make quick connect authorize atomic and stop the fallback shadowing redis

share quick connect state between instances
Move the pending requests and authorized secrets out of process so the initiate, authorize and exchange legs can land on different replicas.
2026-09-24 23:38:35 +10:00 · 2026-09-24 23:02:56 +10:00 · 2026-09-21 23:13:37 +10:00 · 2026-09-21 21:44:34 +10:00 · 2026-09-21 07:45:29 +10:00 · 2026-09-21 07:42:33 +10:00
174 changed files with 23050 additions and 1475 deletions
@@ -1,44 +0,0 @@
-name: "CodeQL"
-
-on:
-  push:
-    branches: [ master ]
-  pull_request:
-    branches: [ master ]
-  schedule:
-    - cron: '24 2 * * 4'
-
-permissions:
-  contents: read
-  security-events: write
-
-jobs:
-  analyze:
-    name: Analyze
-    runs-on: ubuntu-latest
-
-    strategy:
-      fail-fast: false
-      matrix:
-        language: [ 'csharp' ]
-
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-    - name: Setup .NET
-      uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
-      with:
-        dotnet-version: '10.0.x'
-
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
-      with:
-        languages: ${{ matrix.language }}
-        queries: +security-extended
-
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
@@ -1,159 +0,0 @@
-name: ABI Compatibility
-on:
-  pull_request:
-
-permissions: {}
-
-jobs:
-  abi-head:
-    name: ABI - HEAD
-    runs-on: ubuntu-latest
-    permissions: read-all
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          repository: ${{ github.event.pull_request.head.repo.full_name }}
-
-      - name: Setup .NET
-        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
-        with:
-          dotnet-version: '10.0.x'
-
-      - name: Build
-        run: |
-          dotnet build Jellyfin.Server -o ./out
-
-      - name: Upload Head
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: abi-head
-          retention-days: 14
-          if-no-files-found: error
-          path: out/
-
-  abi-base:
-    name: ABI - BASE
-    if: ${{ github.base_ref != '' }}
-    runs-on: ubuntu-latest
-    permissions: read-all
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          repository: ${{ github.event.pull_request.head.repo.full_name }}
-          fetch-depth: 0
-
-      - name: Setup .NET
-        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
-        with:
-          dotnet-version: '10.0.x'
-
-      - name: Checkout common ancestor
-        env:
-          HEAD_REF: ${{ github.head_ref }}
-        run: |
-          git remote add upstream https://github.com/${{ github.event.pull_request.base.repo.full_name }}
-          git -c protocol.version=2 fetch --prune --progress --no-recurse-submodules upstream +refs/heads/*:refs/remotes/upstream/* +refs/tags/*:refs/tags/*
-          ANCESTOR_REF=$(git merge-base upstream/${{ github.base_ref }} origin/$HEAD_REF)
-          git checkout --progress --force $ANCESTOR_REF
-
-      - name: Build
-        run: |
-          dotnet build Jellyfin.Server -o ./out
-
-      - name: Upload Head
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: abi-base
-          retention-days: 14
-          if-no-files-found: error
-          path: out/
-
-  abi-diff:
-    permissions:
-      pull-requests: write  #  to create or update comment (peter-evans/create-or-update-comment)
-
-    name: ABI - Difference
-    if: ${{ github.event_name == 'pull_request' }}
-    runs-on: ubuntu-latest
-    needs:
-      - abi-head
-      - abi-base
-
-    steps:
-      - name: Download abi-head
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: abi-head
-          path: abi-head
-
-      - name: Download abi-base
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: abi-base
-          path: abi-base
-
-      - name: Setup ApiCompat
-        run: |
-          dotnet tool install --global Microsoft.DotNet.ApiCompat.Tool
-
-      - name: Run ApiCompat
-        id: diff
-        run: |
-          {
-            echo 'body<<EOF'
-            for file in Jellyfin.Data.dll MediaBrowser.Common.dll MediaBrowser.Controller.dll MediaBrowser.Model.dll Emby.Naming.dll Jellyfin.Extensions.dll Jellyfin.MediaEncoding.Keyframes.dll Jellyfin.Database.Implementations.dll; do
-              COMPAT_OUTPUT="$( { apicompat --left ./abi-base/${file} --right ./abi-head/${file}; } 2>&1 || true )"
-              if [ "APICompat ran successfully without finding any breaking changes." != "${COMPAT_OUTPUT}" ]; then
-                printf "\n${file}\n${COMPAT_OUTPUT}\n"
-              fi
-            done
-            echo EOF
-          } >> $GITHUB_OUTPUT
-
-      - name: Find difference comment
-        uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4.0.0
-        id: find-comment
-        with:
-          issue-number: ${{ github.event.pull_request.number }}
-          direction: last
-          body-includes: abi-diff-workflow-comment
-
-      - name: Reply or edit difference comment (changed)
-        uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
-        if: ${{ steps.diff.outputs.body != '' }}
-        with:
-          issue-number: ${{ github.event.pull_request.number }}
-          comment-id: ${{ steps.find-comment.outputs.comment-id }}
-          edit-mode: replace
-          token: ${{ secrets.JF_BOT_TOKEN }}
-          body: |
-            <!--abi-diff-workflow-comment-->
-            <details>
-            <summary>ABI Difference</summary>
-
-            ```
-            ${{ steps.diff.outputs.body }}
-            ```
-
-            </details>
-
-      - name: Reply or edit difference comment (unchanged)
-        uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
-        if: ${{ steps.diff.outputs.body == '' && steps.find-comment.outputs.comment-id != '' }}
-        with:
-          issue-number: ${{ github.event.pull_request.number }}
-          comment-id: ${{ steps.find-comment.outputs.comment-id }}
-          edit-mode: replace
-          token: ${{ secrets.JF_BOT_TOKEN }}
-          body: |
-            <!--abi-diff-workflow-comment-->
-            <details>
-            <summary>ABI Difference</summary>
-
-            No changes to the ABI found. See history of this comment for previous changes.
-
-            </details>
@@ -1,25 +0,0 @@
-name: Format
-on:
-  push:
-    branches:
-      - master
-  # Run formatter against the forked branch, but
-  # do not allow access to secrets
-  # https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#workflows-in-forked-repositories
-  pull_request:
-
-env:
-  SDK_VERSION: "10.0.x"
-
-jobs:
-  format-check:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
-        with:
-          dotnet-version: ${{ env.SDK_VERSION }}
-
-      - name: Run DotNet Format
-        run: dotnet format --verify-no-changes --verbosity minimal
@@ -1,45 +0,0 @@
-name: Tests
-on:
-  push:
-    branches:
-      - master
-  # Run tests against the forked branch, but
-  # do not allow access to secrets
-  # https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#workflows-in-forked-repositories
-  pull_request:
-
-env:
-  SDK_VERSION: "10.0.x"
-
-jobs:
-  run-tests:
-    strategy:
-      matrix:
-        os: ["ubuntu-latest", "macos-latest", "windows-latest"]
-      fail-fast: false
-
-    runs-on: "${{ matrix.os }}"
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
-        with:
-          dotnet-version: ${{ env.SDK_VERSION }}
-
-      - name: Run DotNet CLI Tests
-        run: >
-          dotnet test Jellyfin.sln
-          --configuration Release
-          --collect:"XPlat Code Coverage"
-          --settings tests/coverletArgs.runsettings
-          --verbosity minimal
-
-      - name: Merge code coverage results
-        uses: danielpalme/ReportGenerator-GitHub-Action@d3ebf1f760f7d8ab92cc44d9bcfee7ad73722a31 # v5.5.11
-        with:
-          reports: "**/coverage.cobertura.xml"
-          targetdir: "merged/"
-          reporttypes: "Cobertura"
-
-      # TODO - which action / tool to use to publish code coverage results?
-      # - name: Publish code coverage results
@@ -1,63 +0,0 @@
-name: Commands
-on:
-  issue_comment:
-    types:
-      - created
-      - edited
-  pull_request:
-    types:
-      - labeled
-      - synchronize
-
-permissions: {}
-jobs:
-  rebase:
-    name: Rebase
-    if: github.event.issue.pull_request != '' && contains(github.event.comment.body, '@jellyfin-bot rebase') && github.event.comment.author_association == 'MEMBER'
-    runs-on: ubuntu-latest
-    steps:
-      - name: Notify as seen
-        uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
-        with:
-          token: ${{ secrets.JF_BOT_TOKEN }}
-          comment-id: ${{ github.event.comment.id }}
-          reactions: '+1'
-
-      - name: Checkout the latest code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          token: ${{ secrets.JF_BOT_TOKEN }}
-          fetch-depth: 0
-
-      - name: Automatic Rebase
-        uses: cirrus-actions/rebase@b87d48154a87a85666003575337e27b8cd65f691 # 1.8
-        env:
-          GITHUB_TOKEN: ${{ secrets.JF_BOT_TOKEN }}
-
-  rename:
-    name: Rename
-    if: contains(github.event.comment.body, '@jellyfin-bot rename')
-    runs-on: ubuntu-latest
-    steps:
-      - name: pull in script
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          repository: jellyfin/jellyfin-triage-script
-
-      - name: install python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: '3.14'
-          cache: 'pip'
-
-      - name: install python packages
-        run: pip install -r rename/requirements.txt
-
-      - name: run rename script
-        run: python3 rename.py
-        working-directory: ./rename
-        env:
-          GH_TOKEN: ${{ secrets.JF_BOT_TOKEN }}
-          GH_REPO: ${{ github.repository }}
-          ISSUE: ${{ github.event.issue.number }}
-          COMMENT_ID: ${{ github.event.comment.id }}
@@ -1,35 +0,0 @@
-name: Stale Issue Labeler
-
-on:
-  schedule:
-    - cron: '30 1 * * *'
-  workflow_dispatch:
-
-permissions:
-  issues: write
-  pull-requests: write
-  actions: write
-
-jobs:
-  issues:
-    name: Check for stale issues
-    runs-on: ubuntu-latest
-    if: ${{ contains(github.repository, 'jellyfin/') }}
-    steps:
-      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
-        with:
-          repo-token: ${{ secrets.JF_BOT_TOKEN }}
-          ascending: true
-          days-before-stale: 120
-          days-before-pr-stale: -1
-          days-before-close: 21
-          days-before-pr-close: -1
-          operations-per-run: 500
-          exempt-issue-labels: regression,security,roadmap,future,feature,enhancement,confirmed
-          stale-issue-label: stale
-          stale-issue-message: |-
-            This issue has gone 120 days without an update and will be closed within 21 days if there is no new activity. To prevent this issue from being closed, please confirm the issue has not already been fixed by providing updated examples or logs.
-
-            If you have any questions you can use one of several ways to [contact us](https://jellyfin.org/contact).
-          close-issue-message: |-
-            This issue was closed due to inactivity.
@@ -1,32 +0,0 @@
-name: Check Issue Template
-on:
-  issues:
-    types:
-      - opened
-jobs:
-  check_issue:
-    runs-on: ubuntu-latest
-    permissions:
-      issues: write
-    steps:
-      - name: pull in script
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          repository: jellyfin/jellyfin-triage-script
-
-      - name: install python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: '3.14'
-          cache: 'pip'
-
-      - name: install python packages
-        run: pip install -r main-repo-triage/requirements.txt
-
-      - name: check and comment issue
-        working-directory: ./main-repo-triage
-        run: python3 single_issue_gha.py
-        env:
-          GH_TOKEN: ${{ secrets.JF_BOT_TOKEN }}
-          GH_REPO: ${{ github.repository }}
-          ISSUE: ${{ github.event.issue.number }}
@@ -1,44 +0,0 @@
-name: OpenAPI Generate
-
-on:
-  workflow_call:
-    inputs:
-      ref:
-        required: true
-        type: string
-      repository:
-        required: true
-        type: string
-      artifact:
-        required: true
-        type: string
-
-permissions:
-  contents: read
-
-jobs:
-  main:
-    name: Main
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout Repository
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      with:
-        ref: ${{ inputs.ref }}
-        repository: ${{ inputs.repository }}
-
-    - name: Configure .NET
-      uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
-      with:
-        dotnet-version: '10.0.x'
-
-    - name: Create File
-      run: dotnet test tests/Jellyfin.Server.Integration.Tests/Jellyfin.Server.Integration.Tests.csproj -c Release --filter Jellyfin.Server.Integration.Tests.OpenApiSpecTests
-
-    - name: Upload Artifact
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-      with:
-        name: ${{ inputs.artifact }}
-        path: tests/Jellyfin.Server.Integration.Tests/bin/Release/net10.0/openapi.json
-        retention-days: 14
-        if-no-files-found: error
@@ -1,140 +0,0 @@
-name: OpenAPI Publish
-on:
-  push:
-    branches:
-      - master
-    tags:
-      - 'v*'
-
-jobs:
-  publish-openapi:
-    name: OpenAPI - Publish Artifact
-    uses: ./.github/workflows/openapi-generate.yml
-    permissions:
-      contents: read
-    with:
-      ref: ${{ github.sha }}
-      repository: ${{ github.repository }}
-      artifact: openapi-head
-
-  publish-unstable:
-    name: OpenAPI - Publish Unstable Spec
-    if: ${{ github.event_name != 'pull_request' && !startsWith(github.ref, 'refs/tags/v') && contains(github.repository_owner, 'jellyfin') }}
-    runs-on: ubuntu-latest
-    needs:
-    - publish-openapi
-    steps:
-      - name: Set unstable dated version
-        id: version
-        run: |-
-          echo "JELLYFIN_VERSION=$(date +'%Y%m%d%H%M%S')" >> $GITHUB_ENV
-      - name: Download openapi-head
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: openapi-head
-          path: openapi-head
-      - name: Upload openapi.json (unstable) to repository server
-        uses: appleboy/scp-action@ff85246acaad7bdce478db94a363cd2bf7c90345 # v1.0.0
-        with:
-          host: "${{ secrets.REPO_HOST }}"
-          username: "${{ secrets.REPO_USER }}"
-          key: "${{ secrets.REPO_KEY }}"
-          source: openapi-head/openapi.json
-          strip_components: 1
-          target: "/srv/incoming/openapi/unstable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}"
-      - name: Move openapi.json (unstable) into place
-        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
-        with:
-          host: "${{ secrets.REPO_HOST }}"
-          username: "${{ secrets.REPO_USER }}"
-          key: "${{ secrets.REPO_KEY }}"
-          debug: false
-          script: |
-            if ! test -d /run/workflows; then
-                sudo mkdir -p /run/workflows
-                sudo chown ${{ secrets.REPO_USER }} /run/workflows
-            fi
-            (
-            flock -x -w 300 200 || exit 1
-            TGT_DIR="/srv/repository/main/openapi"
-            LAST_SPEC="$( ls -lt ${TGT_DIR}/unstable/ | grep 'jellyfin-openapi' | head -1 | awk '{ print $NF }' )"
-            # If new and previous spec don't differ (diff retcode 0), remove incoming and finish
-            if diff /srv/incoming/openapi/unstable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}/openapi.json ${TGT_DIR}/unstable/${LAST_SPEC} &>/dev/null; then
-                rm -r /srv/incoming/openapi/unstable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}
-                exit 0
-            fi
-            # Move new spec into place
-            sudo mv /srv/incoming/openapi/unstable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}/openapi.json ${TGT_DIR}/unstable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}.json
-            # Delete previous jellyfin-openapi-unstable_previous.json
-            sudo rm ${TGT_DIR}/jellyfin-openapi-unstable_previous.json
-            # Move current jellyfin-openapi-unstable.json symlink to jellyfin-openapi-unstable_previous.json
-            sudo mv ${TGT_DIR}/jellyfin-openapi-unstable.json ${TGT_DIR}/jellyfin-openapi-unstable_previous.json
-            # Create new jellyfin-openapi-unstable.json symlink
-            sudo ln -s unstable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}.json ${TGT_DIR}/jellyfin-openapi-unstable.json
-            # Check that the previous openapi unstable spec link is correct
-            if [[ "$( readlink ${TGT_DIR}/jellyfin-openapi-unstable_previous.json )" != "unstable/${LAST_SPEC}" ]]; then
-                sudo rm ${TGT_DIR}/jellyfin-openapi-unstable_previous.json
-                sudo ln -s unstable/${LAST_SPEC} ${TGT_DIR}/jellyfin-openapi-unstable_previous.json
-            fi
-            ) 200>/run/workflows/openapi-unstable.lock
-
-  publish-stable:
-    name: OpenAPI - Publish Stable Spec
-    if: ${{ startsWith(github.ref, 'refs/tags/v') && contains(github.repository_owner, 'jellyfin') }}
-    runs-on: ubuntu-latest
-    needs:
-    - publish-openapi
-    steps:
-      - name: Set version number
-        id: version
-        run: |-
-          echo "JELLYFIN_VERSION=${GITHUB_REF#refs/tags/v}" >> $GITHUB_ENV
-      - name: Download openapi-head
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: openapi-head
-          path: openapi-head
-      - name: Upload openapi.json (stable) to repository server
-        uses: appleboy/scp-action@ff85246acaad7bdce478db94a363cd2bf7c90345 # v1.0.0
-        with:
-          host: "${{ secrets.REPO_HOST }}"
-          username: "${{ secrets.REPO_USER }}"
-          key: "${{ secrets.REPO_KEY }}"
-          source: openapi-head/openapi.json
-          strip_components: 1
-          target: "/srv/incoming/openapi/stable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}"
-      - name: Move openapi.json (stable) into place
-        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
-        with:
-          host: "${{ secrets.REPO_HOST }}"
-          username: "${{ secrets.REPO_USER }}"
-          key: "${{ secrets.REPO_KEY }}"
-          debug: false
-          script: |
-            if ! test -d /run/workflows; then
-                sudo mkdir -p /run/workflows
-                sudo chown ${{ secrets.REPO_USER }} /run/workflows
-            fi
-            (
-            flock -x -w 300 200 || exit 1
-            TGT_DIR="/srv/repository/main/openapi"
-            LAST_SPEC="$( ls -lt ${TGT_DIR}/stable/ | grep 'jellyfin-openapi' | head -1 | awk '{ print $NF }' )"
-            # If new and previous spec don't differ (diff retcode 0), remove incoming and finish
-            if diff /srv/incoming/openapi/stable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}/openapi.json ${TGT_DIR}/stable/${LAST_SPEC} &>/dev/null; then
-                rm -r /srv/incoming/openapi/stable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}
-                exit 0
-            fi
-            # Move new spec into place
-            sudo mv /srv/incoming/openapi/stable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}/openapi.json ${TGT_DIR}/stable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}.json
-            # Delete previous jellyfin-openapi-stable_previous.json
-            sudo rm ${TGT_DIR}/jellyfin-openapi-stable_previous.json
-            # Move current jellyfin-openapi-stable.json symlink to jellyfin-openapi-stable_previous.json
-            sudo mv ${TGT_DIR}/jellyfin-openapi-stable.json ${TGT_DIR}/jellyfin-openapi-stable_previous.json
-            # Create new jellyfin-openapi-stable.json symlink
-            sudo ln -s stable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}.json ${TGT_DIR}/jellyfin-openapi-stable.json
-            # Check that the previous openapi stable spec link is correct
-            if [[ "$( readlink ${TGT_DIR}/jellyfin-openapi-stable_previous.json )" != "stable/${LAST_SPEC}" ]]; then
-                sudo rm ${TGT_DIR}/jellyfin-openapi-stable_previous.json
-                sudo ln -s stable/${LAST_SPEC} ${TGT_DIR}/jellyfin-openapi-stable_previous.json
-            fi
-            ) 200>/run/workflows/openapi-stable.lock
@@ -1,80 +0,0 @@
-name: OpenAPI Check
-on:
-  pull_request:
-
-jobs:
-  ancestor:
-    name: Common Ancestor
-    runs-on: ubuntu-latest
-    outputs:
-      base_ref: ${{ steps.ancestor.outputs.base_ref }}
-    steps:
-    - name: Checkout Repository
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      with:
-        ref: ${{ github.event.pull_request.head.sha }}
-        repository: ${{ github.event.pull_request.head.repo.full_name }}
-        fetch-depth: 0
-    - name: Search History
-      id: ancestor
-      run: |
-        git remote add upstream https://github.com/${{ github.event.pull_request.base.repo.full_name }}
-        git fetch --prune --progress --no-recurse-submodules upstream +refs/heads/*:refs/remotes/upstream/* +refs/tags/*:refs/tags/*
-
-        ANCESTOR_REF=$(git merge-base upstream/${{ github.base_ref }} HEAD)
-
-        echo "ref: ${ANCESTOR_REF}"
-
-        echo "base_ref=${ANCESTOR_REF}" >> "$GITHUB_OUTPUT"
-
-  head:
-    name: Head Artifact
-    uses: ./.github/workflows/openapi-generate.yml
-    with:
-      ref: ${{ github.event.pull_request.head.sha }}
-      repository: ${{ github.event.pull_request.head.repo.full_name }}
-      artifact: openapi-head
-
-  base:
-    name: Base Artifact
-    uses: ./.github/workflows/openapi-generate.yml
-    needs:
-    - ancestor
-    with:
-      ref: ${{ needs.ancestor.outputs.base_ref }}
-      repository: ${{ github.event.pull_request.base.repo.full_name }}
-      artifact: openapi-base
-
-  diff:
-    name: Generate Report
-    runs-on: ubuntu-latest
-    needs:
-    - head
-    - base
-    steps:
-    - name: Download Head
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-      with:
-        name: openapi-head
-        path: openapi-head
-    - name: Download Base
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-      with:
-        name: openapi-base
-        path: openapi-base
-    - name: Detect Changes
-      id: openapi-diff
-      run: |
-        sed -i 's:allOf:oneOf:g' openapi-head/openapi.json
-        sed -i 's:allOf:oneOf:g' openapi-base/openapi.json
-
-        mkdir -p /tmp/openapi-report
-        mv openapi-head/openapi.json /tmp/openapi-report/head.json
-        mv openapi-base/openapi.json /tmp/openapi-report/base.json
-
-        docker run -v /tmp/openapi-report:/data openapitools/openapi-diff:2.1.6 /data/base.json /data/head.json --state -l ERROR --markdown /data/openapi-report.md
-    - name: Upload Artifact
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-      with:
-        name: openapi-report
-        path: /tmp/openapi-report/openapi-report.md
@@ -1,59 +0,0 @@
-name: OpenAPI Report
-
-on:
-  workflow_run:
-    workflows:
-    - OpenAPI Check
-    types:
-    - completed
-
-jobs:
-  metadata:
-    name: Generate Metadata
-    runs-on: ubuntu-latest
-    if: ${{ github.event.workflow_run.conclusion == 'success' }}
-    outputs:
-      pr_number: ${{ steps.pr_number.outputs.pr_number }}
-    steps:
-    - name: Get Pull Request Number
-      id: pr_number
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
-      run: |
-        API_RESPONSE=$(gh pr list --repo "${GITHUB_REPOSITORY}" --search "${HEAD_SHA}" --state open --json number)
-        PR_NUMBER=$(echo "${API_RESPONSE}" | jq '.[0].number')
-
-        echo "repository: ${GITHUB_REPOSITORY}"
-        echo "sha: ${HEAD_SHA}"
-        echo "response: ${API_RESPONSE}"
-        echo "pr: ${PR_NUMBER}"
-
-        echo "pr_number=${PR_NUMBER}" >> "${GITHUB_OUTPUT}"
-
-  comment:
-    name: Pull Request Comment
-    runs-on: ubuntu-latest
-    if: ${{ github.event.workflow_run.conclusion == 'success' }}
-    needs:
-    - metadata
-    permissions:
-      pull-requests: write
-      actions: read
-      contents: read
-    steps:
-    - name: Download OpenAPI Report
-      id: download_report
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-      with:
-        name: openapi-report
-        path: openapi-report
-        run-id: ${{ github.event.workflow_run.id }}
-        github-token: ${{ secrets.GITHUB_TOKEN }}
-    - name: Push Comment
-      uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
-      with:
-        github-token: ${{ secrets.JF_BOT_TOKEN }}
-        file-path: ${{ steps.download_report.outputs.download-path }}/openapi-report.md
-        pr-number: ${{ needs.metadata.outputs.pr_number }}
-        comment-tag: openapi-report
@@ -1,66 +0,0 @@
-name: Project Automation
-
-on:
-  push:
-    branches:
-      - master
-  pull_request:
-  issue_comment:
-
-permissions: {}
-jobs:
-  project:
-    name: Project board
-    runs-on: ubuntu-latest
-    if: ${{ github.repository == 'jellyfin/jellyfin' }}
-    steps:
-      - name: Remove from 'Current Release' project
-        uses: alex-page/github-project-automation-plus@303f24a24c67ce7adf565a07e96720faf126fe36 # v0.9.0
-        if: (github.event.pull_request || github.event.issue.pull_request) && !contains(github.event.*.labels.*.name, 'stable backport')
-        continue-on-error: true
-        with:
-          project: Current Release
-          action: delete
-          column: In progress
-          repo-token: ${{ secrets.JF_BOT_TOKEN }}
-
-      - name: Add to 'Release Next' project
-        uses: alex-page/github-project-automation-plus@303f24a24c67ce7adf565a07e96720faf126fe36 # v0.9.0
-        if: (github.event.pull_request || github.event.issue.pull_request) && github.event.action == 'opened'
-        continue-on-error: true
-        with:
-          project: Release Next
-          column: In progress
-          repo-token: ${{ secrets.JF_BOT_TOKEN }}
-
-      - name: Add to 'Current Release' project
-        uses: alex-page/github-project-automation-plus@303f24a24c67ce7adf565a07e96720faf126fe36 # v0.9.0
-        if: (github.event.pull_request || github.event.issue.pull_request) && !contains(github.event.*.labels.*.name, 'stable backport')
-        continue-on-error: true
-        with:
-          project: Current Release
-          column: In progress
-          repo-token: ${{ secrets.JF_BOT_TOKEN }}
-
-      - name: Check number of comments from the team member
-        if: github.event.issue.pull_request == '' && github.event.comment.author_association == 'MEMBER'
-        id: member_comments
-        run: echo "::set-output name=number::$(curl -s ${{ github.event.issue.comments_url }} | jq '.[] | select(.author_association == "MEMBER") | .author_association' | wc -l)"
-
-      - name: Move issue to needs triage
-        uses: alex-page/github-project-automation-plus@303f24a24c67ce7adf565a07e96720faf126fe36 # v0.9.0
-        if: github.event.issue.pull_request == '' && github.event.comment.author_association == 'MEMBER' && steps.member_comments.outputs.number <= 1
-        continue-on-error: true
-        with:
-          project: Issue Triage for Main Repo
-          column: Needs triage
-          repo-token: ${{ secrets.JF_BOT_TOKEN }}
-
-      - name: Add issue to triage project
-        uses: alex-page/github-project-automation-plus@303f24a24c67ce7adf565a07e96720faf126fe36 # v0.9.0
-        if: github.event.issue.pull_request == '' && github.event.action == 'opened'
-        continue-on-error: true
-        with:
-          project: Issue Triage for Main Repo
-          column: Pending response
-          repo-token: ${{ secrets.JF_BOT_TOKEN }}
@@ -1,24 +0,0 @@
-name: Merge Conflict Labeler
-
-on:
-  push:
-    branches:
-      - master
-  pull_request_target:
-    types: [synchronize]
-
-permissions: {}
-jobs:
-  main:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write
-    if: ${{ github.repository == 'jellyfin/jellyfin' }}
-    steps:
-      - name: Apply label
-        uses: eps1lon/actions-label-merge-conflict@0273be72a0bbd58fcd71d0d6c02c209b50d1e5e1 # v3.1.0
-        with:
-          dirtyLabel: 'merge conflict'
-          commentOnDirty: 'This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged.'
-          repoToken: ${{ secrets.JF_BOT_TOKEN }}
@@ -1,30 +0,0 @@
-name: Stale PR Check
-
-on:
-  schedule:
-    - cron: '30 */12 * * *'
-  workflow_dispatch:
-
-permissions:
-  pull-requests: write
-  actions: write
-
-jobs:
-  prs-stale-conflicts:
-    name: Check PRs with merge conflicts
-    runs-on: ubuntu-latest
-    if: ${{ contains(github.repository, 'jellyfin/') }}
-    steps:
-      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
-        with:
-          repo-token: ${{ secrets.JF_BOT_TOKEN }}
-          ascending: true
-          operations-per-run: 150
-          # The merge conflict action will remove the label when updated
-          remove-stale-when-updated: false
-          days-before-stale: -1
-          days-before-close: 90
-          days-before-issue-close: -1
-          stale-pr-label: merge conflict
-          close-pr-message: |-
-            This PR has been closed due to having unresolved merge conflicts.
@@ -1,82 +0,0 @@
-name: '🆙 Auto bump_version'
-
-on:
-  release:
-    types:
-      - published
-  workflow_dispatch:
-    inputs:
-      TAG_BRANCH:
-        required: true
-        description: release-x.y.z
-      NEXT_VERSION:
-        required: true
-        description: x.y.z
-
-jobs:
-  auto_bump_version:
-    runs-on: ubuntu-latest
-    if: ${{ github.event_name == 'release' && !contains(github.event.release.tag_name, 'rc') }}
-    env:
-      TAG_BRANCH: ${{ github.event.release.target_commitish }}
-    steps:
-      - name: Wait for deploy checks to finish
-        uses: jitterbit/await-check-suites@292a541bb7618078395b2ce711a0d89cfb8a568a # v1
-        with:
-          ref: ${{ env.TAG_BRANCH }}
-          intervalSeconds: 60
-          timeoutSeconds: 3600
-
-      - name: Setup YQ
-        uses: chrisdickinson/setup-yq@fa3192edd79d6eb0e4e12de8dde3a0c26f2b853b # latest
-        with:
-          yq-version: v4.9.8
-
-      - name: Checkout Repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ env.TAG_BRANCH }}
-
-      - name: Setup EnvVars
-        run: |-
-          CURRENT_VERSION=$(yq e '.version' build.yaml)
-          CURRENT_MAJOR_MINOR=${CURRENT_VERSION%.*}
-          CURRENT_PATCH=${CURRENT_VERSION##*.}
-          echo "CURRENT_VERSION=${CURRENT_VERSION}" >> $GITHUB_ENV
-          echo "CURRENT_MAJOR_MINOR=${CURRENT_MAJOR_MINOR}" >> $GITHUB_ENV
-          echo "CURRENT_PATCH=${CURRENT_PATCH}" >> $GITHUB_ENV
-          echo "NEXT_VERSION=${CURRENT_MAJOR_MINOR}.$(($CURRENT_PATCH + 1))" >> $GITHUB_ENV
-
-      - name: Run bump_version
-        run: ./bump_version ${{ env.NEXT_VERSION }}
-
-      - name: Commit Changes
-        run: |-
-          git config user.name "jellyfin-bot"
-          git config user.email "team@jellyfin.org"
-          git checkout ${{ env.TAG_BRANCH }}
-          git commit -am "Bump version to ${{ env.NEXT_VERSION }}"
-          git push origin ${{ env.TAG_BRANCH }}
-
-  manual_bump_version:
-    runs-on: ubuntu-latest
-    if: ${{ github.event_name == 'workflow_dispatch' }}
-    env:
-      TAG_BRANCH: ${{ github.event.inputs.TAG_BRANCH }}
-      NEXT_VERSION: ${{ github.event.inputs.NEXT_VERSION }}
-    steps:
-      - name: Checkout Repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ env.TAG_BRANCH }}
-
-      - name: Run bump_version
-        run: ./bump_version ${{ env.NEXT_VERSION }}
-
-      - name: Commit Changes
-        run: |-
-          git config user.name "jellyfin-bot"
-          git config user.email "team@jellyfin.org"
-          git checkout ${{ env.TAG_BRANCH }}
-          git commit -am "Bump version to ${{ env.NEXT_VERSION }}"
-          git push origin ${{ env.TAG_BRANCH }}
@@ -0,0 +1,84 @@
+when:
+  - event: pull_request
+  - event: push
+
+steps:
+  # Restore, build and test in one step so the NuGet cache stays on the step's
+  # own ephemeral storage instead of the 10Gi workspace volume.
+  # global.json pins the .NET 10 SDK (10.0.0, rollForward latestMinor).
+  - name: build-test
+    image: mcr.microsoft.com/dotnet/sdk:10.0
+    environment:
+      DOTNET_CLI_TELEMETRY_OPTOUT: "1"
+      DOTNET_NOLOGO: "1"
+    commands:
+      - dotnet --info
+      - dotnet restore Jellyfin.sln
+      - dotnet build Jellyfin.sln -c Release --no-restore
+      # libSkiaSharp needs fontconfig to load and the SDK image does not ship it.
+      # The mirror occasionally serves a half-synced index, so update is retried.
+      - apt-get -o Acquire::Retries=3 update || apt-get -o Acquire::Retries=3 update
+      - apt-get install -y --no-install-recommends libfontconfig1
+      - ldconfig -p | grep -q libfontconfig
+      # BackupServiceTests is excluded because BackupService refuses to write a
+      # backup with less than 5GiB free on its target path. The clone and build
+      # output fill 5.7G of the 9.8G workspace volume, leaving 4.1G. Raising the
+      # agent's workspace volume size is the only way to run it here.
+      - df -h .
+      - dotnet test Jellyfin.sln -c Release --no-build --verbosity minimal --filter "Category!=RequiresDocker&FullyQualifiedName!~Integration&FullyQualifiedName!~BackupServiceTests"
+    backend_options:
+      kubernetes:
+        serviceAccountName: jellyfin-ha-src
+        resources:
+          requests:
+            memory: 2Gi
+            cpu: 2
+            ephemeral-storage: 10Gi
+          limits:
+            memory: 8Gi
+            cpu: 4
+            ephemeral-storage: 20Gi
+
+  # The PostgreSQL migration tests are the only ones that run the startup migration chain against
+  # the provider production uses, and the filter above has always skipped them.
+  # The server runs inside this step: the kubernetes backend has no docker daemon for
+  # testcontainers, and a postgres service container deadlocks the step because the backend mounts
+  # the ReadWriteOnce workspace volume into service pods and schedules them on another node.
+  # Its data directory lives on the step's ephemeral storage, not on the workspace volume.
+  # Both projects attach to it through JELLYFIN_TEST_POSTGRES and give every test a database of
+  # its own, so nothing here depends on a docker daemon.
+  # Valkey runs in the step for the same reason, attached through JELLYFIN_TEST_REDIS.
+  - name: postgres-migration-chain
+    image: mcr.microsoft.com/dotnet/sdk:10.0
+    depends_on:
+      - build-test
+    environment:
+      DOTNET_CLI_TELEMETRY_OPTOUT: "1"
+      DOTNET_NOLOGO: "1"
+      JELLYFIN_TEST_POSTGRES: "Host=127.0.0.1;Port=5432;Database=postgres;Username=postgres"
+      JELLYFIN_TEST_REDIS: "127.0.0.1:6379"
+    commands:
+      - apt-get -o Acquire::Retries=3 update || apt-get -o Acquire::Retries=3 update
+      - DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends postgresql valkey-server
+      - install -d -o postgres -g postgres /tmp/pgdata /tmp/pgrun
+      - PGBIN=$(ls -d /usr/lib/postgresql/*/bin | tail -1)
+      - su postgres -c "$PGBIN/initdb -D /tmp/pgdata -A trust -U postgres"
+      - su postgres -c "$PGBIN/pg_ctl -D /tmp/pgdata -o \"-c listen_addresses=127.0.0.1 -k /tmp/pgrun\" -l /tmp/pg.log -w start"
+      - valkey-server --daemonize yes --bind 127.0.0.1 --port 6379 --save ''
+      - valkey-cli ping
+      - dotnet build tests/Jellyfin.Server.Tests/Jellyfin.Server.Tests.csproj -c Release
+      - dotnet build tests/Jellyfin.Database.Tests.PostgreSQL/Jellyfin.Database.Tests.PostgreSQL.csproj -c Release
+      - dotnet test tests/Jellyfin.Server.Tests/Jellyfin.Server.Tests.csproj -c Release --no-build --verbosity minimal --filter "Category=RequiresDocker"
+      - dotnet test tests/Jellyfin.Database.Tests.PostgreSQL/Jellyfin.Database.Tests.PostgreSQL.csproj -c Release --no-build --verbosity minimal --filter "Category=RequiresDocker"
+    backend_options:
+      kubernetes:
+        serviceAccountName: jellyfin-ha-src
+        resources:
+          requests:
+            memory: 2Gi
+            cpu: 2
+            ephemeral-storage: 6Gi
+          limits:
+            memory: 6Gi
+            cpu: 4
+            ephemeral-storage: 12Gi
@@ -8,6 +8,7 @@
    <PackageVersion Include="AutoFixture.AutoMoq" Version="4.18.1" />
    <PackageVersion Include="AutoFixture.Xunit3" Version="4.19.0" />
    <PackageVersion Include="AutoFixture" Version="4.18.1" />
+    <PackageVersion Include="AWSSDK.S3" Version="4.0.103.1" />
    <PackageVersion Include="BDInfo" Version="0.8.0" />
    <PackageVersion Include="BitFaster.Caching" Version="2.6.1" />
    <PackageVersion Include="BlurHashSharp.SkiaSharp" Version="1.4.0-pre.1" />
@@ -46,6 +47,7 @@
    <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.11" />
    <PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.11" />
    <PackageVersion Include="Microsoft.Extensions.Logging" Version="10.0.11" />
+    <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.11" />
    <PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.11" />
    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.9.0" />
    <PackageVersion Include="MimeTypes" Version="2.5.2" />
@@ -53,6 +55,8 @@
    <PackageVersion Include="Moq" Version="4.18.4" />
    <PackageVersion Include="NEbml" Version="1.1.0.5" />
    <PackageVersion Include="Newtonsoft.Json" Version="13.0.4" />
+    <PackageVersion Include="Npgsql" Version="10.0.3" />
+    <PackageVersion Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.3" />
    <PackageVersion Include="PDFtoImage" Version="5.2.1" />
    <PackageVersion Include="PlaylistsNET" Version="1.4.1" />
    <PackageVersion Include="prometheus-net.AspNetCore" Version="8.2.1" />
@@ -74,12 +78,15 @@
    <PackageVersion Include="SkiaSharp.HarfBuzz" Version="3.119.4" />
    <PackageVersion Include="SkiaSharp.NativeAssets.Linux" Version="3.119.4" />
    <PackageVersion Include="SmartAnalyzers.MultithreadingAnalyzer" Version="1.1.31" />
+    <PackageVersion Include="StackExchange.Redis" Version="2.13.17" />
    <PackageVersion Include="StyleCop.Analyzers" Version="1.2.0-beta.556" />
    <PackageVersion Include="Svg.Skia" Version="3.7.0" />
    <PackageVersion Include="Swashbuckle.AspNetCore.ReDoc" Version="10.2.3" />
    <PackageVersion Include="Swashbuckle.AspNetCore" Version="10.2.3" />
    <PackageVersion Include="System.Text.Json" Version="10.0.11" />
    <PackageVersion Include="TagLibSharp" Version="2.3.0" />
+    <PackageVersion Include="Testcontainers.PostgreSql" Version="4.15.0" />
+    <PackageVersion Include="Testcontainers.Redis" Version="4.15.0" />
    <PackageVersion Include="z440.atl.core" Version="7.16.0" />
    <PackageVersion Include="TMDbLib" Version="3.0.0" />
    <PackageVersion Include="UTF.Unknown" Version="2.7.0" />
@@ -0,0 +1,96 @@
+# syntax=docker/dockerfile:1
+
+# ── Build stage ──────────────────────────────────────────────────────────────
+FROM --platform=linux/amd64 mcr.microsoft.com/dotnet/sdk:10.0 AS build
+
+WORKDIR /src
+
+# Restore dependencies first (layer-cache friendly)
+COPY ["Jellyfin.sln", "global.json", "nuget.config", "Directory.Build.props", "Directory.Packages.props", "./"]
+COPY ["SharedVersion.cs", "BannedSymbols.txt", "stylecop.json", "./"]
+
+# Copy all project files so dotnet restore can resolve the full dependency graph
+COPY Emby.Naming/                                   Emby.Naming/
+COPY Emby.Photos/                                   Emby.Photos/
+COPY Emby.Server.Implementations/                  Emby.Server.Implementations/
+COPY Jellyfin.Api/                                  Jellyfin.Api/
+COPY Jellyfin.Data/                                 Jellyfin.Data/
+COPY Jellyfin.Server/                               Jellyfin.Server/
+COPY Jellyfin.Server.Implementations/              Jellyfin.Server.Implementations/
+COPY MediaBrowser.Common/                           MediaBrowser.Common/
+COPY MediaBrowser.Controller/                       MediaBrowser.Controller/
+COPY MediaBrowser.LocalMetadata/                    MediaBrowser.LocalMetadata/
+COPY MediaBrowser.MediaEncoding/                    MediaBrowser.MediaEncoding/
+COPY MediaBrowser.Model/                            MediaBrowser.Model/
+COPY MediaBrowser.Providers/                        MediaBrowser.Providers/
+COPY MediaBrowser.XbmcMetadata/                    MediaBrowser.XbmcMetadata/
+COPY src/                                           src/
+
+RUN dotnet restore Jellyfin.Server/Jellyfin.Server.csproj \
+      --runtime linux-x64
+
+# Publish the server (and all transitive dependencies, including the
+# PostgreSQL provider assembly added by this fork).
+# Note: TreatWarningsAsErrors is disabled for the Docker build — StyleCop
+# analyzer violations in upstream src/ projects would otherwise block the
+# image build. StyleCop is enforced in the CI pipeline, not the Dockerfile.
+RUN dotnet publish Jellyfin.Server/Jellyfin.Server.csproj \
+      --configuration Release \
+      --runtime linux-x64 \
+      --self-contained false \
+      --no-restore \
+      -p:TreatWarningsAsErrors=false \
+      --output /app
+
+# ── Web client stage ──────────────────────────────────────────────────────────
+# Install jellyfin-web via the official Jellyfin apt repo.
+# Package suffix in the bookworm repo is +deb12 (e.g. 12.0+deb12).
+# Web assets land at /usr/share/jellyfin/web/ — stable, prebuilt, no npm required.
+# The web client version must match the server version this fork is based on.
+FROM --platform=linux/amd64 debian:bookworm-slim AS webclient
+
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends curl gnupg ca-certificates \
+ && curl -fsSL https://repo.jellyfin.org/jellyfin_team.gpg.key \
+    | gpg --dearmor -o /usr/share/keyrings/jellyfin.gpg \
+ && echo "deb [arch=amd64 signed-by=/usr/share/keyrings/jellyfin.gpg] https://repo.jellyfin.org/debian bookworm main" \
+    > /etc/apt/sources.list.d/jellyfin.list \
+ && apt-get update \
+ && apt-get install -y --no-install-recommends "jellyfin-web=12.0+deb12" \
+ && rm -rf /var/lib/apt/lists/* \
+ && echo "Web client files:" && ls /usr/share/jellyfin/web/ | head -10
+
+# ── Runtime stage ─────────────────────────────────────────────────────────────
+FROM --platform=linux/amd64 mcr.microsoft.com/dotnet/aspnet:10.0
+
+# Install FFmpeg and native dependencies required by SkiaSharp and fontconfig.
+# libicu, libssl, and liblttng-ust are already present in the dotnet/aspnet base image.
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+      ffmpeg \
+      fontconfig \
+      libfontconfig1 \
+      libfreetype6 \
+ && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /jellyfin
+
+COPY --from=build /app .
+COPY --from=webclient /usr/share/jellyfin/web ./jellyfin-web/
+
+# Jellyfin default ports
+EXPOSE 8096
+EXPOSE 8920
+
+# Data / config volumes
+VOLUME ["/config", "/cache", "/media"]
+
+ENV JELLYFIN_DATA_DIR=/config \
+    JELLYFIN_CACHE_DIR=/cache \
+    JELLYFIN_LOG_DIR=/config/log \
+    JELLYFIN_CONFIG_DIR=/config
+
+ENTRYPOINT ["./jellyfin", \
+            "--datadir", "/config", \
+            "--cachedir", "/cache", \
+            "--webdir", "/jellyfin/jellyfin-web"]
@@ -0,0 +1,55 @@
+# syntax=docker/dockerfile:1
+# Runtime-only image — the .NET publish step runs on the CI host (runner),
+# not inside this Dockerfile.
+
+# ── Web client stage ──────────────────────────────────────────────────────────
+# Install jellyfin-web via the official Jellyfin apt repo.
+# Package suffix in the bookworm repo is +deb12 (e.g. 12.0+deb12).
+# Web assets land at /usr/share/jellyfin/web/ — stable, prebuilt, no npm required.
+# The web client version must match the server version this fork is based on.
+FROM --platform=linux/amd64 debian:bookworm-slim AS webclient
+
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends curl gnupg ca-certificates \
+ && curl -fsSL https://repo.jellyfin.org/jellyfin_team.gpg.key \
+    | gpg --dearmor -o /usr/share/keyrings/jellyfin.gpg \
+ && echo "deb [arch=amd64 signed-by=/usr/share/keyrings/jellyfin.gpg] https://repo.jellyfin.org/debian bookworm main" \
+    > /etc/apt/sources.list.d/jellyfin.list \
+ && apt-get update \
+ && apt-get install -y --no-install-recommends "jellyfin-web=12.0+deb12" \
+ && rm -rf /var/lib/apt/lists/*
+
+# ── Runtime stage ─────────────────────────────────────────────────────────────
+FROM --platform=linux/amd64 mcr.microsoft.com/dotnet/aspnet:10.0
+
+# Install FFmpeg and native dependencies required by SkiaSharp and fontconfig.
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+      ffmpeg \
+      fontconfig \
+      libfontconfig1 \
+      libfreetype6 \
+ && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /jellyfin
+
+# Copy the pre-built publish output produced by `dotnet publish` on the CI host.
+COPY publish-output/ .
+# Copy the jellyfin-web client assets from the webclient stage.
+COPY --from=webclient /usr/share/jellyfin/web ./jellyfin-web/
+
+# Jellyfin default ports
+EXPOSE 8096
+EXPOSE 8920
+
+# Data / config volumes
+VOLUME ["/config", "/cache", "/media"]
+
+ENV JELLYFIN_DATA_DIR=/config \
+    JELLYFIN_CACHE_DIR=/cache \
+    JELLYFIN_LOG_DIR=/config/log
+
+ENTRYPOINT ["./jellyfin", \
+            "--datadir", "/config", \
+            "--cachedir", "/cache", \
+            "--webdir", "/jellyfin/jellyfin-web"]
@@ -87,6 +87,12 @@ namespace Emby.Server.Implementations.AppBase
        /// <value>The application paths.</value>
        public IApplicationPaths CommonApplicationPaths { get; private set; }

