,
   indexProjectBuzz,
   indexProjectUpdate,
@@ -44,6 +45,8 @@ export async function loadInMemoryState(publicStore: PublicStore): Promise<InMem
   const roles = await publicStore['help-wanted-roles'].queryAll();
   const interests = await publicStore['help-wanted-interest'].queryAll();
   const slugHistoryRecords = await publicStore['slug-history'].queryAll();
+  // Human spam votes. Absent on data repos without the sheet config → [].
+  const evaluations = await publicStore['person-evaluations'].queryAll();
 
   for (const p of projects) indexProject(state, p);
   for (const p of people) indexPerson(state, p);
@@ -60,6 +63,7 @@ export async function loadInMemoryState(publicStore: PublicStore): Promise<InMem
   // separate sweeper purges; this is the read-path defense).
   const bootNow = new Date();
   for (const r of slugHistoryRecords) indexSlugHistory(state, r, bootNow);
+  for (const e of evaluations) indexPersonEvaluation(state, e);
 
   return state;
 }
diff --git a/apps/api/src/store/memory/state.ts b/apps/api/src/store/memory/state.ts
index dd947a2..69ce047 100644
--- a/apps/api/src/store/memory/state.ts
+++ b/apps/api/src/store/memory/state.ts
@@ -12,6 +12,7 @@ import type {
   HelpWantedInterestExpression,
   HelpWantedRole,
   Person,
+  PersonEvaluation,
   Project,
   ProjectBuzz,
   ProjectMembership,
@@ -114,6 +115,15 @@ export interface InMemoryState {
    * decide whether to serve a 301 per specs/behaviors/slug-handles.md.
    */
   slugHistory: Map<string, { newSlug: string; expiresAt: string }>;
+
+  /**
+   * Human spam votes from `person-evaluations` on the served branch, keyed
+   * `${personSlug}/${evaluator}`. Machine verdicts never reach the runtime
+   * (specs/behaviors/spam-exclusion.md → "What the runtime sees").
+   */
+  personEvaluations: Map<string, PersonEvaluation>;
+  /** personSlug → Set<evaluation key> */
+  evaluationsByPerson: Map<string, Set<string>>;
 }
 
 /** Compose the slug-history map key. Kept here so call sites stay consistent. */
@@ -155,6 +165,8 @@ export function createEmptyState(): InMemoryState {
     interestByRoleAndPerson: new Map(),
     interestByRole: new Map(),
     slugHistory: new Map(),
+    personEvaluations: new Map(),
+    evaluationsByPerson: new Map(),
   };
 }
 
@@ -300,3 +312,15 @@ export function indexHelpWantedInterest(state: InMemoryState, expr: HelpWantedIn
   const key = `${expr.roleId}:${expr.personId}`;
   state.interestByRoleAndPerson.set(key, expr.id);
 }
+
+/** Add or replace one person-evaluation record (one per person + evaluator). */
+export function indexPersonEvaluation(state: InMemoryState, record: PersonEvaluation): void {
+  const key = `${record.personSlug}/${record.evaluator}`;
+  state.personEvaluations.set(key, record);
+  let set = state.evaluationsByPerson.get(record.personSlug);
+  if (!set) {
+    set = new Set();
+    state.evaluationsByPerson.set(record.personSlug, set);
+  }
+  set.add(key);
+}
diff --git a/apps/api/src/store/public.ts b/apps/api/src/store/public.ts
index 3d752a7..fd3471e 100644
--- a/apps/api/src/store/public.ts
+++ b/apps/api/src/store/public.ts
@@ -8,6 +8,7 @@ import {
   HelpWantedInterestExpressionSchema,
   HelpWantedRoleSchema,
   PersonSchema,
+  PersonEvaluationSchema,
   ProjectBuzzSchema,
   ProjectMembershipSchema,
   ProjectSchema,
@@ -22,6 +23,7 @@ import type {
   HelpWantedInterestExpression,
   HelpWantedRole,
   Person,
+  PersonEvaluation,
   ProjectBuzz,
   ProjectMembership,
   ProjectUpdate,
@@ -117,6 +119,7 @@ type PublicValidators = {
   readonly 'tag-assignments': StandardSchemaV1<unknown, TagAssignment>;
   readonly 'slug-history': StandardSchemaV1<unknown, SlugHistory>;
   readonly revocations: StandardSchemaV1<unknown, Revocation>;
+  readonly 'person-evaluations': StandardSchemaV1<unknown, PersonEvaluation>;
 } & ValidatorMap;
 
 export type PublicStore = Store<PublicValidators>;
@@ -167,6 +170,7 @@ export async function openPublicStore(
     'tag-assignments': asValidator<TagAssignment>(TagAssignmentSchema),
     'slug-history': asValidator<SlugHistory>(SlugHistorySchema),
     revocations: asValidator<Revocation>(RevocationSchema),
+    'person-evaluations': asValidator<PersonEvaluation>(PersonEvaluationSchema),
   };
 
   const store = (await openStore(repo, { validators })) as PublicStore;
diff --git a/apps/api/src/store/state-apply.ts b/apps/api/src/store/state-apply.ts
index 3bfcf12..03f0cdc 100644
--- a/apps/api/src/store/state-apply.ts
+++ b/apps/api/src/store/state-apply.ts
@@ -12,6 +12,7 @@ import type {
   HelpWantedInterestExpression,
   HelpWantedRole,
   Person,
+  PersonEvaluation,
   Project,
   ProjectBuzz,
   ProjectMembership,
@@ -27,6 +28,7 @@ import {
   indexHelpWantedRole,
   indexMembership,
   indexPerson,
+  indexPersonEvaluation,
   indexProject,
   indexProjectBuzz,
   indexProjectUpdate,
@@ -267,6 +269,11 @@ export class StateApply {
     return this;
   }
 
+  upsertPersonEvaluation(record: PersonEvaluation): this {
+    this.#ops.push((state) => indexPersonEvaluation(state, record));
+    return this;
+  }
+
   apply(state: InMemoryState, fts: FtsEngine): void {
     for (const op of this.#ops) {
       op(state, fts);
diff --git a/apps/api/tests/helpers/test-full-repo.ts b/apps/api/tests/helpers/test-full-repo.ts
index 7b7de4f..d834f0b 100644
--- a/apps/api/tests/helpers/test-full-repo.ts
+++ b/apps/api/tests/helpers/test-full-repo.ts
@@ -29,6 +29,7 @@ const SHEET_CONFIGS: Record<string, string> = {
   'tag-assignments': `[gitsheet]\nroot = 'tag-assignments'\npath = '\${{ tagId }}/\${{ taggableType }}/\${{ taggableId }}'\n`,
   'slug-history': `[gitsheet]\nroot = 'slug-history'\npath = '\${{ entityType }}/\${{ oldSlug }}'\n`,
   'revocations': `[gitsheet]\nroot = 'revocations'\npath = '\${{ jti }}'\n`,
+  'person-evaluations': `[gitsheet]\nroot = 'person-evaluations'\npath = '\${{ personSlug }}/\${{ evaluator }}'\n`,
 };
 
 export interface FullTestRepo {
diff --git a/apps/api/tests/import-laddr.test.ts b/apps/api/tests/import-laddr.test.ts
index 3b461e2..965b456 100644
--- a/apps/api/tests/import-laddr.test.ts
+++ b/apps/api/tests/import-laddr.test.ts
@@ -750,6 +750,7 @@ async function makeRepo(): Promise<{ path: string; cleanup: () => Promise<void>
     ],
     ['slug-history', "root = 'slug-history'\npath = '${{ entityType }}/${{ slug }}'\n"],
     ['revocations', "root = 'revocations'\npath = '${{ jti }}'\n"],
+    ['person-evaluations', "root = 'person-evaluations'\npath = '${{ personSlug }}/${{ evaluator }}'\n"],
   ];
   for (const [name, body] of sheets) {
     await writeFile(join(seedDir, '.gitsheets', `${name}.toml`), `[gitsheet]\n${body}`);
diff --git a/apps/api/tests/internal-reload.test.ts b/apps/api/tests/internal-reload.test.ts
index 85e754d..b14328c 100644
--- a/apps/api/tests/internal-reload.test.ts
+++ b/apps/api/tests/internal-reload.test.ts
@@ -54,6 +54,7 @@ const SHEET_CONFIGS: Record<string, string> = {
   'tag-assignments': `[gitsheet]\nroot = 'tag-assignments'\npath = '\${{ tagId }}/\${{ taggableType }}/\${{ taggableId }}'\n`,
   'slug-history': `[gitsheet]\nroot = 'slug-history'\npath = '\${{ entityType }}/\${{ oldSlug }}'\n`,
   'revocations': `[gitsheet]\nroot = 'revocations'\npath = '\${{ jti }}'\n`,
+  'person-evaluations': `[gitsheet]\nroot = 'person-evaluations'\npath = '\${{ personSlug }}/\${{ evaluator }}'\n`,
 };
 
