diff --git a/TODO.md b/TODO.md
index ec7f405..e1b82b5 100644
--- a/TODO.md
+++ b/TODO.md
@@ -4,26 +4,28 @@ Backlog of bugs + long-term items. Milestones live in REWORK_PLAN.md.
 
 ## Open
 
-### FEAT-2: structured combat logs (parseable)
-- Goal: logs in storage carry enough state to run skip/rotation analysis
-  on ANY historic round --- not just replay stdout.
-- Current: `{timestamp, message, encounterName, undo}`. Parser guesses
-  roster from message strings. Brittle.
-- Upgrade: structured fields at turn-state mutation log sites in App.js
-  (startEncounter, toggleActive, addParticipant, removeParticipant,
-  applyHpChange death/revive, togglePause, nextTurn):
-  ```
-  turnSnapshot: { round, currentTurnParticipantId, turnOrderIds, activeIds }
-  ```
-- Then `scripts/analyze-turns.js` ingests app logs directly. Works on real
-  game sessions, any round, deterministic.
+### FEAT: clarify "Is NPC" in add-participant
+- Ambiguous label. May expand work based on what NPC means here (ally? monster?
+  display-only? skip in turn order?). Clarify intent before UX changes.
 
-### FEAT-M6: transactional undo
-- Every mutating action writes event: `(type, payload, undo_payload, undone, ts)`.
-- Undo = apply `undo_payload` in same SQLite tx, flip `undone`. Transactional,
-  no stale clobber.
-- Replaces fragile `/logs` snapshot-write undo.
-- Migration: keep old undo for existing entries; new format for new.
+### FEAT: first-class undo/redo UI buttons (B — do now)
+- Toolbar buttons ↶/↷ in AdminView header, not buried in /logs.
+- Undo = revert latest non-undone log. Redo = re-apply latest undone.
+- Uses current 2-write undo (non-tx). Race safety = log refactor later.
+- Disabled when stack empty. Keyboard shortcuts (cmd+z / cmd+shift+z).
+
+### FEAT-LOG: unified log refactor (was FEAT-2 + M6, batched)
+- Single event schema, one source of truth:
+  `{ ts, type, payload, undo_payload, undone, encounterId,
+     snapshot:{ round, currentTurnParticipantId, turnOrderIds, activeIds } }`
+- Common format consumed by: UI log view, download/copy export,
+  replay-combat, analyze-turns. One shape, four consumers.
+- Transactional undo: server endpoint `POST /api/undo/:eventId`. Single
+  SQLite tx applies undo_payload + flips `undone`. Replaces fragile 2-write
+  (log update + encounter update as separate calls).
+- Download/copy: exports event stream as JSON for offline analysis.
+- replay-combat + analyze-turns rewritten to emit/consume same event shape.
+- Migration: keep old log entries readable; new format for new writes.
 
 ## Done (history)