The guess and the lock.

submit/3’s head clause is when length(emojis) == 6, so a wrong-length input falls to the catch-all clause and is a plain :bad_guess — the arity of a guess is enforced by pattern match, not a runtime check. A live, unexpired game then validates the six codes against its own snapshotted keyboard: cell_codes, the randomized subset the game pinned at open (C2). A code from outside that subset is rejected before any money moves.

def submit(game, player, emojis) when length(emojis) == 6 do
  r = Store.game(game)                    # the system of record, not the cache
  now = System.system_time(:millisecond)
  cond do
    r == nil                            -> {:error, :no_game}
    Map.get(r, :status, :open) != :open -> {:error, :closed}
    expired?(r, now)                    -> {:error, :expired}
    not valid_guess?(r, emojis)         -> {:error, :bad_guess}
    true ->
      guess = Locks.merge(game, player, emojis)   # locks overlaid → the scored guess
      # … charge the wallet, then enqueue (C3.2)
  end
end
def submit(_game, _player, _emojis), do: {:error, :bad_guess}

The guards run in order and short-circuit: the first that matches returns its error, and only true reaches the write. The surface turns each {:error, reason} into a rejection the player sees immediately, and turns the accepted branch into an on-its-way response — the score returns later, over the live channel.

A player sure of a position locks it. The lock is one field in a per-player Valkey hash for the round — key cm:{round}:lock:{player}, field the position 0..5, value the code — so it persists across guesses with no client state to lose. At submit time, Locks.merge/3 overlays the locked positions onto the six submitted codes; a locked position wins regardless of what the keyboard sent.

# key: cm:{round}:lock:{player}   field: position 0..5   value: code
def merge(round, player, guess) do
  locks = locked(round, player)                 # %{pos => code} from the hash
  guess
  |> Enum.with_index()
  |> Enum.map(fn {code, i} -> Map.get(locks, i, code) end)  # lock wins at its position
end

So a confirmed cell is guaranteed on every subsequent guess: the player commits it once, and the server enforces it on the merged guess that becomes the job. The guess that gets scored is always the merged one, never the raw client input.