diff --git a/CHANGES.md b/CHANGES.md
index 42690e03a..acd63ec6a 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -20,6 +20,18 @@ To be released.
 [#893]: https://github.com/fedify-dev/fedify/issues/893
 [#1187]: https://github.com/fedify-dev/fedify/pull/1187
 
+### @fedify/debugger
+
+ -  Added filtering controls to the debug dashboard.  The traces list can
+    now be narrowed down by activity type, and a trace's log table can be
+    narrowed down by category, level, or a free-text search of the message.
+    This makes it easier to find one failed activity or one noisy log
+    category once a federated app has produced more than a few traces.
+    [[#896], [#1204]]
+
+[#896]: https://github.com/fedify-dev/fedify/issues/896
+[#1204]: https://github.com/fedify-dev/fedify/issues/1204
+
 
 Version 2.4.0
 -------------
diff --git a/changes.d/debugger/debug-dashboard-filters.md b/changes.d/debugger/debug-dashboard-filters.md
new file mode 100644
index 000000000..bcf408e25
--- /dev/null
+++ b/changes.d/debugger/debug-dashboard-filters.md
@@ -0,0 +1,6 @@
+ -  Added filtering controls to the debug dashboard.  The traces list can
+    now be narrowed down by activity type, and a trace's log table can be
+    narrowed down by category, level, or a free-text search of the message.
+    This makes it easier to find one failed activity or one noisy log
+    category once a federated app has produced more than a few traces.
+    [[#896], [#1204]]
diff --git a/packages/debugger/src/mod.test.ts b/packages/debugger/src/mod.test.ts
index 3f131c24c..4eaecb202 100644
--- a/packages/debugger/src/mod.test.ts
+++ b/packages/debugger/src/mod.test.ts
@@ -17,6 +17,7 @@ import type {
   TraceActivityRecord,
   TraceSummary,
 } from "@fedify/fedify/otel";
+import type { Sink } from "@logtape/logtape";
 import { trace } from "@opentelemetry/api";
 