+        /// <summary>
+        /// Gets or sets the bus announcing configuration writes to the other instances sharing this
+        /// configuration directory. Defaults to a no-op, which is the single-instance behaviour.
+        /// </summary>
+        public IConfigurationInvalidationBus InvalidationBus { get; set; } = NullConfigurationInvalidationBus.Instance;
+
        /// <summary>
        /// Gets or sets the system configuration.
        /// </summary>
@@ -169,6 +175,8 @@ namespace Emby.Server.Implementations.AppBase
            }

            OnConfigurationUpdated();
+
+            InvalidationBus.PublishLocalWrite(ConfigurationInvalidationScope.SystemConfiguration, null);
        }

        /// <summary>
@@ -350,6 +358,29 @@ namespace Emby.Server.Implementations.AppBase
            }

            OnNamedConfigurationUpdated(key, configuration);
+
+            InvalidationBus.PublishLocalWrite(ConfigurationInvalidationScope.NamedConfiguration, key);
+        }
+
+        /// <inheritdoc />
+        public void InvalidateCachedConfiguration(string? key)
+        {
+            if (string.IsNullOrEmpty(key))
+            {
+                lock (_configurationSyncLock)
+                {
+                    _configuration = null;
+                }
+
+                // Reloads the system configuration off the shared file as a side effect of re-deriving
+                // the cache path from it, then tells the in-process consumers to re-read it.
+                OnConfigurationUpdated();
+                return;
+            }
+
+            _configurations.TryRemove(key, out _);
+
+            OnNamedConfigurationUpdated(key, GetConfiguration(key));
        }

        /// <summary>
@@ -706,6 +706,8 @@ namespace Emby.Server.Implementations
            BaseItem.UserDataManager = Resolve<IUserDataManager>();
            CollectionFolder.XmlSerializer = _xmlSerializer;
            CollectionFolder.ApplicationHost = this;
+            CollectionFolder.InvalidationBus = Resolve<IConfigurationInvalidationBus>();
+            ConfigurationManager.InvalidationBus = CollectionFolder.InvalidationBus;
            Folder.UserViewManager = Resolve<IUserViewManager>();
            Folder.CollectionManager = Resolve<ICollectionManager>();
            Folder.LimitedConcurrencyLibraryScheduler = Resolve<ILimitedConcurrencyLibraryScheduler>();
@@ -790,6 +792,43 @@ namespace Emby.Server.Implementations
            }
        }

+        /// <summary>
+        /// Works out what a configuration update means for the ports this process bound at startup.
+        /// </summary>
+        /// <param name="boundHttpPort">The HTTP port this process is bound to.</param>
+        /// <param name="boundHttpsPort">The HTTPS port this process is bound to.</param>
+        /// <param name="configuredHttpPort">The HTTP port the shared configuration now carries.</param>
+        /// <param name="configuredHttpsPort">The HTTPS port the shared configuration now carries.</param>
+        /// <param name="isPortAuthorized">Whether the shared configuration still marks the port as authorized.</param>
+        /// <param name="isApplyingRemoteInvalidation">Whether this update is another instance's write being applied.</param>
+        /// <returns>What the update requires of this instance.</returns>
+        internal static PortChangeOutcome EvaluatePortChange(
+            int boundHttpPort,
+            int boundHttpsPort,
+            int configuredHttpPort,
+            int configuredHttpsPort,
+            bool isPortAuthorized,
+            bool isApplyingRemoteInvalidation)
+        {
+            // Nothing is bound yet, so nothing has gone stale.
+            if (boundHttpPort == 0 || boundHttpsPort == 0)
+            {
+                return default;
+            }
+
+            if (configuredHttpPort == boundHttpPort && configuredHttpsPort == boundHttpsPort)
+            {
+                return default;
+            }
+
+            // Whoever wrote the change, this process is still listening on a port the configuration no
+            // longer names, so the pending restart is reported either way. The authorization flag belongs
+            // to the instance that made the change: it cleared the flag along with the port, and clearing
+            // it again here would write shared configuration on that instance's behalf and announce it a
+            // second time.
+            return new PortChangeOutcome(true, isPortAuthorized && !isApplyingRemoteInvalidation);
+        }
+
        /// <summary>
        /// Called when [configuration updated].
        /// </summary>
@@ -797,26 +836,24 @@ namespace Emby.Server.Implementations
        /// <param name="e">The <see cref="EventArgs"/> instance containing the event data.</param>
        private void OnConfigurationUpdated(object sender, EventArgs e)
        {
-            var requiresRestart = false;
            var networkConfiguration = ConfigurationManager.GetNetworkConfiguration();

-            // Don't do anything if these haven't been set yet
-            if (HttpPort != 0 && HttpsPort != 0)
-            {
-                // Need to restart if ports have changed
-                if (networkConfiguration.InternalHttpPort != HttpPort
-                    || networkConfiguration.InternalHttpsPort != HttpsPort)
-                {
-                    if (ConfigurationManager.Configuration.IsPortAuthorized)
-                    {
-                        ConfigurationManager.Configuration.IsPortAuthorized = false;
-                        ConfigurationManager.SaveConfiguration();
+            var portChange = EvaluatePortChange(
+                HttpPort,
+                HttpsPort,
+                networkConfiguration.InternalHttpPort,
+                networkConfiguration.InternalHttpsPort,
+                ConfigurationManager.Configuration.IsPortAuthorized,
+                ConfigurationInvalidationContext.IsApplyingRemoteInvalidation);

-                        requiresRestart = true;
-                    }
-                }
+            if (portChange.ClearsPortAuthorization)
+            {
+                ConfigurationManager.Configuration.IsPortAuthorized = false;
+                ConfigurationManager.SaveConfiguration();
            }

+            var requiresRestart = portChange.RequiresRestart;
+
            if (ValidateSslCertificate(networkConfiguration))
            {
                requiresRestart = true;
@@ -0,0 +1,82 @@
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using MediaBrowser.Common.Configuration;
+using MediaBrowser.Controller.Entities;
+using Microsoft.Extensions.Hosting;
+using Microsoft.Extensions.Logging;
+
+namespace Emby.Server.Implementations.Configuration
+{
+    /// <summary>
+    /// Applies the configuration invalidations published by the other instances sharing this
+    /// configuration directory, dropping the local cache entry so the next read comes off the shared file.
+    /// </summary>
+    public sealed class ConfigurationInvalidationSubscriber : IHostedService
+    {
+        private readonly IConfigurationInvalidationBus _bus;
+        private readonly IConfigurationManager _configurationManager;
+        private readonly ILogger<ConfigurationInvalidationSubscriber> _logger;
+
+        /// <summary>
+        /// Initializes a new instance of the <see cref="ConfigurationInvalidationSubscriber"/> class.
+        /// </summary>
+        /// <param name="bus">The invalidation bus.</param>
+        /// <param name="configurationManager">The configuration manager holding the cached configuration.</param>
+        /// <param name="logger">The logger.</param>
+        public ConfigurationInvalidationSubscriber(
+            IConfigurationInvalidationBus bus,
+            IConfigurationManager configurationManager,
+            ILogger<ConfigurationInvalidationSubscriber> logger)
+        {
+            _bus = bus;
+            _configurationManager = configurationManager;
+            _logger = logger;
+        }
+
+        /// <inheritdoc />
+        public Task StartAsync(CancellationToken cancellationToken)
+        {
+            _bus.Subscribe(Apply);
+            return Task.CompletedTask;
+        }
+
+        /// <inheritdoc />
+        public Task StopAsync(CancellationToken cancellationToken) => Task.CompletedTask;
+
+        private void Apply(ConfigurationInvalidation invalidation)
+        {
+            try
+            {
+                // Applying re-raises the same update events a local save raises, so the in-process
+                // consumers re-read. The scope tells those consumers that the write was somebody else's,
+                // so the ones that answer an update by writing neither repeat it nor publish it back.
+                using var scope = ConfigurationInvalidationContext.BeginApply();
+
+                switch (invalidation.Scope)
+                {
+                    case ConfigurationInvalidationScope.SystemConfiguration:
+                        _configurationManager.InvalidateCachedConfiguration(null);
+                        break;
+                    case ConfigurationInvalidationScope.NamedConfiguration when !string.IsNullOrEmpty(invalidation.Target):
+                        _configurationManager.InvalidateCachedConfiguration(invalidation.Target);
+                        break;
+                    case ConfigurationInvalidationScope.LibraryOptions when !string.IsNullOrEmpty(invalidation.Target):
+                        CollectionFolder.InvalidateLibraryOptions(invalidation.Target);
+                        break;
+                    case ConfigurationInvalidationScope.AllLibraryOptions:
+                        CollectionFolder.InvalidateAllLibraryOptions();
+                        break;
+                    default:
+                        return;
+                }
+
+                _logger.LogDebug("Applied {Scope} invalidation for {Target} from {OriginId}.", invalidation.Scope, invalidation.Target, invalidation.OriginId);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogWarning(ex, "Failed to apply a {Scope} invalidation for {Target}.", invalidation.Scope, invalidation.Target);
+            }
+        }
+    }
+}
@@ -0,0 +1,96 @@
+using System;
+using System.Text.Json;
+using Jellyfin.Extensions.Json;
+using MediaBrowser.Common.Configuration;
+using Microsoft.Extensions.Logging;
+using StackExchange.Redis;
+
+namespace Emby.Server.Implementations.Configuration
+{
+    /// <summary>
+    /// A Redis pub/sub <see cref="IConfigurationInvalidationBus"/>. Notices are broadcast on one channel
+    /// and every instance but the publisher applies them.
+    /// </summary>
+    public sealed class RedisConfigurationInvalidationBus : IConfigurationInvalidationBus
+    {
+        private const string ChannelName = "jellyfin:configinvalidation";
+
+        private static readonly JsonSerializerOptions _jsonOptions = JsonDefaults.Options;
+
+        private readonly ISubscriber _subscriber;
+        private readonly ILogger<RedisConfigurationInvalidationBus> _logger;
+        private readonly string _originId;
+
+        /// <summary>
+        /// Initializes a new instance of the <see cref="RedisConfigurationInvalidationBus"/> class.
+        /// </summary>
+        /// <param name="redis">The Redis connection multiplexer.</param>
+        /// <param name="logger">The logger.</param>
+        public RedisConfigurationInvalidationBus(IConnectionMultiplexer redis, ILogger<RedisConfigurationInvalidationBus> logger)
+        {
+            ArgumentNullException.ThrowIfNull(redis);
+
+            _subscriber = redis.GetSubscriber();
+            _logger = logger;
+            _originId = Environment.GetEnvironmentVariable("JELLYFIN_INSTANCE_ID") ?? Environment.MachineName;
+        }
+
+        /// <inheritdoc />
+        public void Publish(ConfigurationInvalidationScope scope, string? target)
+        {
+            var invalidation = new ConfigurationInvalidation
+            {
+                Scope = scope,
+                Target = target,
+                OriginId = _originId
+            };
+
+            try
+            {
+                // Fire and forget: an admin saving configuration must never wait on, or fail because of,
+                // the bus. The write has already reached the shared directory by this point.
+                _subscriber.Publish(
+                    RedisChannel.Literal(ChannelName),
+                    JsonSerializer.Serialize(invalidation, _jsonOptions),
+                    CommandFlags.FireAndForget);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogWarning(ex, "Failed to publish {Scope} invalidation for {Target}; other instances keep their cached copy until they restart.", scope, target);
+            }
+        }
+
+        /// <inheritdoc />
+        public void Subscribe(Action<ConfigurationInvalidation> handler)
+        {
+            ArgumentNullException.ThrowIfNull(handler);
+
+            try
+            {
+                _subscriber.Subscribe(RedisChannel.Literal(ChannelName), (_, value) => Dispatch(handler, value));
+            }
+            catch (Exception ex)
+            {
+                _logger.LogWarning(ex, "Failed to subscribe to configuration invalidations; this instance keeps its cached configuration until it restarts.");
+            }
+        }
+
+        private void Dispatch(Action<ConfigurationInvalidation> handler, RedisValue value)
+        {
+            try
+            {
+                var invalidation = JsonSerializer.Deserialize<ConfigurationInvalidation>(value.ToString(), _jsonOptions);
+                if (invalidation is null || string.Equals(invalidation.OriginId, _originId, StringComparison.Ordinal))
+                {
+                    return;
+                }
+
+                handler(invalidation);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogWarning(ex, "Failed to apply a configuration invalidation.");
+            }
+        }
+    }
+}
@@ -65,6 +65,7 @@

  <ItemGroup>
    <PackageReference Include="Ignore" />
+    <PackageReference Include="StackExchange.Redis" />
  </ItemGroup>

  <ItemGroup>
@@ -2332,7 +2332,10 @@ namespace Emby.Server.Implementations.Library
        {
            IOrderedEnumerable<BaseItem>? orderedItems = null;

-            foreach (var orderBy in sortBy.Select(o => GetComparer(o, user)).Where(c => c is not null))
+            var comparers = sortBy.Select(o => GetComparer(o, user)).Where(c => c is not null).ToList();
+            items = PrefetchUserData(items, user, comparers);
+
+            foreach (var orderBy in comparers)
            {
                if (orderBy is RandomComparer)
                {
@@ -2364,14 +2367,14 @@ namespace Emby.Server.Implementations.Library
        {
            IOrderedEnumerable<BaseItem>? orderedItems = null;

-            foreach (var (name, sortOrder) in orderBy)
-            {
-                var comparer = GetComparer(name, user);
-                if (comparer is null)
-                {
-                    continue;
-                }
+            var comparers = orderBy
+                .Select(o => (Comparer: GetComparer(o.OrderBy, user), o.SortOrder))
+                .Where(c => c.Comparer is not null)
+                .ToList();
+            items = PrefetchUserData(items, user, comparers.Select(c => c.Comparer).ToList());

+            foreach (var (comparer, sortOrder) in comparers)
+            {
                if (comparer is RandomComparer)
                {
                    var randomItems = items.ToArray();
@@ -2397,6 +2400,31 @@ namespace Emby.Server.Implementations.Library
            return orderedItems ?? items;
        }

+        // The user comparers read user data per item, so without one batched read up front an
+        // in-memory sort would issue a database round trip per comparison.
+        private IEnumerable<BaseItem> PrefetchUserData(IEnumerable<BaseItem> items, User? user, IReadOnlyList<IBaseItemComparer?> comparers)
+        {
+            if (user is null)
+            {
+                return items;
+            }
+
+            var userComparers = comparers.OfType<IUserBaseItemComparer>().ToList();
+            if (userComparers.Count == 0)
+            {
+                return items;
+            }
+
+            var itemList = items as IReadOnlyList<BaseItem> ?? items.ToList();
+            var userData = _userDataManager.GetUserDataBatch(itemList, user);
+            foreach (var comparer in userComparers)
+            {
+                comparer.PrefetchedUserData = userData;
+            }
+
+            return itemList;
+        }
+
        /// <summary>
        /// Gets the comparer.
        /// </summary>
@@ -2,10 +2,8 @@

 using System;
 using System.Collections.Generic;
-using System.Globalization;
 using System.Linq;
 using System.Threading;
-using BitFaster.Caching.Lru;
 using Jellyfin.Database.Implementations;
 using Jellyfin.Database.Implementations.Entities;
 using MediaBrowser.Controller.Configuration;
@@ -27,7 +25,6 @@ namespace Emby.Server.Implementations.Library
    {
        private readonly IServerConfigurationManager _config;
        private readonly IDbContextFactory<JellyfinDbContext> _repository;
-        private readonly FastConcurrentLru<string, UserItemData> _cache;

        /// <summary>
        /// Initializes a new instance of the <see cref="UserDataManager"/> class.
@@ -40,7 +37,6 @@ namespace Emby.Server.Implementations.Library
        {
            _config = config;
            _repository = repository;
-            _cache = new FastConcurrentLru<string, UserItemData>(Environment.ProcessorCount, _config.Configuration.CacheSize, StringComparer.OrdinalIgnoreCase);
        }

        /// <inheritdoc />
@@ -77,11 +73,6 @@ namespace Emby.Server.Implementations.Library
            dbContext.SaveChanges();
            transaction.Commit();

-            var userId = user.InternalId;
-            var cacheKey = GetCacheKey(userId, item.Id);
-            _cache.AddOrUpdate(cacheKey, userData);
-            item.UserData = dbContext.UserData.Where(e => e.ItemId == item.Id).AsNoTracking().ToArray(); // rehydrate the cached userdata
-
            UserDataSaved?.Invoke(this, new UserDataSaveEventArgs
            {
                Keys = keys,
@@ -180,64 +171,41 @@ namespace Emby.Server.Implementations.Library
        /// <inheritdoc />
        public Dictionary<Guid, UserItemData> GetUserDataBatch(IReadOnlyList<BaseItem> items, User user)
        {
+            ArgumentNullException.ThrowIfNull(items);
+            ArgumentNullException.ThrowIfNull(user);
+
            var result = new Dictionary<Guid, UserItemData>(items.Count);
-            var itemsNeedingQuery = new List<(BaseItem Item, List<string> Keys)>();
-
-            foreach (var item in items)
-            {
-                var cacheKey = GetCacheKey(user.InternalId, item.Id);
-                if (_cache.TryGet(cacheKey, out var cachedData))
-                {
-                    result[item.Id] = cachedData;
-                }
-                else
-                {
-                    var userDataRow = ResolveUserDataRow(item, item.UserData?.Where(e => e.UserId.Equals(user.Id)));
-                    var userData = userDataRow is not null ? Map(userDataRow) : null;
-                    if (userData is not null)
-                    {
-                        result[item.Id] = userData;
-                        _cache.AddOrUpdate(cacheKey, userData);
-                    }
-                    else
-                    {
-                        var keys = item.GetUserDataKeys();
-                        itemsNeedingQuery.Add((item, keys));
-                    }
-                }
-            }
-
-            if (itemsNeedingQuery.Count == 0)
+            if (items.Count == 0)
            {
                return result;
            }

-            // Build a single query for all missing items. Fetch rows by item alone so rows kept
-            // under keys from older metadata resolve the same way as the in-memory path.
-            var allItemIds = itemsNeedingQuery.Select(x => x.Item.Id).ToList();
+            // Fetch rows by item alone so rows kept under keys from older metadata resolve the same
+            // way as the single item path.
+            var itemIds = items.Select(e => e.Id).Distinct().ToList();
            using var context = _repository.CreateDbContext();
-            var userDataArray = context.UserData
+            var userDataByItem = context.UserData
                .AsNoTracking()
                .Where(e => e.UserId.Equals(user.Id))
-                .WhereOneOrMany(allItemIds, e => e.ItemId)
-                .ToArray();
+                .WhereOneOrMany(itemIds, e => e.ItemId)
+                .ToArray()
+                .GroupBy(e => e.ItemId)
+                .ToDictionary(g => g.Key, g => g.ToArray());

-            var userDataByItem = userDataArray.GroupBy(e => e.ItemId).ToDictionary(g => g.Key, g => g.ToArray());
-            foreach (var (item, keys) in itemsNeedingQuery)
+            foreach (var item in items)
            {
-                UserItemData userData;
-                if (userDataByItem.TryGetValue(item.Id, out var itemUserData) && itemUserData.Length > 0)
+                if (result.ContainsKey(item.Id))
                {
-                    userData = Map(ResolveUserDataRow(item, itemUserData)!);
-                }
-                else
-                {
-                    userData = new UserItemData { Key = keys.Count > 0 ? keys[0] : string.Empty };
+                    continue;
                }

-                result[item.Id] = userData;
-                var cacheKey = GetCacheKey(user.InternalId, item.Id);
-                _cache.AddOrUpdate(cacheKey, userData);
+                var row = userDataByItem.TryGetValue(item.Id, out var itemUserData)
+                    ? ResolveUserDataRow(item, itemUserData)
+                    : null;
+
+                result[item.Id] = row is not null
+                    ? Map(row)
+                    : new UserItemData { Key = item.GetUserDataKeys().FirstOrDefault() ?? string.Empty };
            }

            return result;
@@ -340,20 +308,19 @@ namespace Emby.Server.Implementations.Library
            return result;
        }

-        /// <summary>
-        /// Gets the internal key.
-        /// </summary>
-        /// <returns>System.String.</returns>
-        private static string GetCacheKey(long internalUserId, Guid itemId)
-        {
-            return internalUserId.ToString(CultureInfo.InvariantCulture) + "-" + itemId.ToString("N", CultureInfo.InvariantCulture);
-        }
-
        /// <inheritdoc />
        public UserItemData? GetUserData(User user, BaseItem item)
        {
            ArgumentNullException.ThrowIfNull(user);
-            var row = ResolveUserDataRow(item, item.UserData?.Where(e => e.UserId.Equals(user.Id)));
+            ArgumentNullException.ThrowIfNull(item);
+
+            using var dbContext = _repository.CreateDbContext();
+            var rows = dbContext.UserData
+                .AsNoTracking()
+                .Where(e => e.ItemId == item.Id && e.UserId == user.Id)
+                .ToArray();
+
+            var row = ResolveUserDataRow(item, rows);
            return row is not null ? Map(row) : new UserItemData()
            {
                Key = item.GetUserDataKeys()[0],
@@ -536,16 +503,6 @@ namespace Emby.Server.Implementations.Library
            }

