Guesses on fair lanes.

Admission before enqueue. A guess that is closed, expired, malformed, or unaffordable never becomes a job. submit/3 walks a cond of guards and charges the wallet before it enqueues — so everything on the queue is a validated, paid attempt, never waste. The surface answers accepted-and-on-its-way, and there is no process per game, so a large field of idle games costs nothing.

Per-player fairness. The guess lane is keyed by the player’s PLR, and the bus rotates service across lanes. A player who taps twice as fast gets their own lane serviced in turn — not twice the field’s throughput. Paying for speed buys a turn, not the field, and the fairness is structural: it is the group key on the queue, not a throttle at the edge.

At-least-once, made harmless. Delivery is at-least-once and every handler is idempotent. The enqueue answers :duplicate to a re-send; scoring is a pure function of the secret and the guess, so a re-scored guess is identical; and each consumer leases the job it works, so a crashed consumer’s in-flight job becomes visible again rather than lost. The attempt a player paid for is scored, once, even across a failure.