 function createMockExporter(
@@ -1251,3 +1252,609 @@ test("trace detail page shows empty log message", async () => {
   const html = await response.text();
   ok(html.includes("No logs captured for this trace."));
 });
+
+// ---------- Trace list filtering tests ----------
+
+function threeTypedTraces(): TraceSummary[] {
+  return [
+    {
+      traceId: "a".repeat(32),
+      timestamp: "2026-01-01T00:00:00Z",
+      activityCount: 1,
+      activityTypes: ["Create"],
+    },
+    {
+      traceId: "b".repeat(32),
+      timestamp: "2026-01-02T00:00:00Z",
+      activityCount: 1,
+      activityTypes: ["Follow"],
+    },
+    {
+      traceId: "c".repeat(32),
+      timestamp: "2026-01-03T00:00:00Z",
+      activityCount: 1,
+      activityTypes: ["Like"],
+    },
+  ];
+}
+
+test("traces list page filters by a single activity type", async () => {
+  const { federation } = createMockFederation();
+  const { exporter, kv } = createMockExporter(threeTypedTraces());
+  const dbg = createFederationDebugger(federation, { exporter, kv });
+  const request = new Request("https://example.com/__debug__/?type=Follow");
+  const response = await dbg.fetch(request, { contextData: undefined });
+  const html = await response.text();
+  ok(html.includes("<strong>1</strong>"));
+  ok(html.includes("bbbbbbbb"));
+  ok(!html.includes("aaaaaaaa"));
+  ok(!html.includes("cccccccc"));
+});
+
+test("traces list page filters by multiple activity types with OR semantics", async () => {
+  const { federation } = createMockFederation();
+  const { exporter, kv } = createMockExporter(threeTypedTraces());
+  const dbg = createFederationDebugger(federation, { exporter, kv });
+  const request = new Request(
+    "https://example.com/__debug__/?type=Create&type=Like",
+  );
+  const response = await dbg.fetch(request, { contextData: undefined });
+  const html = await response.text();
+  ok(html.includes("<strong>2</strong>"));
+  ok(html.includes("aaaaaaaa"));
+  ok(html.includes("cccccccc"));
+  ok(!html.includes("bbbbbbbb"));
+});
+
+test("traces list page shows filter-specific empty message when nothing matches", async () => {
+  const { federation } = createMockFederation();
+  const { exporter, kv } = createMockExporter(threeTypedTraces());
+  const dbg = createFederationDebugger(federation, { exporter, kv });
+  const request = new Request("https://example.com/__debug__/?type=Nope");
+  const response = await dbg.fetch(request, { contextData: undefined });
+  const html = await response.text();
+  ok(html.includes("No traces match the selected filters."));
+  ok(!html.includes("No traces captured yet."));
+});
+
+test("traces list page filter form retains the selected checkbox and shows a clear link", async () => {
+  const { federation } = createMockFederation();
+  const { exporter, kv } = createMockExporter(threeTypedTraces());
+  const dbg = createFederationDebugger(federation, { exporter, kv });
+  const request = new Request("https://example.com/__debug__/?type=Follow");
+  const response = await dbg.fetch(request, { contextData: undefined });
+  const html = await response.text();
+  ok(html.includes('value="Follow" checked'));
+  ok(!html.includes('value="Create" checked'));
+  ok(!html.includes('value="Like" checked'));
+  ok(html.includes("Clear filters"));
+});
+
+test("traces list page filter form has no clear link when nothing is selected", async () => {
+  const { federation } = createMockFederation();
+  const { exporter, kv } = createMockExporter(threeTypedTraces());
+  const dbg = createFederationDebugger(federation, { exporter, kv });
+  const request = new Request("https://example.com/__debug__/");
+  const response = await dbg.fetch(request, { contextData: undefined });
+  const html = await response.text();
+  ok(!html.includes("Clear filters"));
+});
+
+test("JSON traces API filters by type", async () => {
+  const { federation } = createMockFederation();
+  const { exporter, kv } = createMockExporter(threeTypedTraces());
+  const dbg = createFederationDebugger(federation, { exporter, kv });
+  const request = new Request(
+    "https://example.com/__debug__/api/traces?type=Follow",
+  );
+  const response = await dbg.fetch(request, { contextData: undefined });
+  const body = (await response.json()) as TraceSummary[];
+  strictEqual(body.length, 1);
+  strictEqual(body[0].traceId, "b".repeat(32));
+});
+
+// ---------- Poll script tests ----------
+
+/** Pulls the inline `<script>` body out of a rendered traces list page. */
+function extractPollScript(html: string): string {
+  const match = html.match(/<script>([\s\S]*?)<\/script>/);
+  if (match == null) throw new Error("poll script not found in the page");
+  return match[1];
+}
+
+/**
+ * Runs the extracted poll script in a sandbox, feeding it one page of
+ * `/api/traces` JSON per simulated tick, and reports the index of the
+ * first tick that called `location.reload()`, or `null` if none did.
+ * `locationSearch` should match the query string the page was actually
+ * rendered with, since the script reads it back via `location.search`.
+ */
+async function runPollScript(
+  scriptBody: string,
+  ticks: readonly TraceSummary[][],
+  locationSearch = "",
+): Promise<{ reloadedAtTick: number | null }> {
+  let reloadedAtTick: number | null = null;
+  let tickIndex = 0;
+  const fakeFetch = () => {
+    const data = ticks[tickIndex];
+    return Promise.resolve({ json: () => Promise.resolve(data) });
+  };
+  let onTick: (() => void) | undefined;
+  const fakeSetInterval = (fn: () => void) => {
+    onTick = fn;
+    return 1;
+  };
+  const fakeLocation = {
+    search: locationSearch,
+    reload: () => {
+      if (reloadedAtTick === null) reloadedAtTick = tickIndex;
+    },
+  };
+  const run = new Function(
+    "window",
+    "location",
+    "fetch",
+    "setInterval",
+    "clearInterval",
+    scriptBody,
+  ) as (
+    windowArg: unknown,
+    locationArg: unknown,
+    fetchArg: unknown,
+    setIntervalArg: unknown,
+    clearIntervalArg: unknown,
+  ) => void;
+  run(
+    { addEventListener: () => {} },
+    fakeLocation,
+    fakeFetch,
+    fakeSetInterval,
+    () => {},
+  );
+  if (onTick == null) throw new Error("setInterval was never called");
+  for (; tickIndex < ticks.length; tickIndex++) {
+    onTick();
+    // Flush the fetch/json/then microtask chain before the next tick.
+    await new Promise<void>((resolve) => setTimeout(resolve, 0));
+  }
+  return { reloadedAtTick };
+}
+
+test("poll script does not reload across unchanged ticks", async () => {
+  const { federation } = createMockFederation();
+  const { exporter, kv } = createMockExporter(threeTypedTraces());
+  const dbg = createFederationDebugger(federation, { exporter, kv });
+  const response = await dbg.fetch(
+    new Request("https://example.com/__debug__/"),
+    { contextData: undefined },
+  );
+  const script = extractPollScript(await response.text());
+  const same = threeTypedTraces();
+  const { reloadedAtTick } = await runPollScript(script, [same, same, same]);
+  strictEqual(reloadedAtTick, null);
+});
+
+test("poll script reloads when a new activity type appears", async () => {
+  const { federation } = createMockFederation();
+  const before: TraceSummary[] = [
+    {
+      traceId: "a".repeat(32),
+      timestamp: "2026-01-01T00:00:00Z",
+      activityCount: 1,
+      activityTypes: ["Create"],
+    },
+  ];
+  const { exporter, kv } = createMockExporter(before);
+  const dbg = createFederationDebugger(federation, { exporter, kv });
+  // A filter is active, matching only the "Create" trace: a newly captured
+  // "Follow" trace would not change what's visible, but its checkbox should
+  // still appear once the page reloads. The render and the first tick both
+  // see `before`, so the first tick must not reload on its own.
+  const response = await dbg.fetch(
+    new Request("https://example.com/__debug__/?type=Create"),
+    { contextData: undefined },
+  );
+  const script = extractPollScript(await response.text());
+  const after: TraceSummary[] = [
+    ...before,
+    {
+      traceId: "b".repeat(32),
+      timestamp: "2026-01-02T00:00:00Z",
