feat(sync): coalesce offline media intent

docs/ARCHITECTURE.md

@@ -50,8 +50,31 @@ relay media event.
 
 Force Sync remains a two-phase ACK protocol. `PREPARE` is temporary choreography;
 the matching `EXECUTE` commits its validated target to canonical state. Per-sender
-`seq`, peer heartbeats, and the existing reconnect event queue remain separate.
-Offline media-command compaction is intentionally deferred.
+`seq`, peer heartbeats, and the reconnect queue remain separate mechanisms.
+
+## 3.2 Offline Media Intent
+
+Canonical Media State and Offline Media Intent have different ownership:
+
+- Canonical Media State is the relay's last accepted shared playback truth.
+- Offline Media Intent is one room-scoped client representation of local
+  `PLAY`/`PAUSE`/`SEEK` commands that have not reached the relay yet.
+
+Contiguous offline controls merge into a bounded logical queue entry. Every
+retained coordination event, including Force Sync and Episode Lobby events, is
+an ordering barrier. Stale offline `PING`, `PONG`, heartbeat `PEER_STATUS`, and
+`EVENT_ACK` frames are not persisted because they are no longer meaningful after
+reconnect. Force Sync ACK remains transactional and is not dropped or merged.
+
+Media intent waits for the reconnecting room's `ROOM_DATA`. An authorized intent
+takes precedence over the older canonical snapshot, materializes into the
+minimum ordered legacy `SEEK` plus `PLAY`/`PAUSE` frames needed by old peers, and
+thereby advances relay canonical state normally. With no intent, canonical
+recovery is unchanged. Role loss discards room-driving intent before recovery;
+intentional Host Control solo mode and an active Episode Lobby remain
+authoritative. MV3 session restoration migrates the previous raw queue format,
+preserves barriers, repairs `localSeq` monotonically, and rejects another room's
+intent.
 
 ## 4. Episode Auto-Sync
 Maintains continuous synchronized viewing when watching series:

docs/PROTOCOL.md

@@ -141,8 +141,29 @@ relaying the established event names, payloads, and order unchanged. This makes
 server-first rollout safe: old clients populate recovery state without needing to
 understand or acknowledge it, and new clients consume it only when the relay
 advertises the capability. No protocol-version or minimum-version bump is
-required. Offline `play`/`pause`/`seek` compaction is planned separately and is
-not part of Media State v1.
+required. Offline `play`/`pause`/`seek` compaction remains the separate
+client-owned layer described below rather than part of the relay capability.
+
+### Offline media intent
+
+Offline media intent is client-side queue state, not a relay protocol feature.
+An updated extension coalesces contiguous unsent `play`, `pause`, and `seek`
+commands for one room. Retained non-media events are ordering barriers. On a
+successful rejoin, the extension first reads `room_data` so current Host Control
+and Episode Lobby authority can be applied, then replays an authorized intent as
+the minimum existing legacy media-event sequence. Actual wire frames, rather
+than logical queue entries, consume the paced reconnect budget.
+
+Pending authorized local intent takes precedence over an older canonical
+snapshot because it has not yet been accepted by the relay. Its legacy replay
+then updates canonical state like any other accepted control. Without pending
+intent, canonical recovery proceeds normally. Intent made stale by a room switch,
+role loss, intentional solo mode, or an active Episode Lobby is discarded and
+cannot suppress server recovery.
+
+This requires no event, capability, ACK, protocol-version, or minimum-version
+change. Old relays receive ordinary `play`/`pause`/`seek`; old peers see only the
+same existing relayed events.
 
 ## Ephemeral encrypted chat