fix(session): parse the owner key without assuming the pod id

test(session): sample ownership after each non-owner request
fix(session): tie directory ownership to the live connection
2026-09-25 00:04:54 +10:00 · 2026-09-25 00:01:42 +10:00 · 2026-09-24 23:50:01 +10:00 · 2026-09-24 23:08:52 +10:00 · 2026-09-24 22:48:48 +10:00 · 2026-09-21 23:13:37 +10:00
181 changed files with 23173 additions and 1455 deletions
@@ -1,44 +0,0 @@
-name: "CodeQL"
-
-on:
-  push:
-    branches: [ master ]
-  pull_request:
-    branches: [ master ]
-  schedule:
-    - cron: '24 2 * * 4'
-
-permissions:
-  contents: read
-  security-events: write
-
-jobs:
-  analyze:
-    name: Analyze
-    runs-on: ubuntu-latest
-
-    strategy:
-      fail-fast: false
-      matrix:
-        language: [ 'csharp' ]
-
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-    - name: Setup .NET
-      uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
-      with:
-        dotnet-version: '10.0.x'
-
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
-      with:
-        languages: ${{ matrix.language }}
-        queries: +security-extended
-
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
@@ -1,159 +0,0 @@
-name: ABI Compatibility
-on:
-  pull_request:
-
-permissions: {}
-
-jobs:
-  abi-head:
-    name: ABI - HEAD
-    runs-on: ubuntu-latest
-    permissions: read-all
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          repository: ${{ github.event.pull_request.head.repo.full_name }}
-
-      - name: Setup .NET
-        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
-        with:
-          dotnet-version: '10.0.x'
-
-      - name: Build
-        run: |
-          dotnet build Jellyfin.Server -o ./out
-
-      - name: Upload Head
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: abi-head
-          retention-days: 14
-          if-no-files-found: error
-          path: out/
-
-  abi-base:
-    name: ABI - BASE
-    if: ${{ github.base_ref != '' }}
-    runs-on: ubuntu-latest
-    permissions: read-all
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          repository: ${{ github.event.pull_request.head.repo.full_name }}
-          fetch-depth: 0
-
-      - name: Setup .NET
-        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
-        with:
-          dotnet-version: '10.0.x'
-
-      - name: Checkout common ancestor
-        env:
-          HEAD_REF: ${{ github.head_ref }}
-        run: |
-          git remote add upstream https://github.com/${{ github.event.pull_request.base.repo.full_name }}
-          git -c protocol.version=2 fetch --prune --progress --no-recurse-submodules upstream +refs/heads/*:refs/remotes/upstream/* +refs/tags/*:refs/tags/*
-          ANCESTOR_REF=$(git merge-base upstream/${{ github.base_ref }} origin/$HEAD_REF)
-          git checkout --progress --force $ANCESTOR_REF
-
-      - name: Build
-        run: |
-          dotnet build Jellyfin.Server -o ./out
-
-      - name: Upload Head
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: abi-base
-          retention-days: 14
-          if-no-files-found: error
-          path: out/
-
-  abi-diff:
-    permissions:
-      pull-requests: write  #  to create or update comment (peter-evans/create-or-update-comment)
-
-    name: ABI - Difference
-    if: ${{ github.event_name == 'pull_request' }}
-    runs-on: ubuntu-latest
-    needs:
-      - abi-head
-      - abi-base
-
-    steps:
-      - name: Download abi-head
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: abi-head
-          path: abi-head
-
-      - name: Download abi-base
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: abi-base
-          path: abi-base
-
-      - name: Setup ApiCompat
-        run: |
-          dotnet tool install --global Microsoft.DotNet.ApiCompat.Tool
-
-      - name: Run ApiCompat
-        id: diff
-        run: |
-          {
-            echo 'body<<EOF'
-            for file in Jellyfin.Data.dll MediaBrowser.Common.dll MediaBrowser.Controller.dll MediaBrowser.Model.dll Emby.Naming.dll Jellyfin.Extensions.dll Jellyfin.MediaEncoding.Keyframes.dll Jellyfin.Database.Implementations.dll; do
-              COMPAT_OUTPUT="$( { apicompat --left ./abi-base/${file} --right ./abi-head/${file}; } 2>&1 || true )"
-              if [ "APICompat ran successfully without finding any breaking changes." != "${COMPAT_OUTPUT}" ]; then
-                printf "\n${file}\n${COMPAT_OUTPUT}\n"
-              fi
-            done
-            echo EOF
-          } >> $GITHUB_OUTPUT
-
-      - name: Find difference comment
-        uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4.0.0
-        id: find-comment
-        with:
-          issue-number: ${{ github.event.pull_request.number }}
-          direction: last
-          body-includes: abi-diff-workflow-comment
-
-      - name: Reply or edit difference comment (changed)
-        uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
-        if: ${{ steps.diff.outputs.body != '' }}
-        with:
-          issue-number: ${{ github.event.pull_request.number }}
-          comment-id: ${{ steps.find-comment.outputs.comment-id }}
-          edit-mode: replace
-          token: ${{ secrets.JF_BOT_TOKEN }}
-          body: |
-            <!--abi-diff-workflow-comment-->
-            <details>
-            <summary>ABI Difference</summary>
-
-            ```
-            ${{ steps.diff.outputs.body }}
-            ```
-
-            </details>
-
-      - name: Reply or edit difference comment (unchanged)
-        uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
-        if: ${{ steps.diff.outputs.body == '' && steps.find-comment.outputs.comment-id != '' }}
-        with:
-          issue-number: ${{ github.event.pull_request.number }}
-          comment-id: ${{ steps.find-comment.outputs.comment-id }}
-          edit-mode: replace
-          token: ${{ secrets.JF_BOT_TOKEN }}
-          body: |
-            <!--abi-diff-workflow-comment-->
-            <details>
-            <summary>ABI Difference</summary>
-
-            No changes to the ABI found. See history of this comment for previous changes.
-
-            </details>
@@ -1,25 +0,0 @@
-name: Format
-on:
-  push:
-    branches:
-      - master
-  # Run formatter against the forked branch, but
-  # do not allow access to secrets
-  # https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#workflows-in-forked-repositories
-  pull_request:
-
-env:
-  SDK_VERSION: "10.0.x"
-
-jobs:
-  format-check:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
-        with:
-          dotnet-version: ${{ env.SDK_VERSION }}
-
-      - name: Run DotNet Format
-        run: dotnet format --verify-no-changes --verbosity minimal
@@ -1,45 +0,0 @@
-name: Tests
-on:
-  push:
-    branches:
-      - master
-  # Run tests against the forked branch, but
-  # do not allow access to secrets
-  # https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#workflows-in-forked-repositories
-  pull_request:
-
-env:
-  SDK_VERSION: "10.0.x"
-
-jobs:
-  run-tests:
-    strategy:
-      matrix:
-        os: ["ubuntu-latest", "macos-latest", "windows-latest"]
-      fail-fast: false
-
-    runs-on: "${{ matrix.os }}"
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
-        with:
-          dotnet-version: ${{ env.SDK_VERSION }}
-
-      - name: Run DotNet CLI Tests
-        run: >
-          dotnet test Jellyfin.sln
-          --configuration Release
-          --collect:"XPlat Code Coverage"
-          --settings tests/coverletArgs.runsettings
-          --verbosity minimal
-
-      - name: Merge code coverage results
-        uses: danielpalme/ReportGenerator-GitHub-Action@d3ebf1f760f7d8ab92cc44d9bcfee7ad73722a31 # v5.5.11
-        with:
-          reports: "**/coverage.cobertura.xml"
-          targetdir: "merged/"
-          reporttypes: "Cobertura"
-
-      # TODO - which action / tool to use to publish code coverage results?
-      # - name: Publish code coverage results
@@ -1,63 +0,0 @@
-name: Commands
-on:
-  issue_comment:
-    types:
-      - created
-      - edited
-  pull_request:
-    types:
-      - labeled
-      - synchronize
-
-permissions: {}
-jobs:
-  rebase:
-    name: Rebase
-    if: github.event.issue.pull_request != '' && contains(github.event.comment.body, '@jellyfin-bot rebase') && github.event.comment.author_association == 'MEMBER'
-    runs-on: ubuntu-latest
-    steps:
-      - name: Notify as seen
-        uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
-        with:
-          token: ${{ secrets.JF_BOT_TOKEN }}
-          comment-id: ${{ github.event.comment.id }}
-          reactions: '+1'
-
-      - name: Checkout the latest code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          token: ${{ secrets.JF_BOT_TOKEN }}
-          fetch-depth: 0
-
-      - name: Automatic Rebase
-        uses: cirrus-actions/rebase@b87d48154a87a85666003575337e27b8cd65f691 # 1.8
-        env:
-          GITHUB_TOKEN: ${{ secrets.JF_BOT_TOKEN }}
-
-  rename:
-    name: Rename
-    if: contains(github.event.comment.body, '@jellyfin-bot rename')
-    runs-on: ubuntu-latest
-    steps:
-      - name: pull in script
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          repository: jellyfin/jellyfin-triage-script
-
-      - name: install python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: '3.14'
-          cache: 'pip'
-
-      - name: install python packages
-        run: pip install -r rename/requirements.txt
-
-      - name: run rename script
-        run: python3 rename.py
-        working-directory: ./rename
-        env:
-          GH_TOKEN: ${{ secrets.JF_BOT_TOKEN }}
-          GH_REPO: ${{ github.repository }}
-          ISSUE: ${{ github.event.issue.number }}
-          COMMENT_ID: ${{ github.event.comment.id }}
@@ -1,35 +0,0 @@
-name: Stale Issue Labeler
-
-on:
-  schedule:
-    - cron: '30 1 * * *'
-  workflow_dispatch:
-
-permissions:
-  issues: write
-  pull-requests: write
-  actions: write
-
-jobs:
-  issues:
-    name: Check for stale issues
-    runs-on: ubuntu-latest
-    if: ${{ contains(github.repository, 'jellyfin/') }}
-    steps:
-      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
-        with:
-          repo-token: ${{ secrets.JF_BOT_TOKEN }}
-          ascending: true
-          days-before-stale: 120
-          days-before-pr-stale: -1
-          days-before-close: 21
-          days-before-pr-close: -1
-          operations-per-run: 500
-          exempt-issue-labels: regression,security,roadmap,future,feature,enhancement,confirmed
-          stale-issue-label: stale
-          stale-issue-message: |-
-            This issue has gone 120 days without an update and will be closed within 21 days if there is no new activity. To prevent this issue from being closed, please confirm the issue has not already been fixed by providing updated examples or logs.
-
-            If you have any questions you can use one of several ways to [contact us](https://jellyfin.org/contact).
-          close-issue-message: |-
-            This issue was closed due to inactivity.
@@ -1,32 +0,0 @@
-name: Check Issue Template
-on:
-  issues:
-    types:
-      - opened
-jobs:
-  check_issue:
-    runs-on: ubuntu-latest
-    permissions:
-      issues: write
-    steps:
-      - name: pull in script
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          repository: jellyfin/jellyfin-triage-script
-
-      - name: install python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: '3.14'
-          cache: 'pip'
-
-      - name: install python packages
-        run: pip install -r main-repo-triage/requirements.txt
-
-      - name: check and comment issue
-        working-directory: ./main-repo-triage
-        run: python3 single_issue_gha.py
-        env:
-          GH_TOKEN: ${{ secrets.JF_BOT_TOKEN }}
-          GH_REPO: ${{ github.repository }}
-          ISSUE: ${{ github.event.issue.number }}
@@ -1,44 +0,0 @@
-name: OpenAPI Generate
-
-on:
-  workflow_call:
-    inputs:
-      ref:
-        required: true
-        type: string
-      repository:
-        required: true
-        type: string
-      artifact:
-        required: true
-        type: string
-
-permissions:
-  contents: read
-
-jobs:
-  main:
-    name: Main
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout Repository
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      with:
-        ref: ${{ inputs.ref }}
-        repository: ${{ inputs.repository }}
-
-    - name: Configure .NET
-      uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
-      with:
-        dotnet-version: '10.0.x'
-
-    - name: Create File
-      run: dotnet test tests/Jellyfin.Server.Integration.Tests/Jellyfin.Server.Integration.Tests.csproj -c Release --filter Jellyfin.Server.Integration.Tests.OpenApiSpecTests
-
-    - name: Upload Artifact
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-      with:
-        name: ${{ inputs.artifact }}
-        path: tests/Jellyfin.Server.Integration.Tests/bin/Release/net10.0/openapi.json
-        retention-days: 14
-        if-no-files-found: error
@@ -1,140 +0,0 @@
-name: OpenAPI Publish
-on:
-  push:
-    branches:
-      - master
-    tags:
-      - 'v*'
-
-jobs:
-  publish-openapi:
-    name: OpenAPI - Publish Artifact
-    uses: ./.github/workflows/openapi-generate.yml
-    permissions:
-      contents: read
-    with:
-      ref: ${{ github.sha }}
-      repository: ${{ github.repository }}
-      artifact: openapi-head
-
-  publish-unstable:
-    name: OpenAPI - Publish Unstable Spec
-    if: ${{ github.event_name != 'pull_request' && !startsWith(github.ref, 'refs/tags/v') && contains(github.repository_owner, 'jellyfin') }}
-    runs-on: ubuntu-latest
-    needs:
-    - publish-openapi
-    steps:
-      - name: Set unstable dated version
-        id: version
-        run: |-
-          echo "JELLYFIN_VERSION=$(date +'%Y%m%d%H%M%S')" >> $GITHUB_ENV
-      - name: Download openapi-head
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: openapi-head
-          path: openapi-head
-      - name: Upload openapi.json (unstable) to repository server
-        uses: appleboy/scp-action@ff85246acaad7bdce478db94a363cd2bf7c90345 # v1.0.0
-        with:
-          host: "${{ secrets.REPO_HOST }}"
-          username: "${{ secrets.REPO_USER }}"
-          key: "${{ secrets.REPO_KEY }}"
-          source: openapi-head/openapi.json
-          strip_components: 1
-          target: "/srv/incoming/openapi/unstable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}"
-      - name: Move openapi.json (unstable) into place
-        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
-        with:
-          host: "${{ secrets.REPO_HOST }}"
-          username: "${{ secrets.REPO_USER }}"
-          key: "${{ secrets.REPO_KEY }}"
-          debug: false
-          script: |
-            if ! test -d /run/workflows; then
-                sudo mkdir -p /run/workflows
-                sudo chown ${{ secrets.REPO_USER }} /run/workflows
-            fi
-            (
-            flock -x -w 300 200 || exit 1
-            TGT_DIR="/srv/repository/main/openapi"
-            LAST_SPEC="$( ls -lt ${TGT_DIR}/unstable/ | grep 'jellyfin-openapi' | head -1 | awk '{ print $NF }' )"
-            # If new and previous spec don't differ (diff retcode 0), remove incoming and finish
-            if diff /srv/incoming/openapi/unstable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}/openapi.json ${TGT_DIR}/unstable/${LAST_SPEC} &>/dev/null; then
-                rm -r /srv/incoming/openapi/unstable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}
-                exit 0
-            fi
-            # Move new spec into place
-            sudo mv /srv/incoming/openapi/unstable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}/openapi.json ${TGT_DIR}/unstable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}.json
-            # Delete previous jellyfin-openapi-unstable_previous.json
-            sudo rm ${TGT_DIR}/jellyfin-openapi-unstable_previous.json
-            # Move current jellyfin-openapi-unstable.json symlink to jellyfin-openapi-unstable_previous.json
-            sudo mv ${TGT_DIR}/jellyfin-openapi-unstable.json ${TGT_DIR}/jellyfin-openapi-unstable_previous.json
-            # Create new jellyfin-openapi-unstable.json symlink
-            sudo ln -s unstable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}.json ${TGT_DIR}/jellyfin-openapi-unstable.json
-            # Check that the previous openapi unstable spec link is correct
-            if [[ "$( readlink ${TGT_DIR}/jellyfin-openapi-unstable_previous.json )" != "unstable/${LAST_SPEC}" ]]; then
-                sudo rm ${TGT_DIR}/jellyfin-openapi-unstable_previous.json
-                sudo ln -s unstable/${LAST_SPEC} ${TGT_DIR}/jellyfin-openapi-unstable_previous.json
-            fi
-            ) 200>/run/workflows/openapi-unstable.lock
-
-  publish-stable:
-    name: OpenAPI - Publish Stable Spec
-    if: ${{ startsWith(github.ref, 'refs/tags/v') && contains(github.repository_owner, 'jellyfin') }}
-    runs-on: ubuntu-latest
-    needs:
-    - publish-openapi
-    steps:
-      - name: Set version number
-        id: version
-        run: |-
-          echo "JELLYFIN_VERSION=${GITHUB_REF#refs/tags/v}" >> $GITHUB_ENV
-      - name: Download openapi-head
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: openapi-head
-          path: openapi-head
-      - name: Upload openapi.json (stable) to repository server
-        uses: appleboy/scp-action@ff85246acaad7bdce478db94a363cd2bf7c90345 # v1.0.0
-        with:
-          host: "${{ secrets.REPO_HOST }}"
-          username: "${{ secrets.REPO_USER }}"
-          key: "${{ secrets.REPO_KEY }}"
-          source: openapi-head/openapi.json
-          strip_components: 1
-          target: "/srv/incoming/openapi/stable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}"
-      - name: Move openapi.json (stable) into place
-        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
-        with:
-          host: "${{ secrets.REPO_HOST }}"
-          username: "${{ secrets.REPO_USER }}"
-          key: "${{ secrets.REPO_KEY }}"
-          debug: false
-          script: |
-            if ! test -d /run/workflows; then
-                sudo mkdir -p /run/workflows
-                sudo chown ${{ secrets.REPO_USER }} /run/workflows
-            fi
-            (
-            flock -x -w 300 200 || exit 1
-            TGT_DIR="/srv/repository/main/openapi"
-            LAST_SPEC="$( ls -lt ${TGT_DIR}/stable/ | grep 'jellyfin-openapi' | head -1 | awk '{ print $NF }' )"
-            # If new and previous spec don't differ (diff retcode 0), remove incoming and finish
-            if diff /srv/incoming/openapi/stable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}/openapi.json ${TGT_DIR}/stable/${LAST_SPEC} &>/dev/null; then
-                rm -r /srv/incoming/openapi/stable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}
-                exit 0
-            fi
-            # Move new spec into place
-            sudo mv /srv/incoming/openapi/stable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}/openapi.json ${TGT_DIR}/stable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}.json
-            # Delete previous jellyfin-openapi-stable_previous.json
-            sudo rm ${TGT_DIR}/jellyfin-openapi-stable_previous.json
-            # Move current jellyfin-openapi-stable.json symlink to jellyfin-openapi-stable_previous.json
-            sudo mv ${TGT_DIR}/jellyfin-openapi-stable.json ${TGT_DIR}/jellyfin-openapi-stable_previous.json
-            # Create new jellyfin-openapi-stable.json symlink
-            sudo ln -s stable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}.json ${TGT_DIR}/jellyfin-openapi-stable.json
-            # Check that the previous openapi stable spec link is correct
-            if [[ "$( readlink ${TGT_DIR}/jellyfin-openapi-stable_previous.json )" != "stable/${LAST_SPEC}" ]]; then
-                sudo rm ${TGT_DIR}/jellyfin-openapi-stable_previous.json
-                sudo ln -s stable/${LAST_SPEC} ${TGT_DIR}/jellyfin-openapi-stable_previous.json
-            fi
-            ) 200>/run/workflows/openapi-stable.lock
@@ -1,80 +0,0 @@
-name: OpenAPI Check
-on:
-  pull_request:
-
-jobs:
-  ancestor:
-    name: Common Ancestor
-    runs-on: ubuntu-latest
-    outputs:
-      base_ref: ${{ steps.ancestor.outputs.base_ref }}
-    steps:
-    - name: Checkout Repository
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      with:
-        ref: ${{ github.event.pull_request.head.sha }}
-        repository: ${{ github.event.pull_request.head.repo.full_name }}
-        fetch-depth: 0
-    - name: Search History
-      id: ancestor
-      run: |
-        git remote add upstream https://github.com/${{ github.event.pull_request.base.repo.full_name }}
-        git fetch --prune --progress --no-recurse-submodules upstream +refs/heads/*:refs/remotes/upstream/* +refs/tags/*:refs/tags/*
-
-        ANCESTOR_REF=$(git merge-base upstream/${{ github.base_ref }} HEAD)
-
-        echo "ref: ${ANCESTOR_REF}"
-
-        echo "base_ref=${ANCESTOR_REF}" >> "$GITHUB_OUTPUT"
-
-  head:
-    name: Head Artifact
-    uses: ./.github/workflows/openapi-generate.yml
-    with:
-      ref: ${{ github.event.pull_request.head.sha }}
-      repository: ${{ github.event.pull_request.head.repo.full_name }}
-      artifact: openapi-head
-
-  base:
-    name: Base Artifact
-    uses: ./.github/workflows/openapi-generate.yml
-    needs:
-    - ancestor
-    with:
-      ref: ${{ needs.ancestor.outputs.base_ref }}
-      repository: ${{ github.event.pull_request.base.repo.full_name }}
-      artifact: openapi-base
-
-  diff:
-    name: Generate Report
-    runs-on: ubuntu-latest
-    needs:
-    - head
-    - base
-    steps:
-    - name: Download Head
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-      with:
-        name: openapi-head
-        path: openapi-head
-    - name: Download Base
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-      with:
-        name: openapi-base
-        path: openapi-base
-    - name: Detect Changes
-      id: openapi-diff
-      run: |
-        sed -i 's:allOf:oneOf:g' openapi-head/openapi.json
-        sed -i 's:allOf:oneOf:g' openapi-base/openapi.json
-
-        mkdir -p /tmp/openapi-report
-        mv openapi-head/openapi.json /tmp/openapi-report/head.json
-        mv openapi-base/openapi.json /tmp/openapi-report/base.json
-
-        docker run -v /tmp/openapi-report:/data openapitools/openapi-diff:2.1.6 /data/base.json /data/head.json --state -l ERROR --markdown /data/openapi-report.md
-    - name: Upload Artifact
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-      with:
-        name: openapi-report
-        path: /tmp/openapi-report/openapi-report.md
@@ -1,59 +0,0 @@
-name: OpenAPI Report
-
-on:
-  workflow_run:
-    workflows:
-    - OpenAPI Check
-    types:
-    - completed
-
-jobs:
-  metadata:
-    name: Generate Metadata
-    runs-on: ubuntu-latest
-    if: ${{ github.event.workflow_run.conclusion == 'success' }}
-    outputs:
-      pr_number: ${{ steps.pr_number.outputs.pr_number }}
-    steps:
-    - name: Get Pull Request Number
-      id: pr_number
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
-      run: |
-        API_RESPONSE=$(gh pr list --repo "${GITHUB_REPOSITORY}" --search "${HEAD_SHA}" --state open --json number)
-        PR_NUMBER=$(echo "${API_RESPONSE}" | jq '.[0].number')
-
-        echo "repository: ${GITHUB_REPOSITORY}"
-        echo "sha: ${HEAD_SHA}"
-        echo "response: ${API_RESPONSE}"
-        echo "pr: ${PR_NUMBER}"
-
-        echo "pr_number=${PR_NUMBER}" >> "${GITHUB_OUTPUT}"
-
-  comment:
-    name: Pull Request Comment
-    runs-on: ubuntu-latest
-    if: ${{ github.event.workflow_run.conclusion == 'success' }}
-    needs:
-    - metadata
-    permissions:
-      pull-requests: write
-      actions: read
-      contents: read
-    steps:
-    - name: Download OpenAPI Report
-      id: download_report
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-      with:
-        name: openapi-report
-        path: openapi-report
-        run-id: ${{ github.event.workflow_run.id }}
-        github-token: ${{ secrets.GITHUB_TOKEN }}
-    - name: Push Comment
-      uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
-      with:
-        github-token: ${{ secrets.JF_BOT_TOKEN }}
-        file-path: ${{ steps.download_report.outputs.download-path }}/openapi-report.md
-        pr-number: ${{ needs.metadata.outputs.pr_number }}
-        comment-tag: openapi-report
@@ -1,66 +0,0 @@
-name: Project Automation
-
-on:
-  push:
-    branches:
-      - master
-  pull_request:
-  issue_comment:
-
-permissions: {}
-jobs:
-  project:
-    name: Project board
-    runs-on: ubuntu-latest
-    if: ${{ github.repository == 'jellyfin/jellyfin' }}
-    steps:
-      - name: Remove from 'Current Release' project
-        uses: alex-page/github-project-automation-plus@303f24a24c67ce7adf565a07e96720faf126fe36 # v0.9.0
-        if: (github.event.pull_request || github.event.issue.pull_request) && !contains(github.event.*.labels.*.name, 'stable backport')
-        continue-on-error: true
-        with:
-          project: Current Release
-          action: delete
-          column: In progress
-          repo-token: ${{ secrets.JF_BOT_TOKEN }}
-
-      - name: Add to 'Release Next' project
-        uses: alex-page/github-project-automation-plus@303f24a24c67ce7adf565a07e96720faf126fe36 # v0.9.0
-        if: (github.event.pull_request || github.event.issue.pull_request) && github.event.action == 'opened'
-        continue-on-error: true
-        with:
-          project: Release Next
-          column: In progress
-          repo-token: ${{ secrets.JF_BOT_TOKEN }}
-
-      - name: Add to 'Current Release' project
-        uses: alex-page/github-project-automation-plus@303f24a24c67ce7adf565a07e96720faf126fe36 # v0.9.0
-        if: (github.event.pull_request || github.event.issue.pull_request) && !contains(github.event.*.labels.*.name, 'stable backport')
-        continue-on-error: true
-        with:
-          project: Current Release
-          column: In progress
-          repo-token: ${{ secrets.JF_BOT_TOKEN }}
-
-      - name: Check number of comments from the team member
-        if: github.event.issue.pull_request == '' && github.event.comment.author_association == 'MEMBER'
-        id: member_comments
-        run: echo "::set-output name=number::$(curl -s ${{ github.event.issue.comments_url }} | jq '.[] | select(.author_association == "MEMBER") | .author_association' | wc -l)"
-
-      - name: Move issue to needs triage
-        uses: alex-page/github-project-automation-plus@303f24a24c67ce7adf565a07e96720faf126fe36 # v0.9.0
-        if: github.event.issue.pull_request == '' && github.event.comment.author_association == 'MEMBER' && steps.member_comments.outputs.number <= 1
-        continue-on-error: true
-        with:
-          project: Issue Triage for Main Repo
-          column: Needs triage
-          repo-token: ${{ secrets.JF_BOT_TOKEN }}
-
-      - name: Add issue to triage project
-        uses: alex-page/github-project-automation-plus@303f24a24c67ce7adf565a07e96720faf126fe36 # v0.9.0
-        if: github.event.issue.pull_request == '' && github.event.action == 'opened'
-        continue-on-error: true
-        with:
-          project: Issue Triage for Main Repo
-          column: Pending response
-          repo-token: ${{ secrets.JF_BOT_TOKEN }}
@@ -1,24 +0,0 @@
-name: Merge Conflict Labeler
-
-on:
-  push:
-    branches:
-      - master
-  pull_request_target:
-    types: [synchronize]
-
-permissions: {}
-jobs:
-  main:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write
-    if: ${{ github.repository == 'jellyfin/jellyfin' }}
-    steps:
-      - name: Apply label
-        uses: eps1lon/actions-label-merge-conflict@0273be72a0bbd58fcd71d0d6c02c209b50d1e5e1 # v3.1.0
-        with:
-          dirtyLabel: 'merge conflict'
-          commentOnDirty: 'This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged.'
-          repoToken: ${{ secrets.JF_BOT_TOKEN }}
@@ -1,30 +0,0 @@
-name: Stale PR Check
-
-on:
-  schedule:
-    - cron: '30 */12 * * *'
-  workflow_dispatch:
-
-permissions:
-  pull-requests: write
-  actions: write
-
-jobs:
-  prs-stale-conflicts:
-    name: Check PRs with merge conflicts
-    runs-on: ubuntu-latest
-    if: ${{ contains(github.repository, 'jellyfin/') }}
-    steps:
-      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
-        with:
-          repo-token: ${{ secrets.JF_BOT_TOKEN }}
-          ascending: true
-          operations-per-run: 150
-          # The merge conflict action will remove the label when updated
-          remove-stale-when-updated: false
-          days-before-stale: -1
-          days-before-close: 90
-          days-before-issue-close: -1
-          stale-pr-label: merge conflict
-          close-pr-message: |-
-            This PR has been closed due to having unresolved merge conflicts.
@@ -1,82 +0,0 @@
-name: '🆙 Auto bump_version'
-
-on:
-  release:
-    types:
-      - published
-  workflow_dispatch:
-    inputs:
-      TAG_BRANCH:
-        required: true
-        description: release-x.y.z
-      NEXT_VERSION:
-        required: true
-        description: x.y.z
-
-jobs:
-  auto_bump_version:
-    runs-on: ubuntu-latest
-    if: ${{ github.event_name == 'release' && !contains(github.event.release.tag_name, 'rc') }}
-    env:
-      TAG_BRANCH: ${{ github.event.release.target_commitish }}
-    steps:
-      - name: Wait for deploy checks to finish
-        uses: jitterbit/await-check-suites@292a541bb7618078395b2ce711a0d89cfb8a568a # v1
-        with:
-          ref: ${{ env.TAG_BRANCH }}
-          intervalSeconds: 60
-          timeoutSeconds: 3600
-
-      - name: Setup YQ
-        uses: chrisdickinson/setup-yq@fa3192edd79d6eb0e4e12de8dde3a0c26f2b853b # latest
-        with:
-          yq-version: v4.9.8
-
-      - name: Checkout Repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ env.TAG_BRANCH }}
-
-      - name: Setup EnvVars
-        run: |-
-          CURRENT_VERSION=$(yq e '.version' build.yaml)
-          CURRENT_MAJOR_MINOR=${CURRENT_VERSION%.*}
-          CURRENT_PATCH=${CURRENT_VERSION##*.}
-          echo "CURRENT_VERSION=${CURRENT_VERSION}" >> $GITHUB_ENV
-          echo "CURRENT_MAJOR_MINOR=${CURRENT_MAJOR_MINOR}" >> $GITHUB_ENV
-          echo "CURRENT_PATCH=${CURRENT_PATCH}" >> $GITHUB_ENV
-          echo "NEXT_VERSION=${CURRENT_MAJOR_MINOR}.$(($CURRENT_PATCH + 1))" >> $GITHUB_ENV
-
-      - name: Run bump_version
-        run: ./bump_version ${{ env.NEXT_VERSION }}
-
-      - name: Commit Changes
-        run: |-
-          git config user.name "jellyfin-bot"
-          git config user.email "team@jellyfin.org"
-          git checkout ${{ env.TAG_BRANCH }}
-          git commit -am "Bump version to ${{ env.NEXT_VERSION }}"
-          git push origin ${{ env.TAG_BRANCH }}
-
-  manual_bump_version:
-    runs-on: ubuntu-latest
-    if: ${{ github.event_name == 'workflow_dispatch' }}
-    env:
-      TAG_BRANCH: ${{ github.event.inputs.TAG_BRANCH }}
-      NEXT_VERSION: ${{ github.event.inputs.NEXT_VERSION }}
-    steps:
-      - name: Checkout Repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ env.TAG_BRANCH }}
-
-      - name: Run bump_version
-        run: ./bump_version ${{ env.NEXT_VERSION }}
-
-      - name: Commit Changes
-        run: |-
-          git config user.name "jellyfin-bot"
-          git config user.email "team@jellyfin.org"
-          git checkout ${{ env.TAG_BRANCH }}
-          git commit -am "Bump version to ${{ env.NEXT_VERSION }}"
-          git push origin ${{ env.TAG_BRANCH }}
@@ -0,0 +1,84 @@
+when:
+  - event: pull_request
+  - event: push
+
+steps:
+  # Restore, build and test in one step so the NuGet cache stays on the step's
+  # own ephemeral storage instead of the 10Gi workspace volume.
+  # global.json pins the .NET 10 SDK (10.0.0, rollForward latestMinor).
+  - name: build-test
+    image: mcr.microsoft.com/dotnet/sdk:10.0
+    environment:
+      DOTNET_CLI_TELEMETRY_OPTOUT: "1"
+      DOTNET_NOLOGO: "1"
+    commands:
+      - dotnet --info
+      - dotnet restore Jellyfin.sln
+      - dotnet build Jellyfin.sln -c Release --no-restore
+      # libSkiaSharp needs fontconfig to load and the SDK image does not ship it.
+      # The mirror occasionally serves a half-synced index, so update is retried.
+      - apt-get -o Acquire::Retries=3 update || apt-get -o Acquire::Retries=3 update
+      - apt-get install -y --no-install-recommends libfontconfig1
+      - ldconfig -p | grep -q libfontconfig
+      # BackupServiceTests is excluded because BackupService refuses to write a
+      # backup with less than 5GiB free on its target path. The clone and build
+      # output fill 5.7G of the 9.8G workspace volume, leaving 4.1G. Raising the
+      # agent's workspace volume size is the only way to run it here.
+      - df -h .
+      - dotnet test Jellyfin.sln -c Release --no-build --verbosity minimal --filter "Category!=RequiresDocker&FullyQualifiedName!~Integration&FullyQualifiedName!~BackupServiceTests"
+    backend_options:
+      kubernetes:
+        serviceAccountName: jellyfin-ha-src
+        resources:
+          requests:
+            memory: 2Gi
+            cpu: 2
+            ephemeral-storage: 10Gi
+          limits:
+            memory: 8Gi
+            cpu: 4
+            ephemeral-storage: 20Gi
+
+  # The PostgreSQL migration tests are the only ones that run the startup migration chain against
+  # the provider production uses, and the filter above has always skipped them.
+  # The server runs inside this step: the kubernetes backend has no docker daemon for
+  # testcontainers, and a postgres service container deadlocks the step because the backend mounts
+  # the ReadWriteOnce workspace volume into service pods and schedules them on another node.
+  # Its data directory lives on the step's ephemeral storage, not on the workspace volume.
+  # Both projects attach to it through JELLYFIN_TEST_POSTGRES and give every test a database of
+  # its own, so nothing here depends on a docker daemon.
+  # Valkey runs in the step for the same reason, reached through JELLYFIN_TEST_REDIS.
+  - name: postgres-migration-chain
+    image: mcr.microsoft.com/dotnet/sdk:10.0
+    depends_on:
+      - build-test
+    environment:
+      DOTNET_CLI_TELEMETRY_OPTOUT: "1"
+      DOTNET_NOLOGO: "1"
+      JELLYFIN_TEST_POSTGRES: "Host=127.0.0.1;Port=5432;Database=postgres;Username=postgres"
+      JELLYFIN_TEST_REDIS: "127.0.0.1:6379"
+    commands:
+      - apt-get -o Acquire::Retries=3 update || apt-get -o Acquire::Retries=3 update
+      - DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends postgresql valkey-server
+      - install -d -o postgres -g postgres /tmp/pgdata /tmp/pgrun
+      - PGBIN=$(ls -d /usr/lib/postgresql/*/bin | tail -1)
+      - su postgres -c "$PGBIN/initdb -D /tmp/pgdata -A trust -U postgres"
+      - su postgres -c "$PGBIN/pg_ctl -D /tmp/pgdata -o \"-c listen_addresses=127.0.0.1 -k /tmp/pgrun\" -l /tmp/pg.log -w start"
+      - valkey-server --daemonize yes --bind 127.0.0.1 --port 6379 --save ""
+      - for i in $(seq 30); do valkey-cli -h 127.0.0.1 ping && break; sleep 1; done
+      - dotnet build tests/Jellyfin.Server.Tests/Jellyfin.Server.Tests.csproj -c Release
+      - dotnet build tests/Jellyfin.Database.Tests.PostgreSQL/Jellyfin.Database.Tests.PostgreSQL.csproj -c Release
+      - dotnet test tests/Jellyfin.Server.Tests/Jellyfin.Server.Tests.csproj -c Release --no-build --verbosity minimal --filter "Category=RequiresDocker"
+      - dotnet test tests/Jellyfin.Database.Tests.PostgreSQL/Jellyfin.Database.Tests.PostgreSQL.csproj -c Release --no-build --verbosity minimal --filter "Category=RequiresDocker"
+    backend_options:
+      kubernetes:
+        serviceAccountName: jellyfin-ha-src
+        resources:
+          requests:
+            memory: 2Gi
+            cpu: 2
+            ephemeral-storage: 6Gi
+          limits:
+            memory: 6Gi
+            cpu: 4
+            ephemeral-storage: 12Gi
@@ -8,6 +8,7 @@
    <PackageVersion Include="AutoFixture.AutoMoq" Version="4.18.1" />
    <PackageVersion Include="AutoFixture.Xunit3" Version="4.19.0" />
    <PackageVersion Include="AutoFixture" Version="4.18.1" />
+    <PackageVersion Include="AWSSDK.S3" Version="4.0.103.1" />
    <PackageVersion Include="BDInfo" Version="0.8.0" />
    <PackageVersion Include="BitFaster.Caching" Version="2.6.1" />
    <PackageVersion Include="BlurHashSharp.SkiaSharp" Version="1.4.0-pre.1" />
@@ -46,6 +47,7 @@
    <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.11" />
    <PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.11" />
    <PackageVersion Include="Microsoft.Extensions.Logging" Version="10.0.11" />
+    <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.11" />
    <PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.11" />
    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.9.0" />
    <PackageVersion Include="MimeTypes" Version="2.5.2" />
@@ -53,6 +55,8 @@
    <PackageVersion Include="Moq" Version="4.18.4" />
    <PackageVersion Include="NEbml" Version="1.1.0.5" />
    <PackageVersion Include="Newtonsoft.Json" Version="13.0.4" />
+    <PackageVersion Include="Npgsql" Version="10.0.3" />
+    <PackageVersion Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.3" />
    <PackageVersion Include="PDFtoImage" Version="5.2.1" />
    <PackageVersion Include="PlaylistsNET" Version="1.4.1" />
    <PackageVersion Include="prometheus-net.AspNetCore" Version="8.2.1" />
@@ -74,12 +78,15 @@
    <PackageVersion Include="SkiaSharp.HarfBuzz" Version="3.119.4" />
    <PackageVersion Include="SkiaSharp.NativeAssets.Linux" Version="3.119.4" />
    <PackageVersion Include="SmartAnalyzers.MultithreadingAnalyzer" Version="1.1.31" />
+    <PackageVersion Include="StackExchange.Redis" Version="2.13.17" />
    <PackageVersion Include="StyleCop.Analyzers" Version="1.2.0-beta.556" />
    <PackageVersion Include="Svg.Skia" Version="3.7.0" />
    <PackageVersion Include="Swashbuckle.AspNetCore.ReDoc" Version="10.2.3" />
    <PackageVersion Include="Swashbuckle.AspNetCore" Version="10.2.3" />
    <PackageVersion Include="System.Text.Json" Version="10.0.11" />
    <PackageVersion Include="TagLibSharp" Version="2.3.0" />
+    <PackageVersion Include="Testcontainers.PostgreSql" Version="4.15.0" />
+    <PackageVersion Include="Testcontainers.Redis" Version="4.15.0" />
    <PackageVersion Include="z440.atl.core" Version="7.16.0" />
    <PackageVersion Include="TMDbLib" Version="3.0.0" />
    <PackageVersion Include="UTF.Unknown" Version="2.7.0" />
@@ -0,0 +1,96 @@
+# syntax=docker/dockerfile:1
+
+# ── Build stage ──────────────────────────────────────────────────────────────
+FROM --platform=linux/amd64 mcr.microsoft.com/dotnet/sdk:10.0 AS build
+
+WORKDIR /src
+
+# Restore dependencies first (layer-cache friendly)
+COPY ["Jellyfin.sln", "global.json", "nuget.config", "Directory.Build.props", "Directory.Packages.props", "./"]
+COPY ["SharedVersion.cs", "BannedSymbols.txt", "stylecop.json", "./"]
+
+# Copy all project files so dotnet restore can resolve the full dependency graph
+COPY Emby.Naming/                                   Emby.Naming/
+COPY Emby.Photos/                                   Emby.Photos/
+COPY Emby.Server.Implementations/                  Emby.Server.Implementations/
+COPY Jellyfin.Api/                                  Jellyfin.Api/
+COPY Jellyfin.Data/                                 Jellyfin.Data/
+COPY Jellyfin.Server/                               Jellyfin.Server/
+COPY Jellyfin.Server.Implementations/              Jellyfin.Server.Implementations/
+COPY MediaBrowser.Common/                           MediaBrowser.Common/
+COPY MediaBrowser.Controller/                       MediaBrowser.Controller/
+COPY MediaBrowser.LocalMetadata/                    MediaBrowser.LocalMetadata/
+COPY MediaBrowser.MediaEncoding/                    MediaBrowser.MediaEncoding/
+COPY MediaBrowser.Model/                            MediaBrowser.Model/
+COPY MediaBrowser.Providers/                        MediaBrowser.Providers/
+COPY MediaBrowser.XbmcMetadata/                    MediaBrowser.XbmcMetadata/
+COPY src/                                           src/
+
+RUN dotnet restore Jellyfin.Server/Jellyfin.Server.csproj \
+      --runtime linux-x64
+
+# Publish the server (and all transitive dependencies, including the
+# PostgreSQL provider assembly added by this fork).
+# Note: TreatWarningsAsErrors is disabled for the Docker build — StyleCop
+# analyzer violations in upstream src/ projects would otherwise block the
+# image build. StyleCop is enforced in the CI pipeline, not the Dockerfile.
+RUN dotnet publish Jellyfin.Server/Jellyfin.Server.csproj \
+      --configuration Release \
+      --runtime linux-x64 \
+      --self-contained false \
+      --no-restore \
+      -p:TreatWarningsAsErrors=false \
+      --output /app
+
+# ── Web client stage ──────────────────────────────────────────────────────────
+# Install jellyfin-web via the official Jellyfin apt repo.
+# Package suffix in the bookworm repo is +deb12 (e.g. 12.0+deb12).
+# Web assets land at /usr/share/jellyfin/web/ — stable, prebuilt, no npm required.
+# The web client version must match the server version this fork is based on.
+FROM --platform=linux/amd64 debian:bookworm-slim AS webclient
+
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends curl gnupg ca-certificates \
+ && curl -fsSL https://repo.jellyfin.org/jellyfin_team.gpg.key \
+    | gpg --dearmor -o /usr/share/keyrings/jellyfin.gpg \
+ && echo "deb [arch=amd64 signed-by=/usr/share/keyrings/jellyfin.gpg] https://repo.jellyfin.org/debian bookworm main" \
+    > /etc/apt/sources.list.d/jellyfin.list \
+ && apt-get update \
+ && apt-get install -y --no-install-recommends "jellyfin-web=12.0+deb12" \
+ && rm -rf /var/lib/apt/lists/* \
+ && echo "Web client files:" && ls /usr/share/jellyfin/web/ | head -10
+
+# ── Runtime stage ─────────────────────────────────────────────────────────────
+FROM --platform=linux/amd64 mcr.microsoft.com/dotnet/aspnet:10.0
+
+# Install FFmpeg and native dependencies required by SkiaSharp and fontconfig.
+# libicu, libssl, and liblttng-ust are already present in the dotnet/aspnet base image.
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+      ffmpeg \
+      fontconfig \
+      libfontconfig1 \
+      libfreetype6 \
+ && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /jellyfin
+
+COPY --from=build /app .
+COPY --from=webclient /usr/share/jellyfin/web ./jellyfin-web/
+
+# Jellyfin default ports
+EXPOSE 8096
+EXPOSE 8920
+
+# Data / config volumes
+VOLUME ["/config", "/cache", "/media"]
+
+ENV JELLYFIN_DATA_DIR=/config \
+    JELLYFIN_CACHE_DIR=/cache \
+    JELLYFIN_LOG_DIR=/config/log \
+    JELLYFIN_CONFIG_DIR=/config
+
+ENTRYPOINT ["./jellyfin", \
+            "--datadir", "/config", \
+            "--cachedir", "/cache", \
+            "--webdir", "/jellyfin/jellyfin-web"]
@@ -0,0 +1,55 @@
+# syntax=docker/dockerfile:1
+# Runtime-only image — the .NET publish step runs on the CI host (runner),
+# not inside this Dockerfile.
+
+# ── Web client stage ──────────────────────────────────────────────────────────
+# Install jellyfin-web via the official Jellyfin apt repo.
+# Package suffix in the bookworm repo is +deb12 (e.g. 12.0+deb12).
+# Web assets land at /usr/share/jellyfin/web/ — stable, prebuilt, no npm required.
+# The web client version must match the server version this fork is based on.
+FROM --platform=linux/amd64 debian:bookworm-slim AS webclient
+
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends curl gnupg ca-certificates \
+ && curl -fsSL https://repo.jellyfin.org/jellyfin_team.gpg.key \
+    | gpg --dearmor -o /usr/share/keyrings/jellyfin.gpg \
+ && echo "deb [arch=amd64 signed-by=/usr/share/keyrings/jellyfin.gpg] https://repo.jellyfin.org/debian bookworm main" \
+    > /etc/apt/sources.list.d/jellyfin.list \
+ && apt-get update \
+ && apt-get install -y --no-install-recommends "jellyfin-web=12.0+deb12" \
+ && rm -rf /var/lib/apt/lists/*
+
+# ── Runtime stage ─────────────────────────────────────────────────────────────
+FROM --platform=linux/amd64 mcr.microsoft.com/dotnet/aspnet:10.0
+
+# Install FFmpeg and native dependencies required by SkiaSharp and fontconfig.
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+      ffmpeg \
+      fontconfig \
+      libfontconfig1 \
+      libfreetype6 \
+ && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /jellyfin
+
+# Copy the pre-built publish output produced by `dotnet publish` on the CI host.
+COPY publish-output/ .
+# Copy the jellyfin-web client assets from the webclient stage.
+COPY --from=webclient /usr/share/jellyfin/web ./jellyfin-web/
+
+# Jellyfin default ports
+EXPOSE 8096
+EXPOSE 8920
+
+# Data / config volumes
+VOLUME ["/config", "/cache", "/media"]
+
+ENV JELLYFIN_DATA_DIR=/config \
+    JELLYFIN_CACHE_DIR=/cache \
+    JELLYFIN_LOG_DIR=/config/log
+
+ENTRYPOINT ["./jellyfin", \
+            "--datadir", "/config", \
+            "--cachedir", "/cache", \
+            "--webdir", "/jellyfin/jellyfin-web"]
@@ -87,6 +87,12 @@ namespace Emby.Server.Implementations.AppBase
        /// <value>The application paths.</value>
        public IApplicationPaths CommonApplicationPaths { get; private set; }