+      activityCount: 1,
+      activityTypes: ["Follow"],
+    },
+  ];
+  const { reloadedAtTick } = await runPollScript(
+    script,
+    [before, after],
+    "?type=Create",
+  );
+  strictEqual(reloadedAtTick, 1);
+});
+
+test("poll script reloads when an existing trace gains a new activity type", async () => {
+  const { federation } = createMockFederation();
+  // The trace count never changes here—only the one trace's own
+  // activityTypes grows, the way FedifySpanExporter updates an existing
+  // summary in place. A count-only comparison would miss this.
+  const before: TraceSummary[] = [
+    {
+      traceId: "a".repeat(32),
+      timestamp: "2026-01-01T00:00:00Z",
+      activityCount: 1,
+      activityTypes: ["Create"],
+    },
+  ];
+  const { exporter, kv } = createMockExporter(before);
+  const dbg = createFederationDebugger(federation, { exporter, kv });
+  const response = await dbg.fetch(
+    new Request("https://example.com/__debug__/"),
+    { contextData: undefined },
+  );
+  const script = extractPollScript(await response.text());
+  const after: TraceSummary[] = [
+    { ...before[0], activityCount: 2, activityTypes: ["Create", "Update"] },
+  ];
+  const { reloadedAtTick } = await runPollScript(script, [before, after]);
+  strictEqual(reloadedAtTick, 1);
+});
+
+test("poll script reloads on the first tick when data already changed before it", async () => {
+  const { federation } = createMockFederation();
+  const atRenderTime: TraceSummary[] = [
+    {
+      traceId: "a".repeat(32),
+      timestamp: "2026-01-01T00:00:00Z",
+      activityCount: 1,
+      activityTypes: ["Create"],
+    },
+  ];
+  const { exporter, kv } = createMockExporter(atRenderTime);
+  const dbg = createFederationDebugger(federation, { exporter, kv });
+  const response = await dbg.fetch(
+    new Request("https://example.com/__debug__/"),
+    { contextData: undefined },
+  );
+  const script = extractPollScript(await response.text());
+  // A Follow trace arrives in the gap between the page rendering and the
+  // first 3-second poll, so the very first fetch already differs from
+  // what the page was rendered with. Without an initial snapshot computed
+  // from the render-time data, that first response would be taken as the
+  // new baseline instead of being compared against it.
+  const firstPollResult: TraceSummary[] = [
+    ...atRenderTime,
+    {
+      traceId: "b".repeat(32),
+      timestamp: "2026-01-02T00:00:00Z",
+      activityCount: 1,
+      activityTypes: ["Follow"],
+    },
+  ];
+  const { reloadedAtTick } = await runPollScript(script, [firstPollResult]);
+  strictEqual(reloadedAtTick, 0);
+});
+
+test("poll script reloads when an existing trace starts matching the active filter", async () => {
+  const { federation } = createMockFederation();
+  const createTrace: TraceSummary = {
+    traceId: "a".repeat(32),
+    timestamp: "2026-01-01T00:00:00Z",
+    activityCount: 1,
+    activityTypes: ["Create"],
+  };
+  const followTrace: TraceSummary = {
+    traceId: "b".repeat(32),
+    timestamp: "2026-01-02T00:00:00Z",
+    activityCount: 1,
+    activityTypes: ["Follow"],
+  };
+  const before = [createTrace, followTrace];
+  const { exporter, kv } = createMockExporter(before);
+  const dbg = createFederationDebugger(federation, { exporter, kv });
+  // Filtered to "Follow": only followTrace matches, so the page renders
+  // with one visible row.
+  const response = await dbg.fetch(
+    new Request("https://example.com/__debug__/?type=Follow"),
+    { contextData: undefined },
+  );
+  const script = extractPollScript(await response.text());
+  // createTrace now also has a Follow activity. The total trace count (2)
+  // and the global type set ({Create, Follow}, already present via
+  // followTrace) both stay the same—only the filtered result changes,
+  // from one match to two.
+  const after = [
+    { ...createTrace, activityCount: 2, activityTypes: ["Create", "Follow"] },
+    followTrace,
+  ];
+  const { reloadedAtTick } = await runPollScript(
+    script,
+    [before, after],
+    "?type=Follow",
+  );
+  strictEqual(reloadedAtTick, 1);
+});
+
+test("poll script reloads when a matching trace is replaced by a different one", async () => {
+  const { federation } = createMockFederation();
+  const original: TraceSummary = {
+    traceId: "a".repeat(32),
+    timestamp: "2026-01-01T00:00:00Z",
+    activityCount: 1,
+    activityTypes: ["Create"],
+  };
+  const before = [original];
+  const { exporter, kv } = createMockExporter(before);
+  const dbg = createFederationDebugger(federation, { exporter, kv });
+  const response = await dbg.fetch(
+    new Request("https://example.com/__debug__/"),
+    { contextData: undefined },
+  );
+  const script = extractPollScript(await response.text());
+  // `original` expired (e.g. its TTL ran out) and a different trace of the
+  // same type took its place. The total count, the type union, and how
+  // many traces match (no filter here, so all of them) stay identical to
+  // `before`—only the trace's identity changed.
+  const replacement: TraceSummary = {
+    traceId: "b".repeat(32),
+    timestamp: "2026-01-02T00:00:00Z",
+    activityCount: 1,
+    activityTypes: ["Create"],
+  };
+  const after = [replacement];
+  const { reloadedAtTick } = await runPollScript(script, [before, after]);
+  strictEqual(reloadedAtTick, 1);
+});
+
+test("poll script reloads when a trace's activity count grows without its types changing", async () => {
+  const { federation } = createMockFederation();
+  const before: TraceSummary[] = [
+    {
+      traceId: "a".repeat(32),
+      timestamp: "2026-01-01T00:00:00Z",
+      activityCount: 1,
+      activityTypes: ["Create"],
+    },
+  ];
+  const { exporter, kv } = createMockExporter(before);
+  const dbg = createFederationDebugger(federation, { exporter, kv });
+  const response = await dbg.fetch(
+    new Request("https://example.com/__debug__/"),
+    { contextData: undefined },
+  );
+  const script = extractPollScript(await response.text());
+  // A second Create activity landed on the same trace: the trace ID, its
+  // activity types, the total count, and the type union are all
+  // unchanged—only activityCount goes up, which the "Activities" column
+  // displays.
+  const after: TraceSummary[] = [
+    { ...before[0], activityCount: 2 },
+  ];
+  const { reloadedAtTick } = await runPollScript(script, [before, after]);
+  strictEqual(reloadedAtTick, 1);
+});
+
+// ---------- Log filtering tests ----------
+
+function sinkTwoDistinctLogs(
+  dbg: Federation<void> & { sink: Sink },
+  traceId: string,
+): void {
+  dbg.sink({
+    category: ["fedify", "federation"],
+    level: "info",
+    message: ["hello world"],
+    rawMessage: "hello world",
+    timestamp: Date.now(),
+    properties: { traceId, spanId: "1".repeat(16) },
+  });
+  dbg.sink({
+    category: ["fedify", "outbox"],
+    level: "error",
+    message: ["boom happened"],
+    rawMessage: "boom happened",
+    timestamp: Date.now(),
+    properties: { traceId, spanId: "2".repeat(16) },
+  });
+}
+
+test("trace detail page filters logs by category", async () => {
+  const { federation } = createMockFederation();
+  const { exporter, kv } = createMockExporter();
+  const dbg = createFederationDebugger(federation, { exporter, kv });
+  const traceId = "aaaa1111bbbb2222cccc3333dddd4444";
+  sinkTwoDistinctLogs(dbg, traceId);
+
+  const request = new Request(
+    `https://example.com/__debug__/traces/${traceId}?category=fedify.federation`,
+  );
+  const response = await dbg.fetch(request, { contextData: undefined });
+  const html = await response.text();
+  ok(html.includes("hello world"));
+  ok(!html.includes("boom happened"));
+});
+
+test("trace detail page filters logs by level", async () => {
+  const { federation } = createMockFederation();
+  const { exporter, kv } = createMockExporter();
+  const dbg = createFederationDebugger(federation, { exporter, kv });
+  const traceId = "aaaa1111bbbb2222cccc3333dddd4444";
+  sinkTwoDistinctLogs(dbg, traceId);
+
+  const request = new Request(
