diff --git a/docs/TODO.md b/docs/TODO.md
index 2d1ff9f..7cd1282 100644
--- a/docs/TODO.md
+++ b/docs/TODO.md
@@ -16,6 +16,93 @@
 
 ---
 
+## Activity Log System (In Progress)
+
+**Status:** Phase 5/8 Complete (Backend Complete ✅)
+**Started:** 2025-12-02
+**Commits:** `f9cdf2a` (Ph1), `c9beee9` (Ph2), `d83e416` (Ph3), `4dd6603` (Ph4), `d641e3f` (Ph5)
+**Admin User:** spotlight@radziel.com (password: Dance123!)
+
+### Purpose
+Comprehensive activity logging system for admin monitoring with real-time streaming dashboard.
+- Track all user actions (auth, events, matches, chat, admin)
+- Real-time WebSocket streaming (like `tail -f`)
+- Filter by time range, action type, username
+- Admin-only access with `requireAdmin` middleware
+
+### Completed ✅
+
+**Phase 1: Database Schema**
+- ✅ ActivityLog model with indexes (43 lines)
+- ✅ User.isAdmin flag for access control
+- ✅ Admin user created: spotlight@radziel.com
+- **Files:** `backend/prisma/schema.prisma`
+
+**Phase 2: Backend Services**
+- ✅ ActivityLog service (300+ lines) - centralized logging, fire-and-forget pattern
+  - 18 action constants (AUTH_LOGIN, MATCH_CREATE, etc.)
+  - Query interface with filtering
+  - Socket.IO emission for real-time
+  - Statistics and action types endpoints
+- ✅ Request utility - IP extraction (X-Forwarded-For support)
+- ✅ Admin middleware - `requireAdmin()` protects admin routes
+- **Files:**
+  - `backend/src/services/activityLog.js`
+  - `backend/src/utils/request.js`
+  - `backend/src/middleware/admin.js`
+
+**Phase 3: Logging Integration (14 actions)**
+- ✅ Auth controller: register, login, verify email (token & code), password reset (4 actions)
+- ✅ Events routes: checkin, leave event (2 actions)
+- ✅ Socket handlers: join event chat, leave event chat, join match room (3 actions)
+- ✅ Matches routes: create, accept, reject match (3 actions)
+- ✅ Admin routes: matching run + secured all routes with requireAdmin (1 action)
+- **Files:**
+  - `backend/src/controllers/auth.js`
+  - `backend/src/routes/events.js`
+  - `backend/src/socket/index.js`
+  - `backend/src/routes/matches.js`
+  - `backend/src/routes/admin.js`
+
+**Phase 4: Admin API Endpoints**
+- ✅ `GET /api/admin/activity-logs` - Query logs with filters (date range, action, category, username, success, pagination)
+- ✅ `GET /api/admin/activity-logs/actions` - Get unique action types
+- ✅ `GET /api/admin/activity-logs/stats` - Statistics dashboard (total, failures, by category, 24h activity)
+- ✅ ADMIN_VIEW_LOGS action logging
+- **File:** `backend/src/routes/admin.js`
+
+**Phase 5: Socket.IO Real-Time Streaming**
+- ✅ `join_admin_activity_logs` handler with admin verification
+- ✅ `leave_admin_activity_logs` handler
+- ✅ Emits `activity_log_entry` to admin room (already in Phase 2 service)
+- ✅ Fresh DB check for admin status on join
+- **File:** `backend/src/socket/index.js`
+
+### Remaining Tasks (Frontend)
+
+**Phase 6-7: Frontend Admin Page**
+- [ ] Create `frontend/src/pages/admin/ActivityLogsPage.jsx`
+- [ ] Stats dashboard (total logs, failures, by category)
+- [ ] Filter UI (date range, action, username)
+- [ ] Log table with pagination
+- [ ] Real-time streaming toggle with auto-scroll
+- [ ] Add navigation link for admins
+
+**Phase 8: Testing & Polish**
+- [ ] Test all 14 action logging points
+- [ ] Test admin-only access enforcement
+- [ ] Test real-time streaming with multiple admins
+- [ ] Mobile responsive design
+- [ ] Documentation
+
+### Implementation Notes
+- **Fire-and-forget**: Logging never blocks requests or crashes app
+- **Denormalized**: Username stored to avoid JOINs
+- **Scalability**: Partitioning after 10M+ rows
+- **Security**: Admin-only with fresh DB checks
+
+---
+
 ## Matching System - Comprehensive Test Scenarios
 
 **Last Updated:** 2025-11-30