Channels and PubSub.

The connection is refused before any channel exists. CodemojexWeb.UserSocket declares one channel route — channel "game:*", CodemojexWeb.RoomChannel — and gates connect/3 on the session: Codemojex.Session.resolve(params["session"] || params["token"]) either assigns :player or returns :error. The SES travels as a body field, kept out of a query string so it does not land in proxy logs; revocation is immediate because the session lives in Valkey behind the auth floor (C7.1). Only an authenticated socket carries a non-nil id/1 — "player_socket:" <> plr.

defmodule CodemojexWeb.UserSocket do
  use Phoenix.Socket

  channel "game:*", CodemojexWeb.RoomChannel

  # cm.4: authenticate the socket by the SES connect-param. The SES is a body field
  # (`session`, or `token`), kept out of a query string so it does not land in proxy
  # logs. A bad / missing / revoked SES → :error (the connection is refused); only an
  # authenticated socket carries an assigned :player and a non-nil id/1.
  @impl true
  def connect(params, socket, _connect_info) do
    case Codemojex.Session.resolve(params["session"] || params["token"]) do
      {:ok, %{plr: plr}} -> {:ok, assign(socket, :player, plr)}
      {:error, _} -> :error
    end
  end

  @impl true
  def id(%{assigns: %{player: plr}}) when is_binary(plr), do: "player_socket:" <> plr
  def id(_socket), do: nil
end

The auth floor is C7.1: the handshake POST /api/auth/:platform is the sole SES mint; the socket only resolves what the handshake minted. Identity is verified, never trusted.

join/3 is the subscription: joining game:<id> subscribes the channel to the matching PubSub topic and replies {:ok, %{view: Codemojex.game_view(game)}} — the privacy-safe view, never the secret; for a golden game, the public commitment but never its preimage, with the score totals withheld until revealed_ms is set. The inbound surface is one message: "refresh" re-reads the view and the top-20 leaderboard on demand. Everything else arrives as a handle_info from the topic and leaves as a push. The fan-out is Phoenix.PubSub, started as Codemojex.PubSub in the supervision tree right after the Repo; a room with a thousand watchers and a room with none cost the same — zero processes beyond the channels the clients themselves hold open.

@impl true
def join("game:" <> game, _params, socket) do
  {:ok, %{view: Codemojex.game_view(game)}, assign(socket, :game, game)}
end

@impl true
def handle_info({:scored, payload}, socket) do
  push(socket, "scored", payload) # classic — per finished attempt
  {:noreply, socket}
end

@impl true
def handle_info({:revealed, payload}, socket) do
  push(socket, "revealed", payload) # golden — the one fat close
  {:noreply, socket}
end

@impl true
def handle_info({:golden_win, payload}, socket) do
  push(socket, "golden_win", payload) # a Golden Room's live close
  {:noreply, socket}
end

@impl true
def handle_in("refresh", _params, socket) do
  game = socket.assigns.game

  reply = %{
    view: Codemojex.game_view(game),
    leaderboard: Enum.map(Codemojex.leaderboard(game, 20), fn {p, s} -> %{player: p, score: s} end)
  }

  {:reply, {:ok, reply}, socket}
end

The acceptance catalog pins the reply’s shape: “there is no :secret key anywhere in the view — only the keyboard snapshot”, and every leaderboard row is a {player, score} pair with no emojis attached (privacy.stories.md).

What crosses the wire differs by mode, and the difference is the privacy design. A classic attempt fans out the moment the worker scores it: {:scored, %{game, player, pct, eff}} — a display name, the attempt’s percentage, and the best board total Board.record/3 returned. A golden game broadcasts nothing per guess — the blind mode suppresses the feedback at the source, so no event exists to leak a score — and settles its whole story into one revealed event at the sealed close. A Golden Room tournament adds a third message on the same topic: {:golden_win, %{game: game, diamonds: won}}, the total paid and nothing about any guess.

# The ONE fat `revealed` event (V-13): the first and only results a blind client
# receives — the now-exposed secret + nonce + commitment, the final board, the
# top-K payouts, and the terminal state. The preimage was sealed until this point.
defp broadcast_revealed(game, settled, board, payouts) do
  Phoenix.PubSub.broadcast(
    Codemojex.PubSub,
    "game:" <> game,
    {:revealed,
     %{
       game: game,
       secret: Map.get(settled, :secret),
       nonce: Map.get(settled, :nonce),
       commitment: Map.get(settled, :commitment),
       board: Enum.map(board, fn {p, s} -> %{player: p, score: s} end),
       payouts: Enum.map(payouts, fn {p, d} -> %{player: p, diamonds: d} end),
       state: Map.get(settled, :status)
     }}
  )
end

The reveal closes the commitment made at open: with secret and nonce public, any player recomputes SHA-256(secret ‖ nonce) and checks it against the commitment the join view carried all along. In-flight, the events that fan out carry a name and a score, never the code or the guess — privacy.stories.md is the acceptance catalog.