+        /// <summary>
+        /// Gets or sets the bus announcing configuration writes to the other instances sharing this
+        /// configuration directory. Defaults to a no-op, which is the single-instance behaviour.
+        /// </summary>
+        public IConfigurationInvalidationBus InvalidationBus { get; set; } = NullConfigurationInvalidationBus.Instance;
+
        /// <summary>
        /// Gets or sets the system configuration.
        /// </summary>
@@ -169,6 +175,8 @@ namespace Emby.Server.Implementations.AppBase
            }

            OnConfigurationUpdated();
+
+            InvalidationBus.PublishLocalWrite(ConfigurationInvalidationScope.SystemConfiguration, null);
        }

        /// <summary>
@@ -350,6 +358,29 @@ namespace Emby.Server.Implementations.AppBase
            }

            OnNamedConfigurationUpdated(key, configuration);
+
+            InvalidationBus.PublishLocalWrite(ConfigurationInvalidationScope.NamedConfiguration, key);
+        }
+
+        /// <inheritdoc />
+        public void InvalidateCachedConfiguration(string? key)
+        {
+            if (string.IsNullOrEmpty(key))
+            {
+                lock (_configurationSyncLock)
+                {
+                    _configuration = null;
+                }
+
+                // Reloads the system configuration off the shared file as a side effect of re-deriving
+                // the cache path from it, then tells the in-process consumers to re-read it.
+                OnConfigurationUpdated();
+                return;
+            }
+
+            _configurations.TryRemove(key, out _);
+
+            OnNamedConfigurationUpdated(key, GetConfiguration(key));
        }

        /// <summary>
@@ -706,6 +706,8 @@ namespace Emby.Server.Implementations
            BaseItem.UserDataManager = Resolve<IUserDataManager>();
            CollectionFolder.XmlSerializer = _xmlSerializer;
            CollectionFolder.ApplicationHost = this;
+            CollectionFolder.InvalidationBus = Resolve<IConfigurationInvalidationBus>();
+            ConfigurationManager.InvalidationBus = CollectionFolder.InvalidationBus;
            Folder.UserViewManager = Resolve<IUserViewManager>();
            Folder.CollectionManager = Resolve<ICollectionManager>();
            Folder.LimitedConcurrencyLibraryScheduler = Resolve<ILimitedConcurrencyLibraryScheduler>();
@@ -790,6 +792,43 @@ namespace Emby.Server.Implementations
            }
        }

+        /// <summary>
+        /// Works out what a configuration update means for the ports this process bound at startup.
+        /// </summary>
+        /// <param name="boundHttpPort">The HTTP port this process is bound to.</param>
+        /// <param name="boundHttpsPort">The HTTPS port this process is bound to.</param>
+        /// <param name="configuredHttpPort">The HTTP port the shared configuration now carries.</param>
+        /// <param name="configuredHttpsPort">The HTTPS port the shared configuration now carries.</param>
+        /// <param name="isPortAuthorized">Whether the shared configuration still marks the port as authorized.</param>
+        /// <param name="isApplyingRemoteInvalidation">Whether this update is another instance's write being applied.</param>
+        /// <returns>What the update requires of this instance.</returns>
+        internal static PortChangeOutcome EvaluatePortChange(
+            int boundHttpPort,
+            int boundHttpsPort,
+            int configuredHttpPort,
+            int configuredHttpsPort,
+            bool isPortAuthorized,
+            bool isApplyingRemoteInvalidation)
+        {
+            // Nothing is bound yet, so nothing has gone stale.
+            if (boundHttpPort == 0 || boundHttpsPort == 0)
+            {
+                return default;
+            }
+
+            if (configuredHttpPort == boundHttpPort && configuredHttpsPort == boundHttpsPort)
+            {
+                return default;
+            }
+
+            // Whoever wrote the change, this process is still listening on a port the configuration no
+            // longer names, so the pending restart is reported either way. The authorization flag belongs
+            // to the instance that made the change: it cleared the flag along with the port, and clearing
+            // it again here would write shared configuration on that instance's behalf and announce it a
+            // second time.
+            return new PortChangeOutcome(true, isPortAuthorized && !isApplyingRemoteInvalidation);
+        }
+
        /// <summary>
        /// Called when [configuration updated].
        /// </summary>
@@ -797,26 +836,24 @@ namespace Emby.Server.Implementations
        /// <param name="e">The <see cref="EventArgs"/> instance containing the event data.</param>
        private void OnConfigurationUpdated(object sender, EventArgs e)
        {
-            var requiresRestart = false;
            var networkConfiguration = ConfigurationManager.GetNetworkConfiguration();

-            // Don't do anything if these haven't been set yet
-            if (HttpPort != 0 && HttpsPort != 0)
-            {
-                // Need to restart if ports have changed
-                if (networkConfiguration.InternalHttpPort != HttpPort
-                    || networkConfiguration.InternalHttpsPort != HttpsPort)
-                {
-                    if (ConfigurationManager.Configuration.IsPortAuthorized)
-                    {
-                        ConfigurationManager.Configuration.IsPortAuthorized = false;
-                        ConfigurationManager.SaveConfiguration();
+            var portChange = EvaluatePortChange(
+                HttpPort,
+                HttpsPort,
+                networkConfiguration.InternalHttpPort,
+                networkConfiguration.InternalHttpsPort,
+                ConfigurationManager.Configuration.IsPortAuthorized,
+                ConfigurationInvalidationContext.IsApplyingRemoteInvalidation);

-                        requiresRestart = true;
-                    }
-                }
+            if (portChange.ClearsPortAuthorization)
+            {
+                ConfigurationManager.Configuration.IsPortAuthorized = false;
+                ConfigurationManager.SaveConfiguration();
            }

+            var requiresRestart = portChange.RequiresRestart;
+
            if (ValidateSslCertificate(networkConfiguration))
            {
                requiresRestart = true;
@@ -0,0 +1,82 @@
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using MediaBrowser.Common.Configuration;
+using MediaBrowser.Controller.Entities;
+using Microsoft.Extensions.Hosting;
+using Microsoft.Extensions.Logging;
+
+namespace Emby.Server.Implementations.Configuration
+{
+    /// <summary>
+    /// Applies the configuration invalidations published by the other instances sharing this
+    /// configuration directory, dropping the local cache entry so the next read comes off the shared file.
+    /// </summary>
+    public sealed class ConfigurationInvalidationSubscriber : IHostedService
+    {
+        private readonly IConfigurationInvalidationBus _bus;
+        private readonly IConfigurationManager _configurationManager;
+        private readonly ILogger<ConfigurationInvalidationSubscriber> _logger;
+
+        /// <summary>
+        /// Initializes a new instance of the <see cref="ConfigurationInvalidationSubscriber"/> class.
+        /// </summary>
+        /// <param name="bus">The invalidation bus.</param>
+        /// <param name="configurationManager">The configuration manager holding the cached configuration.</param>
+        /// <param name="logger">The logger.</param>
+        public ConfigurationInvalidationSubscriber(
+            IConfigurationInvalidationBus bus,
+            IConfigurationManager configurationManager,
+            ILogger<ConfigurationInvalidationSubscriber> logger)
+        {
+            _bus = bus;
+            _configurationManager = configurationManager;
+            _logger = logger;
+        }
+
+        /// <inheritdoc />
+        public Task StartAsync(CancellationToken cancellationToken)
+        {
+            _bus.Subscribe(Apply);
+            return Task.CompletedTask;
+        }
+
+        /// <inheritdoc />
+        public Task StopAsync(CancellationToken cancellationToken) => Task.CompletedTask;
+
+        private void Apply(ConfigurationInvalidation invalidation)
+        {
+            try
+            {
+                // Applying re-raises the same update events a local save raises, so the in-process
+                // consumers re-read. The scope tells those consumers that the write was somebody else's,
+                // so the ones that answer an update by writing neither repeat it nor publish it back.
+                using var scope = ConfigurationInvalidationContext.BeginApply();
+
+                switch (invalidation.Scope)
+                {
+                    case ConfigurationInvalidationScope.SystemConfiguration:
+                        _configurationManager.InvalidateCachedConfiguration(null);
+                        break;
+                    case ConfigurationInvalidationScope.NamedConfiguration when !string.IsNullOrEmpty(invalidation.Target):
+                        _configurationManager.InvalidateCachedConfiguration(invalidation.Target);
+                        break;
+                    case ConfigurationInvalidationScope.LibraryOptions when !string.IsNullOrEmpty(invalidation.Target):
+                        CollectionFolder.InvalidateLibraryOptions(invalidation.Target);
+                        break;
+                    case ConfigurationInvalidationScope.AllLibraryOptions:
+                        CollectionFolder.InvalidateAllLibraryOptions();
+                        break;
+                    default:
+                        return;
+                }
+
+                _logger.LogDebug("Applied {Scope} invalidation for {Target} from {OriginId}.", invalidation.Scope, invalidation.Target, invalidation.OriginId);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogWarning(ex, "Failed to apply a {Scope} invalidation for {Target}.", invalidation.Scope, invalidation.Target);
+            }
+        }
+    }
+}
@@ -0,0 +1,96 @@
+using System;
+using System.Text.Json;
+using Jellyfin.Extensions.Json;
+using MediaBrowser.Common.Configuration;
+using Microsoft.Extensions.Logging;
+using StackExchange.Redis;
+
+namespace Emby.Server.Implementations.Configuration
+{
+    /// <summary>
+    /// A Redis pub/sub <see cref="IConfigurationInvalidationBus"/>. Notices are broadcast on one channel
+    /// and every instance but the publisher applies them.
+    /// </summary>
+    public sealed class RedisConfigurationInvalidationBus : IConfigurationInvalidationBus
+    {
+        private const string ChannelName = "jellyfin:configinvalidation";
+
+        private static readonly JsonSerializerOptions _jsonOptions = JsonDefaults.Options;
+
+        private readonly ISubscriber _subscriber;
+        private readonly ILogger<RedisConfigurationInvalidationBus> _logger;
+        private readonly string _originId;
+
+        /// <summary>
+        /// Initializes a new instance of the <see cref="RedisConfigurationInvalidationBus"/> class.
+        /// </summary>
+        /// <param name="redis">The Redis connection multiplexer.</param>
+        /// <param name="logger">The logger.</param>
+        public RedisConfigurationInvalidationBus(IConnectionMultiplexer redis, ILogger<RedisConfigurationInvalidationBus> logger)
+        {
+            ArgumentNullException.ThrowIfNull(redis);
+
+            _subscriber = redis.GetSubscriber();
+            _logger = logger;
+            _originId = Environment.GetEnvironmentVariable("JELLYFIN_INSTANCE_ID") ?? Environment.MachineName;
+        }
+
+        /// <inheritdoc />
+        public void Publish(ConfigurationInvalidationScope scope, string? target)
+        {
+            var invalidation = new ConfigurationInvalidation
+            {
+                Scope = scope,
+                Target = target,
+                OriginId = _originId
+            };
+
+            try
+            {
+                // Fire and forget: an admin saving configuration must never wait on, or fail because of,
+                // the bus. The write has already reached the shared directory by this point.
+                _subscriber.Publish(
+                    RedisChannel.Literal(ChannelName),
+                    JsonSerializer.Serialize(invalidation, _jsonOptions),
+                    CommandFlags.FireAndForget);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogWarning(ex, "Failed to publish {Scope} invalidation for {Target}; other instances keep their cached copy until they restart.", scope, target);
+            }
+        }
+
+        /// <inheritdoc />
+        public void Subscribe(Action<ConfigurationInvalidation> handler)
+        {
+            ArgumentNullException.ThrowIfNull(handler);
+
+            try
+            {
+                _subscriber.Subscribe(RedisChannel.Literal(ChannelName), (_, value) => Dispatch(handler, value));
+            }
+            catch (Exception ex)
+            {
+                _logger.LogWarning(ex, "Failed to subscribe to configuration invalidations; this instance keeps its cached configuration until it restarts.");
+            }
+        }
+
+        private void Dispatch(Action<ConfigurationInvalidation> handler, RedisValue value)
+        {
+            try
+            {
+                var invalidation = JsonSerializer.Deserialize<ConfigurationInvalidation>(value.ToString(), _jsonOptions);
+                if (invalidation is null || string.Equals(invalidation.OriginId, _originId, StringComparison.Ordinal))
+                {
+                    return;
+                }
+
+                handler(invalidation);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogWarning(ex, "Failed to apply a configuration invalidation.");
+            }
+        }
+    }
+}
@@ -65,6 +65,7 @@

  <ItemGroup>
    <PackageReference Include="Ignore" />
+    <PackageReference Include="StackExchange.Redis" />
  </ItemGroup>

  <ItemGroup>
@@ -2332,7 +2332,10 @@ namespace Emby.Server.Implementations.Library
        {
            IOrderedEnumerable<BaseItem>? orderedItems = null;

-            foreach (var orderBy in sortBy.Select(o => GetComparer(o, user)).Where(c => c is not null))
+            var comparers = sortBy.Select(o => GetComparer(o, user)).Where(c => c is not null).ToList();
+            items = PrefetchUserData(items, user, comparers);
+
+            foreach (var orderBy in comparers)
            {
                if (orderBy is RandomComparer)
                {
@@ -2364,14 +2367,14 @@ namespace Emby.Server.Implementations.Library
        {
            IOrderedEnumerable<BaseItem>? orderedItems = null;

-            foreach (var (name, sortOrder) in orderBy)
-            {
-                var comparer = GetComparer(name, user);
-                if (comparer is null)
-                {
-                    continue;
-                }
+            var comparers = orderBy
+                .Select(o => (Comparer: GetComparer(o.OrderBy, user), o.SortOrder))
+                .Where(c => c.Comparer is not null)
+                .ToList();
+            items = PrefetchUserData(items, user, comparers.Select(c => c.Comparer).ToList());

+            foreach (var (comparer, sortOrder) in comparers)
+            {
                if (comparer is RandomComparer)
                {
                    var randomItems = items.ToArray();
@@ -2397,6 +2400,31 @@ namespace Emby.Server.Implementations.Library
            return orderedItems ?? items;
        }

+        // The user comparers read user data per item, so without one batched read up front an
+        // in-memory sort would issue a database round trip per comparison.
+        private IEnumerable<BaseItem> PrefetchUserData(IEnumerable<BaseItem> items, User? user, IReadOnlyList<IBaseItemComparer?> comparers)
+        {
+            if (user is null)
+            {
+                return items;
+            }
+
+            var userComparers = comparers.OfType<IUserBaseItemComparer>().ToList();
+            if (userComparers.Count == 0)
+            {
+                return items;
+            }
+
+            var itemList = items as IReadOnlyList<BaseItem> ?? items.ToList();
+            var userData = _userDataManager.GetUserDataBatch(itemList, user);
+            foreach (var comparer in userComparers)
+            {
+                comparer.PrefetchedUserData = userData;
+            }
+
+            return itemList;
+        }
+
        /// <summary>
        /// Gets the comparer.
        /// </summary>
@@ -2,10 +2,8 @@

 using System;
 using System.Collections.Generic;
-using System.Globalization;
 using System.Linq;
 using System.Threading;
-using BitFaster.Caching.Lru;
 using Jellyfin.Database.Implementations;
 using Jellyfin.Database.Implementations.Entities;
 using MediaBrowser.Controller.Configuration;
@@ -27,7 +25,6 @@ namespace Emby.Server.Implementations.Library
    {
        private readonly IServerConfigurationManager _config;
        private readonly IDbContextFactory<JellyfinDbContext> _repository;
-        private readonly FastConcurrentLru<string, UserItemData> _cache;

        /// <summary>
        /// Initializes a new instance of the <see cref="UserDataManager"/> class.
@@ -40,7 +37,6 @@ namespace Emby.Server.Implementations.Library
        {
            _config = config;
            _repository = repository;
-            _cache = new FastConcurrentLru<string, UserItemData>(Environment.ProcessorCount, _config.Configuration.CacheSize, StringComparer.OrdinalIgnoreCase);
        }

        /// <inheritdoc />
@@ -77,11 +73,6 @@ namespace Emby.Server.Implementations.Library
            dbContext.SaveChanges();
            transaction.Commit();

-            var userId = user.InternalId;
-            var cacheKey = GetCacheKey(userId, item.Id);
-            _cache.AddOrUpdate(cacheKey, userData);
-            item.UserData = dbContext.UserData.Where(e => e.ItemId == item.Id).AsNoTracking().ToArray(); // rehydrate the cached userdata
-
            UserDataSaved?.Invoke(this, new UserDataSaveEventArgs
            {
                Keys = keys,
@@ -180,64 +171,41 @@ namespace Emby.Server.Implementations.Library
        /// <inheritdoc />
        public Dictionary<Guid, UserItemData> GetUserDataBatch(IReadOnlyList<BaseItem> items, User user)
        {
+            ArgumentNullException.ThrowIfNull(items);
+            ArgumentNullException.ThrowIfNull(user);
+
            var result = new Dictionary<Guid, UserItemData>(items.Count);
-            var itemsNeedingQuery = new List<(BaseItem Item, List<string> Keys)>();
-
-            foreach (var item in items)
-            {
-                var cacheKey = GetCacheKey(user.InternalId, item.Id);
-                if (_cache.TryGet(cacheKey, out var cachedData))
-                {
-                    result[item.Id] = cachedData;
-                }
-                else
-                {
-                    var userDataRow = ResolveUserDataRow(item, item.UserData?.Where(e => e.UserId.Equals(user.Id)));
-                    var userData = userDataRow is not null ? Map(userDataRow) : null;
-                    if (userData is not null)
-                    {
-                        result[item.Id] = userData;
-                        _cache.AddOrUpdate(cacheKey, userData);
-                    }
-                    else
-                    {
-                        var keys = item.GetUserDataKeys();
-                        itemsNeedingQuery.Add((item, keys));
-                    }
-                }
-            }
-
-            if (itemsNeedingQuery.Count == 0)
+            if (items.Count == 0)
            {
                return result;
            }

-            // Build a single query for all missing items. Fetch rows by item alone so rows kept
-            // under keys from older metadata resolve the same way as the in-memory path.
-            var allItemIds = itemsNeedingQuery.Select(x => x.Item.Id).ToList();
+            // Fetch rows by item alone so rows kept under keys from older metadata resolve the same
+            // way as the single item path.
+            var itemIds = items.Select(e => e.Id).Distinct().ToList();
            using var context = _repository.CreateDbContext();
-            var userDataArray = context.UserData
+            var userDataByItem = context.UserData
                .AsNoTracking()
                .Where(e => e.UserId.Equals(user.Id))
-                .WhereOneOrMany(allItemIds, e => e.ItemId)
-                .ToArray();
+                .WhereOneOrMany(itemIds, e => e.ItemId)
+                .ToArray()
+                .GroupBy(e => e.ItemId)
+                .ToDictionary(g => g.Key, g => g.ToArray());

-            var userDataByItem = userDataArray.GroupBy(e => e.ItemId).ToDictionary(g => g.Key, g => g.ToArray());
-            foreach (var (item, keys) in itemsNeedingQuery)
+            foreach (var item in items)
            {
-                UserItemData userData;
-                if (userDataByItem.TryGetValue(item.Id, out var itemUserData) && itemUserData.Length > 0)
+                if (result.ContainsKey(item.Id))
                {
-                    userData = Map(ResolveUserDataRow(item, itemUserData)!);
-                }
-                else
-                {
-                    userData = new UserItemData { Key = keys.Count > 0 ? keys[0] : string.Empty };
+                    continue;
                }

-                result[item.Id] = userData;
-                var cacheKey = GetCacheKey(user.InternalId, item.Id);
-                _cache.AddOrUpdate(cacheKey, userData);
+                var row = userDataByItem.TryGetValue(item.Id, out var itemUserData)
+                    ? ResolveUserDataRow(item, itemUserData)
+                    : null;
+
+                result[item.Id] = row is not null
+                    ? Map(row)
+                    : new UserItemData { Key = item.GetUserDataKeys().FirstOrDefault() ?? string.Empty };
            }

            return result;
@@ -340,20 +308,19 @@ namespace Emby.Server.Implementations.Library
            return result;
        }

-        /// <summary>
-        /// Gets the internal key.
-        /// </summary>
-        /// <returns>System.String.</returns>
-        private static string GetCacheKey(long internalUserId, Guid itemId)
-        {
-            return internalUserId.ToString(CultureInfo.InvariantCulture) + "-" + itemId.ToString("N", CultureInfo.InvariantCulture);
-        }
-
        /// <inheritdoc />
        public UserItemData? GetUserData(User user, BaseItem item)
        {
            ArgumentNullException.ThrowIfNull(user);
-            var row = ResolveUserDataRow(item, item.UserData?.Where(e => e.UserId.Equals(user.Id)));
+            ArgumentNullException.ThrowIfNull(item);
+
+            using var dbContext = _repository.CreateDbContext();
+            var rows = dbContext.UserData
+                .AsNoTracking()
+                .Where(e => e.ItemId == item.Id && e.UserId == user.Id)
+                .ToArray();
+
+            var row = ResolveUserDataRow(item, rows);
            return row is not null ? Map(row) : new UserItemData()
            {
                Key = item.GetUserDataKeys()[0],
@@ -536,16 +503,6 @@ namespace Emby.Server.Implementations.Library
            }

            dbContext.SaveChanges();
-
-            var cacheKey = GetCacheKey(user.InternalId, item.Id);
-            if (_cache.TryGet(cacheKey, out var cached))
-            {
-                cached.AudioStreamIndex = null;
-                cached.SubtitleStreamIndex = null;
-                _cache.AddOrUpdate(cacheKey, cached);
-            }
-
-            item.UserData = dbContext.UserData.Where(e => e.ItemId == item.Id).AsNoTracking().ToArray();
        }
    }
 }
@@ -0,0 +1,235 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using System.Threading;
+using System.Threading.Tasks;
+using MediaBrowser.Controller.MediaEncoding;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+using StackExchange.Redis;
+
+namespace Emby.Server.Implementations.MediaEncoding;
+
+/// <summary>
+/// A Redis-backed implementation of <see cref="ITranscodeSessionStore"/> that provides
+/// durable, distributed session tracking with lease-based ownership between pods.
+/// </summary>
+public sealed class RedisTranscodeSessionStore : ITranscodeSessionStore
+{
+    private const string KeyPrefix = "jellyfin:transcode:";
+
+    /// <summary>
+    /// Lua script for atomic takeover: reads the stored session, checks whether the lease has
+    /// expired (comparing the stored expiry against the caller-supplied current time) and, if it
+    /// has, claims it for the calling pod before returning 1; returns 0 otherwise.
+    /// </summary>
+    private const string TakeoverScript = @"
+local raw = redis.call('GET', KEYS[1])
+if not raw then return 0 end
+local session = cjson.decode(raw)
+if tonumber(session['LeaseExpiresUtc']) > tonumber(ARGV[1]) then return 0 end
+session['OwnerPod'] = ARGV[2]
+session['LeaseExpiresUtc'] = tonumber(ARGV[1]) + tonumber(ARGV[3])
+redis.call('SET', KEYS[1], cjson.encode(session), 'PX', tonumber(ARGV[4]))
+return 1";
+
+    /// <summary>
+    /// Lua script for atomic, ownership-checked renewal: extends the lease only while the calling
+    /// pod still owns it, so a renewal racing a successful takeover cannot revert the new owner.
+    /// </summary>
+    private const string RenewScript = @"
+local raw = redis.call('GET', KEYS[1])
+if not raw then return 0 end
+local session = cjson.decode(raw)
+if session['OwnerPod'] ~= ARGV[2] then return 0 end
+session['LeaseExpiresUtc'] = tonumber(ARGV[1]) + tonumber(ARGV[3])
+redis.call('SET', KEYS[1], cjson.encode(session), 'PX', tonumber(ARGV[4]))
+return 1";
+
+    // The lease expiry is serialized as unix milliseconds because the Lua scripts compare it
+    // numerically; an ISO-8601 string cannot be compared against a number in Lua.
+    private static readonly JsonSerializerOptions _jsonOptions = new JsonSerializerOptions
+    {
+        Converters = { new UnixMillisecondsDateTimeConverter() }
+    };
+
+    private readonly IConnectionMultiplexer _redis;
+    private readonly IDatabase _db;
+    private readonly TranscodeStoreOptions _options;
+    private readonly ILogger<RedisTranscodeSessionStore> _logger;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="RedisTranscodeSessionStore"/> class.
+    /// </summary>
+    /// <param name="redis">The Redis connection multiplexer.</param>
+    /// <param name="options">The transcode store configuration options.</param>
+    /// <param name="logger">The logger.</param>
+    public RedisTranscodeSessionStore(
+        IConnectionMultiplexer redis,
+        IOptions<TranscodeStoreOptions> options,
+        ILogger<RedisTranscodeSessionStore> logger)
+    {
+        _redis = redis;
+        _db = redis.GetDatabase();
+        _options = options.Value;
+        _logger = logger;
+    }
+
+    private long LeaseDurationMs => (long)_options.LeaseDurationSeconds * 1000;
+
+    private long RetentionMs => Math.Max((long)_options.SessionRetentionSeconds * 1000, LeaseDurationMs);
+
+    /// <inheritdoc />
+    public async Task SetAsync(TranscodeSession session, CancellationToken cancellationToken = default)
+    {
+        var key = GetKey(session.PlaySessionId);
+        var json = JsonSerializer.Serialize(session, _jsonOptions);
+        await _db.StringSetAsync(key, json, TimeSpan.FromMilliseconds(RetentionMs)).ConfigureAwait(false);
+        _logger.LogDebug("Set transcode session {PlaySessionId} in Redis.", session.PlaySessionId);
+    }
+
+    /// <inheritdoc />
+    public async Task<TranscodeSession?> TryGetAsync(string playSessionId, CancellationToken cancellationToken = default)
+    {
+        var key = GetKey(playSessionId);
+        var raw = await _db.StringGetAsync(key).ConfigureAwait(false);
+        if (!raw.HasValue)
+        {
+            return null;
+        }
+
+        var session = JsonSerializer.Deserialize<TranscodeSession>(raw.ToString(), _jsonOptions);
+
+        // The record outlives the lease so that an orphaned session can still be taken over,
+        // so the lease has to be checked explicitly here.
+        if (session is null || session.LeaseExpiresUtc <= DateTime.UtcNow)
+        {
+            return null;
+        }
+
+        return session;
+    }
+
+    /// <inheritdoc />
+    public async Task<bool> RenewLeaseAsync(string playSessionId, string ownerPod, CancellationToken cancellationToken = default)
+    {
+        var result = (long?)await _db.ScriptEvaluateAsync(
+            RenewScript,
+            keys: new RedisKey[] { GetKey(playSessionId) },
+            values: new RedisValue[] { UnixMillisecondsNow(), ownerPod, LeaseDurationMs, RetentionMs }).ConfigureAwait(false);
+
+        if (result != 1)
+        {
+            _logger.LogWarning(
+                "Pod {OwnerPod} no longer owns transcode session {PlaySessionId}; lease not renewed.",
+                ownerPod,
+                playSessionId);
+            return false;
+        }
+
+        _logger.LogDebug("Renewed lease for transcode session {PlaySessionId}.", playSessionId);
+        return true;
+    }
+
+    /// <inheritdoc />
+    public async Task DeleteAsync(string playSessionId, CancellationToken cancellationToken = default)
+    {
+        var key = GetKey(playSessionId);
+        await _db.KeyDeleteAsync(key).ConfigureAwait(false);
+        _logger.LogDebug("Deleted transcode session {PlaySessionId} from Redis.", playSessionId);
+    }
+
+    /// <inheritdoc />
+    public async Task<bool> TryTakeoverAsync(string playSessionId, string claimingPod, CancellationToken cancellationToken = default)
+    {
+        var result = (long?)await _db.ScriptEvaluateAsync(
+            TakeoverScript,
+            keys: new RedisKey[] { GetKey(playSessionId) },
+            values: new RedisValue[] { UnixMillisecondsNow(), claimingPod, LeaseDurationMs, RetentionMs }).ConfigureAwait(false);
+
+        var succeeded = result == 1;
+        if (succeeded)
+        {
+            _logger.LogInformation("Pod {ClaimingPod} successfully took over transcode session {PlaySessionId}.", claimingPod, playSessionId);
+        }
+
+        return succeeded;
+    }
+
+    /// <inheritdoc />
+    public async Task<IEnumerable<TranscodeSession>> GetActiveSessionsAsync(CancellationToken cancellationToken = default)
+    {
+        var sessions = new List<TranscodeSession>();
+        var servers = _redis.GetServers();
+
+        foreach (var server in servers)
+        {
+            if (!server.IsConnected)
+            {
+                continue;
+            }
+
+            var keys = new List<RedisKey>();
+            await foreach (var key in server.KeysAsync(database: _db.Database, pattern: KeyPrefix + "*", pageSize: 1000).WithCancellation(cancellationToken).ConfigureAwait(false))
+            {
+                keys.Add(key);
+            }
+
+            var tasks = keys.Select(key => _db.StringGetAsync(key)).ToList();
+            var values = await Task.WhenAll(tasks).ConfigureAwait(false);
+
+            foreach (var raw in values)
+            {
+                if (!raw.HasValue)
+                {
+                    continue;
+                }
+
+                TranscodeSession? session;
+                try
+                {
+                    session = JsonSerializer.Deserialize<TranscodeSession>(raw.ToString(), _jsonOptions);
+                }
+                catch (Exception ex)
+                {
+                    _logger.LogWarning(ex, "Failed to deserialize transcode session from Redis.");
+                    continue;
+                }
+
+                if (session is not null && session.LeaseExpiresUtc > DateTime.UtcNow)
+                {
+                    sessions.Add(session);
+                }
+            }
+        }
+
+        return sessions;
+    }
+
+    private static string GetKey(string playSessionId) => KeyPrefix + playSessionId;
+
+    private static long UnixMillisecondsNow() => DateTimeOffset.UtcNow.ToUnixTimeMilliseconds();
+
+    private sealed class UnixMillisecondsDateTimeConverter : JsonConverter<DateTime>
+    {
+        public override DateTime Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            var milliseconds = reader.TryGetInt64(out var value) ? value : (long)reader.GetDouble();
+            return DateTimeOffset.FromUnixTimeMilliseconds(milliseconds).UtcDateTime;
+        }
+
+        public override void Write(Utf8JsonWriter writer, DateTime value, JsonSerializerOptions options)
+        {
+            var utc = value.Kind switch
+            {
+                DateTimeKind.Utc => value,
+                DateTimeKind.Local => value.ToUniversalTime(),
+                _ => DateTime.SpecifyKind(value, DateTimeKind.Utc)
+            };
+
+            writer.WriteNumberValue(new DateTimeOffset(utc, TimeSpan.Zero).ToUnixTimeMilliseconds());
+        }
+    }
+}
@@ -0,0 +1,56 @@
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using MediaBrowser.Controller.MediaEncoding;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Hosting;
+using Microsoft.Extensions.Logging;
+using StackExchange.Redis;
+
+namespace Emby.Server.Implementations.MediaEncoding;
+
+/// <summary>
+/// Pings the configured Redis transcode session store once at startup so an unreachable store is
+/// reported there instead of being discovered as a silent loss of cross-pod takeover.
+/// </summary>
+public sealed class TranscodeStoreConnectivityProbe : IHostedService
+{
+    private readonly IServiceProvider _serviceProvider;
+    private readonly ILogger<TranscodeStoreConnectivityProbe> _logger;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="TranscodeStoreConnectivityProbe"/> class.
+    /// </summary>
+    /// <param name="serviceProvider">The service provider used to resolve the Redis connection.</param>
+    /// <param name="logger">The logger.</param>
+    public TranscodeStoreConnectivityProbe(IServiceProvider serviceProvider, ILogger<TranscodeStoreConnectivityProbe> logger)
+    {
+        _serviceProvider = serviceProvider;
+        _logger = logger;
+    }
+
+    /// <inheritdoc />
+    public async Task StartAsync(CancellationToken cancellationToken)
+    {
+        try
+        {
+            // Resolved here rather than injected: connecting must not be able to abort startup.
+            var redis = _serviceProvider.GetRequiredService<IConnectionMultiplexer>();
+            var roundTrip = await redis.GetDatabase().PingAsync().ConfigureAwait(false);
+
+            _logger.LogInformation(
+                "Redis transcode session store is reachable ({RoundTripMs}ms round trip). HA transcode takeover is active.",
+                (long)roundTrip.TotalMilliseconds);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(
+                ex,
+                "Redis transcode session store is configured but UNREACHABLE. HA transcode takeover is not working: sessions stay local to this instance and are lost when it restarts. Check {Key}.",
+                TranscodeStoreOptions.RedisConnectionStringKey);
+        }
+    }
+
+    /// <inheritdoc />
+    public Task StopAsync(CancellationToken cancellationToken) => Task.CompletedTask;
+}
@@ -0,0 +1,14 @@
+namespace Emby.Server.Implementations
+{
+    /// <summary>
+    /// What a configuration update carrying different ports requires of the instance reading it.
+    /// </summary>
+    /// <param name="RequiresRestart">
+    /// Whether this process is still bound to a port the shared configuration no longer names, and so has
+    /// to report a pending restart.
+    /// </param>
+    /// <param name="ClearsPortAuthorization">
+    /// Whether this instance is the one that has to clear the port authorization flag and save it.
+    /// </param>
+    internal readonly record struct PortChangeOutcome(bool RequiresRestart, bool ClearsPortAuthorization);
+}
@@ -0,0 +1,81 @@
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using MediaBrowser.Controller.ScheduledTasks;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+using StackExchange.Redis;
+
+namespace Emby.Server.Implementations.ScheduledTasks;
+
+/// <summary>
+/// A Redis-backed <see cref="IScanLeaderLease"/> that elects a single scan-leader instance using a
+/// TTL lease on a shared key. The lease value is this instance's pod identity; a leader that keeps
+/// renewing retains the lease, and any instance can claim it once the previous leader's lease expires.
+/// </summary>
+public sealed class RedisScanLeaderLease : IScanLeaderLease
+{
+    private const string LeaderKey = "jellyfin:scanleader";
+
+    /// <summary>
+    /// Lua script for atomic acquire-or-renew: if the key is unset (missing or already expired) it is
+    /// set to this pod for the lease duration and 1 is returned; if it already holds this pod the TTL is
+    /// extended and 1 is returned; otherwise another pod owns a live lease and 0 is returned.
+    /// </summary>
+    private const string AcquireOrRenewScript = @"
+local current = redis.call('GET', KEYS[1])
+if not current then
+    redis.call('SET', KEYS[1], ARGV[1], 'PX', ARGV[2])
+    return 1
+elseif current == ARGV[1] then
+    redis.call('PEXPIRE', KEYS[1], ARGV[2])
+    return 1
+else
+    return 0
+end";
+
+    private readonly IDatabase _db;
+    private readonly ScanLeaderOptions _options;
+    private readonly ILogger<RedisScanLeaderLease> _logger;
+    private readonly string _podId;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="RedisScanLeaderLease"/> class.
+    /// </summary>
+    /// <param name="redis">The Redis connection multiplexer.</param>
+    /// <param name="options">The scan-leader configuration options.</param>
+    /// <param name="logger">The logger.</param>
+    public RedisScanLeaderLease(
+        IConnectionMultiplexer redis,
+        IOptions<ScanLeaderOptions> options,
+        ILogger<RedisScanLeaderLease> logger)
+    {
+        _db = redis.GetDatabase();
+        _options = options.Value;
+        _logger = logger;
+        _podId = Environment.GetEnvironmentVariable("JELLYFIN_INSTANCE_ID") ?? Environment.MachineName;
+    }
+
+    /// <inheritdoc />
+    public async Task<bool> TryAcquireOrRenewAsync(CancellationToken cancellationToken = default)
+    {
+        var leaseDurationMs = (long)_options.LeaseDurationSeconds * 1000;
+
+        try
+        {
+            var result = (long?)await _db.ScriptEvaluateAsync(
+                AcquireOrRenewScript,
+                keys: new RedisKey[] { LeaderKey },
+                values: new RedisValue[] { _podId, leaseDurationMs }).ConfigureAwait(false);
+
+            return result == 1;
+        }
+        catch (Exception ex)
+        {
+            // Fail-safe: if Redis is unreachable, treat this instance as the leader so scheduled scans
+            // keep running. Every instance scanning is preferable to no instance scanning.
+            _logger.LogWarning(ex, "Scan-leader lease evaluation failed; treating {PodId} as leader.", _podId);
+            return true;
+        }
+    }
+}
@@ -13,6 +13,7 @@ using Jellyfin.Data.Events;
 using Jellyfin.Extensions.Json;
 using MediaBrowser.Common.Configuration;
 using MediaBrowser.Common.Extensions;
+using MediaBrowser.Controller.ScheduledTasks;
 using MediaBrowser.Model.Tasks;
 using Microsoft.Extensions.Logging;

