Fix #10 , #27 and #28 from the read-tools sweep

v2 request lists sent the RAML example sort field requestDate; Ombi looks up RequestedDate and NullReferenceException'd every non-empty page. Browse now streams TV popular/most-watched payloads and skips the hydrated seasonRequests graph that blew the 8 MiB read budget. provider_summary treats an empty upstream body as an empty group_page.
Document #12 vote read upstream failures
2026-09-19 20:59:57 +01:00 · 2026-09-19 18:50:24 +01:00 · 2026-09-19 18:48:47 +01:00 · 2026-09-19 18:36:03 +01:00 · 2026-09-19 16:20:03 +01:00 · 2026-09-19 16:19:02 +01:00
28 changed files with 3053 additions and 266 deletions
@@ -115,7 +115,7 @@ Tools are grouped into **bundles** — deployment policy groups, not permission
 | `read_votes` | Global vote list or votes on a request. |
 | `read_users` | Self, authorized user lookup, claims, online users, preference read. |
 | `read_library` | Recent additions, calendar, artwork. |
-| `read_server` | Server status, version, features, news, stats, cron validation. |
+| `read_server` | Server status, version, features, stats, cron validation. |
 | `read_integration` | Saved ARR options and authorized media-server metadata. |
 | `write_request_create` | Create one media request or an explicit collection request. |
 | `write_request_subscribe` | Subscribe/unsubscribe to a request. |
@@ -22,7 +22,7 @@ The [input catalogue](03-input-schemas.md) defines every parameter, required fie
 | `read_votes` | Global vote list or votes on a request | core | vote page |
 | `read_users` | Self, authorized user lookup, claims, online users, preference read | core | user/reference page |
 | `read_library` | Recent additions, calendar, artwork | core | media/calendar/artwork page |
-| `read_server` | Status, version, features, news, stats, cron validation | core | metrics/reference page |
+| `read_server` | Status, version, features, stats, cron validation | core | metrics/reference page |
 | `read_integration` | Saved ARR options and authorized media-server metadata | core | reference/user page |
 | `write_request_create` | One media request or explicit collection request | core | mutation |
 | `write_request_subscribe` | Subscribe/unsubscribe | core | mutation |
@@ -95,7 +95,7 @@ The [input catalogue](03-input-schemas.md) defines every parameter, required fie
   | `welcome_email` | 8 | | | |
   Remaining numeric enums are unresolved gaps and stay numeric pending verification: `VoteType [0,1]` (labels unverified), `RequestSource`, `RequestLimitType [0,1,2]`, and the legacy `orderType`/`statusType`/`availabilityType` filter ints. Search response IDs must retain their source/provider namespace, including multi-search TV TMDB IDs.
-5. A TV parent is a show record; a TV child is an individual request under it. `read_requests.list(media=tv)` uses v2 child pages. Parent detail and children enumeration use v1. A compact projection of v2 children is preferable to secretly swapping in `tvlite` parent results. Return `parent_request_id` alongside child IDs when present.
+5. A TV parent is a show record; a TV child is an individual request under it. `read_requests.list(media=tv)` uses v2 child pages. Parent detail and children enumeration use v1. A compact projection of v2 children is preferable to secretly swapping in `tvlite` parent results (the v2 list contract is preserved). Return `parent_request_id` alongside child IDs when present. `read_requests.search` for TV uses v1 `Request/tv/search/{term}` but falls back to a bounded v1 parent scan if it fails, compensating for an upstream LINQ bug. v2 list `{sort}` is the C# property `RequestedDate` (not the RAML example `requestDate`, which TypeDescriptor cannot resolve and which 500s every non-empty page).
 6. Parameter names such as `currentPosition`, `position`, `skip`, `count`, `take` and `amountToLoad` are mapped exactly per ledger. Offsets are zero-based by this MCP contract; the adapter must verify ambiguous upstream paging behaviour. Requests use count then position; issue summary uses position then take; issue list uses take then skip. Do not reverse these pairs.
 7. Array responses without server pagination are sliced locally only within a bounded fetched response. Mark pagination as local and total unknown unless the complete collection was obtained. A result-size cap is a truncation warning, not a fabricated server total or a promise that the next page exists.
 8. `format: date-time` and cross-field comparisons must be enforced by the server, not assumed from a client's validator. Stats requires `from <= to` when both are supplied. Strings must contain non-whitespace text where used as queries/comments. Reject duplicate season numbers and duplicate episode numbers; impose a maximum of 2,000 selected episodes per call in addition to per-array limits.
@@ -109,19 +109,18 @@ The [input catalogue](03-input-schemas.md) defines every parameter, required fie
 `similar` is POST v2 movie/similar with `{theMovieDbId, languageCode?}`. A verified v1 POST equivalent can preserve language; a v1 GET cannot preserve a language argument. `collection` returns the collection's members/basic metadata, without creating requests. `credits` chooses actor/{actorId}/movie or /tv. `artist_albums` uses v1 music/artist/album/{foreignArtistId}.
-`advanced_movie` POSTs the exact DiscoverModel property names: `release_year→releaseYear`, `genre_ids→genreIds`, `keyword_ids→keywordIds`, `watch_provider_ids→watchProviders`, `company_ids→companies`, and decade unchanged. Do not invent a `query` requirement for discovery. The optional upstream `type` field is omitted until its semantics are verified; release year and decade must agree if both supplied.
+`advanced_movie` POSTs the exact DiscoverModel property names: `type:"movie"`, `release_year→releaseYear`, `genre_ids→genreIds`, `keyword_ids→keywordIds`, `watch_provider_ids→watchProviders`, and decade unchanged. Ombi 4.53.x accepts but ignores `companies`, so `company_ids` is not advertised and legacy calls fail explicitly. Do not invent a `query` requirement for discovery. Release year and decade must agree if both are supplied.
 `read_media.details` chooses v2 movie TMDB/IMDb, TV TVDB/TMDB, artist, or artist/album routes. TV `tmdb` uses v2 `Search/tv/moviedb/{id}`; TV `tvdb` uses the legacy v1 `Search/tv/info/{tvdbId}` route — the v2 `Search/tv/{tvdbId}` route is a TMDB-keyed alias of moviedb despite its parameter name and must never serve a TVDB lookup. IMDb path placeholder spelling differs from its parameter declaration; substitute the actual path placeholder. `by_request` chooses movie/request, tv/request or artist/request; the TV namespace of this particular upstream route requires adapter verification and must not be guessed from list results. `movie_localized` uses POST v1 movie/info with `{theMovieDbId, languageCode}`. `ratings` uses title and year, not a numeric media ID. `streaming` uses TMDB even for TV. Cast/crew are projections of detailed metadata where present, not invented standalone endpoints.
 `read_media.details` chooses v2 movie TMDB/IMDb, TV TVDB/TMDB, artist, or artist/album routes. TV `tmdb` uses v2 `Search/tv/moviedb/{id}`; TV `tvdb` uses the legacy v1 `Search/tv/info/{tvdbId}` route (the v2 `Search/tv/{tvdbId}` route is a TMDB-keyed alias and must never serve a TVDB lookup). The legacy v1 TVDB info route does not reliably carry request state; for TVDB, the adapter performs a bounded scan of v1 `Request/tv` (matching by `tvDbId` or `imdbId`) to overlay `requested`, `request_targets` (using the real parent request ID), and per-episode availability flags. IMDb path placeholder spelling differs from its parameter declaration. `by_request` chooses movie/request, tv/request or artist/request. `movie_localized` uses POST v1 movie/info. `ratings` first uses Ombi's title/year ratings route. Ombi 4.53.x still routes that operation through removed Rotten Tomatoes private endpoints; on a 404/5xx (or a successful empty response), the adapter searches the same media/title and requires an exact case-insensitive title and year match before returning explicitly labelled `tmdb_vote_*` or `tvmaze_site_rating` references. A warning identifies the fallback source; no fuzzy match is substituted. `streaming` uses TMDB even for TV.
 TV identifier labels follow the origin route, not the upstream field name. The v1 TVMaze-backed routes (`Search/tv/{term}`, `Search/tv/info/{tvdbId}`) place the TVDB id in the misleadingly-named `theMovieDbId` field and the TVMaze id in `seriesId`; emit `tvdb` and `tvmaze` there. The v2 engine routes (browse, `moviedb`, `by_request`, multi-search) are TMDB-keyed; emit `tmdb` and do not treat `seriesId` as TVMaze. When `theMovieDbId` is absent, `id` is labelled with that origin namespace so browse and collection members still carry a usable identifier. Multi-search `mediaType` is case-insensitive (`Artist`→artist). The v1 `RecentlyAdded` TV model's id namespace is unverified — keep `tmdb` pending live confirmation.
 `read_reference.keywords` passes query `searchTerm`; keyword detail uses its own keyword ID. Watch-provider catalogue search also has optional `searchTerm`; it is distinct from streaming availability for a particular title. Other branches have no request body. Reference values are good optional cached resources, but remain available through tools for tool-only clients.
 ## Requests and quotas
-Use v2 list/status routes, always with sort and page segments. `status` defaults `all`; `sort_direction` maps to the `{sortOrder}` segment (`asc`/`desc`). Public `sort.field=request_date` maps to the documented example `requestDate`; no speculative sort fields are published. `all` means the base route, not an `/all/` segment. Album lacks an unavailable-status route, so that combination fails schema validation. The misspelled movie `availble` route is an explicitly gated compatibility alias, not the primary path.
+Use v2 list/status routes, always with sort and page segments. `status` defaults `all`; `sort_direction` maps to the `{sortOrder}` segment (`asc`/`desc`). Public `sort.field=request_date` maps to Ombi's `RequestedDate` property (the RAML example `requestDate` does not match and 500s on non-empty pages). No speculative sort fields are published. `all` means the base route, not an `/all/` segment. Album lacks an unavailable-status route, so that combination fails schema validation. The misspelled movie `availble` route is an explicitly gated compatibility alias, not the primary path.
-`get` supports movie and TV parent only; no album single-request endpoint is advertised. `children` returns children for a parent. Request `search` uses the appropriate v1 route and rejects list-only status/sort arguments. `recent` uses v2 recentlyRequested; `target.id` is `requestId` (never a provider id left in `id`). `retry_queue` is a privileged GET and returns queue IDs separately from underlying request IDs.
+`get` supports movie and TV parent only; no album single-request endpoint is advertised. `children` returns children for a parent; child ids are the real upstream child PKs (provider-shaped for first-request children by design), with provider ids surfaced from the embedded `parentRequest`. Request `search` uses the appropriate v1 route and rejects list-only status/sort arguments. `recent` uses v2 recentlyRequested; for movie/album `target.id` is `requestId`, while TV `requestId` is a child request id (often provider-shaped) that is resolved to the parent request id through a bounded v1 parent scan — unresolvable rows emit `target.id` 0 with a warning rather than a provider-shaped target. `retry_queue` is a privileged GET and returns queue IDs separately from underlying request IDs.
 `read_request_stats.counts` uses Request/count; `total` uses the media's total endpoint; `quota` uses its remaining endpoint. Quota belongs to the actual upstream principal. `has_requests` requires an explicit `user_id` by MCP policy and sends it as the optional upstream `userId` query; viewing another user is subject to authorization. Do not combine instance totals with a per-user quota under an unlabeled “total”.
@@ -160,7 +159,7 @@ Issue `list` uses v1 paged issues and returns individual records. `summary` uses
 Issue creation maps only title, subject, description, `issueCategoryId`, numeric `requestType`, and optional `requestId`/`providerId`. Require at least one association by design; RAML marks these properties optional and does not establish a server requirement. If both are provided, verify they refer to the same media. The server supplies author, timestamps and state; never accept `userReported`, comments, resolved date or persistence ID from the model. Comment POST uses `{comment, issueId}`. Status POST uses `{issueId, status}`. Category POST uses `{value}`. Delete IDs are in the path; no speculative update-category endpoint exists.
-Vote reads use `Vote/music/{requestId}` for albums; writes use `Vote/{up|down}/album/{requestId}`. Do not derive both directions from one generic segment rule. Vote toggling/repeated-call behaviour is unverified, hence no idempotence promise.
