test(admin): qualify recent audit filters and disclosure

docs/ui-modernisation/REFINEMENT_AND_EUROPE.md

@@ -7,7 +7,7 @@ Owner addendum received 9 November 2026. Source `E:/Storage/Projects/Active/temp
 | Admin information isolation | The original redaction patch passed 62 tests on the security branch. [A3 integration](ADMIN_AUDIT_ISOLATION_VALIDATION.md) matched the exact source/test patch and passed 57 selected tests. The runs overlap and remain separate evidence. | Integrated security, remaining delivery paths, broader minimisation and deployment checks remain separate. |
 | Discover Jobs | [Search-first layout](visual-correction/DISCOVERY_SEARCH_FIRST.md) moves the query above filters and qualifies the existing NAV request, keyboard submit and source disclosure. | Expose new filters, map and multilingual suggestions only with qualified data and the existing GJ architecture. Mobile filter drawer and focused detail remain open. |
 | Applications | [Title-first rows and explicit bulk mode](visual-correction/APPLICATION_SELECTION_REVIEW.md) qualified at 36 configurations. | Secondary action consolidation and final native/visual review remain open. |
-| Admin Users and Audit | [Aligned rows](visual-correction/ADMIN_USER_ALIGNMENT_REVIEW.md), [read-only 2FA status](visual-correction/ADMIN_USER_2FA_REVIEW.md) and [recent audit search](visual-correction/AUDIT_SEARCH_REVIEW.md) passed their own 36-configuration checks. Compact user actions, structured filters and safe expansion remain open. | 2FA recovery and private support access require explicit owner approval of their technical and privacy designs. |
+| Admin Users and Audit | [Aligned rows](visual-correction/ADMIN_USER_ALIGNMENT_REVIEW.md), [read-only 2FA status](visual-correction/ADMIN_USER_2FA_REVIEW.md) and [recent audit filtering and details](visual-correction/AUDIT_FILTERS_REVIEW.md) passed their own 36-configuration checks. Compact user actions and additional structured filters remain open. | 2FA recovery and private support access require explicit owner approval of their technical and privacy designs. |
 | Job Correspondence | Continue inbox layout, mailbox-status presentation and existing explicit consent flow. | Provider verification, restricted scopes, multiple-account persistence and retention decisions retain their gates. Signing in grants no mailbox access. |
 | System Status | [Status refresh evidence](visual-correction/SYSTEM_STATUS_REFRESH_REVIEW.md) and [diagnostics design](SYSTEM_DIAGNOSTICS_DESIGN.md) distinguish current, stale and unavailable readings. CV Benchmark Review is retained. | Predefined diagnostics require approved suites, isolated execution, role checks and audit. Live execution and per-signal telemetry remain open. |
 | Terminology | “Prepare application” / “Klargjør søknaden” is visible in the scoped EN/NB application checks. | Continue broader terminology and European catalogue review. |

docs/ui-modernisation/UI-10.md

@@ -1,5 +1,7 @@
 # A3-IM10 Cross-application qualification
 
+Audit runtime `cd69b769` combines exact event type and inclusive local dates with recent search and adds keyboard-expandable details for already permitted values. See [Audit filter review](visual-correction/AUDIT_FILTERS_REVIEW.md).
+
 Audit runtime `1a8a97a5` adds local metadata search for the loaded recent-event window. Ten frontend tests and 72 controlled captures and scans passed. See [audit search evidence](visual-correction/AUDIT_SEARCH_REVIEW.md).
 