@@ -27,6 +28,8 @@ public class ScheduledTaskWorker : IScheduledTaskWorker
    private readonly IApplicationPaths _applicationPaths;
    private readonly ILogger _logger;
    private readonly ITaskManager _taskManager;
+    private readonly IScanLeaderLease _scanLeaderLease;
+    private readonly ScanLeaderOptions _scanLeaderOptions;
    private readonly Lock _lastExecutionResultSyncLock = new();
    private bool _readFromFile;
    private TaskResult _lastExecutionResult;
@@ -41,6 +44,8 @@ public class ScheduledTaskWorker : IScheduledTaskWorker
    /// <param name="applicationPaths">The application paths.</param>
    /// <param name="taskManager">The task manager.</param>
    /// <param name="logger">The logger.</param>
+    /// <param name="scanLeaderLease">The scan-leader lease used to gate periodic library-mutating tasks, or <c>null</c> to disable gating.</param>
+    /// <param name="scanLeaderOptions">The scan-leader options, or <c>null</c> to disable gating.</param>
    /// <exception cref="ArgumentNullException">
    /// scheduledTask
    /// or
@@ -52,7 +57,13 @@ public class ScheduledTaskWorker : IScheduledTaskWorker
    /// or
    /// logger.
    /// </exception>
-    public ScheduledTaskWorker(IScheduledTask scheduledTask, IApplicationPaths applicationPaths, ITaskManager taskManager, ILogger logger)
+    public ScheduledTaskWorker(
+        IScheduledTask scheduledTask,
+        IApplicationPaths applicationPaths,
+        ITaskManager taskManager,
+        ILogger logger,
+        IScanLeaderLease scanLeaderLease = null,
+        ScanLeaderOptions scanLeaderOptions = null)
    {
        ArgumentNullException.ThrowIfNull(scheduledTask);
        ArgumentNullException.ThrowIfNull(applicationPaths);
@@ -63,6 +74,8 @@ public class ScheduledTaskWorker : IScheduledTaskWorker
        _applicationPaths = applicationPaths;
        _taskManager = taskManager;
        _logger = logger;
+        _scanLeaderLease = scanLeaderLease;
+        _scanLeaderOptions = scanLeaderOptions;

        InitTriggerEvents();
    }
@@ -268,6 +281,20 @@ public class ScheduledTaskWorker : IScheduledTaskWorker

        trigger.Stop();

+        if (_scanLeaderLease is not null
+            && _scanLeaderOptions is not null
+            && _scanLeaderOptions.Enabled
+            && _scanLeaderOptions.GatedTaskKeys is not null
+            && _scanLeaderOptions.GatedTaskKeys.Contains(ScheduledTask.Key, StringComparer.Ordinal)
+            && !await _scanLeaderLease.TryAcquireOrRenewAsync().ConfigureAwait(false))
+        {
+            _logger.LogDebug("Skipping gated task {Task}: this instance does not hold the scan-leader lease.", Name);
+
+            // Re-arm the trigger for the next interval without enqueueing on this instance.
+            trigger.Start(LastExecutionResult, _logger, Name, false);
+            return;
+        }
+
        _taskManager.QueueScheduledTask(ScheduledTask, trigger.TaskOptions);

        await Task.Delay(1000).ConfigureAwait(false);
@@ -5,8 +5,10 @@ using System.Linq;
 using System.Threading.Tasks;
 using Jellyfin.Data.Events;
 using MediaBrowser.Common.Configuration;
+using MediaBrowser.Controller.ScheduledTasks;
 using MediaBrowser.Model.Tasks;
 using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;

 namespace Emby.Server.Implementations.ScheduledTasks;

@@ -23,18 +25,26 @@ public class TaskManager : ITaskManager

    private readonly IApplicationPaths _applicationPaths;
    private readonly ILogger<TaskManager> _logger;
+    private readonly IScanLeaderLease? _scanLeaderLease;
+    private readonly ScanLeaderOptions? _scanLeaderOptions;

    /// <summary>
    /// Initializes a new instance of the <see cref="TaskManager" /> class.
    /// </summary>
    /// <param name="applicationPaths">The application paths.</param>
    /// <param name="logger">The logger.</param>
+    /// <param name="scanLeaderLease">The scan-leader lease used to gate periodic library-mutating tasks, or <c>null</c> to disable gating.</param>
+    /// <param name="scanLeaderOptions">The scan-leader options, or <c>null</c> to disable gating.</param>
    public TaskManager(
        IApplicationPaths applicationPaths,
-        ILogger<TaskManager> logger)
+        ILogger<TaskManager> logger,
+        IScanLeaderLease? scanLeaderLease = null,
+        IOptions<ScanLeaderOptions>? scanLeaderOptions = null)
    {
        _applicationPaths = applicationPaths;
        _logger = logger;
+        _scanLeaderLease = scanLeaderLease;
+        _scanLeaderOptions = scanLeaderOptions?.Value;

        ScheduledTasks = [];
    }
@@ -175,7 +185,7 @@ public class TaskManager : ITaskManager
    /// <inheritdoc />
    public void AddTasks(IEnumerable<IScheduledTask> tasks)
    {
-        var list = tasks.Select(t => new ScheduledTaskWorker(t, _applicationPaths, this, _logger));
+        var list = tasks.Select(t => new ScheduledTaskWorker(t, _applicationPaths, this, _logger, _scanLeaderLease, _scanLeaderOptions));

        ScheduledTasks = ScheduledTasks.Concat(list).ToArray();
    }
@@ -5,6 +5,7 @@ using System.Threading;
 using System.Threading.Tasks;
 using MediaBrowser.Common.Configuration;
 using MediaBrowser.Controller.IO;
+using MediaBrowser.Controller.MediaEncoding;
 using MediaBrowser.Model.Globalization;
 using MediaBrowser.Model.IO;
 using MediaBrowser.Model.Tasks;
@@ -21,6 +22,7 @@ public class DeleteTranscodeFileTask : IScheduledTask, IConfigurableScheduledTas
    private readonly IConfigurationManager _configurationManager;
    private readonly IFileSystem _fileSystem;
    private readonly ILocalizationManager _localization;
+    private readonly ITranscodeSessionStore _sessionStore;

    /// <summary>
    /// Initializes a new instance of the <see cref="DeleteTranscodeFileTask"/> class.
@@ -29,16 +31,19 @@ public class DeleteTranscodeFileTask : IScheduledTask, IConfigurableScheduledTas
    /// <param name="fileSystem">Instance of the <see cref="IFileSystem"/> interface.</param>
    /// <param name="configurationManager">Instance of the <see cref="IConfigurationManager"/> interface.</param>
    /// <param name="localization">Instance of the <see cref="ILocalizationManager"/> interface.</param>
+    /// <param name="sessionStore">Instance of the <see cref="ITranscodeSessionStore"/> interface.</param>
    public DeleteTranscodeFileTask(
        ILogger<DeleteTranscodeFileTask> logger,
        IFileSystem fileSystem,
        IConfigurationManager configurationManager,
-        ILocalizationManager localization)
+        ILocalizationManager localization,
+        ITranscodeSessionStore sessionStore)
    {
        _logger = logger;
        _fileSystem = fileSystem;
        _configurationManager = configurationManager;
        _localization = localization;
+        _sessionStore = sessionStore;
    }

    /// <inheritdoc />
@@ -78,25 +83,39 @@ public class DeleteTranscodeFileTask : IScheduledTask, IConfigurableScheduledTas
    }

    /// <inheritdoc />
-    public Task ExecuteAsync(IProgress<double> progress, CancellationToken cancellationToken)
+    public async Task ExecuteAsync(IProgress<double> progress, CancellationToken cancellationToken)
    {
        var minDateModified = DateTime.UtcNow.AddDays(-1);
        progress.Report(50);

-        DeleteTempFilesFromDirectory(_configurationManager.GetTranscodePath(), minDateModified, progress, cancellationToken);
+        IEnumerable<TranscodeSession> activeSessions;
+        try
+        {
+            activeSessions = await _sessionStore.GetActiveSessionsAsync(cancellationToken).ConfigureAwait(false);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Failed to retrieve active transcode sessions. Skipping deletion to avoid removing files in use.");
+            progress.Report(100);
+            return;
+        }

-        return Task.CompletedTask;
+        DeleteTempFilesFromDirectory(_configurationManager.GetTranscodePath(), minDateModified, activeSessions, progress, cancellationToken);
    }

    /// <summary>
-    /// Deletes the transcoded temp files from directory with a last write time less than a given date.
+    /// Deletes the transcoded temp files from directory with a last write time less than a given date,
+    /// skipping any files that belong to an active transcode session.
    /// </summary>
    /// <param name="directory">The directory.</param>
    /// <param name="minDateModified">The min date modified.</param>
+    /// <param name="activeSessions">The currently active transcode sessions.</param>
    /// <param name="progress">The progress.</param>
    /// <param name="cancellationToken">The task cancellation token.</param>
-    private void DeleteTempFilesFromDirectory(string directory, DateTime minDateModified, IProgress<double> progress, CancellationToken cancellationToken)
+    private void DeleteTempFilesFromDirectory(string directory, DateTime minDateModified, IEnumerable<TranscodeSession> activeSessions, IProgress<double> progress, CancellationToken cancellationToken)
    {
+        var activeSessionList = activeSessions.ToList();
+
        var filesToDelete = _fileSystem.GetFiles(directory, true)
            .Where(f => _fileSystem.GetLastWriteTimeUtc(f) < minDateModified)
            .ToList();
@@ -112,6 +131,13 @@ public class DeleteTranscodeFileTask : IScheduledTask, IConfigurableScheduledTas

            cancellationToken.ThrowIfCancellationRequested();

+            if (IsFileProtectedByActiveSession(file.FullName, activeSessionList))
+            {
+                _logger.LogDebug("Skipping deletion of {FilePath} as it belongs to an active transcode session.", file.FullName);
+                index++;
+                continue;
+            }
+
            FileSystemHelper.DeleteFile(_fileSystem, file.FullName, _logger);

            index++;
@@ -121,4 +147,24 @@ public class DeleteTranscodeFileTask : IScheduledTask, IConfigurableScheduledTas

        progress.Report(100);
    }
+
+    private static bool IsFileProtectedByActiveSession(string filePath, IList<TranscodeSession> activeSessions)
+    {
+        foreach (var session in activeSessions)
+        {
+            if (!string.IsNullOrEmpty(session.ManifestPath) &&
+                string.Equals(filePath, session.ManifestPath, StringComparison.OrdinalIgnoreCase))
+            {
+                return true;
+            }
+
+            if (!string.IsNullOrEmpty(session.SegmentPathPrefix) &&
+                filePath.StartsWith(session.SegmentPathPrefix, StringComparison.OrdinalIgnoreCase))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
 }
@@ -0,0 +1,95 @@
+using System;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Jellyfin.Extensions.Json;
+using MediaBrowser.Controller.Session;
+using Microsoft.Extensions.Logging;
+using StackExchange.Redis;
+
+namespace Emby.Server.Implementations.Session;
+
+/// <summary>
+/// A Redis pub/sub <see cref="IPodMessageBus"/>. Every instance subscribes to a channel named after
+/// itself, which keeps addressed delivery working without the instances being routable to each other.
+/// </summary>
+public sealed class RedisPodMessageBus : IPodMessageBus
+{
+    private const string ChannelPrefix = "jellyfin:pod:";
+
+    private static readonly TimeSpan _publishTimeout = TimeSpan.FromSeconds(5);
+
+    private static readonly JsonSerializerOptions _jsonOptions = JsonDefaults.Options;
+
+    private readonly ISubscriber _subscriber;
+    private readonly ILogger<RedisPodMessageBus> _logger;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="RedisPodMessageBus"/> class.
+    /// </summary>
+    /// <param name="redis">The Redis connection multiplexer.</param>
+    /// <param name="logger">The logger.</param>
+    public RedisPodMessageBus(IConnectionMultiplexer redis, ILogger<RedisPodMessageBus> logger)
+    {
+        ArgumentNullException.ThrowIfNull(redis);
+
+        _subscriber = redis.GetSubscriber();
+        _logger = logger;
+        PodId = PodIdentity.Current;
+    }
+
+    /// <inheritdoc />
+    public string PodId { get; }
+
+    /// <inheritdoc />
+    public async Task<long> PublishAsync(string targetPod, PodMessage message, CancellationToken cancellationToken = default)
+    {
+        ArgumentException.ThrowIfNullOrEmpty(targetPod);
+        ArgumentNullException.ThrowIfNull(message);
+
+        message.OriginPod = PodId;
+
+        try
+        {
+            return await _subscriber.PublishAsync(
+                RedisChannel.Literal(ChannelPrefix + targetPod),
+                JsonSerializer.Serialize(message, _jsonOptions)).WaitAsync(_publishTimeout, cancellationToken).ConfigureAwait(false);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogWarning(ex, "Failed to send a {Kind} message to {TargetPod}.", message.Kind, targetPod);
+            return 0;
+        }
+    }
+
+    /// <inheritdoc />
+    public void Subscribe(Func<PodMessage, Task> handler)
+    {
+        ArgumentNullException.ThrowIfNull(handler);
+
+        try
+        {
+            _subscriber.Subscribe(RedisChannel.Literal(ChannelPrefix + PodId), (_, value) => Dispatch(handler, value));
+        }
+        catch (Exception ex)
+        {
+            _logger.LogWarning(ex, "Failed to subscribe to {PodId}; messages routed here are dropped.", PodId);
+        }
+    }
+
+    private async void Dispatch(Func<PodMessage, Task> handler, RedisValue value)
+    {
+        try
+        {
+            var message = JsonSerializer.Deserialize<PodMessage>(value.ToString(), _jsonOptions);
+            if (message is not null)
+            {
+                await handler(message).ConfigureAwait(false);
+            }
+        }
+        catch (Exception ex)
+        {
+            _logger.LogWarning(ex, "Failed to handle a message routed to this instance.");
+        }
+    }
+}
@@ -0,0 +1,215 @@
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Jellyfin.Extensions.Json;
+using MediaBrowser.Controller.Session;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+using StackExchange.Redis;
+
+namespace Emby.Server.Implementations.Session;
+
+/// <summary>
+/// A Redis-backed <see cref="ISessionDirectory"/>. A session is owned by the instance holding its
+/// connection: ownership is claimed through a check-and-set, so an instance that only served a request
+/// for the session cannot take it from the instance the device is actually connected to. Each entry is a
+/// key with an expiry, so the sessions of an instance that stops refreshing them disappear on their own.
+/// </summary>
+public sealed class RedisSessionDirectory : ISessionDirectory
+{
+    private const string KeyPrefix = "jellyfin:session:";
+    private const string OwnerKeyPrefix = "jellyfin:sessionowner:";
+
+    /// <summary>
+    /// Lua script for an atomic ownership claim. The owner key holds <c>connectedTicks|pod</c>, where
+    /// the ticks are zero for an instance that holds no connection. A claim by another instance is
+    /// refused unless its connection is newer than the recorded one, so the instance holding the live
+    /// connection keeps ownership however many requests the others serve.
+    /// </summary>
+    private const string ClaimScript = @"
+local current = redis.call('GET', KEYS[1])
+if current then
+    local separator = string.find(current, '|', 1, true)
+    local connected = tonumber(string.sub(current, 1, separator - 1))
+    local owner = string.sub(current, separator + 1)
+    if owner ~= ARGV[1] and connected > 0 and tonumber(ARGV[2]) <= connected then
+        return 0
+    end
+end
+redis.call('SET', KEYS[1], ARGV[2] .. '|' .. ARGV[1], 'PX', ARGV[4])
+redis.call('SET', KEYS[2], ARGV[3], 'PX', ARGV[4])
+return 1";
+
+    /// <summary>
+    /// Lua script for an atomic, ownership-checked removal, so that an instance ending its own copy of a
+    /// session cannot erase the entry of the instance still holding the connection.
+    /// </summary>
+    private const string ReleaseScript = @"
+local current = redis.call('GET', KEYS[1])
+if not current then return 0 end
+local separator = string.find(current, '|', 1, true)
+if string.sub(current, separator + 1) ~= ARGV[1] then return 0 end
+redis.call('DEL', KEYS[1], KEYS[2])
+return 1";
+
+    private static readonly JsonSerializerOptions _jsonOptions = JsonDefaults.Options;
+
+    private readonly IConnectionMultiplexer _redis;
+    private readonly IDatabase _db;
+    private readonly SessionDirectoryOptions _options;
+    private readonly ILogger<RedisSessionDirectory> _logger;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="RedisSessionDirectory"/> class.
+    /// </summary>
+    /// <param name="redis">The Redis connection multiplexer.</param>
+    /// <param name="options">The session directory configuration options.</param>
+    /// <param name="logger">The logger.</param>
+    public RedisSessionDirectory(
+        IConnectionMultiplexer redis,
+        IOptions<SessionDirectoryOptions> options,
+        ILogger<RedisSessionDirectory> logger)
+    {
+        ArgumentNullException.ThrowIfNull(redis);
+        ArgumentNullException.ThrowIfNull(options);
+
+        _redis = redis;
+        _db = redis.GetDatabase();
+        _options = options.Value;
+        _logger = logger;
+    }
+
+    private long EntryTtlMs => Math.Max(1, _options.EntryTtlSeconds) * 1000L;
+
+    private TimeSpan OperationTimeout => TimeSpan.FromSeconds(Math.Max(1, _options.OperationTimeoutSeconds));
+
+    /// <inheritdoc />
+    public async Task<bool> PublishAsync(SessionDirectoryEntry entry, long connectedUtcTicks, CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(entry);
+
+        var sessionId = entry.Session?.Id;
+        if (string.IsNullOrEmpty(sessionId))
+        {
+            return false;
+        }
+
+        try
+        {
+            var claimed = (long?)await _db.ScriptEvaluateAsync(
+                ClaimScript,
+                keys: new RedisKey[] { OwnerKeyPrefix + sessionId, KeyPrefix + sessionId },
+                values: new RedisValue[]
+                {
+                    entry.OwnerPod,
+                    connectedUtcTicks.ToString(CultureInfo.InvariantCulture),
+                    JsonSerializer.Serialize(entry, _jsonOptions),
+                    EntryTtlMs
+                }).WaitAsync(OperationTimeout, cancellationToken).ConfigureAwait(false);
+
+            return claimed == 1;
+        }
+        catch (Exception ex)
+        {
+            _logger.LogWarning(ex, "Failed to publish session {SessionId}; it stays invisible to the other instances.", sessionId);
+            return false;
+        }
+    }
+
+    /// <inheritdoc />
+    public async Task RemoveAsync(string sessionId, string ownerPod, CancellationToken cancellationToken = default)
+    {
+        try
+        {
+            await _db.ScriptEvaluateAsync(
+                ReleaseScript,
+                keys: new RedisKey[] { OwnerKeyPrefix + sessionId, KeyPrefix + sessionId },
+                values: new RedisValue[] { ownerPod }).WaitAsync(OperationTimeout, cancellationToken).ConfigureAwait(false);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogWarning(ex, "Failed to remove session {SessionId}; it expires on its own.", sessionId);
+        }
+    }
+
+    /// <inheritdoc />
+    public async Task<SessionDirectoryEntry?> GetAsync(string sessionId, CancellationToken cancellationToken = default)
+    {
+        try
+        {
+            var raw = await _db.StringGetAsync(KeyPrefix + sessionId).WaitAsync(OperationTimeout, cancellationToken).ConfigureAwait(false);
+
+            return raw.HasValue ? Deserialize(raw) : null;
+        }
+        catch (Exception ex)
+        {
+            _logger.LogWarning(ex, "Failed to read session {SessionId} from the directory.", sessionId);
+            return null;
+        }
+    }
+
+    /// <inheritdoc />
+    public async Task<IReadOnlyList<SessionDirectoryEntry>> GetAllAsync(CancellationToken cancellationToken = default)
+    {
+        var entries = new List<SessionDirectoryEntry>();
+
+        try
+        {
+            foreach (var server in _redis.GetServers())
+            {
+                if (!server.IsConnected)
+                {
+                    continue;
+                }
+
+                var keys = new List<RedisKey>();
+                await foreach (var key in server.KeysAsync(database: _db.Database, pattern: KeyPrefix + "*", pageSize: 1000).WithCancellation(cancellationToken).ConfigureAwait(false))
+                {
+                    keys.Add(key);
+                }
+
+                var values = await Task.WhenAll(keys.Select(key => _db.StringGetAsync(key)))
+                    .WaitAsync(OperationTimeout, cancellationToken).ConfigureAwait(false);
+
+                foreach (var raw in values)
+                {
+                    if (!raw.HasValue)
+                    {
+                        continue;
+                    }
+
+                    var entry = Deserialize(raw);
+                    if (entry?.Session is not null)
+                    {
+                        entries.Add(entry);
+                    }
+                }
+            }
+        }
+        catch (Exception ex)
+        {
+            // Degrade to the sessions this instance holds rather than failing the request outright.
+            _logger.LogWarning(ex, "Failed to read the session directory; only local sessions are reported.");
+            return Array.Empty<SessionDirectoryEntry>();
+        }
+
+        return entries;
+    }
+
+    private SessionDirectoryEntry? Deserialize(RedisValue raw)
+    {
+        try
+        {
+            return JsonSerializer.Deserialize<SessionDirectoryEntry>(raw.ToString(), _jsonOptions);
+        }
+        catch (JsonException ex)
+        {
+            _logger.LogWarning(ex, "Failed to deserialize a session directory entry.");
+            return null;
+        }
+    }
+}
@@ -0,0 +1,76 @@
+using System;
+using System.Globalization;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Jellyfin.Extensions.Json;
+using MediaBrowser.Common.Extensions;
+using MediaBrowser.Controller.Session;
+using MediaBrowser.Model.Session;
+using Microsoft.Extensions.Logging;
+
+namespace Emby.Server.Implementations.Session;
+
+/// <summary>
+/// Stands in for the websocket of a session another instance holds: messages are forwarded to that
+/// instance, which writes them to the connection it owns.
+/// </summary>
+public sealed class RemoteSessionController : ISessionController
+{
+    private readonly IPodMessageBus _bus;
+    private readonly ILogger _logger;
+    private readonly string _ownerPod;
+    private readonly string _sessionId;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="RemoteSessionController"/> class.
+    /// </summary>
+    /// <param name="bus">The cross-instance bus.</param>
+    /// <param name="logger">The logger.</param>
+    /// <param name="ownerPod">The instance holding the connection.</param>
+    /// <param name="sessionId">The session identifier.</param>
+    /// <param name="supportsMediaControl">Whether the owner reported the session as controllable.</param>
+    public RemoteSessionController(IPodMessageBus bus, ILogger logger, string ownerPod, string sessionId, bool supportsMediaControl)
+    {
+        _bus = bus;
+        _logger = logger;
+        _ownerPod = ownerPod;
+        _sessionId = sessionId;
+        SupportsMediaControl = supportsMediaControl;
+    }
+
+    /// <inheritdoc />
+    public bool IsSessionActive => true;
+
+    /// <inheritdoc />
+    public bool SupportsMediaControl { get; }
+
+    /// <inheritdoc />
+    public async Task SendMessage<T>(SessionMessageType name, Guid messageId, T data, CancellationToken cancellationToken)
+    {
+        var routed = new RoutedSessionMessage
+        {
+            SessionId = _sessionId,
+            MessageType = name,
+            MessageId = messageId,
+            Data = JsonSerializer.Serialize(data, JsonDefaults.Options)
+        };
+
+        var delivered = await _bus.PublishAsync(
+            _ownerPod,
+            new PodMessage
+            {
+                Kind = RoutedSessionMessage.Kind,
+                Payload = JsonSerializer.Serialize(routed, JsonDefaults.Options)
+            },
+            cancellationToken).ConfigureAwait(false);
+
+        if (delivered == 0)
+        {
+            _logger.LogWarning("Instance {OwnerPod} holds session {SessionId} but is not listening; the {MessageType} message was not delivered.", _ownerPod, _sessionId, name);
+
+            throw new ResourceNotFoundException(
+                string.Format(CultureInfo.InvariantCulture, "The instance holding session {0} is unreachable.", _sessionId));
+        }
+    }
+}
@@ -5,6 +5,7 @@ using System.Collections.Concurrent;
 using System.Collections.Generic;
 using System.Globalization;
 using System.Linq;
+using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
 using Jellyfin.Data;
@@ -15,6 +16,7 @@ using Jellyfin.Database.Implementations.Entities;
 using Jellyfin.Database.Implementations.Entities.Security;
 using Jellyfin.Database.Implementations.Enums;
 using Jellyfin.Extensions;
+using Jellyfin.Extensions.Json;
 using MediaBrowser.Common.Events;
 using MediaBrowser.Common.Extensions;
 using MediaBrowser.Controller;
@@ -39,6 +41,7 @@ using MediaBrowser.Model.SyncPlay;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Hosting;
 using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
 using Episode = MediaBrowser.Controller.Entities.TV.Episode;

 namespace Emby.Server.Implementations.Session
@@ -60,15 +63,23 @@ namespace Emby.Server.Implementations.Session
        private readonly IMediaSourceManager _mediaSourceManager;
        private readonly IServerApplicationHost _appHost;
        private readonly IDeviceManager _deviceManager;
+        private readonly ISessionDirectory _sessionDirectory;
+        private readonly IPodMessageBus _podMessageBus;
+        private readonly SessionDirectoryOptions _sessionDirectoryOptions;
+        private readonly bool _directoryEnabled;
        private readonly CancellationTokenRegistration _shutdownCallback;
        private readonly ConcurrentDictionary<string, SessionInfo> _activeConnections
            = new(StringComparer.OrdinalIgnoreCase);

+        private readonly ConcurrentDictionary<string, long> _connectionEpochs = new(StringComparer.Ordinal);
+        private readonly ConcurrentDictionary<string, long> _lastDirectoryPublish = new(StringComparer.Ordinal);
+
        private readonly ConcurrentDictionary<string, ConcurrentDictionary<string, string>> _activeLiveStreamSessions
            = new(StringComparer.OrdinalIgnoreCase);

        private Timer _idleTimer;
        private Timer _inactiveTimer;
+        private Timer _directoryTimer;

        private DtoOptions _itemInfoDtoOptions;
        private bool _disposed;
@@ -89,6 +100,9 @@ namespace Emby.Server.Implementations.Session
        /// <param name="deviceManager">Instance of <see cref="IDeviceManager"/> interface.</param>
        /// <param name="mediaSourceManager">Instance of <see cref="IMediaSourceManager"/> interface.</param>
        /// <param name="hostApplicationLifetime">Instance of <see cref="IHostApplicationLifetime"/> interface.</param>
+        /// <param name="sessionDirectory">Instance of <see cref="ISessionDirectory"/> interface.</param>
+        /// <param name="podMessageBus">Instance of <see cref="IPodMessageBus"/> interface.</param>
+        /// <param name="sessionDirectoryOptions">The session directory options.</param>
        public SessionManager(
            ILogger<SessionManager> logger,
            IEventManager eventManager,
@@ -102,7 +116,10 @@ namespace Emby.Server.Implementations.Session
            IServerApplicationHost appHost,
            IDeviceManager deviceManager,
            IMediaSourceManager mediaSourceManager,
-            IHostApplicationLifetime hostApplicationLifetime)
+            IHostApplicationLifetime hostApplicationLifetime,
+            ISessionDirectory sessionDirectory,
+            IPodMessageBus podMessageBus,
+            IOptions<SessionDirectoryOptions> sessionDirectoryOptions)
        {
            _logger = logger;
            _eventManager = eventManager;
@@ -116,9 +133,21 @@ namespace Emby.Server.Implementations.Session
            _appHost = appHost;
            _deviceManager = deviceManager;
            _mediaSourceManager = mediaSourceManager;
+            _sessionDirectory = sessionDirectory;
+            _podMessageBus = podMessageBus;
+            _sessionDirectoryOptions = sessionDirectoryOptions.Value;
            _shutdownCallback = hostApplicationLifetime.ApplicationStopping.Register(OnApplicationStopping);

            _deviceManager.DeviceOptionsUpdated += OnDeviceManagerDeviceOptionsUpdated;
+
+            _directoryEnabled = _sessionDirectory is not NullSessionDirectory;
+
+            if (_directoryEnabled)
+            {
+                _podMessageBus.Subscribe(OnPodMessage);
+                var interval = TimeSpan.FromSeconds(Math.Max(1, _sessionDirectoryOptions.RefreshIntervalSeconds));
+                _directoryTimer = new Timer(RefreshSessionDirectory, null, interval, interval);
+            }
        }

        /// <summary>
@@ -218,6 +247,8 @@ namespace Emby.Server.Implementations.Session

            _eventManager.Publish(new SessionEndedEventArgs(info));

+            await RemoveFromDirectoryAsync(info).ConfigureAwait(false);
+
            await info.DisposeAsync().ConfigureAwait(false);
        }

@@ -256,7 +287,7 @@ namespace Emby.Server.Implementations.Session
            ArgumentException.ThrowIfNullOrEmpty(deviceId);

            var activityDate = DateTime.UtcNow;
-            var session = GetSessionInfo(appName, appVersion, deviceId, deviceName, remoteEndPoint, user);
+            var session = await GetSessionInfo(appName, appVersion, deviceId, deviceName, remoteEndPoint, user).ConfigureAwait(false);
            var lastActivityDate = session.LastActivityDate;
            session.LastActivityDate = activityDate;

@@ -288,11 +319,13 @@ namespace Emby.Server.Implementations.Session
                    });
            }

+            QueueDirectoryPublish(session);
+
            return session;
        }