 interface Rig {
diff --git a/apps/api/tests/moderation.test.ts b/apps/api/tests/moderation.test.ts
new file mode 100644
index 0000000..111151f
--- /dev/null
+++ b/apps/api/tests/moderation.test.ts
@@ -0,0 +1,224 @@
+/**
+ * Moderation API — specs/api/moderation.md, specs/behaviors/person-lifecycle.md.
+ *
+ * Covers:
+ *  - every endpoint 404s for anonymous and ordinary users (existence is not a signal)
+ *  - the roster lists members newest first with staff-visible email and vote state
+ *  - a spam vote records `human-<voter>` and deactivates in the same transaction
+ *  - a legit vote after a spam vote reactivates; after a self-deactivation it does not
+ *  - re-voting replaces the caller's record; self-votes are rejected
+ *  - the `vote` filter and the detail endpoint's footprint + vote history
+ */
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import type { FastifyInstance } from 'fastify';
+import { execFile } from 'node:child_process';
+import { writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { promisify } from 'node:util';
+
+const execFileAsync = promisify(execFile);
+
+import { buildApp } from '../src/app.js';
+import { mintSessionFor } from '../src/auth/issue.js';
+import { createFullDataRepo, createPrivateStorageDir } from './helpers/test-full-repo.js';
+import { seedRawToml } from './helpers/seed-fixtures.js';
+
+const JWT_KEY = 'test-jwt-signing-key-at-least-32-chars!!';
+
+const STAFF_ID = '01951a3c-0000-7000-8000-0000000000a1';
+const ADMIN_ID = '01951a3c-0000-7000-8000-0000000000a2';
+const USER_ID = '01951a3c-0000-7000-8000-0000000000b1';
+const NEW_ID = '01951a3c-0000-7000-8000-0000000000b2';
+const SELFOFF_ID = '01951a3c-0000-7000-8000-0000000000b3';
+
+async function seedPerson(
+  repoDir: string,
+  opts: { slug: string; id: string; accountLevel?: string; createdAt: string; deletedAt?: string; bio?: string; githubUserId?: number },
+): Promise<void> {
+  const lines = [
+    `id = "${opts.id}"`,
+    `slug = "${opts.slug}"`,
+    `fullName = "Test ${opts.slug}"`,
+    `accountLevel = "${opts.accountLevel ?? 'user'}"`,
+    opts.bio ? `bio = "${opts.bio}"` : '',
+    typeof opts.githubUserId === 'number' ? `githubUserId = ${opts.githubUserId}` : '',
+    opts.deletedAt ? `deletedAt = "${opts.deletedAt}"` : '',
+    `createdAt = "${opts.createdAt}"`,
+    `updatedAt = "${opts.createdAt}"`,
+  ].filter(Boolean);
+  await seedRawToml(repoDir, `people/${opts.slug}.toml`, lines.join('\n'), `seed person ${opts.slug}`);
+}
+
+describe('moderation API', () => {
+  let dataRepo: { path: string; cleanup: () => Promise<void> };
+  let privateStore: { path: string; cleanup: () => Promise<void> };
+  let app: FastifyInstance;
+  let staffCookie: string;
+  let adminCookie: string;
+  let userCookie: string;
+
+  beforeAll(async () => {
+    dataRepo = await createFullDataRepo();
+    privateStore = await createPrivateStorageDir();
+    await seedPerson(dataRepo.path, { slug: 'staffer', id: STAFF_ID, accountLevel: 'staff', createdAt: '2026-01-01T00:00:00Z' });
+    await seedPerson(dataRepo.path, { slug: 'boss', id: ADMIN_ID, accountLevel: 'administrator', createdAt: '2026-01-02T00:00:00Z' });
+    await seedPerson(dataRepo.path, { slug: 'regular', id: USER_ID, createdAt: '2026-02-01T00:00:00Z', githubUserId: 42 });
+    await seedPerson(dataRepo.path, { slug: 'newest', id: NEW_ID, createdAt: '2026-09-01T00:00:00Z', bio: 'Buy **cheap** [pills](https://x.example) now' });
+    await seedPerson(dataRepo.path, { slug: 'selfoff', id: SELFOFF_ID, createdAt: '2026-03-01T00:00:00Z', deletedAt: '2026-04-01T00:00:00Z' });
+
+    const profiles = [
+      { personId: NEW_ID, email: 'newest@example.org' },
+      { personId: USER_ID, email: 'regular@example.org' },
+    ].map((p) =>
+      JSON.stringify({
+        ...p,
+        emailRefreshedAt: '2026-05-01T00:00:00.000Z',
+        newsletter: { optedIn: false, optedInAt: null, optedOutAt: null, unsubscribeToken: null },
+        updatedAt: '2026-05-01T00:00:00.000Z',
+      }),
+    );
+    await writeFile(join(privateStore.path, 'profiles.jsonl'), profiles.join('\n') + '\n');
+
+    app = await buildApp({
+      serverOptions: { logger: false },
+      overrideEnv: {
+        CFP_DATA_REPO_PATH: dataRepo.path,
+        STORAGE_BACKEND: 'filesystem',
+        CFP_PRIVATE_STORAGE_PATH: privateStore.path,
+        CFP_JWT_SIGNING_KEY: JWT_KEY,
+        NODE_ENV: 'test',
+      },
+    });
+
+    staffCookie = (await mintSessionFor(STAFF_ID, 'staff', JWT_KEY)).accessToken;
+    adminCookie = (await mintSessionFor(ADMIN_ID, 'administrator', JWT_KEY)).accessToken;
+    userCookie = (await mintSessionFor(USER_ID, 'user', JWT_KEY)).accessToken;
+  }, 60_000);
+
+  afterAll(async () => {
+    await app.close();
+    await dataRepo.cleanup();
+    await privateStore.cleanup();
+  });
+
+  const asStaff = (cookie: string) => ({ cookies: { cfp_session: cookie } });
+
+  it('404s for anonymous and ordinary users on all three endpoints', async () => {
+    for (const cookies of [{}, asStaff(userCookie)]) {
+      const list = await app.inject({ method: 'GET', url: '/api/admin/members', ...cookies });
+      expect(list.statusCode).toBe(404);
+      const detail = await app.inject({ method: 'GET', url: '/api/admin/members/newest', ...cookies });
+      expect(detail.statusCode).toBe(404);
+      const vote = await app.inject({
+        method: 'POST',
+        url: '/api/admin/members/newest/vote',
+        payload: { verdict: 'spam' },
+        ...cookies,
+      });
+      expect(vote.statusCode).toBe(404);
+    }
+  });
+
+  it('lists members newest first with staff-visible fields and no vote yet', async () => {
+    const res = await app.inject({ method: 'GET', url: '/api/admin/members', ...asStaff(staffCookie) });
+    expect(res.statusCode).toBe(200);
+    const body = res.json<{ data: Array<Record<string, unknown>>; metadata: { totalItems: number } }>();
+    expect(body.metadata.totalItems).toBe(5);
+    expect(body.data[0]?.['slug']).toBe('newest');
+    const newest = body.data[0]!;
+    expect(newest['email']).toBe('newest@example.org');
+    expect(newest['latestVote']).toBeNull();
+    expect(newest['bioExcerpt']).toBe('Buy cheap pills now');
+    const regular = body.data.find((r) => r['slug'] === 'regular')!;
+    expect(regular['hasGitHubLink']).toBe(true);
+    // Deactivated members are included by default — moderation needs to see what it hid.
+    expect(body.data.some((r) => r['slug'] === 'selfoff')).toBe(true);
+  });
+
+  it('spam vote records human-<voter> and deactivates in the same transaction', async () => {
+    const res = await app.inject({
+      method: 'POST',
+      url: '/api/admin/members/newest/vote',
+      payload: { verdict: 'spam', reasoning: 'pharma bio' },
+      ...asStaff(staffCookie),
+    });
+    expect(res.statusCode).toBe(200);
+    const body = res.json<{ data: { person: { deletedAt: string | null }; vote: { evaluator: string; confidence: number }; latestVote: { verdict: string; voter: { slug: string } } } }>();
+    expect(body.data.vote.evaluator).toBe('human-staffer');
+    expect(body.data.vote.confidence).toBe(1);
+    expect(body.data.person.deletedAt).not.toBeNull();
+    expect(body.data.latestVote.verdict).toBe('spam');
+    expect(body.data.latestVote.voter.slug).toBe('staffer');
+
+    // Hidden from the public detail endpoint now.
+    const pub = await app.inject({ method: 'GET', url: '/api/people/newest' });
+    expect(pub.statusCode).toBe(404);
+
+    // The record landed on the data repo as a committed file, authored by the voter.
+    const tree = await execFileAsync('git', ['ls-tree', '-r', '--name-only', 'HEAD', 'person-evaluations/'], {
+      cwd: dataRepo.path,
+    });
+    expect(tree.stdout.trim().split('\n')).toEqual(['person-evaluations/newest/human-staffer.toml']);
+    const author = await execFileAsync('git', ['log', '-1', '--format=%an <%ae>'], { cwd: dataRepo.path });
+    expect(author.stdout.trim()).toBe('Test staffer <staffer@users.noreply.codeforphilly.org>');
+  });
+
+  it('vote filter and detail endpoint expose the vote history and footprint', async () => {
+    const spamOnly = await app.inject({ method: 'GET', url: '/api/admin/members?vote=spam', ...asStaff(adminCookie) });
+    expect(spamOnly.json<{ data: Array<{ slug: string }> }>().data.map((r) => r.slug)).toEqual(['newest']);
+
+    const none = await app.inject({ method: 'GET', url: '/api/admin/members?vote=none', ...asStaff(adminCookie) });
+    expect(none.json<{ data: Array<{ slug: string }> }>().data.map((r) => r.slug)).not.toContain('newest');
+
+    const detail = await app.inject({ method: 'GET', url: '/api/admin/members/newest', ...asStaff(adminCookie) });
+    expect(detail.statusCode).toBe(200);
+    const d = detail.json<{ data: { person: { slug: string; email: string | null }; footprint: Record<string, unknown[]>; votes: Array<{ verdict: string; reasoning: string | null }> } }>().data;
+    expect(d.person.slug).toBe('newest');
+    expect(d.person.email).toBe('newest@example.org');
+    expect(d.footprint.memberships).toEqual([]);
+    expect(d.votes).toHaveLength(1);
+    expect(d.votes[0]).toMatchObject({ verdict: 'spam', reasoning: 'pharma bio' });
+  });
+
+  it('a legit vote after a spam vote reactivates; re-voting replaces the record', async () => {
+    const res = await app.inject({
+      method: 'POST',
+      url: '/api/admin/members/newest/vote',
+      payload: { verdict: 'legit' },
+      ...asStaff(staffCookie),
+    });
+    expect(res.statusCode).toBe(200);
+    expect(res.json<{ data: { person: { deletedAt: string | null } } }>().data.person.deletedAt).toBeNull();
+
+    const detail = await app.inject({ method: 'GET', url: '/api/admin/members/newest', ...asStaff(staffCookie) });
+    const votes = detail.json<{ data: { votes: Array<{ verdict: string; voter: { slug: string } }> } }>().data.votes;
+    expect(votes).toHaveLength(1);
+    expect(votes[0]).toMatchObject({ verdict: 'legit', voter: { slug: 'staffer' } });
+  });
+
+  it('a legit vote never undoes a self-deactivation', async () => {
+    const res = await app.inject({
+      method: 'POST',
+      url: '/api/admin/members/selfoff/vote',
+      payload: { verdict: 'legit' },
+      ...asStaff(adminCookie),
+    });
+    expect(res.statusCode).toBe(200);
+    expect(res.json<{ data: { person: { deletedAt: string | null } } }>().data.person.deletedAt).not.toBeNull();
+  });
+
+  it('rejects voting on your own account', async () => {
+    const res = await app.inject({
+      method: 'POST',
+      url: '/api/admin/members/staffer/vote',
+      payload: { verdict: 'legit' },
+      ...asStaff(staffCookie),
+    });
+    expect(res.statusCode).toBe(422);
+  });
+
+  it('rejects an unknown sort key', async () => {
+    const res = await app.inject({ method: 'GET', url: '/api/admin/members?sort=bogus', ...asStaff(staffCookie) });
+    expect(res.statusCode).toBe(422);
+  });
+});
diff --git a/apps/api/tests/reload-swap.test.ts b/apps/api/tests/reload-swap.test.ts
index b018837..761d2d4 100644
--- a/apps/api/tests/reload-swap.test.ts
+++ b/apps/api/tests/reload-swap.test.ts
@@ -30,6 +30,7 @@ import {
   createEmptyState,
   indexBlogPost,
   indexHelpWantedInterest,
+  indexPersonEvaluation,
   indexHelpWantedRole,
   indexMembership,
   indexPerson,
@@ -159,6 +160,14 @@ function buildState(base: number, slugs: { project: string; buzz: string; oldSlu
   indexHelpWantedRole(state, role);
   indexHelpWantedInterest(state, makeInterest(base + 10, role.id, person.id));
   indexSlugHistory(state, makeSlugHistory(base + 11, project.id, slugs.oldSlug, slugs.project));
+  indexPersonEvaluation(state, {
+    personSlug: person.slug,
+    evaluator: 'human-voter' + base,
+    verdict: 'legit',
+    confidence: 1,
+    flags: [],
+    evaluatedAt: '2026-05-01T00:00:00Z',
+  });
   return state;
 }
 