+Vote reads use `Vote/music/{requestId}` for albums; writes use `Vote/{up|down}/album/{requestId}`. Do not derive both directions from one generic segment rule. Vote toggling/repeated-call behaviour is unverified, hence no idempotence promise. On Ombi 4.53.10, the global vote view and movie vote-record route can return HTTP 500 for existing instance data while the corresponding empty TV route succeeds. Ombi exposes no equivalent read route from which the adapter can reconstruct vote ownership or totals. Preserve `UPSTREAM_REJECTED` in that case; never convert the failure into a fabricated empty `vote_page`.
 User GET-by-ID is `/Identity/User/{id}`. `self`, all users, dropdown, claims, online and notification preferences each have their exact separate routes. Respect hide-user settings and upstream visibility; do not disclose hidden requester IDs simply to populate a normalized field.
@@ -174,11 +173,11 @@ Recent TV grouped and ungrouped routes are separate branches. Calendar has no do
 Images may be binary, redirects or URLs depending on the route; RAML leaves several response bodies unspecified. Return a safe resource reference only after validating actual content type/shape and destination. Do not invent a signed URL or expose an `ApiKey` query. Random backgrounds are read-only but their outputs are not deterministic; idempotent read annotations describe side effects, not identical results.
-Stats passes optional `from` and `to` query values. `update_check` is GET Job/update; `update_info` is GET Update. Running updates is an explicit administrative job. `cron_validate` POSTs `{expression}` to Settings/testcron and is an administrator-gated read calculation, not a scheduled-job mutation.
+Stats requires RFC3339 `from` and `to` query values. `update_check` is GET Job/update; `update_info` is GET Update. Running updates is an explicit administrative job. `cron_validate` POSTs `{expression}` to Settings/testcron and is an administrator-gated read calculation, not a scheduled-job mutation. Ombi uses Quartz cron syntax: six or seven fields, with `?` in the unused day-of-month or day-of-week field.
 `read_integration` prefers saved-settings GETs. Radarr 4K only applies to profiles/root folders, not tags. Sonarr language profiles uses `/v3/LanguageProfiles`. Lidarr Metadata is POST-only, so load saved Lidarr settings privately and construct its request internally. CouchPotato profile is singular and POST-only. Credential acquisition `/CouchPotato/apikey` is never a tool. RPC POST counterparts accepting settings are compatibility adapters to the same read intent; they do not add caller connection overrides.
-Plex library lookup uses a known saved `machine_id`; Emby/Jellyfin info and Library POSTs use an authorized saved `server_id` to resolve the server settings privately. No arbitrary server object or connection destination is accepted. Routes that acquire Plex/Emby/Jellyfin access or provision accounts remain internal/manual because their authentication/side effects are not adequately specified here.
+Plex library lookup uses a known saved `machine_id` (discoverable via `read_integration plex servers`, which emits the machine identifier in `id`); Emby/Jellyfin info and Library POSTs use an authorized saved `server_id` to resolve the server settings privately (discoverable via `read_settings emby` / `jellyfin` / `plex`, which expose `/servers/<digits>/{id,serverId,machineIdentifier}` leaves in `values`). No arbitrary server object or connection destination is accepted. Routes that acquire Plex/Emby/Jellyfin access or provision accounts remain internal/manual because their authentication/side effects are not adequately specified here.
 Settings section names and wire types are fully listed in [the registry](07-settings-types.md). Read-only flags and customization content are not accidentally accepted as writable sections. Before saving, privately read the original section, verify the revision, merge a typed patch preserving secrets and omitted fields, and POST the full correct wire model. An incomplete original object means save is unsupported. Redacted strings must never become stored credentials. Feature writes are enable/disable POSTs with `{name, enabled}`.
@@ -227,7 +226,7 @@ Locked decision D3 keeps snake_case MCP field names; the Go adapter translates e
 | `is_4k` | create/moderate/reprocess | `is4kRequest` body / `is4K` body / `{is4K}` path |
 | `request_type` | `write_issue_create`, `write_request_reprocess` | `requestType` body int / `{type}` path int (T1 map) |
 | `status` | `read_issues`, `write_issue_manage` | `{status}` path int / `status` body int (T2 map) |
-| `sort_direction` | `read_requests.list` | `{sortOrder}` path `asc`/`desc` (sort=`requestDate`) |
+| `sort_direction` | `read_requests.list` | `{sortOrder}` path `asc`/`desc` (sort=`RequestedDate`) |
 | `season_numbers` | `write_request_create` tv season mode | adapter expansion → `seasons[].episodes` |
 | `on_behalf_user_id` | `write_request_create` | `requestOnBehalf` body (**Verify**: id vs username) |
 | `requested_by_alias` | `write_request_create.album` | `requestedByAlias` body |
@@ -318,6 +318,11 @@ Browse supported lists, related movies, actor credits, artist albums, or advance
          "type": "integer",
          "minimum": 1
        },
        "person_name": {
          "type": "string",
          "minLength": 1,
          "maxLength": 200
        },
        "media": {
          "type": "string",
          "enum": [
@@ -332,6 +337,7 @@ Browse supported lists, related movies, actor credits, artist albums, or advance
      "required": [
        "action",
        "person_id",
        "person_name",
        "media"
      ],
      "additionalProperties": false
@@ -368,7 +374,7 @@ Browse supported lists, related movies, actor credits, artist albums, or advance
          "properties": {
            "release_year": {
              "type": "integer",
-              "minimum": 1870,
+              "minimum": 1901,
              "maximum": 9999
            },
            "decade": {
@@ -406,16 +412,6 @@ Browse supported lists, related movies, actor credits, artist albums, or advance
              "minItems": 1,
              "maxItems": 100,
              "uniqueItems": true
            },
            "company_ids": {
              "type": "array",
              "items": {
                "type": "integer",
                "minimum": 1
              },
              "minItems": 1,
              "maxItems": 100,
              "uniqueItems": true
            }
          },
          "required": [],
@@ -991,7 +987,7 @@ Read issue records, provider-grouped summaries, comments or counts.
 ## read_votes
-Read all voteable requests or votes for a movie, TV or album request.
+Read all voteable requests or votes for a movie, TV or album request. Some Ombi 4.53.x data sets make the global or movie read routes fail upstream; the tool reports `UPSTREAM_REJECTED` rather than treating unknown votes as an empty page.
 ```json
 {
@@ -1498,18 +1494,6 @@ Read server status, feature availability, version, update information or usage s
      ],
      "additionalProperties": false
    },
    {
      "type": "object",
      "properties": {
        "action": {
          "const": "news"
        }
      },
      "required": [
        "action"
      ],
      "additionalProperties": false
    },
    {
      "type": "object",
      "properties": {
@@ -1550,7 +1534,9 @@ Read server status, feature availability, version, update information or usage s
        }
      },
      "required": [
-        "action"
+        "action",
        "from",
        "to"
      ],
      "additionalProperties": false
    },
@@ -1562,6 +1548,7 @@ Read server status, feature availability, version, update information or usage s
        },
        "expression": {
          "type": "string",
          "description": "Quartz cron expression — 6 or 7 fields (seconds minutes hours day-of-month month day-of-week [year]); one of the two day fields must be ?",
          "minLength": 1,
          "maxLength": 200
        }
@@ -16,14 +16,14 @@ Each per-tool output schema is intentionally a bounded projection, not the recur
 | Family | Projection rules |
 |---|---|
-| media_page | Search/discovery/details return zero or more normalized media records. Details usually has one item. Keep every known ID namespace; never emit the same namespace+value twice. On TV the upstream `theMovieDbId` field name lies: TVMaze-backed v1 routes (`Search/tv/{term}`, `Search/tv/info/{tvdbId}`) carry the TVDB id there (emit `tvdb`, plus `seriesId`→`tvmaze`); TMDB-keyed v2 routes carry the TMDB id (emit `tmdb`) and must not label `seriesId` as `tvmaze` — on those routes it echoes the TMDB id. When `theMovieDbId` is absent, `id` is labelled with the same origin namespace (v2 browse/collection members and MovieFullInfoViewModel). `belongsToCollection.id` is the collection's TMDB id, not the movie's. Multi-search `mediaType` is matched case-insensitively (`Artist`→`artist`/`musicbrainz`). The namespace label is per origin route, never per field name. Map cast/crew into credits; title-specific streaming into providers; rating fields into named rating references. Never claim a global provider catalogue is a title's availability. Collections keep their own collection identity and returned members. |
+| media_page | Search/discovery/details return zero or more normalized media records. Details usually has one item. Keep every known ID namespace; never emit the same namespace+value twice. On TV the upstream `theMovieDbId` field name lies: TVMaze-backed v1 routes (`Search/tv/{term}`, `Search/tv/info/{tvdbId}`) carry the TVDB id there (emit `tvdb`, plus `seriesId`→`tvmaze`); TMDB-keyed v2 routes carry the TMDB id (emit `tmdb`) and must not label `seriesId` as `tvmaze` — on those routes it echoes the TMDB id. When `theMovieDbId` is absent, `id` is labelled with the same origin namespace (v2 browse/collection members and MovieFullInfoViewModel). `belongsToCollection.id` is the collection's TMDB id, not the movie's. Multi-search `mediaType` is matched case-insensitively (`Artist`→`artist`/`musicbrainz`). The namespace label is per origin route, never per field name. Credit calls require the caller-supplied person name because Ombi returns only the person ID; TV credit titles are enriched from their TMDB detail records. If requested browse falls back to Ombi's bounded recently-requested feed, mark it truncated and leave total/continuation unknown. Browse streams the upstream array and discards `seasonRequests` (Ombi hydrates full episode trees on popular/most-watched when hiding available titles). Map cast/crew into credits; title-specific streaming into providers; rating fields into named rating references. Never claim a global provider catalogue is a title's availability. Collections keep their own collection identity and returned members. |
-| request_page | Map the Ombi request id to target kind and ID: prefer `requestId` over `id`. v2 TV list items are children and `parentRequestId` is preserved; v1 parent records stay parents. On `recent`, `RecentlyRequestedModel.requestId` is the target id for every kind; a provider-shaped `id` (common on TV) is never the target — provider values go in `identifiers` (`mediaId`, `tvDbId`, `externalProviderId`). Include standard and 4K state separately. Never infer one combined lifecycle status when booleans disagree. |