            dbContext.SaveChanges();
-
-            var cacheKey = GetCacheKey(user.InternalId, item.Id);
-            if (_cache.TryGet(cacheKey, out var cached))
-            {
-                cached.AudioStreamIndex = null;
-                cached.SubtitleStreamIndex = null;
-                _cache.AddOrUpdate(cacheKey, cached);
-            }
-
-            item.UserData = dbContext.UserData.Where(e => e.ItemId == item.Id).AsNoTracking().ToArray();
        }
    }
 }
@@ -0,0 +1,235 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using System.Threading;
+using System.Threading.Tasks;
+using MediaBrowser.Controller.MediaEncoding;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+using StackExchange.Redis;
+
+namespace Emby.Server.Implementations.MediaEncoding;
+
+/// <summary>
+/// A Redis-backed implementation of <see cref="ITranscodeSessionStore"/> that provides
+/// durable, distributed session tracking with lease-based ownership between pods.
+/// </summary>
+public sealed class RedisTranscodeSessionStore : ITranscodeSessionStore
+{
+    private const string KeyPrefix = "jellyfin:transcode:";
+
+    /// <summary>
+    /// Lua script for atomic takeover: reads the stored session, checks whether the lease has
+    /// expired (comparing the stored expiry against the caller-supplied current time) and, if it
+    /// has, claims it for the calling pod before returning 1; returns 0 otherwise.
+    /// </summary>
+    private const string TakeoverScript = @"
+local raw = redis.call('GET', KEYS[1])
+if not raw then return 0 end
+local session = cjson.decode(raw)
+if tonumber(session['LeaseExpiresUtc']) > tonumber(ARGV[1]) then return 0 end
+session['OwnerPod'] = ARGV[2]
+session['LeaseExpiresUtc'] = tonumber(ARGV[1]) + tonumber(ARGV[3])
+redis.call('SET', KEYS[1], cjson.encode(session), 'PX', tonumber(ARGV[4]))
+return 1";
+
+    /// <summary>
+    /// Lua script for atomic, ownership-checked renewal: extends the lease only while the calling
+    /// pod still owns it, so a renewal racing a successful takeover cannot revert the new owner.
+    /// </summary>
+    private const string RenewScript = @"
+local raw = redis.call('GET', KEYS[1])
+if not raw then return 0 end
+local session = cjson.decode(raw)
+if session['OwnerPod'] ~= ARGV[2] then return 0 end
+session['LeaseExpiresUtc'] = tonumber(ARGV[1]) + tonumber(ARGV[3])
+redis.call('SET', KEYS[1], cjson.encode(session), 'PX', tonumber(ARGV[4]))
+return 1";
+
+    // The lease expiry is serialized as unix milliseconds because the Lua scripts compare it
+    // numerically; an ISO-8601 string cannot be compared against a number in Lua.
+    private static readonly JsonSerializerOptions _jsonOptions = new JsonSerializerOptions
+    {
+        Converters = { new UnixMillisecondsDateTimeConverter() }
+    };
+
+    private readonly IConnectionMultiplexer _redis;
+    private readonly IDatabase _db;
+    private readonly TranscodeStoreOptions _options;
+    private readonly ILogger<RedisTranscodeSessionStore> _logger;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="RedisTranscodeSessionStore"/> class.
+    /// </summary>
+    /// <param name="redis">The Redis connection multiplexer.</param>
+    /// <param name="options">The transcode store configuration options.</param>
+    /// <param name="logger">The logger.</param>
+    public RedisTranscodeSessionStore(
+        IConnectionMultiplexer redis,
+        IOptions<TranscodeStoreOptions> options,
+        ILogger<RedisTranscodeSessionStore> logger)
+    {
+        _redis = redis;
+        _db = redis.GetDatabase();
+        _options = options.Value;
+        _logger = logger;
+    }
+
+    private long LeaseDurationMs => (long)_options.LeaseDurationSeconds * 1000;
+
+    private long RetentionMs => Math.Max((long)_options.SessionRetentionSeconds * 1000, LeaseDurationMs);
+
+    /// <inheritdoc />
+    public async Task SetAsync(TranscodeSession session, CancellationToken cancellationToken = default)
+    {
+        var key = GetKey(session.PlaySessionId);
+        var json = JsonSerializer.Serialize(session, _jsonOptions);
+        await _db.StringSetAsync(key, json, TimeSpan.FromMilliseconds(RetentionMs)).ConfigureAwait(false);
+        _logger.LogDebug("Set transcode session {PlaySessionId} in Redis.", session.PlaySessionId);
+    }
+
+    /// <inheritdoc />
+    public async Task<TranscodeSession?> TryGetAsync(string playSessionId, CancellationToken cancellationToken = default)
+    {
+        var key = GetKey(playSessionId);
+        var raw = await _db.StringGetAsync(key).ConfigureAwait(false);
+        if (!raw.HasValue)
+        {
+            return null;
+        }
+
+        var session = JsonSerializer.Deserialize<TranscodeSession>(raw.ToString(), _jsonOptions);
+
+        // The record outlives the lease so that an orphaned session can still be taken over,
+        // so the lease has to be checked explicitly here.
+        if (session is null || session.LeaseExpiresUtc <= DateTime.UtcNow)
+        {
+            return null;
+        }
+
+        return session;
+    }
+
+    /// <inheritdoc />
+    public async Task<bool> RenewLeaseAsync(string playSessionId, string ownerPod, CancellationToken cancellationToken = default)
+    {
+        var result = (long?)await _db.ScriptEvaluateAsync(
+            RenewScript,
+            keys: new RedisKey[] { GetKey(playSessionId) },
+            values: new RedisValue[] { UnixMillisecondsNow(), ownerPod, LeaseDurationMs, RetentionMs }).ConfigureAwait(false);
+
+        if (result != 1)
+        {
+            _logger.LogWarning(
+                "Pod {OwnerPod} no longer owns transcode session {PlaySessionId}; lease not renewed.",
+                ownerPod,
+                playSessionId);
+            return false;
+        }
+
+        _logger.LogDebug("Renewed lease for transcode session {PlaySessionId}.", playSessionId);
+        return true;
+    }
+
+    /// <inheritdoc />
+    public async Task DeleteAsync(string playSessionId, CancellationToken cancellationToken = default)
+    {
+        var key = GetKey(playSessionId);
+        await _db.KeyDeleteAsync(key).ConfigureAwait(false);
+        _logger.LogDebug("Deleted transcode session {PlaySessionId} from Redis.", playSessionId);
+    }
+
+    /// <inheritdoc />
+    public async Task<bool> TryTakeoverAsync(string playSessionId, string claimingPod, CancellationToken cancellationToken = default)
+    {
+        var result = (long?)await _db.ScriptEvaluateAsync(
+            TakeoverScript,
+            keys: new RedisKey[] { GetKey(playSessionId) },
+            values: new RedisValue[] { UnixMillisecondsNow(), claimingPod, LeaseDurationMs, RetentionMs }).ConfigureAwait(false);
+
+        var succeeded = result == 1;
+        if (succeeded)
+        {
+            _logger.LogInformation("Pod {ClaimingPod} successfully took over transcode session {PlaySessionId}.", claimingPod, playSessionId);
+        }
+
+        return succeeded;
+    }
+
+    /// <inheritdoc />
+    public async Task<IEnumerable<TranscodeSession>> GetActiveSessionsAsync(CancellationToken cancellationToken = default)
+    {
+        var sessions = new List<TranscodeSession>();
+        var servers = _redis.GetServers();
+
+        foreach (var server in servers)
+        {
+            if (!server.IsConnected)
+            {
+                continue;
+            }
+
+            var keys = new List<RedisKey>();
+            await foreach (var key in server.KeysAsync(database: _db.Database, pattern: KeyPrefix + "*", pageSize: 1000).WithCancellation(cancellationToken).ConfigureAwait(false))
+            {
+                keys.Add(key);
+            }
+
+            var tasks = keys.Select(key => _db.StringGetAsync(key)).ToList();
+            var values = await Task.WhenAll(tasks).ConfigureAwait(false);
+
+            foreach (var raw in values)
+            {
+                if (!raw.HasValue)
+                {
+                    continue;
+                }
+
+                TranscodeSession? session;
+                try
+                {
+                    session = JsonSerializer.Deserialize<TranscodeSession>(raw.ToString(), _jsonOptions);
+                }
+                catch (Exception ex)
+                {
+                    _logger.LogWarning(ex, "Failed to deserialize transcode session from Redis.");
+                    continue;
+                }
+
+                if (session is not null && session.LeaseExpiresUtc > DateTime.UtcNow)
+                {
+                    sessions.Add(session);
+                }
+            }
+        }
+
+        return sessions;
+    }
+
+    private static string GetKey(string playSessionId) => KeyPrefix + playSessionId;
+
+    private static long UnixMillisecondsNow() => DateTimeOffset.UtcNow.ToUnixTimeMilliseconds();
+
+    private sealed class UnixMillisecondsDateTimeConverter : JsonConverter<DateTime>
+    {
+        public override DateTime Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            var milliseconds = reader.TryGetInt64(out var value) ? value : (long)reader.GetDouble();
+            return DateTimeOffset.FromUnixTimeMilliseconds(milliseconds).UtcDateTime;
+        }
+
+        public override void Write(Utf8JsonWriter writer, DateTime value, JsonSerializerOptions options)
+        {
+            var utc = value.Kind switch
+            {
+                DateTimeKind.Utc => value,
+                DateTimeKind.Local => value.ToUniversalTime(),
+                _ => DateTime.SpecifyKind(value, DateTimeKind.Utc)
+            };
+
+            writer.WriteNumberValue(new DateTimeOffset(utc, TimeSpan.Zero).ToUnixTimeMilliseconds());
+        }
+    }
+}
@@ -0,0 +1,56 @@
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using MediaBrowser.Controller.MediaEncoding;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Hosting;
+using Microsoft.Extensions.Logging;
+using StackExchange.Redis;
+
+namespace Emby.Server.Implementations.MediaEncoding;
+
+/// <summary>
+/// Pings the configured Redis transcode session store once at startup so an unreachable store is
+/// reported there instead of being discovered as a silent loss of cross-pod takeover.
+/// </summary>
+public sealed class TranscodeStoreConnectivityProbe : IHostedService
+{
+    private readonly IServiceProvider _serviceProvider;
+    private readonly ILogger<TranscodeStoreConnectivityProbe> _logger;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="TranscodeStoreConnectivityProbe"/> class.
+    /// </summary>
+    /// <param name="serviceProvider">The service provider used to resolve the Redis connection.</param>
+    /// <param name="logger">The logger.</param>
+    public TranscodeStoreConnectivityProbe(IServiceProvider serviceProvider, ILogger<TranscodeStoreConnectivityProbe> logger)
+    {
+        _serviceProvider = serviceProvider;
+        _logger = logger;
+    }
+
+    /// <inheritdoc />
+    public async Task StartAsync(CancellationToken cancellationToken)
+    {
+        try
+        {
+            // Resolved here rather than injected: connecting must not be able to abort startup.
+            var redis = _serviceProvider.GetRequiredService<IConnectionMultiplexer>();
+            var roundTrip = await redis.GetDatabase().PingAsync().ConfigureAwait(false);
+
+            _logger.LogInformation(
+                "Redis transcode session store is reachable ({RoundTripMs}ms round trip). HA transcode takeover is active.",
+                (long)roundTrip.TotalMilliseconds);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(
+                ex,
+                "Redis transcode session store is configured but UNREACHABLE. HA transcode takeover is not working: sessions stay local to this instance and are lost when it restarts. Check {Key}.",
+                TranscodeStoreOptions.RedisConnectionStringKey);
+        }
+    }
+
+    /// <inheritdoc />
+    public Task StopAsync(CancellationToken cancellationToken) => Task.CompletedTask;
+}
@@ -0,0 +1,14 @@
+namespace Emby.Server.Implementations
+{
+    /// <summary>
+    /// What a configuration update carrying different ports requires of the instance reading it.
+    /// </summary>
+    /// <param name="RequiresRestart">
+    /// Whether this process is still bound to a port the shared configuration no longer names, and so has
+    /// to report a pending restart.
+    /// </param>
+    /// <param name="ClearsPortAuthorization">
+    /// Whether this instance is the one that has to clear the port authorization flag and save it.
+    /// </param>
+    internal readonly record struct PortChangeOutcome(bool RequiresRestart, bool ClearsPortAuthorization);
+}
@@ -1,7 +1,5 @@
 using System;
-using System.Collections.Concurrent;
 using System.Globalization;
-using System.Linq;
 using System.Security.Cryptography;
 using System.Threading.Tasks;
 using MediaBrowser.Common.Extensions;
@@ -30,12 +28,10 @@ namespace Emby.Server.Implementations.QuickConnect
        /// </summary>
        private const int Timeout = 10;

-        private readonly ConcurrentDictionary<string, QuickConnectResult> _currentRequests = new();
-        private readonly ConcurrentDictionary<string, (DateTime Timestamp, AuthenticationResult AuthenticationResult)> _authorizedSecrets = new();
-
        private readonly IServerConfigurationManager _config;
        private readonly ILogger<QuickConnectManager> _logger;
        private readonly ISessionManager _sessionManager;
+        private readonly IQuickConnectStore _store;

        /// <summary>
        /// Initializes a new instance of the <see cref="QuickConnectManager"/> class.
@@ -44,14 +40,17 @@ namespace Emby.Server.Implementations.QuickConnect
        /// <param name="config">Configuration.</param>
        /// <param name="logger">Logger.</param>
        /// <param name="sessionManager">Session Manager.</param>
+        /// <param name="store">Quick connect store.</param>
        public QuickConnectManager(
            IServerConfigurationManager config,
            ILogger<QuickConnectManager> logger,
-            ISessionManager sessionManager)
+            ISessionManager sessionManager,
+            IQuickConnectStore store)
        {
            _config = config;
            _logger = logger;
            _sessionManager = sessionManager;
+            _store = store;
        }

        /// <inheritdoc />
@@ -69,7 +68,7 @@ namespace Emby.Server.Implementations.QuickConnect
        }

        /// <inheritdoc/>
-        public QuickConnectResult TryConnect(AuthorizationInfo authorizationInfo)
+        public async Task<QuickConnectResult> TryConnect(AuthorizationInfo authorizationInfo)
        {
            ArgumentException.ThrowIfNullOrEmpty(authorizationInfo.DeviceId);
            ArgumentException.ThrowIfNullOrEmpty(authorizationInfo.Device);
@@ -77,7 +76,6 @@ namespace Emby.Server.Implementations.QuickConnect
            ArgumentException.ThrowIfNullOrEmpty(authorizationInfo.Version);

            AssertActive();
-            ExpireRequests();

            var secret = GenerateSecureRandom();
            var code = GenerateCode();
@@ -90,19 +88,17 @@ namespace Emby.Server.Implementations.QuickConnect
                authorizationInfo.Client,
                authorizationInfo.Version);

-            _currentRequests[code] = result;
+            await _store.SetRequestAsync(result, ExpiryOf(result)).ConfigureAwait(false);
            return result;
        }

        /// <inheritdoc/>
-        public QuickConnectResult CheckRequestStatus(string secret)
+        public async Task<QuickConnectResult> CheckRequestStatus(string secret)
        {
            AssertActive();
-            ExpireRequests();

-            string code = _currentRequests.Where(x => x.Value.Secret == secret).Select(x => x.Value.Code).DefaultIfEmpty(string.Empty).First();
-
-            if (!_currentRequests.TryGetValue(code, out QuickConnectResult? result))
+            var result = await _store.GetRequestBySecretAsync(secret).ConfigureAwait(false);
+            if (result is null)
            {
                throw new ResourceNotFoundException("Unable to find request with provided secret");
            }
@@ -136,9 +132,9 @@ namespace Emby.Server.Implementations.QuickConnect
        public async Task<bool> AuthorizeRequest(Guid userId, string code)
        {
            AssertActive();
-            ExpireRequests();

-            if (!_currentRequests.TryGetValue(code, out QuickConnectResult? result))
+            var result = await _store.GetRequestByCodeAsync(code).ConfigureAwait(false);
+            if (result is null)
            {
                throw new ResourceNotFoundException("Unable to find request");
            }
@@ -151,6 +147,12 @@ namespace Emby.Server.Implementations.QuickConnect
            // Change the time on the request so it expires one minute into the future. It can't expire immediately as otherwise some clients wouldn't ever see that they have been authenticated.
            result.DateAdded = DateTime.UtcNow.Add(TimeSpan.FromMinutes(1));

+            // The guard above is a read on shared state, so it cannot settle a race between instances; the claim can.
+            if (!await _store.TryClaimAuthorizationAsync(result.Secret, ExpiryOf(result)).ConfigureAwait(false))
+            {
+                throw new InvalidOperationException("Request is already authorized");
+            }
+
            var authenticationResult = await _sessionManager.AuthenticateDirect(new AuthenticationRequest
            {
                UserId = userId,
@@ -160,9 +162,10 @@ namespace Emby.Server.Implementations.QuickConnect
                AppVersion = result.AppVersion
            }).ConfigureAwait(false);

-            _authorizedSecrets[result.Secret] = (DateTime.UtcNow, authenticationResult);
            result.Authenticated = true;
-            _currentRequests[code] = result;
+
+            await _store.SetAuthorizationAsync(result.Secret, authenticationResult, DateTime.UtcNow.AddMinutes(Timeout)).ConfigureAwait(false);
+            await _store.SetRequestAsync(result, ExpiryOf(result)).ConfigureAwait(false);

            _logger.LogDebug("Authorizing device with code {Code} to login as user {UserId}", code, userId);

@@ -170,19 +173,21 @@ namespace Emby.Server.Implementations.QuickConnect
        }

        /// <inheritdoc/>
-        public AuthenticationResult GetAuthorizedRequest(string secret)
+        public async Task<AuthenticationResult> GetAuthorizedRequest(string secret)
        {
            AssertActive();
-            ExpireRequests();

-            if (!_authorizedSecrets.TryGetValue(secret, out var result))
+            var result = await _store.TryConsumeAuthorizationAsync(secret).ConfigureAwait(false);
+            if (result is null)
            {
                throw new ResourceNotFoundException("Unable to find request");
            }

-            return result.AuthenticationResult;
+            return result;
        }

+        private static DateTime ExpiryOf(QuickConnectResult request) => request.DateAdded.AddMinutes(Timeout);
+
        private string GenerateSecureRandom(int length = 32)
        {
            Span<byte> bytes = stackalloc byte[length];
@@ -190,42 +195,5 @@ namespace Emby.Server.Implementations.QuickConnect

            return Convert.ToHexString(bytes);
        }
-
-        /// <summary>
-        /// Expire quick connect requests that are over the time limit. If <paramref name="expireAll"/> is true, all requests are unconditionally expired.
-        /// </summary>
-        /// <param name="expireAll">If true, all requests will be expired.</param>
-        private void ExpireRequests(bool expireAll = false)
-        {
-            // All requests before this timestamp have expired
-            var minTime = DateTime.UtcNow.AddMinutes(-Timeout);
-
-            // Expire stale connection requests
-            foreach (var (_, currentRequest) in _currentRequests)
-            {
-                if (expireAll || currentRequest.DateAdded < minTime)
-                {
-                    var code = currentRequest.Code;
-                    _logger.LogDebug("Removing expired request {Code}", code);
-
-                    if (!_currentRequests.TryRemove(code, out _))
-                    {
-                        _logger.LogWarning("Request {Code} already expired", code);
-                    }
-                }
-            }
-
-            foreach (var (secret, (timestamp, _)) in _authorizedSecrets)
-            {
-                if (expireAll || timestamp < minTime)
-                {
-                    _logger.LogDebug("Removing expired secret {Secret}", secret);
-                    if (!_authorizedSecrets.TryRemove(secret, out _))
-                    {
-                        _logger.LogWarning("Secret {Secret} already expired", secret);
-                    }
-                }
-            }
-        }
    }
 }
@@ -0,0 +1,175 @@
+using System;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Jellyfin.Extensions.Json;
+using MediaBrowser.Controller.Authentication;
+using MediaBrowser.Controller.QuickConnect;
+using MediaBrowser.Model.QuickConnect;
+using Microsoft.Extensions.Logging;
+using StackExchange.Redis;
+
+namespace Emby.Server.Implementations.QuickConnect;
+
+/// <summary>
+/// A Redis-backed <see cref="IQuickConnectStore"/> that lets the initiate, authorize and exchange legs
+/// of a quick connect flow land on different instances. Expiry is the key TTL, an authorization is
+/// claimed with a Lua check-and-set and consumed with <c>GETDEL</c>, so only one instance can ever mint
+/// a given secret's access token and only one can ever hand it out.
+/// </summary>
+/// <remarks>
+/// A pending request survives an unreachable Redis through a process-local fallback, because a second
+/// copy of it is harmless. An authorization has none: a second copy of it is a second access token, and
+/// a write whose response timed out may well have been applied, so a transport failure on that path is
+/// surfaced rather than degraded.
+/// </remarks>
+public sealed class RedisQuickConnectStore : IQuickConnectStore
+{
+    private const string KeyPrefix = "jellyfin:quickconnect:";
+
+    /// <summary>
+    /// Lua script for the atomic claim of the sole right to authorize a request: the request has to
+    /// exist and not already be authorized, and the claim marker is taken with <c>SET NX</c>, so of two
+    /// instances racing on one code exactly one goes on to mint an access token.
+    /// </summary>
+    private const string ClaimAuthorizationScript = @"
+local raw = redis.call('GET', KEYS[1])
+if not raw then return 0 end
+if cjson.decode(raw)['Authenticated'] then return 0 end
+if redis.call('SET', KEYS[2], '1', 'NX', 'PX', ARGV[1]) then return 1 end
+return 0";
+
+    private readonly IDatabase _db;
+    private readonly InMemoryQuickConnectStore _fallback;
+    private readonly ILogger<RedisQuickConnectStore> _logger;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="RedisQuickConnectStore"/> class.
+    /// </summary>
+    /// <param name="redis">The Redis connection multiplexer.</param>
+    /// <param name="logger">The logger.</param>
+    public RedisQuickConnectStore(IConnectionMultiplexer redis, ILogger<RedisQuickConnectStore> logger)
+    {
+        ArgumentNullException.ThrowIfNull(redis);
+
+        _db = redis.GetDatabase();
+        _fallback = new InMemoryQuickConnectStore();
+        _logger = logger;
+    }
+
+    /// <inheritdoc />
+    public async Task<QuickConnectResult?> GetRequestBySecretAsync(string secret, CancellationToken cancellationToken = default)
+    {
+        RedisValue raw;
+        try
+        {
+            raw = await _db.StringGetAsync(RequestKey(secret)).ConfigureAwait(false);
+        }
+        catch (Exception ex) when (IsTransportFailure(ex))
+        {
+            LogDegraded(ex);
+            return await _fallback.GetRequestBySecretAsync(secret, cancellationToken).ConfigureAwait(false);
+        }
+
+        // A miss is an answer rather than a transport failure, so the fallback is not consulted for it.
+        return raw.HasValue ? JsonSerializer.Deserialize<QuickConnectResult>(raw.ToString(), JsonDefaults.Options) : null;
+    }
+
+    /// <inheritdoc />
+    public async Task<QuickConnectResult?> GetRequestByCodeAsync(string code, CancellationToken cancellationToken = default)
+    {
+        RedisValue secret;
+        try
+        {
+            secret = await _db.StringGetAsync(CodeKey(code)).ConfigureAwait(false);
+        }
+        catch (Exception ex) when (IsTransportFailure(ex))
+        {
+            LogDegraded(ex);
+            return await _fallback.GetRequestByCodeAsync(code, cancellationToken).ConfigureAwait(false);
+        }
+
+        return secret.HasValue
+            ? await GetRequestBySecretAsync(secret.ToString(), cancellationToken).ConfigureAwait(false)
+            : null;
+    }
+
+    /// <inheritdoc />
+    public async Task SetRequestAsync(QuickConnectResult request, DateTime expiresUtc, CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(request);
+
+        var ttl = expiresUtc - DateTime.UtcNow;
+        if (ttl <= TimeSpan.Zero)
+        {
+            return;
+        }
+
+        try
+        {
+            var json = JsonSerializer.Serialize(request, JsonDefaults.Options);
+            await _db.StringSetAsync(RequestKey(request.Secret), json, ttl).ConfigureAwait(false);
+            await _db.StringSetAsync(CodeKey(request.Code), request.Secret, ttl).ConfigureAwait(false);
+        }
+        catch (Exception ex) when (IsTransportFailure(ex))
+        {
+            LogDegraded(ex);
+            await _fallback.SetRequestAsync(request, expiresUtc, cancellationToken).ConfigureAwait(false);
+        }
+    }
+
+    /// <inheritdoc />
+    public async Task<bool> TryClaimAuthorizationAsync(string secret, DateTime expiresUtc, CancellationToken cancellationToken = default)
+    {
+        var ttl = expiresUtc - DateTime.UtcNow;
+        if (ttl <= TimeSpan.Zero)
+        {
+            return false;
+        }
+
+        var claimed = (long?)await _db.ScriptEvaluateAsync(
+            ClaimAuthorizationScript,
+            keys: new RedisKey[] { RequestKey(secret), ClaimKey(secret) },
+            values: new RedisValue[] { (long)ttl.TotalMilliseconds }).ConfigureAwait(false);
+
+        return claimed == 1;
+    }
+
+    /// <inheritdoc />
+    public async Task SetAuthorizationAsync(string secret, AuthenticationResult authenticationResult, DateTime expiresUtc, CancellationToken cancellationToken = default)
+    {
+        var ttl = expiresUtc - DateTime.UtcNow;
+        if (ttl <= TimeSpan.Zero)
+        {
+            return;
+        }
+
+        var json = JsonSerializer.Serialize(authenticationResult, JsonDefaults.Options);
+        await _db.StringSetAsync(AuthorizationKey(secret), json, ttl).ConfigureAwait(false);
+    }
+
+    /// <inheritdoc />
+    public async Task<AuthenticationResult?> TryConsumeAuthorizationAsync(string secret, CancellationToken cancellationToken = default)
+    {
+        var raw = await _db.StringGetDeleteAsync(AuthorizationKey(secret)).ConfigureAwait(false);
+
+        return raw.HasValue
+            ? JsonSerializer.Deserialize<AuthenticationResult>(raw.ToString(), JsonDefaults.Options)
+            : null;
+    }
+
+    // Deliberately excludes a malformed stored value, which is a fault of its own rather than a reason
+    // to answer from this instance.
+    private static bool IsTransportFailure(Exception exception) => exception is RedisException or TimeoutException;
+
+    private static string RequestKey(string secret) => KeyPrefix + "request:" + secret;
+
+    private static string CodeKey(string code) => KeyPrefix + "code:" + code;
+
+    private static string ClaimKey(string secret) => KeyPrefix + "claim:" + secret;
+
+    private static string AuthorizationKey(string secret) => KeyPrefix + "auth:" + secret;
+
+    private void LogDegraded(Exception exception)
+        => _logger.LogWarning(exception, "Quick connect request state could not be shared through Redis; falling back to this instance only.");
+}
@@ -0,0 +1,81 @@
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using MediaBrowser.Controller.ScheduledTasks;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+using StackExchange.Redis;
+
+namespace Emby.Server.Implementations.ScheduledTasks;
+
+/// <summary>
+/// A Redis-backed <see cref="IScanLeaderLease"/> that elects a single scan-leader instance using a
+/// TTL lease on a shared key. The lease value is this instance's pod identity; a leader that keeps
+/// renewing retains the lease, and any instance can claim it once the previous leader's lease expires.
+/// </summary>
+public sealed class RedisScanLeaderLease : IScanLeaderLease
+{
+    private const string LeaderKey = "jellyfin:scanleader";
+
+    /// <summary>
+    /// Lua script for atomic acquire-or-renew: if the key is unset (missing or already expired) it is
+    /// set to this pod for the lease duration and 1 is returned; if it already holds this pod the TTL is
+    /// extended and 1 is returned; otherwise another pod owns a live lease and 0 is returned.
+    /// </summary>
+    private const string AcquireOrRenewScript = @"
+local current = redis.call('GET', KEYS[1])
+if not current then
+    redis.call('SET', KEYS[1], ARGV[1], 'PX', ARGV[2])
+    return 1
+elseif current == ARGV[1] then
+    redis.call('PEXPIRE', KEYS[1], ARGV[2])
+    return 1
+else
+    return 0
+end";
+
+    private readonly IDatabase _db;
+    private readonly ScanLeaderOptions _options;
+    private readonly ILogger<RedisScanLeaderLease> _logger;
+    private readonly string _podId;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="RedisScanLeaderLease"/> class.
+    /// </summary>
+    /// <param name="redis">The Redis connection multiplexer.</param>
+    /// <param name="options">The scan-leader configuration options.</param>
+    /// <param name="logger">The logger.</param>
+    public RedisScanLeaderLease(
+        IConnectionMultiplexer redis,
+        IOptions<ScanLeaderOptions> options,
+        ILogger<RedisScanLeaderLease> logger)
+    {
+        _db = redis.GetDatabase();
+        _options = options.Value;
+        _logger = logger;
+        _podId = Environment.GetEnvironmentVariable("JELLYFIN_INSTANCE_ID") ?? Environment.MachineName;
+    }
+
+    /// <inheritdoc />
+    public async Task<bool> TryAcquireOrRenewAsync(CancellationToken cancellationToken = default)
+    {
+        var leaseDurationMs = (long)_options.LeaseDurationSeconds * 1000;
+
+        try
+        {
+            var result = (long?)await _db.ScriptEvaluateAsync(
+                AcquireOrRenewScript,
+                keys: new RedisKey[] { LeaderKey },
+                values: new RedisValue[] { _podId, leaseDurationMs }).ConfigureAwait(false);
+
+            return result == 1;
+        }
+        catch (Exception ex)
+        {
+            // Fail-safe: if Redis is unreachable, treat this instance as the leader so scheduled scans
+            // keep running. Every instance scanning is preferable to no instance scanning.
+            _logger.LogWarning(ex, "Scan-leader lease evaluation failed; treating {PodId} as leader.", _podId);
+            return true;
+        }
+    }
+}
@@ -13,6 +13,7 @@ using Jellyfin.Data.Events;
 using Jellyfin.Extensions.Json;
 using MediaBrowser.Common.Configuration;
 using MediaBrowser.Common.Extensions;
+using MediaBrowser.Controller.ScheduledTasks;
 using MediaBrowser.Model.Tasks;
 using Microsoft.Extensions.Logging;

@@ -27,6 +28,8 @@ public class ScheduledTaskWorker : IScheduledTaskWorker
    private readonly IApplicationPaths _applicationPaths;
    private readonly ILogger _logger;
    private readonly ITaskManager _taskManager;
+    private readonly IScanLeaderLease _scanLeaderLease;
+    private readonly ScanLeaderOptions _scanLeaderOptions;
    private readonly Lock _lastExecutionResultSyncLock = new();
    private bool _readFromFile;
    private TaskResult _lastExecutionResult;
@@ -41,6 +44,8 @@ public class ScheduledTaskWorker : IScheduledTaskWorker
    /// <param name="applicationPaths">The application paths.</param>
    /// <param name="taskManager">The task manager.</param>
    /// <param name="logger">The logger.</param>
+    /// <param name="scanLeaderLease">The scan-leader lease used to gate periodic library-mutating tasks, or <c>null</c> to disable gating.</param>
+    /// <param name="scanLeaderOptions">The scan-leader options, or <c>null</c> to disable gating.</param>
    /// <exception cref="ArgumentNullException">
    /// scheduledTask
    /// or
@@ -52,7 +57,13 @@ public class ScheduledTaskWorker : IScheduledTaskWorker
    /// or
    /// logger.
    /// </exception>
-    public ScheduledTaskWorker(IScheduledTask scheduledTask, IApplicationPaths applicationPaths, ITaskManager taskManager, ILogger logger)
+    public ScheduledTaskWorker(
+        IScheduledTask scheduledTask,
+        IApplicationPaths applicationPaths,
+        ITaskManager taskManager,
+        ILogger logger,
+        IScanLeaderLease scanLeaderLease = null,
+        ScanLeaderOptions scanLeaderOptions = null)
    {
        ArgumentNullException.ThrowIfNull(scheduledTask);
        ArgumentNullException.ThrowIfNull(applicationPaths);
@@ -63,6 +74,8 @@ public class ScheduledTaskWorker : IScheduledTaskWorker
        _applicationPaths = applicationPaths;
        _taskManager = taskManager;
        _logger = logger;
+        _scanLeaderLease = scanLeaderLease;
+        _scanLeaderOptions = scanLeaderOptions;

        InitTriggerEvents();
    }
@@ -268,6 +281,20 @@ public class ScheduledTaskWorker : IScheduledTaskWorker

        trigger.Stop();

+        if (_scanLeaderLease is not null
+            && _scanLeaderOptions is not null
+            && _scanLeaderOptions.Enabled
+            && _scanLeaderOptions.GatedTaskKeys is not null
+            && _scanLeaderOptions.GatedTaskKeys.Contains(ScheduledTask.Key, StringComparer.Ordinal)
+            && !await _scanLeaderLease.TryAcquireOrRenewAsync().ConfigureAwait(false))
+        {
+            _logger.LogDebug("Skipping gated task {Task}: this instance does not hold the scan-leader lease.", Name);
+
+            // Re-arm the trigger for the next interval without enqueueing on this instance.
+            trigger.Start(LastExecutionResult, _logger, Name, false);
+            return;
+        }
+
        _taskManager.QueueScheduledTask(ScheduledTask, trigger.TaskOptions);

        await Task.Delay(1000).ConfigureAwait(false);
@@ -5,8 +5,10 @@ using System.Linq;
 using System.Threading.Tasks;
 using Jellyfin.Data.Events;
 using MediaBrowser.Common.Configuration;
+using MediaBrowser.Controller.ScheduledTasks;
 using MediaBrowser.Model.Tasks;
 using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;

 namespace Emby.Server.Implementations.ScheduledTasks;

@@ -23,18 +25,26 @@ public class TaskManager : ITaskManager

    private readonly IApplicationPaths _applicationPaths;
    private readonly ILogger<TaskManager> _logger;
+    private readonly IScanLeaderLease? _scanLeaderLease;
+    private readonly ScanLeaderOptions? _scanLeaderOptions;

    /// <summary>
    /// Initializes a new instance of the <see cref="TaskManager" /> class.
    /// </summary>
    /// <param name="applicationPaths">The application paths.</param>
    /// <param name="logger">The logger.</param>
+    /// <param name="scanLeaderLease">The scan-leader lease used to gate periodic library-mutating tasks, or <c>null</c> to disable gating.</param>
+    /// <param name="scanLeaderOptions">The scan-leader options, or <c>null</c> to disable gating.</param>
    public TaskManager(
        IApplicationPaths applicationPaths,
-        ILogger<TaskManager> logger)
+        ILogger<TaskManager> logger,
+        IScanLeaderLease? scanLeaderLease = null,
+        IOptions<ScanLeaderOptions>? scanLeaderOptions = null)
    {
        _applicationPaths = applicationPaths;
        _logger = logger;
+        _scanLeaderLease = scanLeaderLease;
+        _scanLeaderOptions = scanLeaderOptions?.Value;

        ScheduledTasks = [];
    }
@@ -175,7 +185,7 @@ public class TaskManager : ITaskManager
    /// <inheritdoc />
    public void AddTasks(IEnumerable<IScheduledTask> tasks)
    {
-        var list = tasks.Select(t => new ScheduledTaskWorker(t, _applicationPaths, this, _logger));
+        var list = tasks.Select(t => new ScheduledTaskWorker(t, _applicationPaths, this, _logger, _scanLeaderLease, _scanLeaderOptions));

        ScheduledTasks = ScheduledTasks.Concat(list).ToArray();
    }
@@ -5,6 +5,7 @@ using System.Threading;
 using System.Threading.Tasks;
 using MediaBrowser.Common.Configuration;
 using MediaBrowser.Controller.IO;
+using MediaBrowser.Controller.MediaEncoding;
 using MediaBrowser.Model.Globalization;
 using MediaBrowser.Model.IO;
 using MediaBrowser.Model.Tasks;
@@ -21,6 +22,7 @@ public class DeleteTranscodeFileTask : IScheduledTask, IConfigurableScheduledTas
    private readonly IConfigurationManager _configurationManager;
    private readonly IFileSystem _fileSystem;
    private readonly ILocalizationManager _localization;
+    private readonly ITranscodeSessionStore _sessionStore;

    /// <summary>
    /// Initializes a new instance of the <see cref="DeleteTranscodeFileTask"/> class.
@@ -29,16 +31,19 @@ public class DeleteTranscodeFileTask : IScheduledTask, IConfigurableScheduledTas
    /// <param name="fileSystem">Instance of the <see cref="IFileSystem"/> interface.</param>
    /// <param name="configurationManager">Instance of the <see cref="IConfigurationManager"/> interface.</param>
    /// <param name="localization">Instance of the <see cref="ILocalizationManager"/> interface.</param>
+    /// <param name="sessionStore">Instance of the <see cref="ITranscodeSessionStore"/> interface.</param>
    public DeleteTranscodeFileTask(
        ILogger<DeleteTranscodeFileTask> logger,
        IFileSystem fileSystem,
        IConfigurationManager configurationManager,
-        ILocalizationManager localization)
+        ILocalizationManager localization,
+        ITranscodeSessionStore sessionStore)
    {
        _logger = logger;
        _fileSystem = fileSystem;
        _configurationManager = configurationManager;
        _localization = localization;
+        _sessionStore = sessionStore;
    }

    /// <inheritdoc />
@@ -78,25 +83,39 @@ public class DeleteTranscodeFileTask : IScheduledTask, IConfigurableScheduledTas
    }

    /// <inheritdoc />
-    public Task ExecuteAsync(IProgress<double> progress, CancellationToken cancellationToken)
+    public async Task ExecuteAsync(IProgress<double> progress, CancellationToken cancellationToken)
    {
        var minDateModified = DateTime.UtcNow.AddDays(-1);
        progress.Report(50);

-        DeleteTempFilesFromDirectory(_configurationManager.GetTranscodePath(), minDateModified, progress, cancellationToken);
+        IEnumerable<TranscodeSession> activeSessions;
+        try
+        {
+            activeSessions = await _sessionStore.GetActiveSessionsAsync(cancellationToken).ConfigureAwait(false);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Failed to retrieve active transcode sessions. Skipping deletion to avoid removing files in use.");
+            progress.Report(100);
+            return;
+        }

-        return Task.CompletedTask;
+        DeleteTempFilesFromDirectory(_configurationManager.GetTranscodePath(), minDateModified, activeSessions, progress, cancellationToken);
    }

    /// <summary>
-    /// Deletes the transcoded temp files from directory with a last write time less than a given date.
+    /// Deletes the transcoded temp files from directory with a last write time less than a given date,
+    /// skipping any files that belong to an active transcode session.
    /// </summary>
    /// <param name="directory">The directory.</param>
    /// <param name="minDateModified">The min date modified.</param>
+    /// <param name="activeSessions">The currently active transcode sessions.</param>
    /// <param name="progress">The progress.</param>
    /// <param name="cancellationToken">The task cancellation token.</param>
-    private void DeleteTempFilesFromDirectory(string directory, DateTime minDateModified, IProgress<double> progress, CancellationToken cancellationToken)
+    private void DeleteTempFilesFromDirectory(string directory, DateTime minDateModified, IEnumerable<TranscodeSession> activeSessions, IProgress<double> progress, CancellationToken cancellationToken)
    {
+        var activeSessionList = activeSessions.ToList();
+
        var filesToDelete = _fileSystem.GetFiles(directory, true)
            .Where(f => _fileSystem.GetLastWriteTimeUtc(f) < minDateModified)
            .ToList();
@@ -112,6 +131,13 @@ public class DeleteTranscodeFileTask : IScheduledTask, IConfigurableScheduledTas

            cancellationToken.ThrowIfCancellationRequested();

+            if (IsFileProtectedByActiveSession(file.FullName, activeSessionList))
+            {
+                _logger.LogDebug("Skipping deletion of {FilePath} as it belongs to an active transcode session.", file.FullName);
+                index++;
+                continue;
+            }
+
            FileSystemHelper.DeleteFile(_fileSystem, file.FullName, _logger);

            index++;
@@ -121,4 +147,24 @@ public class DeleteTranscodeFileTask : IScheduledTask, IConfigurableScheduledTas

        progress.Report(100);
    }
+
+    private static bool IsFileProtectedByActiveSession(string filePath, IList<TranscodeSession> activeSessions)
+    {
+        foreach (var session in activeSessions)
+        {
+            if (!string.IsNullOrEmpty(session.ManifestPath) &&
+                string.Equals(filePath, session.ManifestPath, StringComparison.OrdinalIgnoreCase))
+            {
+                return true;
+            }
+
+            if (!string.IsNullOrEmpty(session.SegmentPathPrefix) &&
+                filePath.StartsWith(session.SegmentPathPrefix, StringComparison.OrdinalIgnoreCase))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
 }
@@ -256,7 +256,7 @@ namespace Emby.Server.Implementations.Session
            ArgumentException.ThrowIfNullOrEmpty(deviceId);

            var activityDate = DateTime.UtcNow;
-            var session = GetSessionInfo(appName, appVersion, deviceId, deviceName, remoteEndPoint, user);
+            var session = await GetSessionInfo(appName, appVersion, deviceId, deviceName, remoteEndPoint, user).ConfigureAwait(false);
            var lastActivityDate = session.LastActivityDate;
            session.LastActivityDate = activityDate;