diff --git a/apps/web/src/App.tsx b/apps/web/src/App.tsx
index e794b09..886063a 100644
--- a/apps/web/src/App.tsx
+++ b/apps/web/src/App.tsx
@@ -35,6 +35,7 @@ import { AccountClaimByPassword } from '@/pages/AccountClaimByPassword';
 import { AccountClaimRequestStaffReview } from '@/pages/AccountClaimRequestStaffReview';
 import { AccountClaimLegacy } from '@/pages/AccountClaimLegacy';
 import { StaffAccountClaimQueue } from '@/pages/StaffAccountClaimQueue';
+import { AdminMembers } from '@/pages/AdminMembers';
 
 const router = createBrowserRouter([
   {
@@ -74,6 +75,8 @@ const router = createBrowserRouter([
       { path: '/account-claim/request-staff-review', element: <AccountClaimRequestStaffReview /> },
       { path: '/account/claim-legacy', element: <AccountClaimLegacy /> },
       { path: '/staff/account-claim', element: <StaffAccountClaimQueue /> },
+      { path: '/admin/members', element: <AdminMembers /> },
+      { path: '/admin/members/:slug', element: <AdminMembers /> },
       { path: '*', element: <NotFound /> },
     ],
   },
diff --git a/apps/web/src/components/AppHeader.tsx b/apps/web/src/components/AppHeader.tsx
index 2a303e3..f76d939 100644
--- a/apps/web/src/components/AppHeader.tsx
+++ b/apps/web/src/components/AppHeader.tsx
@@ -127,6 +127,9 @@ function AuthControls({ mobile = false }: { mobile?: boolean }) {
             <DropdownMenuItem asChild>
               <Link to="/tags?staff=true">Manage tags</Link>
             </DropdownMenuItem>
+            <DropdownMenuItem asChild>
+              <Link to="/admin/members">Members roster</Link>
+            </DropdownMenuItem>
             <DropdownMenuItem disabled>Recent staff actions</DropdownMenuItem>
             <DropdownMenuSeparator />
           </>
diff --git a/apps/web/src/lib/api.ts b/apps/web/src/lib/api.ts
index 74174d2..175a875 100644
--- a/apps/web/src/lib/api.ts
+++ b/apps/web/src/lib/api.ts
@@ -580,6 +580,70 @@ export interface UpdateTagInput {
   mergeInto?: string;
 }
 
