Agreed, but maybe my mental model is splitting the 'Controller' aspect into the client / server model. Everything must get validated server side, there's no ot

Agreed, but maybe my mental model is splitting the 'Controller' aspect into the client / server model. Everything must get validated server side, there's no other rational choice. Otherwise you cannot enforce any consistency or business logic. That just leaves formatting the requested changes into a language the server model accepts. Maybe model is more 'database', controller is API interface (server side + client request requirements), and view is end user render?