fix(environment): own JSON fields across capture, state and replay

docs/agent-environments.md

@@ -871,8 +871,9 @@ names a `document` view once, at its initial document's `path`. The `version`,
 and the `state_evidence_id` and `types` that `data/get` reports, must match
 the served state, so a `data/get` result loads back unchanged. A number without
 an exact native value, or whose serialized spelling would not be read as exact
-(an integer from 2^53 below 1e21, such as `1e20`, in any spelling), or a
-`__proto__` member is refused rather than altered.
+(an integer from 2^53 below 1e21, such as `1e20`, in any spelling), is refused
+rather than altered. Caller data preserves all own JSON members, including
+`__proto__`; unknown members of the state document's structure are refused.
 An invalid document is `-32602` naming the first problem by JSON pointer, as in
 `/rea_state/entities/3/collection` (also in `error.data.path`); a problem
 inside caller data (`fields`, `value`, `types`) is located at that member, so

docs/specs/agent-environments/state-serve/spec.md

@@ -110,7 +110,9 @@ this increment: write tools are not served from the state.
   differs from the entity's id (refused at that view's `fields`),
   documents naming document views once at the initial path, and the optional
   `state_evidence_id` and `types` that `data/get` reports equal to the served
-  ones. Refuse numbers without an exact native value and `__proto__` members.
+  ones. Refuse numbers without an exact native value. Preserve all own JSON
+  members in caller data, including `__proto__`, and reject unknown structural
+  members before projecting the document's declared fields.
   Name the first problem by JSON pointer, never deeper than a caller-data
   member (`fields`, `value`, `types`), and leave the state unchanged.
 - Keep record citations Evidence provenance: refuse `record_ordinals` or a

docs/specs/agent-environments/state-view/spec.md

@@ -133,8 +133,8 @@ later increments.
 - Keep an item or list plan only when it reproduces each request line's latest
   initial recording from the state, comparing JSON values without regard to
   member order; otherwise record the tool with a reason. Parse bodies only when
-  JSON-like, UTF-8, at most 256 KiB, exactly representable and free of
-  `__proto__` members.
+  JSON-like, UTF-8, at most 256 KiB and exactly representable. Preserve all own
+  JSON members, including `__proto__`, through extraction and normalization.
 - Mark the Evidence inferred; state unknowns for authorization, response
   semantics and write effects.
 - Charge the manifest's admission and grouping, every record line, every body

docs/specs/agent-environments/state-writes/spec.md

@@ -150,7 +150,7 @@ the exemplar.
 
 - **Request body.** The exemplar's request body must be a JSON object that
   could enter the state: a JSON-like media type, complete UTF-8 text within
-  256 KiB, exact numbers, no `__proto__` member. Otherwise the reason is
+  256 KiB and exact numbers. All own JSON member names are retained. Otherwise the reason is
   `body-unusable`. A `DELETE` takes no body. A create's or update's body
   whose only member wraps one object in a one-element array (Ghost's
   `{"posts":[{...}]}`) is that object, and the plan records the member as
@@ -587,7 +587,7 @@ changes it atomically, so every MCP session and `data/get` see one state.
 - a create in another collection when the plan is tied to its own;
 - a document write at a path other than the one the state holds it at;
 - a body member or a resulting value `data/add` would refuse (a number not
-  exact as `data/get` writes it, a `__proto__` member, nesting past the
+  exact as `data/get` writes it or nesting past the
   limit), increments included, so `data/get` always loads back;
 - a create, update or document write that would take what `data/get` reports
   past the 32 MiB `data/add` intake limit, as a `resource_constraint` error;

docs/web-network-captures.md

@@ -696,8 +696,9 @@ more than one query) and `rendered-oversize` (a document value whose JSON
 renders to more than 256 KiB). A document holds the value of its one `path`, so for such
 a template it says nothing about the template's other paths. A body is usable
 when its content type is
-JSON-like, it is UTF-8 text of at most 256 KiB, every number survives native
-conversion exactly, and no member is named `__proto__`.
+JSON-like, it is UTF-8 text of at most 256 KiB, and every number survives native
+conversion exactly. JSON member names, including `__proto__`, remain ordinary
+own data members through extraction and serving.
 
 A list view also learns, from its checked lines that do not list the whole
 collection, what each query parameter does, and names the result in `query`.