+// --- Moderation (specs/api/moderation.md) ---------------------------------
+
+export type VoteVerdict = 'spam' | 'legit';
+
+export interface VoteView {
+  readonly verdict: 'spam' | 'legit' | 'uncertain';
+  readonly reasoning: string | null;
+  readonly voter: { readonly slug: string; readonly fullName: string };
+  readonly evaluatedAt: string;
+}
+
+export interface MemberRow {
+  readonly id: string;
+  readonly slug: string;
+  readonly fullName: string;
+  readonly avatarUrl: string | null;
+  readonly createdAt: string;
+  readonly deletedAt: string | null;
+  readonly email: string | null;
+  readonly hasGitHubLink: boolean;
+  readonly lastLoginAt: string | null;
+  readonly bioExcerpt: string;
+  readonly footprint: {
+    readonly memberships: number;
+    readonly updates: number;
+    readonly buzz: number;
+    readonly blogPosts: number;
+    readonly helpWantedInterest: number;
+    readonly tags: number;
+  };
+  readonly latestVote: VoteView | null;
+}
+
+export interface MemberListParams {
+  q?: string;
+  vote?: 'none' | VoteVerdict;
+  joinedAfter?: string;
+  joinedBefore?: string;
+  includeDeactivated?: boolean;
+  sort?: string;
+  page?: number;
+  perPage?: number;
+}
+
+interface ProjectRef {
+  readonly slug: string;
+  readonly title: string;
+}
+
+export interface MemberFootprint {
+  readonly memberships: Array<{ project: ProjectRef; role: string; joinedAt: string }>;
+  readonly updates: Array<{ project: ProjectRef; number: number; title: string; postedAt: string }>;
+  readonly buzz: Array<{ project: ProjectRef; slug: string; title: string; postedAt: string }>;
+  readonly blogPosts: Array<{ slug: string; title: string; postedAt: string }>;
+  readonly helpWantedInterest: Array<{ project: ProjectRef; role: { title: string }; createdAt: string }>;
+  readonly tags: Array<{ handle: string; type: string }>;
+}
+
+export interface MemberDetail {
+  readonly person: PersonDetail;
+  readonly footprint: MemberFootprint;
+  readonly votes: VoteView[];
+}
+
 export const api = {
   preview: (source: string): Promise<SuccessEnvelope<{ html: string }>> =>
     request(`/api/_preview`, {
@@ -831,6 +895,21 @@ export const api = {
         body: JSON.stringify({ claimedSlug, evidence }),
       }),
   },
+  admin: {
+    members: (params: MemberListParams = {}): Promise<PaginatedEnvelope<MemberRow>> =>
+      request(`/api/admin/members${buildQuery(params)}`),
+    member: (slug: string): Promise<SuccessEnvelope<MemberDetail>> =>
+      request(`/api/admin/members/${encodeURIComponent(slug)}`),
+    vote: (
+      slug: string,
+      verdict: VoteVerdict,
+      reasoning?: string,
+    ): Promise<SuccessEnvelope<{ person: PersonDetail; vote: unknown; latestVote: VoteView | null }>> =>
+      request(`/api/admin/members/${encodeURIComponent(slug)}/vote`, {
+        method: 'POST',
+        body: JSON.stringify(reasoning ? { verdict, reasoning } : { verdict }),
+      }),
+  },
   staffAccountClaim: {
     queue: (): Promise<SuccessEnvelope<AccountClaimQueueItem[]>> =>
       request(`/api/staff/account-claim/queue`),
diff --git a/apps/web/src/pages/AdminMembers.tsx b/apps/web/src/pages/AdminMembers.tsx
new file mode 100644
index 0000000..bd97655
--- /dev/null
+++ b/apps/web/src/pages/AdminMembers.tsx
@@ -0,0 +1,414 @@
+/**
+ * /admin/members — staff roster with footprint and human spam votes.
+ * Per specs/screens/admin-members.md.
+ */
+import { useEffect, useState, type FormEvent } from 'react';
+import { Link, useNavigate, useParams, useSearchParams } from 'react-router';
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
+import { toast } from 'sonner';
+import { Button } from '@/components/ui/button';
+import { Input } from '@/components/ui/input';
+import { Label } from '@/components/ui/label';
+import { Textarea } from '@/components/ui/textarea';
+import { useAuth } from '@/hooks/useAuth';
+import { api, ApiError, type MemberListParams, type MemberRow, type VoteVerdict, type VoteView } from '@/lib/api';
+import { formatAbsoluteDate, formatRelativeTime } from '@/lib/time';
+
+const PER_PAGE = 50;
+
+function isStaff(level: string | undefined): boolean {
+  return level === 'staff' || level === 'administrator';
+}
+
+function VoteBadge({ vote, hiddenByVote }: { vote: VoteView; hiddenByVote: boolean }) {
+  const spam = vote.verdict === 'spam';
+  return (
+    <span
+      className={`inline-flex items-center gap-1 rounded-full px-2 py-0.5 text-xs font-medium ${
+        spam ? 'bg-destructive/10 text-destructive' : 'bg-emerald-100 text-emerald-800'
+      }`}
+      title={vote.reasoning ?? undefined}
+    >
+      {spam ? 'Spam' : 'Not spam'} · {vote.voter.fullName} · {formatRelativeTime(vote.evaluatedAt)}
+      {hiddenByVote ? ' · hidden' : ''}
+    </span>
+  );
+}
+
+function VoteButtons({
+  slug,
+  disabled,
+  onDone,
+}: {
+  slug: string;
+  disabled: boolean;
+  onDone: () => Promise<void>;
+}) {
+  const [confirming, setConfirming] = useState<VoteVerdict | null>(null);
+  const [reasoning, setReasoning] = useState('');
+  const mutation = useMutation({
+    mutationFn: ({ verdict, why }: { verdict: VoteVerdict; why: string }) =>
+      api.admin.vote(slug, verdict, why.trim() || undefined),
+    onSuccess: async (_res, vars) => {
+      toast.success(vars.verdict === 'spam' ? 'Marked as spam and hidden' : 'Marked as not spam');
+      setConfirming(null);
+      setReasoning('');
+      await onDone();
+    },
+    onError: (err) => toast.error(err instanceof ApiError ? err.message : 'Vote failed'),
+  });
+
+  if (confirming) {
+    const submit = (e: FormEvent) => {
+      e.preventDefault();
+      mutation.mutate({ verdict: confirming, why: reasoning });
+    };
+    return (
+      <form onSubmit={submit} className="flex flex-col gap-2">
+        <Label htmlFor={`why-${slug}`} className="text-xs">
+          {confirming === 'spam' ? 'Why spam? (optional, saved with your vote)' : 'Note (optional)'}
+        </Label>
+        <Textarea
+          id={`why-${slug}`}
+          value={reasoning}
+          onChange={(e) => setReasoning(e.target.value)}
+          maxLength={1000}
+          rows={2}
+          className="text-sm"
+        />
+        <div className="flex gap-2">
+          <Button type="submit" size="sm" variant={confirming === 'spam' ? 'destructive' : 'default'} disabled={mutation.isPending}>
+            Confirm {confirming === 'spam' ? 'spam' : 'not spam'}
+          </Button>
+          <Button type="button" size="sm" variant="ghost" onClick={() => setConfirming(null)} disabled={mutation.isPending}>
+            Cancel
+          </Button>
+        </div>
+      </form>
+    );
+  }
+  return (
+    <div className="flex gap-2">
+      <Button size="sm" variant="destructive" disabled={disabled} onClick={() => setConfirming('spam')}>
+        Spam
+      </Button>
+      <Button size="sm" variant="outline" disabled={disabled} onClick={() => setConfirming('legit')}>
+        Not spam
+      </Button>
+    </div>
+  );
+}
+
+function MemberRowView({
+  row,
+  selfSlug,
+  expanded,
+  onToggle,
+  onChanged,
+}: {
+  row: MemberRow;
+  selfSlug: string | undefined;
+  expanded: boolean;
+  onToggle: () => void;
+  onChanged: () => Promise<void>;
+}) {
+  const [changing, setChanging] = useState(false);
+  const hiddenByVote = row.deletedAt !== null && row.latestVote?.verdict === 'spam';
+  const isSelf = row.slug === selfSlug;
+  const fp = row.footprint;
+  const counts = [
+    `${fp.memberships} project${fp.memberships === 1 ? '' : 's'}`,
+    fp.updates ? `${fp.updates} update${fp.updates === 1 ? '' : 's'}` : null,
+    fp.buzz ? `${fp.buzz} buzz` : null,
+    fp.blogPosts ? `${fp.blogPosts} post${fp.blogPosts === 1 ? '' : 's'}` : null,
+    fp.helpWantedInterest ? `${fp.helpWantedInterest} help-wanted` : null,
+    `${fp.tags} tag${fp.tags === 1 ? '' : 's'}`,
+  ].filter(Boolean);
+
+  return (
+    <li className={`rounded-lg border p-4 ${row.deletedAt ? 'opacity-60' : ''}`}>
+      <div className="flex flex-wrap items-start gap-4">
+        {row.avatarUrl ? (
+          <img src={row.avatarUrl} alt="" className="h-12 w-12 rounded-full object-cover" />
+        ) : (
+          <div className="h-12 w-12 rounded-full bg-muted" aria-hidden="true" />
+        )}
+        <div className="min-w-0 flex-1">
+          <div className="flex flex-wrap items-center gap-x-2 gap-y-1">
+            <Link to={`/members/${row.slug}`} target="_blank" rel="noreferrer" className="font-semibold hover:underline">
+              {row.fullName}
+            </Link>
+            <span className="text-sm text-muted-foreground">@{row.slug}</span>
+            {row.hasGitHubLink && (
+              <span className="rounded bg-muted px-1.5 py-0.5 text-xs">GitHub</span>
+            )}
+            {row.deletedAt && (
+              <span className="rounded bg-muted px-1.5 py-0.5 text-xs">
+                {hiddenByVote ? `Hidden by ${row.latestVote?.voter.fullName ?? 'vote'}` : 'Deactivated'}
+              </span>
+            )}
+          </div>
+          <div className="mt-1 text-sm text-muted-foreground">
+            joined {formatRelativeTime(row.createdAt)}
+            {row.lastLoginAt ? ` · last sign-in ${formatRelativeTime(row.lastLoginAt)}` : ' · never signed in'}
+            {row.email ? ` · ${row.email}` : ''}
+          </div>
+          {row.bioExcerpt && <p className="mt-1 text-sm">{row.bioExcerpt}</p>}
+          <div className="mt-1 text-xs text-muted-foreground">{counts.join(' · ')}</div>
+        </div>
+        <div className="flex flex-col items-end gap-2">
+          {row.latestVote && !changing ? (
+            <>
+              <VoteBadge vote={row.latestVote} hiddenByVote={hiddenByVote} />
+              <Button size="sm" variant="ghost" onClick={() => setChanging(true)} disabled={isSelf}>
+                Change
+              </Button>
+            </>
+          ) : (
+            <VoteButtons
+              slug={row.slug}
+              disabled={isSelf}
+              onDone={async () => {
+                setChanging(false);
+                await onChanged();
+              }}
+            />
+          )}
+          <Button size="sm" variant="link" onClick={onToggle} aria-expanded={expanded}>
+            {expanded ? 'Hide details' : 'Details'}
+          </Button>
+        </div>
+      </div>
+      {expanded && <MemberDetailView slug={row.slug} />}
+    </li>
+  );
+}
+
+function MemberDetailView({ slug }: { slug: string }) {
+  const q = useQuery({ queryKey: ['admin-member', slug], queryFn: () => api.admin.member(slug) });
+  if (q.isLoading) return <p className="mt-3 text-sm text-muted-foreground">Loading…</p>;
+  if (q.isError || !q.data) return <p className="mt-3 text-sm text-destructive">Could not load details.</p>;
+  const { person, footprint, votes } = q.data.data;
+  const section = (title: string, items: React.ReactNode[]) =>
+    items.length > 0 ? (
+      <div>
+        <h3 className="text-sm font-semibold">{title}</h3>
+        <ul className="ml-4 list-disc text-sm">{items}</ul>
+      </div>
+    ) : null;
+  return (
+    <div className="mt-4 grid gap-4 border-t pt-4 md:grid-cols-2">
+      <div className="space-y-3">
+        {person.bioHtml ? (
+          <div className="prose prose-sm max-w-none" dangerouslySetInnerHTML={{ __html: person.bioHtml }} />
+        ) : (
+          <p className="text-sm text-muted-foreground">No bio.</p>
+        )}
+        {section(
+          'Projects',
+          footprint.memberships.map((m) => (
+            <li key={`${m.project.slug}-${m.joinedAt}`}>
+              <Link to={`/projects/${m.project.slug}`} className="hover:underline">{m.project.title}</Link> — {m.role}, joined {formatAbsoluteDate(m.joinedAt)}
+            </li>
+          )),
+        )}
+        {section(
+          'Updates',
+          footprint.updates.map((u) => (
+            <li key={`${u.project.slug}-${u.number}`}>
+              <Link to={`/projects/${u.project.slug}/updates/${u.number}`} className="hover:underline">{u.title || `Update #${u.number}`}</Link> on {u.project.title}, {formatAbsoluteDate(u.postedAt)}
+            </li>
+          )),
+        )}
+        {section(
+          'Buzz',
+          footprint.buzz.map((b) => (
+            <li key={b.slug}>{b.title} on {b.project.title}, {formatAbsoluteDate(b.postedAt)}</li>
+          )),
+        )}
+        {section(
+          'Blog posts',
+          footprint.blogPosts.map((bp) => (
+            <li key={bp.slug}><Link to={`/blog/${bp.slug}`} className="hover:underline">{bp.title}</Link>, {formatAbsoluteDate(bp.postedAt)}</li>
+          )),
+        )}
+        {section(
+          'Help-wanted interest',
+          footprint.helpWantedInterest.map((i, idx) => (
+            <li key={idx}>{i.role.title} on {i.project.title}, {formatAbsoluteDate(i.createdAt)}</li>
+          )),
+        )}
+        {footprint.tags.length > 0 && (
+          <div>
+            <h3 className="text-sm font-semibold">Tags</h3>
+            <p className="text-sm">{footprint.tags.map((t) => t.handle).join(', ')}</p>
+          </div>
+        )}
+      </div>
+      <div>
+        <h3 className="text-sm font-semibold">Votes</h3>
+        {votes.length === 0 ? (
+          <p className="text-sm text-muted-foreground">No human votes yet.</p>
+        ) : (
+          <ul className="space-y-2 text-sm">
+            {votes.map((v) => (
+              <li key={`${v.voter.slug}-${v.evaluatedAt}`}>
+                <VoteBadge vote={v} hiddenByVote={false} />
+                {v.reasoning && <p className="mt-1 text-muted-foreground">{v.reasoning}</p>}
+              </li>
+            ))}
+          </ul>
+        )}
+        <p className="mt-4 text-xs text-muted-foreground">
+          Purge lives on the <Link to={`/members/${slug}`} className="underline">person page</Link> (admins).
+        </p>
+      </div>
+    </div>
+  );
+}
+
+export function AdminMembers() {
+  const { person, loading } = useAuth();
+  const navigate = useNavigate();
+  const queryClient = useQueryClient();
+  const params = useParams<{ slug?: string }>();
+  const [searchParams, setSearchParams] = useSearchParams();
+  const [expanded, setExpanded] = useState<string | null>(params.slug ?? null);
+
+  const allowed = !!person && isStaff(person.accountLevel);
+  useEffect(() => {
+    if (loading) return;
+    if (!person) {
+      void navigate('/login?return=/admin/members', { replace: true });
+      return;
+    }
+    if (!isStaff(person.accountLevel)) {
+      void navigate('/404', { replace: true });
+    }
+  }, [loading, person, navigate]);
+
+  const listParams: MemberListParams = {
+    q: searchParams.get('q') || undefined,
+    vote: (searchParams.get('vote') as MemberListParams['vote']) || undefined,
+    includeDeactivated: searchParams.get('hidden') !== '0',
+    sort: searchParams.get('sort') || undefined,
+    page: Number(searchParams.get('page') || '1'),
+    perPage: PER_PAGE,
+  };
+  const listQ = useQuery({
+    queryKey: ['admin-members', listParams],
+    queryFn: () => api.admin.members(listParams),
+    enabled: allowed,
+  });
+
+  const setParam = (key: string, value: string | null) => {
+    const next = new URLSearchParams(searchParams);
+    if (value === null || value === '') next.delete(key);
+    else next.set(key, value);
+    if (key !== 'page') next.delete('page');
+    setSearchParams(next);
+  };
+
+  const refresh = async () => {
+    await queryClient.invalidateQueries({ queryKey: ['admin-members'] });
+    await queryClient.invalidateQueries({ queryKey: ['admin-member'] });
+  };
+
+  if (!allowed) return null;
+
+  const meta = listQ.data?.metadata;
+
+  return (
+    <div className="container mx-auto max-w-5xl px-4 py-8">
+      <h1 className="text-2xl font-bold">Members roster</h1>
+      <p className="mt-1 text-sm text-muted-foreground">
+        Newest signups first. Votes are recorded under your name; a spam vote hides the member immediately and the next
+        pipeline run removes them.
+      </p>
+
+      <form
+        className="mt-4 flex flex-wrap items-end gap-3"
+        onSubmit={(e) => {
+          e.preventDefault();
+          const data = new FormData(e.currentTarget);
+          setParam('q', String(data.get('q') ?? ''));
+        }}
+      >
+        <div className="flex flex-col gap-1">
+          <Label htmlFor="q" className="text-xs">Search</Label>
+          <Input id="q" name="q" defaultValue={listParams.q ?? ''} placeholder="name, @slug, bio, email" className="w-64" />
+        </div>
+        <div className="flex flex-col gap-1">
+          <Label htmlFor="vote" className="text-xs">Vote</Label>
+          <select
+            id="vote"
+            className="h-9 rounded-md border bg-background px-2 text-sm"
+            value={listParams.vote ?? ''}
+            onChange={(e) => setParam('vote', e.target.value)}
+          >
+            <option value="">Any</option>
+            <option value="none">No vote yet</option>
+            <option value="spam">Voted spam</option>
+            <option value="legit">Voted not spam</option>
+          </select>
+        </div>
+        <div className="flex flex-col gap-1">
+          <Label htmlFor="sort" className="text-xs">Sort</Label>
+          <select
+            id="sort"
+            className="h-9 rounded-md border bg-background px-2 text-sm"
+            value={listParams.sort ?? '-createdAt'}
+            onChange={(e) => setParam('sort', e.target.value)}
+          >
+            <option value="-createdAt">Newest first</option>
+            <option value="createdAt">Oldest first</option>
+            <option value="-lastLoginAt">Last sign-in</option>
+            <option value="fullName">Name</option>
+          </select>
+        </div>
+        <label className="flex items-center gap-2 text-sm">
+          <input
+            type="checkbox"
+            checked={listParams.includeDeactivated !== false}
+            onChange={(e) => setParam('hidden', e.target.checked ? null : '0')}
+          />
+          Show deactivated
+        </label>
+        <Button type="submit" size="sm">Apply</Button>
+      </form>
+
+      {listQ.isLoading && <p className="mt-6 text-sm text-muted-foreground">Loading…</p>}
+      {listQ.isError && <p className="mt-6 text-sm text-destructive">Could not load the roster.</p>}
+      {listQ.data && (
+        <>
+          <p className="mt-6 text-sm text-muted-foreground" role="status">
+            {meta?.totalItems ?? 0} member{meta?.totalItems === 1 ? '' : 's'}
+            {meta && meta.totalPages > 1 ? ` · page ${meta.page} of ${meta.totalPages}` : ''}
+          </p>
+          <ul className="mt-2 space-y-3">
+            {listQ.data.data.map((row) => (
+              <MemberRowView
+                key={row.id}
+                row={row}
+                selfSlug={person?.slug}
+                expanded={expanded === row.slug}
+                onToggle={() => setExpanded(expanded === row.slug ? null : row.slug)}
+                onChanged={refresh}
+              />
+            ))}
+          </ul>
+          {meta && meta.totalPages > 1 && (
+            <nav className="mt-4 flex items-center gap-2" aria-label="Pagination">
+              <Button size="sm" variant="outline" disabled={meta.page <= 1} onClick={() => setParam('page', String(meta.page - 1))}>
+                Previous
+              </Button>
+              <Button size="sm" variant="outline" disabled={meta.page >= meta.totalPages} onClick={() => setParam('page', String(meta.page + 1))}>
+                Next
+              </Button>
+            </nav>
+          )}
+        </>
+      )}
+    </div>
+  );
+}
diff --git a/docs/operations/spam-detection.md b/docs/operations/spam-detection.md
index 4e00cc9..2265e0d 100644
--- a/docs/operations/spam-detection.md
+++ b/docs/operations/spam-detection.md
@@ -2,11 +2,18 @@
 