+    `https://example.com/__debug__/traces/${traceId}?level=error`,
+  );
+  const response = await dbg.fetch(request, { contextData: undefined });
+  const html = await response.text();
+  ok(html.includes("boom happened"));
+  ok(!html.includes("hello world"));
+});
+
+test("trace detail page filters logs by a case-insensitive text search", async () => {
+  const { federation } = createMockFederation();
+  const { exporter, kv } = createMockExporter();
+  const dbg = createFederationDebugger(federation, { exporter, kv });
+  const traceId = "aaaa1111bbbb2222cccc3333dddd4444";
+  sinkTwoDistinctLogs(dbg, traceId);
+
+  const request = new Request(
+    `https://example.com/__debug__/traces/${traceId}?q=BOOM`,
+  );
+  const response = await dbg.fetch(request, { contextData: undefined });
+  const html = await response.text();
+  ok(html.includes("boom happened"));
+  ok(!html.includes("hello world"));
+});
+
+test("trace detail page combines log filters with AND semantics", async () => {
+  const { federation } = createMockFederation();
+  const { exporter, kv } = createMockExporter();
+  const dbg = createFederationDebugger(federation, { exporter, kv });
+  const traceId = "aaaa1111bbbb2222cccc3333dddd4444";
+  sinkTwoDistinctLogs(dbg, traceId);
+
+  // "hello world" is level info, not error, so this combination matches none.
+  const request = new Request(
+    `https://example.com/__debug__/traces/${traceId}` +
+      "?category=fedify.federation&level=error",
+  );
+  const response = await dbg.fetch(request, { contextData: undefined });
+  const html = await response.text();
+  ok(!html.includes("hello world"));
+  ok(!html.includes("boom happened"));
+  ok(html.includes("No logs match the selected filters."));
+});
+
+test("trace detail page log filter form retains selected values", async () => {
+  const { federation } = createMockFederation();
+  const { exporter, kv } = createMockExporter();
+  const dbg = createFederationDebugger(federation, { exporter, kv });
+  const traceId = "aaaa1111bbbb2222cccc3333dddd4444";
+  sinkTwoDistinctLogs(dbg, traceId);
+
+  const request = new Request(
+    `https://example.com/__debug__/traces/${traceId}` +
+      "?category=fedify.federation&level=info&q=hello",
+  );
+  const response = await dbg.fetch(request, { contextData: undefined });
+  const html = await response.text();
+  ok(html.includes('value="fedify.federation" selected'));
+  ok(html.includes('value="info" selected'));
+  ok(html.includes('value="hello"'));
+  ok(html.includes("Clear filters"));
+});
+
+test("JSON logs API filters by level", async () => {
+  const { federation } = createMockFederation();
+  const { exporter, kv } = createMockExporter();
+  const dbg = createFederationDebugger(federation, { exporter, kv });
+  const traceId = "aaaa1111bbbb2222cccc3333dddd4444";
+  sinkTwoDistinctLogs(dbg, traceId);
+
+  const request = new Request(
+    `https://example.com/__debug__/api/logs/${traceId}?level=error`,
+  );
+  const response = await dbg.fetch(request, { contextData: undefined });
+  const body = (await response.json()) as SerializedLogRecord[];
+  strictEqual(body.length, 1);
+  strictEqual(body[0].message, "boom happened");
+});
+
+test("JSON logs API filters by category", async () => {
+  const { federation } = createMockFederation();
+  const { exporter, kv } = createMockExporter();
+  const dbg = createFederationDebugger(federation, { exporter, kv });
+  const traceId = "aaaa1111bbbb2222cccc3333dddd4444";
+  sinkTwoDistinctLogs(dbg, traceId);
+
+  const request = new Request(
+    `https://example.com/__debug__/api/logs/${traceId}?category=fedify.federation`,
+  );
+  const response = await dbg.fetch(request, { contextData: undefined });
+  const body = (await response.json()) as SerializedLogRecord[];
+  strictEqual(body.length, 1);
+  strictEqual(body[0].message, "hello world");
+});
+
+test("JSON logs API filters by a case-insensitive text search", async () => {
+  const { federation } = createMockFederation();
+  const { exporter, kv } = createMockExporter();
+  const dbg = createFederationDebugger(federation, { exporter, kv });
+  const traceId = "aaaa1111bbbb2222cccc3333dddd4444";
+  sinkTwoDistinctLogs(dbg, traceId);
+
+  const request = new Request(
+    `https://example.com/__debug__/api/logs/${traceId}?q=BOOM`,
+  );
+  const response = await dbg.fetch(request, { contextData: undefined });
+  const body = (await response.json()) as SerializedLogRecord[];
+  strictEqual(body.length, 1);
+  strictEqual(body[0].message, "boom happened");
+});
+
+test("JSON logs API combines filters with AND semantics", async () => {
+  const { federation } = createMockFederation();
+  const { exporter, kv } = createMockExporter();
+  const dbg = createFederationDebugger(federation, { exporter, kv });
+  const traceId = "aaaa1111bbbb2222cccc3333dddd4444";
+  sinkTwoDistinctLogs(dbg, traceId);
+
+  // "hello world" is level info, not error, so this combination matches none.
+  const request = new Request(
+    `https://example.com/__debug__/api/logs/${traceId}` +
+      "?category=fedify.federation&level=error",
+  );
+  const response = await dbg.fetch(request, { contextData: undefined });
+  const body = (await response.json()) as SerializedLogRecord[];
+  strictEqual(body.length, 0);
+});
+
+test("JSON logs API returns everything when no filter is given", async () => {
+  const { federation } = createMockFederation();
+  const { exporter, kv } = createMockExporter();
+  const dbg = createFederationDebugger(federation, { exporter, kv });
+  const traceId = "aaaa1111bbbb2222cccc3333dddd4444";
+  sinkTwoDistinctLogs(dbg, traceId);
+
+  const request = new Request(
+    `https://example.com/__debug__/api/logs/${traceId}`,
+  );
+  const response = await dbg.fetch(request, { contextData: undefined });
+  const body = (await response.json()) as SerializedLogRecord[];
+  strictEqual(body.length, 2);
+});
+
+test("trace detail page shows the filtered count alongside the total", async () => {
+  const { federation } = createMockFederation();
+  const { exporter, kv } = createMockExporter();
+  const dbg = createFederationDebugger(federation, { exporter, kv });
+  const traceId = "aaaa1111bbbb2222cccc3333dddd4444";
+  sinkTwoDistinctLogs(dbg, traceId);
+
+  const request = new Request(
+    `https://example.com/__debug__/traces/${traceId}?level=error`,
+  );
+  const response = await dbg.fetch(request, { contextData: undefined });
+  const html = await response.text();
+  ok(html.includes("<strong>1</strong> of"));
+  ok(html.includes("<strong>2</strong>"));
+});
+
+test("trace detail page escapes a malicious search query in the filter form", async () => {
+  const { federation } = createMockFederation();
+  const { exporter, kv } = createMockExporter();
+  const dbg = createFederationDebugger(federation, { exporter, kv });
+  const traceId = "aaaa1111bbbb2222cccc3333dddd4444";
+  sinkTwoDistinctLogs(dbg, traceId);
+
+  const malicious = '"><script>alert(1)</script>';
+  const request = new Request(
+    `https://example.com/__debug__/traces/${traceId}?q=${
+      encodeURIComponent(malicious)
+    }`,
+  );
+  const response = await dbg.fetch(request, { contextData: undefined });
+  const html = await response.text();
+  ok(!html.includes("<script>alert(1)</script>"));
+  ok(html.includes("&lt;script&gt;"));
+});
diff --git a/packages/debugger/src/routes.tsx b/packages/debugger/src/routes.tsx
index 15e196df5..569608798 100644
--- a/packages/debugger/src/routes.tsx
+++ b/packages/debugger/src/routes.tsx
@@ -5,7 +5,7 @@
  *
  * @module
  */
-import type { FedifySpanExporter } from "@fedify/fedify/otel";
+import type { FedifySpanExporter, TraceSummary } from "@fedify/fedify/otel";
 import { Hono } from "hono";
 import { getCookie } from "hono/cookie";
 import {
@@ -16,11 +16,108 @@ import {
   signSession,
   verifySession,
 } from "./auth.ts";
-import type { LogStore } from "./log-store.ts";
+import type { LogStore, SerializedLogRecord } from "./log-store.ts";
 import { LoginPage } from "./views/login.tsx";
 import { TraceDetailPage } from "./views/trace-detail.tsx";
 import { TracesListPage } from "./views/traces-list.tsx";
 