+| request_page | Map the Ombi request id to target kind and ID: prefer `requestId` over `id`. v2 TV list items are children and `parentRequestId` is preserved; v1 parent records stay parents; child provider ids live on the embedded `parentRequest` record. On `recent`, `RecentlyRequestedModel.requestId` is the request id for movie/album, but on TV rows it is a *child* request id (upstream builds recent TV rows from child requests and persists the provider id as the child PK for new-request children). The `tv_parent` target id is therefore resolved through a bounded v1 parent scan — child-id match first, then `tvDbId`/`externalProviderId` fallback — the child id is emitted as an `ombi_tv_child` identifier, provider values land in `identifiers` (`mediaId`, `tvDbId`, `externalProviderId`), and unresolvable rows emit `target.id` 0 with a warning. A provider-shaped value is never the target. Include standard and 4K state separately. Never infer one combined lifecycle status when booleans disagree. |
 | issue_page | Project writable/display fields plus IDs/timestamps. Wire `resovledDate` maps to `resolved_date` without changing upstream spelling. Omit nested user objects and comments unless requested separately. |
-| group_page | v2 issue summaries are provider groups. Count and page units describe groups, not individual issues. Truncate nested issues with a warning. |
+| group_page | v2 issue summaries are provider groups. Count and page units describe groups, not individual issues. Truncate nested issues with a warning. An empty, null, or `[]` body from `provider_summary` is an empty page, not a schema mismatch. |
 | comment_page | Preserve comment text and authorized author identifier, omit full user graph. |
 | vote_page | Preserve numeric VoteType until verified; totals only if supplied or completely computed from an authorized complete set. No inference of the caller's own vote without identity evidence. |
 | user_page | Only ID, username/alias and non-secret language/country/online state. Permission-limited user visibility applies even to nested source objects. |
-| reference_page | Named ID/value records for genres, language/country lists, categories, claims, integration options, features and safe metadata. Names/IDs need verified upstream adapters. Unspecified response shapes fail explicitly instead of dumping raw data. |
+| reference_page | Named ID/value records for genres, language/country lists, categories, claims, integration options, features and safe metadata. Names/IDs need verified upstream adapters. `value` holds the native-typed identifier (e.g. integer or string) matching the resolved ID, falling back to name string when no ID matched; selection is deterministic across calls. Upstream corrupted labels (all-`?` mojibake or U+FFFD) are skipped for clean candidate keys; if only corrupted labels exist, the corrupted string is emitted and a `warnings[]` note is recorded. Unspecified response shapes fail explicitly instead of dumping raw data. |
 | metrics | Counts/quota/health/stats become named scalar values with an explicit instance/principal/selected-user scope. RequestQuota fields are has_limit, limit, remaining and next_request. Server request counts are pending, approved, available and denied. Do not equate false `hasLimit` with remaining=0. |
 | settings | Only allowlisted non-secret fields; nested settings are flattened using escaped JSON Pointer names, one scalar leaf per entry. Array indices are display paths only, never mutation identifiers. `revision` appears only when a safe corresponding patch can be offered. No credentials or destination URLs. |
 | calendar_page | Known date/title/episode/ID values, no invented time zone or promised date-range filtering. |
@@ -117,7 +117,7 @@ The body/response columns describe the **upstream** schema, not a promise to pas
 | 099 | [POST `/api/v1/Plex/Libraries`](../api/raml/api.raml#L1477) | A | `read_integration / plex_libraries` | body [PlexServers](../api/raml/types/Ombi.Core.Settings.Models.External.PlexServers.raml) | 200: [PlexLibrariesResponse](../api/raml/types/Ombi.Models.External.PlexLibrariesResponse.raml) | Private saved-server POST alternative. |
 | 100 | [GET `/api/v1/Plex/Libraries/{machineId}`](../api/raml/api.raml#L1497) | D | `read_integration / plex_libraries` | path `machineId`:string required | 200: [PlexLibrariesLiteResponse](../api/raml/types/Ombi.Models.External.PlexLibrariesLiteResponse.raml) | — |
 | 101 | [POST `/api/v1/Plex/user`](../api/raml/api.raml#L1510) | X | `Plex account provisioning` | body [PlexUserViewModel](../api/raml/types/Ombi.Models.External.PlexUserViewModel.raml) | 200: body unspecified | Side effects are insufficiently specified; no guessed read lookup. |
-| 102 | [GET `/api/v1/Plex/servers`](../api/raml/api.raml#L1525) | D | `read_integration / plex:servers` | none documented | 200: body unspecified | — |
+| 102 | [GET `/api/v1/Plex/servers`](../api/raml/api.raml#L1525) | D | `read_integration / plex:servers` | none documented | 200: object wrapper `{"success":bool,"servers":[...]}` | Verified upstream wrapper shape; projects servers array to reference_page with `id=machineId`, `name=serverName`, `value=serverId`. |
 | 103 | [POST `/api/v1/Plex/servers`](../api/raml/api.raml#L1525) | I | `Plex authentication/provisioning` | body [UserRequest](../api/raml/types/Ombi.Api.External.MediaServers.Plex.Models.UserRequest.raml) | 200: [PlexServersViewModel](../api/raml/types/Ombi.Models.External.PlexServersViewModel.raml) | Credential-bearing account/OAuth workflow stays outside model tools. |
 | 104 | [GET `/api/v1/Plex/friends`](../api/raml/api.raml#L1552) | D | `read_integration / plex:friends` | none documented | 200: array&lt;[UsersViewModel](../api/raml/types/Ombi.Models.External.UsersViewModel.raml)&gt; | — |
 | 105 | [POST `/api/v1/Plex/oauth`](../api/raml/api.raml#L1564) | I | `Plex authentication/provisioning` | body [PlexOAuthViewModel](../api/raml/types/Ombi.Models.PlexOAuthViewModel.raml) | 200: body unspecified | Credential-bearing account/OAuth workflow stays outside model tools. |
@@ -234,8 +234,8 @@ The body/response columns describe the **upstream** schema, not a promise to pas
 | 216 | [GET `/api/v2/Search/artist/request/{requestId}`](../api/raml/api.raml#L3949) | D | `read_media / by_request` | path `requestId`:integer required | 200: [ArtistInformation](../api/raml/types/Ombi.Core.Models.Search.V2.Music.ArtistInformation.raml) | Request-ID namespace requires verification. MCP `media=album` maps to this literal `artist` route segment. |
 | 217 | [GET `/api/v2/Search/artist/album/{albumId}`](../api/raml/api.raml#L3976) | D | `read_media / details` | path `albumId`:string required | 200: [ReleaseGroup](../api/raml/types/Ombi.Core.Models.Search.V2.Music.ReleaseGroup.raml) | — |
 | 218 | [GET `/api/v2/Search/releasegroupart/{musicBrainzId}`](../api/raml/api.raml#L4003) | D | `read_library / album_art` | path `musicBrainzId`:string required | 200: [AlbumArt](../api/raml/types/Ombi.Core.Models.Search.V2.Music.AlbumArt.raml) | — |
-| 219 | [GET `/api/v2/Search/ratings/movie/{name}/{year}`](../api/raml/api.raml#L4030) | D | `read_media / ratings` | path `name`:string required; path `year`:integer required | 200: [MovieRatings](../api/raml/types/Ombi.Api.External.ExternalApis.RottenTomatoes.Models.MovieRatings.raml) | — |
+| 219 | [GET `/api/v2/Search/ratings/movie/{name}/{year}`](../api/raml/api.raml#L4030) | D | `read_media / ratings` | path `name`:string required; path `year`:integer required | 200: [MovieRatings](../api/raml/types/Ombi.Api.External.ExternalApis.RottenTomatoes.Models.MovieRatings.raml) | Ombi 4.53.x depends on removed Rotten Tomatoes private endpoints; on 404/5xx/empty results, fall back to an exact title/year v1 movie search and label TMDB rating fields. |
-| 220 | [GET `/api/v2/Search/ratings/tv/{name}/{year}`](../api/raml/api.raml#L4060) | D | `read_media / ratings` | path `name`:string required; path `year`:integer required | 200: [TvRatings](../api/raml/types/Ombi.Api.External.ExternalApis.RottenTomatoes.Models.TvRatings.raml) | — |
+| 220 | [GET `/api/v2/Search/ratings/tv/{name}/{year}`](../api/raml/api.raml#L4060) | D | `read_media / ratings` | path `name`:string required; path `year`:integer required | 200: [TvRatings](../api/raml/types/Ombi.Api.External.ExternalApis.RottenTomatoes.Models.TvRatings.raml) | Ombi 4.53.x depends on removed Rotten Tomatoes private endpoints; on 404/5xx/empty results, fall back to an exact title/year v1 TV search and label TVMaze rating fields. |
 | 221 | [GET `/api/v2/Search/stream/movie/{movieDbId}`](../api/raml/api.raml#L4090) | D | `read_media / streaming` | path `movieDBId`:integer required | 200: array&lt;[StreamingData](../api/raml/types/Ombi.Core.Models.Search.V2.StreamingData.raml)&gt; | — |
 | 222 | [GET `/api/v2/Search/stream/tv/{movieDbId}`](../api/raml/api.raml#L4120) | D | `read_media / streaming` | path `movieDbId`:integer required | 200: array&lt;[StreamingData](../api/raml/types/Ombi.Core.Models.Search.V2.StreamingData.raml)&gt; | — |
 | 223 | [GET `/api/v1/Search/movie/{searchTerm}`](../api/raml/api.raml#L4150) | D | `read_search / text` | path `searchTerm`:unspecified required | 200: array&lt;[SearchMovieViewModel](../api/raml/types/Ombi.Core.Models.Search.SearchMovieViewModel.raml)&gt; | — |
@@ -298,7 +298,7 @@ The body/response columns describe the **upstream** schema, not a promise to pas
 | 280 | [GET `/api/v1/Settings/SickRage`](../api/raml/api.raml#L5100) | D | `read_settings / sickrage` | none documented | 200: [SickRageSettings](../api/raml/types/Ombi.Settings.Settings.Models.External.SickRageSettings.raml) | Allowlisted projection; no raw secrets. |
 | 281 | [GET `/api/v1/Settings/jobs`](../api/raml/api.raml#L5130) | D | `read_settings / jobs` | none documented | 200: [JobSettings](../api/raml/types/Ombi.Settings.Settings.Models.JobSettings.raml) | Allowlisted projection; no raw secrets. |
 | 282 | [POST `/api/v1/Settings/jobs`](../api/raml/api.raml#L5130) | P | `write_settings_patch / patch:jobs` | body [JobSettings](../api/raml/types/Ombi.Settings.Settings.Models.JobSettings.raml) | 200: [JobSettingsViewModel](../api/raml/types/Ombi.Models.JobSettingsViewModel.raml) | Only typed non-secret patch; preserve omitted/private fields. |
-| 283 | [POST `/api/v1/Settings/testcron`](../api/raml/api.raml#L5160) | D | `read_server / cron_validate` | body [CronViewModelBody](../api/raml/types/Ombi.Models.CronViewModelBody.raml) | 200: [CronTestModel](../api/raml/types/Ombi.Models.CronTestModel.raml) | Administrator-gated read calculation. |
+| 283 | [POST `/api/v1/Settings/testcron`](../api/raml/api.raml#L5160) | D | `read_server / cron_validate` | body [CronViewModelBody](../api/raml/types/Ombi.Models.CronViewModelBody.raml) | 200: [CronTestModel](../api/raml/types/Ombi.Models.CronTestModel.raml) | Administrator-gated read calculation; Quartz uses 6-7 fields and `?` for the unused day field. |
 | 284 | [POST `/api/v1/Settings/Issues`](../api/raml/api.raml#L5178) | P | `write_settings_patch / patch:issues` | body [IssueSettings](../api/raml/types/Ombi.Settings.Settings.Models.IssueSettings.raml) | 200: boolean | Only typed non-secret patch; preserve omitted/private fields. |
 | 285 | [GET `/api/v1/Settings/Issues`](../api/raml/api.raml#L5178) | D | `read_settings / issues` | none documented | 200: [IssueSettings](../api/raml/types/Ombi.Settings.Settings.Models.IssueSettings.raml) | Allowlisted projection; no raw secrets. |
 | 286 | [GET `/api/v1/Settings/issuesenabled`](../api/raml/api.raml#L5208) | D | `read_settings / issuesenabled` | none documented | 200: boolean | Allowlisted projection; no raw secrets. |
@@ -344,12 +344,12 @@ The body/response columns describe the **upstream** schema, not a promise to pas
 | 326 | [GET `/api/v1/Sonarr/tags`](../api/raml/api.raml#L5783) | D | `read_integration / options:sonarr/tags` | none documented | 200: array&lt;[Tag](../api/raml/types/Ombi.Api.External.ExternalApis.Sonarr.Models.Tag.raml)&gt; | — |
 | 327 | [GET `/api/v1/Sonarr/enabled`](../api/raml/api.raml#L5815) | D | `read_integration / options:sonarr/enabled` | none documented | 200: boolean | — |