 The `codeforphilly-data` site has accumulated tens of thousands of legacy signups, the majority of which are spam — SEO link drops, gambling / adult / cleaning-service promotional bios, foreign-language commercial content, and so on. This document describes the multi-pass evaluation system that scores every person record and the workflow for refreshing the evaluations as new data arrives.
 
-> See also: the [codeforphilly-data repo](https://github.com/CodeForPhilly/codeforphilly-data), currently on the `spam-detection` branch where the scripts, sheet configs, and evaluation data all live.
+> See also: the private [codeforphilly-spam-detection repo](https://github.com/CodeForPhilly/codeforphilly-spam-detection), where the scripts, the evaluation sheet configs, and the machine-produced evaluation data live. Staff **human votes** live in the public data repo (`person-evaluations` on `published`) — see [specs/api/moderation.md](../../specs/api/moderation.md).
 
 ## Where everything lives
 
-All work — scripts, sheet configs, and evaluation records — currently sits on the `spam-detection` branch of `codeforphilly-data`. Eventually this will migrate (scripts + configs up to `empty`, eval data down to `published`), but for now treat `spam-detection` as the source of truth for the spam moderation surface.
+Since 2026-09-18 the pipeline is split across two repositories:
+
+| Repo | Visibility | Holds |
+| --- | --- | --- |
+| `CodeForPhilly/codeforphilly-spam-detection` | **private** | scripts, the four evaluation sheet configs, machine `person-evaluations` (heuristic + LLM), and the Slack-derived sheets. Slack message text, Slack identities, and LLM prose about named people never leave it. |
+| `CodeForPhilly/codeforphilly-data` | public-by-design | the served data on `published`, plus `person-evaluations` records written by the site: staff votes with `evaluator = "human-<voterSlug>"`. |
+
+The scripts read people/projects/etc. from a clone of the data repo on `published` (`CFP_DATA_GIT_DIR`) and write only to the private repo. The prune reads machine verdicts from the private repo and human votes from `published`; **a human vote is final** ([spam-exclusion.md](../../specs/behaviors/spam-exclusion.md)). The old `spam-detection` branch of the data repo was deleted when the split landed.
 