@@ -491,7 +491,7 @@ namespace Emby.Server.Implementations.Session
        /// <param name="remoteEndPoint">The remote end point.</param>
        /// <param name="user">The user.</param>
        /// <returns>SessionInfo.</returns>
-        private SessionInfo GetSessionInfo(
+        private async Task<SessionInfo> GetSessionInfo(
            string appName,
            string appVersion,
            string deviceId,
@@ -504,7 +504,7 @@ namespace Emby.Server.Implementations.Session
            ArgumentException.ThrowIfNullOrEmpty(deviceId);

            var key = GetSessionKey(appName, deviceId, user?.Id ?? Guid.Empty);
-            SessionInfo newSession = CreateSessionInfo(key, appName, appVersion, deviceId, deviceName, remoteEndPoint, user);
+            SessionInfo newSession = await CreateSessionInfo(key, appName, appVersion, deviceId, deviceName, remoteEndPoint, user).ConfigureAwait(false);
            SessionInfo sessionInfo = _activeConnections.GetOrAdd(key, newSession);
            if (ReferenceEquals(newSession, sessionInfo))
            {
@@ -532,7 +532,7 @@ namespace Emby.Server.Implementations.Session
            return sessionInfo;
        }

-        private SessionInfo CreateSessionInfo(
+        private async Task<SessionInfo> CreateSessionInfo(
            string key,
            string appName,
            string appVersion,
@@ -562,7 +562,7 @@ namespace Emby.Server.Implementations.Session
                deviceName = "Network Device";
            }

-            var deviceOptions = _deviceManager.GetDeviceOptions(deviceId) ?? new()
+            var deviceOptions = await _deviceManager.GetDeviceOptions(deviceId).ConfigureAwait(false) ?? new()
            {
                DeviceId = deviceId
            };
@@ -1768,12 +1768,12 @@ namespace Emby.Server.Implementations.Session
            // This should be validated above, but if it isn't don't delete all tokens.
            ArgumentException.ThrowIfNullOrEmpty(deviceId);

-            var existing = _deviceManager.GetDevices(
+            var existing = (await _deviceManager.GetDevices(
                new DeviceQuery
                {
                    DeviceId = deviceId,
                    UserId = user.Id
-                }).Items;
+                }).ConfigureAwait(false)).Items;

            foreach (var auth in existing)
            {
@@ -1801,12 +1801,12 @@ namespace Emby.Server.Implementations.Session

            ArgumentException.ThrowIfNullOrEmpty(accessToken);

-            var existing = _deviceManager.GetDevices(
+            var existing = (await _deviceManager.GetDevices(
                new DeviceQuery
                {
                    Limit = 1,
                    AccessToken = accessToken
-                }).Items;
+                }).ConfigureAwait(false)).Items;

            if (existing.Count > 0)
            {
@@ -1845,10 +1845,10 @@ namespace Emby.Server.Implementations.Session
        {
            CheckDisposed();

-            var existing = _deviceManager.GetDevices(new DeviceQuery
+            var existing = await _deviceManager.GetDevices(new DeviceQuery
            {
                UserId = userId
-            });
+            }).ConfigureAwait(false);

            foreach (var info in existing.Items)
            {
@@ -2045,11 +2045,11 @@ namespace Emby.Server.Implementations.Session
        /// <inheritdoc />
        public async Task<SessionInfo> GetSessionByAuthenticationToken(string token, string deviceId, string remoteEndpoint)
        {
-            var items = _deviceManager.GetDevices(new DeviceQuery
+            var items = (await _deviceManager.GetDevices(new DeviceQuery
            {
                AccessToken = token,
                Limit = 1
-            }).Items;
+            }).ConfigureAwait(false)).Items;

            if (items.Count == 0)
            {
@@ -1,6 +1,7 @@
 #nullable disable

 using System;
+using System.Collections.Generic;
 using Jellyfin.Data.Enums;
 using Jellyfin.Database.Implementations.Entities;
 using MediaBrowser.Controller.Entities;
@@ -27,6 +28,12 @@ namespace Emby.Server.Implementations.Sorting
        /// <value>The user manager.</value>
        public IUserManager UserManager { get; set; }

+        /// <summary>
+        /// Gets or sets the prefetched user data.
+        /// </summary>
+        /// <value>The prefetched user data.</value>
+        public IReadOnlyDictionary<Guid, UserItemData> PrefetchedUserData { get; set; }
+
        /// <summary>
        /// Gets or sets the user data manager.
        /// </summary>
@@ -57,7 +64,7 @@ namespace Emby.Server.Implementations.Sorting
        /// <returns>DateTime.</returns>
        private DateTime GetDate(BaseItem x)
        {
-            var userdata = UserDataManager.GetUserData(User, x);
+            var userdata = this.GetUserData(x);

            if (userdata is not null && userdata.LastPlayedDate.HasValue)
            {
@@ -1,6 +1,8 @@
 #nullable disable
 #pragma warning disable CS1591

+using System;
+using System.Collections.Generic;
 using Jellyfin.Data.Enums;
 using Jellyfin.Database.Implementations.Entities;
 using MediaBrowser.Controller.Entities;
@@ -35,6 +37,12 @@ namespace Emby.Server.Implementations.Sorting
        /// <value>The user manager.</value>
        public IUserManager UserManager { get; set; }

+        /// <summary>
+        /// Gets or sets the prefetched user data.
+        /// </summary>
+        /// <value>The prefetched user data.</value>
+        public IReadOnlyDictionary<Guid, UserItemData> PrefetchedUserData { get; set; }
+
        /// <summary>
        /// Compares the specified x.
        /// </summary>
@@ -53,7 +61,7 @@ namespace Emby.Server.Implementations.Sorting
        /// <returns>DateTime.</returns>
        private int GetValue(BaseItem x)
        {
-            return x.IsFavoriteOrLiked(User, userItemData: null) ? 0 : 1;
+            return x.IsFavoriteOrLiked(User, this.GetUserData(x)) ? 0 : 1;
        }
    }
 }
@@ -2,6 +2,8 @@

 #pragma warning disable CS1591

+using System;
+using System.Collections.Generic;
 using Jellyfin.Data.Enums;
 using Jellyfin.Database.Implementations.Entities;
 using MediaBrowser.Controller.Entities;
@@ -36,6 +38,12 @@ namespace Emby.Server.Implementations.Sorting
        /// <value>The user manager.</value>
        public IUserManager UserManager { get; set; }

+        /// <summary>
+        /// Gets or sets the prefetched user data.
+        /// </summary>
+        /// <value>The prefetched user data.</value>
+        public IReadOnlyDictionary<Guid, UserItemData> PrefetchedUserData { get; set; }
+
        /// <summary>
        /// Compares the specified x.
        /// </summary>
@@ -54,7 +62,7 @@ namespace Emby.Server.Implementations.Sorting
        /// <returns>DateTime.</returns>
        private int GetValue(BaseItem x)
        {
-            return x.IsPlayed(User, userItemData: null) ? 0 : 1;
+            return x.IsPlayed(User, this.GetUserData(x)) ? 0 : 1;
        }
    }
 }
@@ -2,6 +2,8 @@

 #pragma warning disable CS1591

+using System;
+using System.Collections.Generic;
 using Jellyfin.Data.Enums;
 using Jellyfin.Database.Implementations.Entities;
 using MediaBrowser.Controller.Entities;
@@ -36,6 +38,12 @@ namespace Emby.Server.Implementations.Sorting
        /// <value>The user manager.</value>
        public IUserManager UserManager { get; set; }

+        /// <summary>
+        /// Gets or sets the prefetched user data.
+        /// </summary>
+        /// <value>The prefetched user data.</value>
+        public IReadOnlyDictionary<Guid, UserItemData> PrefetchedUserData { get; set; }
+
        /// <summary>
        /// Compares the specified x.
        /// </summary>
@@ -54,7 +62,7 @@ namespace Emby.Server.Implementations.Sorting
        /// <returns>DateTime.</returns>
        private int GetValue(BaseItem x)
        {
-            return x.IsUnplayed(User, userItemData: null) ? 0 : 1;
+            return x.IsUnplayed(User, this.GetUserData(x)) ? 0 : 1;
        }
    }
 }
@@ -1,5 +1,7 @@
 #nullable disable

+using System;
+using System.Collections.Generic;
 using Jellyfin.Data.Enums;
 using Jellyfin.Database.Implementations.Entities;
 using MediaBrowser.Controller.Entities;
@@ -38,6 +40,12 @@ namespace Emby.Server.Implementations.Sorting
        /// <value>The user manager.</value>
        public IUserManager UserManager { get; set; }

+        /// <summary>
+        /// Gets or sets the prefetched user data.
+        /// </summary>
+        /// <value>The prefetched user data.</value>
+        public IReadOnlyDictionary<Guid, UserItemData> PrefetchedUserData { get; set; }
+
        /// <summary>
        /// Compares the specified x.
        /// </summary>
@@ -56,7 +64,7 @@ namespace Emby.Server.Implementations.Sorting
        /// <returns>DateTime.</returns>
        private int GetValue(BaseItem x)
        {
-            var userdata = UserDataManager.GetUserData(User, x);
+            var userdata = this.GetUserData(x);

            return userdata is null ? 0 : userdata.PlayCount;
        }
@@ -13,6 +13,7 @@ using MediaBrowser.Controller.Configuration;
 using MediaBrowser.Controller.Dto;
 using MediaBrowser.Controller.Entities;
 using MediaBrowser.Controller.Library;
+using MediaBrowser.Controller.Persistence;
 using MediaBrowser.Controller.TV;
 using MediaBrowser.Model.Querying;
 using Episode = MediaBrowser.Controller.Entities.TV.Episode;
@@ -124,53 +125,100 @@ namespace Emby.Server.Implementations.TV

            var batchResult = _libraryManager.GetNextUpEpisodesBatch(query, seriesKeys, includeSpecials, includeRewatching);

-            var nextUpList = new List<(DateTime LastWatchedDate, Episode Episode)>();
-
+            var results = new List<NextUpEpisodeBatchResult>(seriesKeys.Count);
            foreach (var seriesKey in seriesKeys)
            {
-                if (!batchResult.TryGetValue(seriesKey, out var result))
+                if (batchResult.TryGetValue(seriesKey, out var result))
                {
-                    continue;
+                    results.Add(result);
                }
+            }

-                var nextEpisode = DetermineNextEpisode(result, user, includeSpecials, request.EnableResumable, false);
+            // The selection below tests the played state of every episode it considers, so read the whole
+            // series batch in one query rather than one query per series.
+            var selectionCandidates = new List<BaseItem>();
+            foreach (var result in results)
+            {
+                AddCandidate(selectionCandidates, result.NextUp);
+                AddCandidate(selectionCandidates, result.LastWatched);
+                AddCandidate(selectionCandidates, result.NextPlayedForRewatching);
+                AddCandidate(selectionCandidates, result.LastWatchedForRewatching);

+                if (result.Specials is not null)
+                {
+                    selectionCandidates.AddRange(result.Specials);
+                }
+            }
+
+            var selectionUserData = _userDataManager.GetUserDataBatch(selectionCandidates, user);
+
+            var candidates = new List<NextUpCandidate>();
+            foreach (var result in results)
+            {
+                var nextEpisode = SelectNextEpisode(result, user, includeSpecials, includePlayed: false, selectionUserData);
                if (nextEpisode is not null)
                {
-                    // The last played date and the version that was actually played live on the version item's user data
-                    // The played state propagated to the sibling versions carries no date
-                    var (playedVersion, lastPlayedDate) = GetMostRecentlyPlayedVersion(result.LastWatched, user);
-                    nextEpisode = GetPreferredVersion(nextEpisode, result.LastWatched, playedVersion);
-
-                    DateTime lastWatchedDate = DateTime.MinValue;
-                    if (result.LastWatched is not null)
-                    {
-                        lastWatchedDate = lastPlayedDate ?? DateTime.MinValue.AddDays(1);
-                    }
-
-                    nextUpList.Add((lastWatchedDate, nextEpisode));
+                    candidates.Add(new NextUpCandidate(nextEpisode, result.LastWatched, !request.EnableResumable));
                }

                if (includeRewatching)
                {
-                    var nextPlayedEpisode = DetermineNextEpisodeForRewatching(result, user, includeSpecials);
-
+                    var nextPlayedEpisode = SelectNextEpisode(result, user, includeSpecials, includePlayed: true, selectionUserData);
                    if (nextPlayedEpisode is not null)
                    {
-                        var (playedVersion, lastPlayedDate) = GetMostRecentlyPlayedVersion(result.LastWatchedForRewatching, user);
-                        nextPlayedEpisode = GetPreferredVersion(nextPlayedEpisode, result.LastWatchedForRewatching, playedVersion);
-
-                        DateTime rewatchLastWatchedDate = DateTime.MinValue;
-                        if (result.LastWatchedForRewatching is not null)
-                        {
-                            rewatchLastWatchedDate = lastPlayedDate ?? DateTime.MinValue.AddDays(1);
-                        }
-
-                        nextUpList.Add((rewatchLastWatchedDate, nextPlayedEpisode));
+                        // A rewatch suggestion is dropped once it has been resumed, whatever the request asked for.
+                        candidates.Add(new NextUpCandidate(nextPlayedEpisode, result.LastWatchedForRewatching, true));
                    }
                }
            }

+            // The resume progress may live on an alternate version, so read every version in one query.
+            var episodeVersions = new List<BaseItem>();
+            foreach (var candidate in candidates)
+            {
+                if (candidate.DropWhenResumed)
+                {
+                    candidate.EpisodeVersions = candidate.Episode.GetAllVersions();
+                    episodeVersions.AddRange(candidate.EpisodeVersions);
+                }
+            }
+
+            if (episodeVersions.Count > 0)
+            {
+                var resumeUserData = _userDataManager.GetUserDataBatch(episodeVersions, user);
+                candidates.RemoveAll(candidate => candidate.EpisodeVersions
+                    .Any(version => GetUserData(user, version, resumeUserData)?.PlaybackPositionTicks > 0));
+            }
+
+            // The last played date and the version that was actually played live on the version item's user data
+            // The played state propagated to the sibling versions carries no date
+            var lastWatchedVersions = new List<BaseItem>();
+            foreach (var candidate in candidates)
+            {
+                if (candidate.LastWatched is Video lastWatchedVideo)
+                {
+                    candidate.LastWatchedVersions = lastWatchedVideo.GetAllVersions();
+                    lastWatchedVersions.AddRange(candidate.LastWatchedVersions);
+                }
+            }
+
+            var lastWatchedUserData = _userDataManager.GetUserDataBatch(lastWatchedVersions, user);
+
+            var nextUpList = new List<(DateTime LastWatchedDate, Episode Episode)>(candidates.Count);
+            foreach (var candidate in candidates)
+            {
+                var (playedVersion, lastPlayedDate) = GetMostRecentlyPlayedVersion(candidate.LastWatchedVersions, user, lastWatchedUserData);
+                var nextEpisode = GetPreferredVersion(candidate.Episode, candidate.LastWatched, playedVersion);
+
+                DateTime lastWatchedDate = DateTime.MinValue;
+                if (candidate.LastWatched is not null)
+                {
+                    lastWatchedDate = lastPlayedDate ?? DateTime.MinValue.AddDays(1);
+                }
+
+                nextUpList.Add((lastWatchedDate, nextEpisode));
+            }
+
            var sortedEpisodes = nextUpList
                .OrderByDescending(x => x.LastWatchedDate)
                .Select(x => (BaseItem)x.Episode);
@@ -178,12 +226,25 @@ namespace Emby.Server.Implementations.TV
            return GetResult(sortedEpisodes, request);
        }

-        private Episode? DetermineNextEpisode(
-            MediaBrowser.Controller.Persistence.NextUpEpisodeBatchResult result,
+        private static void AddCandidate(List<BaseItem> candidates, BaseItem? item)
+        {
+            if (item is not null)
+            {
+                candidates.Add(item);
+            }
+        }
+
+        private UserItemData? GetUserData(User user, BaseItem item, IReadOnlyDictionary<Guid, UserItemData> prefetchedUserData)
+            => prefetchedUserData.TryGetValue(item.Id, out var userData)
+                ? userData
+                : _userDataManager.GetUserData(user, item);
+
+        private Episode? SelectNextEpisode(
+            NextUpEpisodeBatchResult result,
            User user,
            bool includeSpecials,
-            bool includeResumable,
-            bool includePlayed)
+            bool includePlayed,
+            IReadOnlyDictionary<Guid, UserItemData> prefetchedUserData)
        {
            var nextEpisode = (includePlayed ? result.NextPlayedForRewatching : result.NextUp) as Episode;
            var lastWatchedEpisode = (includePlayed ? result.LastWatchedForRewatching : result.LastWatched) as Episode;
@@ -217,60 +278,41 @@ namespace Emby.Server.Implementations.TV

                    if (!includePlayed)
                    {
-                        sortedEpisodes = sortedEpisodes.Where(episode => _userDataManager.GetUserData(user, episode) is not { Played: true });
+                        sortedEpisodes = sortedEpisodes.Where(episode => GetUserData(user, episode, prefetchedUserData) is not { Played: true });
                    }

                    nextEpisode = sortedEpisodes.FirstOrDefault();
                }
            }

-            if (nextEpisode is not null && !includeResumable)
-            {
-                // The resume progress may live on an alternate version
-                foreach (var version in nextEpisode.GetAllVersions())
-                {
-                    if (_userDataManager.GetUserData(user, version)?.PlaybackPositionTicks > 0)
-                    {
-                        return null;
-                    }
-                }
-            }
-
            return nextEpisode;
        }

-        private Episode? DetermineNextEpisodeForRewatching(
-            MediaBrowser.Controller.Persistence.NextUpEpisodeBatchResult result,
-            User user,
-            bool includeSpecials)
-        {
-            return DetermineNextEpisode(result, user, includeSpecials, includeResumable: false, includePlayed: true);
-        }
-
        /// <summary>
        /// Gets the version of the last watched episode that was actually played, together with its last played date.
        /// The version that was played carries the most recent LastPlayedDate.
        /// dates.
        /// </summary>
-        /// <param name="lastWatched">The last watched episode (any version).</param>
+        /// <param name="versions">The versions of the last watched episode.</param>
        /// <param name="user">The user.</param>
+        /// <param name="prefetchedUserData">User data read for every version up front.</param>
        /// <returns>The played version and its last played date.</returns>
-        private (Video? PlayedVersion, DateTime? LastPlayedDate) GetMostRecentlyPlayedVersion(BaseItem? lastWatched, User user)
+        private (Video? PlayedVersion, DateTime? LastPlayedDate) GetMostRecentlyPlayedVersion(
+            IReadOnlyList<Video> versions,
+            User user,
+            IReadOnlyDictionary<Guid, UserItemData> prefetchedUserData)
        {
-            if (lastWatched is not Video lastWatchedVideo)
+            if (versions.Count == 0)
            {
                return (null, null);
            }

-            var versions = lastWatchedVideo.GetAllVersions();
-            var userDataByVersion = _userDataManager.GetUserDataBatch(versions, user);
-
            var playedVersion = VersionPlaybackSelector.SelectMostRecentlyPlayed(
                versions,
-                version => userDataByVersion.GetValueOrDefault(version.Id),
+                version => GetUserData(user, version, prefetchedUserData),
                data => data.LastPlayedDate.HasValue);

-            return (playedVersion, playedVersion is null ? null : userDataByVersion[playedVersion.Id].LastPlayedDate);
+            return (playedVersion, playedVersion is null ? null : GetUserData(user, playedVersion, prefetchedUserData)?.LastPlayedDate);
        }

        /// <summary>
@@ -346,5 +388,28 @@ namespace Emby.Server.Implementations.TV
                totalCount,
                items.ToArray());
        }
+
+        /// <summary>
+        /// An episode picked for Next Up, together with the versions its user data is read from.
+        /// </summary>
+        private sealed class NextUpCandidate
+        {
+            public NextUpCandidate(Episode episode, BaseItem? lastWatched, bool dropWhenResumed)
+            {
+                Episode = episode;
+                LastWatched = lastWatched;
+                DropWhenResumed = dropWhenResumed;
+            }
+
+            public Episode Episode { get; }
+
+            public BaseItem? LastWatched { get; }
+
+            public bool DropWhenResumed { get; }
+
+            public IReadOnlyList<Video> EpisodeVersions { get; set; } = [];
+
+            public IReadOnlyList<Video> LastWatchedVersions { get; set; } = [];
+        }
    }
 }
@@ -50,10 +50,10 @@ public class DevicesController : BaseJellyfinApiController
    /// <returns>An <see cref="OkResult"/> containing the list of devices.</returns>
    [HttpGet]
    [ProducesResponseType(StatusCodes.Status200OK)]
-    public ActionResult<QueryResult<DeviceInfoDto>> GetDevices([FromQuery] Guid? userId)
+    public async Task<ActionResult<QueryResult<DeviceInfoDto>>> GetDevices([FromQuery] Guid? userId)
    {
        userId = RequestHelpers.GetUserId(User, userId);
-        return _deviceManager.GetDevicesForUser(userId);
+        return await _deviceManager.GetDevicesForUser(userId).ConfigureAwait(false);
    }

    /// <summary>
@@ -66,9 +66,9 @@ public class DevicesController : BaseJellyfinApiController
    [HttpGet("Info")]
    [ProducesResponseType(StatusCodes.Status200OK)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
-    public ActionResult<DeviceInfoDto> GetDeviceInfo([FromQuery, Required] string id)
+    public async Task<ActionResult<DeviceInfoDto>> GetDeviceInfo([FromQuery, Required] string id)
    {
-        var deviceInfo = _deviceManager.GetDevice(id);
+        var deviceInfo = await _deviceManager.GetDevice(id).ConfigureAwait(false);
        if (deviceInfo is null)
        {
            return NotFound();
@@ -87,9 +87,9 @@ public class DevicesController : BaseJellyfinApiController
    [HttpGet("Options")]
    [ProducesResponseType(StatusCodes.Status200OK)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
-    public ActionResult<DeviceOptionsDto> GetDeviceOptions([FromQuery, Required] string id)
+    public async Task<ActionResult<DeviceOptionsDto>> GetDeviceOptions([FromQuery, Required] string id)
    {
-        var deviceInfo = _deviceManager.GetDeviceOptions(id);
+        var deviceInfo = await _deviceManager.GetDeviceOptions(id).ConfigureAwait(false);
        if (deviceInfo is null)
        {
            return NotFound();
@@ -127,7 +127,12 @@ public class DevicesController : BaseJellyfinApiController
    [ProducesResponseType(StatusCodes.Status400BadRequest)]
    public async Task<ActionResult> DeleteDevice([FromQuery] string[] id)
    {
-        var devices = id.Select(_deviceManager.GetDevice).ToArray();
+        var devices = new List<DeviceInfoDto?>(id.Length);
+        foreach (var deviceId in id)
+        {
+            devices.Add(await _deviceManager.GetDevice(deviceId).ConfigureAwait(false));
+        }
+
        if (devices.Any(f => f is null))
        {
            return BadRequest();
@@ -135,7 +140,7 @@ public class DevicesController : BaseJellyfinApiController

        foreach (var device in devices)
        {
-            var sessions = _deviceManager.GetDevices(new DeviceQuery { DeviceId = device!.Id });
+            var sessions = await _deviceManager.GetDevices(new DeviceQuery { DeviceId = device!.Id }).ConfigureAwait(false);

            foreach (var session in sessions.Items)
            {
@@ -29,6 +29,7 @@ using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;

 namespace Jellyfin.Api.Controllers;

@@ -44,6 +45,8 @@ public class DynamicHlsController : BaseJellyfinApiController
    private const EncoderPreset DefaultEventEncoderPreset = EncoderPreset.superfast;
    private const TranscodingJobType TranscodingJobType = MediaBrowser.Controller.MediaEncoding.TranscodingJobType.Hls;

+    private static readonly string _podIdentity = Environment.GetEnvironmentVariable("JELLYFIN_INSTANCE_ID") ?? Environment.MachineName;
+
    private readonly Version _minFFmpegFlacInMp4 = new Version(6, 0);
    private readonly Version _minFFmpegX265BframeInFmp4 = new Version(7, 0, 1);
    private readonly Version _minFFmpegHlsSegmentOptions = new Version(5, 0);
@@ -60,6 +63,8 @@ public class DynamicHlsController : BaseJellyfinApiController
    private readonly IDynamicHlsPlaylistGenerator _dynamicHlsPlaylistGenerator;
    private readonly DynamicHlsHelper _dynamicHlsHelper;
    private readonly EncodingOptions _encodingOptions;
+    private readonly ITranscodeSessionStore _transcodeSessionStore;
+    private readonly TranscodeStoreOptions _transcodeStoreOptions;

    /// <summary>
    /// Initializes a new instance of the <see cref="DynamicHlsController"/> class.
@@ -75,6 +80,8 @@ public class DynamicHlsController : BaseJellyfinApiController
    /// <param name="dynamicHlsHelper">Instance of <see cref="DynamicHlsHelper"/>.</param>
    /// <param name="encodingHelper">Instance of <see cref="EncodingHelper"/>.</param>
    /// <param name="dynamicHlsPlaylistGenerator">Instance of <see cref="IDynamicHlsPlaylistGenerator"/>.</param>
+    /// <param name="transcodeSessionStore">Instance of the <see cref="ITranscodeSessionStore"/> interface used to register and renew HLS transcoding session leases in the durable store.</param>
+    /// <param name="transcodeStoreOptions">The <see cref="TranscodeStoreOptions"/> holding the session lease duration.</param>
    public DynamicHlsController(
        ILibraryManager libraryManager,
        IUserManager userManager,
@@ -86,7 +93,9 @@ public class DynamicHlsController : BaseJellyfinApiController
        ILogger<DynamicHlsController> logger,
        DynamicHlsHelper dynamicHlsHelper,
        EncodingHelper encodingHelper,
-        IDynamicHlsPlaylistGenerator dynamicHlsPlaylistGenerator)
+        IDynamicHlsPlaylistGenerator dynamicHlsPlaylistGenerator,
+        ITranscodeSessionStore transcodeSessionStore,
+        IOptions<TranscodeStoreOptions> transcodeStoreOptions)
    {
        _libraryManager = libraryManager;
        _userManager = userManager;
@@ -99,6 +108,8 @@ public class DynamicHlsController : BaseJellyfinApiController
        _dynamicHlsHelper = dynamicHlsHelper;
        _encodingHelper = encodingHelper;
        _dynamicHlsPlaylistGenerator = dynamicHlsPlaylistGenerator;
+        _transcodeSessionStore = transcodeSessionStore;
+        _transcodeStoreOptions = transcodeStoreOptions.Value;

        _encodingOptions = serverConfigurationManager.GetEncodingOptions();
    }
@@ -306,15 +317,24 @@ public class DynamicHlsController : BaseJellyfinApiController
                    // If the playlist doesn't already exist, startup ffmpeg
                    try
                    {
+                        var isHaMode = await IsHaTakeoverAsync(playSessionId, cancellationToken).ConfigureAwait(false);
+
                        job = await _transcodeManager.StartFfMpeg(
                                state,
                                playlistPath,
-                                GetCommandLineArguments(playlistPath, state, true, 0),
+                                GetCommandLineArguments(playlistPath, state, true, 0, isHaMode),
                                Request.HttpContext.User.GetUserId(),
                                TranscodingJobType,
                                cancellationTokenSource)
                            .ConfigureAwait(false);
                        job.IsLiveOutput = true;
+                        await RegisterTranscodeSessionAsync(
+                                playSessionId ?? string.Empty,
+                                mediaSourceId ?? string.Empty,
+                                playlistPath,
+                                cancellationToken)
+                            .ConfigureAwait(false);
+                        StartLeaseRenewal(playSessionId ?? string.Empty, cancellationToken);
                    }
                    catch
                    {
@@ -1511,14 +1531,23 @@ public class DynamicHlsController : BaseJellyfinApiController

                    streamingRequest.StartTimeTicks = streamingRequest.CurrentRuntimeTicks;

+                    var isHaMode = await IsHaTakeoverAsync(streamingRequest.PlaySessionId, cancellationToken).ConfigureAwait(false);
+
                    state.WaitForPath = segmentPath;
                    job = await _transcodeManager.StartFfMpeg(
                        state,
                        playlistPath,
-                        GetCommandLineArguments(playlistPath, state, false, segmentId),
+                        GetCommandLineArguments(playlistPath, state, false, segmentId, isHaMode),
                        Request.HttpContext.User.GetUserId(),
                        TranscodingJobType,
                        cancellationTokenSource).ConfigureAwait(false);
+                    await RegisterTranscodeSessionAsync(
+                            streamingRequest.PlaySessionId ?? string.Empty,
+                            streamingRequest.MediaSourceId ?? string.Empty,
+                            playlistPath,
+                            cancellationToken)
+                        .ConfigureAwait(false);
+                    StartLeaseRenewal(streamingRequest.PlaySessionId ?? string.Empty, cancellationToken);
                }
                catch
                {
@@ -1543,6 +1572,31 @@ public class DynamicHlsController : BaseJellyfinApiController
        }
    }

+    /// <summary>
+    /// Gets the segment length ffmpeg is told to use. HA mode shortens segments so a takeover pod
+    /// has to re-encode less; the configured value is user-editable so it is clamped.
+    /// </summary>
+    /// <param name="isHaMode">Whether the session is being resumed from the durable store.</param>
+    /// <param name="requestedSegmentLength">The segment length requested by the streaming pipeline.</param>
+    /// <param name="encodingOptions">The encoding options holding the recovery segment length.</param>
+    /// <returns>The segment length in seconds.</returns>
+    internal static int GetEffectiveSegmentLength(bool isHaMode, int requestedSegmentLength, EncodingOptions encodingOptions)
+        => isHaMode
+            ? Math.Clamp(encodingOptions.RecoverySegmentLengthSeconds, 1, 6)
+            : requestedSegmentLength;
+
+    /// <summary>
+    /// Gets the ffmpeg <c>hls_list_size</c>. HA mode keeps a bounded rolling buffer; 0 (unbounded)
+    /// otherwise.
+    /// </summary>
+    /// <param name="isHaMode">Whether the session is being resumed from the durable store.</param>
+    /// <param name="encodingOptions">The encoding options holding the recovery buffer count.</param>
+    /// <returns>The number of segments to keep in the playlist, or 0 for all of them.</returns>
+    internal static int GetHlsListSize(bool isHaMode, EncodingOptions encodingOptions)
+        => isHaMode
+            ? Math.Clamp(encodingOptions.RecoverySegmentBufferCount, 2, 10)
+            : 0;
+
    internal static async Task WaitForActiveTranscodingRequests(TranscodingJob? job, CancellationToken cancellationToken)
    {
        while (job?.ActiveRequestCount > 0)
@@ -1554,6 +1608,116 @@ public class DynamicHlsController : BaseJellyfinApiController
    private static double[] GetSegmentLengths(StreamState state)
        => GetSegmentLengthsInternal(state.RunTimeTicks ?? 0, state.SegmentLength);

+    /// <summary>
+    /// Determines whether the play session is already present in the durable store, which means
+    /// another pod owned it and this request is resuming it after a failover.
+    /// </summary>
+    private async Task<bool> IsHaTakeoverAsync(string? playSessionId, CancellationToken cancellationToken)
+    {
+        if (string.IsNullOrEmpty(playSessionId))
+        {
+            return false;
+        }
+
+        try
+        {
+            return await _transcodeSessionStore.TryGetAsync(playSessionId, cancellationToken).ConfigureAwait(false) is not null;
+        }
+        catch (Exception ex)
+        {
+            _logger.LogWarning(ex, "Failed to check HA mode for session {PlaySessionId}.", playSessionId);
+            return false;
+        }
+    }
+
+    /// <summary>
+    /// Builds the durable record for an HLS output owned by this instance. The manifest and segment
+    /// paths have to be real, otherwise <c>DeleteTranscodeFileTask</c> cannot tell which files
+    /// belong to a live session.
+    /// </summary>
+    /// <param name="playSessionId">The play session identifier.</param>
+    /// <param name="mediaSourceId">The media source identifier.</param>
+    /// <param name="playlistPath">The absolute path of the HLS playlist this instance is writing.</param>
+    /// <param name="leaseDuration">The initial lease duration.</param>
+    /// <returns>The session record to store.</returns>
+    internal static TranscodeSession CreateSessionRecord(string playSessionId, string mediaSourceId, string playlistPath, TimeSpan leaseDuration)
+        => TranscodeSession.CreateForPlaylist(playSessionId, mediaSourceId, _podIdentity, playlistPath, leaseDuration);
+
+    private async Task RegisterTranscodeSessionAsync(string playSessionId, string mediaSourceId, string playlistPath, CancellationToken cancellationToken)
+    {
+        try
+        {
+            var session = CreateSessionRecord(
+                playSessionId,
+                mediaSourceId,
+                playlistPath,
+                TimeSpan.FromSeconds(_transcodeStoreOptions.LeaseDurationSeconds));
+            await _transcodeSessionStore.SetAsync(session, cancellationToken).ConfigureAwait(false);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogWarning(ex, "Failed to register HLS session {PlaySessionId} in durable store.", playSessionId);
+        }
+    }
+
+    private void StartLeaseRenewal(string playSessionId, CancellationToken cancellationToken)
+    {
+        var renewalInterval = TimeSpan.FromSeconds(Math.Max(1, _transcodeStoreOptions.LeaseDurationSeconds / 3));
+
+        _ = Task.Run(
+            async () =>
+            {
+                var ownsLease = true;
+                try
+                {
+                    while (!cancellationToken.IsCancellationRequested)
+                    {
+                        try
+                        {
+                            await Task.Delay(renewalInterval, cancellationToken).ConfigureAwait(false);
+                        }
+                        catch (OperationCanceledException)
+                        {
+                            break;
+                        }
+
+                        try
+                        {
+                            if (!await _transcodeSessionStore.RenewLeaseAsync(playSessionId, _podIdentity, cancellationToken).ConfigureAwait(false))
+                            {
+                                // Another pod owns the session now; its record must not be touched.
+                                ownsLease = false;
+                                break;
+                            }
+                        }
+                        catch (Exception ex)
+                        {
+                            _logger.LogWarning(ex, "Failed to renew lease for HLS session {PlaySessionId}.", playSessionId);
+                        }
+                    }
+                }
+                catch (Exception ex)
+                {
+                    _logger.LogWarning(ex, "Lease renewal loop for HLS session {PlaySessionId} encountered an unexpected error.", playSessionId);
+                }
+                finally
+                {
+                    if (ownsLease)
+                    {
+                        try
+                        {
+                            await _transcodeSessionStore.DeleteAsync(playSessionId, CancellationToken.None).ConfigureAwait(false);
+                        }
+                        catch (Exception ex)
+                        {
+                            _logger.LogWarning(ex, "Failed to delete HLS session {PlaySessionId} from durable store.", playSessionId);
+                        }
+                    }
+                }
+            },
+            CancellationToken.None);
+    }
+
    internal static double[] GetSegmentLengthsInternal(long runtimeTicks, int segmentlength)
    {
        var segmentLengthTicks = TimeSpan.FromSeconds(segmentlength).Ticks;
@@ -1575,7 +1739,7 @@ public class DynamicHlsController : BaseJellyfinApiController
        return segments;
    }

-    private string GetCommandLineArguments(string outputPath, StreamState state, bool isEventPlaylist, int startNumber)
+    private string GetCommandLineArguments(string outputPath, StreamState state, bool isEventPlaylist, int startNumber, bool isHaMode = false)
    {
        var videoCodec = _encodingHelper.GetVideoEncoder(state, _encodingOptions);
        var threads = EncodingHelper.GetNumberOfThreads(state, _encodingOptions, videoCodec);
@@ -1588,10 +1752,13 @@ public class DynamicHlsController : BaseJellyfinApiController
        var outputExtension = EncodingHelper.GetSegmentFileExtension(state.Request.SegmentContainer);
        var outputTsArg = outputPrefix + "%d" + outputExtension;