 | 328 | [GET `/api/v1/Sonarr/version`](../api/raml/api.raml#L5824) | D | `read_integration / options:sonarr/version` | none documented | 200: string | — |
-| 329 | [GET `/api/v1/Stats`](../api/raml/api.raml#L5833) | D | `read_server / stats` | query `from`:string optional; query `to`:string optional | 200: [UserStatsSummary](../api/raml/types/Ombi.Core.Engine.UserStatsSummary.raml) | from/to query parameters are supported. |
+| 329 | [GET `/api/v1/Stats`](../api/raml/api.raml#L5833) | D | `read_server / stats` | query `from`:string required; query `to`:string required | 200: [UserStatsSummary](../api/raml/types/Ombi.Core.Engine.UserStatsSummary.raml) | from/to are required at the MCP layer; bare calls cause an upstream NRE. |
 | 330 | [GET `/api/v1/Status`](../api/raml/api.raml#L5849) | D | `read_server / status` | none documented | 200: [HttpStatusCode](../api/raml/types/System.Net.HttpStatusCode.raml) | — |
 | 331 | [GET `/api/v1/Status/info`](../api/raml/api.raml#L5860) | D | `read_server / status_info` | none documented | 200: string | — |
-| 332 | [GET `/api/v2/System/news`](../api/raml/api.raml#L5871) | D | `read_server / news` | none documented | 200: body unspecified | — |
+| 332 | [GET `/api/v2/System/news`](../api/raml/api.raml#L5871) | X | action removed | none documented | 200: Markdig HTML text | Not structured data; action removed (#13). |
-| 333 | [GET `/api/v2/System/logs`](../api/raml/api.raml#L5877) | D | `read_logs / list` | none documented | 200: body unspecified | — |
+| 333 | [GET `/api/v2/System/logs`](../api/raml/api.raml#L5877) | D | `read_logs / list` | none documented | 200: string array of file names | Verified on 4.53.10. |
-| 334 | [GET `/api/v2/System/logs/{logFileName}`](../api/raml/api.raml#L5883) | D | `read_logs / read` | path `logFileName`:string required | 200: body unspecified | Vetted opaque ID maps to filename; sanitized bounded local slicing. |
+| 334 | [GET `/api/v2/System/logs/{logFileName}`](../api/raml/api.raml#L5883) | D | `read_logs / read` | path `logFileName`:string required | 200: plain text | Vetted opaque ID maps to filename; sanitized bounded local slicing (verified 4.53.10). |
 | 335 | [GET `/api/v2/System/logs/download/{logFileName}`](../api/raml/api.raml#L5893) | X | `raw diagnostic download` | path `logFileName`:string required | 200: body unspecified | May expose secrets; sanitized logs tool is the supported alternative. |
 | 336 | [POST `/api/v1/Tester/discord`](../api/raml/api.raml#L5903) | P | `write_integration_test / discord` | body [DiscordNotificationSettings](../api/raml/types/Ombi.Settings.Settings.Models.Notifications.DiscordNotificationSettings.raml) | 200: boolean | Saved authorized profile only; exact tester body differs by service. |
 | 337 | [POST `/api/v1/Tester/pushbullet`](../api/raml/api.raml#L5923) | P | `write_integration_test / pushbullet` | body [PushbulletSettings](../api/raml/types/Ombi.Settings.Settings.Models.Notifications.PushbulletSettings.raml) | 200: boolean | Saved authorized profile only; exact tester body differs by service. |
@@ -383,13 +383,13 @@ The body/response columns describe the **upstream** schema, not a promise to pas
 | 365 | [POST `/api/v1/Token/requirePassword`](../api/raml/api.raml#L6464) | I | `upstream authentication adapter` | body [UserAuthModel](../api/raml/types/Ombi.Models.UserAuthModel.raml) | 200: boolean | Not model-callable; JWT-primary auth adapter (`OMBI_AUTH_MODE=jwt`); login/refresh semantics per `01-authentication.md`; Bearer-on-all-routes remains Verify. |
 | 366 | [POST `/api/v1/Token/header_auth`](../api/raml/api.raml#L6482) | I | `upstream authentication adapter` | none documented | 200: body unspecified | Not model-callable; JWT-primary auth adapter (`OMBI_AUTH_MODE=jwt`); login/refresh semantics per `01-authentication.md`; Bearer-on-all-routes remains Verify. |
 | 367 | [GET `/api/v1/Update`](../api/raml/api.raml#L6494) | D | `read_server / update_info` | none documented | 200: [UpdateModel](../api/raml/types/Ombi.Core.Processor.UpdateModel.raml) | — |
-| 368 | [GET `/api/v1/Vote`](../api/raml/api.raml#L6503) | D | `read_votes / list` | none documented | 200: array&lt;[VoteViewModel](../api/raml/types/Ombi.Core.Models.UI.VoteViewModel.raml)&gt; | — |
+| 368 | [GET `/api/v1/Vote`](../api/raml/api.raml#L6503) | D | `read_votes / list` | none documented | 200: array&lt;[VoteViewModel](../api/raml/types/Ombi.Core.Models.UI.VoteViewModel.raml)&gt; | Ombi 4.53.10 can return HTTP 500 for existing instance data; no lossless alternate read route exists, so preserve `UPSTREAM_REJECTED`. |
 | 369 | [POST `/api/v1/Vote/up/movie/{requestId}`](../api/raml/api.raml#L6515) | D | `write_vote` | path `requestId`:integer required | 200: [VoteEngineResult](../api/raml/types/Ombi.Core.Models.VoteEngineResult.raml) | — |
 | 370 | [POST `/api/v1/Vote/up/tv/{requestId}`](../api/raml/api.raml#L6530) | D | `write_vote` | path `requestId`:integer required | 200: [VoteEngineResult](../api/raml/types/Ombi.Core.Models.VoteEngineResult.raml) | — |
 | 371 | [POST `/api/v1/Vote/up/album/{requestId}`](../api/raml/api.raml#L6545) | D | `write_vote` | path `requestId`:integer required | 200: [VoteEngineResult](../api/raml/types/Ombi.Core.Models.VoteEngineResult.raml) | — |
 | 372 | [POST `/api/v1/Vote/down/movie/{requestId}`](../api/raml/api.raml#L6560) | D | `write_vote` | path `requestId`:integer required | 200: [VoteEngineResult](../api/raml/types/Ombi.Core.Models.VoteEngineResult.raml) | — |
 | 373 | [POST `/api/v1/Vote/down/tv/{requestId}`](../api/raml/api.raml#L6575) | D | `write_vote` | path `requestId`:integer required | 200: [VoteEngineResult](../api/raml/types/Ombi.Core.Models.VoteEngineResult.raml) | — |
 | 374 | [POST `/api/v1/Vote/down/album/{requestId}`](../api/raml/api.raml#L6590) | D | `write_vote` | path `requestId`:integer required | 200: [VoteEngineResult](../api/raml/types/Ombi.Core.Models.VoteEngineResult.raml) | — |
-| 375 | [GET `/api/v1/Vote/movie/{requestId}`](../api/raml/api.raml#L6605) | D | `read_votes / get` | path `requestId`:integer required | 200: array&lt;[Votes](../api/raml/types/Ombi.Store.Entities.Votes.raml)&gt; | — |
+| 375 | [GET `/api/v1/Vote/movie/{requestId}`](../api/raml/api.raml#L6605) | D | `read_votes / get` | path `requestId`:integer required | 200: array&lt;[Votes](../api/raml/types/Ombi.Store.Entities.Votes.raml)&gt; | Ombi 4.53.10 can return HTTP 500 for existing instance data; no lossless alternate read route exists, so preserve `UPSTREAM_REJECTED`. |
 | 376 | [GET `/api/v1/Vote/music/{requestId}`](../api/raml/api.raml#L6621) | D | `read_votes / get` | path `requestId`:integer required | 200: array&lt;[Votes](../api/raml/types/Ombi.Store.Entities.Votes.raml)&gt; | — |
 | 377 | [GET `/api/v1/Vote/tv/{requestId}`](../api/raml/api.raml#L6637) | D | `read_votes / get` | path `requestId`:integer required | 200: array&lt;[Votes](../api/raml/types/Ombi.Store.Entities.Votes.raml)&gt; | — |
@@ -56,7 +56,7 @@ These are future checks, not claims that an implementation was written or tested
 - An empty object must not satisfy a request-creation, issue-creation, moderation or delete schema. Optional defaults must not trigger unrelated conditional requirements.
 - Movie, TVDB TV, TMDB TV, album and collection creation must send the exact wire body and method. TV has no is4kRequest, album has no requestOnBehalf, and collection has no invented body.
 - Denial uses PUT for all media. Similar and actor searches use POST. Lidarr Metadata uses POST. User detail uses Identity/User/{id}. No POST RequestRetry is emitted.
- Request list rejects album+unavailable, preserves TV child identity, maps request_date to requestDate and verifies local versus upstream pagination metadata.
+- Request list rejects album+unavailable, preserves TV child identity, maps request_date to RequestedDate and verifies local versus upstream pagination metadata.
 - Reject empty explicit episode lists, duplicate seasons/episodes, ambiguous providers, irrelevant action properties and overflowing request budgets before upstream calls.
 - Check every method/path pair against the ledger, including spelling/case and request/response types. Generated brace expansion must never add routes.
 - Omitted `is_4k`/`status`/`sort_direction` resolve to documented defaults without triggering conditional requirements.
@@ -298,3 +298,40 @@ The gated live suite is committed and ready; run it with a sourced `.env`. It ad
 - Input/output schema contracts in `docs/schema/` unchanged.
 - `go test ./...` output is identical to before the phase (package fully behind the tag).
 - No instance URL in committed files; `.env` guidance points to the gitignored file only.
 ## M5 Findings — Request state and list routes (#7, #10)
 - `#7`: `GET /api/v1/Search/tv/info/{tvdbId}` (TVMaze-backed info route) upstream does not set request state flags accurately, returning `requested: false` regardless of truth. The adapter patches this by performing a bounded `GET /api/v1/Request/tv` parent scan and overlaying per-episode availability and request states.
 - `#10`: `GET /api/v2/Requests/{movie,tv,album}/...` (v2 lists) 500'd on every non-empty page because the adapter sent the RAML example sort field `requestDate`. Ombi resolves `{sort}` through `TypeDescriptor.GetProperties(...).Find(sortProperty, true)` against `RequestedDate`; a miss leaves `prop` null and `prop.GetValue(x)` throws `NullReferenceException`. Empty `pending` pages never called `GetValue`, which is why they appeared to work. The adapter now sends `RequestedDate`.
 - `#10` search fallback: `GET /api/v1/Request/tv/search/{term}` on 4.53.10 suffers from a LINQ translation bug (upstream Ombi-app/Ombi#5420, fixed by #5421). The adapter gracefully falls back to a bounded v1 parent scan filtering locally on the term if the primary search route fails.
 ## M6 Findings — Integration options and server-id discovery (#16, #17, #18, #20)
 - `#20`: `refOf` reference projections defaulted `value` to the first scalar map entry (`firstScalar`), which produced nondeterministic results depending on Go map iteration order (e.g. leaking logo paths, booleans, or unrelated weights). The contract is now deterministic: `value` holds the native-typed identifier matching the resolved ID key, falling back to name string if no ID matched, or omitted otherwise.
 - `#20` mojibake handling: language endpoints on Ombi 4.53.10 occasionally return corrupted strings like `"??????"` or containing `\uFFFD`. `refOf` skips corrupted candidates in favor of clean alternates (e.g. `name` instead of corrupted `english_name`); if all candidates are corrupted, the string is emitted and a degradation note is recorded in `warnings[]`.
 - `#17`: Root-folder records (`/api/v1/{Sonarr,Radarr,Lidarr}/RootFolders`) have no `name` property on the wire (only `path`). Category key table `refKeySet` now maps `path` to `name` and preserves `id` in `value` (e.g. `{id: "21", name: "/media/tv", value: 21}`), directly usable as `root_folder_id` in write operations.
 - `#16`: `GET /api/v1/Plex/servers` returns an object wrapper `{"success": true, "servers": [...]}` rather than a top-level array. `refsOrUsers` now inspects wrappers, verifies success/failure flags (mapping `success: false` to `UPSTREAM_REJECTED` with sanitized upstream messages), and decodes server entries with `id=machineId`, `name=serverName`, `value=serverId`.
 - `#16` sibling decode fixes: `refsOrScalar` was previously intercepting any valid JSON object in its `decodeScalar` branch and emitting a junk `{name: "<cat>"}` record, leaving nested-container extraction dead code. Reordering decode passes (`refArray` → `decodeObject` → `decodeScalar`) fixes `plex_libraries`, `media_server info`, and `media_server libraries`.