 ## Data model
 
@@ -108,7 +115,7 @@ Per-person cache at `.llm-eval-cache/<evaluator>.json`, flushed every 50 evaluat
 `person-evaluations` is keyed `personSlug/evaluator`, so multiple evaluator opinions coexist per person. To compute the authoritative verdict for a given slug, apply priority:
 
 ```
-1. Any `human:*` evaluator        → use that  (manual override is final)
+1. Any `human-*` evaluator        → use that  (manual override is final)
 2. Latest `haiku-*` evaluator     → use that  (most recent LLM is current)
 3. Latest `heuristic-*` evaluator → use that
 4. No record                      → treat as legit (default-allow per
@@ -119,12 +126,12 @@ When new evaluator versions ship (e.g. `haiku-2026-06` with rubric improvements)
 
 ## Manual overrides
 
-To override an LLM verdict for one person — for example, to mark a mis-flagged spammer as legit, or to confirm a high-confidence-spam call as definitely-spam before a deletion pass — upsert a `human:<your-handle>` record:
+To override an LLM verdict for one person — for example, to mark a mis-flagged spammer as legit, or to confirm a high-confidence-spam call as definitely-spam before a deletion pass — upsert a `human-<your-handle>` record:
 
 ```bash
 gitsheets-axi upsert person-evaluations --data '{
   "personSlug": "ackrolix123",
-  "evaluator": "human:chris",
+  "evaluator": "human-chris",
   "verdict": "legit",
   "confidence": 1.0,
   "flags": ["manual-override"],
@@ -133,18 +140,17 @@ gitsheets-axi upsert person-evaluations --data '{
 }'
 ```
 
-Because the path template is `${{ personSlug }}/${{ evaluator }}` and `evaluator` is `human:chris`, the file lands at `person-evaluations/ackrolix123/human:chris.toml`. Verdict aggregation will pick it up automatically.
+Because the path template is `${{ personSlug }}/${{ evaluator }}` and `evaluator` is `human-chris`, the file lands at `person-evaluations/ackrolix123/human-chris.toml`. Verdict aggregation will pick it up automatically.
 
-To unset a human override, `gitsheets-axi delete person-evaluations ackrolix123/human:chris`.
+To unset a human override, `gitsheets-axi delete person-evaluations ackrolix123/human-chris`.
 
 ## Refreshing evaluations after new data arrives
 
 `legacy-import` snapshots and live API writes land new + updated person records on `published`. To refresh:
 
 ```bash
-# 1. Pull latest data
-git fetch origin published
-git merge origin/published     # or rebase onto spam-detection's data work
+# 1. Refresh the data clone the scripts read from (CFP_DATA_GIT_DIR, HEAD on published)
+git -C $CFP_DATA_GIT_DIR fetch origin published:published
 
 # 2. Refresh Slack snapshot (cheap — cache hits if no new channels)
 npm run fetch-slack
@@ -158,6 +164,13 @@ npm run evaluate-heuristic
 # 5. LLM-eval the new uncertain bucket
 npm run evaluate-llm
 
+# 5b. LLM-confirm the heuristic-spam bucket. REQUIRED: heuristic records carry a
+#     `score` but no `confidence`, so the prune ignores them until Haiku confirms.
+npm run evaluate-llm -- --filter spam
+
+# 5c. Push the evaluations (they commit to this repo's current branch)
+git push
+
 # 6. Apply the verdicts — prune confident-spam from `published` (see below).
 #    Run from the codeforphilly-ng repo against a bare clone, then push.
 #    THIS STEP IS MANDATORY after any import/merge — see "Applying spam decisions".
@@ -173,13 +186,13 @@ When source records get updated (e.g., a previously-empty profile gets a new bio
 
 Verdicts are advisory until the **prune** step applies them. Prune is not a read-path filter (the runtime loader stays spam-unaware); it **removes confident-spam people from `published`** so the deployed app never loads them into memory or shows them. This is what keeps the in-memory footprint within the node budget — see [specs/behaviors/spam-exclusion.md](../../specs/behaviors/spam-exclusion.md) for the full contract.
 
-The tool is `apps/api/scripts/prune-spam.ts` in the **`codeforphilly-ng`** repo (not the data repo). Run it against a bare clone of the data repo that carries both `published` and `spam-detection`, dry-run first, then push:
+The tool is `apps/api/scripts/prune-spam.ts` in the **`codeforphilly-ng`** repo (not the data repo). Run it against a bare clone of the data repo (`--data-repo`, carrying `published` with the staff votes) and a clone of the private repo (`--evaluations-repo`), dry-run first, then push:
 
 ```bash
 # From the codeforphilly-ng repo
 npm run -w apps/api script:prune-spam -- \
   --data-repo=/path/to/codeforphilly-data.git \
-  --evaluations-ref=spam-detection \
+  --evaluations-repo=/path/to/codeforphilly-spam-detection \
   --branch=published \
   --threshold=0.8 \
   --dry-run                       # drop --dry-run to commit the prune
@@ -247,4 +260,4 @@ legit     11,819  (37.6%)
 uncertain     28  (0.09%)  — review backlog
 ```
 
-The 28 uncertain are the small set worth eyeballing for tuning the rubric or supplying manual `human:*` overrides.
+The 28 uncertain are the small set worth eyeballing for tuning the rubric or supplying manual `human-*` overrides.
diff --git a/packages/shared/src/schemas/index.ts b/packages/shared/src/schemas/index.ts
index 1d206fc..bdeba63 100644
--- a/packages/shared/src/schemas/index.ts
+++ b/packages/shared/src/schemas/index.ts
@@ -45,3 +45,11 @@ export type { PasswordToken } from './password-token.js';
 
