feat(ui): ship reachability witnessing shell

docs/features/checked/web/reachability-witnessing-ui.md

@@ -0,0 +1,53 @@
+# Reachability Witnessing UI
+
+## Module
+Web
+
+## Status
+VERIFIED
+
+## Description
+Mounted the canonical `Security > Reachability` shell for coverage, witnesses, proof-of-exposure, and sensor-gap investigation. Operators can drill from findings, triage, evidence replay, and release detail into one witness-detail experience with return-to-context preserved, drawer-first proof inspection, and export or verify actions.
+
+## Implementation Details
+- **Feature directory**: `src/Web/StellaOps.Web/src/app/features/reachability/`
+- **Primary components**:
+  - `reachability-center` (`src/Web/StellaOps.Web/src/app/features/reachability/reachability-center.component.ts`)
+  - `witness-page` (`src/Web/StellaOps.Web/src/app/features/reachability/witness-page.component.ts`)
+  - `poe-drawer` (`src/Web/StellaOps.Web/src/app/features/reachability/poe-drawer.component.ts`)
+- **Canonical routes**:
+  - `/security/reachability/coverage`
+  - `/security/reachability/witnesses`
+  - `/security/reachability/witnesses/:witnessId`
+  - `/security/reachability/poe`
+  - `/security/reachability/poe/:artifactId`
+  - `/security/reachability/gaps`
+- **Secondary entry points**:
+  - `Security > Findings`
+  - `Triage > Artifact Workspace`
+  - `Evidence > Verify & Replay`
+  - `Releases > Detail`
+- **Source**: shipped reachability owner shell with witness-detail and PoE deep-link contract
+
+## E2E Test Plan
+- **Setup**:
+  - [ ] Log in with a user that can view Security, Evidence, and Releases.
+  - [ ] Navigate to `/security/reachability/witnesses`.
+  - [ ] Ensure witness API data exists or fallback fixtures are enabled.
+- **Core verification**:
+  - [ ] Verify `Coverage`, `Witnesses`, `PoE / Exposure`, and `Sensor Gaps` render in one mounted shell.
+  - [ ] Verify witness search, filters, and witness-detail drill-in work.
+  - [ ] Verify PoE drawer, PoE permalink route, export, and verify actions work.
+- **Cross-shell verification**:
+  - [ ] Verify findings, triage, evidence replay, and release detail link into the canonical reachability routes.
+  - [ ] Verify `returnTo` restores the original workflow context.
+  - [ ] Verify fallback fixtures render a clear degraded-mode message when the backend is unavailable.
+
+## Verification
+- Run:
+  - `npx ng test --watch=false --include src/tests/reachability_center/reachability-center.component.spec.ts --include src/tests/reachability_center/witness-page.component.spec.ts --include src/tests/security-risk/security-risk-routes.spec.ts --include src/tests/security-risk/finding-detail-page-reachability-handoff.spec.ts --include src/tests/triage/triage-workspace-with-proof-tree.behavior.spec.ts --include src/tests/evidence/replay-controls-reachability-handoff.spec.ts --include src/tests/releases/release-detail.live-refresh.spec.ts`
+  - `npx playwright test tests/e2e/reachability-witnessing.spec.ts --workers=1`
+- Tier 0 (source): pass
+- Tier 1 (build/tests): pass
+- Tier 2 (behavior): pass
+- Verified on (UTC): 2026-03-07T18:25:00Z