🚧 Add environment maneuverability

README.md

@@ -411,6 +411,26 @@ requirement ID for each item in parentheses.
       config export stay lean (non-default entries only).
 - [ ] M6: scenario run view + alias-ownership rejection (FR-10.2.6,
       FR-10.2.9) — deferred.
+- [x] M7: plant environment control (FR-10.2.15, FR-10.2.17) — the
+      web UI loads/unloads environments at runtime (`--env` becomes the
+      startup default, not the only option): an environment card shows
+      ref, state (running/paused/done/none), sim-time and tick ms with
+      start (with hot reload of edited source, `sys.modules`
+      invalidation), stop (ticker cancelled, field freezes),
+      pause/resume (instance kept — pause is a deliberate FAT fault:
+      "plant stuck"), reset (deterministic fresh episode) and restart.
+      Exactly one env at a time; `is_done()` ends the ticker (state
+      `done`); SAVE CONFIG (module-list rebuild) discards the env like
+      a KBUS reset discards values; starting while loaded is refused;
+      readonly mode blocks every env mutation. API: `GET /api/env` +
+      `POST /api/env/{start,stop,pause,resume,reset,restart}`.
+- [ ] M8: environment file authoring (FR-10.2.16, planned) —
+      create/modify/delete environment source files (e.g.
+      `envs/*.py`) through the web UI (editor pane + upload/download).
+      Security note: UI-written Python is RCE by design — same trust
+      boundary as the bench network; disabled in readonly mode; delete
+      refused while the env is loaded; the on-disk directory must be
+      explicit in configuration.
 - [x] Tests: 46 web-UI tests (`tests/test_webui.py`) via httpx
       `ASGITransport` (in-process, no socket) + live verification:
       browser SAVE CONFIG rebuilds the node and persists YAML; Modbus