        /// <inheritdoc />
-        public void OnSessionControllerConnected(SessionInfo session)
+        public async Task OnSessionControllerConnected(SessionInfo session)
        {
            EventHelper.QueueEventIfNotNull(
                SessionControllerConnected,
@@ -302,6 +335,219 @@ namespace Emby.Server.Implementations.Session
                    SessionInfo = session
                },
                _logger);
+
+            // Ownership of the session belongs to whichever instance holds its connection, so this one
+            // claims it before the connection is used.
+            _lastDirectoryPublish[session.Id] = Environment.TickCount64;
+            await PublishToDirectoryAsync(session).ConfigureAwait(false);
+        }
+
+        // Keeps the directory write off the request path: the caller does not wait for Redis, and a
+        // session reporting playback every few seconds does not write on every report.
+        private void QueueDirectoryPublish(SessionInfo session)
+        {
+            if (!_directoryEnabled || string.IsNullOrEmpty(session.Id))
+            {
+                return;
+            }
+
+            var now = Environment.TickCount64;
+            var throttleMs = Math.Max(1000L, _sessionDirectoryOptions.RefreshIntervalSeconds * 500L);
+            var scheduled = _lastDirectoryPublish.AddOrUpdate(
+                session.Id,
+                now,
+                (_, last) => now - last >= throttleMs ? now : last);
+
+            if (scheduled == now)
+            {
+                _ = PublishToDirectoryAsync(session);
+            }
+        }
+
+        private async Task PublishToDirectoryAsync(SessionInfo session)
+        {
+            if (!_directoryEnabled || string.IsNullOrEmpty(session.Id))
+            {
+                return;
+            }
+
+            try
+            {
+                var connectedUtcTicks = GetConnectionEpoch(session);
+
+                await _sessionDirectory.PublishAsync(
+                    new SessionDirectoryEntry
+                    {
+                        OwnerPod = _podMessageBus.PodId,
+                        HoldsConnection = connectedUtcTicks > 0,
+                        Session = ToSessionInfoDto(session)
+                    },
+                    connectedUtcTicks).ConfigureAwait(false);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogDebug(ex, "Error publishing session {Session} to the directory.", session.Id);
+            }
+        }
+
+        // Ownership follows the connection, not the last request served: an instance without a live
+        // controller claims with epoch zero, which never displaces an instance that has one.
+        private long GetConnectionEpoch(SessionInfo session)
+        {
+            if (!session.SessionControllers.Any(i => i.IsSessionActive))
+            {
+                _connectionEpochs.TryRemove(session.Id, out _);
+                return 0;
+            }
+
+            return _connectionEpochs.GetOrAdd(session.Id, _ => DateTime.UtcNow.Ticks);
+        }
+
+        private async ValueTask RemoveFromDirectoryAsync(SessionInfo session)
+        {
+            _connectionEpochs.TryRemove(session.Id, out _);
+            _lastDirectoryPublish.TryRemove(session.Id, out _);
+
+            if (!_directoryEnabled || string.IsNullOrEmpty(session.Id))
+            {
+                return;
+            }
+
+            await _sessionDirectory.RemoveAsync(session.Id, _podMessageBus.PodId).ConfigureAwait(false);
+        }
+
+        private async void RefreshSessionDirectory(object state)
+        {
+            try
+            {
+                foreach (var session in _activeConnections.Values)
+                {
+                    await PublishToDirectoryAsync(session).ConfigureAwait(false);
+                }
+            }
+            catch (Exception ex)
+            {
+                _logger.LogDebug(ex, "Error refreshing the session directory.");
+            }
+        }
+
+        private async Task<IReadOnlyList<SessionDirectoryEntry>> GetRemoteEntriesAsync(CancellationToken cancellationToken)
+        {
+            if (!_directoryEnabled)
+            {
+                return Array.Empty<SessionDirectoryEntry>();
+            }
+
+            var entries = await _sessionDirectory.GetAllAsync(cancellationToken).ConfigureAwait(false);
+
+            return entries
+                .Where(entry => entry.Session is not null
+                    && !string.Equals(entry.OwnerPod, _podMessageBus.PodId, StringComparison.Ordinal))
+                .ToList();
+        }
+
+        private async Task<SessionInfo> GetRemoteSession(string sessionId)
+        {
+            if (!_directoryEnabled)
+            {
+                return null;
+            }
+
+            var entry = await _sessionDirectory.GetAsync(sessionId).ConfigureAwait(false);
+
+            if (entry?.Session is null
+                || string.Equals(entry.OwnerPod, _podMessageBus.PodId, StringComparison.Ordinal))
+            {
+                return null;
+            }
+
+            var dto = entry.Session;
+            var session = new SessionInfo(this, _logger)
+            {
+                Id = dto.Id,
+                UserId = dto.UserId,
+                UserName = dto.UserName,
+                Client = dto.Client,
+                DeviceId = dto.DeviceId,
+                DeviceName = dto.DeviceName,
+                DeviceType = dto.DeviceType,
+                ApplicationVersion = dto.ApplicationVersion,
+                RemoteEndPoint = dto.RemoteEndPoint,
+                LastActivityDate = dto.LastActivityDate,
+                ServerId = dto.ServerId,
+                AdditionalUsers = dto.AdditionalUsers ?? [],
+                Capabilities = dto.Capabilities?.ToClientCapabilities()
+            };
+
+            if (entry.HoldsConnection)
+            {
+                session.AddController(new RemoteSessionController(_podMessageBus, _logger, entry.OwnerPod, dto.Id, dto.SupportsMediaControl));
+            }
+
+            return session;
+        }
+
+        private Task OnPodMessage(PodMessage message)
+        {
+            switch (message.Kind)
+            {
+                case RoutedSessionMessage.Kind:
+                    return OnRoutedSessionMessage(message);
+                case RoutedAdditionalUserChange.Kind:
+                    OnRoutedAdditionalUserChange(message);
+                    return Task.CompletedTask;
+                default:
+                    return Task.CompletedTask;
+            }
+        }
+
+        private async Task OnRoutedSessionMessage(PodMessage message)
+        {
+            var routed = JsonSerializer.Deserialize<RoutedSessionMessage>(message.Payload, JsonDefaults.Options);
+            if (routed is null)
+            {
+                return;
+            }
+
+            var session = Sessions.FirstOrDefault(i => string.Equals(i.Id, routed.SessionId, StringComparison.Ordinal));
+            var controllers = session?.SessionControllers.Where(i => i.IsSessionActive).ToList();
+
+            if (controllers is null || controllers.Count == 0)
+            {
+                _logger.LogWarning(
+                    "A {MessageType} message for session {Session} was routed to this instance, which no longer holds its connection.",
+                    routed.MessageType,
+                    routed.SessionId);
+                return;
+            }
+
+            using var data = JsonDocument.Parse(routed.Data);
+            foreach (var controller in controllers)
+            {
+                await controller.SendMessage(routed.MessageType, routed.MessageId, data.RootElement, CancellationToken.None).ConfigureAwait(false);
+            }
+        }
+
+        private void OnRoutedAdditionalUserChange(PodMessage message)
+        {
+            var routed = JsonSerializer.Deserialize<RoutedAdditionalUserChange>(message.Payload, JsonDefaults.Options);
+            var session = routed is null
+                ? null
+                : Sessions.FirstOrDefault(i => string.Equals(i.Id, routed.SessionId, StringComparison.Ordinal));
+
+            if (session is null)
+            {
+                return;
+            }
+
+            if (routed.Add)
+            {
+                AttachAdditionalUser(session, routed.UserId, _userManager.GetUserById(routed.UserId)?.Username);
+            }
+            else
+            {
+                DetachAdditionalUser(session, routed.UserId);
+            }
        }

        /// <inheritdoc />
@@ -491,7 +737,7 @@ namespace Emby.Server.Implementations.Session
        /// <param name="remoteEndPoint">The remote end point.</param>
        /// <param name="user">The user.</param>
        /// <returns>SessionInfo.</returns>
-        private SessionInfo GetSessionInfo(
+        private async Task<SessionInfo> GetSessionInfo(
            string appName,
            string appVersion,
            string deviceId,
@@ -504,7 +750,7 @@ namespace Emby.Server.Implementations.Session
            ArgumentException.ThrowIfNullOrEmpty(deviceId);

            var key = GetSessionKey(appName, deviceId, user?.Id ?? Guid.Empty);
-            SessionInfo newSession = CreateSessionInfo(key, appName, appVersion, deviceId, deviceName, remoteEndPoint, user);
+            SessionInfo newSession = await CreateSessionInfo(key, appName, appVersion, deviceId, deviceName, remoteEndPoint, user).ConfigureAwait(false);
            SessionInfo sessionInfo = _activeConnections.GetOrAdd(key, newSession);
            if (ReferenceEquals(newSession, sessionInfo))
            {
@@ -532,7 +778,7 @@ namespace Emby.Server.Implementations.Session
            return sessionInfo;
        }

-        private SessionInfo CreateSessionInfo(
+        private async Task<SessionInfo> CreateSessionInfo(
            string key,
            string appName,
            string appVersion,
@@ -562,7 +808,7 @@ namespace Emby.Server.Implementations.Session
                deviceName = "Network Device";
            }

-            var deviceOptions = _deviceManager.GetDeviceOptions(deviceId) ?? new()
+            var deviceOptions = await _deviceManager.GetDeviceOptions(deviceId).ConfigureAwait(false) ?? new()
            {
                DeviceId = deviceId
            };
@@ -1219,10 +1465,18 @@ namespace Emby.Server.Implementations.Session
            return session;
        }

-        private SessionInfo GetSessionToRemoteControl(string sessionId)
+        // A local SessionInfo without a live controller is a copy left behind by a request this instance
+        // happened to serve, not the connection: prefer the owner named by the directory over it.
+        private async Task<SessionInfo> GetSessionToRemoteControl(string sessionId)
        {
-            // Accept either device id or session id
-            var session = Sessions.FirstOrDefault(i => string.Equals(i.Id, sessionId, StringComparison.Ordinal));
+            var local = Sessions.FirstOrDefault(i => string.Equals(i.Id, sessionId, StringComparison.Ordinal));
+
+            if (local is not null && local.SessionControllers.Any(i => i.IsSessionActive))
+            {
+                return local;
+            }
+
+            var session = await GetRemoteSession(sessionId).ConfigureAwait(false) ?? local;

            if (session is null)
            {
@@ -1291,19 +1545,19 @@ namespace Emby.Server.Implementations.Session
        }

        /// <inheritdoc />
-        public Task SendGeneralCommand(string controllingSessionId, string sessionId, GeneralCommand command, CancellationToken cancellationToken)
+        public async Task SendGeneralCommand(string controllingSessionId, string sessionId, GeneralCommand command, CancellationToken cancellationToken)
        {
            CheckDisposed();

-            var session = GetSessionToRemoteControl(sessionId);
+            var session = await GetSessionToRemoteControl(sessionId).ConfigureAwait(false);

            if (!string.IsNullOrEmpty(controllingSessionId))
            {
-                var controllingSession = GetSession(controllingSessionId);
+                var controllingSession = await GetSessionToRemoteControl(controllingSessionId).ConfigureAwait(false);
                AssertCanControl(session, controllingSession);
            }

-            return SendMessageToSession(session, SessionMessageType.GeneralCommand, command, cancellationToken);
+            await SendMessageToSession(session, SessionMessageType.GeneralCommand, command, cancellationToken).ConfigureAwait(false);
        }

        private static async Task SendMessageToSession<T>(SessionInfo session, SessionMessageType name, T data, CancellationToken cancellationToken)
@@ -1340,7 +1594,7 @@ namespace Emby.Server.Implementations.Session
        {
            CheckDisposed();

-            var session = GetSessionToRemoteControl(sessionId);
+            var session = await GetSessionToRemoteControl(sessionId).ConfigureAwait(false);

            var user = session.UserId.IsEmpty() ? null : _userManager.GetUserById(session.UserId);

@@ -1410,7 +1664,7 @@ namespace Emby.Server.Implementations.Session

            if (!string.IsNullOrEmpty(controllingSessionId))
            {
-                var controllingSession = GetSession(controllingSessionId);
+                var controllingSession = await GetSessionToRemoteControl(controllingSessionId).ConfigureAwait(false);
                AssertCanControl(session, controllingSession);
                if (!controllingSession.UserId.IsEmpty())
                {
@@ -1425,7 +1679,16 @@ namespace Emby.Server.Implementations.Session
        public async Task SendSyncPlayCommand(string sessionId, SendCommand command, CancellationToken cancellationToken)
        {
            CheckDisposed();
-            var session = GetSession(sessionId);
+
+            // SyncPlay group membership is instance-local, so a session listed by another instance is not
+            // reachable from here. It is skipped rather than reported as missing.
+            var session = GetSession(sessionId, false);
+            if (session is null)
+            {
+                _logger.LogDebug("SyncPlay command for session {Session} dropped; it is not held by this instance.", sessionId);
+                return;
+            }
+
            await SendMessageToSession(session, SessionMessageType.SyncPlayCommand, command, cancellationToken).ConfigureAwait(false);
        }

@@ -1433,7 +1696,14 @@ namespace Emby.Server.Implementations.Session
        public async Task SendSyncPlayGroupUpdate<T>(string sessionId, GroupUpdate<T> command, CancellationToken cancellationToken)
        {
            CheckDisposed();
-            var session = GetSession(sessionId);
+
+            var session = GetSession(sessionId, false);
+            if (session is null)
+            {
+                _logger.LogDebug("SyncPlay group update for session {Session} dropped; it is not held by this instance.", sessionId);
+                return;
+            }
+
            await SendMessageToSession(session, SessionMessageType.SyncPlayGroupUpdate, command, cancellationToken).ConfigureAwait(false);
        }

@@ -1521,15 +1791,15 @@ namespace Emby.Server.Implementations.Session
        }

        /// <inheritdoc />
-        public Task SendPlaystateCommand(string controllingSessionId, string sessionId, PlaystateRequest command, CancellationToken cancellationToken)
+        public async Task SendPlaystateCommand(string controllingSessionId, string sessionId, PlaystateRequest command, CancellationToken cancellationToken)
        {
            CheckDisposed();

-            var session = GetSessionToRemoteControl(sessionId);
+            var session = await GetSessionToRemoteControl(sessionId).ConfigureAwait(false);

            if (!string.IsNullOrEmpty(controllingSessionId))
            {
-                var controllingSession = GetSession(controllingSessionId);
+                var controllingSession = await GetSessionToRemoteControl(controllingSessionId).ConfigureAwait(false);
                AssertCanControl(session, controllingSession);
                if (!controllingSession.UserId.IsEmpty())
                {
@@ -1537,7 +1807,7 @@ namespace Emby.Server.Implementations.Session
                }
            }

-            return SendMessageToSession(session, SessionMessageType.Playstate, command, cancellationToken);
+            await SendMessageToSession(session, SessionMessageType.Playstate, command, cancellationToken).ConfigureAwait(false);
        }

        private void AssertCanControl(SessionInfo session, SessionInfo controllingSession)
@@ -1606,17 +1876,18 @@ namespace Emby.Server.Implementations.Session
        /// <param name="controllingSessionId">The controlling session identifier.</param>
        /// <param name="sessionId">The session identifier.</param>
        /// <param name="userId">The user identifier.</param>
+        /// <returns>A task representing the operation.</returns>
        /// <exception cref="SecurityException">The controlling user is not allowed to attach the user to the session.</exception>
        /// <exception cref="ArgumentException">The requested user is already the primary user of the session.</exception>
-        public void AddAdditionalUser(string controllingSessionId, string sessionId, Guid userId)
+        public async Task AddAdditionalUser(string controllingSessionId, string sessionId, Guid userId)
        {
            CheckDisposed();

-            var session = GetSession(sessionId);
+            var session = await GetSessionToRemoteControl(sessionId).ConfigureAwait(false);

            if (!string.IsNullOrEmpty(controllingSessionId))
            {
-                var controllingSession = GetSession(controllingSessionId);
+                var controllingSession = await GetSessionToRemoteControl(controllingSessionId).ConfigureAwait(false);
                AssertCanControl(session, controllingSession);
                AssertCanAttachUser(controllingSession, userId);
            }
@@ -1626,18 +1897,16 @@ namespace Emby.Server.Implementations.Session
                throw new ArgumentException("The requested user is already the primary user of the session.");
            }

-            if (session.AdditionalUsers.All(i => !i.UserId.Equals(userId)))
-            {
-                var user = _userManager.GetUserById(userId)
-                    ?? throw new ArgumentException("The requested user does not exist.");
-                var newUser = new SessionUserInfo
-                {
-                    UserId = userId,
-                    UserName = user.Username
-                };
+            var user = _userManager.GetUserById(userId)
+                ?? throw new ArgumentException("The requested user does not exist.");

-                session.AdditionalUsers = [.. session.AdditionalUsers, newUser];
+            var local = GetSession(sessionId, false);
+            if (local is not null)
+            {
+                AttachAdditionalUser(local, userId, user.Username);
            }
+
+            await RouteAdditionalUserChange(sessionId, userId, true).ConfigureAwait(false);
        }

        /// <summary>
@@ -1646,17 +1915,18 @@ namespace Emby.Server.Implementations.Session
        /// <param name="controllingSessionId">The controlling session identifier.</param>
        /// <param name="sessionId">The session identifier.</param>
        /// <param name="userId">The user identifier.</param>
+        /// <returns>A task representing the operation.</returns>
        /// <exception cref="SecurityException">The controlling user is not allowed to control the session.</exception>
        /// <exception cref="ArgumentException">The requested user is already the primary user of the session.</exception>
-        public void RemoveAdditionalUser(string controllingSessionId, string sessionId, Guid userId)
+        public async Task RemoveAdditionalUser(string controllingSessionId, string sessionId, Guid userId)
        {
            CheckDisposed();

-            var session = GetSession(sessionId);
+            var session = await GetSessionToRemoteControl(sessionId).ConfigureAwait(false);

            if (!string.IsNullOrEmpty(controllingSessionId))
            {
-                AssertCanControl(session, GetSession(controllingSessionId));
+                AssertCanControl(session, await GetSessionToRemoteControl(controllingSessionId).ConfigureAwait(false));
            }

            if (session.UserId.Equals(userId))
@@ -1664,17 +1934,73 @@ namespace Emby.Server.Implementations.Session
                throw new ArgumentException("The requested user is already the primary user of the session.");
            }

-            var user = session.AdditionalUsers.FirstOrDefault(i => i.UserId.Equals(userId));
+            var local = GetSession(sessionId, false);
+            if (local is not null)
+            {
+                DetachAdditionalUser(local, userId);
+            }

-            if (user is not null)
+            await RouteAdditionalUserChange(sessionId, userId, false).ConfigureAwait(false);
+        }
+
+        private static void AttachAdditionalUser(SessionInfo session, Guid userId, string userName)
+        {
+            if (session.AdditionalUsers.All(i => !i.UserId.Equals(userId)))
+            {
+                session.AdditionalUsers = [.. session.AdditionalUsers, new SessionUserInfo { UserId = userId, UserName = userName }];
+            }
+        }
+
+        private static void DetachAdditionalUser(SessionInfo session, Guid userId)
+        {
+            var existing = session.AdditionalUsers.FirstOrDefault(i => i.UserId.Equals(userId));
+
+            if (existing is not null)
            {
                var list = session.AdditionalUsers.ToList();
-                list.Remove(user);
+                list.Remove(existing);

                session.AdditionalUsers = list.ToArray();
            }
        }

+        // The owner is the instance whose copy of the session is the one everyone else is shown, so the
+        // change has to be applied there as well as on whichever instance served the request.
+        private async Task RouteAdditionalUserChange(string sessionId, Guid userId, bool add)
+        {
+            if (!_directoryEnabled)
+            {
+                return;
+            }
+
+            var entry = await _sessionDirectory.GetAsync(sessionId).ConfigureAwait(false);
+
+            if (entry is null || string.Equals(entry.OwnerPod, _podMessageBus.PodId, StringComparison.Ordinal))
+            {
+                return;
+            }
+
+            var payload = new RoutedAdditionalUserChange
+            {
+                SessionId = sessionId,
+                UserId = userId,
+                Add = add
+            };
+
+            var delivered = await _podMessageBus.PublishAsync(
+                entry.OwnerPod,
+                new PodMessage
+                {
+                    Kind = RoutedAdditionalUserChange.Kind,
+                    Payload = JsonSerializer.Serialize(payload, JsonDefaults.Options)
+                }).ConfigureAwait(false);
+
+            if (delivered == 0)
+            {
+                _logger.LogWarning("Instance {OwnerPod} holds session {Session} but is not listening; the additional user change was not applied there.", entry.OwnerPod, sessionId);
+            }
+        }
+
        /// <summary>
        /// Authenticates the new session.
        /// </summary>
@@ -1768,12 +2094,12 @@ namespace Emby.Server.Implementations.Session
            // This should be validated above, but if it isn't don't delete all tokens.
            ArgumentException.ThrowIfNullOrEmpty(deviceId);

-            var existing = _deviceManager.GetDevices(
+            var existing = (await _deviceManager.GetDevices(
                new DeviceQuery
                {
                    DeviceId = deviceId,
                    UserId = user.Id
-                }).Items;
+                }).ConfigureAwait(false)).Items;

            foreach (var auth in existing)
            {
@@ -1801,12 +2127,12 @@ namespace Emby.Server.Implementations.Session

            ArgumentException.ThrowIfNullOrEmpty(accessToken);

-            var existing = _deviceManager.GetDevices(
+            var existing = (await _deviceManager.GetDevices(
                new DeviceQuery
                {
                    Limit = 1,
                    AccessToken = accessToken
-                }).Items;
+                }).ConfigureAwait(false)).Items;

            if (existing.Count > 0)
            {
@@ -1845,10 +2171,10 @@ namespace Emby.Server.Implementations.Session
        {
            CheckDisposed();

-            var existing = _deviceManager.GetDevices(new DeviceQuery
+            var existing = await _deviceManager.GetDevices(new DeviceQuery
            {
                UserId = userId
-            });
+            }).ConfigureAwait(false);

            foreach (var info in existing.Items)
            {
@@ -2045,11 +2371,11 @@ namespace Emby.Server.Implementations.Session
        /// <inheritdoc />
        public async Task<SessionInfo> GetSessionByAuthenticationToken(string token, string deviceId, string remoteEndpoint)
        {
-            var items = _deviceManager.GetDevices(new DeviceQuery
+            var items = (await _deviceManager.GetDevices(new DeviceQuery
            {
                AccessToken = token,
                Limit = 1
-            }).Items;
+            }).ConfigureAwait(false)).Items;

            if (items.Count == 0)
            {
@@ -2060,14 +2386,25 @@ namespace Emby.Server.Implementations.Session
        }

        /// <inheritdoc/>
-        public IReadOnlyList<SessionInfoDto> GetSessions(
+        public async Task<IReadOnlyList<SessionInfoDto>> GetSessions(
            Guid userId,
            string deviceId,
            int? activeWithinSeconds,
            Guid? controllableUserToCheck,
-            bool isApiKey)
+            bool isApiKey,
+            CancellationToken cancellationToken)
        {
-            var result = Sessions;
+            var remote = await GetRemoteEntriesAsync(cancellationToken).ConfigureAwait(false);
+            var ownedElsewhere = remote.Select(entry => entry.Session.Id).ToHashSet(StringComparer.Ordinal);
+
+            // A session this instance only holds a copy of is reported by its owner, whose controllers are
+            // the ones that decide whether it is active and controllable.
+            IEnumerable<SessionInfoDto> result = Sessions
+                .Where(i => !ownedElsewhere.Contains(i.Id))
+                .Select(ToSessionInfoDto)
+                .Concat(remote.Select(entry => entry.Session))
+                .OrderByDescending(i => i.LastActivityDate);
+
            if (!string.IsNullOrEmpty(deviceId))
            {
                result = result.Where(i => string.Equals(i.DeviceId, deviceId, StringComparison.OrdinalIgnoreCase));
@@ -2115,7 +2452,7 @@ namespace Emby.Server.Implementations.Session
                if (!userCanControlOthers)
                {
                    // User cannot control other user's sessions, validate user id.
-                    result = result.Where(i => i.UserId.IsEmpty() || i.ContainsUser(userId));
+                    result = result.Where(i => i.UserId.IsEmpty() || ContainsUser(i, userId));
                }

                result = result.Where(i =>
@@ -2136,7 +2473,7 @@ namespace Emby.Server.Implementations.Session
            else if (!userIsAdmin)
            {
                // Request isn't from administrator, limit to "own" sessions.
-                result = result.Where(i => i.UserId.IsEmpty() || i.ContainsUser(userId));
+                result = result.Where(i => i.UserId.IsEmpty() || ContainsUser(i, userId));
            }

            if (!userIsAdmin)
@@ -2159,7 +2496,18 @@ namespace Emby.Server.Implementations.Session
                result = result.Where(i => i.LastActivityDate >= minActiveDate);
            }

-            return result.Select(ToSessionInfoDto).ToList();
+            return result.ToList();
+        }
+
+        private static bool ContainsUser(SessionInfoDto session, Guid userId)
+        {
+            if (session.UserId.Equals(userId))
+            {
+                return true;
+            }
+
+            return session.AdditionalUsers is not null
+                && session.AdditionalUsers.Any(i => i.UserId.Equals(userId));
        }

        /// <inheritdoc />
@@ -2234,6 +2582,12 @@ namespace Emby.Server.Implementations.Session
                _inactiveTimer = null;
            }

+            if (_directoryTimer is not null)
+            {
+                await _directoryTimer.DisposeAsync().ConfigureAwait(false);
+                _directoryTimer = null;
+            }
+
            await _shutdownCallback.DisposeAsync().ConfigureAwait(false);

            _deviceManager.DeviceOptionsUpdated -= OnDeviceManagerDeviceOptionsUpdated;
@@ -2257,6 +2611,7 @@ namespace Emby.Server.Implementations.Session
            // Close open websockets to allow Kestrel to shut down cleanly
            foreach (var session in _activeConnections.Values)
            {
+                await RemoveFromDirectoryAsync(session).ConfigureAwait(false);
                await session.DisposeAsync().ConfigureAwait(false);
            }

@@ -114,11 +114,11 @@ namespace Emby.Server.Implementations.Session
        public async Task ProcessWebSocketConnectedAsync(IWebSocketConnection connection, HttpContext httpContext)
        {
            var session = await RequestHelpers.GetSession(_sessionManager, _userManager, httpContext).ConfigureAwait(false);
-            EnsureController(session, connection);
+            await EnsureController(session, connection).ConfigureAwait(false);
            await KeepAliveWebSocket(connection).ConfigureAwait(false);
        }

-        private void EnsureController(SessionInfo session, IWebSocketConnection connection)
+        private async Task EnsureController(SessionInfo session, IWebSocketConnection connection)
        {
            var controllerInfo = session.EnsureController<WebSocketController>(
                s => new WebSocketController(_loggerFactory.CreateLogger<WebSocketController>(), s, _sessionManager));
@@ -126,7 +126,7 @@ namespace Emby.Server.Implementations.Session
            var controller = (WebSocketController)controllerInfo.Item1;
            controller.AddWebSocket(connection);

-            _sessionManager.OnSessionControllerConnected(session);
+            await _sessionManager.OnSessionControllerConnected(session).ConfigureAwait(false);
        }

        /// <summary>
@@ -1,6 +1,7 @@
 #nullable disable

 using System;
+using System.Collections.Generic;
 using Jellyfin.Data.Enums;
 using Jellyfin.Database.Implementations.Entities;
 using MediaBrowser.Controller.Entities;
@@ -27,6 +28,12 @@ namespace Emby.Server.Implementations.Sorting
        /// <value>The user manager.</value>
        public IUserManager UserManager { get; set; }

+        /// <summary>
+        /// Gets or sets the prefetched user data.
+        /// </summary>
+        /// <value>The prefetched user data.</value>
+        public IReadOnlyDictionary<Guid, UserItemData> PrefetchedUserData { get; set; }
+
        /// <summary>
        /// Gets or sets the user data manager.
        /// </summary>
@@ -57,7 +64,7 @@ namespace Emby.Server.Implementations.Sorting
        /// <returns>DateTime.</returns>
        private DateTime GetDate(BaseItem x)
        {
-            var userdata = UserDataManager.GetUserData(User, x);
+            var userdata = this.GetUserData(x);

            if (userdata is not null && userdata.LastPlayedDate.HasValue)
            {
@@ -1,6 +1,8 @@
 #nullable disable
 #pragma warning disable CS1591

+using System;
+using System.Collections.Generic;
 using Jellyfin.Data.Enums;
 using Jellyfin.Database.Implementations.Entities;
 using MediaBrowser.Controller.Entities;
@@ -35,6 +37,12 @@ namespace Emby.Server.Implementations.Sorting
        /// <value>The user manager.</value>
        public IUserManager UserManager { get; set; }

+        /// <summary>
+        /// Gets or sets the prefetched user data.
+        /// </summary>
+        /// <value>The prefetched user data.</value>
+        public IReadOnlyDictionary<Guid, UserItemData> PrefetchedUserData { get; set; }
+
        /// <summary>
        /// Compares the specified x.
        /// </summary>
@@ -53,7 +61,7 @@ namespace Emby.Server.Implementations.Sorting
        /// <returns>DateTime.</returns>
        private int GetValue(BaseItem x)
        {
-            return x.IsFavoriteOrLiked(User, userItemData: null) ? 0 : 1;
+            return x.IsFavoriteOrLiked(User, this.GetUserData(x)) ? 0 : 1;
        }
    }
 }
@@ -2,6 +2,8 @@

 #pragma warning disable CS1591

+using System;
+using System.Collections.Generic;
 using Jellyfin.Data.Enums;
 using Jellyfin.Database.Implementations.Entities;
 using MediaBrowser.Controller.Entities;
@@ -36,6 +38,12 @@ namespace Emby.Server.Implementations.Sorting
        /// <value>The user manager.</value>
        public IUserManager UserManager { get; set; }

+        /// <summary>
+        /// Gets or sets the prefetched user data.
+        /// </summary>
+        /// <value>The prefetched user data.</value>
+        public IReadOnlyDictionary<Guid, UserItemData> PrefetchedUserData { get; set; }
+
        /// <summary>
        /// Compares the specified x.
        /// </summary>
@@ -54,7 +62,7 @@ namespace Emby.Server.Implementations.Sorting
        /// <returns>DateTime.</returns>
        private int GetValue(BaseItem x)
        {
-            return x.IsPlayed(User, userItemData: null) ? 0 : 1;
+            return x.IsPlayed(User, this.GetUserData(x)) ? 0 : 1;
        }
    }
 }
@@ -2,6 +2,8 @@

 #pragma warning disable CS1591

+using System;
+using System.Collections.Generic;
 using Jellyfin.Data.Enums;
 using Jellyfin.Database.Implementations.Entities;
 using MediaBrowser.Controller.Entities;
@@ -36,6 +38,12 @@ namespace Emby.Server.Implementations.Sorting
        /// <value>The user manager.</value>
        public IUserManager UserManager { get; set; }

+        /// <summary>
+        /// Gets or sets the prefetched user data.
+        /// </summary>
+        /// <value>The prefetched user data.</value>
+        public IReadOnlyDictionary<Guid, UserItemData> PrefetchedUserData { get; set; }
+
        /// <summary>
        /// Compares the specified x.
        /// </summary>
@@ -54,7 +62,7 @@ namespace Emby.Server.Implementations.Sorting
        /// <returns>DateTime.</returns>
        private int GetValue(BaseItem x)
        {
-            return x.IsUnplayed(User, userItemData: null) ? 0 : 1;
+            return x.IsUnplayed(User, this.GetUserData(x)) ? 0 : 1;
        }
    }
 }
@@ -1,5 +1,7 @@
 #nullable disable

+using System;
+using System.Collections.Generic;
 using Jellyfin.Data.Enums;
 using Jellyfin.Database.Implementations.Entities;
 using MediaBrowser.Controller.Entities;
@@ -38,6 +40,12 @@ namespace Emby.Server.Implementations.Sorting
        /// <value>The user manager.</value>
        public IUserManager UserManager { get; set; }

+        /// <summary>
+        /// Gets or sets the prefetched user data.
+        /// </summary>
+        /// <value>The prefetched user data.</value>
+        public IReadOnlyDictionary<Guid, UserItemData> PrefetchedUserData { get; set; }
+
        /// <summary>
        /// Compares the specified x.
        /// </summary>
@@ -56,7 +64,7 @@ namespace Emby.Server.Implementations.Sorting
        /// <returns>DateTime.</returns>
        private int GetValue(BaseItem x)
        {
-            var userdata = UserDataManager.GetUserData(User, x);
+            var userdata = this.GetUserData(x);

            return userdata is null ? 0 : userdata.PlayCount;
        }
@@ -13,6 +13,7 @@ using MediaBrowser.Controller.Configuration;
 using MediaBrowser.Controller.Dto;
 using MediaBrowser.Controller.Entities;
 using MediaBrowser.Controller.Library;
+using MediaBrowser.Controller.Persistence;
 using MediaBrowser.Controller.TV;
 using MediaBrowser.Model.Querying;
 using Episode = MediaBrowser.Controller.Entities.TV.Episode;
@@ -124,53 +125,100 @@ namespace Emby.Server.Implementations.TV

            var batchResult = _libraryManager.GetNextUpEpisodesBatch(query, seriesKeys, includeSpecials, includeRewatching);

-            var nextUpList = new List<(DateTime LastWatchedDate, Episode Episode)>();
-
+            var results = new List<NextUpEpisodeBatchResult>(seriesKeys.Count);
            foreach (var seriesKey in seriesKeys)
            {
-                if (!batchResult.TryGetValue(seriesKey, out var result))
+                if (batchResult.TryGetValue(seriesKey, out var result))
                {
-                    continue;
+                    results.Add(result);
                }
+            }

-                var nextEpisode = DetermineNextEpisode(result, user, includeSpecials, request.EnableResumable, false);
+            // The selection below tests the played state of every episode it considers, so read the whole
+            // series batch in one query rather than one query per series.
+            var selectionCandidates = new List<BaseItem>();
+            foreach (var result in results)
+            {
+                AddCandidate(selectionCandidates, result.NextUp);
+                AddCandidate(selectionCandidates, result.LastWatched);
+                AddCandidate(selectionCandidates, result.NextPlayedForRewatching);
+                AddCandidate(selectionCandidates, result.LastWatchedForRewatching);

+                if (result.Specials is not null)
+                {
+                    selectionCandidates.AddRange(result.Specials);
+                }
+            }
+
+            var selectionUserData = _userDataManager.GetUserDataBatch(selectionCandidates, user);
+
+            var candidates = new List<NextUpCandidate>();
+            foreach (var result in results)
+            {
+                var nextEpisode = SelectNextEpisode(result, user, includeSpecials, includePlayed: false, selectionUserData);
                if (nextEpisode is not null)
                {
-                    // The last played date and the version that was actually played live on the version item's user data
-                    // The played state propagated to the sibling versions carries no date
-                    var (playedVersion, lastPlayedDate) = GetMostRecentlyPlayedVersion(result.LastWatched, user);
-                    nextEpisode = GetPreferredVersion(nextEpisode, result.LastWatched, playedVersion);
-
-                    DateTime lastWatchedDate = DateTime.MinValue;
-                    if (result.LastWatched is not null)
-                    {
-                        lastWatchedDate = lastPlayedDate ?? DateTime.MinValue.AddDays(1);
-                    }
-
-                    nextUpList.Add((lastWatchedDate, nextEpisode));
+                    candidates.Add(new NextUpCandidate(nextEpisode, result.LastWatched, !request.EnableResumable));
                }

                if (includeRewatching)
                {
-                    var nextPlayedEpisode = DetermineNextEpisodeForRewatching(result, user, includeSpecials);
-
+                    var nextPlayedEpisode = SelectNextEpisode(result, user, includeSpecials, includePlayed: true, selectionUserData);
                    if (nextPlayedEpisode is not null)
                    {
-                        var (playedVersion, lastPlayedDate) = GetMostRecentlyPlayedVersion(result.LastWatchedForRewatching, user);
-                        nextPlayedEpisode = GetPreferredVersion(nextPlayedEpisode, result.LastWatchedForRewatching, playedVersion);
-
-                        DateTime rewatchLastWatchedDate = DateTime.MinValue;
-                        if (result.LastWatchedForRewatching is not null)
-                        {
-                            rewatchLastWatchedDate = lastPlayedDate ?? DateTime.MinValue.AddDays(1);
-                        }
-
-                        nextUpList.Add((rewatchLastWatchedDate, nextPlayedEpisode));
+                        // A rewatch suggestion is dropped once it has been resumed, whatever the request asked for.
+                        candidates.Add(new NextUpCandidate(nextPlayedEpisode, result.LastWatchedForRewatching, true));
                    }
                }
            }

+            // The resume progress may live on an alternate version, so read every version in one query.
+            var episodeVersions = new List<BaseItem>();
+            foreach (var candidate in candidates)
+            {
+                if (candidate.DropWhenResumed)
+                {
+                    candidate.EpisodeVersions = candidate.Episode.GetAllVersions();
+                    episodeVersions.AddRange(candidate.EpisodeVersions);
+                }
+            }
+
+            if (episodeVersions.Count > 0)
+            {
+                var resumeUserData = _userDataManager.GetUserDataBatch(episodeVersions, user);
+                candidates.RemoveAll(candidate => candidate.EpisodeVersions
+                    .Any(version => GetUserData(user, version, resumeUserData)?.PlaybackPositionTicks > 0));
+            }
+
+            // The last played date and the version that was actually played live on the version item's user data
+            // The played state propagated to the sibling versions carries no date
+            var lastWatchedVersions = new List<BaseItem>();
+            foreach (var candidate in candidates)
+            {
+                if (candidate.LastWatched is Video lastWatchedVideo)
+                {
+                    candidate.LastWatchedVersions = lastWatchedVideo.GetAllVersions();
+                    lastWatchedVersions.AddRange(candidate.LastWatchedVersions);
+                }
+            }
+
+            var lastWatchedUserData = _userDataManager.GetUserDataBatch(lastWatchedVersions, user);
+
+            var nextUpList = new List<(DateTime LastWatchedDate, Episode Episode)>(candidates.Count);
+            foreach (var candidate in candidates)
+            {
+                var (playedVersion, lastPlayedDate) = GetMostRecentlyPlayedVersion(candidate.LastWatchedVersions, user, lastWatchedUserData);
+                var nextEpisode = GetPreferredVersion(candidate.Episode, candidate.LastWatched, playedVersion);
+
+                DateTime lastWatchedDate = DateTime.MinValue;
+                if (candidate.LastWatched is not null)
+                {
+                    lastWatchedDate = lastPlayedDate ?? DateTime.MinValue.AddDays(1);
+                }
+
+                nextUpList.Add((lastWatchedDate, nextEpisode));
+            }
+
            var sortedEpisodes = nextUpList
                .OrderByDescending(x => x.LastWatchedDate)
                .Select(x => (BaseItem)x.Episode);
@@ -178,12 +226,25 @@ namespace Emby.Server.Implementations.TV
            return GetResult(sortedEpisodes, request);
        }

-        private Episode? DetermineNextEpisode(
-            MediaBrowser.Controller.Persistence.NextUpEpisodeBatchResult result,
+        private static void AddCandidate(List<BaseItem> candidates, BaseItem? item)
+        {
+            if (item is not null)
+            {
+                candidates.Add(item);
+            }
+        }
+
+        private UserItemData? GetUserData(User user, BaseItem item, IReadOnlyDictionary<Guid, UserItemData> prefetchedUserData)
+            => prefetchedUserData.TryGetValue(item.Id, out var userData)
+                ? userData
+                : _userDataManager.GetUserData(user, item);
+
+        private Episode? SelectNextEpisode(
+            NextUpEpisodeBatchResult result,
            User user,
            bool includeSpecials,
-            bool includeResumable,
-            bool includePlayed)
+            bool includePlayed,
+            IReadOnlyDictionary<Guid, UserItemData> prefetchedUserData)
        {
            var nextEpisode = (includePlayed ? result.NextPlayedForRewatching : result.NextUp) as Episode;
            var lastWatchedEpisode = (includePlayed ? result.LastWatchedForRewatching : result.LastWatched) as Episode;
@@ -217,60 +278,41 @@ namespace Emby.Server.Implementations.TV

                    if (!includePlayed)
                    {
-                        sortedEpisodes = sortedEpisodes.Where(episode => _userDataManager.GetUserData(user, episode) is not { Played: true });
+                        sortedEpisodes = sortedEpisodes.Where(episode => GetUserData(user, episode, prefetchedUserData) is not { Played: true });
                    }

                    nextEpisode = sortedEpisodes.FirstOrDefault();
                }
            }

-            if (nextEpisode is not null && !includeResumable)
-            {
-                // The resume progress may live on an alternate version
-                foreach (var version in nextEpisode.GetAllVersions())
-                {
-                    if (_userDataManager.GetUserData(user, version)?.PlaybackPositionTicks > 0)
-                    {
-                        return null;
-                    }
-                }
-            }
-
            return nextEpisode;
        }

-        private Episode? DetermineNextEpisodeForRewatching(
-            MediaBrowser.Controller.Persistence.NextUpEpisodeBatchResult result,
-            User user,
-            bool includeSpecials)
-        {
-            return DetermineNextEpisode(result, user, includeSpecials, includeResumable: false, includePlayed: true);
-        }
-
        /// <summary>
        /// Gets the version of the last watched episode that was actually played, together with its last played date.
        /// The version that was played carries the most recent LastPlayedDate.
        /// dates.
        /// </summary>
-        /// <param name="lastWatched">The last watched episode (any version).</param>
+        /// <param name="versions">The versions of the last watched episode.</param>
        /// <param name="user">The user.</param>
+        /// <param name="prefetchedUserData">User data read for every version up front.</param>
        /// <returns>The played version and its last played date.</returns>
-        private (Video? PlayedVersion, DateTime? LastPlayedDate) GetMostRecentlyPlayedVersion(BaseItem? lastWatched, User user)
+        private (Video? PlayedVersion, DateTime? LastPlayedDate) GetMostRecentlyPlayedVersion(
+            IReadOnlyList<Video> versions,
+            User user,
+            IReadOnlyDictionary<Guid, UserItemData> prefetchedUserData)
        {
-            if (lastWatched is not Video lastWatchedVideo)
+            if (versions.Count == 0)
            {
                return (null, null);
            }

