Ask where and when this code runs

First, build a mental model

A runtime supplies capabilities. A browser has a document and user input; a build process emits files; a trusted request runtime can make private decisions for each request.

1. Label both location and time: build-time execution is different from per-request execution even if both happen outside the browser.
2. Browser modules can use browser APIs when actually running in the browser. Client Components may also be prerendered, so reading window during module evaluation or initial render is not automatically safe.
3. A Server Component can run at build time for a static route. Its name alone does not imply there is a server available after deployment.
4. Anything serialized into HTML, component data or a JavaScript bundle is delivered to the user. A server-side origin does not make emitted data private.

{
  "build": ["read public curriculum", "emit HTML and assets"],
  "requestServer": ["verify actor", "authorize protected write"],
  "browser": ["handle pointer input", "save local practice history"]
}

1. Before hosting

   The build reads safe curriculum data and produces files that can be served repeatedly.

2. At a protected request

   A live trusted runtime would verify identity and authority; an exported HTML file cannot perform that private decision.

3. In the learner's tab

   JavaScript handles input and local progress. The learner controls that browser and its storage.