 - `#18`: Saved-server identity discovery: `flattenSettings` previously excluded `id`, `serverId`, and `machineIdentifier` everywhere, making it impossible to discover server IDs for `read_integration media_server` and `plex_libraries`. A scoped read-exemption allows server identity leaves under `/servers/<digits>/` to appear in `read_settings` values (top-level section IDs and credentials remain omitted; patches to server identity fields remain rejected with `INVALID_ARGUMENT`).
 ### Residual Verify items
 - Verify `PlexServersAddUserModel` and older Ombi instances where `servers` may be returned as a bare array (now tolerated alongside object wrappers).
 - Verify Emby `selectedLibraries[].key` ↔ MediaFolders `id` correspondence across diverse Emby/Jellyfin setups.
 ## M7 Findings — Admin/server wire contracts (#19, #13, #14, #15)
 - `#19`: `GET /api/v2/System/logs` returns a JSON string array of log file names on Ombi 4.53.10. The adapter accepts that form and the legacy object form, then reads the selected file as plain text.
 - `#13`: `GET /api/v2/System/news` returns Markdig-rendered HTML text rather than structured JSON. The `news` action was removed from `read_server`.
 - `#14`: `GET /api/v1/Stats` binds non-nullable `from` and `to` DateTimes; an empty range triggers an upstream null-reference error. The adapter requires both RFC3339 values before calling Ombi.
 - `#15`: Ombi validates Quartz.NET cron expressions. They have six or seven fields and require `?` in one of day-of-month or day-of-week; for example, `0 0 0 * * ?` validates while five-field cron and expressions with both day fields as `*` do not.
 ## M8 Findings — Upstream ratings and vote failures (#8, #12)
 - `#8`: Ombi 4.53.10 implements both v2 ratings routes by calling `www.rottentomatoes.com/api/private`; both private endpoints now return HTTP 404 and Ombi surfaces the dependency failure as HTTP 500. `read_media ratings` retains the native result when available and otherwise performs an exact title/year lookup through Ombi's normal movie or TV search. Fallback values are source-labelled (`tmdb_vote_average`, `tmdb_vote_count`, or `tvmaze_site_rating`) and the result carries a degradation warning. No fuzzy title or year substitution is allowed.
 - `#12`: `GET /api/v1/Vote` and `GET /api/v1/Vote/movie/{requestId}` return HTTP 500 on the verified Ombi 4.53.10 data set, while an empty TV request returns HTTP 200 with `[]`. The global controller builds derived per-request summaries and the per-media controllers are the only raw vote-record reads; there is no second lossless API from which the MCP can recover user vote identity and counts. The adapter therefore preserves the sanitized, retryable `UPSTREAM_REJECTED` error and never substitutes an empty page. Mock coverage fixes this error boundary as part of the public contract.
 ## Read-tools sweep findings (#10 remainder, #27, #28)
 - `#10` remainder: the v2 list 500s were not an upstream per-row serializer bug. Ombi looks up `{sort}` as a C# property name (`RequestedDate`); `requestDate` misses, `prop` is null, and `GetValue` throws on the first row. Pending pages were empty so they never threw. The adapter now sends `RequestedDate`.
 - `#27`: `read_discover browse` TV `popular`/`most_watched` exceeded the 8 MiB read budget because Ombi hydrates `seasonRequests` for every show when `HideAvailableFromDiscover` is on. Browse now streams the JSON array, skips `seasonRequests` while tokenizing, and uses a 64 MiB safety cap.
 - `#28`: `GET /api/v2/Issues/details/{providerId}` returns an empty body when the provider has no issues. `provider_summary` treats empty/`null`/`[]` as an empty `group_page` instead of a decode failure.
@@ -59,7 +59,7 @@ These types deliberately exclude credentials, connection destinations, internal
 ## Fields excluded from patches
-The following exact field names are excluded recursively wherever encountered; `key` in a selected-library record is an identifier, not automatically a secret. Read projections also exclude private values and use an allowlist, not merely this name list.
+The following exact field names are excluded recursively wherever encountered; `key` in a selected-library record is an identifier, not automatically a secret. Read projections also exclude private values and use an allowlist, not merely this name list. In read projections (`read_settings`), a scoped exemption allows server identity fields (`id`, `serverId`, `machineIdentifier`) to be projected when they are direct leaves of a server record under `/servers/<digits>` (e.g. `/servers/0/id`, `/servers/0/serverId`, `/servers/0/machineIdentifier`), making saved servers discoverable for `read_integration media_server` and `plex_libraries`. In patches (`write_settings_patch`), these fields remain strictly excluded and unpatchable.
 `accessToken`, `accountSid`, `administratorId`, `apiKey`, `applicationToken`, `applicationUrl`, `authToken`, `authorizationHeader`, `baseUrl`, `botApi`, `customDonationUrl`, `disableCertificateChecking`, `disableTLS`, `favicon`, `hasMigratedOldTvDbData`, `host`, `iconUrl`, `id`, `installId`, `ip`, `logo`, `machineIdentifier`, `password`, `plexAuthToken`, `port`, `processName`, `scriptLocation`, `serverHostname`, `serverId`, `set`, `ssl`, `subDir`, `useScript`, `userToken`, `webhookUrl`, `windowsService`, `windowsServiceName`, `wizard`.
@@ -4,6 +4,7 @@ package integration_test
 import (
 	"encoding/json"
 	"fmt"
 	"os"
 	"strings"
 	"testing"
@@ -70,6 +71,50 @@ func TestLiveServerStatus(t *testing.T) {
 	assertNoLeak(t, out.Raw)
 }
 func TestLiveServerStats(t *testing.T) {
 	c := liveServer(t)
 	out := c.callTool(t, "read_server", map[string]any{
 		"action": "stats", "from": "2026-09-01T00:00:00Z", "to": "2026-09-02T00:00:00Z",
 	})
 	data := requireOK(t, out)
 	var metrics struct {
 		Kind string `json:"kind"`
 	}
 	if err := json.Unmarshal(data, &metrics); err != nil || metrics.Kind != "metrics" {
 		t.Fatalf("stats result: %v: %s", err, data)
 	}
 }
 func TestLiveLogs(t *testing.T) {
 	c := liveServer(t)
 	out := c.callTool(t, "read_logs", map[string]any{"action": "list"})
 	data := requireOK(t, out)
 	var logs struct {
 		Kind string `json:"kind"`
 	}
 	if err := json.Unmarshal(data, &logs); err != nil || logs.Kind != "logs" {
 		t.Fatalf("logs result: %v: %s", err, data)
 	}
 }
 func TestLiveCronValidateQuartz(t *testing.T) {
 	c := liveServer(t)
 	out := c.callTool(t, "read_server", map[string]any{
 		"action": "cron_validate", "expression": "0 0 0 * * ?",
 	})
 	data := requireOK(t, out)
 	if !strings.Contains(string(data), `"name":"valid","value":true`) {
 		t.Fatalf("Quartz-valid expression reported invalid: %s", data)
 	}
 	out = c.callTool(t, "read_server", map[string]any{
 		"action": "cron_validate", "expression": "0 0 * * *",
 	})
 	data = requireOK(t, out)
 	if !strings.Contains(string(data), `"name":"valid","value":false`) {
 		t.Fatalf("five-field cron reported valid: %s", data)
 	}
 }
 // --- read/projection contract against real payloads ---
 func TestLiveReadRequestsList(t *testing.T) {
@@ -476,6 +521,54 @@ func TestLiveDiscoverTVBrowseHasIdentifiers(t *testing.T) {
 	assertNoLeak(t, out.Raw)
 }
 func TestLiveRecentTVParentTargetIsCallable(t *testing.T) {
 	c := liveServer(t)
 	out := c.callTool(t, "read_requests", map[string]any{"action": "recent"})
 	data := requireOK(t, out)
 	var page struct {
 		Items []struct {
 			Target struct {
 				Kind string `json:"kind"`
 				ID   int    `json:"id"`
 			} `json:"target"`
 			Title string `json:"title"`
 		} `json:"items"`
 	}
 	if err := json.Unmarshal(data, &page); err != nil {
 		t.Fatalf("decode: %v\n%s", err, data)
 	}
 	var tv *struct {
 		Target struct {
 			Kind string `json:"kind"`
 			ID   int    `json:"id"`
 		} `json:"target"`
 		Title string `json:"title"`
 	}
 	for i := range page.Items {
 		if page.Items[i].Target.Kind == "tv_parent" {
 			tv = &page.Items[i]
 			break
 		}
 	}
 	if tv == nil {
 		t.Skip("live recent feed has no TV rows")
 	}
 	// Issue #11: upstream emits a provider-shaped child request id
 	// here; the resolved tv_parent id must be callable via get.