+        var effectiveSegmentLength = GetEffectiveSegmentLength(isHaMode, state.SegmentLength, _encodingOptions);
+        var hlsListSize = GetHlsListSize(isHaMode, _encodingOptions);
+
        var segmentFormat = string.Empty;
        var segmentContainer = outputExtension.TrimStart('.');
        var inputModifier = _encodingHelper.GetInputModifier(state, _encodingOptions, segmentContainer);
-        var hlsArguments = $"-hls_playlist_type {(isEventPlaylist ? "event" : "vod")} -hls_list_size 0";
+        var hlsArguments = $"-hls_playlist_type {(isEventPlaylist ? "event" : "vod")} -hls_list_size {hlsListSize}";

        if (string.Equals(segmentContainer, "ts", StringComparison.OrdinalIgnoreCase))
        {
@@ -1644,10 +1811,10 @@ public class DynamicHlsController : BaseJellyfinApiController
            _encodingHelper.GetInputArgument(state, _encodingOptions, segmentContainer),
            threads,
            mapArgs,
-            GetVideoArguments(state, startNumber, isEventPlaylist, segmentContainer),
+            GetVideoArguments(state, startNumber, isEventPlaylist, segmentContainer, effectiveSegmentLength),
            GetAudioArguments(state),
            maxMuxingQueueSize,
-            state.SegmentLength.ToString(CultureInfo.InvariantCulture),
+            effectiveSegmentLength.ToString(CultureInfo.InvariantCulture),
            segmentFormat,
            startNumber.ToString(CultureInfo.InvariantCulture),
            baseUrlParam,
@@ -1784,8 +1951,9 @@ public class DynamicHlsController : BaseJellyfinApiController
    /// <param name="startNumber">The first number in the hls sequence.</param>
    /// <param name="isEventPlaylist">Whether the playlist is EVENT or VOD.</param>
    /// <param name="segmentContainer">The segment container.</param>
+    /// <param name="segmentLength">The effective segment length in seconds (overrides <see cref="StreamState.SegmentLength"/> when HA mode is active).</param>
    /// <returns>The command line arguments for video transcoding.</returns>
-    private string GetVideoArguments(StreamState state, int startNumber, bool isEventPlaylist, string segmentContainer)
+    private string GetVideoArguments(StreamState state, int startNumber, bool isEventPlaylist, string segmentContainer, int? segmentLength = null)
    {
        if (state.VideoStream is null)
        {
@@ -1860,7 +2028,7 @@ public class DynamicHlsController : BaseJellyfinApiController
            args += _encodingHelper.GetVideoQualityParam(state, codec, _encodingOptions, isEventPlaylist ? DefaultEventEncoderPreset : DefaultVodEncoderPreset);

            // Set the key frame params for video encoding to match the hls segment time.
-            args += _encodingHelper.GetHlsVideoKeyFrameArguments(state, codec, state.SegmentLength, isEventPlaylist, startNumber);
+            args += _encodingHelper.GetHlsVideoKeyFrameArguments(state, codec, segmentLength ?? state.SegmentLength, isEventPlaylist, startNumber);

            // Currently b-frames in libx265 breaks the FMP4-HLS playback on iOS, disable it for now.
            if (string.Equals(codec, "libx265", StringComparison.OrdinalIgnoreCase)
@@ -59,7 +59,7 @@ public class QuickConnectController : BaseJellyfinApiController
        try
        {
            var auth = await _authContext.GetAuthorizationInfo(Request).ConfigureAwait(false);
-            return _quickConnect.TryConnect(auth);
+            return await _quickConnect.TryConnect(auth).ConfigureAwait(false);
        }
        catch (AuthenticationException)
        {
@@ -77,11 +77,11 @@ public class QuickConnectController : BaseJellyfinApiController
    [HttpGet("Connect")]
    [ProducesResponseType(StatusCodes.Status200OK)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
-    public ActionResult<QuickConnectResult> GetQuickConnectState([FromQuery, Required] string secret)
+    public async Task<ActionResult<QuickConnectResult>> GetQuickConnectState([FromQuery, Required] string secret)
    {
        try
        {
-            return _quickConnect.CheckRequestStatus(secret);
+            return await _quickConnect.CheckRequestStatus(secret).ConfigureAwait(false);
        }
        catch (ResourceNotFoundException)
        {
@@ -108,7 +108,7 @@ public class TvShowsController : BaseJellyfinApiController
                StartIndex = startIndex,
                User = user,
                EnableTotalRecordCount = enableTotalRecordCount,
-                NextUpDateCutoff = nextUpDateCutoff ?? DateTime.MinValue,
+                NextUpDateCutoff = nextUpDateCutoff?.ToUniversalTime() ?? DateTime.SpecifyKind(DateTime.MinValue, DateTimeKind.Utc),
                EnableResumable = enableResumable,
                EnableRewatching = enableRewatching
            },
@@ -245,11 +245,11 @@ public class UserController : BaseJellyfinApiController
    [HttpPost("AuthenticateWithQuickConnect")]
    [ProducesResponseType(StatusCodes.Status200OK)]
    [Tags("Authentication")]
-    public ActionResult<AuthenticationResult> AuthenticateWithQuickConnect([FromBody, Required] QuickConnectDto request)
+    public async Task<ActionResult<AuthenticationResult>> AuthenticateWithQuickConnect([FromBody, Required] QuickConnectDto request)
    {
        try
        {
-            return _quickConnectManager.GetAuthorizedRequest(request.Secret);
+            return await _quickConnectManager.GetAuthorizedRequest(request.Secret).ConfigureAwait(false);
        }
        catch (SecurityException e)
        {
@@ -31,8 +31,6 @@ namespace Jellyfin.Server.Implementations.Devices
        private readonly IDbContextFactory<JellyfinDbContext> _dbProvider;
        private readonly IUserManager _userManager;
        private readonly ConcurrentDictionary<string, ClientCapabilities> _capabilitiesMap = new();
-        private readonly ConcurrentDictionary<int, Device> _devices;
-        private readonly ConcurrentDictionary<string, DeviceOptions> _deviceOptions;

        /// <summary>
        /// Initializes a new instance of the <see cref="DeviceManager"/> class.
@@ -43,23 +41,6 @@ namespace Jellyfin.Server.Implementations.Devices
        {
            _dbProvider = dbProvider;
            _userManager = userManager;
-            _devices = new ConcurrentDictionary<int, Device>();
-            _deviceOptions = new ConcurrentDictionary<string, DeviceOptions>();
-
-            using var dbContext = _dbProvider.CreateDbContext();
-            foreach (var device in dbContext.Devices
-                         .OrderBy(d => d.Id)
-                         .AsEnumerable())
-            {
-                _devices.TryAdd(device.Id, device);
-            }
-
-            foreach (var deviceOption in dbContext.DeviceOptions
-                         .OrderBy(d => d.Id)
-                         .AsEnumerable())
-            {
-                _deviceOptions.TryAdd(deviceOption.DeviceId, deviceOption);
-            }
        }

        /// <inheritdoc />
@@ -89,8 +70,6 @@ namespace Jellyfin.Server.Implementations.Devices
                await dbContext.SaveChangesAsync().ConfigureAwait(false);
            }

-            _deviceOptions[deviceId] = deviceOptions;
-
            DeviceOptionsUpdated?.Invoke(this, new GenericEventArgs<Tuple<string, DeviceOptions>>(new Tuple<string, DeviceOptions>(deviceId, deviceOptions)));
        }

@@ -102,21 +81,24 @@ namespace Jellyfin.Server.Implementations.Devices
            {
                dbContext.Devices.Add(device);
                await dbContext.SaveChangesAsync().ConfigureAwait(false);
-                _devices.TryAdd(device.Id, device);
            }

            return device;
        }

        /// <inheritdoc />
-        public DeviceOptionsDto? GetDeviceOptions(string deviceId)
+        public async Task<DeviceOptionsDto?> GetDeviceOptions(string deviceId)
        {
-            if (_deviceOptions.TryGetValue(deviceId, out var deviceOptions))
+            var dbContext = await _dbProvider.CreateDbContextAsync().ConfigureAwait(false);
+            await using (dbContext.ConfigureAwait(false))
            {
-                return ToDeviceOptionsDto(deviceOptions);
-            }
+                var deviceOptions = await dbContext.DeviceOptions
+                    .AsNoTracking()
+                    .FirstOrDefaultAsync(dev => dev.DeviceId == deviceId)
+                    .ConfigureAwait(false);

-            return null;
+                return deviceOptions is null ? null : ToDeviceOptionsDto(deviceOptions);
+            }
        }

        /// <inheritdoc />
@@ -133,43 +115,79 @@ namespace Jellyfin.Server.Implementations.Devices
        }

        /// <inheritdoc />
-        public DeviceInfoDto? GetDevice(string id)
+        public async Task<DeviceInfoDto?> GetDevice(string id)
        {
-            var device = _devices.Values.Where(d => d.DeviceId == id).OrderByDescending(d => d.DateLastActivity).FirstOrDefault();
-            _deviceOptions.TryGetValue(id, out var deviceOption);
+            var dbContext = await _dbProvider.CreateDbContextAsync().ConfigureAwait(false);
+            await using (dbContext.ConfigureAwait(false))
+            {
+                var device = await dbContext.Devices
+                    .AsNoTracking()
+                    .Where(d => d.DeviceId == id)
+                    .OrderByDescending(d => d.DateLastActivity)
+                    .FirstOrDefaultAsync()
+                    .ConfigureAwait(false);

-            var deviceInfo = device is null ? null : ToDeviceInfo(device, deviceOption);
-            return deviceInfo is null ? null : ToDeviceInfoDto(deviceInfo);
+                if (device is null)
+                {
+                    return null;
+                }
+
+                var deviceOption = await dbContext.DeviceOptions
+                    .AsNoTracking()
+                    .FirstOrDefaultAsync(dev => dev.DeviceId == id)
+                    .ConfigureAwait(false);
+
+                return ToDeviceInfoDto(ToDeviceInfo(device, deviceOption));
+            }
        }

        /// <inheritdoc />
-        public QueryResult<Device> GetDevices(DeviceQuery query)
+        public async Task<QueryResult<Device>> GetDevices(DeviceQuery query)
        {
-            IEnumerable<Device> devices = _devices.Values
-                .Where(device => !query.UserId.HasValue || device.UserId.Equals(query.UserId.Value))
-                .Where(device => query.DeviceId is null || device.DeviceId == query.DeviceId)
-                .Where(device => query.AccessToken is null || device.AccessToken == query.AccessToken)
-                .OrderBy(d => d.Id)
-                .ToList();
-            var count = devices.Count();
-
-            if (query.Skip.HasValue)
+            var dbContext = await _dbProvider.CreateDbContextAsync().ConfigureAwait(false);
+            await using (dbContext.ConfigureAwait(false))
            {
-                devices = devices.Skip(query.Skip.Value);
-            }
+                IQueryable<Device> filtered = dbContext.Devices.AsNoTracking();

-            if (query.Limit.HasValue && query.Limit.Value > 0)
-            {
-                devices = devices.Take(query.Limit.Value);
-            }
+                if (query.UserId.HasValue)
+                {
+                    filtered = filtered.Where(device => device.UserId.Equals(query.UserId.Value));
+                }

-            return new QueryResult<Device>(query.Skip, count, devices.ToList());
+                if (query.DeviceId is not null)
+                {
+                    filtered = filtered.Where(device => device.DeviceId == query.DeviceId);
+                }
+
+                if (query.AccessToken is not null)
+                {
+                    filtered = filtered.Where(device => device.AccessToken == query.AccessToken);
+                }
+
+                // Every filter is an exact match on an indexed column and the table holds one row per
+                // user and device, so paging the materialised set costs less than a second round trip.
+                var matched = await filtered.OrderBy(d => d.Id).ToListAsync().ConfigureAwait(false);
+
+                IEnumerable<Device> devices = matched;
+
+                if (query.Skip.HasValue)
+                {
+                    devices = devices.Skip(query.Skip.Value);
+                }
+
+                if (query.Limit.HasValue && query.Limit.Value > 0)
+                {
+                    devices = devices.Take(query.Limit.Value);
+                }
+
+                return new QueryResult<Device>(query.Skip, matched.Count, devices.ToList());
+            }
        }

        /// <inheritdoc />
-        public QueryResult<DeviceInfo> GetDeviceInfos(DeviceQuery query)
+        public async Task<QueryResult<DeviceInfo>> GetDeviceInfos(DeviceQuery query)
        {
-            var devices = GetDevices(query);
+            var devices = await GetDevices(query).ConfigureAwait(false);

            return new QueryResult<DeviceInfo>(
                devices.StartIndex,
@@ -178,38 +196,49 @@ namespace Jellyfin.Server.Implementations.Devices
        }

        /// <inheritdoc />
-        public QueryResult<DeviceInfoDto> GetDevicesForUser(Guid? userId)
+        public async Task<QueryResult<DeviceInfoDto>> GetDevicesForUser(Guid? userId)
        {
-            IEnumerable<Device> devices = _devices.Values
-                .OrderByDescending(d => d.DateLastActivity)
-                .ThenBy(d => d.DeviceId);
-
-            if (!userId.IsNullOrEmpty())
+            var dbContext = await _dbProvider.CreateDbContextAsync().ConfigureAwait(false);
+            await using (dbContext.ConfigureAwait(false))
            {
-                var user = _userManager.GetUserById(userId.Value);
-                if (user is null)
+                IEnumerable<Device> devices = await dbContext.Devices
+                    .AsNoTracking()
+                    .OrderByDescending(d => d.DateLastActivity)
+                    .ThenBy(d => d.DeviceId)
+                    .ToListAsync()
+                    .ConfigureAwait(false);
+
+                if (!userId.IsNullOrEmpty())
                {
-                    throw new ResourceNotFoundException();
+                    var user = _userManager.GetUserById(userId.Value);
+                    if (user is null)
+                    {
+                        throw new ResourceNotFoundException();
+                    }
+
+                    devices = devices.Where(i => CanAccessDevice(user, i.DeviceId));
                }

-                devices = devices.Where(i => CanAccessDevice(user, i.DeviceId));
+                var options = await dbContext.DeviceOptions
+                    .AsNoTracking()
+                    .ToDictionaryAsync(dev => dev.DeviceId)
+                    .ConfigureAwait(false);
+
+                var array = devices.Select(device =>
+                    {
+                        options.TryGetValue(device.DeviceId, out var option);
+                        return ToDeviceInfo(device, option);
+                    })
+                    .Select(ToDeviceInfoDto)
+                    .ToArray();
+
+                return new QueryResult<DeviceInfoDto>(array);
            }
-
-            var array = devices.Select(device =>
-                {
-                    _deviceOptions.TryGetValue(device.DeviceId, out var option);
-                    return ToDeviceInfo(device, option);
-                })
-                .Select(ToDeviceInfoDto)
-                .ToArray();
-
-            return new QueryResult<DeviceInfoDto>(array);
        }

        /// <inheritdoc />
        public async Task DeleteDevice(Device device)
        {
-            _devices.TryRemove(device.Id, out _);
            var dbContext = await _dbProvider.CreateDbContextAsync().ConfigureAwait(false);
            await using (dbContext.ConfigureAwait(false))
            {
@@ -229,8 +258,6 @@ namespace Jellyfin.Server.Implementations.Devices
                dbContext.Devices.Update(device);
                await dbContext.SaveChangesAsync().ConfigureAwait(false);
            }
-
-            _devices[device.Id] = device;
        }

        /// <inheritdoc />
@@ -6,12 +6,14 @@ using System.Reflection;
 using Jellyfin.Database.Implementations;
 using Jellyfin.Database.Implementations.DbConfiguration;
 using Jellyfin.Database.Implementations.Locking;
+using Jellyfin.Database.Providers.PostgreSQL;
 using Jellyfin.Database.Providers.Sqlite;
 using MediaBrowser.Common.Configuration;
 using MediaBrowser.Controller.Configuration;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
+using Npgsql;
 using JellyfinDbProviderFactory = System.Func<System.IServiceProvider, Jellyfin.Database.Implementations.IJellyfinDatabaseProvider>;

 namespace Jellyfin.Server.Implementations.Extensions;
@@ -24,6 +26,13 @@ public static class ServiceCollectionExtensions
    private static IEnumerable<Type> DatabaseProviderTypes()
    {
        yield return typeof(SqliteDatabaseProvider);
+        yield return typeof(PostgreSqlDatabaseProvider);
+    }
+
+    private static int GetPoolOption(IEnumerable<CustomDatabaseOption>? options, string key, int defaultValue)
+    {
+        var value = options?.FirstOrDefault(o => o.Key.Equals(key, StringComparison.OrdinalIgnoreCase))?.Value;
+        return int.TryParse(value, out var parsed) ? parsed : defaultValue;
    }

    private static IDictionary<string, JellyfinDbProviderFactory> GetSupportedDbProviders()
@@ -123,6 +132,50 @@ public static class ServiceCollectionExtensions

        serviceCollection.AddSingleton<IJellyfinDatabaseProvider>(providerFactory!);

+        if (efCoreConfiguration.DatabaseType.Equals("Jellyfin-PostgreSQL", StringComparison.OrdinalIgnoreCase))
+        {
+            serviceCollection.AddSingleton<NpgsqlDataSource>(static sp =>
+            {
+                var config = sp.GetRequiredService<IServerConfigurationManager>().GetConfiguration<DatabaseConfigurationOptions>("database");
+                var options = config.CustomProviderOptions?.Options;
+
+                var connectionString =
+                    Environment.GetEnvironmentVariable("POSTGRES_CONNECTION_STRING")
+                    ?? options
+                        ?.FirstOrDefault(o => o.Key.Equals("ConnectionString", StringComparison.OrdinalIgnoreCase))
+                        ?.Value
+                    ?? config.CustomProviderOptions?.ConnectionString
+                    ?? throw new InvalidOperationException(
+                        "No PostgreSQL connection string found. Set the POSTGRES_CONNECTION_STRING environment variable, " +
+                        "or provide it via CustomProviderOptions.Options[\"ConnectionString\"] or CustomProviderOptions.ConnectionString.");
+
+                // Support postgresql:// / postgres:// URI format (e.g. DATABASE_URL convention).
+                // NpgsqlDataSourceBuilder requires ADO.NET key=value format; convert if needed.
+                if (connectionString.StartsWith("postgresql://", StringComparison.OrdinalIgnoreCase)
+                    || connectionString.StartsWith("postgres://", StringComparison.OrdinalIgnoreCase))
+                {
+                    var uri = new Uri(connectionString);
+                    var userInfoParts = uri.UserInfo.Split(':', 2);
+                    connectionString = new NpgsqlConnectionStringBuilder
+                    {
+                        Host = uri.Host,
+                        Port = uri.Port > 0 ? uri.Port : 5432,
+                        Database = uri.AbsolutePath.TrimStart('/'),
+                        Username = userInfoParts.Length > 0 ? Uri.UnescapeDataString(userInfoParts[0]) : null,
+                        Password = userInfoParts.Length > 1 ? Uri.UnescapeDataString(userInfoParts[1]) : null,
+                    }.ToString();
+                }
+
+                var dataSourceBuilder = new NpgsqlDataSourceBuilder(connectionString);
+
+                dataSourceBuilder.ConnectionStringBuilder.MinPoolSize = GetPoolOption(options, "MinPoolSize", 2);
+                dataSourceBuilder.ConnectionStringBuilder.MaxPoolSize = GetPoolOption(options, "MaxPoolSize", 20);
+                dataSourceBuilder.ConnectionStringBuilder.CommandTimeout = GetPoolOption(options, "CommandTimeout", 30);
+
+                return dataSourceBuilder.Build();
+            });
+        }
+
        switch (efCoreConfiguration.LockingBehavior)
        {
            case DatabaseLockingBehaviorTypes.NoLock:
@@ -219,9 +219,11 @@ public sealed partial class BaseItemRepository
        }
        else
        {
+            // The representative is the row no other row in its group sorts before, not MIN(Id):
+            // PostgreSQL has no min(uuid) aggregate, while comparing two uuids is supported everywhere.
            representativeIds = masterQuery
-                .GroupBy(e => e.PresentationUniqueKey)
-                .Select(g => g.Min(e => e.Id))
+                .Where(e => !masterQuery.Any(o => o.PresentationUniqueKey == e.PresentationUniqueKey && o.Id.CompareTo(e.Id) < 0))
+                .Select(e => e.Id)
                .ToList();
        }

@@ -96,22 +96,36 @@ public sealed partial class BaseItemRepository
        // primary version (PrimaryVersionId is null) so detail pages and actions target it instead
        // of an arbitrary alternate. Keep the grouped ids as an IQueryable sub-select; materializing
        // to a List would inline one bound parameter per id and hit SQLite's variable cap.
+        // The representative is the row no other row in its group sorts before, not MIN(Id):
+        // PostgreSQL has no min(uuid) aggregate, while comparing two uuids is supported everywhere.
+        // The anti-join reads the filtered set twice, so it has to close over a local that the
+        // reassignment below cannot reach - capturing dbQuery itself makes the tree self-referential.
+        var candidates = dbQuery;
        var enableGroupByPresentationUniqueKey = EnableGroupByPresentationUniqueKey(filter);
        if (enableGroupByPresentationUniqueKey && filter.GroupBySeriesPresentationUniqueKey)
        {
-            var groupedIds = dbQuery.GroupBy(e => new { e.PresentationUniqueKey, e.SeriesPresentationUniqueKey })
-                .Select(g => g.Where(e => e.PrimaryVersionId == null).Min(e => (Guid?)e.Id) ?? g.Min(e => (Guid?)e.Id));
+            var groupedIds = candidates
+                .Where(e => !candidates.Any(o => o.PresentationUniqueKey == e.PresentationUniqueKey
+                    && o.SeriesPresentationUniqueKey == e.SeriesPresentationUniqueKey
+                    && ((o.PrimaryVersionId == null && e.PrimaryVersionId != null)
+                        || ((o.PrimaryVersionId == null) == (e.PrimaryVersionId == null) && o.Id.CompareTo(e.Id) < 0))))
+                .Select(e => e.Id);
            dbQuery = context.BaseItems.AsNoTracking().Where(e => groupedIds.Contains(e.Id));
        }
        else if (enableGroupByPresentationUniqueKey)
        {
-            var groupedIds = dbQuery.GroupBy(e => e.PresentationUniqueKey)
-                .Select(g => g.Where(e => e.PrimaryVersionId == null).Min(e => (Guid?)e.Id) ?? g.Min(e => (Guid?)e.Id));
+            var groupedIds = candidates
+                .Where(e => !candidates.Any(o => o.PresentationUniqueKey == e.PresentationUniqueKey
+                    && ((o.PrimaryVersionId == null && e.PrimaryVersionId != null)
+                        || ((o.PrimaryVersionId == null) == (e.PrimaryVersionId == null) && o.Id.CompareTo(e.Id) < 0))))
+                .Select(e => e.Id);
            dbQuery = context.BaseItems.AsNoTracking().Where(e => groupedIds.Contains(e.Id));
        }
        else if (filter.GroupBySeriesPresentationUniqueKey)
        {
-            var groupedIds = dbQuery.GroupBy(e => e.SeriesPresentationUniqueKey).Select(e => e.Min(x => x.Id));
+            var groupedIds = candidates
+                .Where(e => !candidates.Any(o => o.SeriesPresentationUniqueKey == e.SeriesPresentationUniqueKey && o.Id.CompareTo(e.Id) < 0))
+                .Select(e => e.Id);
            dbQuery = context.BaseItems.AsNoTracking().Where(e => groupedIds.Contains(e.Id));
        }
        else
@@ -35,6 +35,7 @@
    <ProjectReference Include="..\MediaBrowser.Controller\MediaBrowser.Controller.csproj" />
    <ProjectReference Include="..\MediaBrowser.Model\MediaBrowser.Model.csproj" />
    <ProjectReference Include="..\src\Jellyfin.Database\Jellyfin.Database.Implementations\Jellyfin.Database.Implementations.csproj" />
+    <ProjectReference Include="..\src\Jellyfin.Database\Jellyfin.Database.Providers.PostgreSQL\Jellyfin.Database.Providers.PostgreSQL.csproj" />
    <ProjectReference Include="..\src\Jellyfin.Database\Jellyfin.Database.Providers.Sqlite\Jellyfin.Database.Providers.Sqlite.csproj" />
  </ItemGroup>

@@ -126,95 +126,95 @@ namespace Jellyfin.Server.Implementations.Security
                return authInfo;
            }

+            var device = (await _deviceManager.GetDevices(
+                new DeviceQuery { AccessToken = token }).ConfigureAwait(false)).Items.FirstOrDefault();
+
+            if (device is not null)
+            {
+                authInfo.IsAuthenticated = true;
+                var updateToken = false;
+
+                // TODO: Remove these checks for IsNullOrWhiteSpace
+                if (string.IsNullOrWhiteSpace(authInfo.Client))
+                {
+                    authInfo.Client = device.AppName;
+                }
+
+                if (string.IsNullOrWhiteSpace(authInfo.DeviceId))
+                {
+                    authInfo.DeviceId = device.DeviceId;
+                }
+
+                // Temporary. TODO - allow clients to specify that the token has been shared with a casting device
+                var allowTokenInfoUpdate = !authInfo.Client.Contains("chromecast", StringComparison.OrdinalIgnoreCase);
+
+                if (string.IsNullOrWhiteSpace(authInfo.Device))
+                {
+                    authInfo.Device = device.DeviceName;
+                }
+                else if (!string.Equals(authInfo.Device, device.DeviceName, StringComparison.OrdinalIgnoreCase))
+                {
+                    if (allowTokenInfoUpdate)
+                    {
+                        updateToken = true;
+                        device.DeviceName = authInfo.Device;
+                    }
+                }
+
+                if (string.IsNullOrWhiteSpace(authInfo.Version))
+                {
+                    authInfo.Version = device.AppVersion;
+                }
+                else if (!string.Equals(authInfo.Version, device.AppVersion, StringComparison.OrdinalIgnoreCase))
+                {
+                    if (allowTokenInfoUpdate)
+                    {
+                        updateToken = true;
+                        device.AppVersion = authInfo.Version;
+                    }
+                }
+
+                if ((DateTime.UtcNow - device.DateLastActivity).TotalMinutes > 3)
+                {
+                    device.DateLastActivity = DateTime.UtcNow;
+                    updateToken = true;
+                }
+
+                authInfo.User = _userManager.GetUserById(device.UserId);
+
+                if (updateToken)
+                {
+                    await _deviceManager.UpdateDevice(device).ConfigureAwait(false);
+                }
+
+                return authInfo;
+            }
+
            var dbContext = await _jellyfinDbProvider.CreateDbContextAsync().ConfigureAwait(false);
            await using (dbContext.ConfigureAwait(false))
            {
-                var device = _deviceManager.GetDevices(
-                    new DeviceQuery { AccessToken = token }).Items.FirstOrDefault();
-
-                if (device is not null)
+                var key = await dbContext.ApiKeys.FirstOrDefaultAsync(apiKey => apiKey.AccessToken == token).ConfigureAwait(false);
+                if (key is not null)
                {
                    authInfo.IsAuthenticated = true;
-                    var updateToken = false;
-
-                    // TODO: Remove these checks for IsNullOrWhiteSpace
-                    if (string.IsNullOrWhiteSpace(authInfo.Client))
-                    {
-                        authInfo.Client = device.AppName;
-                    }
-
+                    authInfo.Client = key.Name;
+                    authInfo.Token = key.AccessToken;
                    if (string.IsNullOrWhiteSpace(authInfo.DeviceId))
                    {
-                        authInfo.DeviceId = device.DeviceId;
+                        authInfo.DeviceId = _serverApplicationHost.SystemId;
                    }

-                    // Temporary. TODO - allow clients to specify that the token has been shared with a casting device
-                    var allowTokenInfoUpdate = !authInfo.Client.Contains("chromecast", StringComparison.OrdinalIgnoreCase);
-
                    if (string.IsNullOrWhiteSpace(authInfo.Device))
                    {
-                        authInfo.Device = device.DeviceName;
-                    }
-                    else if (!string.Equals(authInfo.Device, device.DeviceName, StringComparison.OrdinalIgnoreCase))
-                    {
-                        if (allowTokenInfoUpdate)
-                        {
-                            updateToken = true;
-                            device.DeviceName = authInfo.Device;
-                        }
+                        authInfo.Device = _serverApplicationHost.Name;
                    }

                    if (string.IsNullOrWhiteSpace(authInfo.Version))
                    {
-                        authInfo.Version = device.AppVersion;
-                    }
-                    else if (!string.Equals(authInfo.Version, device.AppVersion, StringComparison.OrdinalIgnoreCase))
-                    {
-                        if (allowTokenInfoUpdate)
-                        {
-                            updateToken = true;
-                            device.AppVersion = authInfo.Version;
-                        }
+                        authInfo.Version = _serverApplicationHost.ApplicationVersionString;
                    }

-                    if ((DateTime.UtcNow - device.DateLastActivity).TotalMinutes > 3)
-                    {
-                        device.DateLastActivity = DateTime.UtcNow;
-                        updateToken = true;
-                    }
-
-                    authInfo.User = _userManager.GetUserById(device.UserId);
-
-                    if (updateToken)
-                    {
-                        await _deviceManager.UpdateDevice(device).ConfigureAwait(false);
-                    }
-                }
-                else
-                {
-                    var key = await dbContext.ApiKeys.FirstOrDefaultAsync(apiKey => apiKey.AccessToken == token).ConfigureAwait(false);
-                    if (key is not null)
-                    {
-                        authInfo.IsAuthenticated = true;
-                        authInfo.Client = key.Name;
-                        authInfo.Token = key.AccessToken;
-                        if (string.IsNullOrWhiteSpace(authInfo.DeviceId))
-                        {
-                            authInfo.DeviceId = _serverApplicationHost.SystemId;
-                        }
-
-                        if (string.IsNullOrWhiteSpace(authInfo.Device))
-                        {
-                            authInfo.Device = _serverApplicationHost.Name;
-                        }
-
-                        if (string.IsNullOrWhiteSpace(authInfo.Version))
-                        {
-                            authInfo.Version = _serverApplicationHost.ApplicationVersionString;
-                        }
-
-                        authInfo.IsApiKey = true;
-                    }
+                    authInfo.IsApiKey = true;
                }

                return authInfo;
@@ -61,10 +61,10 @@ public sealed class DeviceAccessHost : IHostedService

    private async Task UpdateDeviceAccess(User user)
    {
-        var existing = _deviceManager.GetDevices(new DeviceQuery
+        var existing = (await _deviceManager.GetDevices(new DeviceQuery
        {
            UserId = user.Id
-        }).Items;
+        }).ConfigureAwait(false)).Items;

        foreach (var device in existing)
        {
@@ -2,12 +2,15 @@ using System;
 using System.Collections.Generic;
 using System.Reflection;
 using Emby.Server.Implementations;
+using Emby.Server.Implementations.MediaEncoding;
+using Emby.Server.Implementations.ScheduledTasks;
 using Emby.Server.Implementations.Session;
 using Jellyfin.Api.WebSocketListeners;
 using Jellyfin.Database.Implementations;
 using Jellyfin.Drawing;
 using Jellyfin.Drawing.Skia;
 using Jellyfin.LiveTv;
+using Jellyfin.Server.Extensions;
 using Jellyfin.Server.Implementations.Activity;
 using Jellyfin.Server.Implementations.Devices;
 using Jellyfin.Server.Implementations.Events;
@@ -23,6 +26,7 @@ using MediaBrowser.Controller.Drawing;
 using MediaBrowser.Controller.Events;
 using MediaBrowser.Controller.Library;
 using MediaBrowser.Controller.Lyrics;
+using MediaBrowser.Controller.MediaEncoding;
 using MediaBrowser.Controller.Net;
 using MediaBrowser.Controller.Security;
 using MediaBrowser.Controller.Trickplay;
@@ -39,6 +43,8 @@ namespace Jellyfin.Server
    /// </summary>
    public class CoreAppHost : ApplicationHost
    {
+        private readonly IConfiguration _startupConfig;
+
        /// <summary>
        /// Initializes a new instance of the <see cref="CoreAppHost" /> class.
        /// </summary>
@@ -57,6 +63,7 @@ namespace Jellyfin.Server
                options,
                startupConfig)
        {
+            _startupConfig = startupConfig;
        }

        /// <inheritdoc/>
@@ -98,6 +105,21 @@ namespace Jellyfin.Server

            serviceCollection.AddScoped<IAuthenticationManager, AuthenticationManager>();