-            var versions = lastWatchedVideo.GetAllVersions();
-            var userDataByVersion = _userDataManager.GetUserDataBatch(versions, user);
-
            var playedVersion = VersionPlaybackSelector.SelectMostRecentlyPlayed(
                versions,
-                version => userDataByVersion.GetValueOrDefault(version.Id),
+                version => GetUserData(user, version, prefetchedUserData),
                data => data.LastPlayedDate.HasValue);

-            return (playedVersion, playedVersion is null ? null : userDataByVersion[playedVersion.Id].LastPlayedDate);
+            return (playedVersion, playedVersion is null ? null : GetUserData(user, playedVersion, prefetchedUserData)?.LastPlayedDate);
        }

        /// <summary>
@@ -346,5 +388,28 @@ namespace Emby.Server.Implementations.TV
                totalCount,
                items.ToArray());
        }
+
+        /// <summary>
+        /// An episode picked for Next Up, together with the versions its user data is read from.
+        /// </summary>
+        private sealed class NextUpCandidate
+        {
+            public NextUpCandidate(Episode episode, BaseItem? lastWatched, bool dropWhenResumed)
+            {
+                Episode = episode;
+                LastWatched = lastWatched;
+                DropWhenResumed = dropWhenResumed;
+            }
+
+            public Episode Episode { get; }
+
+            public BaseItem? LastWatched { get; }
+
+            public bool DropWhenResumed { get; }
+
+            public IReadOnlyList<Video> EpisodeVersions { get; set; } = [];
+
+            public IReadOnlyList<Video> LastWatchedVersions { get; set; } = [];
+        }
    }
 }
@@ -50,10 +50,10 @@ public class DevicesController : BaseJellyfinApiController
    /// <returns>An <see cref="OkResult"/> containing the list of devices.</returns>
    [HttpGet]
    [ProducesResponseType(StatusCodes.Status200OK)]
-    public ActionResult<QueryResult<DeviceInfoDto>> GetDevices([FromQuery] Guid? userId)
+    public async Task<ActionResult<QueryResult<DeviceInfoDto>>> GetDevices([FromQuery] Guid? userId)
    {
        userId = RequestHelpers.GetUserId(User, userId);
-        return _deviceManager.GetDevicesForUser(userId);
+        return await _deviceManager.GetDevicesForUser(userId).ConfigureAwait(false);
    }

    /// <summary>
@@ -66,9 +66,9 @@ public class DevicesController : BaseJellyfinApiController
    [HttpGet("Info")]
    [ProducesResponseType(StatusCodes.Status200OK)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
-    public ActionResult<DeviceInfoDto> GetDeviceInfo([FromQuery, Required] string id)
+    public async Task<ActionResult<DeviceInfoDto>> GetDeviceInfo([FromQuery, Required] string id)
    {
-        var deviceInfo = _deviceManager.GetDevice(id);
+        var deviceInfo = await _deviceManager.GetDevice(id).ConfigureAwait(false);
        if (deviceInfo is null)
        {
            return NotFound();
@@ -87,9 +87,9 @@ public class DevicesController : BaseJellyfinApiController
    [HttpGet("Options")]
    [ProducesResponseType(StatusCodes.Status200OK)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
-    public ActionResult<DeviceOptionsDto> GetDeviceOptions([FromQuery, Required] string id)
+    public async Task<ActionResult<DeviceOptionsDto>> GetDeviceOptions([FromQuery, Required] string id)
    {
-        var deviceInfo = _deviceManager.GetDeviceOptions(id);
+        var deviceInfo = await _deviceManager.GetDeviceOptions(id).ConfigureAwait(false);
        if (deviceInfo is null)
        {
            return NotFound();
@@ -127,7 +127,12 @@ public class DevicesController : BaseJellyfinApiController
    [ProducesResponseType(StatusCodes.Status400BadRequest)]
    public async Task<ActionResult> DeleteDevice([FromQuery] string[] id)
    {
-        var devices = id.Select(_deviceManager.GetDevice).ToArray();
+        var devices = new List<DeviceInfoDto?>(id.Length);
+        foreach (var deviceId in id)
+        {
+            devices.Add(await _deviceManager.GetDevice(deviceId).ConfigureAwait(false));
+        }
+
        if (devices.Any(f => f is null))
        {
            return BadRequest();
@@ -135,7 +140,7 @@ public class DevicesController : BaseJellyfinApiController

        foreach (var device in devices)
        {
-            var sessions = _deviceManager.GetDevices(new DeviceQuery { DeviceId = device!.Id });
+            var sessions = await _deviceManager.GetDevices(new DeviceQuery { DeviceId = device!.Id }).ConfigureAwait(false);

            foreach (var session in sessions.Items)
            {
@@ -29,6 +29,7 @@ using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;

 namespace Jellyfin.Api.Controllers;

@@ -44,6 +45,8 @@ public class DynamicHlsController : BaseJellyfinApiController
    private const EncoderPreset DefaultEventEncoderPreset = EncoderPreset.superfast;
    private const TranscodingJobType TranscodingJobType = MediaBrowser.Controller.MediaEncoding.TranscodingJobType.Hls;

+    private static readonly string _podIdentity = Environment.GetEnvironmentVariable("JELLYFIN_INSTANCE_ID") ?? Environment.MachineName;
+
    private readonly Version _minFFmpegFlacInMp4 = new Version(6, 0);
    private readonly Version _minFFmpegX265BframeInFmp4 = new Version(7, 0, 1);
    private readonly Version _minFFmpegHlsSegmentOptions = new Version(5, 0);
@@ -60,6 +63,8 @@ public class DynamicHlsController : BaseJellyfinApiController
    private readonly IDynamicHlsPlaylistGenerator _dynamicHlsPlaylistGenerator;
    private readonly DynamicHlsHelper _dynamicHlsHelper;
    private readonly EncodingOptions _encodingOptions;
+    private readonly ITranscodeSessionStore _transcodeSessionStore;
+    private readonly TranscodeStoreOptions _transcodeStoreOptions;

    /// <summary>
    /// Initializes a new instance of the <see cref="DynamicHlsController"/> class.
@@ -75,6 +80,8 @@ public class DynamicHlsController : BaseJellyfinApiController
    /// <param name="dynamicHlsHelper">Instance of <see cref="DynamicHlsHelper"/>.</param>
    /// <param name="encodingHelper">Instance of <see cref="EncodingHelper"/>.</param>
    /// <param name="dynamicHlsPlaylistGenerator">Instance of <see cref="IDynamicHlsPlaylistGenerator"/>.</param>
+    /// <param name="transcodeSessionStore">Instance of the <see cref="ITranscodeSessionStore"/> interface used to register and renew HLS transcoding session leases in the durable store.</param>
+    /// <param name="transcodeStoreOptions">The <see cref="TranscodeStoreOptions"/> holding the session lease duration.</param>
    public DynamicHlsController(
        ILibraryManager libraryManager,
        IUserManager userManager,
@@ -86,7 +93,9 @@ public class DynamicHlsController : BaseJellyfinApiController
        ILogger<DynamicHlsController> logger,
        DynamicHlsHelper dynamicHlsHelper,
        EncodingHelper encodingHelper,
-        IDynamicHlsPlaylistGenerator dynamicHlsPlaylistGenerator)
+        IDynamicHlsPlaylistGenerator dynamicHlsPlaylistGenerator,
+        ITranscodeSessionStore transcodeSessionStore,
+        IOptions<TranscodeStoreOptions> transcodeStoreOptions)
    {
        _libraryManager = libraryManager;
        _userManager = userManager;
@@ -99,6 +108,8 @@ public class DynamicHlsController : BaseJellyfinApiController
        _dynamicHlsHelper = dynamicHlsHelper;
        _encodingHelper = encodingHelper;
        _dynamicHlsPlaylistGenerator = dynamicHlsPlaylistGenerator;
+        _transcodeSessionStore = transcodeSessionStore;
+        _transcodeStoreOptions = transcodeStoreOptions.Value;

        _encodingOptions = serverConfigurationManager.GetEncodingOptions();
    }
@@ -306,15 +317,24 @@ public class DynamicHlsController : BaseJellyfinApiController
                    // If the playlist doesn't already exist, startup ffmpeg
                    try
                    {
+                        var isHaMode = await IsHaTakeoverAsync(playSessionId, cancellationToken).ConfigureAwait(false);
+
                        job = await _transcodeManager.StartFfMpeg(
                                state,
                                playlistPath,
-                                GetCommandLineArguments(playlistPath, state, true, 0),
+                                GetCommandLineArguments(playlistPath, state, true, 0, isHaMode),
                                Request.HttpContext.User.GetUserId(),
                                TranscodingJobType,
                                cancellationTokenSource)
                            .ConfigureAwait(false);
                        job.IsLiveOutput = true;
+                        await RegisterTranscodeSessionAsync(
+                                playSessionId ?? string.Empty,
+                                mediaSourceId ?? string.Empty,
+                                playlistPath,
+                                cancellationToken)
+                            .ConfigureAwait(false);
+                        StartLeaseRenewal(playSessionId ?? string.Empty, cancellationToken);
                    }
                    catch
                    {
@@ -1511,14 +1531,23 @@ public class DynamicHlsController : BaseJellyfinApiController

                    streamingRequest.StartTimeTicks = streamingRequest.CurrentRuntimeTicks;

+                    var isHaMode = await IsHaTakeoverAsync(streamingRequest.PlaySessionId, cancellationToken).ConfigureAwait(false);
+
                    state.WaitForPath = segmentPath;
                    job = await _transcodeManager.StartFfMpeg(
                        state,
                        playlistPath,
-                        GetCommandLineArguments(playlistPath, state, false, segmentId),
+                        GetCommandLineArguments(playlistPath, state, false, segmentId, isHaMode),
                        Request.HttpContext.User.GetUserId(),
                        TranscodingJobType,
                        cancellationTokenSource).ConfigureAwait(false);
+                    await RegisterTranscodeSessionAsync(
+                            streamingRequest.PlaySessionId ?? string.Empty,
+                            streamingRequest.MediaSourceId ?? string.Empty,
+                            playlistPath,
+                            cancellationToken)
+                        .ConfigureAwait(false);
+                    StartLeaseRenewal(streamingRequest.PlaySessionId ?? string.Empty, cancellationToken);
                }
                catch
                {
@@ -1543,6 +1572,31 @@ public class DynamicHlsController : BaseJellyfinApiController
        }
    }

+    /// <summary>
+    /// Gets the segment length ffmpeg is told to use. HA mode shortens segments so a takeover pod
+    /// has to re-encode less; the configured value is user-editable so it is clamped.
+    /// </summary>
+    /// <param name="isHaMode">Whether the session is being resumed from the durable store.</param>
+    /// <param name="requestedSegmentLength">The segment length requested by the streaming pipeline.</param>
+    /// <param name="encodingOptions">The encoding options holding the recovery segment length.</param>
+    /// <returns>The segment length in seconds.</returns>
+    internal static int GetEffectiveSegmentLength(bool isHaMode, int requestedSegmentLength, EncodingOptions encodingOptions)
+        => isHaMode
+            ? Math.Clamp(encodingOptions.RecoverySegmentLengthSeconds, 1, 6)
+            : requestedSegmentLength;
+
+    /// <summary>
+    /// Gets the ffmpeg <c>hls_list_size</c>. HA mode keeps a bounded rolling buffer; 0 (unbounded)
+    /// otherwise.
+    /// </summary>
+    /// <param name="isHaMode">Whether the session is being resumed from the durable store.</param>
+    /// <param name="encodingOptions">The encoding options holding the recovery buffer count.</param>
+    /// <returns>The number of segments to keep in the playlist, or 0 for all of them.</returns>
+    internal static int GetHlsListSize(bool isHaMode, EncodingOptions encodingOptions)
+        => isHaMode
+            ? Math.Clamp(encodingOptions.RecoverySegmentBufferCount, 2, 10)
+            : 0;
+
    internal static async Task WaitForActiveTranscodingRequests(TranscodingJob? job, CancellationToken cancellationToken)
    {
        while (job?.ActiveRequestCount > 0)
@@ -1554,6 +1608,116 @@ public class DynamicHlsController : BaseJellyfinApiController
    private static double[] GetSegmentLengths(StreamState state)
        => GetSegmentLengthsInternal(state.RunTimeTicks ?? 0, state.SegmentLength);

+    /// <summary>
+    /// Determines whether the play session is already present in the durable store, which means
+    /// another pod owned it and this request is resuming it after a failover.
+    /// </summary>
+    private async Task<bool> IsHaTakeoverAsync(string? playSessionId, CancellationToken cancellationToken)
+    {
+        if (string.IsNullOrEmpty(playSessionId))
+        {
+            return false;
+        }
+
+        try
+        {
+            return await _transcodeSessionStore.TryGetAsync(playSessionId, cancellationToken).ConfigureAwait(false) is not null;
+        }
+        catch (Exception ex)
+        {
+            _logger.LogWarning(ex, "Failed to check HA mode for session {PlaySessionId}.", playSessionId);
+            return false;
+        }
+    }
+
+    /// <summary>
+    /// Builds the durable record for an HLS output owned by this instance. The manifest and segment
+    /// paths have to be real, otherwise <c>DeleteTranscodeFileTask</c> cannot tell which files
+    /// belong to a live session.
+    /// </summary>
+    /// <param name="playSessionId">The play session identifier.</param>
+    /// <param name="mediaSourceId">The media source identifier.</param>
+    /// <param name="playlistPath">The absolute path of the HLS playlist this instance is writing.</param>
+    /// <param name="leaseDuration">The initial lease duration.</param>
+    /// <returns>The session record to store.</returns>
+    internal static TranscodeSession CreateSessionRecord(string playSessionId, string mediaSourceId, string playlistPath, TimeSpan leaseDuration)
+        => TranscodeSession.CreateForPlaylist(playSessionId, mediaSourceId, _podIdentity, playlistPath, leaseDuration);
+
+    private async Task RegisterTranscodeSessionAsync(string playSessionId, string mediaSourceId, string playlistPath, CancellationToken cancellationToken)
+    {
+        try
+        {
+            var session = CreateSessionRecord(
+                playSessionId,
+                mediaSourceId,
+                playlistPath,
+                TimeSpan.FromSeconds(_transcodeStoreOptions.LeaseDurationSeconds));
+            await _transcodeSessionStore.SetAsync(session, cancellationToken).ConfigureAwait(false);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogWarning(ex, "Failed to register HLS session {PlaySessionId} in durable store.", playSessionId);
+        }
+    }
+
+    private void StartLeaseRenewal(string playSessionId, CancellationToken cancellationToken)
+    {
+        var renewalInterval = TimeSpan.FromSeconds(Math.Max(1, _transcodeStoreOptions.LeaseDurationSeconds / 3));
+
+        _ = Task.Run(
+            async () =>
+            {
+                var ownsLease = true;
+                try
+                {
+                    while (!cancellationToken.IsCancellationRequested)
+                    {
+                        try
+                        {
+                            await Task.Delay(renewalInterval, cancellationToken).ConfigureAwait(false);
+                        }
+                        catch (OperationCanceledException)
+                        {
+                            break;
+                        }
+
+                        try
+                        {
+                            if (!await _transcodeSessionStore.RenewLeaseAsync(playSessionId, _podIdentity, cancellationToken).ConfigureAwait(false))
+                            {
+                                // Another pod owns the session now; its record must not be touched.
+                                ownsLease = false;
+                                break;
+                            }
+                        }
+                        catch (Exception ex)
+                        {
+                            _logger.LogWarning(ex, "Failed to renew lease for HLS session {PlaySessionId}.", playSessionId);
+                        }
+                    }
+                }
+                catch (Exception ex)
+                {
+                    _logger.LogWarning(ex, "Lease renewal loop for HLS session {PlaySessionId} encountered an unexpected error.", playSessionId);
+                }
+                finally
+                {
+                    if (ownsLease)
+                    {
+                        try
+                        {
+                            await _transcodeSessionStore.DeleteAsync(playSessionId, CancellationToken.None).ConfigureAwait(false);
+                        }
+                        catch (Exception ex)
+                        {
+                            _logger.LogWarning(ex, "Failed to delete HLS session {PlaySessionId} from durable store.", playSessionId);
+                        }
+                    }
+                }
+            },
+            CancellationToken.None);
+    }
+
    internal static double[] GetSegmentLengthsInternal(long runtimeTicks, int segmentlength)
    {
        var segmentLengthTicks = TimeSpan.FromSeconds(segmentlength).Ticks;
@@ -1575,7 +1739,7 @@ public class DynamicHlsController : BaseJellyfinApiController
        return segments;
    }

-    private string GetCommandLineArguments(string outputPath, StreamState state, bool isEventPlaylist, int startNumber)
+    private string GetCommandLineArguments(string outputPath, StreamState state, bool isEventPlaylist, int startNumber, bool isHaMode = false)
    {
        var videoCodec = _encodingHelper.GetVideoEncoder(state, _encodingOptions);
        var threads = EncodingHelper.GetNumberOfThreads(state, _encodingOptions, videoCodec);
@@ -1588,10 +1752,13 @@ public class DynamicHlsController : BaseJellyfinApiController
        var outputExtension = EncodingHelper.GetSegmentFileExtension(state.Request.SegmentContainer);
        var outputTsArg = outputPrefix + "%d" + outputExtension;

+        var effectiveSegmentLength = GetEffectiveSegmentLength(isHaMode, state.SegmentLength, _encodingOptions);
+        var hlsListSize = GetHlsListSize(isHaMode, _encodingOptions);
+
        var segmentFormat = string.Empty;
        var segmentContainer = outputExtension.TrimStart('.');
        var inputModifier = _encodingHelper.GetInputModifier(state, _encodingOptions, segmentContainer);
-        var hlsArguments = $"-hls_playlist_type {(isEventPlaylist ? "event" : "vod")} -hls_list_size 0";
+        var hlsArguments = $"-hls_playlist_type {(isEventPlaylist ? "event" : "vod")} -hls_list_size {hlsListSize}";

        if (string.Equals(segmentContainer, "ts", StringComparison.OrdinalIgnoreCase))
        {
@@ -1644,10 +1811,10 @@ public class DynamicHlsController : BaseJellyfinApiController
            _encodingHelper.GetInputArgument(state, _encodingOptions, segmentContainer),
            threads,
            mapArgs,
-            GetVideoArguments(state, startNumber, isEventPlaylist, segmentContainer),
+            GetVideoArguments(state, startNumber, isEventPlaylist, segmentContainer, effectiveSegmentLength),
            GetAudioArguments(state),
            maxMuxingQueueSize,
-            state.SegmentLength.ToString(CultureInfo.InvariantCulture),
+            effectiveSegmentLength.ToString(CultureInfo.InvariantCulture),
            segmentFormat,
            startNumber.ToString(CultureInfo.InvariantCulture),
            baseUrlParam,
@@ -1784,8 +1951,9 @@ public class DynamicHlsController : BaseJellyfinApiController
    /// <param name="startNumber">The first number in the hls sequence.</param>
    /// <param name="isEventPlaylist">Whether the playlist is EVENT or VOD.</param>
    /// <param name="segmentContainer">The segment container.</param>
+    /// <param name="segmentLength">The effective segment length in seconds (overrides <see cref="StreamState.SegmentLength"/> when HA mode is active).</param>
    /// <returns>The command line arguments for video transcoding.</returns>
-    private string GetVideoArguments(StreamState state, int startNumber, bool isEventPlaylist, string segmentContainer)
+    private string GetVideoArguments(StreamState state, int startNumber, bool isEventPlaylist, string segmentContainer, int? segmentLength = null)
    {
        if (state.VideoStream is null)
        {
@@ -1860,7 +2028,7 @@ public class DynamicHlsController : BaseJellyfinApiController
            args += _encodingHelper.GetVideoQualityParam(state, codec, _encodingOptions, isEventPlaylist ? DefaultEventEncoderPreset : DefaultVodEncoderPreset);

            // Set the key frame params for video encoding to match the hls segment time.
-            args += _encodingHelper.GetHlsVideoKeyFrameArguments(state, codec, state.SegmentLength, isEventPlaylist, startNumber);
+            args += _encodingHelper.GetHlsVideoKeyFrameArguments(state, codec, segmentLength ?? state.SegmentLength, isEventPlaylist, startNumber);

            // Currently b-frames in libx265 breaks the FMP4-HLS playback on iOS, disable it for now.
            if (string.Equals(codec, "libx265", StringComparison.OrdinalIgnoreCase)
@@ -52,18 +52,19 @@ public class SessionController : BaseJellyfinApiController
    [HttpGet("Sessions")]
    [Authorize]
    [ProducesResponseType(StatusCodes.Status200OK)]
-    public ActionResult<IReadOnlyList<SessionInfoDto>> GetSessions(
+    public async Task<ActionResult<IReadOnlyList<SessionInfoDto>>> GetSessions(
        [FromQuery] Guid? controllableByUserId,
        [FromQuery] string? deviceId,
        [FromQuery] int? activeWithinSeconds)
    {
        Guid? controllableUserToCheck = controllableByUserId is null ? null : RequestHelpers.GetUserId(User, controllableByUserId);
-        var result = _sessionManager.GetSessions(
+        var result = await _sessionManager.GetSessions(
            User.GetUserId(),
            deviceId,
            activeWithinSeconds,
            controllableUserToCheck,
-            User.GetIsApiKey());
+            User.GetIsApiKey(),
+            HttpContext.RequestAborted).ConfigureAwait(false);

        return Ok(result);
    }
@@ -310,10 +311,10 @@ public class SessionController : BaseJellyfinApiController
        [FromRoute, Required] string sessionId,
        [FromRoute, Required] Guid userId)
    {
-        _sessionManager.AddAdditionalUser(
+        await _sessionManager.AddAdditionalUser(
            await RequestHelpers.GetSessionId(_sessionManager, _userManager, HttpContext).ConfigureAwait(false),
            sessionId,
-            userId);
+            userId).ConfigureAwait(false);
        return NoContent();
    }

@@ -331,10 +332,10 @@ public class SessionController : BaseJellyfinApiController
        [FromRoute, Required] string sessionId,
        [FromRoute, Required] Guid userId)
    {
-        _sessionManager.RemoveAdditionalUser(
+        await _sessionManager.RemoveAdditionalUser(
            await RequestHelpers.GetSessionId(_sessionManager, _userManager, HttpContext).ConfigureAwait(false),
            sessionId,
-            userId);
+            userId).ConfigureAwait(false);
        return NoContent();
    }

@@ -108,7 +108,7 @@ public class TvShowsController : BaseJellyfinApiController
                StartIndex = startIndex,
                User = user,
                EnableTotalRecordCount = enableTotalRecordCount,
-                NextUpDateCutoff = nextUpDateCutoff ?? DateTime.MinValue,
+                NextUpDateCutoff = nextUpDateCutoff?.ToUniversalTime() ?? DateTime.SpecifyKind(DateTime.MinValue, DateTimeKind.Utc),
                EnableResumable = enableResumable,
                EnableRewatching = enableRewatching
            },
@@ -31,8 +31,6 @@ namespace Jellyfin.Server.Implementations.Devices
        private readonly IDbContextFactory<JellyfinDbContext> _dbProvider;
        private readonly IUserManager _userManager;
        private readonly ConcurrentDictionary<string, ClientCapabilities> _capabilitiesMap = new();
-        private readonly ConcurrentDictionary<int, Device> _devices;
-        private readonly ConcurrentDictionary<string, DeviceOptions> _deviceOptions;

        /// <summary>
        /// Initializes a new instance of the <see cref="DeviceManager"/> class.
@@ -43,23 +41,6 @@ namespace Jellyfin.Server.Implementations.Devices
        {
            _dbProvider = dbProvider;
            _userManager = userManager;
-            _devices = new ConcurrentDictionary<int, Device>();
-            _deviceOptions = new ConcurrentDictionary<string, DeviceOptions>();
-
-            using var dbContext = _dbProvider.CreateDbContext();
-            foreach (var device in dbContext.Devices
-                         .OrderBy(d => d.Id)
-                         .AsEnumerable())
-            {
-                _devices.TryAdd(device.Id, device);
-            }
-
-            foreach (var deviceOption in dbContext.DeviceOptions
-                         .OrderBy(d => d.Id)
-                         .AsEnumerable())
-            {
-                _deviceOptions.TryAdd(deviceOption.DeviceId, deviceOption);
-            }
        }

        /// <inheritdoc />
@@ -89,8 +70,6 @@ namespace Jellyfin.Server.Implementations.Devices
                await dbContext.SaveChangesAsync().ConfigureAwait(false);
            }

-            _deviceOptions[deviceId] = deviceOptions;
-
            DeviceOptionsUpdated?.Invoke(this, new GenericEventArgs<Tuple<string, DeviceOptions>>(new Tuple<string, DeviceOptions>(deviceId, deviceOptions)));
        }

@@ -102,21 +81,24 @@ namespace Jellyfin.Server.Implementations.Devices
            {
                dbContext.Devices.Add(device);
                await dbContext.SaveChangesAsync().ConfigureAwait(false);
-                _devices.TryAdd(device.Id, device);
            }

            return device;
        }

        /// <inheritdoc />
-        public DeviceOptionsDto? GetDeviceOptions(string deviceId)
+        public async Task<DeviceOptionsDto?> GetDeviceOptions(string deviceId)
        {
-            if (_deviceOptions.TryGetValue(deviceId, out var deviceOptions))
+            var dbContext = await _dbProvider.CreateDbContextAsync().ConfigureAwait(false);
+            await using (dbContext.ConfigureAwait(false))
            {
-                return ToDeviceOptionsDto(deviceOptions);
-            }
+                var deviceOptions = await dbContext.DeviceOptions
+                    .AsNoTracking()
+                    .FirstOrDefaultAsync(dev => dev.DeviceId == deviceId)
+                    .ConfigureAwait(false);

-            return null;
+                return deviceOptions is null ? null : ToDeviceOptionsDto(deviceOptions);
+            }
        }

        /// <inheritdoc />
@@ -133,43 +115,79 @@ namespace Jellyfin.Server.Implementations.Devices
        }

        /// <inheritdoc />
-        public DeviceInfoDto? GetDevice(string id)
+        public async Task<DeviceInfoDto?> GetDevice(string id)
        {
-            var device = _devices.Values.Where(d => d.DeviceId == id).OrderByDescending(d => d.DateLastActivity).FirstOrDefault();
-            _deviceOptions.TryGetValue(id, out var deviceOption);
+            var dbContext = await _dbProvider.CreateDbContextAsync().ConfigureAwait(false);
+            await using (dbContext.ConfigureAwait(false))
+            {
+                var device = await dbContext.Devices
+                    .AsNoTracking()
+                    .Where(d => d.DeviceId == id)
+                    .OrderByDescending(d => d.DateLastActivity)
+                    .FirstOrDefaultAsync()
+                    .ConfigureAwait(false);

-            var deviceInfo = device is null ? null : ToDeviceInfo(device, deviceOption);
-            return deviceInfo is null ? null : ToDeviceInfoDto(deviceInfo);
+                if (device is null)
+                {
+                    return null;
+                }
+
+                var deviceOption = await dbContext.DeviceOptions
+                    .AsNoTracking()
+                    .FirstOrDefaultAsync(dev => dev.DeviceId == id)
+                    .ConfigureAwait(false);
+
+                return ToDeviceInfoDto(ToDeviceInfo(device, deviceOption));
+            }
        }

        /// <inheritdoc />
-        public QueryResult<Device> GetDevices(DeviceQuery query)
+        public async Task<QueryResult<Device>> GetDevices(DeviceQuery query)
        {
-            IEnumerable<Device> devices = _devices.Values
-                .Where(device => !query.UserId.HasValue || device.UserId.Equals(query.UserId.Value))
-                .Where(device => query.DeviceId is null || device.DeviceId == query.DeviceId)
-                .Where(device => query.AccessToken is null || device.AccessToken == query.AccessToken)
-                .OrderBy(d => d.Id)
-                .ToList();
-            var count = devices.Count();
-
-            if (query.Skip.HasValue)
+            var dbContext = await _dbProvider.CreateDbContextAsync().ConfigureAwait(false);
+            await using (dbContext.ConfigureAwait(false))
            {
-                devices = devices.Skip(query.Skip.Value);
-            }
+                IQueryable<Device> filtered = dbContext.Devices.AsNoTracking();

-            if (query.Limit.HasValue && query.Limit.Value > 0)
-            {
-                devices = devices.Take(query.Limit.Value);
-            }
+                if (query.UserId.HasValue)
+                {
+                    filtered = filtered.Where(device => device.UserId.Equals(query.UserId.Value));
+                }

-            return new QueryResult<Device>(query.Skip, count, devices.ToList());
+                if (query.DeviceId is not null)
+                {
+                    filtered = filtered.Where(device => device.DeviceId == query.DeviceId);
+                }
+
+                if (query.AccessToken is not null)
+                {
+                    filtered = filtered.Where(device => device.AccessToken == query.AccessToken);
+                }
+
+                // Every filter is an exact match on an indexed column and the table holds one row per
+                // user and device, so paging the materialised set costs less than a second round trip.
+                var matched = await filtered.OrderBy(d => d.Id).ToListAsync().ConfigureAwait(false);
+
+                IEnumerable<Device> devices = matched;
+
+                if (query.Skip.HasValue)
+                {
+                    devices = devices.Skip(query.Skip.Value);
+                }
+
+                if (query.Limit.HasValue && query.Limit.Value > 0)
+                {
+                    devices = devices.Take(query.Limit.Value);
+                }
+
+                return new QueryResult<Device>(query.Skip, matched.Count, devices.ToList());
+            }
        }

        /// <inheritdoc />
-        public QueryResult<DeviceInfo> GetDeviceInfos(DeviceQuery query)
+        public async Task<QueryResult<DeviceInfo>> GetDeviceInfos(DeviceQuery query)
        {
-            var devices = GetDevices(query);
+            var devices = await GetDevices(query).ConfigureAwait(false);

            return new QueryResult<DeviceInfo>(
                devices.StartIndex,
@@ -178,38 +196,49 @@ namespace Jellyfin.Server.Implementations.Devices
        }

        /// <inheritdoc />
-        public QueryResult<DeviceInfoDto> GetDevicesForUser(Guid? userId)
+        public async Task<QueryResult<DeviceInfoDto>> GetDevicesForUser(Guid? userId)
        {
-            IEnumerable<Device> devices = _devices.Values
-                .OrderByDescending(d => d.DateLastActivity)
-                .ThenBy(d => d.DeviceId);
-
-            if (!userId.IsNullOrEmpty())
+            var dbContext = await _dbProvider.CreateDbContextAsync().ConfigureAwait(false);
+            await using (dbContext.ConfigureAwait(false))
            {
-                var user = _userManager.GetUserById(userId.Value);
-                if (user is null)
+                IEnumerable<Device> devices = await dbContext.Devices
+                    .AsNoTracking()
+                    .OrderByDescending(d => d.DateLastActivity)
+                    .ThenBy(d => d.DeviceId)
+                    .ToListAsync()
+                    .ConfigureAwait(false);
+
+                if (!userId.IsNullOrEmpty())
                {
-                    throw new ResourceNotFoundException();
+                    var user = _userManager.GetUserById(userId.Value);
+                    if (user is null)
+                    {
+                        throw new ResourceNotFoundException();
+                    }
+
+                    devices = devices.Where(i => CanAccessDevice(user, i.DeviceId));
                }

-                devices = devices.Where(i => CanAccessDevice(user, i.DeviceId));
+                var options = await dbContext.DeviceOptions
+                    .AsNoTracking()
+                    .ToDictionaryAsync(dev => dev.DeviceId)
+                    .ConfigureAwait(false);
+
+                var array = devices.Select(device =>
+                    {
+                        options.TryGetValue(device.DeviceId, out var option);
+                        return ToDeviceInfo(device, option);
+                    })
+                    .Select(ToDeviceInfoDto)
+                    .ToArray();
+
+                return new QueryResult<DeviceInfoDto>(array);
            }
-
-            var array = devices.Select(device =>
-                {
-                    _deviceOptions.TryGetValue(device.DeviceId, out var option);
-                    return ToDeviceInfo(device, option);
-                })
-                .Select(ToDeviceInfoDto)
-                .ToArray();
-
-            return new QueryResult<DeviceInfoDto>(array);
        }

        /// <inheritdoc />
        public async Task DeleteDevice(Device device)
        {
-            _devices.TryRemove(device.Id, out _);
            var dbContext = await _dbProvider.CreateDbContextAsync().ConfigureAwait(false);
            await using (dbContext.ConfigureAwait(false))
            {
@@ -229,8 +258,6 @@ namespace Jellyfin.Server.Implementations.Devices
                dbContext.Devices.Update(device);
                await dbContext.SaveChangesAsync().ConfigureAwait(false);
            }
-
-            _devices[device.Id] = device;
        }

        /// <inheritdoc />
@@ -6,12 +6,14 @@ using System.Reflection;
 using Jellyfin.Database.Implementations;
 using Jellyfin.Database.Implementations.DbConfiguration;
 using Jellyfin.Database.Implementations.Locking;
+using Jellyfin.Database.Providers.PostgreSQL;
 using Jellyfin.Database.Providers.Sqlite;
 using MediaBrowser.Common.Configuration;
 using MediaBrowser.Controller.Configuration;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
+using Npgsql;
 using JellyfinDbProviderFactory = System.Func<System.IServiceProvider, Jellyfin.Database.Implementations.IJellyfinDatabaseProvider>;

 namespace Jellyfin.Server.Implementations.Extensions;
@@ -24,6 +26,13 @@ public static class ServiceCollectionExtensions
    private static IEnumerable<Type> DatabaseProviderTypes()
    {
        yield return typeof(SqliteDatabaseProvider);
+        yield return typeof(PostgreSqlDatabaseProvider);
+    }
+
+    private static int GetPoolOption(IEnumerable<CustomDatabaseOption>? options, string key, int defaultValue)
+    {
+        var value = options?.FirstOrDefault(o => o.Key.Equals(key, StringComparison.OrdinalIgnoreCase))?.Value;
+        return int.TryParse(value, out var parsed) ? parsed : defaultValue;
    }

    private static IDictionary<string, JellyfinDbProviderFactory> GetSupportedDbProviders()
@@ -123,6 +132,50 @@ public static class ServiceCollectionExtensions

        serviceCollection.AddSingleton<IJellyfinDatabaseProvider>(providerFactory!);

+        if (efCoreConfiguration.DatabaseType.Equals("Jellyfin-PostgreSQL", StringComparison.OrdinalIgnoreCase))
+        {
+            serviceCollection.AddSingleton<NpgsqlDataSource>(static sp =>
+            {
+                var config = sp.GetRequiredService<IServerConfigurationManager>().GetConfiguration<DatabaseConfigurationOptions>("database");
+                var options = config.CustomProviderOptions?.Options;
+
+                var connectionString =
+                    Environment.GetEnvironmentVariable("POSTGRES_CONNECTION_STRING")
+                    ?? options
+                        ?.FirstOrDefault(o => o.Key.Equals("ConnectionString", StringComparison.OrdinalIgnoreCase))
+                        ?.Value
+                    ?? config.CustomProviderOptions?.ConnectionString
+                    ?? throw new InvalidOperationException(
+                        "No PostgreSQL connection string found. Set the POSTGRES_CONNECTION_STRING environment variable, " +
+                        "or provide it via CustomProviderOptions.Options[\"ConnectionString\"] or CustomProviderOptions.ConnectionString.");
+
+                // Support postgresql:// / postgres:// URI format (e.g. DATABASE_URL convention).
+                // NpgsqlDataSourceBuilder requires ADO.NET key=value format; convert if needed.
+                if (connectionString.StartsWith("postgresql://", StringComparison.OrdinalIgnoreCase)
+                    || connectionString.StartsWith("postgres://", StringComparison.OrdinalIgnoreCase))
+                {
+                    var uri = new Uri(connectionString);
+                    var userInfoParts = uri.UserInfo.Split(':', 2);
+                    connectionString = new NpgsqlConnectionStringBuilder
+                    {
+                        Host = uri.Host,
+                        Port = uri.Port > 0 ? uri.Port : 5432,
+                        Database = uri.AbsolutePath.TrimStart('/'),
+                        Username = userInfoParts.Length > 0 ? Uri.UnescapeDataString(userInfoParts[0]) : null,
+                        Password = userInfoParts.Length > 1 ? Uri.UnescapeDataString(userInfoParts[1]) : null,
+                    }.ToString();
+                }
+
+                var dataSourceBuilder = new NpgsqlDataSourceBuilder(connectionString);
+
+                dataSourceBuilder.ConnectionStringBuilder.MinPoolSize = GetPoolOption(options, "MinPoolSize", 2);
+                dataSourceBuilder.ConnectionStringBuilder.MaxPoolSize = GetPoolOption(options, "MaxPoolSize", 20);
+                dataSourceBuilder.ConnectionStringBuilder.CommandTimeout = GetPoolOption(options, "CommandTimeout", 30);
+
+                return dataSourceBuilder.Build();
+            });
+        }
+
        switch (efCoreConfiguration.LockingBehavior)
        {
            case DatabaseLockingBehaviorTypes.NoLock:
@@ -219,9 +219,11 @@ public sealed partial class BaseItemRepository
        }
        else
        {
+            // The representative is the row no other row in its group sorts before, not MIN(Id):
+            // PostgreSQL has no min(uuid) aggregate, while comparing two uuids is supported everywhere.
            representativeIds = masterQuery
-                .GroupBy(e => e.PresentationUniqueKey)
-                .Select(g => g.Min(e => e.Id))
+                .Where(e => !masterQuery.Any(o => o.PresentationUniqueKey == e.PresentationUniqueKey && o.Id.CompareTo(e.Id) < 0))
+                .Select(e => e.Id)
                .ToList();
        }