+/** Collects the distinct activity types across all traces, sorted. */
+function distinctActivityTypes(traces: readonly TraceSummary[]): string[] {
+  const types = new Set<string>();
+  for (const trace of traces) {
+    for (const type of trace.activityTypes) types.add(type);
+  }
+  return [...types].sort();
+}
+
+/**
+ * Keeps only the traces whose `activityTypes` include at least one of the
+ * given `types`.  An empty `types` list means "no filter"—all traces pass
+ * through unchanged.
+ */
+function filterTracesByTypes(
+  traces: readonly TraceSummary[],
+  types: readonly string[],
+): TraceSummary[] {
+  if (types.length === 0) return [...traces];
+  return traces.filter((trace) =>
+    trace.activityTypes.some((type) => types.includes(type))
+  );
+}
+
+/**
+ * Computes a string that changes whenever the trace corpus changes in a
+ * way the traces list page's live-poll script needs to react to.  Rather
+ * than comparing a handful of hand-picked summary fields—which has missed
+ * a real change each time a new one turned up—this serializes every trace
+ * that currently matches `selectedTypes` as `id:types:activityCount`, so
+ * a trace being replaced, an existing trace's activity count going up, or
+ * its activity types growing are all covered by the same comparison.  The
+ * distinct activity types across *all* traces are tracked separately,
+ * since a type that does not match the active filter still needs to make
+ * its checkbox appear.  The page embeds this as the poll script's
+ * starting point, so the very first poll tick is compared against the
+ * data the page was actually rendered with, rather than treating
+ * whatever that first tick happens to see as the baseline.
+ */
+function snapshotOf(
+  traces: readonly TraceSummary[],
+  selectedTypes: readonly string[],
+): string {
+  const types = distinctActivityTypes(traces);
+  const rows = filterTracesByTypes(traces, selectedTypes)
+    .map((trace) =>
+      `${trace.traceId}:${
+        [...trace.activityTypes].sort().join("+")
+      }:${trace.activityCount}`
+    )
+    .sort();
+  return `${types.join(",")}|${rows.join(";")}`;
+}
+
+/** Collects the distinct dot-joined log categories, sorted. */
+function distinctLogCategories(
+  logs: readonly SerializedLogRecord[],
+): string[] {
+  const categories = new Set<string>();
+  for (const log of logs) categories.add(log.category.join("."));
+  return [...categories].sort();
+}
+
+/**
+ * Criteria for narrowing down a trace's log records on the trace detail
+ * page.  Every present field must match (AND); an absent or empty field
+ * is not applied.
+ */
+interface LogFilter {
+  readonly category?: string;
+  readonly level?: string;
+  readonly q?: string;
+}
+
+/** Applies a {@link LogFilter} to a list of log records. */
+function filterLogs(
+  logs: readonly SerializedLogRecord[],
+  filter: LogFilter,
+): readonly SerializedLogRecord[] {
+  let filtered = logs;
+  if (filter.category) {
+    const category = filter.category;
+    filtered = filtered.filter((log) => log.category.join(".") === category);
+  }
+  if (filter.level) {
+    const level = filter.level;
+    filtered = filtered.filter((log) => log.level === level);
+  }
+  if (filter.q) {
+    const needle = filter.q.toLowerCase();
+    filtered = filtered.filter((log) =>
+      log.message.toLowerCase().includes(needle)
+    );
+  }
+  return filtered;
+}
+
 export function createDebugApp(
   pathPrefix: string,
   exporter: FedifySpanExporter,
@@ -133,14 +230,20 @@ export function createDebugApp(
 