 export { AccountClaimRequestSchema } from './account-claim-request.js';
 export type { AccountClaimRequest } from './account-claim-request.js';
+export {
+  PersonEvaluationSchema,
+  HUMAN_EVALUATOR_PREFIX,
+  isHumanEvaluator,
+  humanEvaluatorFor,
+  personEvaluationKey,
+} from './person-evaluation.js';
+export type { PersonEvaluation } from './person-evaluation.js';
diff --git a/packages/shared/src/schemas/person-evaluation.ts b/packages/shared/src/schemas/person-evaluation.ts
new file mode 100644
index 0000000..d768903
--- /dev/null
+++ b/packages/shared/src/schemas/person-evaluation.ts
@@ -0,0 +1,38 @@
+import { z } from 'zod';
+
+/**
+ * One spam verdict per (person, evaluator) — the `person-evaluations` sheet.
+ *
+ * On the public data repo the only writer is the site: staff votes with
+ * `evaluator = "human-<voterSlug>"`. Machine evaluators (heuristic, LLM) live
+ * in the private spam-detection repo and share this shape so the prune can
+ * aggregate both. See specs/behaviors/spam-exclusion.md.
+ */
+export const PersonEvaluationSchema = z.object({
+  personSlug: z.string().min(1),
+  evaluator: z.string().min(1),
+  verdict: z.enum(['spam', 'legit', 'uncertain']),
+  /** LLM and human evaluators: 0–1 (human votes are 1). Absent on heuristic records. */
+  confidence: z.number().min(0).max(1).optional(),
+  /** Heuristic evaluators only: rule points, unbounded. */
+  score: z.number().int().optional(),
+  flags: z.array(z.string()),
+  reasoning: z.string().optional(),
+  evaluatedAt: z.string().datetime({ offset: true }),
+});
+
+export type PersonEvaluation = z.infer<typeof PersonEvaluationSchema>;
+
+export const HUMAN_EVALUATOR_PREFIX = 'human-';
+
+export function isHumanEvaluator(evaluator: string): boolean {
+  return evaluator.startsWith(HUMAN_EVALUATOR_PREFIX);
+}
+
+export function humanEvaluatorFor(voterSlug: string): string {
+  return `${HUMAN_EVALUATOR_PREFIX}${voterSlug}`;
+}
+
+export function personEvaluationKey(personSlug: string, evaluator: string): string {
+  return `${personSlug}/${evaluator}`;
+}
diff --git a/plans/admin-members-moderation.md b/plans/admin-members-moderation.md
new file mode 100644
index 0000000..0df0e5c
--- /dev/null
+++ b/plans/admin-members-moderation.md
@@ -0,0 +1,86 @@
+---
+status: done
+depends: [person-deactivate-purge, spam-prune]
+specs:
+  - specs/screens/admin-members.md
+  - specs/api/moderation.md
+  - specs/behaviors/spam-exclusion.md
+  - specs/behaviors/person-lifecycle.md
+issues: []
+pr: 187
+---
+
+# Plan: admin members roster + human spam votes
+
+## Scope
+
+Staff need one place to see who joined recently, what they've done on the site,
+and to record a human spam/not-spam judgment that the offline pipeline treats
+as final. Decisions taken 2026-09-18 with Chris:
+
+- The page shows the member's **footprint**, not machine evaluations — anyone
+  listed has already passed (or post-dates) the pipeline.
+- A **spam vote deactivates immediately**; the pipeline hard-deletes later.
+  A legit vote reverses a vote-set deactivation only.
+- Staff see the member's **email** (already a staff-visible field).
+- Route is **`/admin/members`**, open to staff and administrators.
+- Machine evaluations and Slack-derived inputs move to a **private repo**
+  (codeforphilly-data issue); the public repo carries only human votes.
+
+In: the two read endpoints, the vote endpoint with its lifecycle side effect,
+loading `person-evaluations` (human votes) from `published`, the screen.
+Out: machine verdicts on the page; bulk actions; in-process heuristic at
+signup; the private-repo migration itself (tracked on the data repo).
+
+## Implements
+
+- [screens/admin-members.md](../specs/screens/admin-members.md)
+- [api/moderation.md](../specs/api/moderation.md)
+- [behaviors/spam-exclusion.md](../specs/behaviors/spam-exclusion.md) —
+  human votes on `published`; the "human vote is final" aggregation clause.
+- [behaviors/person-lifecycle.md](../specs/behaviors/person-lifecycle.md) —
+  vote-driven deactivate and its reversal rule.
+
+## Approach
+
+1. **Data repo first**: add `.gitsheets/person-evaluations.toml` (same schema
+   as the pipeline's, so records are interchangeable) to `empty` and
+   `published`. The importer/prune never touch this sheet.
+2. **Schema**: `PersonEvaluation` in `packages/shared` (verdict, evaluator,
+   confidence?, score?, flags, reasoning?, evaluatedAt, personSlug).
+3. **Store**: register the sheet in `store/public.ts`; add
+   `personEvaluations` + `evaluationsByPerson` to `InMemoryState`, state-apply,
+   and the hot-reload swap (the swap enumerates `Object.keys(fresh)`, so the new
+   maps are covered automatically — add the integration assertion anyway).
+4. **Services**: `moderation` service — roster query (sort/filter/paginate over
+   people + private profiles + vote index), footprint assembly from existing
+   indices (`membershipsByPerson`, updates/buzz/blog by author, interest,
+   tag-assignments), and `castVote()` inside the write mutex: upsert the
+   `human-<voter>` record, apply the deactivate/reactivate rule, one commit
+   authored by the voter.
+5. **Routes**: `apps/api/src/routes/moderation.ts` — three endpoints, staff
+   guard that 404s. Reuse the people serializer's staff-visible fields.
+6. **Web**: `pages/AdminMembers.tsx` (+ `AdminMemberDetail`), routes
+   `/admin/members` and `/admin/members/:slug`, guarded like the staff queue;
+   nav entry for staff.
+7. **Pipeline**: `prune-spam` reads human votes from `published` in addition to
+   machine records (`--evaluations-ref` stays for the private clone); update
+   `docs/operations/spam-detection.md` for the two-repo layout.
+
+## Validation
+
+- API: staff sees roster/footprint/email, non-staff and anonymous get 404 on
+  all three; vote writes a `human-<slug>` record and deactivates; legit vote
+  after spam reactivates; legit vote after self-deactivate does not; self-vote
+  422; re-voting replaces the caller's record; hot reload keeps the vote index.
+- Web: roster renders, filters work, vote buttons update row state, own row
+  disabled; a11y pass on the grid (landmarks, button names).
+- Prune: a person with a human `spam` vote is pruned even with a membership;
+  a human `legit` vote protects against a confident machine spam verdict.
+- `npm run type-check && npm run lint && npm test` clean; browser check on
+  sandbox.
+
+## Follow-ups
+
+- Tracked as: codeforphilly-data issue (private repo migration).
+- Deferred to plan: in-process heuristic scoring at signup.
diff --git a/specs/api/moderation.md b/specs/api/moderation.md
new file mode 100644
index 0000000..653023d
--- /dev/null
+++ b/specs/api/moderation.md
@@ -0,0 +1,131 @@
+# Moderation API
+
+Staff-facing endpoints behind the [admin members screen](../screens/admin-members.md):
+a newest-first roster of members with their footprint on the site, and a way to
+record a **human spam verdict** that the offline spam pipeline treats as final
+(see [behaviors/spam-exclusion.md](../behaviors/spam-exclusion.md)).
+
+All endpoints require `accountLevel ∈ {staff, administrator}`. Anyone else gets
+`404 not_found` — like the other staff surfaces, the endpoints' existence is not
+a signal.
+
+| Method | Path | Purpose |
+| ------ | ---- | ------- |
+| `GET` | `/api/admin/members` | Paginated roster, newest signup first, with vote state and footprint counts. |
+| `GET` | `/api/admin/members/:slug` | One member's full footprint plus every human vote on record. |
+| `POST` | `/api/admin/members/:slug/vote` | Record the caller's verdict; applies the side effect described below. |
+
+## GET /api/admin/members
+
+### Query parameters
+
+| Param | Type | Notes |
+| ----- | ---- | ----- |
+| `q` | string | Full-text on `fullName`, `slug`, `bio`, and (staff-visible) `email`. |
+| `vote` | enum | `none` (no human vote yet) \| `spam` \| `legit`. Filters on the **latest** human vote. |
+| `joinedAfter`, `joinedBefore` | ISO date | Inclusive bounds on `createdAt`. |
+| `includeDeactivated` | bool | Default `true` — moderation needs to see what it hid. |
+| `sort` | sort | Default `-createdAt`. Allowed: `createdAt`, `fullName`, `lastLoginAt`. |
+| `page`, `perPage` | int | Default `perPage = 50`, max 200. |
+
+### Response — 200
+
+```json
+{
+  "success": true,
+  "data": [
+    {
+      "id": "…", "slug": "jane", "fullName": "Jane Doe", "avatarUrl": "…",
+      "createdAt": "2026-09-17T22:41:00Z",
+      "deletedAt": null,
+      "email": "jane@example.org",
+      "hasGitHubLink": true,
+      "lastLoginAt": "2026-09-18T01:12:00Z",
+      "bioExcerpt": "first ~160 chars of bio, markdown stripped",
+      "footprint": { "memberships": 2, "updates": 1, "buzz": 0, "blogPosts": 0, "helpWantedInterest": 1, "tags": 3 },
+      "latestVote": { "verdict": "legit", "voter": { "slug": "chris", "fullName": "Chris Alfano" }, "evaluatedAt": "…" }
+    }
+  ],
+  "metadata": { "timestamp": "…", "page": 1, "perPage": 50, "totalItems": 12661, "totalPages": 254 }
+}
+```
+
+`email` comes from the private store (the same staff-only field `GET /api/people/:slug`
+exposes); `lastLoginAt` is the newest session issued to the person; `hasGitHubLink`
+mirrors `Person.githubUserId`. None of it is reachable by a non-staff caller (who gets
+404 anyway). `latestVote` is `null`
+when no human has voted.
+
+## GET /api/admin/members/:slug
+
+The row above, plus the full footprint and vote history:
+
+```json
+{
+  "success": true,
+  "data": {
+    "person": { …Person as GET /api/people/:slug for staff, including email and deletedAt… },
+    "footprint": {
+      "memberships": [ { "project": { "slug", "title" }, "role", "joinedAt" } ],
+      "updates":     [ { "project": { "slug", "title" }, "number", "title", "postedAt" } ],
+      "buzz":        [ { "project": { "slug", "title" }, "slug", "title", "postedAt" } ],
+      "blogPosts":   [ { "slug", "title", "postedAt" } ],
+      "helpWantedInterest": [ { "project": { "slug", "title" }, "role": { "title" }, "createdAt" } ],
+      "tags":        [ { "handle", "type" } ]
+    },
+    "votes": [
+      { "verdict": "spam", "reasoning": "…", "voter": { "slug", "fullName" }, "evaluatedAt": "…" }
+    ]
+  }
+}
+```
+
+`votes` is newest first. Everything in `footprint` is drawn from the in-memory
+public state — nothing here is fetched from elsewhere.
+
+### Errors
+
+- `404 not_found` — slug doesn't exist, or the caller is not staff
+
+## POST /api/admin/members/:slug/vote
+
+Record the caller's verdict on this person as a `person-evaluations` record with
+`evaluator = "human-<callerSlug>"` (one record per voter per person — voting
+again replaces the caller's previous record). Committed through the write mutex
+as the caller, so the vote carries the voter's pseudonymous git identity.
+
+### Request
+
+```json
+{ "verdict": "spam" | "legit", "reasoning": "optional, ≤ 1000 chars" }
+```
+
+### Side effects (per [behaviors/person-lifecycle.md](../behaviors/person-lifecycle.md))
+
+- `verdict = "spam"` → the person is **deactivated** in the same transaction
+  (`deletedAt = now()` if not already set).
+- `verdict = "legit"` → if the person's previous **latest** human vote was `spam`
+  (i.e. this vote reverses a moderation hide), `deletedAt` is cleared. A
+  self-deactivation is left alone.
+- Voting on yourself is rejected.
+
+### Response — 200
+
+```json
+{ "success": true, "data": { "person": Person, "vote": { …the recorded vote… }, "latestVote": { … } } }
+```
+
+### Errors
+
+- `422 validation_failed` — bad verdict, reasoning too long, or `slug` is the caller
+- `404 not_found` — slug doesn't exist, or the caller is not staff
+
+## Relationship to other specs
+
+- [behaviors/spam-exclusion.md](../behaviors/spam-exclusion.md) — the
+  `person-evaluations` record shape, why human votes live on `published`, and
+  how the offline pipeline consumes them.
+- [behaviors/person-lifecycle.md](../behaviors/person-lifecycle.md) — the
+  deactivate side effect and its reversal rule.
+- [api/people.md](people.md) — `deactivate`, `reactivate`, `purge`, and the
+  staff-only fields reused here.
diff --git a/specs/behaviors/person-lifecycle.md b/specs/behaviors/person-lifecycle.md
index 60b3734..5b71c83 100644
--- a/specs/behaviors/person-lifecycle.md
+++ b/specs/behaviors/person-lifecycle.md
@@ -5,7 +5,7 @@ A person record has two removal paths with very different intent and reversibili
 | State | Set by | Effect | Reversible |
 | ----- | ------ | ------ | ---------- |
 | **Active** | default | Normal — visible in lists, detail, and as a reference on content. | — |
-| **Deactivated** | self **or** staff/admin | Soft hide. `deletedAt` set. Hidden from public lists + detail; references render a placeholder. The person **can still sign in** and reactivate. | Reactivate (clears `deletedAt`). |
+| **Deactivated** | self, staff/admin, **or a staff spam vote** | Soft hide. `deletedAt` set. Hidden from public lists + detail; references render a placeholder. The person **can still sign in** and reactivate. | Reactivate (clears `deletedAt`). |
 | **Purged** | admin only | Cascading hard delete of the person + their content, in a single commit. | Via git history only (revert the commit). |
 
 ## Deactivate (soft, self-service)
@@ -16,7 +16,8 @@ The privacy / self-removal path — members should be able to remove themselves;
 - **Mechanism:** sets `person.deletedAt = now()` (reactivate clears it). The record and relationships stay intact.
 - **Visibility while deactivated:** excluded from public list endpoints; `GET /api/people/:slug` returns 404 for non-staff (staff may still fetch it, with `deletedAt` populated). Anywhere a deactivated person is referenced (project member grids, project-update/project-buzz authors, help-wanted "posted by", blog author) the serialized reference is a **"Deactivated user" placeholder** (no slug link, generic avatar) rather than the person — substitute, do not omit, so counts/history stay coherent.
 - **Login is NOT blocked** — a deactivated user can still authenticate and reactivate themselves. No session revocation.
-- **Surfaces:** self at `/account` ("Deactivate my account" / "Reactivate"); staff/admin via a person "Danger Zone".
+- **Surfaces:** self at `/account` ("Deactivate my account" / "Reactivate"); staff/admin via a person "Danger Zone"; and the **admin members screen**, where a `spam` vote deactivates the person in the same transaction that records the vote ([api/moderation.md](../api/moderation.md)).
+- **Vote reversal rule:** a `legit` vote clears `deletedAt` only when the person's previous latest human vote was `spam` — that is, when moderation set it. A self-deactivation is never undone by a vote.
 
