Thanks for the input. Steps 1-3 are how it currently works. Step 4 is problematic because the Firebase server cannot compute who wins; that has to be done on the client.
I think I can configure Firebase to validate scores based on some precondition (i.e. 'only allow this value to be increased by one if both players have chosen and declared'). Then clients would reset their choices immediately and scores would be 'locked-in' until the next victory condition is met. That will prevent basic attempts to cheat, but I need to look into the docs to see if I could be smarter about it.
I think I can configure Firebase to validate scores based on some precondition (i.e. 'only allow this value to be increased by one if both players have chosen and declared'). Then clients would reset their choices immediately and scores would be 'locked-in' until the next victory condition is met. That will prevent basic attempts to cheat, but I need to look into the docs to see if I could be smarter about it.