   app.get("/api/traces", async (c) => {
     const traces = await exporter.getRecentTraces();
-    return c.json(traces);
+    const types = c.req.queries("type") ?? [];
+    return c.json(filterTracesByTypes(traces, types));
   });
 
   app.get("/api/logs/:traceId", async (c) => {
     const traceId = c.req.param("traceId");
     await logStore.flush();
     const logs = await logStore.get(traceId);
-    return c.json(logs);
+    const logFilter: LogFilter = {
+      category: c.req.query("category"),
+      level: c.req.query("level"),
+      q: c.req.query("q"),
+    };
+    return c.json(filterLogs(logs, logFilter));
   });
 
   app.get("/traces/:traceId", async (c) => {
@@ -148,11 +251,21 @@ export function createDebugApp(
     await logStore.flush();
     const activities = await exporter.getActivitiesByTraceId(traceId);
     const logs = await logStore.get(traceId);
+    const logFilter: LogFilter = {
+      category: c.req.query("category"),
+      level: c.req.query("level"),
+      q: c.req.query("q"),
+    };
     return c.html(
       <TraceDetailPage
         traceId={traceId}
         activities={activities}
-        logs={logs}
+        logs={filterLogs(logs, logFilter)}
+        totalLogCount={logs.length}
+        availableCategories={distinctLogCategories(logs)}
+        selectedCategory={logFilter.category}
+        selectedLevel={logFilter.level}
+        selectedQuery={logFilter.q}
         pathPrefix={pathPrefix}
       />,
     );
@@ -160,8 +273,15 @@ export function createDebugApp(
 
   app.get("/", async (c) => {
     const traces = await exporter.getRecentTraces();
+    const selectedTypes = c.req.queries("type") ?? [];
     return c.html(
-      <TracesListPage traces={traces} pathPrefix={pathPrefix} />,
+      <TracesListPage
+        traces={filterTracesByTypes(traces, selectedTypes)}
+        availableTypes={distinctActivityTypes(traces)}
+        selectedTypes={selectedTypes}
+        initialSnapshot={snapshotOf(traces, selectedTypes)}
+        pathPrefix={pathPrefix}
+      />,
     );
   });
 
