The privacy boundary.

A Codemojex player sees three things about a game: their own attempt history with scores, their best score, and the leaderboard ranked by best score. They never see the secret, and they never see another player’s guesses — not the values, not the positions. That line is held at the facade and the channel by privacy-safe views, so the data that would spoil the game is filtered before it leaves a system rather than after.

In a Golden Room the boundary is total. Because the mode reveals no feedback, a player does not even learn their own score until the room closes; the channel carries the timer and the room’s state, and nothing about how close anyone is. The secret stays sealed behind a commitment until the reveal, so the boundary protects not only one player from another but every player from a result that does not exist yet.

This is why privacy is a property of the views and the boundary, not of the client. A request that asks for a guess it does not own is refused at the system, an operator screen reads through the same views, and a blind game withholds the score by policy rather than by hoping the client hides it. The reference implementation treats what a player may know as part of the contract, enforced where state lives.