@@ -96,22 +96,36 @@ public sealed partial class BaseItemRepository
        // primary version (PrimaryVersionId is null) so detail pages and actions target it instead
        // of an arbitrary alternate. Keep the grouped ids as an IQueryable sub-select; materializing
        // to a List would inline one bound parameter per id and hit SQLite's variable cap.
+        // The representative is the row no other row in its group sorts before, not MIN(Id):
+        // PostgreSQL has no min(uuid) aggregate, while comparing two uuids is supported everywhere.
+        // The anti-join reads the filtered set twice, so it has to close over a local that the
+        // reassignment below cannot reach - capturing dbQuery itself makes the tree self-referential.
+        var candidates = dbQuery;
        var enableGroupByPresentationUniqueKey = EnableGroupByPresentationUniqueKey(filter);
        if (enableGroupByPresentationUniqueKey && filter.GroupBySeriesPresentationUniqueKey)
        {
-            var groupedIds = dbQuery.GroupBy(e => new { e.PresentationUniqueKey, e.SeriesPresentationUniqueKey })
-                .Select(g => g.Where(e => e.PrimaryVersionId == null).Min(e => (Guid?)e.Id) ?? g.Min(e => (Guid?)e.Id));
+            var groupedIds = candidates
+                .Where(e => !candidates.Any(o => o.PresentationUniqueKey == e.PresentationUniqueKey
+                    && o.SeriesPresentationUniqueKey == e.SeriesPresentationUniqueKey
+                    && ((o.PrimaryVersionId == null && e.PrimaryVersionId != null)
+                        || ((o.PrimaryVersionId == null) == (e.PrimaryVersionId == null) && o.Id.CompareTo(e.Id) < 0))))
+                .Select(e => e.Id);
            dbQuery = context.BaseItems.AsNoTracking().Where(e => groupedIds.Contains(e.Id));
        }
        else if (enableGroupByPresentationUniqueKey)
        {
-            var groupedIds = dbQuery.GroupBy(e => e.PresentationUniqueKey)
-                .Select(g => g.Where(e => e.PrimaryVersionId == null).Min(e => (Guid?)e.Id) ?? g.Min(e => (Guid?)e.Id));
+            var groupedIds = candidates
+                .Where(e => !candidates.Any(o => o.PresentationUniqueKey == e.PresentationUniqueKey
+                    && ((o.PrimaryVersionId == null && e.PrimaryVersionId != null)
+                        || ((o.PrimaryVersionId == null) == (e.PrimaryVersionId == null) && o.Id.CompareTo(e.Id) < 0))))
+                .Select(e => e.Id);
            dbQuery = context.BaseItems.AsNoTracking().Where(e => groupedIds.Contains(e.Id));
        }
        else if (filter.GroupBySeriesPresentationUniqueKey)
        {
-            var groupedIds = dbQuery.GroupBy(e => e.SeriesPresentationUniqueKey).Select(e => e.Min(x => x.Id));
+            var groupedIds = candidates
+                .Where(e => !candidates.Any(o => o.SeriesPresentationUniqueKey == e.SeriesPresentationUniqueKey && o.Id.CompareTo(e.Id) < 0))
+                .Select(e => e.Id);
            dbQuery = context.BaseItems.AsNoTracking().Where(e => groupedIds.Contains(e.Id));
        }
        else
@@ -35,6 +35,7 @@
    <ProjectReference Include="..\MediaBrowser.Controller\MediaBrowser.Controller.csproj" />
    <ProjectReference Include="..\MediaBrowser.Model\MediaBrowser.Model.csproj" />
    <ProjectReference Include="..\src\Jellyfin.Database\Jellyfin.Database.Implementations\Jellyfin.Database.Implementations.csproj" />
+    <ProjectReference Include="..\src\Jellyfin.Database\Jellyfin.Database.Providers.PostgreSQL\Jellyfin.Database.Providers.PostgreSQL.csproj" />
    <ProjectReference Include="..\src\Jellyfin.Database\Jellyfin.Database.Providers.Sqlite\Jellyfin.Database.Providers.Sqlite.csproj" />
  </ItemGroup>

@@ -126,95 +126,95 @@ namespace Jellyfin.Server.Implementations.Security
                return authInfo;
            }

+            var device = (await _deviceManager.GetDevices(
+                new DeviceQuery { AccessToken = token }).ConfigureAwait(false)).Items.FirstOrDefault();
+
+            if (device is not null)
+            {
+                authInfo.IsAuthenticated = true;
+                var updateToken = false;
+
+                // TODO: Remove these checks for IsNullOrWhiteSpace
+                if (string.IsNullOrWhiteSpace(authInfo.Client))
+                {
+                    authInfo.Client = device.AppName;
+                }
+
+                if (string.IsNullOrWhiteSpace(authInfo.DeviceId))
+                {
+                    authInfo.DeviceId = device.DeviceId;
+                }
+
+                // Temporary. TODO - allow clients to specify that the token has been shared with a casting device
+                var allowTokenInfoUpdate = !authInfo.Client.Contains("chromecast", StringComparison.OrdinalIgnoreCase);
+
+                if (string.IsNullOrWhiteSpace(authInfo.Device))
+                {
+                    authInfo.Device = device.DeviceName;
+                }
+                else if (!string.Equals(authInfo.Device, device.DeviceName, StringComparison.OrdinalIgnoreCase))
+                {
+                    if (allowTokenInfoUpdate)
+                    {
+                        updateToken = true;
+                        device.DeviceName = authInfo.Device;
+                    }
+                }
+
+                if (string.IsNullOrWhiteSpace(authInfo.Version))
+                {
+                    authInfo.Version = device.AppVersion;
+                }
+                else if (!string.Equals(authInfo.Version, device.AppVersion, StringComparison.OrdinalIgnoreCase))
+                {
+                    if (allowTokenInfoUpdate)
+                    {
+                        updateToken = true;
+                        device.AppVersion = authInfo.Version;
+                    }
+                }
+
+                if ((DateTime.UtcNow - device.DateLastActivity).TotalMinutes > 3)
+                {
+                    device.DateLastActivity = DateTime.UtcNow;
+                    updateToken = true;
+                }
+
+                authInfo.User = _userManager.GetUserById(device.UserId);
+
+                if (updateToken)
+                {
+                    await _deviceManager.UpdateDevice(device).ConfigureAwait(false);
+                }
+
+                return authInfo;
+            }
+
            var dbContext = await _jellyfinDbProvider.CreateDbContextAsync().ConfigureAwait(false);
            await using (dbContext.ConfigureAwait(false))
            {
-                var device = _deviceManager.GetDevices(
-                    new DeviceQuery { AccessToken = token }).Items.FirstOrDefault();
-
-                if (device is not null)
+                var key = await dbContext.ApiKeys.FirstOrDefaultAsync(apiKey => apiKey.AccessToken == token).ConfigureAwait(false);
+                if (key is not null)
                {
                    authInfo.IsAuthenticated = true;
-                    var updateToken = false;
-
-                    // TODO: Remove these checks for IsNullOrWhiteSpace
-                    if (string.IsNullOrWhiteSpace(authInfo.Client))
-                    {
-                        authInfo.Client = device.AppName;
-                    }
-
+                    authInfo.Client = key.Name;
+                    authInfo.Token = key.AccessToken;
                    if (string.IsNullOrWhiteSpace(authInfo.DeviceId))
                    {
-                        authInfo.DeviceId = device.DeviceId;
+                        authInfo.DeviceId = _serverApplicationHost.SystemId;
                    }

-                    // Temporary. TODO - allow clients to specify that the token has been shared with a casting device
-                    var allowTokenInfoUpdate = !authInfo.Client.Contains("chromecast", StringComparison.OrdinalIgnoreCase);
-
                    if (string.IsNullOrWhiteSpace(authInfo.Device))
                    {
-                        authInfo.Device = device.DeviceName;
-                    }
-                    else if (!string.Equals(authInfo.Device, device.DeviceName, StringComparison.OrdinalIgnoreCase))
-                    {
-                        if (allowTokenInfoUpdate)
-                        {
-                            updateToken = true;
-                            device.DeviceName = authInfo.Device;
-                        }
+                        authInfo.Device = _serverApplicationHost.Name;
                    }

                    if (string.IsNullOrWhiteSpace(authInfo.Version))
                    {
-                        authInfo.Version = device.AppVersion;
-                    }
-                    else if (!string.Equals(authInfo.Version, device.AppVersion, StringComparison.OrdinalIgnoreCase))
-                    {
-                        if (allowTokenInfoUpdate)
-                        {
-                            updateToken = true;
-                            device.AppVersion = authInfo.Version;
-                        }
+                        authInfo.Version = _serverApplicationHost.ApplicationVersionString;
                    }

-                    if ((DateTime.UtcNow - device.DateLastActivity).TotalMinutes > 3)
-                    {
-                        device.DateLastActivity = DateTime.UtcNow;
-                        updateToken = true;
-                    }
-
-                    authInfo.User = _userManager.GetUserById(device.UserId);
-
-                    if (updateToken)
-                    {
-                        await _deviceManager.UpdateDevice(device).ConfigureAwait(false);
-                    }
-                }
-                else
-                {
-                    var key = await dbContext.ApiKeys.FirstOrDefaultAsync(apiKey => apiKey.AccessToken == token).ConfigureAwait(false);
-                    if (key is not null)
-                    {
-                        authInfo.IsAuthenticated = true;
-                        authInfo.Client = key.Name;
-                        authInfo.Token = key.AccessToken;
-                        if (string.IsNullOrWhiteSpace(authInfo.DeviceId))
-                        {
-                            authInfo.DeviceId = _serverApplicationHost.SystemId;
-                        }
-
-                        if (string.IsNullOrWhiteSpace(authInfo.Device))
-                        {
-                            authInfo.Device = _serverApplicationHost.Name;
-                        }
-
-                        if (string.IsNullOrWhiteSpace(authInfo.Version))
-                        {
-                            authInfo.Version = _serverApplicationHost.ApplicationVersionString;
-                        }
-
-                        authInfo.IsApiKey = true;
-                    }
+                    authInfo.IsApiKey = true;
                }

                return authInfo;
@@ -61,10 +61,10 @@ public sealed class DeviceAccessHost : IHostedService

    private async Task UpdateDeviceAccess(User user)
    {
-        var existing = _deviceManager.GetDevices(new DeviceQuery
+        var existing = (await _deviceManager.GetDevices(new DeviceQuery
        {
            UserId = user.Id
-        }).Items;
+        }).ConfigureAwait(false)).Items;

        foreach (var device in existing)
        {
@@ -2,12 +2,15 @@ using System;
 using System.Collections.Generic;
 using System.Reflection;
 using Emby.Server.Implementations;
+using Emby.Server.Implementations.MediaEncoding;
+using Emby.Server.Implementations.ScheduledTasks;
 using Emby.Server.Implementations.Session;
 using Jellyfin.Api.WebSocketListeners;
 using Jellyfin.Database.Implementations;
 using Jellyfin.Drawing;
 using Jellyfin.Drawing.Skia;
 using Jellyfin.LiveTv;
+using Jellyfin.Server.Extensions;
 using Jellyfin.Server.Implementations.Activity;
 using Jellyfin.Server.Implementations.Devices;
 using Jellyfin.Server.Implementations.Events;
@@ -23,6 +26,7 @@ using MediaBrowser.Controller.Drawing;
 using MediaBrowser.Controller.Events;
 using MediaBrowser.Controller.Library;
 using MediaBrowser.Controller.Lyrics;
+using MediaBrowser.Controller.MediaEncoding;
 using MediaBrowser.Controller.Net;
 using MediaBrowser.Controller.Security;
 using MediaBrowser.Controller.Trickplay;
@@ -39,6 +43,8 @@ namespace Jellyfin.Server
    /// </summary>
    public class CoreAppHost : ApplicationHost
    {
+        private readonly IConfiguration _startupConfig;
+
        /// <summary>
        /// Initializes a new instance of the <see cref="CoreAppHost" /> class.
        /// </summary>
@@ -57,6 +63,7 @@ namespace Jellyfin.Server
                options,
                startupConfig)
        {
+            _startupConfig = startupConfig;
        }

        /// <inheritdoc/>
@@ -98,6 +105,21 @@ namespace Jellyfin.Server

            serviceCollection.AddScoped<IAuthenticationManager, AuthenticationManager>();

+            // Transcode session store: Redis-backed when configured, no-op otherwise.
+            serviceCollection.AddTranscodeSessionStore(_startupConfig, Logger);
+
+            // Scan-leader lease: gates periodic library-mutating scheduled tasks to a single leader
+            // instance. Active by default once a Redis connection is configured, no-op otherwise.
+            serviceCollection.AddScanLeaderLease(_startupConfig, Logger);
+
+            // Configuration invalidation bus: propagates shared-configuration and library-option writes
+            // to the other instances. Redis-backed when configured, no-op otherwise.
+            serviceCollection.AddConfigurationInvalidationBus(_startupConfig, Logger);
+
+            // Session directory: publishes which instance holds which session and routes remote-control
+            // messages to it. Redis-backed when configured, no-op otherwise.
+            serviceCollection.AddSessionDirectory(_startupConfig, Logger);
+
            foreach (var type in GetExportTypes<ILyricProvider>())
            {
                serviceCollection.AddSingleton(typeof(ILyricProvider), type);
@@ -0,0 +1,51 @@
+using System.Collections.Generic;
+using System.Linq;
+using Microsoft.Extensions.Configuration;
+
+namespace Jellyfin.Server.Extensions;
+
+/// <summary>
+/// Extensions for building the application configuration.
+/// </summary>
+public static class ConfigurationBuilderExtensions
+{
+    /// <summary>
+    /// The environment variable prefix that maps onto this fork's own <c>Jellyfin:*</c> configuration
+    /// keys, for example <c>Jellyfin__TranscodeStore__RedisConnectionString</c>.
+    /// </summary>
+    public const string JellyfinSectionEnvironmentPrefix = "Jellyfin__";
+
+    /// <summary>
+    /// The configuration section root this fork keeps its own settings under.
+    /// </summary>
+    public const string JellyfinSectionRoot = "Jellyfin";
+
+    /// <summary>
+    /// Adds environment variables named <c>Jellyfin__Section__Key</c> as the configuration keys
+    /// <c>Jellyfin:Section:Key</c>.
+    /// </summary>
+    /// <remarks>
+    /// The base configuration only reads <c>JELLYFIN_</c> prefixed environment variables, so the
+    /// unprefixed form every manifest, chart and document uses would otherwise be dropped and the
+    /// feature it configures would stay off with no error.
+    /// </remarks>
+    /// <param name="builder">The configuration builder.</param>
+    /// <returns>The updated configuration builder.</returns>
+    public static IConfigurationBuilder AddJellyfinSectionEnvironmentVariables(this IConfigurationBuilder builder)
+    {
+        // Read through the framework provider so "__" to ":" normalisation and case handling match the
+        // prefixed form exactly; the prefix it strips is then put back as the section root.
+        var scoped = new ConfigurationBuilder()
+            .AddEnvironmentVariables(JellyfinSectionEnvironmentPrefix)
+            .Build();
+
+        var entries = scoped.AsEnumerable()
+            .Where(entry => entry.Value is not null)
+            .Select(entry => new KeyValuePair<string, string?>(
+                ConfigurationPath.Combine(JellyfinSectionRoot, entry.Key),
+                entry.Value))
+            .ToList();
+
+        return builder.AddInMemoryCollection(entries);
+    }
+}
@@ -0,0 +1,74 @@
+using System;
+using Emby.Server.Implementations.Configuration;
+using MediaBrowser.Common.Configuration;
+using MediaBrowser.Controller.MediaEncoding;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using StackExchange.Redis;
+
+namespace Jellyfin.Server.Extensions;
+
+/// <summary>
+/// Extensions for registering the shared-configuration invalidation bus.
+/// </summary>
+public static class ConfigurationInvalidationServiceCollectionExtensions
+{
+    /// <summary>
+    /// Registers the invalidation bus, Redis-backed when a connection string is configured and no-op
+    /// otherwise, and the subscriber applying the notices other instances publish.
+    /// </summary>
+    /// <remarks>
+    /// The connection string is only set for a multi-instance deployment, which is the only shape where
+    /// one instance can write the shared configuration directory behind another's back.
+    /// </remarks>
+    /// <param name="serviceCollection">The service collection.</param>
+    /// <param name="configuration">The configuration to read the Redis connection string from.</param>
+    /// <param name="logger">The logger to report the selected bus on.</param>
+    /// <returns>The updated service collection.</returns>
+    public static IServiceCollection AddConfigurationInvalidationBus(
+        this IServiceCollection serviceCollection,
+        IConfiguration configuration,
+        ILogger logger)
+    {
+        ArgumentNullException.ThrowIfNull(configuration);
+        ArgumentNullException.ThrowIfNull(logger);
+
+        if (string.IsNullOrEmpty(configuration[TranscodeStoreOptions.RedisConnectionStringKey]))
+        {
+            logger.LogInformation(
+                "Configuration invalidation bus: {Bus}. Shared-configuration and library-visibility changes stay local to the instance that made them; set {Key} to propagate them.",
+                nameof(NullConfigurationInvalidationBus),
+                TranscodeStoreOptions.RedisConnectionStringKey);
+
+            return serviceCollection.AddSingleton<IConfigurationInvalidationBus>(NullConfigurationInvalidationBus.Instance);
+        }
+
+        logger.LogInformation(
+            "Configuration invalidation bus: {Bus}. Shared-configuration and library-visibility changes propagate to every instance.",
+            nameof(RedisConfigurationInvalidationBus));
+
+        serviceCollection.AddSingleton<IConfigurationInvalidationBus>(sp =>
+        {
+            try
+            {
+                return new RedisConfigurationInvalidationBus(
+                    sp.GetRequiredService<IConnectionMultiplexer>(),
+                    sp.GetRequiredService<ILogger<RedisConfigurationInvalidationBus>>());
+            }
+            catch (Exception ex)
+            {
+                // Fail open: an unreachable Redis degrades to the single-instance behaviour of every
+                // instance keeping its own cached configuration, rather than aborting startup.
+                sp.GetRequiredService<ILogger<CoreAppHost>>().LogError(
+                    ex,
+                    "Redis is configured but unavailable, so shared-configuration changes will not propagate between instances. Check {Key}.",
+                    TranscodeStoreOptions.RedisConnectionStringKey);
+
+                return NullConfigurationInvalidationBus.Instance;
+            }
+        });
+
+        return serviceCollection.AddHostedService<ConfigurationInvalidationSubscriber>();
+    }
+}
@@ -0,0 +1,71 @@
+using System;
+using Emby.Server.Implementations.ScheduledTasks;
+using MediaBrowser.Controller.ScheduledTasks;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+
+namespace Jellyfin.Server.Extensions;
+
+/// <summary>
+/// Extensions for registering the scan-leader lease.
+/// </summary>
+public static class ScanLeaderServiceCollectionExtensions
+{
+    private const string RedisConnectionStringKey = "Jellyfin:TranscodeStore:RedisConnectionString";
+
+    /// <summary>
+    /// Registers the scan-leader lease and reports at <see cref="LogLevel.Information"/> whether
+    /// timer-driven library tasks are gated to a single instance.
+    /// </summary>
+    /// <remarks>
+    /// Gating is on by default once a Redis connection string is configured: that is only set for a
+    /// multi-instance deployment, which is the only shape where running library scans on every
+    /// instance is wrong. Single-instance installs have no Redis and keep running every task locally.
+    /// </remarks>
+    /// <param name="serviceCollection">The service collection.</param>
+    /// <param name="configuration">The configuration to read <c>Jellyfin:ScanLeader</c> from.</param>
+    /// <param name="logger">The logger to report the gating decision on.</param>
+    /// <returns>The updated service collection.</returns>
+    public static IServiceCollection AddScanLeaderLease(
+        this IServiceCollection serviceCollection,
+        IConfiguration configuration,
+        ILogger logger)
+    {
+        ArgumentNullException.ThrowIfNull(configuration);
+        ArgumentNullException.ThrowIfNull(logger);
+
+        serviceCollection.Configure<ScanLeaderOptions>(configuration.GetSection(ScanLeaderOptions.ConfigurationSection));
+
+        var redisConfigured = !string.IsNullOrEmpty(configuration[RedisConnectionStringKey]);
+        var requested = bool.TryParse(configuration[ScanLeaderOptions.EnabledKey], out var explicitChoice)
+            ? explicitChoice
+            : redisConfigured;
+        var active = requested && redisConfigured;
+
+        // The task worker reads Enabled from the bound options, so the effective decision has to land
+        // there as well as on the lease registration below.
+        serviceCollection.PostConfigure<ScanLeaderOptions>(options => options.Enabled = active);
+
+        if (active)
+        {
+            logger.LogInformation(
+                "Scan-leader gating is active: timer-driven library tasks run only on the instance holding the Redis scan-leader lease.");
+
+            return serviceCollection.AddSingleton<IScanLeaderLease, RedisScanLeaderLease>();
+        }
+
+        if (requested)
+        {
+            logger.LogWarning(
+                "Scan-leader gating is enabled but no Redis connection string is configured ({Key}), so it cannot run: timer-driven library tasks run on every instance.",
+                RedisConnectionStringKey);
+        }
+        else
+        {
+            logger.LogInformation("Scan-leader gating is off: timer-driven library tasks run on every instance.");
+        }
+
+        return serviceCollection.AddSingleton<IScanLeaderLease, NullScanLeaderLease>();
+    }
+}
@@ -0,0 +1,83 @@
+using System;
+using Emby.Server.Implementations.Session;
+using MediaBrowser.Controller.MediaEncoding;
+using MediaBrowser.Controller.Session;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using StackExchange.Redis;
+
+namespace Jellyfin.Server.Extensions;
+
+/// <summary>
+/// Extensions for registering the session directory and the instance-addressed message bus.
+/// </summary>
+public static class SessionDirectoryServiceCollectionExtensions
+{
+    /// <summary>
+    /// Registers the session directory and message bus, Redis-backed when a connection string is
+    /// configured and no-op otherwise, and reports the selection at <see cref="LogLevel.Information"/>.
+    /// </summary>
+    /// <param name="serviceCollection">The service collection.</param>
+    /// <param name="configuration">The configuration to read <c>Jellyfin:SessionDirectory</c> from.</param>
+    /// <param name="logger">The logger to report the selection on.</param>
+    /// <returns>The updated service collection.</returns>
+    public static IServiceCollection AddSessionDirectory(
+        this IServiceCollection serviceCollection,
+        IConfiguration configuration,
+        ILogger logger)
+    {
+        ArgumentNullException.ThrowIfNull(configuration);
+        ArgumentNullException.ThrowIfNull(logger);
+
+        serviceCollection.Configure<SessionDirectoryOptions>(configuration.GetSection(SessionDirectoryOptions.ConfigurationSection));
+
+        if (string.IsNullOrEmpty(configuration[TranscodeStoreOptions.RedisConnectionStringKey]))
+        {
+            logger.LogInformation(
+                "Session directory: {Directory}. The session list and remote control only reach the sessions this instance holds; set {Key} to share them.",
+                nameof(NullSessionDirectory),
+                TranscodeStoreOptions.RedisConnectionStringKey);
+
+            serviceCollection.AddSingleton<ISessionDirectory>(NullSessionDirectory.Instance);
+            return serviceCollection.AddSingleton<IPodMessageBus>(NullPodMessageBus.Instance);
+        }
+
+        logger.LogInformation(
+            "Session directory: {Directory}. Sessions are visible to, and controllable from, every instance.",
+            nameof(RedisSessionDirectory));
+
+        serviceCollection.AddSingleton<IPodMessageBus>(sp => Create<IPodMessageBus>(
+            sp,
+            () => new RedisPodMessageBus(
+                sp.GetRequiredService<IConnectionMultiplexer>(),
+                sp.GetRequiredService<ILogger<RedisPodMessageBus>>()),
+            NullPodMessageBus.Instance));
+
+        return serviceCollection.AddSingleton<ISessionDirectory>(sp => Create<ISessionDirectory>(
+            sp,
+            () => new RedisSessionDirectory(
+                sp.GetRequiredService<IConnectionMultiplexer>(),
+                sp.GetRequiredService<Microsoft.Extensions.Options.IOptions<SessionDirectoryOptions>>(),
+                sp.GetRequiredService<ILogger<RedisSessionDirectory>>()),
+            NullSessionDirectory.Instance));
+    }
+
+    // Fail open: an unreachable Redis degrades to the single-instance behaviour rather than aborting startup.
+    private static T Create<T>(IServiceProvider serviceProvider, Func<T> factory, T fallback)
+    {
+        try
+        {
+            return factory();
+        }
+        catch (Exception ex)
+        {
+            serviceProvider.GetRequiredService<ILogger<CoreAppHost>>().LogError(
+                ex,
+                "Redis is configured but unavailable, so sessions will not be shared between instances. Check {Key}.",
+                TranscodeStoreOptions.RedisConnectionStringKey);
+
+            return fallback;
+        }
+    }
+}
@@ -0,0 +1,87 @@
+using System;
+using System.Linq;
+using Emby.Server.Implementations.MediaEncoding;
+using MediaBrowser.Controller.MediaEncoding;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using StackExchange.Redis;
+
+namespace Jellyfin.Server.Extensions;
+
+/// <summary>
+/// Extensions for registering the transcode session store.
+/// </summary>
+public static class TranscodeStoreServiceCollectionExtensions
+{
+    /// <summary>
+    /// Registers the transcode session store, Redis-backed when a connection string is configured and
+    /// no-op otherwise, and reports the selected store at <see cref="LogLevel.Information"/>.
+    /// </summary>
+    /// <param name="serviceCollection">The service collection.</param>
+    /// <param name="configuration">The configuration to read <c>Jellyfin:TranscodeStore</c> from.</param>
+    /// <param name="logger">The logger to report the selected store on.</param>
+    /// <returns>The updated service collection.</returns>
+    public static IServiceCollection AddTranscodeSessionStore(
+        this IServiceCollection serviceCollection,
+        IConfiguration configuration,
+        ILogger logger)
+    {
+        ArgumentNullException.ThrowIfNull(configuration);
+        ArgumentNullException.ThrowIfNull(logger);
+
+        serviceCollection.Configure<TranscodeStoreOptions>(configuration.GetSection(TranscodeStoreOptions.ConfigurationSection));
+
+        var redisConnectionString = configuration[TranscodeStoreOptions.RedisConnectionStringKey];
+        if (string.IsNullOrEmpty(redisConnectionString))
+        {
+            logger.LogInformation(
+                "Transcode session store: {Store}. Cross-pod transcode takeover is off; set {Key} to enable it.",
+                nameof(NullTranscodeSessionStore),
+                TranscodeStoreOptions.RedisConnectionStringKey);
+
+            return serviceCollection.AddSingleton<ITranscodeSessionStore, NullTranscodeSessionStore>();
+        }
+
+        logger.LogInformation(
+            "Transcode session store: {Store} on {Endpoints}.",
+            nameof(RedisTranscodeSessionStore),
+            DescribeEndpoints(redisConnectionString));
+
+        serviceCollection.AddSingleton<IConnectionMultiplexer>(sp =>
+        {
+            try
+            {
+                return ConnectionMultiplexer.Connect(redisConnectionString);
+            }
+            catch (Exception ex)
+            {
+                sp.GetRequiredService<ILogger<CoreAppHost>>()
+                    .LogError(ex, "Failed to connect to Redis. Check the {Key} configuration.", TranscodeStoreOptions.RedisConnectionStringKey);
+                throw;
+            }
+        });
+        serviceCollection.AddSingleton<ITranscodeSessionStore, RedisTranscodeSessionStore>();
+        serviceCollection.AddHostedService<TranscodeStoreConnectivityProbe>();
+
+        return serviceCollection;
+    }
+
+    /// <summary>
+    /// Renders the endpoints of a connection string for logging. The connection string itself is never
+    /// logged because it can carry a password.
+    /// </summary>
+    private static string DescribeEndpoints(string redisConnectionString)
+    {
+        try
+        {
+            return string.Join(
+                ',',
+                ConfigurationOptions.Parse(redisConnectionString).EndPoints.Select(endpoint => endpoint.ToString()));
+        }
+        catch (ArgumentException)
+        {
+            return "(unparsable connection string)";
+        }
+    }
+}
@@ -56,6 +56,7 @@
    <PackageReference Include="Serilog.Sinks.Console" />
    <PackageReference Include="Serilog.Sinks.File" />
    <PackageReference Include="Serilog.Sinks.Graylog" />
+    <PackageReference Include="StackExchange.Redis" />
  </ItemGroup>

  <ItemGroup>
@@ -36,7 +36,9 @@ internal class MigrateRatingLevels : IDatabaseMigrationRoutine
        _logger.LogInformation("Recalculating parental rating levels based on rating string.");
        using var context = _provider.CreateDbContext();
        using var transaction = context.Database.BeginTransaction();
-        var ratings = context.BaseItems.AsNoTracking().Select(e => e.OfficialRating).Distinct();
+        // Read the whole list up front: the updates below run on the same connection, and a provider
+        // that cannot multiplex commands rejects them while the reader is still open.
+        var ratings = context.BaseItems.AsNoTracking().Select(e => e.OfficialRating).Distinct().ToList();
        foreach (var rating in ratings)
        {
            if (string.IsNullOrEmpty(rating))
@@ -24,6 +24,7 @@ using Jellyfin.Server.ServerSetupApp;
 using MediaBrowser.Common.Configuration;
 using MediaBrowser.Common.Net;
 using MediaBrowser.Controller;
+using MediaBrowser.Controller.Configuration;
 using Microsoft.AspNetCore.Hosting;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Configuration;
@@ -304,6 +305,10 @@ namespace Jellyfin.Server
                .AddJellyfinDbContext(startupConfigurationManager, startupConfig)
                .AddSingleton<IApplicationPaths>(appPaths)
                .AddSingleton<ServerApplicationPaths>(appPaths)
+                // Required by the NpgsqlDataSource factory in AddJellyfinDbContext when
+                // DatabaseType=Jellyfin-PostgreSQL — the factory resolves this from DI
+                // to read CustomProviderOptions and pool settings.
+                .AddSingleton<IServerConfigurationManager>(startupConfigurationManager)
                .RegisterStartupLogger();

            var startupService = migrationStartupServiceProvider.BuildServiceProvider();
@@ -386,6 +391,8 @@ namespace Jellyfin.Server
                .AddInMemoryCollection(inMemoryDefaultConfig)
                .AddJsonFile(LoggingConfigFileDefault, optional: false, reloadOnChange: true)
                .AddJsonFile(LoggingConfigFileSystem, optional: true, reloadOnChange: true)
+                // Added before the prefixed source so an explicit JELLYFIN_ variable still wins.
+                .AddJellyfinSectionEnvironmentVariables()
                .AddEnvironmentVariables("JELLYFIN_")
                .AddInMemoryCollection(commandLineOpts.ConvertToConfig());
        }
@@ -68,6 +68,8 @@ Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Jellyfin.Server.Tests", "te
 EndProject
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Jellyfin.Server.Integration.Tests", "tests\Jellyfin.Server.Integration.Tests\Jellyfin.Server.Integration.Tests.csproj", "{68B0B823-A5AC-4E8B-82EA-965AAC7BF76E}"
 EndProject
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Jellyfin.Database.Tests.PostgreSQL", "tests\Jellyfin.Database.Tests.PostgreSQL\Jellyfin.Database.Tests.PostgreSQL.csproj", "{B5F2C3A1-9D4E-4F8A-B123-456789ABCDEF}"
+EndProject
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Jellyfin.Providers.Tests", "tests\Jellyfin.Providers.Tests\Jellyfin.Providers.Tests.csproj", "{A964008C-2136-4716-B6CB-B3426C22320A}"
 EndProject
 Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "src", "src", "{C9F0AB5D-F4D7-40C8-A353-3305C86D6D4C}"
@@ -95,10 +97,16 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Jellyfin.Database", "Jellyf
 EndProject
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Jellyfin.Database.Providers.Sqlite", "src\Jellyfin.Database\Jellyfin.Database.Providers.Sqlite\Jellyfin.Database.Providers.Sqlite.csproj", "{A5590358-33CC-4B39-BDE7-DC62FEB03C76}"
 EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Jellyfin.Database.Providers.PostgreSQL", "src\Jellyfin.Database\Jellyfin.Database.Providers.PostgreSQL\Jellyfin.Database.Providers.PostgreSQL.csproj", "{B3C4D5E6-F7A8-4B9C-0D1E-2F3A4B5C6D7E}"
+EndProject
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Jellyfin.Database.Implementations", "src\Jellyfin.Database\Jellyfin.Database.Implementations\Jellyfin.Database.Implementations.csproj", "{8C9F9221-8415-496C-B1F5-E7756F03FA59}"
 EndProject
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Jellyfin.CodeAnalysis", "src\Jellyfin.CodeAnalysis\Jellyfin.CodeAnalysis.csproj", "{11643D0F-6761-4EF7-AB71-6F9F8DE00714}"
 EndProject
+Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "tools", "tools", "{3C85DA50-31AC-40D3-BCF4-F1B14C420996}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Jellyfin.DbMigrator", "tools\Jellyfin.DbMigrator\Jellyfin.DbMigrator.csproj", "{6F7187CB-E1CB-4583-98CF-0FB87F21E844}"
+EndProject
 Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Jellyfin.Drawing.Skia.Tests", "tests\Jellyfin.Drawing.Skia.Tests\Jellyfin.Drawing.Skia.Tests.csproj", "{E24A279C-9A37-419A-8F9C-853C11FBE753}"
 EndProject
 Global
@@ -219,6 +227,10 @@ Global
 		{68B0B823-A5AC-4E8B-82EA-965AAC7BF76E}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{68B0B823-A5AC-4E8B-82EA-965AAC7BF76E}.Release|Any CPU.ActiveCfg = Release|Any CPU
 		{68B0B823-A5AC-4E8B-82EA-965AAC7BF76E}.Release|Any CPU.Build.0 = Release|Any CPU
+		{B5F2C3A1-9D4E-4F8A-B123-456789ABCDEF}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{B5F2C3A1-9D4E-4F8A-B123-456789ABCDEF}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{B5F2C3A1-9D4E-4F8A-B123-456789ABCDEF}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{B5F2C3A1-9D4E-4F8A-B123-456789ABCDEF}.Release|Any CPU.Build.0 = Release|Any CPU
 		{A964008C-2136-4716-B6CB-B3426C22320A}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
 		{A964008C-2136-4716-B6CB-B3426C22320A}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{A964008C-2136-4716-B6CB-B3426C22320A}.Release|Any CPU.ActiveCfg = Release|Any CPU
@@ -259,6 +271,10 @@ Global
 		{A5590358-33CC-4B39-BDE7-DC62FEB03C76}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{A5590358-33CC-4B39-BDE7-DC62FEB03C76}.Release|Any CPU.ActiveCfg = Release|Any CPU
 		{A5590358-33CC-4B39-BDE7-DC62FEB03C76}.Release|Any CPU.Build.0 = Release|Any CPU
+		{B3C4D5E6-F7A8-4B9C-0D1E-2F3A4B5C6D7E}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{B3C4D5E6-F7A8-4B9C-0D1E-2F3A4B5C6D7E}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{B3C4D5E6-F7A8-4B9C-0D1E-2F3A4B5C6D7E}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{B3C4D5E6-F7A8-4B9C-0D1E-2F3A4B5C6D7E}.Release|Any CPU.Build.0 = Release|Any CPU
 		{8C9F9221-8415-496C-B1F5-E7756F03FA59}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
 		{8C9F9221-8415-496C-B1F5-E7756F03FA59}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{8C9F9221-8415-496C-B1F5-E7756F03FA59}.Release|Any CPU.ActiveCfg = Release|Any CPU
@@ -267,6 +283,10 @@ Global
 		{11643D0F-6761-4EF7-AB71-6F9F8DE00714}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{11643D0F-6761-4EF7-AB71-6F9F8DE00714}.Release|Any CPU.ActiveCfg = Release|Any CPU
 		{11643D0F-6761-4EF7-AB71-6F9F8DE00714}.Release|Any CPU.Build.0 = Release|Any CPU
+		{6F7187CB-E1CB-4583-98CF-0FB87F21E844}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{6F7187CB-E1CB-4583-98CF-0FB87F21E844}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{6F7187CB-E1CB-4583-98CF-0FB87F21E844}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{6F7187CB-E1CB-4583-98CF-0FB87F21E844}.Release|Any CPU.Build.0 = Release|Any CPU
 		{E24A279C-9A37-419A-8F9C-853C11FBE753}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
 		{E24A279C-9A37-419A-8F9C-853C11FBE753}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{E24A279C-9A37-419A-8F9C-853C11FBE753}.Release|Any CPU.ActiveCfg = Release|Any CPU
@@ -290,6 +310,7 @@ Global
 		{42816EA8-4511-4CBF-A9C7-7791D5DDDAE6} = {FBBB5129-006E-4AD7-BAD5-8B7CA1D10ED6}
 		{3ADBCD8C-C0F2-4956-8FDC-35D686B74CF9} = {FBBB5129-006E-4AD7-BAD5-8B7CA1D10ED6}
 		{68B0B823-A5AC-4E8B-82EA-965AAC7BF76E} = {FBBB5129-006E-4AD7-BAD5-8B7CA1D10ED6}
+		{B5F2C3A1-9D4E-4F8A-B123-456789ABCDEF} = {FBBB5129-006E-4AD7-BAD5-8B7CA1D10ED6}
 		{A964008C-2136-4716-B6CB-B3426C22320A} = {FBBB5129-006E-4AD7-BAD5-8B7CA1D10ED6}
 		{750B8757-BE3D-4F8C-941A-FBAD94904ADA} = {C9F0AB5D-F4D7-40C8-A353-3305C86D6D4C}
 		{332A5C7A-F907-47CA-910E-BE6F7371B9E0} = {FBBB5129-006E-4AD7-BAD5-8B7CA1D10ED6}
@@ -301,8 +322,10 @@ Global
 		{8C6B2B13-58A4-4506-9DAB-1F882A093FE0} = {C9F0AB5D-F4D7-40C8-A353-3305C86D6D4C}
 		{4C54CE05-69C8-48FA-8785-39F7F6DB1CAD} = {C9F0AB5D-F4D7-40C8-A353-3305C86D6D4C}
 		{A5590358-33CC-4B39-BDE7-DC62FEB03C76} = {4C54CE05-69C8-48FA-8785-39F7F6DB1CAD}
+		{B3C4D5E6-F7A8-4B9C-0D1E-2F3A4B5C6D7E} = {4C54CE05-69C8-48FA-8785-39F7F6DB1CAD}
 		{8C9F9221-8415-496C-B1F5-E7756F03FA59} = {4C54CE05-69C8-48FA-8785-39F7F6DB1CAD}
 		{11643D0F-6761-4EF7-AB71-6F9F8DE00714} = {C9F0AB5D-F4D7-40C8-A353-3305C86D6D4C}
+		{6F7187CB-E1CB-4583-98CF-0FB87F21E844} = {3C85DA50-31AC-40D3-BCF4-F1B14C420996}
 		{E24A279C-9A37-419A-8F9C-853C11FBE753} = {FBBB5129-006E-4AD7-BAD5-8B7CA1D10ED6}
 	EndGlobalSection
 	GlobalSection(ExtensibilityGlobals) = postSolution
@@ -0,0 +1,26 @@
+namespace MediaBrowser.Common.Configuration
+{
+    /// <summary>
+    /// A notice that one instance has written shared configuration, so every other instance has to drop
+    /// its locally cached copy and read the shared file again.
+    /// </summary>
+    public sealed class ConfigurationInvalidation
+    {
+        /// <summary>
+        /// Gets or sets the cache this notice refers to.
+        /// </summary>
+        public ConfigurationInvalidationScope Scope { get; set; }
+
+        /// <summary>
+        /// Gets or sets what was invalidated within the scope: the configuration key for
+        /// <see cref="ConfigurationInvalidationScope.NamedConfiguration"/>, the library path for
+        /// <see cref="ConfigurationInvalidationScope.LibraryOptions"/>, and <c>null</c> otherwise.
+        /// </summary>
+        public string? Target { get; set; }
+
+        /// <summary>
+        /// Gets or sets the identity of the instance that published the notice, so it can ignore its own.
+        /// </summary>
+        public string? OriginId { get; set; }
+    }
+}
@@ -0,0 +1,30 @@
+namespace MediaBrowser.Common.Configuration
+{
+    /// <summary>
+    /// Extensions for <see cref="IConfigurationInvalidationBus"/>.
+    /// </summary>
+    public static class ConfigurationInvalidationBusExtensions
+    {
+        /// <summary>
+        /// Announces a write this instance originated, and stays silent for a write induced by an
+        /// invalidation another instance published.
+        /// </summary>
+        /// <remarks>
+        /// This is the backstop for the write path: a consumer reacting to an applied invalidation by
+        /// writing - including a plugin that knows nothing about the bus - cannot turn that write into a
+        /// notice of its own.
+        /// </remarks>
+        /// <param name="bus">The bus.</param>
+        /// <param name="scope">The cache that was written.</param>
+        /// <param name="target">The configuration key or library path that was written, if any.</param>
+        public static void PublishLocalWrite(this IConfigurationInvalidationBus bus, ConfigurationInvalidationScope scope, string? target)
+        {
+            if (ConfigurationInvalidationContext.IsApplyingRemoteInvalidation)
+            {
+                return;
+            }
+
+            bus.Publish(scope, target);
+        }
+    }
+}
@@ -0,0 +1,57 @@
+using System;
+using System.Threading;
+
+namespace MediaBrowser.Common.Configuration
+{
+    /// <summary>
+    /// Marks the flow of control that is applying an invalidation published by another instance, so the
+    /// reactions to it can tell a remote write apart from a local one.
+    /// </summary>
+    /// <remarks>
+    /// Applying an invalidation raises the same update events a local save raises, because the in-process
+    /// consumers have to re-read the configuration either way. Some of those consumers answer an update by
+    /// writing, and that write must neither repeat what the publishing instance already did nor fan back
+    /// out over the bus. The flag rides the execution context, so it reaches the queued and asynchronous
+    /// event handlers as well as the synchronous ones.
+    /// </remarks>
+    public static class ConfigurationInvalidationContext
+    {
+        private static readonly AsyncLocal<bool> _applyingRemoteInvalidation = new();
+
+        /// <summary>
+        /// Gets a value indicating whether the current flow of control is applying an invalidation
+        /// published by another instance rather than handling a local save.
+        /// </summary>
+        public static bool IsApplyingRemoteInvalidation => _applyingRemoteInvalidation.Value;
+
+        /// <summary>
+        /// Marks the current flow of control as applying a remote invalidation until the returned scope is
+        /// disposed.
+        /// </summary>
+        /// <returns>The scope to dispose once the invalidation has been applied.</returns>
+        public static IDisposable BeginApply() => new ApplyScope();
+
+        private sealed class ApplyScope : IDisposable
+        {
+            private readonly bool _previous;
+            private bool _disposed;
+
+            public ApplyScope()
+            {
+                _previous = _applyingRemoteInvalidation.Value;
+                _applyingRemoteInvalidation.Value = true;
+            }
+
+            public void Dispose()
+            {
+                if (_disposed)
+                {
+                    return;
+                }
+
+                _disposed = true;
+                _applyingRemoteInvalidation.Value = _previous;
+            }
+        }
+    }
+}
@@ -0,0 +1,29 @@
+namespace MediaBrowser.Common.Configuration
+{
+    /// <summary>
+    /// Identifies which locally cached copy of the shared configuration a
+    /// <see cref="ConfigurationInvalidation"/> refers to.
+    /// </summary>
+    public enum ConfigurationInvalidationScope
+    {
+        /// <summary>
+        /// The system configuration cached by the configuration manager.
+        /// </summary>
+        SystemConfiguration = 0,
+
+        /// <summary>
+        /// A single named configuration, identified by its key.
+        /// </summary>
+        NamedConfiguration = 1,
+
+        /// <summary>
+        /// The library options of a single collection folder, identified by its path.
+        /// </summary>
+        LibraryOptions = 2,
+
+        /// <summary>
+        /// The library options of every collection folder, for changes to the library structure itself.
+        /// </summary>
+        AllLibraryOptions = 3
+    }
+}
@@ -0,0 +1,28 @@
+using System;
+
+namespace MediaBrowser.Common.Configuration
+{
+    /// <summary>
+    /// Carries cache-invalidation notices between the instances that share one configuration directory.
+    /// </summary>
+    /// <remarks>
+    /// The shared directory carries the content; this bus only carries the fact that it changed. Every
+    /// implementation is expected to fail open: a bus that cannot deliver must not throw into the write
+    /// path, leaving each instance on its own locally cached copy until it restarts.
+    /// </remarks>
+    public interface IConfigurationInvalidationBus
+    {
+        /// <summary>
+        /// Announces that this instance has written shared configuration.
+        /// </summary>
+        /// <param name="scope">The cache that was written.</param>
+        /// <param name="target">The configuration key or library path that was written, if any.</param>
+        void Publish(ConfigurationInvalidationScope scope, string? target);
+
+        /// <summary>
+        /// Registers the handler invoked for notices published by other instances.
+        /// </summary>
+        /// <param name="handler">The handler applying the invalidation locally.</param>
+        void Subscribe(Action<ConfigurationInvalidation> handler);
+    }
+}
@@ -85,6 +85,20 @@ namespace MediaBrowser.Common.Configuration
        /// </summary>
        /// <param name="factories">The factories.</param>
        void AddParts(IEnumerable<IConfigurationFactory> factories);
+
+        /// <summary>
+        /// Drops the locally cached copy of configuration another instance has written to the shared
+        /// configuration directory, so the next read reloads it, and raises the local update event.
+        /// </summary>
+        /// <remarks>
+        /// An implementation predating the invalidation bus keeps the default, which reports that it
+        /// cannot drop its cache rather than quietly leaving it stale. The caller applying a remote
+        /// notice treats that as a failed apply and logs it.
+        /// </remarks>
+        /// <param name="key">The named configuration key, or <c>null</c> for the system configuration.</param>
+        /// <exception cref="NotSupportedException">The implementation cannot drop its cached configuration.</exception>
+        void InvalidateCachedConfiguration(string? key)
+            => throw new NotSupportedException(GetType().Name + " cannot drop configuration cached from the shared configuration directory, so writes by other instances will not be picked up.");
    }

