Branch E — MOW Unified Canvas Preview Deployment + PHU-LUC Verdict

Deployed files (verified live, HTTP 200)

URL path	type	bytes
/ui-preview/mow/unified-canvas/v1/ (index.html)	text/html	11,739
…/styles.css	text/css	9,342
…/mock-data.json	application/json	18,963
…/preview.meta.json	application/json	1,591
…/phu-luc-a.html (access-note placeholder)	text/html	—
/ui-preview/_demo/health/v1/	text/html	1,558

Production sanity: GET / still HTTP 200 served by Nuxt (no regression).

Preview shows (all mission requirements)

• ✅ MOW Unified Canvas normal mode (default T3).
• ✅ T6→T1 tier tabs (with per-tier count badges).
• ✅ Breadcrumb (clickable crumbs, deepens per tier).
• ✅ Horizontal workflow/node blocks (step boxes, arrows, row-wrap like PHU-LUC-A).
• ✅ Child list under each block (≤3 + "··· +N").
• ✅ Traffic-light status (green/yellow/red/gray + instance blue/orange).
• ✅ "Đề xuất cải tiến" (Kaizen) button → Proposal Mode (toggle pills sửa/xóa, "+" buttons, "+ Thêm").
• ✅ Proposal mode mock state (state switcher).
• ✅ Large / governance-alert mock state (banner + freeze + approvals 1/2 + large-scale demo).
• ✅ Instance mode (progress bar, assignee avatar, SLA, 9-state chips).
• ✅ T1 click opens MOT Task Card panel.
• ✅ Links back to spec + review log + preview.meta.json.

Engineering notes: self-contained (no external CDN) → CSP-clean under the server's strict policy; loads ./mock-data.json via fetch (connect-src 'self'); light theme; desktop-first.

PHU-LUC extraction verdict — 🟡 read-extracted, verbatim hosting BLOCKED

• All four are stored on Drive as text/plain HTML (not Google Docs): A 1uy16CJ3lmH6llDroV18Gy5ZbAyH6cJaB, C 1hxm3qBYc1uZF1-ayGaFx3Im1k7F3zC1mABMskpuekSs, D 1btm_SHoZUk1n2SDK3QgKzOaY-F5BHbWg_0zfvlGlKNE, E 1wrIByOIyzodxJsRUwv2K0b5ER1z8NmZD4ymoA.
• PHU-LUC-A fully extracted via download_file_content (clean base64 → full working MOW prototype read).
• Exact blocker: the files are shared owner-only (private); get_file_permissions shows only nmhuyen@gmail.com (owner). VPS curl of the Drive download URL returns Google's sign-in HTML (939 KB), not the file. There is no binary pipe from a tool's read result into a deployment write, and hand-transcribing 21 KB of HTML/base64 risks corruption — so the originals were not re-hosted byte-for-byte.
• Mitigation shipped: index.html faithfully reproduces PHU-LUC-A's structure/flow (and is data-driven per the contract). phu-luc-a.html is an honest access-note page.
• Precise unblock: set PHU-LUC A/C/D/E Drive sharing to "anyone with the link can view", then re-run the deploy step — the VPS can then curl each file and base64 -d / save it cleanly into the version dir. (Alternatively, paste each file's content for direct authored write.)

Deploy mechanics

Local build under /tmp/incomex-preview/… → tar | ssh contabo 'tar -x' into the static mount → nginx /ui-preview/ route (see 02). Total deployed: 84 KB.