 	if tv.Target.ID < 1 {
 		t.Skipf("recent tv row %q left unresolved (id 0)", tv.Title)
 	}
 	out = c.callTool(t, "read_requests", map[string]any{
 		"action": "get",
 		"target": map[string]any{"kind": "tv_parent", "id": tv.Target.ID},
 	})
 	if out.IsError {
 		t.Fatalf("recent tv_parent target %d not callable via get (issue #11): %s",
 			tv.Target.ID, out.Raw)
 	}
 	assertNoLeak(t, out.Raw)
 }
 func TestLiveSearchMultiArtistMapped(t *testing.T) {
 	c := liveServer(t)
 	out := c.callTool(t, "read_search", map[string]any{
@@ -509,3 +602,121 @@ func TestLiveSearchMultiArtistMapped(t *testing.T) {
 	}
 	assertNoLeak(t, out.Raw)
 }
 func TestLiveReferenceGenresValue(t *testing.T) {
 	c := liveServer(t)
 	out := c.callTool(t, "read_reference", map[string]any{
 		"action": "genres",
 		"media":  "movie",
 	})
 	data := requireOK(t, out)
 	var page struct {
 		Items []struct {
 			ID    string `json:"id"`
 			Name  string `json:"name"`
 			Value any    `json:"value"`
 		} `json:"items"`
 	}
 	if err := json.Unmarshal(data, &page); err != nil {
 		t.Fatalf("decode: %v\n%s", err, data)
 	}
 	if len(page.Items) == 0 {
 		t.Skip("live genres returned no items")
 	}
 	for _, it := range page.Items {
 		idNum, ok := it.Value.(float64)
 		if !ok {
 			t.Fatalf("genre item %q id %q has non-numeric value: %v (%T)", it.Name, it.ID, it.Value, it.Value)
 		}
 		if fmt.Sprintf("%.0f", idNum) != it.ID {
 			t.Fatalf("genre item %q id %q does not match value %.0f", it.Name, it.ID, idNum)
 		}
 	}
 	assertNoLeak(t, out.Raw)
 }
 func TestLivePlexServersAndLibraries(t *testing.T) {
 	c := liveServer(t)
 	out := c.callTool(t, "read_integration", map[string]any{
 		"action":   "plex",
 		"resource": "servers",
 	})
 	if out.IsError {
 		t.Skip("live plex servers returned error")
 	}
 	data := requireOK(t, out)
 	var page struct {
 		Items []struct {
 			ID    string `json:"id"`
 			Name  string `json:"name"`
 			Value any    `json:"value"`
 		} `json:"items"`
 	}
 	if err := json.Unmarshal(data, &page); err != nil {
 		t.Fatalf("decode: %v\n%s", err, data)
 	}
 	if len(page.Items) == 0 {
 		t.Skip("no plex servers configured")
 	}
 	server := page.Items[0]
 	if server.ID == "" {
 		t.Fatalf("plex server ID (machineId) is empty: %+v", server)
 	}
 	outLibs := c.callTool(t, "read_integration", map[string]any{
 		"action":     "plex_libraries",
 		"machine_id": server.ID,
 	})
 	requireOK(t, outLibs)
 	assertNoLeak(t, outLibs.Raw)
 }
 func TestLiveServerIdentityDiscoveryAndMediaServer(t *testing.T) {
 	c := liveServer(t)
 	var foundServerID string
 	var foundService string
 	for _, svc := range []string{"emby", "jellyfin", "plex"} {
 		out := c.callTool(t, "read_settings", map[string]any{
 			"section": svc,
 		})
 		if out.IsError {
 			continue
 		}
 		data := requireOK(t, out)
 		var s struct {
 			Values []struct {
 				Name  string `json:"name"`
 				Value any    `json:"value"`
 			} `json:"values"`
 			OmittedFields []string `json:"omitted_fields"`
 		}
 		if err := json.Unmarshal(data, &s); err != nil {
 			t.Fatalf("decode: %v\n%s", err, data)
 		}
 		for _, v := range s.Values {
 			if strings.HasPrefix(v.Name, "/servers/") {
 				if strings.HasSuffix(v.Name, "/id") || strings.HasSuffix(v.Name, "/serverId") || strings.HasSuffix(v.Name, "/machineIdentifier") {
 					if foundServerID == "" && (svc == "emby" || svc == "jellyfin") {
 						foundServerID = fmt.Sprintf("%v", v.Value)
 						foundService = svc
 					}
 				}
 			}
 		}
 		for _, o := range s.OmittedFields {
 			if strings.HasPrefix(o, "/servers/") && (strings.HasSuffix(o, "/id") || strings.HasSuffix(o, "/serverId") || strings.HasSuffix(o, "/machineIdentifier")) {
 				t.Errorf("server identity field %q found in omitted_fields for %s", o, svc)
 			}
 		}
 	}
 	if foundServerID != "" && foundService != "" {
 		outInfo := c.callTool(t, "read_integration", map[string]any{
 			"action":    "media_server",
 			"service":   foundService,
 			"resource":  "info",
 			"server_id": foundServerID,
 		})
 		if !outInfo.IsError {
 			assertNoLeak(t, outInfo.Raw)
 		}
 	}
 }
@@ -53,25 +53,45 @@ func newMockOmbi(t *testing.T, mode string) *mockOmbi {
 	m.settings = map[string]map[string]any{
 		"/api/v1/Settings/customization":         mockCustomization(),
 		"/api/v1/Settings/notifications/discord": mockDiscordSettings(),
 		"/api/v1/Settings/emby":                  mockMediaServerSettings("Emby One", "emby-guid", 3),
 		"/api/v1/Settings/jellyfin":              mockMediaServerSettings("Jellyfin One", "jf-guid", 4),
 		"/api/v1/Settings/plex":                  mockMediaServerSettings("Plex One", "plex-guid", 5),
 	}
 	mux := http.NewServeMux()
 	mux.HandleFunc("POST /api/v1/Token", m.handleToken)
 	mux.HandleFunc("GET /api/v1/Status", m.wrap(m.fixed(`200`)))
 	mux.HandleFunc("GET /api/v1/Status/info", m.wrap(m.fixed(`"mock-status-info"`)))
 	mux.HandleFunc("GET /api/v1/Settings/about", m.wrap(m.json(mockAbout())))
-	mux.HandleFunc("GET /api/v2/Requests/movie/{amt}/{pos}/requestDate/{order}", m.wrap(m.movieList))
+	mux.HandleFunc("GET /api/v1/Stats", m.wrap(m.stats))
-	mux.HandleFunc("GET /api/v2/Requests/tv/{amt}/{pos}/requestDate/{order}", m.wrap(m.tvList))
+	mux.HandleFunc("POST /api/v1/Settings/testcron", m.wrap(m.testcron))
 	mux.HandleFunc("GET /api/v2/System/logs", m.wrap(m.fixed(`["ombi-20260918.txt","ombi-20260919.txt"]`)))
 	mux.HandleFunc("GET /api/v2/System/logs/{logFileName}", m.wrap(m.logsRead))
 	mux.HandleFunc("GET /api/v1/Request/tv/{count}/{pos}/{o}/{s}/{a}", m.wrap(m.tvParentList))
 	mux.HandleFunc("GET /api/v1/Request/tv/{id}/child", m.wrap(m.tvChildren))
 	mux.HandleFunc("GET /api/v2/Requests/movie/{amt}/{pos}/RequestedDate/{order}", m.wrap(m.movieList))
 	mux.HandleFunc("GET /api/v2/Requests/tv/{amt}/{pos}/RequestedDate/{order}", m.wrap(m.tvList))
 	mux.HandleFunc("GET /api/v2/Requests/movie/{status}/{amt}/{pos}/RequestedDate/{order}", m.wrap(m.movieList))
 	mux.HandleFunc("GET /api/v2/Requests/tv/{status}/{amt}/{pos}/RequestedDate/{order}", m.wrap(m.tvList))
 	mux.HandleFunc("GET /api/v2/Search/movie/{id}", m.wrap(m.movieDetails))
 	mux.HandleFunc("GET /api/v2/Search/movie/collection/{id}", m.wrap(m.movieCollection))
 	mux.HandleFunc("GET /api/v2/Search/movie/requested/{pos}/{amt}", m.wrap(m.emptyBrowse))
 	mux.HandleFunc("GET /api/v2/Search/tv/moviedb/{id}", m.wrap(m.tvDetailsTMDB))
 	mux.HandleFunc("GET /api/v2/Search/tv/{id}", m.wrap(m.tvDetailsTVDB))
 	mux.HandleFunc("GET /api/v2/Search/tv/popular/{pos}/{amt}", m.wrap(m.tvBrowse))
 	mux.HandleFunc("GET /api/v2/Search/tv/anticipated/{pos}/{amt}", m.wrap(m.tvBrowse))
 	mux.HandleFunc("GET /api/v2/Search/tv/mostwatched/{pos}/{amt}", m.wrap(m.tvBrowseHuge))
 	mux.HandleFunc("GET /api/v2/Search/tv/trending/{pos}/{amt}", m.wrap(m.tvBrowse))
 	mux.HandleFunc("GET /api/v2/Issues/details/{providerId}", m.wrap(m.issueProviderSummary))
 	mux.HandleFunc("GET /api/v2/Search/tv/requested/{pos}/{amt}", m.wrap(m.emptyBrowse))
 	mux.HandleFunc("GET /api/v2/Search/actor/{id}/movie", m.wrap(m.actorMovieCredits))
 	mux.HandleFunc("GET /api/v2/Search/actor/{id}/tv", m.wrap(m.actorTVCredits))
 	mux.HandleFunc("POST /api/v2/Search/advancedSearch/movie/{pos}/{amt}", m.wrap(m.advancedMovie))
 	mux.HandleFunc("POST /api/v2/Search/multi/{term}", m.wrap(m.multiSearch))
 	mux.HandleFunc("GET /api/v2/Search/ratings/{media}/{name}/{year}", m.wrap(m.ratingsUnavailable))
 	mux.HandleFunc("GET /api/v2/Requests/recentlyRequested", m.wrap(m.recentlyRequested))
 	mux.HandleFunc("GET /api/v1/Search/tv/info/{id}", m.wrap(m.tvInfoTVDB))
 	mux.HandleFunc("GET /api/v1/Search/tv/{term}", m.wrap(m.tvSearch))
 	mux.HandleFunc("GET /api/v1/Search/movie/{term}", m.wrap(m.movieSearch))
 	mux.HandleFunc("GET /api/v1/Request/movie/info/{id}", m.wrap(m.movieInfo))
 	mux.HandleFunc("POST /api/v2/Requests/tv", m.wrap(m.createTV))
 	mux.HandleFunc("POST /api/v1/Request/tv", m.wrap(m.createTV))
@@ -84,6 +104,15 @@ func newMockOmbi(t *testing.T, mode string) *mockOmbi {
 	mux.HandleFunc("POST /api/v1/Settings/customization", m.wrap(m.settingsPost))
 	mux.HandleFunc("GET /api/v1/Settings/notifications/discord", m.wrap(m.settingsGet))
 	mux.HandleFunc("POST /api/v1/Settings/notifications/discord", m.wrap(m.settingsPost))
 	mux.HandleFunc("GET /api/v1/Settings/emby", m.wrap(m.settingsGet))
 	mux.HandleFunc("POST /api/v1/Settings/emby", m.wrap(m.settingsPost))
 	mux.HandleFunc("GET /api/v1/Settings/jellyfin", m.wrap(m.settingsGet))
 	mux.HandleFunc("POST /api/v1/Settings/jellyfin", m.wrap(m.settingsPost))
 	mux.HandleFunc("GET /api/v1/Settings/plex", m.wrap(m.settingsGet))
 	mux.HandleFunc("POST /api/v1/Settings/plex", m.wrap(m.settingsPost))
 	mux.HandleFunc("GET /api/v1/Emby/users", m.wrap(m.fixed(`[{"id":"e-1","username":"emb"}]`)))
 	mux.HandleFunc("POST /api/v1/Emby/info", m.wrap(m.fixed(`{"id":"emby-guid","serverName":"Emby One","version":"4.8.0"}`)))
 	mux.HandleFunc("POST /api/v1/Emby/Library", m.wrap(m.fixed(`{"items":[{"name":"Movies","serverId":"emby-guid","id":"f137","collectionType":"movies"}]}`)))
 	mux.HandleFunc("GET /api/v1/Request/movie/search/{q}", m.wrap(m.malformed))
 	mux.HandleFunc("GET /api/v1/Request/count", m.wrap(m.fixed(`{"pending":3,"approved":2,"available":5,"denied":1}`)))
 	mux.HandleFunc("GET /api/v1/Request/movie/total", m.wrap(m.fixed(`7`)))
@@ -92,6 +121,17 @@ func newMockOmbi(t *testing.T, mode string) *mockOmbi {
 		mockUser("u-1", "alice"), mockUser("u-2", "bob"),
 	})))
 	mux.HandleFunc("GET /api/v1/Identity/User/{id}", m.wrap(m.userGet))
 	mux.HandleFunc("GET /api/v1/Vote", m.wrap(m.voteListFailure))
 	mux.HandleFunc("GET /api/v1/Vote/{media}/{id}", m.wrap(m.voteGet))
 	mux.HandleFunc("GET /api/v1/Radarr/Profiles", m.wrap(m.fixed(`[{"id":6,"name":"HD","weight":7,"enabled":false}]`)))
 	mux.HandleFunc("GET /api/v2/Search/Genres/{media}", m.wrap(m.fixed(`[{"id":53,"name":"Thriller"}]`)))
 	mux.HandleFunc("GET /api/v2/Search/Languages", m.wrap(m.fixed(`[{"iso_639_1":"ky","english_name":"??????","name":"Кыргызча"},{"iso_639_1":"zz","english_name":"??????","name":"??????"}]`)))
 	mux.HandleFunc("GET /api/v1/TheMovieDb/WatchProviders/{media}", m.wrap(m.fixed(`[{"provider_id":8,"provider_name":"Netflix","logo_path":"/x.png"}]`)))
 	mux.HandleFunc("GET /api/v1/Sonarr/RootFolders", m.wrap(m.fixed(`[{"id":21,"path":"/media/tv","freespace":9e9}]`)))
 	mux.HandleFunc("GET /api/v1/Plex/servers", m.wrap(m.fixed(`{"success":true,"servers":[{"serverId":7,"machineId":"mach-plex-1","serverName":"Main Plex"}]}`)))
 	mux.HandleFunc("GET /api/v1/Plex/Libraries/{machineId}", m.wrap(m.plexLibraries))
 	mux.HandleFunc("GET /api/v1/Plex/friends", m.wrap(m.fixed(`[{"id":"pf-1","username":"plexfriend"}]`)))
 	mux.HandleFunc("GET /api/v1/Plex/WatchlistUsers", m.wrap(m.fixed(`[{"userId":"w-1","userName":"wl","syncStatus":1}]`)))
 	mux.HandleFunc("/api/v1/", m.wrap(m.catchAll)) // fallthrough: 404
 	m.Server = httptest.NewServer(mux)
 	t.Cleanup(m.Server.Close)
@@ -353,7 +393,7 @@ func mockTVDetail() map[string]any {
 			map[string]any{
 				"seasonNumber": 1,
 				"episodes": []any{
-					map[string]any{"episodeNumber": 1, "title": "Pilot", "available": true, "requested": true},
+					map[string]any{"episodeNumber": 1, "title": "Pilot", "available": true},
 					map[string]any{"episodeNumber": 2, "title": "Cat's in the Bag...", "available": true},
 					map[string]any{"episodeNumber": 3, "title": "...And the Bag's in the River"},
 					map[string]any{"episodeNumber": 4, "title": "Cancer Man"},
@@ -392,7 +432,8 @@ func mockTVInfoV1() map[string]any {
 		"title": "Breaking Bad", "name": "Breaking Bad",
 		"overview":   "A chemistry teacher turns to cooking meth.",
 		"firstAired": "2008-01-20T00:00:00", "status": "Ended",
-		"available": false, "requested": false, "fullyAvailable": false,
+		// Live sends requestId 0 (not absent) on unrequested shows.
