feat(n7web): refine spatial UI and NFC-gated extension routing

tests/unit/test_assistant_frontend_contract.py

@@ -27,7 +27,7 @@ def test_console_contains_ai_assistant_surface():
 def test_codex_assistant_assets_are_versioned_together_in_the_service_worker():
     service_worker = (ROOT / "apps/web-console/service-worker.js").read_text(encoding="utf-8")
     assert (
-        'const CACHE_VERSION = "cognitive-agent-pad-v315-vue-vite"'
+        'const CACHE_VERSION = "cognitive-agent-pad-v317-nfc-auth-routing"'
         in service_worker
     )
     assert '"/assistant-chat.css?v=codex-assistant-29"' in service_worker
@@ -120,6 +120,32 @@ def test_validated_controls_are_mirrored_into_a_compact_assistant_card():
     assert ".assistant-dispatched-controls[open]" in css
 
 
+def test_explicit_nfc_authorization_block_is_rendered_as_safety_blocked():
+    console = (ROOT / "apps/web-console/console-v2.js").read_text(encoding="utf-8")
+
+    assert 'executionStatus === "blocked"' in console
+    assert "Boolean(telemetry.authorization_reason)" in console
+    assert 'deliveryState = aborted' in console
+    assert '? "blocked"' in console
+    assert '? "安全阻止"' in console
+
+
+def test_latest_dispatched_control_group_is_the_only_group_expanded():
+    assistant = (ROOT / "apps/web-console/assistant-chat.js").read_text(
+        encoding="utf-8"
+    )
+    vue_ui = (ROOT / "apps/web-console/vue-ui.js").read_text(encoding="utf-8")
+
+    assert "function focusLatestDispatchedControls(container)" in assistant
+    assert 'transcript.querySelectorAll(".assistant-dispatched-controls")' in assistant
+    assert "card.open = card === activeCard" in assistant
+    assert "focusLatestDispatchedControls(host)" in assistant
+    assert "focusLatestDispatchedControls(card)" in assistant
+    assert 'querySelectorAll(".assistant-dispatched-controls[open]")' in assistant
+    assert 'querySelectorAll(".assistant-dispatched-controls[open]")' in vue_ui
+    assert "if (card !== event.currentTarget) card.open = false" in vue_ui
+
+
 def test_saved_mode_execution_opens_with_pending_flow_before_http_completion():
     app = (ROOT / "apps/web-console/app.js").read_text(encoding="utf-8")
     flow = app.split(