One authoritative clock, two obedient players

function authoritativePosition(room, nowServerMs) {
  if (room.state !== 'playing') return room.anchorPositionMs;
  const elapsed = nowServerMs - room.anchorServerMs;
  return room.anchorPositionMs + elapsed * room.rate;
}

// every transition rewrites the anchor atomically
function applyPause(room, nowServerMs) {
  room.anchorPositionMs = authoritativePosition(room, nowServerMs);
  room.anchorServerMs   = nowServerMs;
  room.state            = 'paused';
  room.seq             += 1;
}

client → { type: "sync_ping", t0: <client monotonic ms> }
server → { type: "sync_pong", t0, t1: <server recv>, t2: <server send>,
           state, anchorPositionMs, anchorServerMs, rate, seq }
client:  t3 = now()

rtt    = (t3 - t0) - (t2 - t1)
offset = ((t1 - t0) + (t2 - t3)) / 2      // add offset to client clock → server clock

// keep the 5 lowest-RTT samples from the last 30 s; use their median offset.
// discard any sample whose rtt exceeds 2.5x the running median — that is queueing delay,
// and asymmetric delay is what poisons naive offset math.

const LOCK = 40, FINE = 250, COARSE = 1500, REARM = 10_000;

function correct(video, driftMs /* local - authoritative */) {
  const gap = Math.abs(driftMs);

  if (gap <= LOCK) { setRate(video, 1); return 'locked'; }

  if (gap <= COARSE) {
    const span  = gap <= FINE ? 0.02 : 0.05;
    // close the gap over ~4 s rather than instantly: gentler and self-damping
    const nudge = Math.min(span, gap / 4000);
    setRate(video, driftMs < 0 ? 1 + nudge : 1 - nudge);
    return 'nudging';
  }

  if (gap <= REARM) { seekAtSegmentBoundary(video, authoritative()); return 'seeking'; }

  return rearm(video);   // pause, seek, refill, report ready, rejoin start handshake
}

// setRate never touches room state: the room's rate stays 1.0 and only this
// device's decoder runs marginally fast or slow. Audio uses the browser's
// pitch-preserving resampler, so ±5% is inaudible on dialogue.

host   → play_requested { seq }
server : verify role, room state, and that every participant reported ready
server : startAt = now() + max(400 ms, 2 x worst_observed_rtt/2)
server → playback_started { anchorPositionMs, anchorServerMs: startAt, rate: 1, seq }

client : targetLocal = startAt - clockOffset      // convert to local time
client : video.currentTime = anchorPositionMs / 1000
client : wait until performance.now() >= targetLocal - 20 ms, then play()
client : if the deadline is already past, play() immediately and let the
         drift controller absorb the remainder — never delay the film to be tidy

pause_requested   : allowed for host and guest (this is 'pause for both').
                    Server anchors the position, broadcasts playback_paused,
                    and the room shows who paused it.

seek_requested    : host only, unless room.shared_control = true.
                    Server clamps the target to [0, duration], bumps seq,
                    sets state = 'armed', and broadcasts seek_committed.
                    Both clients seek, refill, report ready; the server then
                    re-runs the start-together handshake automatically if the
                    room was playing before the seek.

rate_changed      : host only. Applies to room.rate; the drift controller's own
                    nudges are layered on top of it per device.

track_changed     : subtitle and audio selection are room state, so both clients
                    switch at once. Subtitle changes never re-arm playback;
                    audio track changes do, because they reset the media element.