 Admin Users runtime `e22f2d64` presents read-only 2FA and confirmation status. Seven backend tests, 14 frontend tests, lint, export and 36 scoped browser scans passed. See [account status evidence](visual-correction/ADMIN_USER_2FA_REVIEW.md).

docs/ui-modernisation/visual-correction/AUDIT_FILTERS_REVIEW.md

@@ -0,0 +1,11 @@
+# Recent Audit Log filters and event details
+
+Runtime `cd69b769a232dda959d758b685579354ae35fdd2`. The existing recent-event search combines with an exact event-type selector and inclusive calendar dates in the browser's timezone. An inverted range is announced next to the end date. All filters operate over the existing response of up to 200 events.
+
+The event details disclosure is closed by default and opens with the keyboard. It shows previous value, new value and any note already permitted by the API. The existing actor, timestamp, job and action columns remain. Filtering excludes notes and change values. No new endpoint, permission or data collection was added.
+
+The targeted tests cover the last millisecond of a local day, exclusion of the next day, exact event type, invalid range, no additional API request and disclosure in Bokmål. The browser journey checks keyboard expansion, retained notes and redacted search scope, narrow no-match feedback, date readability and the scroll region. All API responses are synthetic. No undo or restore is executed.
+
+Remaining: historical search, task/correlation/status/severity/component filters with qualified sources, richer safe event history, native-language/device review and integrated security.
+
+Passed 11 selected frontend tests, full lint, export build with TypeScript, and 36 controlled responsive configurations with 108 scoped axe scans and screenshots. There were zero mutations and page errors, and 36 unavailable company fixture reads outside Audit. The pilot overlaps the matrix. Reviewed the 320 px Bokmål dark filter and expanded-detail captures.

docs/ui-modernisation/visual-correction/ROUTE_COVERAGE.json

@@ -219,9 +219,9 @@
         "AdminAuditPage"
       ],
       "visualStatus": "OPEN_COLLECTION_RENDERED_SCOPED_RENDERED_REVIEW",
-      "afterStatus": "PASSED:36 recent-search, no-match, timestamp and keyboard scroll configurations; browser mutations not run",
+      "afterStatus": "PASSED:36 recent-search, event type/date filter, disclosure, no-match and keyboard scroll configurations; browser mutations not run",
       "functionalCriteria": "Original preservation register retained; no capability acceptance promotion",
-      "evidence": "AUDIT_SEARCH_REVIEW.md; evidence/audit-search/BROWSER.json; earlier AUDIT_DATE_REVIEW.md and ADMIN_HEADINGS_REVIEW.md"
+      "evidence": "AUDIT_FILTERS_REVIEW.md; evidence/audit-filters/BROWSER.json; earlier AUDIT_SEARCH_REVIEW.md and AUDIT_DATE_REVIEW.md"
     },
     {
       "route": "/admin/users",

docs/ui-modernisation/visual-correction/evidence/audit-filters/PILOT.json

@@ -0,0 +1,55 @@
+{
+  "screens": [
+    {
+      "width": 320,
+      "language": "nb",
+      "mode": "dark",
+      "state": "audit-no-matches",
+      "capture": "viewport at top",
+      "violations": []
+    },
+    {
+      "width": 320,
+      "language": "nb",
+      "mode": "dark",
+      "state": "audit-expanded",
+      "capture": "focused viewport",
+      "violations": []
+    },
+    {
+      "width": 320,
+      "language": "nb",
+      "mode": "dark",
+      "state": "audit-populated",
+      "capture": "viewport at top",
+      "violations": []
+    }
+  ],
+  "journeys": [
+    {
+      "width": 320,
+      "language": "nb",
+      "mode": "dark",
+      "auditSearch": "PASS",
+      "auditTimestampReadable": "PASS",
+      "headerHeight": 44.5,
+      "eventHeight": 79.5,
+      "keyboardScroll": "PASS",
+      "auditMutations": "NOT RUN"
+    }
+  ],
+  "errors": [],
+  "unexpectedWrites": [],
+  "exportDenials": [],
+  "unavailableReads": [
+    "/api/companies"
+  ],
+  "blockedExternal": [
+    "https://fonts.googleapis.com"
+  ],
+  "limits": [
+    "Every API response is synthetic. In admin-only mode all mutations are blocked and account flows are NOT RUN; otherwise account export is a controlled 403 and confirmations are cancelled.",
+    "Only the populated audit table, timestamp geometry and keyboard scrolling are exercised.",
+    "No real credentials, provider activation, model, native device, integrated security, production or release acceptance."
+  ]
+}