    public static class ConfigurationManagerExtensions
@@ -0,0 +1,27 @@
+using System;
+
+namespace MediaBrowser.Common.Configuration
+{
+    /// <summary>
+    /// A no-op <see cref="IConfigurationInvalidationBus"/> used by single-instance installs and whenever
+    /// the shared bus is unavailable. Every instance keeps its own cached configuration, which is the
+    /// behaviour of an install that has only one.
+    /// </summary>
+    public sealed class NullConfigurationInvalidationBus : IConfigurationInvalidationBus
+    {
+        /// <summary>
+        /// Gets the shared instance.
+        /// </summary>
+        public static NullConfigurationInvalidationBus Instance { get; } = new NullConfigurationInvalidationBus();
+
+        /// <inheritdoc />
+        public void Publish(ConfigurationInvalidationScope scope, string? target)
+        {
+        }
+
+        /// <inheritdoc />
+        public void Subscribe(Action<ConfigurationInvalidation> handler)
+        {
+        }
+    }
+}
@@ -47,29 +47,29 @@ public interface IDeviceManager
    /// Gets the device information.
    /// </summary>
    /// <param name="id">The identifier.</param>
-    /// <returns>DeviceInfoDto.</returns>
-    DeviceInfoDto? GetDevice(string id);
+    /// <returns>A <see cref="Task"/> representing the retrieval of the device information.</returns>
+    Task<DeviceInfoDto?> GetDevice(string id);

    /// <summary>
    /// Gets devices based on the provided query.
    /// </summary>
    /// <param name="query">The device query.</param>
    /// <returns>A <see cref="Task{QueryResult}"/> representing the retrieval of the devices.</returns>
-    QueryResult<Device> GetDevices(DeviceQuery query);
+    Task<QueryResult<Device>> GetDevices(DeviceQuery query);

    /// <summary>
    /// Gets device information based on the provided query.
    /// </summary>
    /// <param name="query">The device query.</param>
    /// <returns>A <see cref="Task{QueryResult}"/> representing the retrieval of the device information.</returns>
-    QueryResult<DeviceInfo> GetDeviceInfos(DeviceQuery query);
+    Task<QueryResult<DeviceInfo>> GetDeviceInfos(DeviceQuery query);

    /// <summary>
    /// Gets the device information.
    /// </summary>
    /// <param name="userId">The user's id, or <c>null</c>.</param>
-    /// <returns>IEnumerable&lt;DeviceInfoDto&gt;.</returns>
-    QueryResult<DeviceInfoDto> GetDevicesForUser(Guid? userId);
+    /// <returns>A <see cref="Task{QueryResult}"/> representing the retrieval of the device information.</returns>
+    Task<QueryResult<DeviceInfoDto>> GetDevicesForUser(Guid? userId);

    /// <summary>
    /// Deletes a device.
@@ -105,8 +105,8 @@ public interface IDeviceManager
    /// Gets the options of a device.
    /// </summary>
    /// <param name="deviceId">The device id.</param>
-    /// <returns><see cref="DeviceOptions"/> of the device.</returns>
-    DeviceOptionsDto? GetDeviceOptions(string deviceId);
+    /// <returns>A <see cref="Task"/> representing the retrieval of the <see cref="DeviceOptions"/> of the device.</returns>
+    Task<DeviceOptionsDto?> GetDeviceOptions(string deviceId);

    /// <summary>
    /// Gets the dto for client capabilities.
@@ -14,6 +14,7 @@ using System.Threading.Tasks;
 using Jellyfin.Data.Enums;
 using Jellyfin.Database.Implementations.Entities;
 using Jellyfin.Extensions.Json;
+using MediaBrowser.Common.Configuration;
 using MediaBrowser.Controller.IO;
 using MediaBrowser.Controller.Library;
 using MediaBrowser.Controller.Providers;
@@ -70,6 +71,12 @@ namespace MediaBrowser.Controller.Entities

        public static IServerApplicationHost ApplicationHost { get; set; }

+        /// <summary>
+        /// Gets or sets the bus announcing library option writes to the other instances sharing this
+        /// configuration directory. Defaults to a no-op, which is the single-instance behaviour.
+        /// </summary>
+        public static IConfigurationInvalidationBus InvalidationBus { get; set; } = NullConfigurationInvalidationBus.Instance;
+
        [JsonIgnore]
        public override bool SupportsPlayedStatus => false;

@@ -188,11 +195,36 @@ namespace MediaBrowser.Controller.Entities
            XmlSerializer.SerializeToFile(clone, GetLibraryOptionsPath(path));

            LibraryOptionsUpdated?.Invoke(null, new LibraryOptionsUpdatedEventArgs(path, options));
+
+            InvalidationBus.PublishLocalWrite(ConfigurationInvalidationScope.LibraryOptions, path);
        }

-        public static void OnCollectionFolderChange()
+        /// <summary>
+        /// Drops the cached options of one library so the next read comes off <c>options.xml</c> again.
+        /// Applied on the instances that did not write, and so does not publish.
+        /// </summary>
+        /// <param name="path">The library path.</param>
+        public static void InvalidateLibraryOptions(string path)
+        {
+            _libraryOptions.TryRemove(path, out _);
+
+            LibraryOptionsUpdated?.Invoke(null, new LibraryOptionsUpdatedEventArgs(path, GetLibraryOptions(path)));
+        }
+
+        /// <summary>
+        /// Drops every cached library option set. Applied on the instances that did not write, and so does
+        /// not publish.
+        /// </summary>
+        public static void InvalidateAllLibraryOptions()
            => _libraryOptions.Clear();

+        public static void OnCollectionFolderChange()
+        {
+            InvalidateAllLibraryOptions();
+
+            InvalidationBus.PublishLocalWrite(ConfigurationInvalidationScope.AllLibraryOptions, null);
+        }
+
        public override bool IsSaveLocalMetadataEnabled()
        {
            return true;
@@ -449,19 +449,26 @@ namespace MediaBrowser.Controller.Entities
            IUserDataManager userDataManager,
            ILibraryManager libraryManager)
        {
-            var filtered = items.Where(i => Filter(i, user, query, userDataManager, libraryManager));
+            var itemList = items as IReadOnlyList<BaseItem> ?? items.ToList();
+
+            // The user data checks below run per item, so read them all in one query up front.
+            var userDataBatch = user is not null && RequiresUserData(query)
+                ? userDataManager.GetUserDataBatch(itemList, user)
+                : null;
+
+            var filtered = itemList.Where(i => Filter(i, user, query, userDataManager, libraryManager, userDataBatch));

            if (query.IsPlayed.HasValue && user is not null)
            {
-                var itemList = filtered.ToList();
-                var folderIds = itemList.OfType<Folder>().Select(f => f.Id).ToList();
+                var filteredList = filtered.ToList();
+                var folderIds = filteredList.OfType<Folder>().Select(f => f.Id).ToList();

                if (folderIds.Count > 0)
                {
                    var counts = libraryManager.GetPlayedAndTotalCountBatch(folderIds, user);
                    var isPlayedValue = query.IsPlayed.Value;

-                    return itemList.Where(item =>
+                    return filteredList.Where(item =>
                    {
                        if (item is Folder)
                        {
@@ -473,7 +480,7 @@ namespace MediaBrowser.Controller.Entities
                    });
                }

-                return itemList;
+                return filteredList;
            }

            return filtered;
@@ -515,12 +522,29 @@ namespace MediaBrowser.Controller.Entities
                itemsArray);
        }

+        private static bool RequiresUserData(InternalItemsQuery query)
+            => query.IsLiked.HasValue
+                || query.IsFavoriteOrLiked.HasValue
+                || query.IsFavorite.HasValue
+                || query.IsResumable.HasValue
+                || query.IsPlayed.HasValue;
+
+        private static UserItemData GetUserData(
+            IUserDataManager userDataManager,
+            User user,
+            BaseItem item,
+            Dictionary<Guid, UserItemData> userDataBatch)
+            => userDataBatch is not null && userDataBatch.TryGetValue(item.Id, out var userData)
+                ? userData
+                : userDataManager.GetUserData(user, item);
+
        private static bool Filter(
            BaseItem item,
            User user,
            InternalItemsQuery query,
            IUserDataManager userDataManager,
-            ILibraryManager libraryManager)
+            ILibraryManager libraryManager,
+            Dictionary<Guid, UserItemData> userDataBatch)
        {
            if (!string.IsNullOrEmpty(query.NameStartsWith) && !item.SortName.StartsWith(query.NameStartsWith, StringComparison.InvariantCultureIgnoreCase))
            {
@@ -568,7 +592,7 @@ namespace MediaBrowser.Controller.Entities

            if (query.IsLiked.HasValue)
            {
-                userData = userDataManager.GetUserData(user, item);
+                userData = GetUserData(userDataManager, user, item, userDataBatch);
                if (!userData.Likes.HasValue || userData.Likes != query.IsLiked.Value)
                {
                    return false;
@@ -577,7 +601,7 @@ namespace MediaBrowser.Controller.Entities

            if (query.IsFavoriteOrLiked.HasValue)
            {
-                userData ??= userDataManager.GetUserData(user, item);
+                userData ??= GetUserData(userDataManager, user, item, userDataBatch);
                var isFavoriteOrLiked = userData.IsFavorite || (userData.Likes ?? false);

                if (isFavoriteOrLiked != query.IsFavoriteOrLiked.Value)
@@ -588,7 +612,7 @@ namespace MediaBrowser.Controller.Entities

            if (query.IsFavorite.HasValue)
            {
-                userData ??= userDataManager.GetUserData(user, item);
+                userData ??= GetUserData(userDataManager, user, item, userDataBatch);
                if (userData.IsFavorite != query.IsFavorite.Value)
                {
                    return false;
@@ -597,7 +621,7 @@ namespace MediaBrowser.Controller.Entities

            if (query.IsResumable.HasValue)
            {
-                userData ??= userDataManager.GetUserData(user, item);
+                userData ??= GetUserData(userDataManager, user, item, userDataBatch);
                var isResumable = userData.PlaybackPositionTicks > 0;

                if (isResumable != query.IsResumable.Value)
@@ -612,7 +636,7 @@ namespace MediaBrowser.Controller.Entities
                // Folders are batch-filtered by the collection Filter() overload.
                if (!item.IsFolder)
                {
-                    userData ??= userDataManager.GetUserData(user, item);
+                    userData ??= GetUserData(userDataManager, user, item, userDataBatch);
                    if (item.IsPlayed(user, userData) != query.IsPlayed.Value)
                    {
                        return false;
@@ -0,0 +1,79 @@
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace MediaBrowser.Controller.MediaEncoding;
+
+/// <summary>
+/// Provides a durable store for HLS transcoding session state, enabling
+/// HA recovery and lease-based ownership between pods.
+/// </summary>
+public interface ITranscodeSessionStore
+{
+    /// <summary>
+    /// Attempts to retrieve a transcoding session by its play session identifier.
+    /// </summary>
+    /// <param name="playSessionId">The play session identifier.</param>
+    /// <param name="cancellationToken">A cancellation token.</param>
+    /// <returns>
+    /// The <see cref="TranscodeSession"/> if it exists and its lease has not expired;
+    /// otherwise <c>null</c>.
+    /// </returns>
+    Task<TranscodeSession?> TryGetAsync(string playSessionId, CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Attempts to take over ownership of an existing session by claiming the lease for
+    /// <paramref name="claimingPod"/>. Takeover succeeds only when the session exists and
+    /// its current lease has already expired.
+    /// </summary>
+    /// <param name="playSessionId">The play session identifier.</param>
+    /// <param name="claimingPod">The name of the pod attempting to claim ownership.</param>
+    /// <param name="cancellationToken">A cancellation token.</param>
+    /// <returns>
+    /// <c>true</c> if the takeover succeeded (the claiming pod now holds the lease);
+    /// <c>false</c> if the session does not exist, its lease is still valid, or another
+    /// concurrent caller already claimed it.
+    /// </returns>
+    Task<bool> TryTakeoverAsync(string playSessionId, string claimingPod, CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Persists a new or updated transcoding session.
+    /// </summary>
+    /// <param name="session">The session to store.</param>
+    /// <param name="cancellationToken">A cancellation token.</param>
+    /// <returns>A <see cref="Task"/> representing the asynchronous operation.</returns>
+    Task SetAsync(TranscodeSession session, CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Renews the lease for an existing session, extending its
+    /// <see cref="TranscodeSession.LeaseExpiresUtc"/> by the store's configured lease duration.
+    /// The renewal is rejected when <paramref name="ownerPod"/> no longer owns the lease, so a
+    /// renewal in flight while another pod wins <see cref="TryTakeoverAsync"/> cannot revert the takeover.
+    /// </summary>
+    /// <param name="playSessionId">The play session identifier.</param>
+    /// <param name="ownerPod">The name of the pod that believes it owns the lease.</param>
+    /// <param name="cancellationToken">A cancellation token.</param>
+    /// <returns>
+    /// <c>true</c> if the lease was renewed; <c>false</c> if the session no longer exists or is
+    /// owned by another pod.
+    /// </returns>
+    Task<bool> RenewLeaseAsync(string playSessionId, string ownerPod, CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Removes a transcoding session from the store.
+    /// </summary>
+    /// <param name="playSessionId">The play session identifier.</param>
+    /// <param name="cancellationToken">A cancellation token.</param>
+    /// <returns>A <see cref="Task"/> representing the asynchronous operation.</returns>
+    Task DeleteAsync(string playSessionId, CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Returns all currently active transcoding sessions from the store.
+    /// </summary>
+    /// <param name="cancellationToken">A cancellation token.</param>
+    /// <returns>
+    /// An enumerable of <see cref="TranscodeSession"/> objects representing all active sessions.
+    /// Returns an empty enumerable if no sessions are active or if the store cannot be reached.
+    /// </returns>
+    Task<IEnumerable<TranscodeSession>> GetActiveSessionsAsync(CancellationToken cancellationToken = default);
+}
@@ -0,0 +1,37 @@
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace MediaBrowser.Controller.MediaEncoding;
+
+/// <summary>
+/// A no-op implementation of <see cref="ITranscodeSessionStore"/> used in single-instance deployments
+/// where durable session tracking across pods is not required.
+/// </summary>
+public sealed class NullTranscodeSessionStore : ITranscodeSessionStore
+{
+    /// <inheritdoc />
+    public Task<TranscodeSession?> TryGetAsync(string playSessionId, CancellationToken cancellationToken = default)
+        => Task.FromResult<TranscodeSession?>(null);
+
+    /// <inheritdoc />
+    public Task<bool> TryTakeoverAsync(string playSessionId, string claimingPod, CancellationToken cancellationToken = default)
+        => Task.FromResult(false);
+
+    /// <inheritdoc />
+    public Task SetAsync(TranscodeSession session, CancellationToken cancellationToken = default)
+        => Task.CompletedTask;
+
+    /// <inheritdoc />
+    public Task<bool> RenewLeaseAsync(string playSessionId, string ownerPod, CancellationToken cancellationToken = default)
+        => Task.FromResult(true);
+
+    /// <inheritdoc />
+    public Task DeleteAsync(string playSessionId, CancellationToken cancellationToken = default)
+        => Task.CompletedTask;
+
+    /// <inheritdoc />
+    public Task<IEnumerable<TranscodeSession>> GetActiveSessionsAsync(CancellationToken cancellationToken = default)
+        => Task.FromResult<IEnumerable<TranscodeSession>>(Array.Empty<TranscodeSession>());
+}
@@ -0,0 +1,86 @@
+using System;
+using System.IO;
+
+namespace MediaBrowser.Controller.MediaEncoding;
+
+/// <summary>
+/// Represents a durable record of an HLS transcoding session for HA pod recovery.
+/// </summary>
+public sealed class TranscodeSession
+{
+    /// <summary>
+    /// Gets or sets the unique play session identifier.
+    /// </summary>
+    public string PlaySessionId { get; set; } = string.Empty;
+
+    /// <summary>
+    /// Gets or sets the name of the pod that currently owns this session's lease.
+    /// </summary>
+    public string OwnerPod { get; set; } = string.Empty;
+
+    /// <summary>
+    /// Gets or sets the UTC time at which the owning pod's lease expires.
+    /// </summary>
+    public DateTime LeaseExpiresUtc { get; set; }
+
+    /// <summary>
+    /// Gets or sets the absolute path to the HLS manifest (.m3u8) file on shared storage.
+    /// </summary>
+    public string ManifestPath { get; set; } = string.Empty;
+
+    /// <summary>
+    /// Gets or sets the path prefix for transcoded segment files on shared storage.
+    /// </summary>
+    public string SegmentPathPrefix { get; set; } = string.Empty;
+
+    /// <summary>
+    /// Gets or sets the media source identifier associated with this session.
+    /// </summary>
+    public string MediaSourceId { get; set; } = string.Empty;
+
+    /// <summary>
+    /// Gets or sets the zero-based index of the last segment that was fully written to durable storage.
+    /// </summary>
+    public int LastCompletedSegmentIndex { get; set; }
+
+    /// <summary>
+    /// Gets or sets the last durable playback offset in ticks, used to resume playback after failover.
+    /// </summary>
+    public long LastDurablePlaybackOffset { get; set; }
+
+    /// <summary>
+    /// Creates a session record for an HLS output, deriving <see cref="ManifestPath"/> and
+    /// <see cref="SegmentPathPrefix"/> from the playlist path so that cleanup can recognise
+    /// every file the session owns.
+    /// </summary>
+    /// <param name="playSessionId">The play session identifier.</param>
+    /// <param name="mediaSourceId">The media source identifier.</param>
+    /// <param name="ownerPod">The name of the pod that owns the session.</param>
+    /// <param name="playlistPath">The absolute path of the HLS playlist (.m3u8) file.</param>
+    /// <param name="leaseDuration">The initial lease duration.</param>
+    /// <returns>The new <see cref="TranscodeSession"/>.</returns>
+    public static TranscodeSession CreateForPlaylist(
+        string playSessionId,
+        string mediaSourceId,
+        string ownerPod,
+        string playlistPath,
+        TimeSpan leaseDuration)
+        => new TranscodeSession
+        {
+            PlaySessionId = playSessionId,
+            OwnerPod = ownerPod,
+            LeaseExpiresUtc = DateTime.UtcNow.Add(leaseDuration),
+            ManifestPath = playlistPath,
+            SegmentPathPrefix = GetSegmentPathPrefix(playlistPath),
+            MediaSourceId = mediaSourceId,
+        };
+
+    /// <summary>
+    /// Gets the prefix every segment file of the HLS output at <paramref name="playlistPath"/> starts with.
+    /// Segments are written as <c>&lt;playlist path without extension&gt;&lt;index&gt;&lt;segment extension&gt;</c>.
+    /// </summary>
+    /// <param name="playlistPath">The absolute path of the HLS playlist (.m3u8) file.</param>
+    /// <returns>The segment path prefix.</returns>
+    public static string GetSegmentPathPrefix(string playlistPath)
+        => Path.ChangeExtension(playlistPath, null) ?? playlistPath;
+}
@@ -0,0 +1,36 @@
+namespace MediaBrowser.Controller.MediaEncoding;
+
+/// <summary>
+/// Configuration options for the transcode session store.
+/// </summary>
+public sealed class TranscodeStoreOptions
+{
+    /// <summary>
+    /// The configuration section these options bind from.
+    /// </summary>
+    public const string ConfigurationSection = "Jellyfin:TranscodeStore";
+
+    /// <summary>
+    /// The configuration key holding the Redis connection string.
+    /// </summary>
+    public const string RedisConnectionStringKey = ConfigurationSection + ":RedisConnectionString";
+
+    /// <summary>
+    /// Gets or sets the Redis connection string.
+    /// A <c>null</c> or empty value indicates single-instance mode, where
+    /// <see cref="NullTranscodeSessionStore"/> is used instead of a Redis-backed store.
+    /// </summary>
+    public string? RedisConnectionString { get; set; }
+
+    /// <summary>
+    /// Gets or sets the duration in seconds for which a transcoding session lease is valid.
+    /// </summary>
+    public int LeaseDurationSeconds { get; set; } = 30;
+
+    /// <summary>
+    /// Gets or sets how long in seconds a session record is retained after its lease was last renewed.
+    /// The record must outlive the lease, otherwise an orphaned session is gone before another pod
+    /// can take it over.
+    /// </summary>
+    public int SessionRetentionSeconds { get; set; } = 300;
+}
@@ -0,0 +1,21 @@
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace MediaBrowser.Controller.ScheduledTasks;
+
+/// <summary>
+/// Provides a distributed leader lease that gates periodic, library-mutating scheduled tasks
+/// to a single instance across a multi-pod deployment.
+/// </summary>
+public interface IScanLeaderLease
+{
+    /// <summary>
+    /// Attempts to acquire the scan-leader lease, or renews it when this instance already holds it.
+    /// </summary>
+    /// <param name="cancellationToken">A cancellation token.</param>
+    /// <returns>
+    /// <c>true</c> if this instance holds the leader lease and gated periodic tasks may run here;
+    /// otherwise <c>false</c>.
+    /// </returns>
+    Task<bool> TryAcquireOrRenewAsync(CancellationToken cancellationToken = default);
+}
@@ -0,0 +1,16 @@
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace MediaBrowser.Controller.ScheduledTasks;
+
+/// <summary>
+/// A no-op <see cref="IScanLeaderLease"/> used when scan-leader election is disabled or no Redis
+/// connection is configured. Every instance is treated as the leader, preserving the default
+/// single-instance behavior where all periodic tasks run locally.
+/// </summary>
+public sealed class NullScanLeaderLease : IScanLeaderLease
+{
+    /// <inheritdoc />
+    public Task<bool> TryAcquireOrRenewAsync(CancellationToken cancellationToken = default)
+        => Task.FromResult(true);
+}
@@ -0,0 +1,56 @@
+namespace MediaBrowser.Controller.ScheduledTasks;
+
+/// <summary>
+/// Configuration options for scan-leader election, which gates periodic library-mutating
+/// scheduled tasks to a single leader instance in a multi-pod deployment.
+/// </summary>
+public sealed class ScanLeaderOptions
+{
+    /// <summary>
+    /// The configuration section these options bind from.
+    /// </summary>
+    public const string ConfigurationSection = "Jellyfin:ScanLeader";
+
+    /// <summary>
+    /// The configuration key that overrides the default enablement.
+    /// </summary>
+    public const string EnabledKey = ConfigurationSection + ":Enabled";
+
+    /// <summary>
+    /// Gets or sets a value indicating whether scan-leader election is enabled. When disabled,
+    /// every instance runs its periodic tasks as before. Left unset, election is enabled whenever a
+    /// Redis connection string is configured, because that is the only deployment shape that needs it.
+    /// </summary>
+    public bool Enabled { get; set; }
+
+    /// <summary>
+    /// Gets or sets the duration in seconds for which the scan-leader lease is held before it must
+    /// be renewed. A leader that stops renewing loses the lease after this duration.
+    /// </summary>
+    public int LeaseDurationSeconds { get; set; } = 60;
+
+    /// <summary>
+    /// Gets or sets the set of scheduled task keys whose periodic (timer-driven) execution is gated
+    /// to the scan leader. Tasks not listed here run on every instance, and manual or API-triggered
+    /// runs are never gated.
+    /// </summary>
+    public string[] GatedTaskKeys { get; set; } =
+    {
+        "RefreshLibrary",
+        "RefreshPeople",
+        "RefreshChapterImages",
+        "AudioNormalization",
+        "TaskExtractMediaSegments",
+        "KeyframeExtraction",
+        "CleanupUserDataTask",
+        "OptimizeDatabaseTask",
+        "DownloadLyrics",
+        "DownloadSubtitles",
+        "TmdbRefreshUpcomingEpisodes",
+        "RefreshTrickplayImages",
+        "MoveTrickplayImages",
+        "RefreshInternetChannels",
+        "RefreshGuide",
+        "PluginUpdates"
+    };
+}
@@ -0,0 +1,33 @@
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace MediaBrowser.Controller.Session;
+
+/// <summary>
+/// Point-to-point delivery between instances: every instance listens on a channel of its own, so a
+/// message can be addressed to the one instance holding a given connection.
+/// </summary>
+public interface IPodMessageBus
+{
+    /// <summary>
+    /// Gets the identity of this instance.
+    /// </summary>
+    string PodId { get; }
+
+    /// <summary>
+    /// Sends a message to one instance and reports how many listeners took it, so that a message
+    /// addressed to an instance that is no longer there is not mistaken for a delivered one.
+    /// </summary>
+    /// <param name="targetPod">The instance to deliver to.</param>
+    /// <param name="message">The message.</param>
+    /// <param name="cancellationToken">The cancellation token.</param>
+    /// <returns>The number of instances the message reached.</returns>
+    Task<long> PublishAsync(string targetPod, PodMessage message, CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Registers a handler for the messages addressed to this instance.
+    /// </summary>
+    /// <param name="handler">The handler.</param>
+    void Subscribe(Func<PodMessage, Task> handler);
+}
@@ -0,0 +1,47 @@
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace MediaBrowser.Controller.Session;
+
+/// <summary>
+/// The shared record of which instance holds which session. Entries expire, so an instance that stops
+/// refreshing them drops out of every other instance's view instead of lingering.
+/// </summary>
+public interface ISessionDirectory
+{
+    /// <summary>
+    /// Claims a session for the publishing instance and restarts its expiry. The claim is refused when
+    /// another instance holds the connection, so an instance that merely served a request for the session
+    /// cannot take ownership of it.
+    /// </summary>
+    /// <param name="entry">The entry.</param>
+    /// <param name="connectedUtcTicks">When the publishing instance's connection to the session was established, or zero when it holds none.</param>
+    /// <param name="cancellationToken">The cancellation token.</param>
+    /// <returns><c>true</c> if the entry was written.</returns>
+    Task<bool> PublishAsync(SessionDirectoryEntry entry, long connectedUtcTicks, CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Removes an entry, but only while the calling instance still owns it.
+    /// </summary>
+    /// <param name="sessionId">The session identifier.</param>
+    /// <param name="ownerPod">The instance requesting the removal.</param>
+    /// <param name="cancellationToken">The cancellation token.</param>
+    /// <returns>A task representing the operation.</returns>
+    Task RemoveAsync(string sessionId, string ownerPod, CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Gets one entry by session identifier.
+    /// </summary>
+    /// <param name="sessionId">The session identifier.</param>
+    /// <param name="cancellationToken">The cancellation token.</param>
+    /// <returns>The entry, or <c>null</c> when the session is in no instance's directory.</returns>
+    Task<SessionDirectoryEntry?> GetAsync(string sessionId, CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Gets every entry that has not expired.
+    /// </summary>
+    /// <param name="cancellationToken">The cancellation token.</param>
+    /// <returns>The entries.</returns>
+    Task<IReadOnlyList<SessionDirectoryEntry>> GetAllAsync(CancellationToken cancellationToken = default);
+}
@@ -80,7 +80,8 @@ namespace MediaBrowser.Controller.Session
        /// Used to report that a session controller has connected.
        /// </summary>
        /// <param name="session">The session.</param>
-        void OnSessionControllerConnected(SessionInfo session);
+        /// <returns>A task representing the operation.</returns>
+        Task OnSessionControllerConnected(SessionInfo session);

        void UpdateDeviceName(string sessionId, string reportedDeviceName);

@@ -241,7 +242,8 @@ namespace MediaBrowser.Controller.Session
        /// <param name="controllingSessionId">The controlling session identifier.</param>
        /// <param name="sessionId">The session identifier.</param>
        /// <param name="userId">The user identifier.</param>
-        void AddAdditionalUser(string controllingSessionId, string sessionId, Guid userId);
+        /// <returns>A task representing the operation.</returns>
+        Task AddAdditionalUser(string controllingSessionId, string sessionId, Guid userId);

        /// <summary>
        /// Removes the additional user.
@@ -249,7 +251,8 @@ namespace MediaBrowser.Controller.Session
        /// <param name="controllingSessionId">The controlling session identifier.</param>
        /// <param name="sessionId">The session identifier.</param>
        /// <param name="userId">The user identifier.</param>
-        void RemoveAdditionalUser(string controllingSessionId, string sessionId, Guid userId);
+        /// <returns>A task representing the operation.</returns>
+        Task RemoveAdditionalUser(string controllingSessionId, string sessionId, Guid userId);

        /// <summary>
        /// Reports the now viewing item.
@@ -306,8 +309,9 @@ namespace MediaBrowser.Controller.Session
        /// <param name="activeWithinSeconds">Active within session limit.</param>
        /// <param name="controllableUserToCheck">Filter for sessions remote controllable for this user.</param>
        /// <param name="isApiKey">Is the request authenticated with API key.</param>
-        /// <returns>IReadOnlyList{SessionInfoDto}.</returns>
-        IReadOnlyList<SessionInfoDto> GetSessions(Guid userId, string deviceId, int? activeWithinSeconds, Guid? controllableUserToCheck, bool isApiKey);
+        /// <param name="cancellationToken">The cancellation token.</param>
+        /// <returns>IReadOnlyList{SessionInfoDto}, including the sessions held by the other instances.</returns>
+        Task<IReadOnlyList<SessionInfoDto>> GetSessions(Guid userId, string deviceId, int? activeWithinSeconds, Guid? controllableUserToCheck, bool isApiKey, CancellationToken cancellationToken);