 ## Purge (cascading hard delete, admin only)
 
@@ -32,6 +33,7 @@ The garbage-collection path for spam — the runtime sibling of the offline spam
 | Action | Self | Staff | Admin |
 | ------ | ---- | ----- | ----- |
 | Deactivate / Reactivate | ✓ (own) | ✓ (any) | ✓ (any) |
+| Spam / not-spam vote (deactivates / may reactivate) | – | ✓ | ✓ |
 | Purge | – | – | ✓ |
 
 ## Relationship to other specs
diff --git a/specs/behaviors/spam-exclusion.md b/specs/behaviors/spam-exclusion.md
index 657e359..41873ef 100644
--- a/specs/behaviors/spam-exclusion.md
+++ b/specs/behaviors/spam-exclusion.md
@@ -16,33 +16,50 @@ whatever `published` contains.
 
 ## Where verdicts come from
 
-Spam evaluation runs offline and lands on the **`spam-detection`** branch of the
-data repo, in the **`person-evaluations`** sheet (path template
-`${personSlug}/${evaluator}` — one record per (person, evaluator)). Each record:
+Two sources write the same record shape into the **`person-evaluations`** sheet
+(path template `${personSlug}/${evaluator}` — one record per (person, evaluator)):
+
+1. **Machine evaluators** (heuristic, LLM passes) run offline in the **private
+   spam-detection repo** (`codeforphilly-spam-detection`), which also holds the
+   Slack-derived inputs. That material — public-channel message text, Slack
+   identities, LLM prose about named people — never enters the public data repo.
+2. **Human votes** are cast by staff on the site ([api/moderation.md](../api/moderation.md))
+   and committed to **`published`** in this repo as `evaluator = "human-<voterSlug>"`,
+   authored by the voter. They are small, summary-only, and attributable, which is
+   what a public civic dataset can carry.
+
+Each record:
 
 | Field | Meaning |
 | ----- | ------- |
 | `personSlug` | the evaluated person |
-| `evaluator` | model/run id (e.g. `haiku-2026-05`) |
+| `evaluator` | model/run id (e.g. `haiku-2026-05`) or `human-<voterSlug>` |
 | `verdict` | `"spam"` \| `"legit"` \| `"uncertain"` |
-| `confidence` | 0–1 |
+| `confidence` | 0–1 (LLM); absent on heuristic records, which carry `score` instead; `1` on human votes |
 | `flags` | array of short reason tags |
-| `reasoning` | free-text justification |
+| `reasoning` | free-text justification (optional on human votes) |
 | `evaluatedAt` | ISO 8601 UTC |
 
-The evaluations stay on `spam-detection`; they are **not** merged into
-`published` (they are bulky and not runtime data). The pipeline reads them from
-`spam-detection` and applies the result to `published`.
+Machine evaluations stay in the private repo; the runtime never loads them. The
+pipeline reads machine records from its own repo and human votes from
+`published`, aggregates, and applies the result to `published`.
 
 ## Per-person verdict aggregation
 
 A person may have multiple evaluator records. The aggregate decision is
 deliberately **conservative — only confident spam is pruned**:
 
-> A person is **pruned as spam** iff they have at least one `spam` verdict with
-> `confidence ≥ SPAM_CONFIDENCE_THRESHOLD` (default **0.8**), no `legit`
-> verdict at any confidence, **and no `project-membership`** (real project
-> involvement overrides any spam verdict). Otherwise they are **kept** — this
+> **A human vote is final.** If any `human-*` records exist for the person, the
+> latest one decides: `spam` → pruned (membership protection does not apply —
+> a person looked at the profile); `legit` → kept.
+>
+> Otherwise a person is **pruned as spam** iff they have at least one `spam`
+> verdict with `confidence ≥ SPAM_CONFIDENCE_THRESHOLD` (default **0.8**), no
+> `legit` verdict at any confidence, **and no `project-membership`** (real
+> project involvement overrides any machine verdict). Heuristic records carry
+> a `score`, not a `confidence`, and therefore never prune on their own: the
+> pipeline must LLM-confirm the heuristic-spam bucket (`evaluate-llm --filter spam`)
+> before pruning, or those accounts stay. Otherwise they are **kept** — this
 > includes `uncertain`, `legit`, low-confidence spam, anyone who is a project
 > member, and people with no evaluation.
 
@@ -74,7 +91,11 @@ records, not a full-tree replacement like the importer).
 
 ## What the runtime sees
 
-Nothing changes in the loader or read services. After a prune, `published` holds
+The runtime loads exactly one evaluation sheet: `person-evaluations` from
+`published`, which by construction holds only human votes. It uses them for the
+admin members screen and for the vote side effect (a `spam` vote deactivates the
+person immediately — [person-lifecycle.md](./person-lifecycle.md)); the public
+read services stay spam-unaware. After a prune, `published` holds
 only kept people (legit + uncertain + unevaluated minus confident spam), so the
 in-memory state, indices, and FTS are built over that smaller set. Dangling
 references are avoided by the cascade, so member lists, help-wanted interest, and
diff --git a/specs/screens/admin-members.md b/specs/screens/admin-members.md
new file mode 100644
index 0000000..11ac603
--- /dev/null
+++ b/specs/screens/admin-members.md
@@ -0,0 +1,85 @@
+# Screen: Admin members
+
+## Route
+
+`/admin/members` — staff and administrators. Anyone else (including signed-out)
+gets the site's 404, same as `/staff/account-claim`.
+
+`/admin/members/:slug` — the expanded footprint view for one member (also
+reachable in-page by expanding a row).
+
+## Purpose
+
+New members now arrive only through GitHub sign-in, so the volume is low and the
+question is simple: *is this a real person?* Everyone listed here has already
+passed the offline spam pipeline (or arrived after its last run), so the page
+does **not** show machine evaluations. It shows the member's footprint on the
+site in one place, and lets staff record a **human judgment** the pipeline treats
+as final.
+
+## Data Requirements
+
+- `GET /api/admin/members` on entry and on every filter/sort/page change
+- `GET /api/admin/members/:slug` when a row is expanded or the detail route opens
+- `POST /api/admin/members/:slug/vote` on either vote button
+
+See [api/moderation.md](../api/moderation.md).
+
+## Display Rules
+
+### Roster
+
+- Newest signup first by default; sort toggles for name and last sign-in.
+- Filter bar: text search; **Vote**: any / no vote yet (default) / voted spam /
+  voted legit; joined date range; a "show deactivated" toggle (on by default —
+  moderation needs to see what it hid).
+- Each row: avatar, `fullName` (link to the public profile, opens in a new tab),
+  `@slug`, "joined {createdAt relative}", GitHub-linked badge, last sign-in
+  relative, email (staff-visible), bio excerpt, compact footprint counts
+  (`2 projects · 1 update · 3 tags`), and the vote state:
+  - no vote → two buttons **Spam** / **Not spam**
+  - voted → a badge `Spam · by {voter} · {when}` or `Not spam · …` with a
+    "Change" affordance that re-shows the buttons
+- Deactivated members render dimmed with a "Deactivated" chip; a member hidden by
+  a spam vote shows "Hidden by {voter}".
+
+### Expanded row / detail
+
+Full bio (rendered markdown, server-side), then the footprint as lists with
+links: project memberships (role, joined), authored updates, buzz, blog posts,
+help-wanted interest, tags. Then the vote history, newest first, each with
+voter, verdict, reasoning, and time. Then the same two buttons, plus a link to
+the person's Danger Zone for admins (purge lives there, not here).
+
+### Voting
+
+- **Spam** opens a small confirm with an optional reasoning field ("Why? —
+  optional, saved with your vote"), then calls the vote endpoint. On success the
+  row dims immediately ("Hidden by you"), because the API deactivates the person
+  in the same transaction.
+- **Not spam** calls the endpoint directly (reasoning optional via the same
+  disclosure). If the member had been hidden by a spam vote, the row un-dims.
+- The buttons are disabled on the caller's own row.
+- Errors surface as a toast; the row state is refetched, never guessed.
+
+## Actions
+
+| Action | API call | On success |
+| ------ | -------- | ---------- |
+| Filter / sort / page | `GET /api/admin/members?…` | Re-render roster |
+| Expand row | `GET /api/admin/members/:slug` | Show footprint + votes |
+| Spam | `POST …/vote { verdict: "spam", reasoning? }` | Row → deactivated + vote badge |
+| Not spam | `POST …/vote { verdict: "legit", reasoning? }` | Row → vote badge; un-dim if vote-hidden |
+
+## Authorization
+
+Staff and administrators. Purge is not offered here (admin-only, on the person
+page). Votes are attributed to the individual caller and can be changed by that
+caller at any time.
+
+## Out of scope (v1)
+
+- Machine verdicts, confidence, or reasoning on this page — the pipeline's
+  concern, and its data lives in a private repo.
+- Bulk actions.
+- Running the heuristic in-process at signup (natural follow-up).