The mental model

server   init ──▶ Model ──┬── plan.state ──▶ slice ──▶ envelope   (JSON on the stamped root)
                          └── view ──▶ HTML                        (checked, see below)

browser  envelope ──▶ baseline with the slice set on it ──▶ Model
         Model + the server's HTML ──▶ Runtime.hydrate adopts ──▶ plan.boot Commands

The one rule everything else serves: the browser's first Model renders the same page the server sent. The browser's Model is the plan's baseline, by default the application's initial, with the slice set onto it. So SSR.render renders the view twice, once from the server's Model and once from the browser's, and refuses the plan if the two differ. A view that reads a field the plan does not send is caught there, on the server, instead of being silently rebuilt in the browser.