+            // Transcode session store: Redis-backed when configured, no-op otherwise.
+            serviceCollection.AddTranscodeSessionStore(_startupConfig, Logger);
+
+            // Scan-leader lease: gates periodic library-mutating scheduled tasks to a single leader
+            // instance. Active by default once a Redis connection is configured, no-op otherwise.
+            serviceCollection.AddScanLeaderLease(_startupConfig, Logger);
+
+            // Configuration invalidation bus: propagates shared-configuration and library-option writes
+            // to the other instances. Redis-backed when configured, no-op otherwise.
+            serviceCollection.AddConfigurationInvalidationBus(_startupConfig, Logger);
+
+            // Quick connect store: shares in-flight quick connect requests so the initiate, authorize and
+            // exchange legs can land on different instances. Redis-backed when configured, local otherwise.
+            serviceCollection.AddQuickConnectStore(_startupConfig, Logger);
+
            foreach (var type in GetExportTypes<ILyricProvider>())
            {
                serviceCollection.AddSingleton(typeof(ILyricProvider), type);
@@ -0,0 +1,51 @@
+using System.Collections.Generic;
+using System.Linq;
+using Microsoft.Extensions.Configuration;
+
+namespace Jellyfin.Server.Extensions;
+
+/// <summary>
+/// Extensions for building the application configuration.
+/// </summary>
+public static class ConfigurationBuilderExtensions
+{
+    /// <summary>
+    /// The environment variable prefix that maps onto this fork's own <c>Jellyfin:*</c> configuration
+    /// keys, for example <c>Jellyfin__TranscodeStore__RedisConnectionString</c>.
+    /// </summary>
+    public const string JellyfinSectionEnvironmentPrefix = "Jellyfin__";
+
+    /// <summary>
+    /// The configuration section root this fork keeps its own settings under.
+    /// </summary>
+    public const string JellyfinSectionRoot = "Jellyfin";
+
+    /// <summary>
+    /// Adds environment variables named <c>Jellyfin__Section__Key</c> as the configuration keys
+    /// <c>Jellyfin:Section:Key</c>.
+    /// </summary>
+    /// <remarks>
+    /// The base configuration only reads <c>JELLYFIN_</c> prefixed environment variables, so the
+    /// unprefixed form every manifest, chart and document uses would otherwise be dropped and the
+    /// feature it configures would stay off with no error.
+    /// </remarks>
+    /// <param name="builder">The configuration builder.</param>
+    /// <returns>The updated configuration builder.</returns>
+    public static IConfigurationBuilder AddJellyfinSectionEnvironmentVariables(this IConfigurationBuilder builder)
+    {
+        // Read through the framework provider so "__" to ":" normalisation and case handling match the
+        // prefixed form exactly; the prefix it strips is then put back as the section root.
+        var scoped = new ConfigurationBuilder()
+            .AddEnvironmentVariables(JellyfinSectionEnvironmentPrefix)
+            .Build();
+
+        var entries = scoped.AsEnumerable()
+            .Where(entry => entry.Value is not null)
+            .Select(entry => new KeyValuePair<string, string?>(
+                ConfigurationPath.Combine(JellyfinSectionRoot, entry.Key),
+                entry.Value))
+            .ToList();
+
+        return builder.AddInMemoryCollection(entries);
+    }
+}
@@ -0,0 +1,74 @@
+using System;
+using Emby.Server.Implementations.Configuration;
+using MediaBrowser.Common.Configuration;
+using MediaBrowser.Controller.MediaEncoding;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using StackExchange.Redis;
+
+namespace Jellyfin.Server.Extensions;
+
+/// <summary>
+/// Extensions for registering the shared-configuration invalidation bus.
+/// </summary>
+public static class ConfigurationInvalidationServiceCollectionExtensions
+{
+    /// <summary>
+    /// Registers the invalidation bus, Redis-backed when a connection string is configured and no-op
+    /// otherwise, and the subscriber applying the notices other instances publish.
+    /// </summary>
+    /// <remarks>
+    /// The connection string is only set for a multi-instance deployment, which is the only shape where
+    /// one instance can write the shared configuration directory behind another's back.
+    /// </remarks>
+    /// <param name="serviceCollection">The service collection.</param>
+    /// <param name="configuration">The configuration to read the Redis connection string from.</param>
+    /// <param name="logger">The logger to report the selected bus on.</param>
+    /// <returns>The updated service collection.</returns>
+    public static IServiceCollection AddConfigurationInvalidationBus(
+        this IServiceCollection serviceCollection,
+        IConfiguration configuration,
+        ILogger logger)
+    {
+        ArgumentNullException.ThrowIfNull(configuration);
+        ArgumentNullException.ThrowIfNull(logger);
+
+        if (string.IsNullOrEmpty(configuration[TranscodeStoreOptions.RedisConnectionStringKey]))
+        {
+            logger.LogInformation(
+                "Configuration invalidation bus: {Bus}. Shared-configuration and library-visibility changes stay local to the instance that made them; set {Key} to propagate them.",
+                nameof(NullConfigurationInvalidationBus),
+                TranscodeStoreOptions.RedisConnectionStringKey);
+
+            return serviceCollection.AddSingleton<IConfigurationInvalidationBus>(NullConfigurationInvalidationBus.Instance);
+        }
+
+        logger.LogInformation(
+            "Configuration invalidation bus: {Bus}. Shared-configuration and library-visibility changes propagate to every instance.",
+            nameof(RedisConfigurationInvalidationBus));
+
+        serviceCollection.AddSingleton<IConfigurationInvalidationBus>(sp =>
+        {
+            try
+            {
+                return new RedisConfigurationInvalidationBus(
+                    sp.GetRequiredService<IConnectionMultiplexer>(),
+                    sp.GetRequiredService<ILogger<RedisConfigurationInvalidationBus>>());
+            }
+            catch (Exception ex)
+            {
+                // Fail open: an unreachable Redis degrades to the single-instance behaviour of every
+                // instance keeping its own cached configuration, rather than aborting startup.
+                sp.GetRequiredService<ILogger<CoreAppHost>>().LogError(
+                    ex,
+                    "Redis is configured but unavailable, so shared-configuration changes will not propagate between instances. Check {Key}.",
+                    TranscodeStoreOptions.RedisConnectionStringKey);
+
+                return NullConfigurationInvalidationBus.Instance;
+            }
+        });
+
+        return serviceCollection.AddHostedService<ConfigurationInvalidationSubscriber>();
+    }
+}
@@ -0,0 +1,72 @@
+using System;
+using Emby.Server.Implementations.QuickConnect;
+using MediaBrowser.Controller.MediaEncoding;
+using MediaBrowser.Controller.QuickConnect;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using StackExchange.Redis;
+
+namespace Jellyfin.Server.Extensions;
+
+/// <summary>
+/// Extensions for registering the quick connect store.
+/// </summary>
+public static class QuickConnectStoreServiceCollectionExtensions
+{
+    /// <summary>
+    /// Registers the quick connect store, Redis-backed when a connection string is configured and
+    /// process-local otherwise, and reports the selected store at <see cref="LogLevel.Information"/>.
+    /// </summary>
+    /// <remarks>
+    /// The connection string is only set for a multi-instance deployment, which is the only shape where
+    /// the initiate, authorize and exchange legs of one flow can land on different instances.
+    /// </remarks>
+    /// <param name="serviceCollection">The service collection.</param>
+    /// <param name="configuration">The configuration to read the Redis connection string from.</param>
+    /// <param name="logger">The logger to report the selected store on.</param>
+    /// <returns>The updated service collection.</returns>
+    public static IServiceCollection AddQuickConnectStore(
+        this IServiceCollection serviceCollection,
+        IConfiguration configuration,
+        ILogger logger)
+    {
+        ArgumentNullException.ThrowIfNull(configuration);
+        ArgumentNullException.ThrowIfNull(logger);
+
+        if (string.IsNullOrEmpty(configuration[TranscodeStoreOptions.RedisConnectionStringKey]))
+        {
+            logger.LogInformation(
+                "Quick connect store: {Store}. A quick connect flow has to complete against one instance; set {Key} to share it.",
+                nameof(InMemoryQuickConnectStore),
+                TranscodeStoreOptions.RedisConnectionStringKey);
+
+            return serviceCollection.AddSingleton<IQuickConnectStore, InMemoryQuickConnectStore>();
+        }
+
+        logger.LogInformation(
+            "Quick connect store: {Store}. Quick connect flows complete across any instance.",
+            nameof(RedisQuickConnectStore));
+
+        return serviceCollection.AddSingleton<IQuickConnectStore>(sp =>
+        {
+            try
+            {
+                return new RedisQuickConnectStore(
+                    sp.GetRequiredService<IConnectionMultiplexer>(),
+                    sp.GetRequiredService<ILogger<RedisQuickConnectStore>>());
+            }
+            catch (Exception ex)
+            {
+                // Fail open: an unreachable Redis degrades to the single-instance behaviour of a flow
+                // having to complete against one instance, rather than taking quick connect down.
+                sp.GetRequiredService<ILogger<CoreAppHost>>().LogError(
+                    ex,
+                    "Redis is configured but unavailable, so quick connect flows will not complete across instances. Check {Key}.",
+                    TranscodeStoreOptions.RedisConnectionStringKey);
+
+                return new InMemoryQuickConnectStore();
+            }
+        });
+    }
+}
@@ -0,0 +1,71 @@
+using System;
+using Emby.Server.Implementations.ScheduledTasks;
+using MediaBrowser.Controller.ScheduledTasks;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+
+namespace Jellyfin.Server.Extensions;
+
+/// <summary>
+/// Extensions for registering the scan-leader lease.
+/// </summary>
+public static class ScanLeaderServiceCollectionExtensions
+{
+    private const string RedisConnectionStringKey = "Jellyfin:TranscodeStore:RedisConnectionString";
+
+    /// <summary>
+    /// Registers the scan-leader lease and reports at <see cref="LogLevel.Information"/> whether
+    /// timer-driven library tasks are gated to a single instance.
+    /// </summary>
+    /// <remarks>
+    /// Gating is on by default once a Redis connection string is configured: that is only set for a
+    /// multi-instance deployment, which is the only shape where running library scans on every
+    /// instance is wrong. Single-instance installs have no Redis and keep running every task locally.
+    /// </remarks>
+    /// <param name="serviceCollection">The service collection.</param>
+    /// <param name="configuration">The configuration to read <c>Jellyfin:ScanLeader</c> from.</param>
+    /// <param name="logger">The logger to report the gating decision on.</param>
+    /// <returns>The updated service collection.</returns>
+    public static IServiceCollection AddScanLeaderLease(
+        this IServiceCollection serviceCollection,
+        IConfiguration configuration,
+        ILogger logger)
+    {
+        ArgumentNullException.ThrowIfNull(configuration);
+        ArgumentNullException.ThrowIfNull(logger);
+
+        serviceCollection.Configure<ScanLeaderOptions>(configuration.GetSection(ScanLeaderOptions.ConfigurationSection));
+
+        var redisConfigured = !string.IsNullOrEmpty(configuration[RedisConnectionStringKey]);
+        var requested = bool.TryParse(configuration[ScanLeaderOptions.EnabledKey], out var explicitChoice)
+            ? explicitChoice
+            : redisConfigured;
+        var active = requested && redisConfigured;
+
+        // The task worker reads Enabled from the bound options, so the effective decision has to land
+        // there as well as on the lease registration below.
+        serviceCollection.PostConfigure<ScanLeaderOptions>(options => options.Enabled = active);
+
+        if (active)
+        {
+            logger.LogInformation(
+                "Scan-leader gating is active: timer-driven library tasks run only on the instance holding the Redis scan-leader lease.");
+
+            return serviceCollection.AddSingleton<IScanLeaderLease, RedisScanLeaderLease>();
+        }
+
+        if (requested)
+        {
+            logger.LogWarning(
+                "Scan-leader gating is enabled but no Redis connection string is configured ({Key}), so it cannot run: timer-driven library tasks run on every instance.",
+                RedisConnectionStringKey);
+        }
+        else
+        {
+            logger.LogInformation("Scan-leader gating is off: timer-driven library tasks run on every instance.");
+        }
+
+        return serviceCollection.AddSingleton<IScanLeaderLease, NullScanLeaderLease>();
+    }
+}
@@ -0,0 +1,87 @@
+using System;
+using System.Linq;
+using Emby.Server.Implementations.MediaEncoding;
+using MediaBrowser.Controller.MediaEncoding;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using StackExchange.Redis;
+
+namespace Jellyfin.Server.Extensions;
+
+/// <summary>
+/// Extensions for registering the transcode session store.
+/// </summary>
+public static class TranscodeStoreServiceCollectionExtensions
+{
+    /// <summary>
+    /// Registers the transcode session store, Redis-backed when a connection string is configured and
+    /// no-op otherwise, and reports the selected store at <see cref="LogLevel.Information"/>.
+    /// </summary>
+    /// <param name="serviceCollection">The service collection.</param>
+    /// <param name="configuration">The configuration to read <c>Jellyfin:TranscodeStore</c> from.</param>
+    /// <param name="logger">The logger to report the selected store on.</param>
+    /// <returns>The updated service collection.</returns>
+    public static IServiceCollection AddTranscodeSessionStore(
+        this IServiceCollection serviceCollection,
+        IConfiguration configuration,
+        ILogger logger)
+    {
+        ArgumentNullException.ThrowIfNull(configuration);
+        ArgumentNullException.ThrowIfNull(logger);
+
+        serviceCollection.Configure<TranscodeStoreOptions>(configuration.GetSection(TranscodeStoreOptions.ConfigurationSection));
+
+        var redisConnectionString = configuration[TranscodeStoreOptions.RedisConnectionStringKey];
+        if (string.IsNullOrEmpty(redisConnectionString))
+        {
+            logger.LogInformation(
+                "Transcode session store: {Store}. Cross-pod transcode takeover is off; set {Key} to enable it.",
+                nameof(NullTranscodeSessionStore),
+                TranscodeStoreOptions.RedisConnectionStringKey);
+
+            return serviceCollection.AddSingleton<ITranscodeSessionStore, NullTranscodeSessionStore>();
+        }
+
+        logger.LogInformation(
+            "Transcode session store: {Store} on {Endpoints}.",
+            nameof(RedisTranscodeSessionStore),
+            DescribeEndpoints(redisConnectionString));
+
+        serviceCollection.AddSingleton<IConnectionMultiplexer>(sp =>
+        {
+            try
+            {
+                return ConnectionMultiplexer.Connect(redisConnectionString);
+            }
+            catch (Exception ex)
+            {
+                sp.GetRequiredService<ILogger<CoreAppHost>>()
+                    .LogError(ex, "Failed to connect to Redis. Check the {Key} configuration.", TranscodeStoreOptions.RedisConnectionStringKey);
+                throw;
+            }
+        });
+        serviceCollection.AddSingleton<ITranscodeSessionStore, RedisTranscodeSessionStore>();
+        serviceCollection.AddHostedService<TranscodeStoreConnectivityProbe>();
+
+        return serviceCollection;
+    }
+
+    /// <summary>
+    /// Renders the endpoints of a connection string for logging. The connection string itself is never
+    /// logged because it can carry a password.
+    /// </summary>
+    private static string DescribeEndpoints(string redisConnectionString)
+    {
+        try
+        {
+            return string.Join(
+                ',',
+                ConfigurationOptions.Parse(redisConnectionString).EndPoints.Select(endpoint => endpoint.ToString()));
+        }
+        catch (ArgumentException)
+        {
+            return "(unparsable connection string)";
+        }
+    }
+}
@@ -56,6 +56,7 @@
    <PackageReference Include="Serilog.Sinks.Console" />
    <PackageReference Include="Serilog.Sinks.File" />
    <PackageReference Include="Serilog.Sinks.Graylog" />
+    <PackageReference Include="StackExchange.Redis" />
  </ItemGroup>

  <ItemGroup>
@@ -36,7 +36,9 @@ internal class MigrateRatingLevels : IDatabaseMigrationRoutine
        _logger.LogInformation("Recalculating parental rating levels based on rating string.");
        using var context = _provider.CreateDbContext();
        using var transaction = context.Database.BeginTransaction();
-        var ratings = context.BaseItems.AsNoTracking().Select(e => e.OfficialRating).Distinct();
+        // Read the whole list up front: the updates below run on the same connection, and a provider
+        // that cannot multiplex commands rejects them while the reader is still open.
+        var ratings = context.BaseItems.AsNoTracking().Select(e => e.OfficialRating).Distinct().ToList();
        foreach (var rating in ratings)
        {
            if (string.IsNullOrEmpty(rating))
@@ -24,6 +24,7 @@ using Jellyfin.Server.ServerSetupApp;
 using MediaBrowser.Common.Configuration;
 using MediaBrowser.Common.Net;
 using MediaBrowser.Controller;
+using MediaBrowser.Controller.Configuration;
 using Microsoft.AspNetCore.Hosting;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Configuration;
@@ -304,6 +305,10 @@ namespace Jellyfin.Server
                .AddJellyfinDbContext(startupConfigurationManager, startupConfig)
                .AddSingleton<IApplicationPaths>(appPaths)
                .AddSingleton<ServerApplicationPaths>(appPaths)
+                // Required by the NpgsqlDataSource factory in AddJellyfinDbContext when
+                // DatabaseType=Jellyfin-PostgreSQL — the factory resolves this from DI
+                // to read CustomProviderOptions and pool settings.
+                .AddSingleton<IServerConfigurationManager>(startupConfigurationManager)
                .RegisterStartupLogger();

            var startupService = migrationStartupServiceProvider.BuildServiceProvider();
@@ -386,6 +391,8 @@ namespace Jellyfin.Server
                .AddInMemoryCollection(inMemoryDefaultConfig)
                .AddJsonFile(LoggingConfigFileDefault, optional: false, reloadOnChange: true)
                .AddJsonFile(LoggingConfigFileSystem, optional: true, reloadOnChange: true)
+                // Added before the prefixed source so an explicit JELLYFIN_ variable still wins.
+                .AddJellyfinSectionEnvironmentVariables()
                .AddEnvironmentVariables("JELLYFIN_")
                .AddInMemoryCollection(commandLineOpts.ConvertToConfig());
        }
@@ -68,6 +68,8 @@ Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Jellyfin.Server.Tests", "te
 EndProject
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Jellyfin.Server.Integration.Tests", "tests\Jellyfin.Server.Integration.Tests\Jellyfin.Server.Integration.Tests.csproj", "{68B0B823-A5AC-4E8B-82EA-965AAC7BF76E}"
 EndProject
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Jellyfin.Database.Tests.PostgreSQL", "tests\Jellyfin.Database.Tests.PostgreSQL\Jellyfin.Database.Tests.PostgreSQL.csproj", "{B5F2C3A1-9D4E-4F8A-B123-456789ABCDEF}"
+EndProject
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Jellyfin.Providers.Tests", "tests\Jellyfin.Providers.Tests\Jellyfin.Providers.Tests.csproj", "{A964008C-2136-4716-B6CB-B3426C22320A}"
 EndProject
 Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "src", "src", "{C9F0AB5D-F4D7-40C8-A353-3305C86D6D4C}"
@@ -95,10 +97,16 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Jellyfin.Database", "Jellyf
 EndProject
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Jellyfin.Database.Providers.Sqlite", "src\Jellyfin.Database\Jellyfin.Database.Providers.Sqlite\Jellyfin.Database.Providers.Sqlite.csproj", "{A5590358-33CC-4B39-BDE7-DC62FEB03C76}"
 EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Jellyfin.Database.Providers.PostgreSQL", "src\Jellyfin.Database\Jellyfin.Database.Providers.PostgreSQL\Jellyfin.Database.Providers.PostgreSQL.csproj", "{B3C4D5E6-F7A8-4B9C-0D1E-2F3A4B5C6D7E}"
+EndProject
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Jellyfin.Database.Implementations", "src\Jellyfin.Database\Jellyfin.Database.Implementations\Jellyfin.Database.Implementations.csproj", "{8C9F9221-8415-496C-B1F5-E7756F03FA59}"
 EndProject
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Jellyfin.CodeAnalysis", "src\Jellyfin.CodeAnalysis\Jellyfin.CodeAnalysis.csproj", "{11643D0F-6761-4EF7-AB71-6F9F8DE00714}"
 EndProject
+Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "tools", "tools", "{3C85DA50-31AC-40D3-BCF4-F1B14C420996}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Jellyfin.DbMigrator", "tools\Jellyfin.DbMigrator\Jellyfin.DbMigrator.csproj", "{6F7187CB-E1CB-4583-98CF-0FB87F21E844}"
+EndProject
 Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Jellyfin.Drawing.Skia.Tests", "tests\Jellyfin.Drawing.Skia.Tests\Jellyfin.Drawing.Skia.Tests.csproj", "{E24A279C-9A37-419A-8F9C-853C11FBE753}"
 EndProject
 Global
@@ -219,6 +227,10 @@ Global
 		{68B0B823-A5AC-4E8B-82EA-965AAC7BF76E}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{68B0B823-A5AC-4E8B-82EA-965AAC7BF76E}.Release|Any CPU.ActiveCfg = Release|Any CPU
 		{68B0B823-A5AC-4E8B-82EA-965AAC7BF76E}.Release|Any CPU.Build.0 = Release|Any CPU
+		{B5F2C3A1-9D4E-4F8A-B123-456789ABCDEF}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{B5F2C3A1-9D4E-4F8A-B123-456789ABCDEF}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{B5F2C3A1-9D4E-4F8A-B123-456789ABCDEF}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{B5F2C3A1-9D4E-4F8A-B123-456789ABCDEF}.Release|Any CPU.Build.0 = Release|Any CPU
 		{A964008C-2136-4716-B6CB-B3426C22320A}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
 		{A964008C-2136-4716-B6CB-B3426C22320A}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{A964008C-2136-4716-B6CB-B3426C22320A}.Release|Any CPU.ActiveCfg = Release|Any CPU
@@ -259,6 +271,10 @@ Global
 		{A5590358-33CC-4B39-BDE7-DC62FEB03C76}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{A5590358-33CC-4B39-BDE7-DC62FEB03C76}.Release|Any CPU.ActiveCfg = Release|Any CPU
 		{A5590358-33CC-4B39-BDE7-DC62FEB03C76}.Release|Any CPU.Build.0 = Release|Any CPU
+		{B3C4D5E6-F7A8-4B9C-0D1E-2F3A4B5C6D7E}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{B3C4D5E6-F7A8-4B9C-0D1E-2F3A4B5C6D7E}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{B3C4D5E6-F7A8-4B9C-0D1E-2F3A4B5C6D7E}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{B3C4D5E6-F7A8-4B9C-0D1E-2F3A4B5C6D7E}.Release|Any CPU.Build.0 = Release|Any CPU
 		{8C9F9221-8415-496C-B1F5-E7756F03FA59}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
 		{8C9F9221-8415-496C-B1F5-E7756F03FA59}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{8C9F9221-8415-496C-B1F5-E7756F03FA59}.Release|Any CPU.ActiveCfg = Release|Any CPU
@@ -267,6 +283,10 @@ Global
 		{11643D0F-6761-4EF7-AB71-6F9F8DE00714}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{11643D0F-6761-4EF7-AB71-6F9F8DE00714}.Release|Any CPU.ActiveCfg = Release|Any CPU
 		{11643D0F-6761-4EF7-AB71-6F9F8DE00714}.Release|Any CPU.Build.0 = Release|Any CPU
+		{6F7187CB-E1CB-4583-98CF-0FB87F21E844}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{6F7187CB-E1CB-4583-98CF-0FB87F21E844}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{6F7187CB-E1CB-4583-98CF-0FB87F21E844}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{6F7187CB-E1CB-4583-98CF-0FB87F21E844}.Release|Any CPU.Build.0 = Release|Any CPU
 		{E24A279C-9A37-419A-8F9C-853C11FBE753}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
 		{E24A279C-9A37-419A-8F9C-853C11FBE753}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{E24A279C-9A37-419A-8F9C-853C11FBE753}.Release|Any CPU.ActiveCfg = Release|Any CPU
@@ -290,6 +310,7 @@ Global
 		{42816EA8-4511-4CBF-A9C7-7791D5DDDAE6} = {FBBB5129-006E-4AD7-BAD5-8B7CA1D10ED6}
 		{3ADBCD8C-C0F2-4956-8FDC-35D686B74CF9} = {FBBB5129-006E-4AD7-BAD5-8B7CA1D10ED6}
 		{68B0B823-A5AC-4E8B-82EA-965AAC7BF76E} = {FBBB5129-006E-4AD7-BAD5-8B7CA1D10ED6}
+		{B5F2C3A1-9D4E-4F8A-B123-456789ABCDEF} = {FBBB5129-006E-4AD7-BAD5-8B7CA1D10ED6}
 		{A964008C-2136-4716-B6CB-B3426C22320A} = {FBBB5129-006E-4AD7-BAD5-8B7CA1D10ED6}
 		{750B8757-BE3D-4F8C-941A-FBAD94904ADA} = {C9F0AB5D-F4D7-40C8-A353-3305C86D6D4C}
 		{332A5C7A-F907-47CA-910E-BE6F7371B9E0} = {FBBB5129-006E-4AD7-BAD5-8B7CA1D10ED6}
@@ -301,8 +322,10 @@ Global
 		{8C6B2B13-58A4-4506-9DAB-1F882A093FE0} = {C9F0AB5D-F4D7-40C8-A353-3305C86D6D4C}
 		{4C54CE05-69C8-48FA-8785-39F7F6DB1CAD} = {C9F0AB5D-F4D7-40C8-A353-3305C86D6D4C}
 		{A5590358-33CC-4B39-BDE7-DC62FEB03C76} = {4C54CE05-69C8-48FA-8785-39F7F6DB1CAD}
+		{B3C4D5E6-F7A8-4B9C-0D1E-2F3A4B5C6D7E} = {4C54CE05-69C8-48FA-8785-39F7F6DB1CAD}
 		{8C9F9221-8415-496C-B1F5-E7756F03FA59} = {4C54CE05-69C8-48FA-8785-39F7F6DB1CAD}
 		{11643D0F-6761-4EF7-AB71-6F9F8DE00714} = {C9F0AB5D-F4D7-40C8-A353-3305C86D6D4C}
+		{6F7187CB-E1CB-4583-98CF-0FB87F21E844} = {3C85DA50-31AC-40D3-BCF4-F1B14C420996}
 		{E24A279C-9A37-419A-8F9C-853C11FBE753} = {FBBB5129-006E-4AD7-BAD5-8B7CA1D10ED6}
 	EndGlobalSection
 	GlobalSection(ExtensibilityGlobals) = postSolution
@@ -0,0 +1,26 @@
+namespace MediaBrowser.Common.Configuration
+{
+    /// <summary>
+    /// A notice that one instance has written shared configuration, so every other instance has to drop
+    /// its locally cached copy and read the shared file again.
+    /// </summary>
+    public sealed class ConfigurationInvalidation
+    {
+        /// <summary>
+        /// Gets or sets the cache this notice refers to.
+        /// </summary>
+        public ConfigurationInvalidationScope Scope { get; set; }
+
+        /// <summary>
+        /// Gets or sets what was invalidated within the scope: the configuration key for
+        /// <see cref="ConfigurationInvalidationScope.NamedConfiguration"/>, the library path for
+        /// <see cref="ConfigurationInvalidationScope.LibraryOptions"/>, and <c>null</c> otherwise.
+        /// </summary>
+        public string? Target { get; set; }
+
+        /// <summary>
+        /// Gets or sets the identity of the instance that published the notice, so it can ignore its own.
+        /// </summary>
+        public string? OriginId { get; set; }
+    }
+}
@@ -0,0 +1,30 @@
+namespace MediaBrowser.Common.Configuration
+{
+    /// <summary>
+    /// Extensions for <see cref="IConfigurationInvalidationBus"/>.
+    /// </summary>
+    public static class ConfigurationInvalidationBusExtensions
+    {
+        /// <summary>
+        /// Announces a write this instance originated, and stays silent for a write induced by an
+        /// invalidation another instance published.
+        /// </summary>
+        /// <remarks>
+        /// This is the backstop for the write path: a consumer reacting to an applied invalidation by
+        /// writing - including a plugin that knows nothing about the bus - cannot turn that write into a
+        /// notice of its own.
+        /// </remarks>
+        /// <param name="bus">The bus.</param>
+        /// <param name="scope">The cache that was written.</param>
+        /// <param name="target">The configuration key or library path that was written, if any.</param>
+        public static void PublishLocalWrite(this IConfigurationInvalidationBus bus, ConfigurationInvalidationScope scope, string? target)
+        {
+            if (ConfigurationInvalidationContext.IsApplyingRemoteInvalidation)
+            {
+                return;
+            }
+
+            bus.Publish(scope, target);
+        }
+    }
+}
@@ -0,0 +1,57 @@
+using System;
+using System.Threading;
+
+namespace MediaBrowser.Common.Configuration
+{
+    /// <summary>
+    /// Marks the flow of control that is applying an invalidation published by another instance, so the
+    /// reactions to it can tell a remote write apart from a local one.
+    /// </summary>
+    /// <remarks>
+    /// Applying an invalidation raises the same update events a local save raises, because the in-process
+    /// consumers have to re-read the configuration either way. Some of those consumers answer an update by
+    /// writing, and that write must neither repeat what the publishing instance already did nor fan back
+    /// out over the bus. The flag rides the execution context, so it reaches the queued and asynchronous
+    /// event handlers as well as the synchronous ones.
+    /// </remarks>
+    public static class ConfigurationInvalidationContext
+    {
+        private static readonly AsyncLocal<bool> _applyingRemoteInvalidation = new();
+
+        /// <summary>
+        /// Gets a value indicating whether the current flow of control is applying an invalidation
+        /// published by another instance rather than handling a local save.
+        /// </summary>
+        public static bool IsApplyingRemoteInvalidation => _applyingRemoteInvalidation.Value;
+
+        /// <summary>
+        /// Marks the current flow of control as applying a remote invalidation until the returned scope is
+        /// disposed.
+        /// </summary>
+        /// <returns>The scope to dispose once the invalidation has been applied.</returns>
+        public static IDisposable BeginApply() => new ApplyScope();
+
+        private sealed class ApplyScope : IDisposable
+        {
+            private readonly bool _previous;
+            private bool _disposed;
+
+            public ApplyScope()
+            {
+                _previous = _applyingRemoteInvalidation.Value;
+                _applyingRemoteInvalidation.Value = true;
+            }
+
+            public void Dispose()
+            {
+                if (_disposed)
+                {
+                    return;
+                }
+
+                _disposed = true;
+                _applyingRemoteInvalidation.Value = _previous;
+            }
+        }
+    }
+}
@@ -0,0 +1,29 @@
+namespace MediaBrowser.Common.Configuration
+{
+    /// <summary>
+    /// Identifies which locally cached copy of the shared configuration a
+    /// <see cref="ConfigurationInvalidation"/> refers to.
+    /// </summary>
+    public enum ConfigurationInvalidationScope
+    {
+        /// <summary>
+        /// The system configuration cached by the configuration manager.
+        /// </summary>
+        SystemConfiguration = 0,
+
+        /// <summary>
+        /// A single named configuration, identified by its key.
+        /// </summary>
+        NamedConfiguration = 1,
+
+        /// <summary>
+        /// The library options of a single collection folder, identified by its path.
+        /// </summary>
+        LibraryOptions = 2,
+
+        /// <summary>
+        /// The library options of every collection folder, for changes to the library structure itself.
+        /// </summary>
+        AllLibraryOptions = 3
+    }
+}
@@ -0,0 +1,28 @@
+using System;
+
+namespace MediaBrowser.Common.Configuration
+{
+    /// <summary>
+    /// Carries cache-invalidation notices between the instances that share one configuration directory.
+    /// </summary>
+    /// <remarks>
+    /// The shared directory carries the content; this bus only carries the fact that it changed. Every
+    /// implementation is expected to fail open: a bus that cannot deliver must not throw into the write
+    /// path, leaving each instance on its own locally cached copy until it restarts.
+    /// </remarks>
+    public interface IConfigurationInvalidationBus
+    {
+        /// <summary>
+        /// Announces that this instance has written shared configuration.
+        /// </summary>
+        /// <param name="scope">The cache that was written.</param>
+        /// <param name="target">The configuration key or library path that was written, if any.</param>
+        void Publish(ConfigurationInvalidationScope scope, string? target);
+
+        /// <summary>
+        /// Registers the handler invoked for notices published by other instances.
+        /// </summary>
+        /// <param name="handler">The handler applying the invalidation locally.</param>
+        void Subscribe(Action<ConfigurationInvalidation> handler);
+    }
+}
@@ -85,6 +85,20 @@ namespace MediaBrowser.Common.Configuration
        /// </summary>
        /// <param name="factories">The factories.</param>
        void AddParts(IEnumerable<IConfigurationFactory> factories);
+
+        /// <summary>
+        /// Drops the locally cached copy of configuration another instance has written to the shared
+        /// configuration directory, so the next read reloads it, and raises the local update event.
+        /// </summary>
+        /// <remarks>
+        /// An implementation predating the invalidation bus keeps the default, which reports that it
+        /// cannot drop its cache rather than quietly leaving it stale. The caller applying a remote
+        /// notice treats that as a failed apply and logs it.
+        /// </remarks>
+        /// <param name="key">The named configuration key, or <c>null</c> for the system configuration.</param>
+        /// <exception cref="NotSupportedException">The implementation cannot drop its cached configuration.</exception>
+        void InvalidateCachedConfiguration(string? key)
+            => throw new NotSupportedException(GetType().Name + " cannot drop configuration cached from the shared configuration directory, so writes by other instances will not be picked up.");
    }

    public static class ConfigurationManagerExtensions
@@ -0,0 +1,27 @@
+using System;
+
+namespace MediaBrowser.Common.Configuration
+{
+    /// <summary>
+    /// A no-op <see cref="IConfigurationInvalidationBus"/> used by single-instance installs and whenever
+    /// the shared bus is unavailable. Every instance keeps its own cached configuration, which is the
+    /// behaviour of an install that has only one.
+    /// </summary>
+    public sealed class NullConfigurationInvalidationBus : IConfigurationInvalidationBus
+    {
+        /// <summary>
+        /// Gets the shared instance.
+        /// </summary>
+        public static NullConfigurationInvalidationBus Instance { get; } = new NullConfigurationInvalidationBus();
+
+        /// <inheritdoc />
+        public void Publish(ConfigurationInvalidationScope scope, string? target)
+        {
+        }
+
+        /// <inheritdoc />
+        public void Subscribe(Action<ConfigurationInvalidation> handler)
+        {
+        }
+    }
+}
@@ -47,29 +47,29 @@ public interface IDeviceManager
    /// Gets the device information.
    /// </summary>
    /// <param name="id">The identifier.</param>
-    /// <returns>DeviceInfoDto.</returns>
-    DeviceInfoDto? GetDevice(string id);
+    /// <returns>A <see cref="Task"/> representing the retrieval of the device information.</returns>
+    Task<DeviceInfoDto?> GetDevice(string id);

    /// <summary>
    /// Gets devices based on the provided query.
    /// </summary>
    /// <param name="query">The device query.</param>
    /// <returns>A <see cref="Task{QueryResult}"/> representing the retrieval of the devices.</returns>
-    QueryResult<Device> GetDevices(DeviceQuery query);
+    Task<QueryResult<Device>> GetDevices(DeviceQuery query);

    /// <summary>
    /// Gets device information based on the provided query.
    /// </summary>
    /// <param name="query">The device query.</param>
    /// <returns>A <see cref="Task{QueryResult}"/> representing the retrieval of the device information.</returns>
-    QueryResult<DeviceInfo> GetDeviceInfos(DeviceQuery query);
+    Task<QueryResult<DeviceInfo>> GetDeviceInfos(DeviceQuery query);

    /// <summary>
    /// Gets the device information.
    /// </summary>
    /// <param name="userId">The user's id, or <c>null</c>.</param>
-    /// <returns>IEnumerable&lt;DeviceInfoDto&gt;.</returns>
-    QueryResult<DeviceInfoDto> GetDevicesForUser(Guid? userId);
+    /// <returns>A <see cref="Task{QueryResult}"/> representing the retrieval of the device information.</returns>
+    Task<QueryResult<DeviceInfoDto>> GetDevicesForUser(Guid? userId);

    /// <summary>
    /// Deletes a device.
@@ -105,8 +105,8 @@ public interface IDeviceManager
    /// Gets the options of a device.
    /// </summary>
    /// <param name="deviceId">The device id.</param>
-    /// <returns><see cref="DeviceOptions"/> of the device.</returns>
-    DeviceOptionsDto? GetDeviceOptions(string deviceId);
+    /// <returns>A <see cref="Task"/> representing the retrieval of the <see cref="DeviceOptions"/> of the device.</returns>
+    Task<DeviceOptionsDto?> GetDeviceOptions(string deviceId);

    /// <summary>
    /// Gets the dto for client capabilities.
@@ -14,6 +14,7 @@ using System.Threading.Tasks;
 using Jellyfin.Data.Enums;
 using Jellyfin.Database.Implementations.Entities;
 using Jellyfin.Extensions.Json;
+using MediaBrowser.Common.Configuration;
 using MediaBrowser.Controller.IO;
 using MediaBrowser.Controller.Library;
 using MediaBrowser.Controller.Providers;
@@ -70,6 +71,12 @@ namespace MediaBrowser.Controller.Entities

        public static IServerApplicationHost ApplicationHost { get; set; }

+        /// <summary>
+        /// Gets or sets the bus announcing library option writes to the other instances sharing this
+        /// configuration directory. Defaults to a no-op, which is the single-instance behaviour.
+        /// </summary>
+        public static IConfigurationInvalidationBus InvalidationBus { get; set; } = NullConfigurationInvalidationBus.Instance;
+
        [JsonIgnore]
        public override bool SupportsPlayedStatus => false;

@@ -188,11 +195,36 @@ namespace MediaBrowser.Controller.Entities
            XmlSerializer.SerializeToFile(clone, GetLibraryOptionsPath(path));

            LibraryOptionsUpdated?.Invoke(null, new LibraryOptionsUpdatedEventArgs(path, options));
+
+            InvalidationBus.PublishLocalWrite(ConfigurationInvalidationScope.LibraryOptions, path);
        }

-        public static void OnCollectionFolderChange()
+        /// <summary>
+        /// Drops the cached options of one library so the next read comes off <c>options.xml</c> again.
+        /// Applied on the instances that did not write, and so does not publish.
+        /// </summary>
+        /// <param name="path">The library path.</param>
+        public static void InvalidateLibraryOptions(string path)
+        {
+            _libraryOptions.TryRemove(path, out _);
+
+            LibraryOptionsUpdated?.Invoke(null, new LibraryOptionsUpdatedEventArgs(path, GetLibraryOptions(path)));
+        }
+
+        /// <summary>
+        /// Drops every cached library option set. Applied on the instances that did not write, and so does
+        /// not publish.
+        /// </summary>
+        public static void InvalidateAllLibraryOptions()
            => _libraryOptions.Clear();

+        public static void OnCollectionFolderChange()
+        {
+            InvalidateAllLibraryOptions();
+
+            InvalidationBus.PublishLocalWrite(ConfigurationInvalidationScope.AllLibraryOptions, null);
+        }
+
        public override bool IsSaveLocalMetadataEnabled()
        {
            return true;
@@ -449,19 +449,26 @@ namespace MediaBrowser.Controller.Entities
            IUserDataManager userDataManager,
            ILibraryManager libraryManager)
        {
-            var filtered = items.Where(i => Filter(i, user, query, userDataManager, libraryManager));
+            var itemList = items as IReadOnlyList<BaseItem> ?? items.ToList();
+
+            // The user data checks below run per item, so read them all in one query up front.
+            var userDataBatch = user is not null && RequiresUserData(query)
+                ? userDataManager.GetUserDataBatch(itemList, user)
+                : null;
+
+            var filtered = itemList.Where(i => Filter(i, user, query, userDataManager, libraryManager, userDataBatch));

            if (query.IsPlayed.HasValue && user is not null)
            {
-                var itemList = filtered.ToList();
-                var folderIds = itemList.OfType<Folder>().Select(f => f.Id).ToList();
+                var filteredList = filtered.ToList();
+                var folderIds = filteredList.OfType<Folder>().Select(f => f.Id).ToList();

                if (folderIds.Count > 0)
                {
                    var counts = libraryManager.GetPlayedAndTotalCountBatch(folderIds, user);
                    var isPlayedValue = query.IsPlayed.Value;

-                    return itemList.Where(item =>
+                    return filteredList.Where(item =>
                    {
                        if (item is Folder)
                        {
@@ -473,7 +480,7 @@ namespace MediaBrowser.Controller.Entities
                    });
                }

-                return itemList;
+                return filteredList;
            }

            return filtered;
@@ -515,12 +522,29 @@ namespace MediaBrowser.Controller.Entities
                itemsArray);
        }