diff --git a/packages/debugger/src/views/layout.tsx b/packages/debugger/src/views/layout.tsx
index 038c07c96..11d20a0f1 100644
--- a/packages/debugger/src/views/layout.tsx
+++ b/packages/debugger/src/views/layout.tsx
@@ -57,6 +57,13 @@ export const Layout: FC<PropsWithChildren<LayoutProps>> = (
           pre { background: #f6f8fa; padding: 1rem; overflow-x: auto; border-radius: 6px; font-size: 0.8125rem; }
           .empty { color: #888; font-style: italic; }
           nav a { margin-right: 0.5rem; }
+          .filter-form { border: 1px solid #ddd; border-radius: 6px; padding: 0.75rem 1rem; margin-bottom: 1rem; }
+          .filter-form fieldset { border: none; padding: 0; margin: 0; }
+          .filter-form legend { font-size: 0.8125rem; color: #666; padding: 0; margin-bottom: 0.5rem; }
+          .filter-form label { display: inline-flex; align-items: center; gap: 0.3rem; margin: 0 1rem 0.5rem 0; font-size: 0.875rem; }
+          .filter-form select, .filter-form input[type="text"] { font-size: 0.875rem; padding: 0.25rem 0.4rem; }
+          .filter-actions { display: flex; align-items: center; gap: 1rem; margin-top: 0.25rem; }
+          .filter-actions button { font-size: 0.8125rem; padding: 0.3rem 0.75rem; cursor: pointer; }
           .log-table td { font-size: 0.8125rem; vertical-align: top; }
           .log-table time { font-family: monospace; white-space: nowrap; }
           .badge-debug { background: #e8e8e8; color: #666; }
@@ -80,6 +87,8 @@ export const Layout: FC<PropsWithChildren<LayoutProps>> = (
             .detail-section h2 { border-bottom-color: #21262d; }
             pre { background: #161b22; }
             .empty { color: #9198a1; }
+            .filter-form { border-color: #30363d; }
+            .filter-form legend { color: #9198a1; }
             .badge-debug { background: #21262d; color: #9198a1; }
             .badge-info { background: #122d42; color: #58a6ff; }
             .badge-warning { background: #2e2a1f; color: #d29922; }
diff --git a/packages/debugger/src/views/trace-detail.tsx b/packages/debugger/src/views/trace-detail.tsx
index 2277709a3..711dda71b 100644
--- a/packages/debugger/src/views/trace-detail.tsx
+++ b/packages/debugger/src/views/trace-detail.tsx
@@ -2,6 +2,7 @@
 /** @jsxImportSource hono/jsx */
 import type { FC } from "hono/jsx";
 import type { TraceActivityRecord } from "@fedify/fedify/otel";
+import { getLogLevels } from "@logtape/logtape";
 import type { SerializedLogRecord } from "../mod.tsx";
 import { Layout } from "./layout.tsx";
 
@@ -34,10 +35,38 @@ export interface TraceDetailPageProps {
   activities: TraceActivityRecord[];
 
   /**
-   * The list of log records for this trace.
+   * The list of log records for this trace, already filtered by
+   * {@link selectedCategory}, {@link selectedLevel}, and
+   * {@link selectedQuery} when any of them is set.
    */
   logs: readonly SerializedLogRecord[];
 
+  /**
+   * The total number of log records for this trace, before filtering.
+   */
+  totalLogCount: number;
+
+  /**
+   * The distinct log categories available to filter by, derived from the
+   * unfiltered log set for this trace.
+   */
+  availableCategories: readonly string[];
+
+  /**
+   * The category currently selected in the filter form, if any.
+   */
+  selectedCategory?: string;
+
+  /**
+   * The log level currently selected in the filter form, if any.
+   */
+  selectedLevel?: string;
+
+  /**
+   * The free-text search term currently entered in the filter form, if any.
+   */
+  selectedQuery?: string;
+
   /**
    * The path prefix for the debug dashboard.
    */
@@ -48,8 +77,20 @@ export interface TraceDetailPageProps {
  * The trace detail page of the debug dashboard.
  */
 export const TraceDetailPage: FC<TraceDetailPageProps> = (
-  { traceId, activities, logs, pathPrefix },
+  {
+    traceId,
+    activities,
+    logs,
+    totalLogCount,
+    availableCategories,
+    selectedCategory,
+    selectedLevel,
+    selectedQuery,
+    pathPrefix,
+  },
 ) => {
+  const filtered = Boolean(selectedCategory) || Boolean(selectedLevel) ||
+    Boolean(selectedQuery);
   return (
     <Layout pathPrefix={pathPrefix} title={`Trace ${traceId.slice(0, 8)}`}>
       <nav>
@@ -62,8 +103,20 @@ export const TraceDetailPage: FC<TraceDetailPageProps> = (
       <p>
         Full ID: <code>{traceId}</code> &mdash;{" "}
         <strong>{activities.length}</strong>{" "}
-        activit{activities.length !== 1 ? "ies" : "y"},{" "}
-        <strong>{logs.length}</strong> log record{logs.length !== 1 ? "s" : ""}
+        activit{activities.length !== 1 ? "ies" : "y"}, {filtered
+          ? (
+            <span>
+              <strong>{logs.length}</strong> of <strong>{totalLogCount}</strong>
+              {" "}
+              log record{totalLogCount !== 1 ? "s" : ""}
+            </span>
+          )
+          : (
+            <span>
+              <strong>{logs.length}</strong>{" "}
+              log record{logs.length !== 1 ? "s" : ""}
+            </span>
+          )}
       </p>
 
       {activities.length === 0
@@ -179,8 +232,67 @@ export const TraceDetailPage: FC<TraceDetailPageProps> = (
         )}
 