 		"available": false, "requested": false, "requestId": 0, "fullyAvailable": false,
 		"poster": "/ggFHVNu6YYI5L9pCfOacjizRGt.jpg",
 		"banner": "/tsRy63Mu5cu8etL1X7ZLyf7UP1M.jpg",
 		"genre":  []any{"Crime", "Drama", "Thriller"},
@@ -427,7 +468,7 @@ func mockTVSearchHit() map[string]any {
 		"imdbId": "tt0903747",
 		"title":  "Breaking Bad", "name": "Breaking Bad",
 		"overview":   "A chemistry teacher turns to cooking meth.",
-		"firstAired": "2008-01-20T00:00:00",
+		"firstAired": "2008-01-20T00:00:00", "siteRating": 9,
 		"available": false, "requested": false,
 		"poster":           "/ggFHVNu6YYI5L9pCfOacjizRGt.jpg",
 		"genre":            []any{"Crime", "Drama"},
@@ -435,6 +476,13 @@ func mockTVSearchHit() map[string]any {
 	}
 }
 func mockMovieSearchHit() map[string]any {
 	return map[string]any{
 		"id": 348, "title": "Alien", "releaseDate": "1979-05-25T00:00:00",
 		"voteAverage": 8.2, "voteCount": 15400,
 	}
 }
 func mockMovieRequest() map[string]any {
 	return map[string]any{
 		"id": 10, "requestId": 10, "theMovieDbId": 27205, "imdbId": "tt1375666",
@@ -467,7 +515,12 @@ func mockTVChild() map[string]any {
 				},
 			},
 		},
-		"tvDbId": 81189, "externalProviderId": 1396, "imdbId": "tt0903747",
+		// ChildRequests carries no top-level provider ids upstream —
 		// they live on the embedded parent navigation property.
 		"parentRequest": map[string]any{
 			"id": 12, "tvDbId": 81189,
 			"externalProviderId": 1396, "imdbId": "tt0903747",
 		},
 		"childFieldFuture": []any{1, 2},
 	}
 }
@@ -515,6 +568,24 @@ func mockDiscordSettings() map[string]any {
 	}
 }
 func mockMediaServerSettings(name, serverGuid string, serverID int) map[string]any {
 	return map[string]any{
 		"enable": true,
 		"id":     9,
 		"servers": []any{
 			map[string]any{
 				"id":              serverID,
 				"serverId":        serverGuid,
 				"name":            name,
 				"apiKey":          "SECRET",
 				"administratorId": "a",
 				"ip":              "10.0.0.5",
 				"port":            8096,
 			},
 		},
 	}
 }
 // --- handlers ---
 func (m *mockOmbi) movieList(w http.ResponseWriter, r *http.Request) {
@@ -527,6 +598,76 @@ func (m *mockOmbi) movieList(w http.ResponseWriter, r *http.Request) {
 	})
 }
 func (m *mockOmbi) tvParentList(w http.ResponseWriter, r *http.Request) {
 	pos := r.PathValue("pos")
 	if pos != "0" {
 		m.json(map[string]any{"collection": []any{}, "total": 1})(w, r)
 		return
 	}
 	// RequestsViewModel<TvRequests>: the v1 paged route wraps rows in
 	// {collection,total} — scans that decode a bare array break on live.
 	m.json(map[string]any{
 		"collection": []any{
 			map[string]any{
 				"id":                 42,
 				"tvDbId":             81189,
 				"externalProviderId": 1396,
 				"imdbId":             "tt0903747",
 				"title":              "trigger-500 and something", // For search fallback test
 				"childRequests": []any{
 					map[string]any{
 						// A real (non-provider-shaped) child request
 						// id — recent rows reference this in requestId.
 						"id": 88,
 						"seasonRequests": []any{
 							map[string]any{
 								"childRequestId": 88,
 								"seasonNumber":   1,
 								"episodes": []any{
 									map[string]any{"episodeNumber": 1, "requested": true},
 									map[string]any{"episodeNumber": 2, "requested": true},
 									map[string]any{"episodeNumber": 3, "requested": true},
 								},
 							},
 						},
 					},
 				},
 			},
 			map[string]any{
 				// Upstream persists the provider id as the child PK
 				// for new-request children — this child's id is the
 				// parent's tvDbId, exactly like live rows.
 				"id":                 909,
 				"tvDbId":             259032,
 				"externalProviderId": 118680,
 				"imdbId":             "tt1439629",
 				"title":              "Seven Up!",
 				"childRequests": []any{
 					map[string]any{
 						"id": 259032,
 						"seasonRequests": []any{
 							map[string]any{
 								"childRequestId": 259032,
 								"seasonNumber":   1,
 								"episodes":       []any{},
 							},
 						},
 					},
 				},
 			},
 		},
 		"total": 2,
 	})(w, r)
 }
 func (m *mockOmbi) tvChildren(w http.ResponseWriter, r *http.Request) {
 	if r.PathValue("id") != "12" {
 		m.jsonErr(w, http.StatusNotFound, "Parent request not found")
 		return
 	}
 	m.json([]any{mockTVChild()})(w, r)
 }
 func (m *mockOmbi) tvList(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Content-Type", "application/json")
 	json.NewEncoder(w).Encode(map[string]any{
@@ -547,6 +688,10 @@ func (m *mockOmbi) movieDetails(w http.ResponseWriter, r *http.Request) {
 		w.Write([]byte("<html><body><h1>500 Internal Server Error</h1>" +
 			"System.NullReferenceException at Ombi.Core.Engine.MovieRequestEngine" +
 			"Authorization: Bearer should-never-appear</body></html>"))
 	case "500001":
 		w.Header().Set("Content-Type", "application/json")
 		w.WriteHeader(http.StatusInternalServerError)
 		w.Write([]byte(`{"error": "Object reference not set to an instance of an object. System.NullReferenceException"}`))
 	default:
 		m.jsonErr(w, http.StatusNotFound, "Movie not found")
 	}
@@ -590,9 +735,36 @@ func (m *mockOmbi) tvInfoTVDB(w http.ResponseWriter, r *http.Request) {
 }
 func (m *mockOmbi) tvSearch(w http.ResponseWriter, r *http.Request) {
 	if r.PathValue("term") == "trigger-500" {
 		w.Header().Set("Content-Type", "text/html")
 		w.WriteHeader(http.StatusInternalServerError)
 		w.Write([]byte("<html><body><h1>500 Internal Server Error</h1>" +
 			"System.NullReferenceException at Ombi.Core.Engine.TvRequestEngine</body></html>"))
 		return
 	}
 	m.json([]any{mockTVSearchHit()})(w, r)
 }
 func (m *mockOmbi) movieSearch(w http.ResponseWriter, r *http.Request) {
 	m.json([]any{mockMovieSearchHit()})(w, r)
 }
 func (m *mockOmbi) ratingsUnavailable(w http.ResponseWriter, r *http.Request) {
 	m.jsonErr(w, http.StatusInternalServerError, "external ratings provider failed")
 }
 func (m *mockOmbi) voteListFailure(w http.ResponseWriter, r *http.Request) {
 	m.jsonErr(w, http.StatusInternalServerError, "vote view could not be generated")
 }
 func (m *mockOmbi) voteGet(w http.ResponseWriter, r *http.Request) {
 	if r.PathValue("media") == "tv" {
 		m.json([]any{})(w, r)
 		return
 	}
 	m.jsonErr(w, http.StatusInternalServerError, "vote records could not be read")
 }
 // tvBrowse is the v2 TMDB-keyed popular/anticipated/trending list —
 // members carry the provider id only in `id`.
 func (m *mockOmbi) tvBrowse(w http.ResponseWriter, r *http.Request) {
@@ -605,6 +777,43 @@ func (m *mockOmbi) tvBrowse(w http.ResponseWriter, r *http.Request) {
 	})(w, r)
 }
 // tvBrowseHuge emulates HideAvailableFromDiscover season hydration:
 // a compact title plus a seasonRequests graph larger than the
 // default 8 MiB read budget (#27).
 func (m *mockOmbi) tvBrowseHuge(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Content-Type", "application/json")
 	json.NewEncoder(w).Encode([]any{
 		map[string]any{
 			"id":         1668,
 			"title":      "Reacher",
 			"overview":   "A former military policeman.",
 			"posterPath": "/reacher.jpg",
 			"seasonRequests": []any{
 				map[string]any{
 					"seasonNumber": 1,
 					"overview":     strings.Repeat("x", 9<<20),
 				},
 			},
 		},
 	})
 }
 func (m *mockOmbi) issueProviderSummary(w http.ResponseWriter, r *http.Request) {
 	if r.PathValue("providerId") == "348" {
 		w.Header().Set("Content-Type", "application/json")
 		w.WriteHeader(http.StatusOK)
 		return
 	}
 	m.json(map[string]any{
 		"providerId": r.PathValue("providerId"),
 		"title":      "The Equalizer",
 		"count":      1,
 		"issues": []any{
 			map[string]any{"id": 1, "title": "Audio missing", "status": 0},
 		},
 	})(w, r)
 }
 func (m *mockOmbi) movieCollection(w http.ResponseWriter, r *http.Request) {
 	m.json(map[string]any{
 		"id": 8091, "name": "Alien Collection", "overview": "In space…",
@@ -618,6 +827,37 @@ func (m *mockOmbi) movieCollection(w http.ResponseWriter, r *http.Request) {
 	})(w, r)
 }
 func (m *mockOmbi) emptyBrowse(w http.ResponseWriter, r *http.Request) {
 	m.json([]any{})(w, r)
 }
 func (m *mockOmbi) actorMovieCredits(w http.ResponseWriter, r *http.Request) {
 	m.json(map[string]any{
 		"id": r.PathValue("id"),
 		"cast": []any{map[string]any{
 			"id": 27205, "title": "Inception", "overview": "A thief who steals corporate secrets.",
 			"release_date": "2010-07-15", "poster_path": "/inception.jpg", "character": "Cobb",
 		}},
 		"crew": []any{map[string]any{
 			"id": 27205, "title": "Inception", "job": "Producer", "department": "Production",
 		}},
 	})(w, r)
 }
 func (m *mockOmbi) actorTVCredits(w http.ResponseWriter, r *http.Request) {
 	// Ombi's ActorCredits DTO discards TMDB's TV name/original_name fields.
 	m.json(map[string]any{
 		"id": r.PathValue("id"),
 		"cast": []any{map[string]any{
 			"id": 1396, "character": "Walter White", "overview": "A chemistry teacher.",
 		}},
 	})(w, r)
 }
 func (m *mockOmbi) advancedMovie(w http.ResponseWriter, r *http.Request) {
 	m.json([]any{mockMovieDetail()})(w, r)
 }
 func (m *mockOmbi) multiSearch(w http.ResponseWriter, r *http.Request) {
 	m.json([]any{
 		map[string]any{
@@ -636,16 +876,27 @@ func (m *mockOmbi) recentlyRequested(w http.ResponseWriter, r *http.Request) {
 			"requestDate": "2026-09-01T10:00:00",
 		},
 		map[string]any{
-			// Live TV recent items put the provider id in `id` and
+			// Live TV rows carry the CHILD request id in requestId —
-			// may omit requestId; target.id must not become 259032.
+			// for new-request children upstream persists the provider
-			"id": 259032, "requestId": 88, "type": 0,
+			// id as the child PK — and the parent's externalProviderId
-			"title": "Seven Up!", "mediaId": "259032",
+			// in mediaId. The parent request id is absent entirely.