+        private static bool RequiresUserData(InternalItemsQuery query)
+            => query.IsLiked.HasValue
+                || query.IsFavoriteOrLiked.HasValue
+                || query.IsFavorite.HasValue
+                || query.IsResumable.HasValue
+                || query.IsPlayed.HasValue;
+
+        private static UserItemData GetUserData(
+            IUserDataManager userDataManager,
+            User user,
+            BaseItem item,
+            Dictionary<Guid, UserItemData> userDataBatch)
+            => userDataBatch is not null && userDataBatch.TryGetValue(item.Id, out var userData)
+                ? userData
+                : userDataManager.GetUserData(user, item);
+
        private static bool Filter(
            BaseItem item,
            User user,
            InternalItemsQuery query,
            IUserDataManager userDataManager,
-            ILibraryManager libraryManager)
+            ILibraryManager libraryManager,
+            Dictionary<Guid, UserItemData> userDataBatch)
        {
            if (!string.IsNullOrEmpty(query.NameStartsWith) && !item.SortName.StartsWith(query.NameStartsWith, StringComparison.InvariantCultureIgnoreCase))
            {
@@ -568,7 +592,7 @@ namespace MediaBrowser.Controller.Entities

            if (query.IsLiked.HasValue)
            {
-                userData = userDataManager.GetUserData(user, item);
+                userData = GetUserData(userDataManager, user, item, userDataBatch);
                if (!userData.Likes.HasValue || userData.Likes != query.IsLiked.Value)
                {
                    return false;
@@ -577,7 +601,7 @@ namespace MediaBrowser.Controller.Entities

            if (query.IsFavoriteOrLiked.HasValue)
            {
-                userData ??= userDataManager.GetUserData(user, item);
+                userData ??= GetUserData(userDataManager, user, item, userDataBatch);
                var isFavoriteOrLiked = userData.IsFavorite || (userData.Likes ?? false);

                if (isFavoriteOrLiked != query.IsFavoriteOrLiked.Value)
@@ -588,7 +612,7 @@ namespace MediaBrowser.Controller.Entities

            if (query.IsFavorite.HasValue)
            {
-                userData ??= userDataManager.GetUserData(user, item);
+                userData ??= GetUserData(userDataManager, user, item, userDataBatch);
                if (userData.IsFavorite != query.IsFavorite.Value)
                {
                    return false;
@@ -597,7 +621,7 @@ namespace MediaBrowser.Controller.Entities

            if (query.IsResumable.HasValue)
            {
-                userData ??= userDataManager.GetUserData(user, item);
+                userData ??= GetUserData(userDataManager, user, item, userDataBatch);
                var isResumable = userData.PlaybackPositionTicks > 0;

                if (isResumable != query.IsResumable.Value)
@@ -612,7 +636,7 @@ namespace MediaBrowser.Controller.Entities
                // Folders are batch-filtered by the collection Filter() overload.
                if (!item.IsFolder)
                {
-                    userData ??= userDataManager.GetUserData(user, item);
+                    userData ??= GetUserData(userDataManager, user, item, userDataBatch);
                    if (item.IsPlayed(user, userData) != query.IsPlayed.Value)
                    {
                        return false;
@@ -0,0 +1,79 @@
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace MediaBrowser.Controller.MediaEncoding;
+
+/// <summary>
+/// Provides a durable store for HLS transcoding session state, enabling
+/// HA recovery and lease-based ownership between pods.
+/// </summary>
+public interface ITranscodeSessionStore
+{
+    /// <summary>
+    /// Attempts to retrieve a transcoding session by its play session identifier.
+    /// </summary>
+    /// <param name="playSessionId">The play session identifier.</param>
+    /// <param name="cancellationToken">A cancellation token.</param>
+    /// <returns>
+    /// The <see cref="TranscodeSession"/> if it exists and its lease has not expired;
+    /// otherwise <c>null</c>.
+    /// </returns>
+    Task<TranscodeSession?> TryGetAsync(string playSessionId, CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Attempts to take over ownership of an existing session by claiming the lease for
+    /// <paramref name="claimingPod"/>. Takeover succeeds only when the session exists and
+    /// its current lease has already expired.
+    /// </summary>
+    /// <param name="playSessionId">The play session identifier.</param>
+    /// <param name="claimingPod">The name of the pod attempting to claim ownership.</param>
+    /// <param name="cancellationToken">A cancellation token.</param>
+    /// <returns>
+    /// <c>true</c> if the takeover succeeded (the claiming pod now holds the lease);
+    /// <c>false</c> if the session does not exist, its lease is still valid, or another
+    /// concurrent caller already claimed it.
+    /// </returns>
+    Task<bool> TryTakeoverAsync(string playSessionId, string claimingPod, CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Persists a new or updated transcoding session.
+    /// </summary>
+    /// <param name="session">The session to store.</param>
+    /// <param name="cancellationToken">A cancellation token.</param>
+    /// <returns>A <see cref="Task"/> representing the asynchronous operation.</returns>
+    Task SetAsync(TranscodeSession session, CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Renews the lease for an existing session, extending its
+    /// <see cref="TranscodeSession.LeaseExpiresUtc"/> by the store's configured lease duration.
+    /// The renewal is rejected when <paramref name="ownerPod"/> no longer owns the lease, so a
+    /// renewal in flight while another pod wins <see cref="TryTakeoverAsync"/> cannot revert the takeover.
+    /// </summary>
+    /// <param name="playSessionId">The play session identifier.</param>
+    /// <param name="ownerPod">The name of the pod that believes it owns the lease.</param>
+    /// <param name="cancellationToken">A cancellation token.</param>
+    /// <returns>
+    /// <c>true</c> if the lease was renewed; <c>false</c> if the session no longer exists or is
+    /// owned by another pod.
+    /// </returns>
+    Task<bool> RenewLeaseAsync(string playSessionId, string ownerPod, CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Removes a transcoding session from the store.
+    /// </summary>
+    /// <param name="playSessionId">The play session identifier.</param>
+    /// <param name="cancellationToken">A cancellation token.</param>
+    /// <returns>A <see cref="Task"/> representing the asynchronous operation.</returns>
+    Task DeleteAsync(string playSessionId, CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Returns all currently active transcoding sessions from the store.
+    /// </summary>
+    /// <param name="cancellationToken">A cancellation token.</param>
+    /// <returns>
+    /// An enumerable of <see cref="TranscodeSession"/> objects representing all active sessions.
+    /// Returns an empty enumerable if no sessions are active or if the store cannot be reached.
+    /// </returns>
+    Task<IEnumerable<TranscodeSession>> GetActiveSessionsAsync(CancellationToken cancellationToken = default);
+}
@@ -0,0 +1,37 @@
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace MediaBrowser.Controller.MediaEncoding;
+
+/// <summary>
+/// A no-op implementation of <see cref="ITranscodeSessionStore"/> used in single-instance deployments
+/// where durable session tracking across pods is not required.
+/// </summary>
+public sealed class NullTranscodeSessionStore : ITranscodeSessionStore
+{
+    /// <inheritdoc />
+    public Task<TranscodeSession?> TryGetAsync(string playSessionId, CancellationToken cancellationToken = default)
+        => Task.FromResult<TranscodeSession?>(null);
+
+    /// <inheritdoc />
+    public Task<bool> TryTakeoverAsync(string playSessionId, string claimingPod, CancellationToken cancellationToken = default)
+        => Task.FromResult(false);
+
+    /// <inheritdoc />
+    public Task SetAsync(TranscodeSession session, CancellationToken cancellationToken = default)
+        => Task.CompletedTask;
+
+    /// <inheritdoc />
+    public Task<bool> RenewLeaseAsync(string playSessionId, string ownerPod, CancellationToken cancellationToken = default)
+        => Task.FromResult(true);
+
+    /// <inheritdoc />
+    public Task DeleteAsync(string playSessionId, CancellationToken cancellationToken = default)
+        => Task.CompletedTask;
+
+    /// <inheritdoc />
+    public Task<IEnumerable<TranscodeSession>> GetActiveSessionsAsync(CancellationToken cancellationToken = default)
+        => Task.FromResult<IEnumerable<TranscodeSession>>(Array.Empty<TranscodeSession>());
+}
@@ -0,0 +1,86 @@
+using System;
+using System.IO;
+
+namespace MediaBrowser.Controller.MediaEncoding;
+
+/// <summary>
+/// Represents a durable record of an HLS transcoding session for HA pod recovery.
+/// </summary>
+public sealed class TranscodeSession
+{
+    /// <summary>
+    /// Gets or sets the unique play session identifier.
+    /// </summary>
+    public string PlaySessionId { get; set; } = string.Empty;
+
+    /// <summary>
+    /// Gets or sets the name of the pod that currently owns this session's lease.
+    /// </summary>
+    public string OwnerPod { get; set; } = string.Empty;
+
+    /// <summary>
+    /// Gets or sets the UTC time at which the owning pod's lease expires.
+    /// </summary>
+    public DateTime LeaseExpiresUtc { get; set; }
+
+    /// <summary>
+    /// Gets or sets the absolute path to the HLS manifest (.m3u8) file on shared storage.
+    /// </summary>
+    public string ManifestPath { get; set; } = string.Empty;
+
+    /// <summary>
+    /// Gets or sets the path prefix for transcoded segment files on shared storage.
+    /// </summary>
+    public string SegmentPathPrefix { get; set; } = string.Empty;
+
+    /// <summary>
+    /// Gets or sets the media source identifier associated with this session.
+    /// </summary>
+    public string MediaSourceId { get; set; } = string.Empty;
+
+    /// <summary>
+    /// Gets or sets the zero-based index of the last segment that was fully written to durable storage.
+    /// </summary>
+    public int LastCompletedSegmentIndex { get; set; }
+
+    /// <summary>
+    /// Gets or sets the last durable playback offset in ticks, used to resume playback after failover.
+    /// </summary>
+    public long LastDurablePlaybackOffset { get; set; }
+
+    /// <summary>
+    /// Creates a session record for an HLS output, deriving <see cref="ManifestPath"/> and
+    /// <see cref="SegmentPathPrefix"/> from the playlist path so that cleanup can recognise
+    /// every file the session owns.
+    /// </summary>
+    /// <param name="playSessionId">The play session identifier.</param>
+    /// <param name="mediaSourceId">The media source identifier.</param>
+    /// <param name="ownerPod">The name of the pod that owns the session.</param>
+    /// <param name="playlistPath">The absolute path of the HLS playlist (.m3u8) file.</param>
+    /// <param name="leaseDuration">The initial lease duration.</param>
+    /// <returns>The new <see cref="TranscodeSession"/>.</returns>
+    public static TranscodeSession CreateForPlaylist(
+        string playSessionId,
+        string mediaSourceId,
+        string ownerPod,
+        string playlistPath,
+        TimeSpan leaseDuration)
+        => new TranscodeSession
+        {
+            PlaySessionId = playSessionId,
+            OwnerPod = ownerPod,
+            LeaseExpiresUtc = DateTime.UtcNow.Add(leaseDuration),
+            ManifestPath = playlistPath,
+            SegmentPathPrefix = GetSegmentPathPrefix(playlistPath),
+            MediaSourceId = mediaSourceId,
+        };
+
+    /// <summary>
+    /// Gets the prefix every segment file of the HLS output at <paramref name="playlistPath"/> starts with.
+    /// Segments are written as <c>&lt;playlist path without extension&gt;&lt;index&gt;&lt;segment extension&gt;</c>.
+    /// </summary>
+    /// <param name="playlistPath">The absolute path of the HLS playlist (.m3u8) file.</param>
+    /// <returns>The segment path prefix.</returns>
+    public static string GetSegmentPathPrefix(string playlistPath)
+        => Path.ChangeExtension(playlistPath, null) ?? playlistPath;
+}
@@ -0,0 +1,36 @@
+namespace MediaBrowser.Controller.MediaEncoding;
+
+/// <summary>
+/// Configuration options for the transcode session store.
+/// </summary>
+public sealed class TranscodeStoreOptions
+{
+    /// <summary>
+    /// The configuration section these options bind from.
+    /// </summary>
+    public const string ConfigurationSection = "Jellyfin:TranscodeStore";
+
+    /// <summary>
+    /// The configuration key holding the Redis connection string.
+    /// </summary>
+    public const string RedisConnectionStringKey = ConfigurationSection + ":RedisConnectionString";
+
+    /// <summary>
+    /// Gets or sets the Redis connection string.
+    /// A <c>null</c> or empty value indicates single-instance mode, where
+    /// <see cref="NullTranscodeSessionStore"/> is used instead of a Redis-backed store.
+    /// </summary>
+    public string? RedisConnectionString { get; set; }
+
+    /// <summary>
+    /// Gets or sets the duration in seconds for which a transcoding session lease is valid.
+    /// </summary>
+    public int LeaseDurationSeconds { get; set; } = 30;
+
+    /// <summary>
+    /// Gets or sets how long in seconds a session record is retained after its lease was last renewed.
+    /// The record must outlive the lease, otherwise an orphaned session is gone before another pod
+    /// can take it over.
+    /// </summary>
+    public int SessionRetentionSeconds { get; set; } = 300;
+}
@@ -21,14 +21,14 @@ namespace MediaBrowser.Controller.QuickConnect
        /// </summary>
        /// <param name="authorizationInfo">The initiator authorization info.</param>
        /// <returns>A quick connect result with tokens to proceed or throws an exception if not active.</returns>
-        QuickConnectResult TryConnect(AuthorizationInfo authorizationInfo);
+        Task<QuickConnectResult> TryConnect(AuthorizationInfo authorizationInfo);

        /// <summary>
        /// Checks the status of an individual request.
        /// </summary>
        /// <param name="secret">Unique secret identifier of the request.</param>
        /// <returns>Quick connect result.</returns>
-        QuickConnectResult CheckRequestStatus(string secret);
+        Task<QuickConnectResult> CheckRequestStatus(string secret);

        /// <summary>
        /// Authorizes a quick connect request to connect as the calling user.
@@ -43,6 +43,6 @@ namespace MediaBrowser.Controller.QuickConnect
        /// </summary>
        /// <param name="secret">The secret.</param>
        /// <returns>The authentication result.</returns>
-        AuthenticationResult GetAuthorizedRequest(string secret);
+        Task<AuthenticationResult> GetAuthorizedRequest(string secret);
    }
 }
@@ -0,0 +1,70 @@
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using MediaBrowser.Controller.Authentication;
+using MediaBrowser.Model.QuickConnect;
+
+namespace MediaBrowser.Controller.QuickConnect;
+
+/// <summary>
+/// Holds the state of in-flight quick connect requests. The three legs of a quick connect flow -
+/// initiate, authorize and exchange - can each land on a different instance, so the state has to be
+/// reachable from all of them.
+/// </summary>
+public interface IQuickConnectStore
+{
+    /// <summary>
+    /// Looks up a pending request by the secret handed to the initiating client.
+    /// </summary>
+    /// <param name="secret">The request secret.</param>
+    /// <param name="cancellationToken">A cancellation token.</param>
+    /// <returns>The request, or <c>null</c> when it is unknown or has expired.</returns>
+    Task<QuickConnectResult?> GetRequestBySecretAsync(string secret, CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Looks up a pending request by the code shown to the user.
+    /// </summary>
+    /// <param name="code">The user facing code.</param>
+    /// <param name="cancellationToken">A cancellation token.</param>
+    /// <returns>The request, or <c>null</c> when it is unknown or has expired.</returns>
+    Task<QuickConnectResult?> GetRequestByCodeAsync(string code, CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Stores a new or updated request until <paramref name="expiresUtc"/>.
+    /// </summary>
+    /// <param name="request">The request to store.</param>
+    /// <param name="expiresUtc">The instant the request stops being resolvable.</param>
+    /// <param name="cancellationToken">A cancellation token.</param>
+    /// <returns>A <see cref="Task"/> representing the asynchronous operation.</returns>
+    Task SetRequestAsync(QuickConnectResult request, DateTime expiresUtc, CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Atomically claims the sole right to authorize the request behind <paramref name="secret"/>, so
+    /// that two instances racing on one code cannot both mint an access token. The claim is never
+    /// released: a mint that failed after writing its token would otherwise be retried into a second one.
+    /// </summary>
+    /// <param name="secret">The request secret.</param>
+    /// <param name="expiresUtc">The instant the claim lapses, after which the request can be authorized again.</param>
+    /// <param name="cancellationToken">A cancellation token.</param>
+    /// <returns><c>true</c> when this caller may go on to authorize the request; <c>false</c> when it is unknown, expired, already authorized or being authorized elsewhere.</returns>
+    Task<bool> TryClaimAuthorizationAsync(string secret, DateTime expiresUtc, CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Stores the authentication minted for an authorized request until <paramref name="expiresUtc"/>.
+    /// </summary>
+    /// <param name="secret">The request secret the client exchanges.</param>
+    /// <param name="authenticationResult">The authentication to hand out.</param>
+    /// <param name="expiresUtc">The instant the authentication stops being exchangeable.</param>
+    /// <param name="cancellationToken">A cancellation token.</param>
+    /// <returns>A <see cref="Task"/> representing the asynchronous operation.</returns>
+    Task SetAuthorizationAsync(string secret, AuthenticationResult authenticationResult, DateTime expiresUtc, CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Atomically takes the authentication for <paramref name="secret"/> and removes it, so that two
+    /// instances racing on the same secret cannot both hand out an access token.
+    /// </summary>
+    /// <param name="secret">The request secret.</param>
+    /// <param name="cancellationToken">A cancellation token.</param>
+    /// <returns>The authentication, or <c>null</c> when the secret is unknown, expired or already exchanged.</returns>
+    Task<AuthenticationResult?> TryConsumeAuthorizationAsync(string secret, CancellationToken cancellationToken = default);
+}
@@ -0,0 +1,110 @@
+using System;
+using System.Collections.Concurrent;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using MediaBrowser.Controller.Authentication;
+using MediaBrowser.Model.QuickConnect;
+
+namespace MediaBrowser.Controller.QuickConnect;
+
+/// <summary>
+/// A process-local <see cref="IQuickConnectStore"/>. It is the single-instance default, and the
+/// fallback a shared store degrades to while its backend is unreachable, so quick connect keeps
+/// working for clients whose three legs happen to land on one instance.
+/// </summary>
+public sealed class InMemoryQuickConnectStore : IQuickConnectStore
+{
+    private readonly ConcurrentDictionary<string, Entry<QuickConnectResult>> _requests = new(StringComparer.Ordinal);
+    private readonly ConcurrentDictionary<string, Entry<AuthenticationResult>> _authorizations = new(StringComparer.Ordinal);
+    private readonly ConcurrentDictionary<string, DateTime> _authorizationClaims = new(StringComparer.Ordinal);
+
+    /// <inheritdoc />
+    public Task<QuickConnectResult?> GetRequestBySecretAsync(string secret, CancellationToken cancellationToken = default)
+    {
+        Expire();
+        return Task.FromResult(_requests.TryGetValue(secret, out var entry) ? entry.Value : null);
+    }
+
+    /// <inheritdoc />
+    public Task<QuickConnectResult?> GetRequestByCodeAsync(string code, CancellationToken cancellationToken = default)
+    {
+        Expire();
+        return Task.FromResult(_requests.Values
+            .Select(entry => entry.Value)
+            .FirstOrDefault(request => string.Equals(request.Code, code, StringComparison.Ordinal)));
+    }
+
+    /// <inheritdoc />
+    public Task SetRequestAsync(QuickConnectResult request, DateTime expiresUtc, CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(request);
+
+        Expire();
+        _requests[request.Secret] = new Entry<QuickConnectResult>(expiresUtc, request);
+        return Task.CompletedTask;
+    }
+
+    /// <inheritdoc />
+    public Task<bool> TryClaimAuthorizationAsync(string secret, DateTime expiresUtc, CancellationToken cancellationToken = default)
+    {
+        Expire();
+        if (!_requests.TryGetValue(secret, out var entry) || entry.Value.Authenticated)
+        {
+            return Task.FromResult(false);
+        }
+
+        return Task.FromResult(_authorizationClaims.TryAdd(secret, expiresUtc));
+    }
+
+    /// <inheritdoc />
+    public Task SetAuthorizationAsync(string secret, AuthenticationResult authenticationResult, DateTime expiresUtc, CancellationToken cancellationToken = default)
+    {
+        Expire();
+        _authorizations[secret] = new Entry<AuthenticationResult>(expiresUtc, authenticationResult);
+        return Task.CompletedTask;
+    }
+
+    /// <inheritdoc />
+    public Task<AuthenticationResult?> TryConsumeAuthorizationAsync(string secret, CancellationToken cancellationToken = default)
+    {
+        Expire();
+        if (!_authorizations.TryRemove(secret, out var entry) || entry.ExpiresUtc <= DateTime.UtcNow)
+        {
+            return Task.FromResult<AuthenticationResult?>(null);
+        }
+
+        return Task.FromResult<AuthenticationResult?>(entry.Value);
+    }
+
+    private void Expire()
+    {
+        var now = DateTime.UtcNow;
+
+        foreach (var (secret, entry) in _requests)
+        {
+            if (entry.ExpiresUtc <= now)
+            {
+                _requests.TryRemove(secret, out _);
+            }
+        }
+
+        foreach (var (secret, entry) in _authorizations)
+        {
+            if (entry.ExpiresUtc <= now)
+            {
+                _authorizations.TryRemove(secret, out _);
+            }
+        }
+
+        foreach (var (secret, expiresUtc) in _authorizationClaims)
+        {
+            if (expiresUtc <= now)
+            {
+                _authorizationClaims.TryRemove(secret, out _);
+            }
+        }
+    }
+
+    private sealed record Entry<T>(DateTime ExpiresUtc, T Value);
+}
@@ -0,0 +1,21 @@
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace MediaBrowser.Controller.ScheduledTasks;
+
+/// <summary>
+/// Provides a distributed leader lease that gates periodic, library-mutating scheduled tasks
+/// to a single instance across a multi-pod deployment.
+/// </summary>
+public interface IScanLeaderLease
+{
+    /// <summary>
+    /// Attempts to acquire the scan-leader lease, or renews it when this instance already holds it.
+    /// </summary>
+    /// <param name="cancellationToken">A cancellation token.</param>
+    /// <returns>
+    /// <c>true</c> if this instance holds the leader lease and gated periodic tasks may run here;
+    /// otherwise <c>false</c>.
+    /// </returns>
+    Task<bool> TryAcquireOrRenewAsync(CancellationToken cancellationToken = default);
+}
@@ -0,0 +1,16 @@
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace MediaBrowser.Controller.ScheduledTasks;
+
+/// <summary>
+/// A no-op <see cref="IScanLeaderLease"/> used when scan-leader election is disabled or no Redis
+/// connection is configured. Every instance is treated as the leader, preserving the default
+/// single-instance behavior where all periodic tasks run locally.
+/// </summary>
+public sealed class NullScanLeaderLease : IScanLeaderLease
+{
+    /// <inheritdoc />
+    public Task<bool> TryAcquireOrRenewAsync(CancellationToken cancellationToken = default)
+        => Task.FromResult(true);
+}
@@ -0,0 +1,56 @@
+namespace MediaBrowser.Controller.ScheduledTasks;
+
+/// <summary>
+/// Configuration options for scan-leader election, which gates periodic library-mutating
+/// scheduled tasks to a single leader instance in a multi-pod deployment.
+/// </summary>
+public sealed class ScanLeaderOptions
+{
+    /// <summary>
+    /// The configuration section these options bind from.
+    /// </summary>
+    public const string ConfigurationSection = "Jellyfin:ScanLeader";
+
+    /// <summary>
+    /// The configuration key that overrides the default enablement.
+    /// </summary>
+    public const string EnabledKey = ConfigurationSection + ":Enabled";
+
+    /// <summary>
+    /// Gets or sets a value indicating whether scan-leader election is enabled. When disabled,
+    /// every instance runs its periodic tasks as before. Left unset, election is enabled whenever a
+    /// Redis connection string is configured, because that is the only deployment shape that needs it.
+    /// </summary>
+    public bool Enabled { get; set; }
+
+    /// <summary>
+    /// Gets or sets the duration in seconds for which the scan-leader lease is held before it must
+    /// be renewed. A leader that stops renewing loses the lease after this duration.
+    /// </summary>
+    public int LeaseDurationSeconds { get; set; } = 60;
+
+    /// <summary>
+    /// Gets or sets the set of scheduled task keys whose periodic (timer-driven) execution is gated
+    /// to the scan leader. Tasks not listed here run on every instance, and manual or API-triggered
+    /// runs are never gated.
+    /// </summary>
+    public string[] GatedTaskKeys { get; set; } =
+    {
+        "RefreshLibrary",
+        "RefreshPeople",
+        "RefreshChapterImages",
+        "AudioNormalization",
+        "TaskExtractMediaSegments",
+        "KeyframeExtraction",
+        "CleanupUserDataTask",
+        "OptimizeDatabaseTask",
+        "DownloadLyrics",
+        "DownloadSubtitles",
+        "TmdbRefreshUpcomingEpisodes",
+        "RefreshTrickplayImages",
+        "MoveTrickplayImages",
+        "RefreshInternetChannels",
+        "RefreshGuide",
+        "PluginUpdates"
+    };
+}
@@ -1,6 +1,9 @@
 #nullable disable

+using System;
+using System.Collections.Generic;
 using Jellyfin.Database.Implementations.Entities;
+using MediaBrowser.Controller.Entities;
 using MediaBrowser.Controller.Library;

 namespace MediaBrowser.Controller.Sorting
@@ -27,5 +30,16 @@ namespace MediaBrowser.Controller.Sorting
        /// </summary>
        /// <value>The user data repository.</value>
        IUserDataManager UserDataManager { get; set; }
+
+        /// <summary>
+        /// Gets or sets user data for the items being sorted, keyed by item id, read once up front.
+        /// A comparer that does not store it reads its user data one item at a time instead.
+        /// </summary>
+        /// <value>The prefetched user data, or <c>null</c> when none was prefetched.</value>
+        IReadOnlyDictionary<Guid, UserItemData> PrefetchedUserData
+        {
+            get => null;
+            set { }
+        }
    }
 }
@@ -0,0 +1,28 @@
+#nullable disable
+
+using MediaBrowser.Controller.Entities;
+
+namespace MediaBrowser.Controller.Sorting
+{
+    /// <summary>
+    /// Helpers shared by the comparers that sort on user data.
+    /// </summary>
+    public static class UserBaseItemComparerExtensions
+    {
+        /// <summary>
+        /// Gets the user data for an item, preferring the batch the sort prefetched.
+        /// </summary>
+        /// <param name="comparer">The comparer.</param>
+        /// <param name="item">The item.</param>
+        /// <returns>The item's user data.</returns>
+        public static UserItemData GetUserData(this IUserBaseItemComparer comparer, BaseItem item)
+        {
+            if (comparer.PrefetchedUserData is not null && comparer.PrefetchedUserData.TryGetValue(item.Id, out var userData))
+            {
+                return userData;
+            }
+
+            return comparer.UserDataManager.GetUserData(comparer.User, item);
+        }
+    }
+}
@@ -1,7 +1,10 @@
 #pragma warning disable CA1819 // XML serialization handles collections improperly, so we need to use arrays

 #nullable disable
+using System;
 using System.ComponentModel;
+using System.Text.Json.Serialization;
+using System.Xml.Serialization;
 using MediaBrowser.Model.Entities;

 namespace MediaBrowser.Model.Configuration;
@@ -25,6 +28,8 @@ public class EncodingOptions
        ThrottleDelaySeconds = 180;
        EnableSegmentDeletion = false;
        SegmentKeepSeconds = 720;
+        RecoverySegmentLengthSeconds = 2;
+        RecoverySegmentBufferCount = 5;
        EncodingThreadCount = -1;
        // This is a DRM device that is almost guaranteed to be there on every intel platform,
        // plus it's the default one in ffmpeg if you don't specify anything
@@ -125,6 +130,20 @@ public class EncodingOptions
    /// </summary>
    public int SegmentKeepSeconds { get; set; }

+    /// <summary>
+    /// Gets or sets the HLS segment length in seconds to use when HA recovery mode is active.
+    /// Shorter segments allow a takeover pod to resume playback faster after a peer failure.
+    /// Default is <c>2</c>. Valid range is 1-6.
+    /// </summary>
+    public int RecoverySegmentLengthSeconds { get; set; }
+
+    /// <summary>
+    /// Gets or sets the number of HLS segments to keep on disk when HA recovery mode is active.
+    /// This acts as a rolling buffer that a takeover pod can serve while restarting the transcode.
+    /// Default is <c>5</c>. Valid range is 2-10.
+    /// </summary>
+    public int RecoverySegmentBufferCount { get; set; }
+
    /// <summary>
    /// Gets or sets the hardware acceleration type.
    /// </summary>
@@ -218,8 +237,27 @@ public class EncodingOptions
    /// <summary>
    /// Gets or sets the encoder preset.
    /// </summary>
+    [XmlIgnore]
    public EncoderPreset EncoderPreset { get; set; }

+    /// <summary>
+    /// Gets or sets the encoder preset as it is stored in the configuration file. Files written before the preset
+    /// list was validated can carry an empty element, which has to read back as the default rather than throw and
+    /// take the rest of the configuration down with it.
+    /// </summary>
+    [JsonIgnore]
+    [XmlElement(nameof(EncoderPreset))]
+    public string EncoderPresetXml
+    {
+        get => EncoderPreset.ToString();
+
+        // TryParse also accepts a number, which would yield a preset value nothing maps to, so the result has to be
+        // a declared one.
+        set => EncoderPreset = Enum.TryParse<EncoderPreset>(value, true, out var encoderPreset) && Enum.IsDefined(encoderPreset)
+            ? encoderPreset
+            : EncoderPreset.auto;
+    }
+
    /// <summary>
    /// Gets or sets a value indicating whether the framerate is doubled when deinterlacing.
    /// </summary>
@@ -12,7 +12,7 @@ public class NextUpQuery
    {
        EnableImageTypes = Array.Empty<ImageType>();
        EnableTotalRecordCount = true;
-        NextUpDateCutoff = DateTime.MinValue;
+        NextUpDateCutoff = DateTime.SpecifyKind(DateTime.MinValue, DateTimeKind.Utc);
        EnableResumable = false;
        EnableRewatching = false;
    }
@@ -56,7 +56,7 @@ public class NextUpQuery
    public bool EnableTotalRecordCount { get; set; }

    /// <summary>
-    /// Gets or sets a value indicating the oldest date for a show to appear in Next Up.
+    /// Gets or sets a value indicating the oldest date, in UTC, for a show to appear in Next Up.
    /// </summary>
    public DateTime NextUpDateCutoff { get; set; }

@@ -1,64 +1,571 @@
-<h1 align="center">Jellyfin</h1>
-<h3 align="center">The Free Software Media System</h3>
+# jellyfin-ha
+
+**A fork of [Jellyfin](https://github.com/jellyfin/jellyfin) adding high-availability transcoding support for multi-pod Kubernetes deployments.**
+
+[![License: GPL v2](https://img.shields.io/badge/License-GPL_v2-blue.svg)](https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html)
+[![.NET 10](https://img.shields.io/badge/.NET-10.0-purple)](https://dotnet.microsoft.com/download/dotnet/10.0)
+[![Upstream](https://img.shields.io/badge/upstream-jellyfin%2Fjellyfin-informational)](https://github.com/jellyfin/jellyfin)

 ---

-<p align="center">
-<img alt="Logo Banner" src="https://raw.githubusercontent.com/jellyfin/jellyfin-ux/master/branding/SVG/banner-logo-solid.svg?sanitize=true"/>
-<br/>
-<br/>
-<a href="https://github.com/jellyfin/jellyfin"><img alt="GPL 2.0 License" src="https://img.shields.io/github/license/jellyfin/jellyfin.svg"/></a>
-<a href="https://github.com/jellyfin/jellyfin/releases"><img alt="Current Release" src="https://img.shields.io/github/release/jellyfin/jellyfin.svg"/></a>
-<a href="https://translate.jellyfin.org/projects/jellyfin/jellyfin-core/?utm_source=widget"><img alt="Translation Status" src="https://translate.jellyfin.org/widgets/jellyfin/-/jellyfin-core/svg-badge.svg"/></a>
-<a href="https://hub.docker.com/r/jellyfin/jellyfin"><img alt="Docker Pull Count" src="https://img.shields.io/docker/pulls/jellyfin/jellyfin.svg"/></a>
-<br/>
-<a href="https://opencollective.com/jellyfin"><img alt="Donate" src="https://img.shields.io/opencollective/all/jellyfin.svg?label=backers"/></a>
-<a href="https://features.jellyfin.org"><img alt="Submit Feature Requests" src="https://img.shields.io/badge/fider-vote%20on%20features-success.svg"/></a>
-<a href="https://matrix.to/#/#jellyfinorg:matrix.org"><img alt="Chat on Matrix" src="https://img.shields.io/matrix/jellyfinorg:matrix.org.svg?logo=matrix"/></a>
-<a href="https://github.com/jellyfin/jellyfin/releases.atom"><img alt="Release RSS Feed" src="https://img.shields.io/badge/rss-releases-ffa500?logo=rss" /></a>
-<a href="https://github.com/jellyfin/jellyfin/commits/master.atom"><img alt="Master Commits RSS Feed" src="https://img.shields.io/badge/rss-commits-ffa500?logo=rss" /></a>
-</p>
+## What is this?
+
+Jellyfin's default assumption is that exactly one server instance is running at a time. Transcode state is held entirely in-memory — when the process dies, so do all active HLS streams. For homelab deployments that want Kubernetes-managed redundancy (rolling restarts, node drain, pod rescheduling), that's a problem.
+
+This fork adds a thin HA layer on top of unmodified Jellyfin core:
+
+- **`ITranscodeSessionStore`** — a new interface for durable, distributed transcode session tracking
+- **`RedisTranscodeSessionStore`** — a Redis-backed implementation using atomic Lua takeover scripts and TTL-based lease expiry
+- **`NullTranscodeSessionStore`** — a no-op fallback so single-instance deployments work with zero configuration change
+- **Lease-aware `DeleteTranscodeFileTask`** — coordinates cleanup across replicas so a restarting pod doesn't delete segments another pod is actively streaming
+- **PostgreSQL database provider** — alternative to SQLite for shared-database HA setups (experimental, under `src/Jellyfin.Database/Jellyfin.Database.Providers.PostgreSQL`)

 ---

-Jellyfin is a Free Software Media System that puts you in control of managing and streaming your media. It is an alternative to the proprietary Emby and Plex, to provide media from a dedicated server to end-user devices via multiple apps. Jellyfin is descended from Emby's 3.5.2 release and ported to the .NET platform to enable full cross-platform support.
+## Architecture

-There are no strings attached, no premium licenses or features, and no hidden agendas: just a team that wants to build something better and work together to achieve it. We welcome anyone who is interested in joining us in our quest!
+```
+┌─────────────┐     ┌─────────────┐
+│  Jellyfin   │     │  Jellyfin   │
+│   Pod A     │     │   Pod B     │
+│             │     │             │
+│ ┌─────────┐ │     │ ┌─────────┐ │
+│ │Transcode│ │     │ │Transcode│ │
+│ │Manager  │ │     │ │Manager  │ │
+│ └────┬────┘ │     │ └────┬────┘ │
+└──────┼──────┘     └──────┼──────┘
+       │                   │
+       └─────────┬─────────┘
+                 │
+         ┌───────▼───────┐
+         │  Redis        │   ← ITranscodeSessionStore
+         │  (lease store)│     TTL-based ownership
+         └───────────────┘

-For further details, please see [our documentation page](https://jellyfin.org/docs/). To receive the latest updates, get help with Jellyfin, and join the community, please visit [one of our communication channels](https://jellyfin.org/docs/general/getting-help). For more information about the project, please see our [about page](https://jellyfin.org/docs/general/about).
+       ┌─────────────────────┐
+       │  Shared NAS / NFS   │   ← HLS segments + manifests
+       │  (shared storage)   │
+       └─────────────────────┘
+```

-<strong>Want to get started?</strong><br/>
-Check out our <a href="https://jellyfin.org/downloads">downloads page</a> or our <a href="https://jellyfin.org/docs/general/installation/">installation guide</a>, then see our <a href="https://jellyfin.org/docs/general/quick-start">quick start guide</a>. You can also <a href="https://jellyfin.org/docs/general/installation/source">build from source</a>.<br/>
+**How takeover works:**

-<strong>Something not working right?</strong><br/>
-Open an <a href="https://jellyfin.org/docs/general/contributing/issues">Issue</a> on GitHub.<br/>
-
-<strong>Want to contribute?</strong><br/>
-Check out our <a href="https://jellyfin.org/contribute">contributing choose-your-own-adventure</a> to see where you can help, then see our <a href="https://jellyfin.org/docs/general/contributing/">contributing guide</a> and our <a href="https://jellyfin.org/docs/general/community-standards">community standards</a>.<br/>
-
-<strong>New idea or improvement?</strong><br/>
-Check out our <a href="https://features.jellyfin.org/?view=most-wanted">feature request hub</a>.<br/>
-
-<strong>Don't see Jellyfin in your language?</strong><br/>
-Check out our <a href="https://translate.jellyfin.org">Weblate instance</a> to help translate Jellyfin and its subprojects.<br/>
-
-<a href="https://translate.jellyfin.org/engage/jellyfin/?utm_source=widget">
-<img src="https://translate.jellyfin.org/widgets/jellyfin/-/jellyfin-web/multi-auto.svg" alt="Detailed Translation Status"/>
-</a>
+1. Pod A starts an HLS transcode and writes a `TranscodeSession` to Redis with a 30-second lease.
+2. Pod A renews the lease every `LeaseDurationSeconds / 3` seconds; the renewal is rejected if Pod A no longer owns it.
+3. If Pod A dies, the lease expires in Redis after 30 seconds.
+4. Pod B receives a client request for the same play session, calls `TryTakeoverAsync`, and atomically claims ownership via a Lua script.
+5. Pod B resumes FFmpeg from the last durable segment index. The client sees a brief stutter, not an error.