        /// <summary>
        /// Gets the session by authentication token.
@@ -0,0 +1,28 @@
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace MediaBrowser.Controller.Session;
+
+/// <summary>
+/// The single-instance <see cref="IPodMessageBus"/>: there is no other instance to reach.
+/// </summary>
+public sealed class NullPodMessageBus : IPodMessageBus
+{
+    /// <summary>
+    /// Gets the shared instance.
+    /// </summary>
+    public static NullPodMessageBus Instance { get; } = new NullPodMessageBus();
+
+    /// <inheritdoc />
+    public string PodId => PodIdentity.Current;
+
+    /// <inheritdoc />
+    public Task<long> PublishAsync(string targetPod, PodMessage message, CancellationToken cancellationToken = default)
+        => Task.FromResult(0L);
+
+    /// <inheritdoc />
+    public void Subscribe(Func<PodMessage, Task> handler)
+    {
+    }
+}
@@ -0,0 +1,34 @@
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace MediaBrowser.Controller.Session;
+
+/// <summary>
+/// The single-instance <see cref="ISessionDirectory"/>: nothing is published and no session is held
+/// anywhere but here, which is exactly the behaviour of a deployment without a shared store.
+/// </summary>
+public sealed class NullSessionDirectory : ISessionDirectory
+{
+    /// <summary>
+    /// Gets the shared instance.
+    /// </summary>
+    public static NullSessionDirectory Instance { get; } = new NullSessionDirectory();
+
+    /// <inheritdoc />
+    public Task<bool> PublishAsync(SessionDirectoryEntry entry, long connectedUtcTicks, CancellationToken cancellationToken = default)
+        => Task.FromResult(false);
+
+    /// <inheritdoc />
+    public Task RemoveAsync(string sessionId, string ownerPod, CancellationToken cancellationToken = default)
+        => Task.CompletedTask;
+
+    /// <inheritdoc />
+    public Task<SessionDirectoryEntry?> GetAsync(string sessionId, CancellationToken cancellationToken = default)
+        => Task.FromResult<SessionDirectoryEntry?>(null);
+
+    /// <inheritdoc />
+    public Task<IReadOnlyList<SessionDirectoryEntry>> GetAllAsync(CancellationToken cancellationToken = default)
+        => Task.FromResult<IReadOnlyList<SessionDirectoryEntry>>(Array.Empty<SessionDirectoryEntry>());
+}
@@ -0,0 +1,14 @@
+using System;
+
+namespace MediaBrowser.Controller.Session;
+
+/// <summary>
+/// The identity of this instance among the replicas sharing a deployment.
+/// </summary>
+public static class PodIdentity
+{
+    /// <summary>
+    /// Gets the identity of this instance.
+    /// </summary>
+    public static string Current => Environment.GetEnvironmentVariable("JELLYFIN_INSTANCE_ID") ?? Environment.MachineName;
+}
@@ -0,0 +1,23 @@
+namespace MediaBrowser.Controller.Session;
+
+/// <summary>
+/// An envelope addressed to one instance. <see cref="Kind"/> names the payload so that features other
+/// than session routing can share the same channel.
+/// </summary>
+public sealed class PodMessage
+{
+    /// <summary>
+    /// Gets or sets the payload discriminator.
+    /// </summary>
+    public string Kind { get; set; } = string.Empty;
+
+    /// <summary>
+    /// Gets or sets the identity of the sending instance.
+    /// </summary>
+    public string OriginPod { get; set; } = string.Empty;
+
+    /// <summary>
+    /// Gets or sets the serialized payload.
+    /// </summary>
+    public string Payload { get; set; } = string.Empty;
+}
@@ -0,0 +1,30 @@
+using System;
+
+namespace MediaBrowser.Controller.Session;
+
+/// <summary>
+/// An additional-user change for a session held by another instance, carried as a
+/// <see cref="PodMessage"/>. The calling instance has already authorized it.
+/// </summary>
+public sealed class RoutedAdditionalUserChange
+{
+    /// <summary>
+    /// The <see cref="PodMessage.Kind"/> this payload travels under.
+    /// </summary>
+    public const string Kind = "AdditionalUserChange";
+
+    /// <summary>
+    /// Gets or sets the session the change applies to.
+    /// </summary>
+    public string SessionId { get; set; } = string.Empty;
+
+    /// <summary>
+    /// Gets or sets the user to attach or detach.
+    /// </summary>
+    public Guid UserId { get; set; }
+
+    /// <summary>
+    /// Gets or sets a value indicating whether the user is being attached rather than detached.
+    /// </summary>
+    public bool Add { get; set; }
+}
@@ -0,0 +1,35 @@
+using System;
+using MediaBrowser.Model.Session;
+
+namespace MediaBrowser.Controller.Session;
+
+/// <summary>
+/// A websocket message for a session held by another instance, carried as a <see cref="PodMessage"/>.
+/// </summary>
+public sealed class RoutedSessionMessage
+{
+    /// <summary>
+    /// The <see cref="PodMessage.Kind"/> this payload travels under.
+    /// </summary>
+    public const string Kind = "SessionMessage";
+
+    /// <summary>
+    /// Gets or sets the session the message is addressed to.
+    /// </summary>
+    public string SessionId { get; set; } = string.Empty;
+
+    /// <summary>
+    /// Gets or sets the message type.
+    /// </summary>
+    public SessionMessageType MessageType { get; set; }
+
+    /// <summary>
+    /// Gets or sets the message identifier.
+    /// </summary>
+    public Guid MessageId { get; set; }
+
+    /// <summary>
+    /// Gets or sets the message data, serialized as JSON.
+    /// </summary>
+    public string Data { get; set; } = "null";
+}
@@ -0,0 +1,25 @@
+using MediaBrowser.Model.Dto;
+
+namespace MediaBrowser.Controller.Session;
+
+/// <summary>
+/// A session held by one instance, as the other instances see it.
+/// </summary>
+public sealed class SessionDirectoryEntry
+{
+    /// <summary>
+    /// Gets or sets the identity of the instance holding the connection.
+    /// </summary>
+    public string OwnerPod { get; set; } = string.Empty;
+
+    /// <summary>
+    /// Gets or sets a value indicating whether the owner holds a live connection to the session. Only an
+    /// owner that does can be routed a remote-control message.
+    /// </summary>
+    public bool HoldsConnection { get; set; }
+
+    /// <summary>
+    /// Gets or sets the session as its owner last rendered it.
+    /// </summary>
+    public SessionInfoDto? Session { get; set; }
+}
@@ -0,0 +1,28 @@
+namespace MediaBrowser.Controller.Session;
+
+/// <summary>
+/// Configuration options for the session directory and the cross-instance bus that goes with it.
+/// </summary>
+public sealed class SessionDirectoryOptions
+{
+    /// <summary>
+    /// The configuration section these options bind from.
+    /// </summary>
+    public const string ConfigurationSection = "Jellyfin:SessionDirectory";
+
+    /// <summary>
+    /// Gets or sets how long in seconds a published entry survives without being refreshed. An instance
+    /// that dies stops refreshing, so its sessions leave the directory after this long.
+    /// </summary>
+    public int EntryTtlSeconds { get; set; } = 60;
+
+    /// <summary>
+    /// Gets or sets how often in seconds an instance republishes the sessions it holds.
+    /// </summary>
+    public int RefreshIntervalSeconds { get; set; } = 20;
+
+    /// <summary>
+    /// Gets or sets how long in seconds a single directory operation may take before it is abandoned.
+    /// </summary>
+    public int OperationTimeoutSeconds { get; set; } = 5;
+}
@@ -1,6 +1,9 @@
 #nullable disable

+using System;
+using System.Collections.Generic;
 using Jellyfin.Database.Implementations.Entities;
+using MediaBrowser.Controller.Entities;
 using MediaBrowser.Controller.Library;

 namespace MediaBrowser.Controller.Sorting
@@ -27,5 +30,16 @@ namespace MediaBrowser.Controller.Sorting
        /// </summary>
        /// <value>The user data repository.</value>
        IUserDataManager UserDataManager { get; set; }
+
+        /// <summary>
+        /// Gets or sets user data for the items being sorted, keyed by item id, read once up front.
+        /// A comparer that does not store it reads its user data one item at a time instead.
+        /// </summary>
+        /// <value>The prefetched user data, or <c>null</c> when none was prefetched.</value>
+        IReadOnlyDictionary<Guid, UserItemData> PrefetchedUserData
+        {
+            get => null;
+            set { }
+        }
    }
 }
@@ -0,0 +1,28 @@
+#nullable disable
+
+using MediaBrowser.Controller.Entities;
+
+namespace MediaBrowser.Controller.Sorting
+{
+    /// <summary>
+    /// Helpers shared by the comparers that sort on user data.
+    /// </summary>
+    public static class UserBaseItemComparerExtensions
+    {
+        /// <summary>
+        /// Gets the user data for an item, preferring the batch the sort prefetched.
+        /// </summary>
+        /// <param name="comparer">The comparer.</param>
+        /// <param name="item">The item.</param>
+        /// <returns>The item's user data.</returns>
+        public static UserItemData GetUserData(this IUserBaseItemComparer comparer, BaseItem item)
+        {
+            if (comparer.PrefetchedUserData is not null && comparer.PrefetchedUserData.TryGetValue(item.Id, out var userData))
+            {
+                return userData;
+            }
+
+            return comparer.UserDataManager.GetUserData(comparer.User, item);
+        }
+    }
+}
@@ -1,7 +1,10 @@
 #pragma warning disable CA1819 // XML serialization handles collections improperly, so we need to use arrays

 #nullable disable
+using System;
 using System.ComponentModel;
+using System.Text.Json.Serialization;
+using System.Xml.Serialization;
 using MediaBrowser.Model.Entities;

 namespace MediaBrowser.Model.Configuration;
@@ -25,6 +28,8 @@ public class EncodingOptions
        ThrottleDelaySeconds = 180;
        EnableSegmentDeletion = false;
        SegmentKeepSeconds = 720;
+        RecoverySegmentLengthSeconds = 2;
+        RecoverySegmentBufferCount = 5;
        EncodingThreadCount = -1;
        // This is a DRM device that is almost guaranteed to be there on every intel platform,
        // plus it's the default one in ffmpeg if you don't specify anything
@@ -125,6 +130,20 @@ public class EncodingOptions
    /// </summary>
    public int SegmentKeepSeconds { get; set; }

+    /// <summary>
+    /// Gets or sets the HLS segment length in seconds to use when HA recovery mode is active.
+    /// Shorter segments allow a takeover pod to resume playback faster after a peer failure.
+    /// Default is <c>2</c>. Valid range is 1-6.
+    /// </summary>
+    public int RecoverySegmentLengthSeconds { get; set; }
+
+    /// <summary>
+    /// Gets or sets the number of HLS segments to keep on disk when HA recovery mode is active.
+    /// This acts as a rolling buffer that a takeover pod can serve while restarting the transcode.
+    /// Default is <c>5</c>. Valid range is 2-10.
+    /// </summary>
+    public int RecoverySegmentBufferCount { get; set; }
+
    /// <summary>
    /// Gets or sets the hardware acceleration type.
    /// </summary>
@@ -218,8 +237,27 @@ public class EncodingOptions
    /// <summary>
    /// Gets or sets the encoder preset.
    /// </summary>
+    [XmlIgnore]
    public EncoderPreset EncoderPreset { get; set; }

+    /// <summary>
+    /// Gets or sets the encoder preset as it is stored in the configuration file. Files written before the preset
+    /// list was validated can carry an empty element, which has to read back as the default rather than throw and
+    /// take the rest of the configuration down with it.
+    /// </summary>
+    [JsonIgnore]
+    [XmlElement(nameof(EncoderPreset))]
+    public string EncoderPresetXml
+    {
+        get => EncoderPreset.ToString();
+
+        // TryParse also accepts a number, which would yield a preset value nothing maps to, so the result has to be
+        // a declared one.
+        set => EncoderPreset = Enum.TryParse<EncoderPreset>(value, true, out var encoderPreset) && Enum.IsDefined(encoderPreset)
+            ? encoderPreset
+            : EncoderPreset.auto;
+    }
+
    /// <summary>
    /// Gets or sets a value indicating whether the framerate is doubled when deinterlacing.
    /// </summary>
@@ -12,7 +12,7 @@ public class NextUpQuery
    {
        EnableImageTypes = Array.Empty<ImageType>();
        EnableTotalRecordCount = true;
-        NextUpDateCutoff = DateTime.MinValue;
+        NextUpDateCutoff = DateTime.SpecifyKind(DateTime.MinValue, DateTimeKind.Utc);
        EnableResumable = false;
        EnableRewatching = false;
    }
@@ -56,7 +56,7 @@ public class NextUpQuery
    public bool EnableTotalRecordCount { get; set; }

    /// <summary>
-    /// Gets or sets a value indicating the oldest date for a show to appear in Next Up.
+    /// Gets or sets a value indicating the oldest date, in UTC, for a show to appear in Next Up.
    /// </summary>
    public DateTime NextUpDateCutoff { get; set; }

@@ -1,64 +1,574 @@
-<h1 align="center">Jellyfin</h1>
-<h3 align="center">The Free Software Media System</h3>
+# jellyfin-ha
+
+**A fork of [Jellyfin](https://github.com/jellyfin/jellyfin) adding high-availability transcoding support for multi-pod Kubernetes deployments.**
+
+[![License: GPL v2](https://img.shields.io/badge/License-GPL_v2-blue.svg)](https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html)
+[![.NET 10](https://img.shields.io/badge/.NET-10.0-purple)](https://dotnet.microsoft.com/download/dotnet/10.0)
+[![Upstream](https://img.shields.io/badge/upstream-jellyfin%2Fjellyfin-informational)](https://github.com/jellyfin/jellyfin)

 ---

-<p align="center">
-<img alt="Logo Banner" src="https://raw.githubusercontent.com/jellyfin/jellyfin-ux/master/branding/SVG/banner-logo-solid.svg?sanitize=true"/>
-<br/>
-<br/>
-<a href="https://github.com/jellyfin/jellyfin"><img alt="GPL 2.0 License" src="https://img.shields.io/github/license/jellyfin/jellyfin.svg"/></a>
-<a href="https://github.com/jellyfin/jellyfin/releases"><img alt="Current Release" src="https://img.shields.io/github/release/jellyfin/jellyfin.svg"/></a>
-<a href="https://translate.jellyfin.org/projects/jellyfin/jellyfin-core/?utm_source=widget"><img alt="Translation Status" src="https://translate.jellyfin.org/widgets/jellyfin/-/jellyfin-core/svg-badge.svg"/></a>
-<a href="https://hub.docker.com/r/jellyfin/jellyfin"><img alt="Docker Pull Count" src="https://img.shields.io/docker/pulls/jellyfin/jellyfin.svg"/></a>
-<br/>
-<a href="https://opencollective.com/jellyfin"><img alt="Donate" src="https://img.shields.io/opencollective/all/jellyfin.svg?label=backers"/></a>
-<a href="https://features.jellyfin.org"><img alt="Submit Feature Requests" src="https://img.shields.io/badge/fider-vote%20on%20features-success.svg"/></a>
-<a href="https://matrix.to/#/#jellyfinorg:matrix.org"><img alt="Chat on Matrix" src="https://img.shields.io/matrix/jellyfinorg:matrix.org.svg?logo=matrix"/></a>
-<a href="https://github.com/jellyfin/jellyfin/releases.atom"><img alt="Release RSS Feed" src="https://img.shields.io/badge/rss-releases-ffa500?logo=rss" /></a>
-<a href="https://github.com/jellyfin/jellyfin/commits/master.atom"><img alt="Master Commits RSS Feed" src="https://img.shields.io/badge/rss-commits-ffa500?logo=rss" /></a>
-</p>
+## What is this?
+
+Jellyfin's default assumption is that exactly one server instance is running at a time. Transcode state is held entirely in-memory — when the process dies, so do all active HLS streams. For homelab deployments that want Kubernetes-managed redundancy (rolling restarts, node drain, pod rescheduling), that's a problem.
+
+This fork adds a thin HA layer on top of unmodified Jellyfin core:
+
+- **`ITranscodeSessionStore`** — a new interface for durable, distributed transcode session tracking
+- **`RedisTranscodeSessionStore`** — a Redis-backed implementation using atomic Lua takeover scripts and TTL-based lease expiry
+- **`NullTranscodeSessionStore`** — a no-op fallback so single-instance deployments work with zero configuration change
+- **Lease-aware `DeleteTranscodeFileTask`** — coordinates cleanup across replicas so a restarting pod doesn't delete segments another pod is actively streaming
+- **PostgreSQL database provider** — alternative to SQLite for shared-database HA setups (experimental, under `src/Jellyfin.Database/Jellyfin.Database.Providers.PostgreSQL`)

 ---

-Jellyfin is a Free Software Media System that puts you in control of managing and streaming your media. It is an alternative to the proprietary Emby and Plex, to provide media from a dedicated server to end-user devices via multiple apps. Jellyfin is descended from Emby's 3.5.2 release and ported to the .NET platform to enable full cross-platform support.
+## Architecture

-There are no strings attached, no premium licenses or features, and no hidden agendas: just a team that wants to build something better and work together to achieve it. We welcome anyone who is interested in joining us in our quest!
+```
+┌─────────────┐     ┌─────────────┐
+│  Jellyfin   │     │  Jellyfin   │
+│   Pod A     │     │   Pod B     │
+│             │     │             │
+│ ┌─────────┐ │     │ ┌─────────┐ │
+│ │Transcode│ │     │ │Transcode│ │
+│ │Manager  │ │     │ │Manager  │ │
+│ └────┬────┘ │     │ └────┬────┘ │
+└──────┼──────┘     └──────┼──────┘
+       │                   │
+       └─────────┬─────────┘
+                 │
+         ┌───────▼───────┐
+         │  Redis        │   ← ITranscodeSessionStore
+         │  (lease store)│     TTL-based ownership
+         └───────────────┘

-For further details, please see [our documentation page](https://jellyfin.org/docs/). To receive the latest updates, get help with Jellyfin, and join the community, please visit [one of our communication channels](https://jellyfin.org/docs/general/getting-help). For more information about the project, please see our [about page](https://jellyfin.org/docs/general/about).
+       ┌─────────────────────┐
+       │  Shared NAS / NFS   │   ← HLS segments + manifests
+       │  (shared storage)   │
+       └─────────────────────┘
+```

-<strong>Want to get started?</strong><br/>
-Check out our <a href="https://jellyfin.org/downloads">downloads page</a> or our <a href="https://jellyfin.org/docs/general/installation/">installation guide</a>, then see our <a href="https://jellyfin.org/docs/general/quick-start">quick start guide</a>. You can also <a href="https://jellyfin.org/docs/general/installation/source">build from source</a>.<br/>
+**How takeover works:**

-<strong>Something not working right?</strong><br/>
-Open an <a href="https://jellyfin.org/docs/general/contributing/issues">Issue</a> on GitHub.<br/>
-
-<strong>Want to contribute?</strong><br/>
-Check out our <a href="https://jellyfin.org/contribute">contributing choose-your-own-adventure</a> to see where you can help, then see our <a href="https://jellyfin.org/docs/general/contributing/">contributing guide</a> and our <a href="https://jellyfin.org/docs/general/community-standards">community standards</a>.<br/>
-
-<strong>New idea or improvement?</strong><br/>
-Check out our <a href="https://features.jellyfin.org/?view=most-wanted">feature request hub</a>.<br/>
-
-<strong>Don't see Jellyfin in your language?</strong><br/>
-Check out our <a href="https://translate.jellyfin.org">Weblate instance</a> to help translate Jellyfin and its subprojects.<br/>
-
-<a href="https://translate.jellyfin.org/engage/jellyfin/?utm_source=widget">
-<img src="https://translate.jellyfin.org/widgets/jellyfin/-/jellyfin-web/multi-auto.svg" alt="Detailed Translation Status"/>
-</a>
+1. Pod A starts an HLS transcode and writes a `TranscodeSession` to Redis with a 30-second lease.
+2. Pod A renews the lease every `LeaseDurationSeconds / 3` seconds; the renewal is rejected if Pod A no longer owns it.
+3. If Pod A dies, the lease expires in Redis after 30 seconds.
+4. Pod B receives a client request for the same play session, calls `TryTakeoverAsync`, and atomically claims ownership via a Lua script.
+5. Pod B resumes FFmpeg from the last durable segment index. The client sees a brief stutter, not an error.

 ---

-## Jellyfin Server
+## Quick Start

-This repository contains the code for Jellyfin's backend server. Note that this is only one of many projects under the Jellyfin GitHub [organization](https://github.com/jellyfin/) on GitHub. If you want to contribute, you can start by checking out our [documentation](https://jellyfin.org/docs/general/contributing/index.html) to see what to work on.
+### Single instance (no Redis)

-## Server Development
+No configuration required. `NullTranscodeSessionStore` is used automatically. Behavior is identical to upstream Jellyfin.

-These instructions will help you get set up with a local development environment in order to contribute to this repository. Before you start, please be sure to completely read our [guidelines on development contributions](https://jellyfin.org/docs/general/contributing/development.html). Note that this project is supported on all major operating systems except FreeBSD, which is still incompatible.
+```bash
+dotnet run --project Jellyfin.Server/Jellyfin.Server.csproj -- \
+  --datadir /var/lib/jellyfin \
+  --webdir /usr/share/jellyfin/web
+```
+
+### HA mode with Redis
+
+Set the `Jellyfin:TranscodeStore:RedisConnectionString` configuration key. You can pass it as a `Jellyfin__TranscodeStore__RedisConnectionString` environment variable, as the equivalent `JELLYFIN_` prefixed variable, or in a JSON config file.
+
+**Environment variable:**
+
+```bash
+export Jellyfin__TranscodeStore__RedisConnectionString="redis:6379"
+export Jellyfin__TranscodeStore__LeaseDurationSeconds="30"
+
+dotnet run --project Jellyfin.Server/Jellyfin.Server.csproj -- \
+  --datadir /var/lib/jellyfin \
+  --webdir /usr/share/jellyfin/web
+```
+
+**`appsettings.json` section:**
+
+```json
+{
+  "Jellyfin": {
+    "TranscodeStore": {
+      "RedisConnectionString": "redis:6379,abortConnect=false",
+      "LeaseDurationSeconds": 30
+    }
+  }
+}
+```
+
+The selected store is logged at startup, so HA transcoding is never on or off without a signal:
+
+```
+Transcode session store: RedisTranscodeSessionStore on valkey:6379.
+Redis transcode session store is reachable (2ms round trip). HA transcode takeover is active.
+```
+
+Without a connection string the line reads `Transcode session store: NullTranscodeSessionStore`. A configured but unreachable store is logged at `Error`; the server keeps serving with per-instance sessions rather than refusing to start.
+
+---
+
+## Configuration Reference
+
+| Key | Default | Description |
+|-----|---------|-------------|
+| `Jellyfin:TranscodeStore:RedisConnectionString` | _(empty)_ | StackExchange.Redis connection string. Empty = single-instance mode. |
+| `Jellyfin:TranscodeStore:LeaseDurationSeconds` | `30` | How long a pod's transcode lease is valid before another pod may take over. |
+| `Jellyfin:TranscodeStore:SessionRetentionSeconds` | `300` | How long an unrenewed session record is kept so another pod can still take it over. |
+| `Jellyfin:SessionDirectory:EntryTtlSeconds` | `60` | How long a published session stays visible to the other pods without being refreshed. |
+| `Jellyfin:SessionDirectory:RefreshIntervalSeconds` | `20` | How often a pod republishes the sessions it holds. |
+| `Jellyfin:SessionDirectory:OperationTimeoutSeconds` | `5` | How long a single session directory read or write may take before it is abandoned. |
+
+### Redis connection string examples
+
+```
+# Standalone Redis
+redis:6379
+
+# With password
+redis:6379,password=secret
+
+# With TLS
+redis.example.com:6380,ssl=true,abortConnect=false
+
+# Redis Sentinel
+sentinel-host:26379,serviceName=mymaster
+```
+
+Standard [StackExchange.Redis connection string format](https://stackexchange.github.io/StackExchange.Redis/Configuration) is accepted.
+
+---
+
+## Deployment
+
+> **This project is designed to run as a container.** Running it as a bare `dotnet` process is fine for development and testing, but the HA benefits only materialize when you have multiple replicas managed by a container orchestrator. Docker Compose gets you Redis + Jellyfin wired together locally. Kubernetes (k3s, k8s, or a managed cloud cluster) gets you the actual pod-death-and-recovery story.
+>
+> Don't have a Kubernetes cluster yet? [DigitalOcean Kubernetes](https://www.digitalocean.com/?refcode=b9012919f7ff&utm_campaign=Referral_Invite&utm_medium=Referral_Program&utm_source=badge) is the fastest path to a managed cluster if you don't want to run your own nodes.
+
+---
+
+### Option 1 — Local HA with Docker Compose
+
+The simplest way to test the full HA stack locally: two Jellyfin replicas sharing a Redis instance and a local volume for transcode output.
+
+```yaml
+# docker-compose.yml
+version: "3.9"
+
+services:
+  redis:
+    image: redis:7-alpine
+    ports:
+      - "6379:6379"
+
+  jellyfin-1:
+    build:
+      context: .
+      dockerfile: Dockerfile.runtime
+    environment:
+      Jellyfin__TranscodeStore__RedisConnectionString: "redis:6379,abortConnect=false"
+      Jellyfin__TranscodeStore__LeaseDurationSeconds: "30"
+      JELLYFIN_HA_POD_NAME: "jellyfin-1"
+    volumes:
+      - ./data/config:/config
+      - ./data/media:/media:ro
+      - transcode-tmp:/transcode
+    ports:
+      - "8096:8096"
+    depends_on:
+      - redis
+
+  jellyfin-2:
+    build:
+      context: .
+      dockerfile: Dockerfile.runtime
+    environment:
+      Jellyfin__TranscodeStore__RedisConnectionString: "redis:6379,abortConnect=false"
+      Jellyfin__TranscodeStore__LeaseDurationSeconds: "30"
+      JELLYFIN_HA_POD_NAME: "jellyfin-2"
+    volumes:
+      - ./data/config:/config
+      - ./data/media:/media:ro
+      - transcode-tmp:/transcode
+    ports:
+      - "8097:8096"
+    depends_on:
+      - redis
+
+volumes:
+  transcode-tmp:
+```
+
+Build the image first (the `dotnet publish` step runs outside Docker for I/O performance):
+
+```bash
+dotnet publish Jellyfin.Server/Jellyfin.Server.csproj \
+  --configuration Release \
+  --runtime linux-x64 \
+  --self-contained false \
+  --output ./publish-output
+
+docker compose up
+```
+
+Both replicas share the `transcode-tmp` volume and register sessions in Redis. Kill one container mid-stream (`docker kill jellyfin-1`) and the other takes over within `LeaseDurationSeconds`.
+
+---
+
+### Option 2 — Kubernetes (k3s / k8s)
+
+This is the intended production deployment. You need:
+
+1. A Kubernetes cluster (k3s, kubeadm, EKS, GKE, DigitalOcean Kubernetes, etc.)
+2. A Redis instance (in-cluster or managed)
+3. A `ReadWriteMany` storage class for shared transcode scratch space (NFS, Longhorn RWX, Ceph RBD, or a cloud-managed RWX PVC)
+
+#### Redis (in-cluster, standalone)
+
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: redis
+  namespace: jellyfin
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: redis
+  template:
+    metadata:
+      labels:
+        app: redis
+    spec:
+      containers:
+        - name: redis
+          image: redis:7-alpine
+          ports:
+            - containerPort: 6379
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: redis
+  namespace: jellyfin
+spec:
+  selector:
+    app: redis
+  ports:
+    - port: 6379
+```
+
+#### Redis connection secret
+
+```bash
+kubectl create secret generic jellyfin-redis \
+  --namespace jellyfin \
+  --from-literal=connection-string="redis.jellyfin.svc.cluster.local:6379,abortConnect=false"
+```
+
+#### Shared transcode PVC (RWX)
+
+```yaml
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: jellyfin-transcode
+  namespace: jellyfin
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: longhorn  # or nfs-client, csi-driver-nfs, etc.
+  resources:
+    requests:
+      storage: 20Gi
+```
+
+#### Jellyfin Deployment
+
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: jellyfin
+  namespace: jellyfin
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: jellyfin
+  template:
+    metadata:
+      labels:
+        app: jellyfin
+    spec:
+      containers:
+        - name: jellyfin
+          image: your-registry/jellyfin-ha:latest
+          ports:
+            - containerPort: 8096
+          env:
+            - name: Jellyfin__TranscodeStore__RedisConnectionString
+              valueFrom:
+                secretKeyRef:
+                  name: jellyfin-redis
+                  key: connection-string
+            - name: Jellyfin__TranscodeStore__LeaseDurationSeconds
+              value: "30"
+            - name: JELLYFIN_HA_POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+          volumeMounts:
+            - name: config
+              mountPath: /config
+            - name: media
+              mountPath: /media
+              readOnly: true
+            - name: transcode
+              mountPath: /transcode
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 8096
+            initialDelaySeconds: 30
+            periodSeconds: 10
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 8096
+            initialDelaySeconds: 10
+            periodSeconds: 5
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: jellyfin-config   # RWO is fine — config is single-writer
+        - name: media
+          nfs:
+            server: your-nas.local
+            path: /media
+        - name: transcode
+          persistentVolumeClaim:
+            claimName: jellyfin-transcode  # Must be RWX
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: jellyfin
+  namespace: jellyfin
+spec:
+  type: ClusterIP
+  selector:
+    app: jellyfin
+  ports:
+    - port: 8096
+      targetPort: 8096
+```
+
+#### Important: storage requirements
+
+| Volume | Access mode | Why |
+|--------|-------------|-----|
+| Config (`/config`) | `ReadWriteOnce` | One writer, SQLite DB lives here |
+| Media (`/media`) | `ReadOnlyMany` | All pods read the same library |
+| Transcode (`/transcode`) | **`ReadWriteMany`** | Pods read each other's HLS segments during takeover |
+
+The transcode volume is the critical one. If it's `ReadWriteOnce`, pod takeover will fail because Pod B cannot read the `.ts` segments Pod A wrote. Use NFS, Longhorn with RWX enabled, or a cloud-managed RWX storage class.
+
+#### Building the image
+
+```bash
+# Publish (run on host, not inside Docker)
+dotnet publish Jellyfin.Server/Jellyfin.Server.csproj \
+  --configuration Release \
+  --runtime linux-x64 \
+  --self-contained false \
+  --output ./publish-output
+
+# Build for amd64 (required for most clusters)
+docker buildx build \
+  --platform linux/amd64 \
+  --provenance=false \
+  -f Dockerfile.runtime \
+  -t your-registry/jellyfin-ha:latest \
+  --push .
+```
+
+> Note: `--provenance=false` is required if your cluster runs containerd (k3s, most kubeadm setups). Without it, Docker adds OCI attestation manifests that containerd cannot resolve.
+
+---
+
+### Option 3 — Bare dotnet (development only)
+
+For local development and testing without containers. HA mode still works — you just run two terminal sessions pointing at the same Redis and a shared local directory.
+
+**Terminal 1:**
+
+```bash
+export Jellyfin__TranscodeStore__RedisConnectionString="localhost:6379"
+export JELLYFIN_HA_POD_NAME="dev-pod-1"
+
+dotnet run --project Jellyfin.Server/Jellyfin.Server.csproj -- \
+  --datadir /tmp/jellyfin-1/data \
+  --cachedir /tmp/jellyfin-1/cache \
+  --transcodes /tmp/jellyfin-shared/transcode \
+  --webdir /usr/share/jellyfin/web \
+  --port 8096
+```
+
+**Terminal 2:**
+
+```bash
+export Jellyfin__TranscodeStore__RedisConnectionString="localhost:6379"
+export JELLYFIN_HA_POD_NAME="dev-pod-2"
+
+dotnet run --project Jellyfin.Server/Jellyfin.Server.csproj -- \
+  --datadir /tmp/jellyfin-2/data \
+  --cachedir /tmp/jellyfin-2/cache \
+  --transcodes /tmp/jellyfin-shared/transcode \
+  --webdir /usr/share/jellyfin/web \
+  --port 8097
+```
+
+Both instances share `/tmp/jellyfin-shared/transcode`. Kill one process mid-stream to test takeover. Start a local Redis with `redis-server` or `docker run -p 6379:6379 redis:7-alpine`.
+
+---
+
+## PostgreSQL (experimental)
+
+This fork includes a PostgreSQL database provider under `src/Jellyfin.Database/Jellyfin.Database.Providers.PostgreSQL`. It is experimental — the SQLite provider remains the default and the recommended choice for most deployments.
+
+To use PostgreSQL, set the migration provider at startup and run migrations:
+
+```bash
+dotnet ef migrations add InitialCreate \
+  --project "src/Jellyfin.Database/Jellyfin.Database.Providers.PostgreSQL" \
+  -- --migration-provider Jellyfin-PostgreSQL
+```
+
+See `src/Jellyfin.Database/readme.md` for full migration instructions.
+
+---
+
+## Building and Testing

 ### Prerequisites

-Before the project can be built, you must first install the [.NET 10 SDK](https://dotnet.microsoft.com/download/dotnet) on your system.
+- [.NET 10 SDK](https://dotnet.microsoft.com/download/dotnet/10.0)
+
+### Build
+
+```bash
+dotnet build Jellyfin.Server/Jellyfin.Server.csproj
+```
+
+### Run all tests
+
+```bash
+dotnet test Jellyfin.sln \
+  --configuration Release \
+  --filter "Category!=RequiresDocker&FullyQualifiedName!~Integration"
+```
+
+### Run the PostgreSQL migration tests
+
+They run the startup migration chain against a real server. Set `JELLYFIN_TEST_POSTGRES` to a
+connection string for an already running server and they use it; without it they start a container
+through testcontainers.
+
+```bash
+dotnet test tests/Jellyfin.Server.Tests \
+  --configuration Release \
+  --filter "Category=RequiresDocker"
+```
+
+### Run HA-specific tests
+
+The transcode session store and HA recovery tests live in:
+
+- `tests/Jellyfin.Server.Implementations.Tests/MediaEncoding/RedisTranscodeSessionStoreTests.cs` (real Redis, `Category=RequiresDocker`)
+- `tests/Jellyfin.MediaEncoding.Tests/Transcoding/InMemoryTranscodeSessionStoreTests.cs`
+
+```bash
+dotnet test tests/Jellyfin.Server.Implementations.Tests \
+  --configuration Release \
+  --filter "FullyQualifiedName~TranscodeSession"
+```
+
+### Run with code coverage
+
+```bash
+dotnet test Jellyfin.sln \
+  --configuration Release \
+  --collect:"XPlat Code Coverage" \
+  --settings tests/coverletArgs.runsettings
+```
+
+---
+
+## Project Structure
+
+```
+MediaBrowser.Controller/MediaEncoding/
+  ITranscodeSessionStore.cs        ← Interface (DI contract)
+  TranscodeSession.cs              ← Session record model
+  TranscodeStoreOptions.cs         ← Configuration options
+  NullTranscodeSessionStore.cs     ← No-op, single-instance fallback
+
+Emby.Server.Implementations/MediaEncoding/
+  RedisTranscodeSessionStore.cs    ← Redis-backed HA implementation
+
+src/Jellyfin.Database/
+  Jellyfin.Database.Providers.PostgreSQL/  ← Experimental PostgreSQL provider
+
+tests/
+  Jellyfin.Server.Implementations.Tests/MediaEncoding/
+    RedisTranscodeSessionStoreTests.cs    ← real Redis via Testcontainers
+  Jellyfin.MediaEncoding.Tests/
+    Fakes/InMemoryTranscodeSessionStore.cs
+    Transcoding/InMemoryTranscodeSessionStoreTests.cs
+```
+
+---
+
+## Contributing
+
+This is a personal experiment, not an officially maintained fork. Issues and PRs are welcome but response time may vary.
+
+If you're interested in getting proper HA transcoding into upstream Jellyfin, that conversation belongs in the [upstream repo](https://github.com/jellyfin/jellyfin). The changes here are deliberately narrow and designed to be upstream-friendly if there's maintainer interest.
+
+**Code conventions** follow the upstream Jellyfin rules:
+- `async`/`await` everywhere — no `.Result` or `.Wait()`
+- All public members need XML doc comments
+- Use `Directory.Packages.props` for NuGet versions — never add `Version=` to a `<PackageReference>`
+- `.NET 10` required
+- Warnings are treated as errors
+
+---
+
+## Relationship to upstream
+
+This fork tracks [jellyfin/jellyfin](https://github.com/jellyfin/jellyfin) release tags and is currently based on `v12.0`. The HA additions are intentionally isolated to:
+
+1. New interfaces and models in `MediaBrowser.Controller`
+2. New implementations in `Emby.Server.Implementations`
+3. DI wiring in `Jellyfin.Server/CoreAppHost.cs`
+4. New test projects
+
+No core Jellyfin logic was modified — only extended via existing DI extension points.
+
+---
+
+## License
+
+GPL-2.0, same as upstream Jellyfin. See [LICENSE](LICENSE).
+
+---
+
+*Upstream README preserved below for reference.*
+
+---

 Instructions to run this project from the command line are included here, but you will also need to install an IDE if you want to debug the server while it is running. Any IDE that supports .NET 6 development will work, but two options are recent versions of [Visual Studio](https://visualstudio.microsoft.com/downloads/) (at least 2022) and [Visual Studio Code](https://code.visualstudio.com/Download).

@@ -177,5 +687,7 @@ Since this is a common scenario, there is also a separate launch profile defined
 This project is supported by:
 <br/>
 <br/>
+<a href="https://www.digitalocean.com"><img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" height="50px" alt="DigitalOcean"></a>
+    &nbsp;
 <a href="https://www.jetbrains.com"><img src="https://gist.githubusercontent.com/anthonylavado/e8b2403deee9581e0b4cb8cd675af7db/raw/199ae22980ef5da64882ec2de3e8e5c03fe535b8/jetbrains.svg" height="50px" alt="JetBrains logo"></a>
 </p>
@@ -0,0 +1,22 @@
+apiVersion: v2
+name: jellyfin-ha
+description: >
+  High-availability Jellyfin media server with Redis-backed transcode session
+  store, lease-aware segment cleanup, and optional PostgreSQL database provider
+  for multi-pod Kubernetes deployments.
+type: application
+version: 0.1.0
+appVersion: "12.0.0"
+keywords:
+  - jellyfin
+  - media-server
+  - high-availability
+  - redis
+  - kubernetes
+home: https://github.com/ZoltyMat/jellyfin-ha
+sources:
+  - https://github.com/ZoltyMat/jellyfin-ha
+maintainers:
+  - name: ZoltyMat
+    url: https://github.com/ZoltyMat
+icon: https://raw.githubusercontent.com/jellyfin/jellyfin/master/Jellyfin.Server/Resources/Images/jellyfin-icon-solid.png
@@ -0,0 +1,49 @@
+1. Jellyfin HA has been deployed.
+
+{{- if eq (int .Values.replicaCount) 1 }}
+⚠  replicaCount=1 — running in single-instance mode. Set replicaCount >= 2 and
+   ha.enabled=true to enable HA transcoding.
+{{- else }}
+✔  Running {{ .Values.replicaCount }} replicas.
+{{- if include "jellyfin-ha.haEnabled" . }}
+✔  HA mode: ACTIVE — transcode sessions replicated via Redis.
+{{- else }}
+⚠  HA mode: INACTIVE — NullTranscodeSessionStore in use.
+   Set redis.enabled=true (or ha.transcodeStore.redisConnectionString) to enable HA.
+{{- end }}
+{{- end }}
+
+2. Get the Jellyfin URL:
+
+{{- if .Values.ingress.enabled }}
+{{- range .Values.ingress.hosts }}
+  https://{{ .host }}/
+{{- end }}
+{{- else if .Values.traefikIngressRoute.enabled }}
+  https://{{ .Values.traefikIngressRoute.host }}/
+{{- else }}
+  Access via port-forward:
+  kubectl port-forward -n {{ .Release.Namespace }} svc/{{ include "jellyfin-ha.fullname" . }} 8096:{{ .Values.service.port }}
+  http://localhost:8096/
+{{- end }}
+
+3. PostgreSQL:
+{{- if .Values.postgresql.enabled }}
+✔  In-cluster PostgreSQL deployed. Ensure the secret "{{ .Values.postgresql.existingSecret }}"
+   exists in namespace {{ .Release.Namespace }} before starting the server.
+{{- else if eq .Values.config.databaseType "Jellyfin-PostgreSQL" }}
+⚠  config.databaseType=Jellyfin-PostgreSQL but postgresql.enabled=false.
+   Make sure you have an external PostgreSQL and the correct DATABASE_URL env var set.
+{{- else }}
+   Using SQLite (default). Enable postgresql.enabled=true for a shared database backend.
+{{- end }}
+
+4. Transcode storage:
+   The transcode PVC must be ReadWriteMany when replicaCount > 1.
+   Current accessMode: {{ .Values.persistence.transcode.accessMode }}
+{{- if and (gt (int .Values.replicaCount) 1) (ne .Values.persistence.transcode.accessMode "ReadWriteMany") }}
+
+⚠  WARNING: replicaCount > 1 but transcode accessMode is not ReadWriteMany.
+   Pod B cannot read Pod A's HLS segments during session takeover.
+   Set persistence.transcode.accessMode=ReadWriteMany or use an NFS / Longhorn RWX PVC.
+{{- end }}
--- a/Show More
+++ b/Show More