       <h2>Logs</h2>
+      {availableCategories.length > 0 && (
+        <form
+          class="filter-form"
+          method="get"
+          action={`${pathPrefix}/traces/${traceId}`}
+        >
+          <label>
+            Category
+            <select name="category">
+              <option value="">All categories</option>
+              {availableCategories.map((category) => (
+                <option
+                  key={category}
+                  value={category}
+                  selected={category === selectedCategory}
+                >
+                  {category}
+                </option>
+              ))}
+            </select>
+          </label>
+          <label>
+            Level
+            <select name="level">
+              <option value="">All levels</option>
+              {getLogLevels().map((level) => (
+                <option
+                  key={level}
+                  value={level}
+                  selected={level === selectedLevel}
+                >
+                  {level}
+                </option>
+              ))}
+            </select>
+          </label>
+          <label>
+            Search
+            <input
+              type="text"
+              name="q"
+              value={selectedQuery ?? ""}
+              placeholder="Search message…"
+            />
+          </label>
+          <div class="filter-actions">
+            <button type="submit">Filter</button>
+            {filtered && (
+              <a href={`${pathPrefix}/traces/${traceId}`}>Clear filters</a>
+            )}
+          </div>
+        </form>
+      )}
       {logs.length === 0
-        ? <p class="empty">No logs captured for this trace.</p>
+        ? (
+          <p class="empty">
+            {filtered
+              ? "No logs match the selected filters."
+              : "No logs captured for this trace."}
+          </p>
+        )
         : (
           <table class="log-table">
             <thead>
diff --git a/packages/debugger/src/views/traces-list.tsx b/packages/debugger/src/views/traces-list.tsx
index 2bf6eb53d..4db9ed53c 100644
--- a/packages/debugger/src/views/traces-list.tsx
+++ b/packages/debugger/src/views/traces-list.tsx
@@ -9,10 +9,31 @@ import { Layout } from "./layout.tsx";
  */
 export interface TracesListPageProps {
   /**
-   * The list of trace summaries to display.
+   * The list of trace summaries to display, already filtered by
+   * {@link selectedTypes} when it is non-empty.
    */
   traces: TraceSummary[];
 
+  /**
+   * The distinct activity types available to filter by, derived from the
+   * unfiltered trace set.
+   */
+  availableTypes: readonly string[];
+
+  /**
+   * The activity types currently selected in the filter form.
+   */
+  selectedTypes: readonly string[];
+
+  /**
+   * The same snapshot string the live-poll script computes from a fresh
+   * `/api/traces` fetch, computed here from the data this page was
+   * actually rendered with.  The script starts comparing from this value
+   * instead of from whatever its first poll happens to see, so a change
+   * that landed between the render and the first poll is still caught.
+   */
+  initialSnapshot: string;
+
   /**
    * The path prefix for the debug dashboard.
    */
@@ -23,16 +44,45 @@ export interface TracesListPageProps {
  * The traces list page of the debug dashboard.
  */
 export const TracesListPage: FC<TracesListPageProps> = (
-  { traces, pathPrefix },
+  { traces, availableTypes, selectedTypes, initialSnapshot, pathPrefix },
 ) => {
+  const filtered = selectedTypes.length > 0;
   return (
     <Layout pathPrefix={pathPrefix}>
+      {availableTypes.length > 0 && (
+        <form class="filter-form" method="get" action={`${pathPrefix}/`}>
+          <fieldset>
+            <legend>Filter by activity type</legend>
+            {availableTypes.map((type) => (
+              <label key={type}>
+                <input
+                  type="checkbox"
+                  name="type"
+                  value={type}
+                  checked={selectedTypes.includes(type)}
+                />
+                {type}
+              </label>
+            ))}
+          </fieldset>
+          <div class="filter-actions">
+            <button type="submit">Filter</button>
+            {filtered && <a href={`${pathPrefix}/`}>Clear filters</a>}
+          </div>
+        </form>
+      )}
       <p>
         Showing <strong>{traces.length}</strong>{" "}
         trace{traces.length !== 1 ? "s" : ""}.
       </p>
       {traces.length === 0
-        ? <p class="empty">No traces captured yet.</p>
+        ? (
+          <p class="empty">
+            {filtered
+              ? "No traces match the selected filters."
+              : "No traces captured yet."}
+          </p>
+        )
         : (
           <table>
             <thead>
@@ -76,19 +126,44 @@ export const TracesListPage: FC<TracesListPageProps> = (
         dangerouslySetInnerHTML={{
           __html: `
 (function() {
+  var selectedTypes = new URLSearchParams(location.search).getAll("type");
+  function snapshotOf(data) {
+    var types = [];
+    var rows = [];
+    for (var i = 0; i < data.length; i++) {
+      var activityTypes = (data[i].activityTypes || []).slice().sort();
+      var matchesFilter = selectedTypes.length === 0;
+      for (var j = 0; j < activityTypes.length; j++) {
+        if (types.indexOf(activityTypes[j]) === -1) types.push(activityTypes[j]);
+        if (!matchesFilter && selectedTypes.indexOf(activityTypes[j]) !== -1) {
+          matchesFilter = true;
+        }
+      }
+      if (matchesFilter) {
+        rows.push(
+          data[i].traceId + ":" + activityTypes.join("+") + ":" +
+            data[i].activityCount,
+        );
+      }
+    }
+    types.sort();
+    rows.sort();
+    return types.join(",") + "|" + rows.join(";");
+  }
+  var prevSnapshot = ${
+            JSON.stringify(initialSnapshot).replace(/</g, "\\u003c")
+          };
   var interval = setInterval(function() {
     fetch(${
             JSON.stringify(pathPrefix).replace(/</g, "\\u003c")
           } + "/api/traces")
       .then(function(r) { return r.json(); })
       .then(function(data) {
-        var countEl = document.querySelector("strong");
-        if (countEl) {
-          var current = parseInt(countEl.textContent, 10);
-          if (data.length !== current) {
-            location.reload();
-          }
+        var snapshot = snapshotOf(data);
+        if (snapshot !== prevSnapshot) {
+          location.reload();
         }
+        prevSnapshot = snapshot;
       })
       .catch(function() {});
   }, 3000);