 ---

-## Jellyfin Server
+## Quick Start

-This repository contains the code for Jellyfin's backend server. Note that this is only one of many projects under the Jellyfin GitHub [organization](https://github.com/jellyfin/) on GitHub. If you want to contribute, you can start by checking out our [documentation](https://jellyfin.org/docs/general/contributing/index.html) to see what to work on.
+### Single instance (no Redis)

-## Server Development
+No configuration required. `NullTranscodeSessionStore` is used automatically. Behavior is identical to upstream Jellyfin.

-These instructions will help you get set up with a local development environment in order to contribute to this repository. Before you start, please be sure to completely read our [guidelines on development contributions](https://jellyfin.org/docs/general/contributing/development.html). Note that this project is supported on all major operating systems except FreeBSD, which is still incompatible.
+```bash
+dotnet run --project Jellyfin.Server/Jellyfin.Server.csproj -- \
+  --datadir /var/lib/jellyfin \
+  --webdir /usr/share/jellyfin/web
+```
+
+### HA mode with Redis
+
+Set the `Jellyfin:TranscodeStore:RedisConnectionString` configuration key. You can pass it as a `Jellyfin__TranscodeStore__RedisConnectionString` environment variable, as the equivalent `JELLYFIN_` prefixed variable, or in a JSON config file.
+
+**Environment variable:**
+
+```bash
+export Jellyfin__TranscodeStore__RedisConnectionString="redis:6379"
+export Jellyfin__TranscodeStore__LeaseDurationSeconds="30"
+
+dotnet run --project Jellyfin.Server/Jellyfin.Server.csproj -- \
+  --datadir /var/lib/jellyfin \
+  --webdir /usr/share/jellyfin/web
+```
+
+**`appsettings.json` section:**
+
+```json
+{
+  "Jellyfin": {
+    "TranscodeStore": {
+      "RedisConnectionString": "redis:6379,abortConnect=false",
+      "LeaseDurationSeconds": 30
+    }
+  }
+}
+```
+
+The selected store is logged at startup, so HA transcoding is never on or off without a signal:
+
+```
+Transcode session store: RedisTranscodeSessionStore on valkey:6379.
+Redis transcode session store is reachable (2ms round trip). HA transcode takeover is active.
+```
+
+Without a connection string the line reads `Transcode session store: NullTranscodeSessionStore`. A configured but unreachable store is logged at `Error`; the server keeps serving with per-instance sessions rather than refusing to start.
+
+---
+
+## Configuration Reference
+
+| Key | Default | Description |
+|-----|---------|-------------|
+| `Jellyfin:TranscodeStore:RedisConnectionString` | _(empty)_ | StackExchange.Redis connection string. Empty = single-instance mode. |
+| `Jellyfin:TranscodeStore:LeaseDurationSeconds` | `30` | How long a pod's transcode lease is valid before another pod may take over. |
+| `Jellyfin:TranscodeStore:SessionRetentionSeconds` | `300` | How long an unrenewed session record is kept so another pod can still take it over. |
+
+### Redis connection string examples
+
+```
+# Standalone Redis
+redis:6379
+
+# With password
+redis:6379,password=secret
+
+# With TLS
+redis.example.com:6380,ssl=true,abortConnect=false
+
+# Redis Sentinel
+sentinel-host:26379,serviceName=mymaster
+```
+
+Standard [StackExchange.Redis connection string format](https://stackexchange.github.io/StackExchange.Redis/Configuration) is accepted.
+
+---
+
+## Deployment
+
+> **This project is designed to run as a container.** Running it as a bare `dotnet` process is fine for development and testing, but the HA benefits only materialize when you have multiple replicas managed by a container orchestrator. Docker Compose gets you Redis + Jellyfin wired together locally. Kubernetes (k3s, k8s, or a managed cloud cluster) gets you the actual pod-death-and-recovery story.
+>
+> Don't have a Kubernetes cluster yet? [DigitalOcean Kubernetes](https://www.digitalocean.com/?refcode=b9012919f7ff&utm_campaign=Referral_Invite&utm_medium=Referral_Program&utm_source=badge) is the fastest path to a managed cluster if you don't want to run your own nodes.
+
+---
+
+### Option 1 — Local HA with Docker Compose
+
+The simplest way to test the full HA stack locally: two Jellyfin replicas sharing a Redis instance and a local volume for transcode output.
+
+```yaml
+# docker-compose.yml
+version: "3.9"
+
+services:
+  redis:
+    image: redis:7-alpine
+    ports:
+      - "6379:6379"
+
+  jellyfin-1:
+    build:
+      context: .
+      dockerfile: Dockerfile.runtime
+    environment:
+      Jellyfin__TranscodeStore__RedisConnectionString: "redis:6379,abortConnect=false"
+      Jellyfin__TranscodeStore__LeaseDurationSeconds: "30"
+      JELLYFIN_HA_POD_NAME: "jellyfin-1"
+    volumes:
+      - ./data/config:/config
+      - ./data/media:/media:ro
+      - transcode-tmp:/transcode
+    ports:
+      - "8096:8096"
+    depends_on:
+      - redis
+
+  jellyfin-2:
+    build:
+      context: .
+      dockerfile: Dockerfile.runtime
+    environment:
+      Jellyfin__TranscodeStore__RedisConnectionString: "redis:6379,abortConnect=false"
+      Jellyfin__TranscodeStore__LeaseDurationSeconds: "30"
+      JELLYFIN_HA_POD_NAME: "jellyfin-2"
+    volumes:
+      - ./data/config:/config
+      - ./data/media:/media:ro
+      - transcode-tmp:/transcode
+    ports:
+      - "8097:8096"
+    depends_on:
+      - redis
+
+volumes:
+  transcode-tmp:
+```
+
+Build the image first (the `dotnet publish` step runs outside Docker for I/O performance):
+
+```bash
+dotnet publish Jellyfin.Server/Jellyfin.Server.csproj \
+  --configuration Release \
+  --runtime linux-x64 \
+  --self-contained false \
+  --output ./publish-output
+
+docker compose up
+```
+
+Both replicas share the `transcode-tmp` volume and register sessions in Redis. Kill one container mid-stream (`docker kill jellyfin-1`) and the other takes over within `LeaseDurationSeconds`.
+
+---
+
+### Option 2 — Kubernetes (k3s / k8s)
+
+This is the intended production deployment. You need:
+
+1. A Kubernetes cluster (k3s, kubeadm, EKS, GKE, DigitalOcean Kubernetes, etc.)
+2. A Redis instance (in-cluster or managed)
+3. A `ReadWriteMany` storage class for shared transcode scratch space (NFS, Longhorn RWX, Ceph RBD, or a cloud-managed RWX PVC)
+
+#### Redis (in-cluster, standalone)
+
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: redis
+  namespace: jellyfin
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: redis
+  template:
+    metadata:
+      labels:
+        app: redis
+    spec:
+      containers:
+        - name: redis
+          image: redis:7-alpine
+          ports:
+            - containerPort: 6379
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: redis
+  namespace: jellyfin
+spec:
+  selector:
+    app: redis
+  ports:
+    - port: 6379
+```
+
+#### Redis connection secret
+
+```bash
+kubectl create secret generic jellyfin-redis \
+  --namespace jellyfin \
+  --from-literal=connection-string="redis.jellyfin.svc.cluster.local:6379,abortConnect=false"
+```
+
+#### Shared transcode PVC (RWX)
+
+```yaml
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: jellyfin-transcode
+  namespace: jellyfin
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: longhorn  # or nfs-client, csi-driver-nfs, etc.
+  resources:
+    requests:
+      storage: 20Gi
+```
+
+#### Jellyfin Deployment
+
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: jellyfin
+  namespace: jellyfin
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: jellyfin
+  template:
+    metadata:
+      labels:
+        app: jellyfin
+    spec:
+      containers:
+        - name: jellyfin
+          image: your-registry/jellyfin-ha:latest
+          ports:
+            - containerPort: 8096
+          env:
+            - name: Jellyfin__TranscodeStore__RedisConnectionString
+              valueFrom:
+                secretKeyRef:
+                  name: jellyfin-redis
+                  key: connection-string
+            - name: Jellyfin__TranscodeStore__LeaseDurationSeconds
+              value: "30"
+            - name: JELLYFIN_HA_POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+          volumeMounts:
+            - name: config
+              mountPath: /config
+            - name: media
+              mountPath: /media
+              readOnly: true
+            - name: transcode
+              mountPath: /transcode
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 8096
+            initialDelaySeconds: 30
+            periodSeconds: 10
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 8096
+            initialDelaySeconds: 10
+            periodSeconds: 5
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: jellyfin-config   # RWO is fine — config is single-writer
+        - name: media
+          nfs:
+            server: your-nas.local
+            path: /media
+        - name: transcode
+          persistentVolumeClaim:
+            claimName: jellyfin-transcode  # Must be RWX
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: jellyfin
+  namespace: jellyfin
+spec:
+  type: ClusterIP
+  selector:
+    app: jellyfin
+  ports:
+    - port: 8096
+      targetPort: 8096
+```
+
+#### Important: storage requirements
+
+| Volume | Access mode | Why |
+|--------|-------------|-----|
+| Config (`/config`) | `ReadWriteOnce` | One writer, SQLite DB lives here |
+| Media (`/media`) | `ReadOnlyMany` | All pods read the same library |
+| Transcode (`/transcode`) | **`ReadWriteMany`** | Pods read each other's HLS segments during takeover |
+
+The transcode volume is the critical one. If it's `ReadWriteOnce`, pod takeover will fail because Pod B cannot read the `.ts` segments Pod A wrote. Use NFS, Longhorn with RWX enabled, or a cloud-managed RWX storage class.
+
+#### Building the image
+
+```bash
+# Publish (run on host, not inside Docker)
+dotnet publish Jellyfin.Server/Jellyfin.Server.csproj \
+  --configuration Release \
+  --runtime linux-x64 \
+  --self-contained false \
+  --output ./publish-output
+
+# Build for amd64 (required for most clusters)
+docker buildx build \
+  --platform linux/amd64 \
+  --provenance=false \
+  -f Dockerfile.runtime \
+  -t your-registry/jellyfin-ha:latest \
+  --push .
+```
+
+> Note: `--provenance=false` is required if your cluster runs containerd (k3s, most kubeadm setups). Without it, Docker adds OCI attestation manifests that containerd cannot resolve.
+
+---
+
+### Option 3 — Bare dotnet (development only)
+
+For local development and testing without containers. HA mode still works — you just run two terminal sessions pointing at the same Redis and a shared local directory.
+
+**Terminal 1:**
+
+```bash
+export Jellyfin__TranscodeStore__RedisConnectionString="localhost:6379"
+export JELLYFIN_HA_POD_NAME="dev-pod-1"
+
+dotnet run --project Jellyfin.Server/Jellyfin.Server.csproj -- \
+  --datadir /tmp/jellyfin-1/data \
+  --cachedir /tmp/jellyfin-1/cache \
+  --transcodes /tmp/jellyfin-shared/transcode \
+  --webdir /usr/share/jellyfin/web \
+  --port 8096
+```
+
+**Terminal 2:**
+
+```bash
+export Jellyfin__TranscodeStore__RedisConnectionString="localhost:6379"
+export JELLYFIN_HA_POD_NAME="dev-pod-2"
+
+dotnet run --project Jellyfin.Server/Jellyfin.Server.csproj -- \
+  --datadir /tmp/jellyfin-2/data \
+  --cachedir /tmp/jellyfin-2/cache \
+  --transcodes /tmp/jellyfin-shared/transcode \
+  --webdir /usr/share/jellyfin/web \
+  --port 8097
+```
+
+Both instances share `/tmp/jellyfin-shared/transcode`. Kill one process mid-stream to test takeover. Start a local Redis with `redis-server` or `docker run -p 6379:6379 redis:7-alpine`.
+
+---
+
+## PostgreSQL (experimental)
+
+This fork includes a PostgreSQL database provider under `src/Jellyfin.Database/Jellyfin.Database.Providers.PostgreSQL`. It is experimental — the SQLite provider remains the default and the recommended choice for most deployments.
+
+To use PostgreSQL, set the migration provider at startup and run migrations:
+
+```bash
+dotnet ef migrations add InitialCreate \
+  --project "src/Jellyfin.Database/Jellyfin.Database.Providers.PostgreSQL" \
+  -- --migration-provider Jellyfin-PostgreSQL
+```
+
+See `src/Jellyfin.Database/readme.md` for full migration instructions.
+
+---
+
+## Building and Testing

 ### Prerequisites

-Before the project can be built, you must first install the [.NET 10 SDK](https://dotnet.microsoft.com/download/dotnet) on your system.
+- [.NET 10 SDK](https://dotnet.microsoft.com/download/dotnet/10.0)
+
+### Build
+
+```bash
+dotnet build Jellyfin.Server/Jellyfin.Server.csproj
+```
+
+### Run all tests
+
+```bash
+dotnet test Jellyfin.sln \
+  --configuration Release \
+  --filter "Category!=RequiresDocker&FullyQualifiedName!~Integration"
+```
+
+### Run the PostgreSQL migration tests
+
+They run the startup migration chain against a real server. Set `JELLYFIN_TEST_POSTGRES` to a
+connection string for an already running server and they use it; without it they start a container
+through testcontainers.
+
+```bash
+dotnet test tests/Jellyfin.Server.Tests \
+  --configuration Release \
+  --filter "Category=RequiresDocker"
+```
+
+### Run HA-specific tests
+
+The transcode session store and HA recovery tests live in:
+
+- `tests/Jellyfin.Server.Implementations.Tests/MediaEncoding/RedisTranscodeSessionStoreTests.cs` (real Redis, `Category=RequiresDocker`)
+- `tests/Jellyfin.MediaEncoding.Tests/Transcoding/InMemoryTranscodeSessionStoreTests.cs`
+
+```bash
+dotnet test tests/Jellyfin.Server.Implementations.Tests \
+  --configuration Release \
+  --filter "FullyQualifiedName~TranscodeSession"
+```
+
+### Run with code coverage
+
+```bash
+dotnet test Jellyfin.sln \
+  --configuration Release \
+  --collect:"XPlat Code Coverage" \
+  --settings tests/coverletArgs.runsettings
+```
+
+---
+
+## Project Structure
+
+```
+MediaBrowser.Controller/MediaEncoding/
+  ITranscodeSessionStore.cs        ← Interface (DI contract)
+  TranscodeSession.cs              ← Session record model
+  TranscodeStoreOptions.cs         ← Configuration options
+  NullTranscodeSessionStore.cs     ← No-op, single-instance fallback
+
+Emby.Server.Implementations/MediaEncoding/
+  RedisTranscodeSessionStore.cs    ← Redis-backed HA implementation
+
+src/Jellyfin.Database/
+  Jellyfin.Database.Providers.PostgreSQL/  ← Experimental PostgreSQL provider
+
+tests/
+  Jellyfin.Server.Implementations.Tests/MediaEncoding/
+    RedisTranscodeSessionStoreTests.cs    ← real Redis via Testcontainers
+  Jellyfin.MediaEncoding.Tests/
+    Fakes/InMemoryTranscodeSessionStore.cs
+    Transcoding/InMemoryTranscodeSessionStoreTests.cs
+```
+
+---
+
+## Contributing
+
+This is a personal experiment, not an officially maintained fork. Issues and PRs are welcome but response time may vary.
+
+If you're interested in getting proper HA transcoding into upstream Jellyfin, that conversation belongs in the [upstream repo](https://github.com/jellyfin/jellyfin). The changes here are deliberately narrow and designed to be upstream-friendly if there's maintainer interest.
+
+**Code conventions** follow the upstream Jellyfin rules:
+- `async`/`await` everywhere — no `.Result` or `.Wait()`
+- All public members need XML doc comments
+- Use `Directory.Packages.props` for NuGet versions — never add `Version=` to a `<PackageReference>`
+- `.NET 10` required
+- Warnings are treated as errors
+
+---
+
+## Relationship to upstream
+
+This fork tracks [jellyfin/jellyfin](https://github.com/jellyfin/jellyfin) release tags and is currently based on `v12.0`. The HA additions are intentionally isolated to:
+
+1. New interfaces and models in `MediaBrowser.Controller`
+2. New implementations in `Emby.Server.Implementations`
+3. DI wiring in `Jellyfin.Server/CoreAppHost.cs`
+4. New test projects
+
+No core Jellyfin logic was modified — only extended via existing DI extension points.
+
+---
+
+## License
+
+GPL-2.0, same as upstream Jellyfin. See [LICENSE](LICENSE).
+
+---
+
+*Upstream README preserved below for reference.*
+
+---

 Instructions to run this project from the command line are included here, but you will also need to install an IDE if you want to debug the server while it is running. Any IDE that supports .NET 6 development will work, but two options are recent versions of [Visual Studio](https://visualstudio.microsoft.com/downloads/) (at least 2022) and [Visual Studio Code](https://code.visualstudio.com/Download).

@@ -177,5 +684,7 @@ Since this is a common scenario, there is also a separate launch profile defined
 This project is supported by:
 <br/>
 <br/>
+<a href="https://www.digitalocean.com"><img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" height="50px" alt="DigitalOcean"></a>
+    &nbsp;
 <a href="https://www.jetbrains.com"><img src="https://gist.githubusercontent.com/anthonylavado/e8b2403deee9581e0b4cb8cd675af7db/raw/199ae22980ef5da64882ec2de3e8e5c03fe535b8/jetbrains.svg" height="50px" alt="JetBrains logo"></a>
 </p>
@@ -0,0 +1,22 @@
+apiVersion: v2
+name: jellyfin-ha
+description: >
+  High-availability Jellyfin media server with Redis-backed transcode session
+  store, lease-aware segment cleanup, and optional PostgreSQL database provider
+  for multi-pod Kubernetes deployments.
+type: application
+version: 0.1.0
+appVersion: "12.0.0"
+keywords:
+  - jellyfin
+  - media-server
+  - high-availability
+  - redis
+  - kubernetes
+home: https://github.com/ZoltyMat/jellyfin-ha
+sources:
+  - https://github.com/ZoltyMat/jellyfin-ha
+maintainers:
+  - name: ZoltyMat
+    url: https://github.com/ZoltyMat
+icon: https://raw.githubusercontent.com/jellyfin/jellyfin/master/Jellyfin.Server/Resources/Images/jellyfin-icon-solid.png
@@ -0,0 +1,49 @@
+1. Jellyfin HA has been deployed.
+
+{{- if eq (int .Values.replicaCount) 1 }}
+⚠  replicaCount=1 — running in single-instance mode. Set replicaCount >= 2 and
+   ha.enabled=true to enable HA transcoding.
+{{- else }}
+✔  Running {{ .Values.replicaCount }} replicas.
+{{- if include "jellyfin-ha.haEnabled" . }}
+✔  HA mode: ACTIVE — transcode sessions replicated via Redis.
+{{- else }}
+⚠  HA mode: INACTIVE — NullTranscodeSessionStore in use.
+   Set redis.enabled=true (or ha.transcodeStore.redisConnectionString) to enable HA.
+{{- end }}
+{{- end }}
+
+2. Get the Jellyfin URL:
+
+{{- if .Values.ingress.enabled }}
+{{- range .Values.ingress.hosts }}
+  https://{{ .host }}/
+{{- end }}
+{{- else if .Values.traefikIngressRoute.enabled }}
+  https://{{ .Values.traefikIngressRoute.host }}/
+{{- else }}
+  Access via port-forward:
+  kubectl port-forward -n {{ .Release.Namespace }} svc/{{ include "jellyfin-ha.fullname" . }} 8096:{{ .Values.service.port }}
+  http://localhost:8096/
+{{- end }}
+
+3. PostgreSQL:
+{{- if .Values.postgresql.enabled }}
+✔  In-cluster PostgreSQL deployed. Ensure the secret "{{ .Values.postgresql.existingSecret }}"
+   exists in namespace {{ .Release.Namespace }} before starting the server.
+{{- else if eq .Values.config.databaseType "Jellyfin-PostgreSQL" }}
+⚠  config.databaseType=Jellyfin-PostgreSQL but postgresql.enabled=false.
+   Make sure you have an external PostgreSQL and the correct DATABASE_URL env var set.
+{{- else }}
+   Using SQLite (default). Enable postgresql.enabled=true for a shared database backend.
+{{- end }}
+
+4. Transcode storage:
+   The transcode PVC must be ReadWriteMany when replicaCount > 1.
+   Current accessMode: {{ .Values.persistence.transcode.accessMode }}
+{{- if and (gt (int .Values.replicaCount) 1) (ne .Values.persistence.transcode.accessMode "ReadWriteMany") }}
+
+⚠  WARNING: replicaCount > 1 but transcode accessMode is not ReadWriteMany.
+   Pod B cannot read Pod A's HLS segments during session takeover.
+   Set persistence.transcode.accessMode=ReadWriteMany or use an NFS / Longhorn RWX PVC.
+{{- end }}
@@ -0,0 +1,137 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "jellyfin-ha.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "jellyfin-ha.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart label.
+*/}}
+{{- define "jellyfin-ha.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels.
+*/}}
+{{- define "jellyfin-ha.labels" -}}
+helm.sh/chart: {{ include "jellyfin-ha.chart" . }}
+{{ include "jellyfin-ha.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels.
+*/}}
+{{- define "jellyfin-ha.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "jellyfin-ha.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/component: server
+{{- end }}
+
+{{/*
+Service account name.
+*/}}
+{{- define "jellyfin-ha.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "jellyfin-ha.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{/*
+Fully qualified name of the in-cluster Redis service.
+*/}}
+{{- define "jellyfin-ha.redis.fullname" -}}
+{{- printf "%s-redis" (include "jellyfin-ha.fullname" .) }}
+{{- end }}
+
+{{/*
+Fully qualified name of the in-cluster PostgreSQL service.
+*/}}
+{{- define "jellyfin-ha.postgres.fullname" -}}
+{{- printf "%s-postgres" (include "jellyfin-ha.fullname" .) }}
+{{- end }}
+
+{{/*
+Compute the Redis connection string.
+Priority:
+  1. existingSecret (mounted as env var in the statefulset template)
+  2. explicit ha.transcodeStore.redisConnectionString value
+  3. auto-compose from the in-cluster Redis service name when redis.enabled=true
+Returns empty string if none of the above apply (= single-instance / NullStore mode).
+This helper returns the literal string only for cases 2 and 3; case 1 is handled
+directly in the container env block via secretKeyRef.
+*/}}
+{{- define "jellyfin-ha.redisConnectionString" -}}
+{{- if .Values.ha.transcodeStore.redisConnectionString }}
+{{- .Values.ha.transcodeStore.redisConnectionString }}
+{{- else if .Values.redis.enabled }}
+{{- printf "%s:6379,abortConnect=false" (include "jellyfin-ha.redis.fullname" .) }}
+{{- end }}
+{{- end }}
+
+{{/*
+Return true if HA mode is active and Redis should be wired up.
+*/}}
+{{- define "jellyfin-ha.haEnabled" -}}
+{{- if and .Values.ha.enabled (or .Values.redis.enabled .Values.ha.transcodeStore.redisConnectionString .Values.ha.transcodeStore.existingSecret) }}
+{{- "true" }}
+{{- end }}
+{{- end }}
+
+{{/*
+Config PVC claim name — either the existing claim or the chart-managed one.
+*/}}
+{{- define "jellyfin-ha.configPvcName" -}}
+{{- if .Values.persistence.config.existingClaim }}
+{{- .Values.persistence.config.existingClaim }}
+{{- else }}
+{{- printf "%s-config" (include "jellyfin-ha.fullname" .) }}
+{{- end }}
+{{- end }}
+
+{{/*
+Transcode PVC claim name — either the existing claim or the chart-managed one.
+*/}}
+{{- define "jellyfin-ha.transcodePvcName" -}}
+{{- if .Values.persistence.transcode.existingClaim }}
+{{- .Values.persistence.transcode.existingClaim }}
+{{- else }}
+{{- printf "%s-transcode" (include "jellyfin-ha.fullname" .) }}
+{{- end }}
+{{- end }}
+
+{{/*
+Media PVC claim name — either the existing claim or the chart-managed NFS PVC.
+*/}}
+{{- define "jellyfin-ha.mediaPvcName" -}}
+{{- if .Values.persistence.media.existingClaim }}
+{{- .Values.persistence.media.existingClaim }}
+{{- else if .Values.persistence.media.nfs.enabled }}
+{{- printf "%s-media" (include "jellyfin-ha.fullname" .) }}
+{{- end }}
+{{- end }}
@@ -0,0 +1,15 @@
+{{- if .Values.runtimeConfig.enabled }}
+# jellyfin.runtimeconfig.json ConfigMap.
+# Mount path: /jellyfin/jellyfin.runtimeconfig.json
+# Use this to set .NET runtime configuration switches (e.g. Intel QSV codec flags).
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "jellyfin-ha.fullname" . }}-runtimeconfig
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "jellyfin-ha.labels" . | nindent 4 }}
+data:
+  jellyfin.runtimeconfig.json: |
+    {{- .Values.runtimeConfig.json | nindent 4 }}
+{{- end }}
@@ -0,0 +1,97 @@
+{{- if .Values.ingress.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "jellyfin-ha.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "jellyfin-ha.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.ingress.className }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- toYaml .Values.ingress.tls | nindent 4 }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            pathType: {{ .pathType }}
+            backend:
+              service:
+                name: {{ include "jellyfin-ha.fullname" $ }}
+                port:
+                  name: http
+          {{- end }}
+    {{- end }}
+{{- end }}
+
+---
+{{- if .Values.traefikIngressRoute.enabled }}
+# Traefik v3 IngressRoute (used by k3s default ingress controller).
+# Enables sticky session cookies — required for multi-replica Jellyfin so that
+# a client always lands on the same pod (session affinity).
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: {{ include "jellyfin-ha.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "jellyfin-ha.labels" . | nindent 4 }}
+  {{- if .Values.traefikIngressRoute.tls.enabled }}
+  annotations:
+    cert-manager.io/cluster-issuer: {{ .Values.traefikIngressRoute.tls.clusterIssuer }}
+  {{- end }}
+spec:
+  entryPoints:
+    {{- toYaml .Values.traefikIngressRoute.entryPoints | nindent 4 }}
+  routes:
+    - match: Host(`{{ .Values.traefikIngressRoute.host }}`)
+      kind: Rule
+      services:
+        - name: {{ include "jellyfin-ha.fullname" . }}
+          port: {{ .Values.service.port }}
+          {{- if .Values.traefikIngressRoute.sticky.enabled }}
+          sticky:
+            cookie:
+              name: {{ .Values.traefikIngressRoute.sticky.cookieName }}
+              httpOnly: {{ .Values.traefikIngressRoute.sticky.httpOnly }}
+              secure: {{ .Values.traefikIngressRoute.sticky.secure }}
+          {{- end }}
+  {{- if .Values.traefikIngressRoute.tls.enabled }}
+  tls:
+    secretName: {{ .Values.traefikIngressRoute.tls.secretName }}
+  {{- end }}
+
+---
+{{- if .Values.traefikIngressRoute.tls.enabled }}
+# cert-manager Certificate for Traefik TLS termination.
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: {{ include "jellyfin-ha.fullname" . }}-tls
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "jellyfin-ha.labels" . | nindent 4 }}
+spec:
+  secretName: {{ .Values.traefikIngressRoute.tls.secretName }}
+  issuerRef:
+    name: {{ .Values.traefikIngressRoute.tls.clusterIssuer }}
+    kind: ClusterIssuer
+  dnsNames:
+    {{- if .Values.traefikIngressRoute.tls.dnsNames }}
+    {{- toYaml .Values.traefikIngressRoute.tls.dnsNames | nindent 4 }}
+    {{- else }}
+    - {{ .Values.traefikIngressRoute.host }}
+    {{- end }}
+{{- end }}
+{{- end }}
@@ -0,0 +1,14 @@
+{{- if .Values.podDisruptionBudget.enabled }}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ include "jellyfin-ha.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "jellyfin-ha.labels" . | nindent 4 }}
+spec:
+  minAvailable: {{ .Values.podDisruptionBudget.minAvailable }}
+  selector:
+    matchLabels:
+      {{- include "jellyfin-ha.selectorLabels" . | nindent 6 }}
+{{- end }}
@@ -0,0 +1,20 @@
+{{- if .Values.postgresql.enabled }}
+# PersistentVolumeClaim for the in-cluster PostgreSQL data directory.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "jellyfin-ha.postgres.fullname" . }}-data
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "jellyfin-ha.labels" . | nindent 4 }}
+    app.kubernetes.io/component: database
+spec:
+  accessModes:
+    - ReadWriteOnce
+  {{- if .Values.postgresql.persistence.storageClass }}
+  storageClassName: {{ .Values.postgresql.persistence.storageClass | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.postgresql.persistence.size }}
+{{- end }}
@@ -0,0 +1,21 @@
+{{- if .Values.postgresql.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "jellyfin-ha.postgres.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "jellyfin-ha.labels" . | nindent 4 }}
+    app.kubernetes.io/component: database
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: {{ include "jellyfin-ha.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: database
+  ports:
+    - name: postgres
+      port: {{ .Values.postgresql.service.port }}
+      targetPort: postgres
+      protocol: TCP
+{{- end }}
@@ -0,0 +1,84 @@
+{{- if .Values.postgresql.enabled }}
+# In-cluster PostgreSQL StatefulSet — experimental.
+# The credentials secret must be created manually before first deploy:
+#
+#   kubectl create secret generic {{ .Values.postgresql.existingSecret }} \
+#     --namespace {{ .Release.Namespace }} \
+#     --from-literal=POSTGRES_USER=jellyfin \
+#     --from-literal=POSTGRES_PASSWORD=<strong-password> \
+#     --from-literal=POSTGRES_DB=jellyfin \
+#     --from-literal=DATABASE_URL="postgresql://jellyfin:<password>@{{ include "jellyfin-ha.postgres.fullname" . }}:5432/jellyfin"
+#
+# SECURITY: Do NOT add a Secret resource here. Applying this file must not
+# overwrite a live secret.
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ include "jellyfin-ha.postgres.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "jellyfin-ha.labels" . | nindent 4 }}
+    app.kubernetes.io/component: database
+spec:
+  replicas: 1
+  serviceName: {{ include "jellyfin-ha.postgres.fullname" . }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ include "jellyfin-ha.name" . }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      app.kubernetes.io/component: database
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{ include "jellyfin-ha.name" . }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        app.kubernetes.io/component: database
+    spec:
+      containers:
+        - name: postgres
+          image: "{{ .Values.postgresql.image.repository }}:{{ .Values.postgresql.image.tag }}"
+          imagePullPolicy: {{ .Values.postgresql.image.pullPolicy }}
+          ports:
+            - name: postgres
+              containerPort: 5432
+              protocol: TCP
+          env:
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.postgresql.existingSecret }}
+                  key: POSTGRES_USER
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.postgresql.existingSecret }}
+                  key: POSTGRES_PASSWORD
+            - name: POSTGRES_DB
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.postgresql.existingSecret }}
+                  key: POSTGRES_DB
+            - name: PGDATA
+              value: /var/lib/postgresql/data/pgdata
+          resources:
+            {{- toYaml .Values.postgresql.resources | nindent 12 }}
+          livenessProbe:
+            exec:
+              command: ["pg_isready", "-U", "$(POSTGRES_USER)"]
+            initialDelaySeconds: 30
+            periodSeconds: 20
+            timeoutSeconds: 5
+          readinessProbe:
+            exec:
+              command: ["pg_isready", "-U", "$(POSTGRES_USER)"]
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 3
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/postgresql/data
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: {{ include "jellyfin-ha.postgres.fullname" . }}-data
+{{- end }}
@@ -0,0 +1,90 @@
+{{- if not .Values.persistence.config.existingClaim }}
+# Shared config PVC — used by all Jellyfin replicas.
+# Must be ReadWriteMany when replicaCount > 1.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "jellyfin-ha.fullname" . }}-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "jellyfin-ha.labels" . | nindent 4 }}
+    app.kubernetes.io/component: storage
+spec:
+  accessModes:
+    - {{ .Values.persistence.config.accessMode }}
+  {{- if .Values.persistence.config.storageClass }}
+  storageClassName: {{ .Values.persistence.config.storageClass | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.config.size }}
+{{- end }}
+
+---
+{{- if not .Values.persistence.transcode.existingClaim }}
+# Shared transcode PVC — must be ReadWriteMany so pod takeover can read
+# HLS segments written by the previous owner pod.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "jellyfin-ha.fullname" . }}-transcode
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "jellyfin-ha.labels" . | nindent 4 }}
+    app.kubernetes.io/component: storage
+spec:
+  accessModes:
+    - {{ .Values.persistence.transcode.accessMode }}
+  {{- if .Values.persistence.transcode.storageClass }}
+  storageClassName: {{ .Values.persistence.transcode.storageClass | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.transcode.size }}
+{{- end }}
+
+---
+{{- if and .Values.persistence.media.nfs.enabled (not .Values.persistence.media.existingClaim) }}
+# NFS PersistentVolume and PersistentVolumeClaim for the media library.
+# Enable persistence.media.nfs.enabled and provide server/path to use this.
+# Alternatively, set persistence.media.existingClaim to reuse an existing PVC.
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: {{ include "jellyfin-ha.fullname" . }}-media-nfs
+  labels:
+    {{- include "jellyfin-ha.labels" . | nindent 4 }}
+    app.kubernetes.io/component: storage
+spec:
+  capacity:
+    storage: {{ .Values.persistence.media.nfs.size }}
+  accessModes:
+    - ReadOnlyMany
+  persistentVolumeReclaimPolicy: Retain
+  {{- if .Values.persistence.media.nfs.storageClass }}
+  storageClassName: {{ .Values.persistence.media.nfs.storageClass | quote }}
+  {{- end }}
+  nfs:
+    server: {{ .Values.persistence.media.nfs.server | quote }}
+    path: {{ .Values.persistence.media.nfs.path | quote }}
+    readOnly: true
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "jellyfin-ha.fullname" . }}-media
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "jellyfin-ha.labels" . | nindent 4 }}
+    app.kubernetes.io/component: storage
+spec:
+  accessModes:
+    - ReadOnlyMany
+  {{- if .Values.persistence.media.nfs.storageClass }}
+  storageClassName: {{ .Values.persistence.media.nfs.storageClass | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.media.nfs.size }}
+  volumeName: {{ include "jellyfin-ha.fullname" . }}-media-nfs
+{{- end }}
@@ -0,0 +1,15 @@
+{{- if .Values.redis.enabled }}
+# ConfigMap holding the Redis configuration file.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "jellyfin-ha.redis.fullname" . }}-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "jellyfin-ha.labels" . | nindent 4 }}
+    app.kubernetes.io/component: redis
+data:
+  redis.conf: |
+    maxmemory {{ .Values.redis.maxmemory }}
+    maxmemory-policy {{ .Values.redis.maxmemoryPolicy }}
+{{- end }}
--- a/Show More
+++ b/Show More