A reliable guess queue.

codemojex is a competition to crack a six-emoji code. A player submits a guess; the game scores it against the secret; the score lands on the leaderboard. The host never scores — a single consumer is the authority. That split is already a queue. Codemojex.Guesses.submit/3 validates the guess against the round’s keyboard, overlays the player’s locked positions, charges the right currency through the wallet, then mints a branded JOB and enqueues it on the player’s lane.

The lane is named by the player’s PLR, so the bus rotates service across players and one masher cannot starve the field. Codemojex.ScoreWorker.handle/1 is the consumer the bus drains through EchoMQ.Lanes.claim/3: it reads the secret, scores with the pure linear engine, writes a GES guess, counts the attempt, and records the result.

Reliable means two things at the same time. A worker crash never drops a guess — the guess is scored, eventually, even if the first worker dies mid-score. And a worker crash never scores one guess twice — the leaderboard counts each guess once, even when the job is redelivered. The whole point of R3 was to build a queue that holds both at once.

Five patterns assemble into one reliable loop. Each prevents a different failure of the naive form — pop a job, process it, done — and they build in order: the claim leaves the job recoverable, that makes redelivery the at-least-once price, the stalled sweep reclaims a dead worker’s job, the atomic finish keeps the completion indivisible, and the blocking pickup keeps the consumer idle-cheap between guesses.

The claim is the foundation: the guess job moves from its player lane to active in one atomic step — LMOVE rotates the ring of serviceable lanes, ZPOPMIN pops the head of the rotated lane, HSET state active sets the row, and ZADD places the job on the active set at a lease deadline read from the server clock (TIME). So it is in exactly one set at every instant, and a crash leaves it recoverable. That in-flight move is what makes redelivery possible — which is the point — and it is also what makes delivery at-least-once: a worker that scores a guess, then dies before it acknowledges, leaves the job in active to be reclaimed. The stalled sweep returns that job; the atomic finish keeps the completion indivisible; the blocking pickup keeps the consumer idle-cheap. Assembled, they are a queue that loses no guess.

The assembled queue guarantees at-least-once delivery, so a guess job can run twice. That is safe because the branded JOB id is the idempotency key, and the bus dedups on it by construction. EchoMQ.Jobs’ enqueue script is one idempotent step: a second enqueue of the same branded id finds the row present (EXISTS KEYS[1]) and returns 0, which the host reads as {:ok, :duplicate}. The same guess admitted twice is admitted once.

The finish is fenced too. EchoMQ.Jobs.complete/5 refuses a stale attempts token ({:error, :stale}), so a worker whose lease was reaped and re-claimed by another worker cannot complete a job it no longer owns. The id orders the queue (mint order is byte order is sort order), names the row, and dedups admission — one 14-byte value doing the work of an index and a guard. So a guess that is redelivered after a crash is scored once, not twice: the first run writes the GES guess; a redelivered job re-claims and re-runs against the same secret, and the consumer is the authority that holds the count.

The interactive below makes the proof concrete. Submit the same guess job any number of times; the scored count stays at one. The first delivery records the guess; every later delivery is refused at admission or runs as a no-op against the dedup. At-least-once delivery over a branded-id-deduped effect is exactly-once-in-effect.

Every primitive in the assembled path is real EchoMQ code under echo/apps/echo_mq, and the consumer is real codemojex code under echo/apps/codemojex. The states are locations in the braced emq:{cm}: keyspace, and the branded JOB id is gated at the key builder (EchoMQ.Keyspace.job_key/2 raises on an ill-formed id).