Saved review attempts now expose Run JavaScript tests, Cancel test run, and expandable Test output and exact snapshot. Complete, failed and cancelled runs remain in the plan after reloading its page. Results are device-local history, separate from Ampd's authority-managed validation ledger and task acceptance. The first profile remains dependency-free tools/*-test.mjs; Rust/Elixir/native UI suites and arbitrary commands are not selected by this control.
The trusted main webview supplies only the attempt id/revision, expected world and workbench generation. The native host obtains the held repository path and asks the runtime's read-only resolve_development_test bridge operation for the retained attempt. One framed observation checks current world, attempt revision, plan revision/status, review dismissal and registered repository identity. The page supplies neither source text, a host path nor an execution outcome. No agent-facing command, grant or Carrier receipt is added.
The native runner uses CLI/core source embedded in the compiled binary, rather than a script from the selected repository. It writes the retained review and a local starting record before launching Node. The runner checks exact file identities and captures the source as documented in PROPOSAL_TEST_RUNNER_2026_09_08.md; the test process runs in Bubblewrap with no unisolated fallback. SIGTERM requests cancellation through an AbortController, which kills the isolated test process group and records cancellation without a passing verdict. A request during source capture prevents subsequent test launch. The CLI is still a dependency: Node, Bubblewrap and working Linux user namespaces must be installed.
One local run may be active at a time per app process, with up to 32 retained run entries per world. Local history is keyed by world incarnation/generation and linked to the attempt. Starting/running records without an active native owner are shown as interrupted, with no passing verdict. App shutdown is not yet a coordinated cancellation/recovery protocol: a child may finish within its existing timeout, while the app-level entry remains interrupted. Page reload and result restoration are tested; full app-process restart and world rollover still need native coverage.
The UI preserves unfinished notes before starting, disables duplicate starts while running, polls local state while the review is open, retains expanded output during updates, and clears the waiting message after cancellation completes. Test output remains expandable and bounded. A changed plan or source requires a fresh review; a saved passing result is not current-checkout readiness. Device-local records are not signed attestations and are not accepted as runtime validation receipts.
Verification combines runtime lookup tests, runner cancellation tests, the existing JavaScript behavior suite, permission/ordering gates, and two full native plan-file workflows with actual test processes and deterministic provider fixtures. They cover pass/fail, source preservation, cancellation, output identity, note preservation, reload, and dismissal. Screenshots, logs and precise totals are in the task's Super_Review_Test_UI_Implementation.md. The original cancellation callback failure is retained as diagnostic evidence; final runs use the corrected runner.
Next: runtime-owned admission/results and lifecycle recovery, then explicit result-bound acceptance and a real-model Super-on-Super change. Local test controls close a practical UI gap without claiming those remaining authority and dogfood steps are complete.