 			"requestId": 259032, "type": 0,
 			"title": "Seven Up!", "mediaId": "118680",
 			"userId": "u-1", "requestDate": "2026-09-02T10:00:00",
 		},
 		map[string]any{
 			// A real (non-provider-shaped) child id — resolvable only
 			// via the parent's embedded childRequests[].id.
 			"requestId": 88, "type": 0,
 			"title": "trigger-500 and something", "mediaId": "1396",
 			"userId": "u-2", "requestDate": "2026-09-03T10:00:00",
 		},
 		map[string]any{
 			// Unresolvable: no requestId, no parent match; a stray
 			// provider-shaped `id` must never occupy target.id.
 			"id": 111, "type": 0, "title": "Provider Only",
 			"mediaId": "111", "userId": "u-1",
-			"requestDate": "2026-09-03T10:00:00",
+			"requestDate": "2026-09-04T10:00:00",
 		},
 	})(w, r)
 }
@@ -737,6 +988,47 @@ func (m *mockOmbi) userGet(w http.ResponseWriter, r *http.Request) {
 	}
 }
 func (m *mockOmbi) plexLibraries(w http.ResponseWriter, r *http.Request) {
 	if r.PathValue("machineId") == "broken" {
 		w.Header().Set("Content-Type", "application/json")
 		w.Write([]byte(`{"successful":false,"message":"could not reach server"}`))
 		return
 	}
 	w.Header().Set("Content-Type", "application/json")
 	w.Write([]byte(`{"successful":true,"data":[{"id":"3","key":"3","type":"show","title":"TV Shows"},{"id":"1","key":"1","type":"movie","title":"Movies"}]}`))
 }
 func (m *mockOmbi) stats(w http.ResponseWriter, r *http.Request) {
 	if r.URL.Query().Get("from") == "" || r.URL.Query().Get("to") == "" {
 		m.jsonErr(w, http.StatusInternalServerError, "Object reference not set to an instance of an object")
 		return
 	}
 	m.fixed(`{"totalRequests":9,"totalMovieRequests":4,"totalTvRequests":5,"totalIssues":0,"completedRequestsMovies":2,"completedRequestsTv":1,"completedRequests":3}`)(w, r)
 }
 func (m *mockOmbi) testcron(w http.ResponseWriter, r *http.Request) {
 	var body struct {
 		Expression string `json:"expression"`
 	}
 	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
 		m.jsonErr(w, http.StatusBadRequest, "invalid JSON")
 		return
 	}
 	fields := strings.Fields(body.Expression)
 	valid := len(fields) >= 6 && len(fields) <= 7 &&
 		(fields[3] == "?") != (fields[5] == "?")
 	if valid {
 		m.fixed(`{"success":true}`)(w, r)
 		return
 	}
 	m.fixed(fmt.Sprintf(`{"success":false,"message":%q}`, "CRON Expression "+body.Expression+" is not valid"))(w, r)
 }
 func (m *mockOmbi) logsRead(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Content-Type", "text/plain; charset=utf-8")
 	w.Write([]byte("2026-09-19 10:00:00 [INF] boot\n2026-09-19 10:01:00 [INF] tick\n"))
 }
 // mockEnv returns the server env pointing at this mock in the
 // requested mode, plus all three bundles.
 func (m *mockOmbi) env() map[string]string {
@@ -160,16 +160,16 @@ type SearchMovieExtraInfoRefineModel struct {
 	LanguageCode string `json:"languageCode"`
 }
-// DiscoverModel — POST /api/v2/Search/advancedSearch/movie/{pos}/{amt}
+// DiscoverModel — POST /api/v2/Search/advancedSearch/movie/{pos}/{amt}.
-// The optional upstream `type` field is intentionally omitted until
+// Ombi uses Type to choose its downstream TMDB discover route; omitting it
-// its semantics are verified.
+// produces an empty result set.
 type DiscoverModel struct {
 	Type           string `json:"type"`
 	ReleaseYear    *int   `json:"releaseYear,omitempty"`
 	Decade         *int   `json:"decade,omitempty"`
 	GenreIDs       []int  `json:"genreIds,omitempty"`
 	KeywordIDs     []int  `json:"keywordIds,omitempty"`
 	WatchProviders []int  `json:"watchProviders,omitempty"`
 	Companies      []int `json:"companies,omitempty"`
 }
 // --- User / admin bodies ---
@@ -26,6 +26,7 @@ type DiscoverArgs struct {
 	Language     string           `json:"language,omitempty"`
 	CollectionID *int             `json:"collection_id,omitempty"`
 	PersonID     *int             `json:"person_id,omitempty"`
 	PersonName   string           `json:"person_name,omitempty"`
 	ArtistID     string           `json:"artist_id,omitempty"`
 	Filters      *DiscoverFilters `json:"filters,omitempty"`
 	Page         *Page            `json:"page,omitempty"`
@@ -112,7 +113,7 @@ type LibraryArgs struct {
 // read_server
 type ServerArgs struct {
-	Action     string `json:"action"` // status|status_info|about|update_info|update_check|news|landing|features|stats|cron_validate
+	Action     string `json:"action"` // status|status_info|about|update_info|update_check|landing|features|stats|cron_validate
 	From       string `json:"from,omitempty"`
 	To         string `json:"to,omitempty"`
 	Expression string `json:"expression,omitempty"`
@@ -21,6 +21,20 @@ import (
 // into an unbounded entity graph.
 const maxUpstreamBody = 8 << 20 // 8 MiB
 // maxBrowseBody is the read cap for server-paged discover browse
 // routes. Ombi's TV popular/mostwatched payloads embed full
 // seasonRequests trees when HideAvailableFromDiscover is enabled,
 // so three long-running shows routinely exceed 8 MiB. The extra
 // budget is paired with a streaming skim that discards those
 // nested graphs before they become Go values.
 const maxBrowseBody = 64 << 20 // 64 MiB
 // browseSkipKeys are nested graphs on SearchTvShowViewModel that
 // the browse projection never emits.
 var browseSkipKeys = map[string]bool{
 	"seasonRequests": true,
 }
 // maxSanitizedMsg bounds upstream-derived error text.
 const maxSanitizedMsg = 300
@@ -67,6 +81,166 @@ func (o *op) call(method, path string, query map[string]string, body any) ([]byt
 	return raw, nil
 }
 // callSkimArray GETs an upstream JSON array and decodes each object
 // while skipping keys in skip. budget is the maximum number of
 // response bytes that may be consumed.
 func (o *op) callSkimArray(path string, budget int64, skip map[string]bool) ([]map[string]any, *ToolResult) {
 	resp, err := o.env.Upstream.Do(o.ctx, "GET", path, nil, nil)
 	if err != nil {
 		return nil, o.transportErr(err)
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode < 200 || resp.StatusCode > 299 {
 		raw, err := io.ReadAll(io.LimitReader(resp.Body, maxUpstreamBody+1))
 		if err != nil {
 			return nil, o.transportErr(err)
 		}
 		return nil, o.httpErr(resp, raw)
 	}
 	cr := &countingReader{r: io.LimitReader(resp.Body, budget+1)}
 	arr, fail := o.decodeSkimArray(cr, budget, skip)
 	if fail != nil {
 		return nil, fail
 	}
 	return arr, nil
 }
 type countingReader struct {
 	r io.Reader
 	n int64
 }
 func (c *countingReader) Read(p []byte) (int, error) {
 	n, err := c.r.Read(p)
 	c.n += int64(n)
 	return n, err
 }
 func (o *op) decodeSkimArray(r io.Reader, budget int64, skip map[string]bool) ([]map[string]any, *ToolResult) {
 	cr, _ := r.(*countingReader)
 	if cr == nil {
 		cr = &countingReader{r: r}
 		r = cr
 	}
 	dec := json.NewDecoder(r)
 	tok, err := dec.Token()
 	if err != nil {
 		if cr.n > budget {
 			return nil, o.fail("UPSTREAM_SCHEMA_MISMATCH",
 				"upstream response exceeded the read budget", false)
 		}
 		return nil, o.fail("UPSTREAM_SCHEMA_MISMATCH",
 			fmt.Sprintf("upstream response was not a JSON array: %s", sanitizeErr(err)), false)
 	}
 	if delim, ok := tok.(json.Delim); !ok || delim != '[' {
 		return nil, o.fail("UPSTREAM_SCHEMA_MISMATCH",
 			"upstream response was not a JSON array", false)
 	}
 	out := []map[string]any{}
 	for dec.More() {
 		if cr.n > budget {
 			return nil, o.fail("UPSTREAM_SCHEMA_MISMATCH",
 				"upstream response exceeded the read budget", false)
 		}
 		m, err := decodeSkimObject(dec, skip)
 		if err != nil {
 			if cr.n > budget {
 				return nil, o.fail("UPSTREAM_SCHEMA_MISMATCH",
 					"upstream response exceeded the read budget", false)
 			}
 			return nil, o.fail("UPSTREAM_SCHEMA_MISMATCH",
 				fmt.Sprintf("upstream response did not match the expected shape: %s", sanitizeErr(err)), false)
 		}
 		out = append(out, m)
 		if len(out) >= maxRecords {
 			o.warnf("result capped at %d records", maxRecords)
 			o.truncated = true
 			break
 		}
 	}
 	return out, nil
 }
 func decodeSkimObject(dec *json.Decoder, skip map[string]bool) (map[string]any, error) {
 	tok, err := dec.Token()
 	if err != nil {
 		return nil, err
 	}
 	if delim, ok := tok.(json.Delim); !ok || delim != '{' {
 		return nil, fmt.Errorf("expected a JSON object")
 	}
 	m := map[string]any{}
 	for dec.More() {
 		kt, err := dec.Token()
 		if err != nil {
 			return nil, err
 		}
 		key, ok := kt.(string)
 		if !ok {
 			return nil, fmt.Errorf("expected object key")
 		}
 		if skip[key] {
 			if err := skipJSONValue(dec); err != nil {
 				return nil, err
 			}
 			continue
 		}
 		var v any
 		if err := dec.Decode(&v); err != nil {
 			return nil, err
 		}
 		m[key] = v
 	}
 	if _, err := dec.Token(); err != nil {
 		return nil, err
 	}
 	return m, nil
 }
 func skipJSONValue(dec *json.Decoder) error {
 	tok, err := dec.Token()
 	if err != nil {
 		return err
 	}
 	delim, ok := tok.(json.Delim)
 	if !ok {
 		return nil
 	}
 	switch delim {
 	case '{':
 		for dec.More() {
 			if _, err := dec.Token(); err != nil {
 				return err
 			}
 			if err := skipJSONValue(dec); err != nil {
 				return err
 			}
 		}
 		_, err = dec.Token()
 		return err
 	case '[':
 		for dec.More() {
 			if err := skipJSONValue(dec); err != nil {
 				return err
 			}
 		}
 		_, err = dec.Token()
 		return err
 	default:
 		return fmt.Errorf("unexpected JSON delimiter %v", delim)
 	}
 }
 // emptyCollection reports an empty/null/[] body that some Ombi
 // routes return instead of a structured empty payload.
 func emptyCollection(raw []byte) bool {
 	trim := bytes.TrimSpace(raw)
 	if len(trim) == 0 || bytes.Equal(trim, []byte("null")) {
 		return true
 	}
 	return bytes.Equal(trim, []byte("[]"))
 }
 // transportErr maps client/transport failures onto ToolError codes.
 // A timed-out or disconnected write has unknown outcome and is never
 // marked retryable.
@@ -132,7 +306,7 @@ func (o *op) httpErr(resp *http.Response, raw []byte) *ToolResult {
 	default:
 		if st >= 500 {
 			e.Code, e.Message, e.Retryable = "UPSTREAM_REJECTED",
-				fmt.Sprintf("upstream error (HTTP %d)", st), true
+				fmt.Sprintf("upstream error (HTTP %d)", st)+sanitizedDetail(raw), true
 		} else {
 			e.Code, e.Message, e.Retryable = "UPSTREAM_REJECTED",
 				fmt.Sprintf("upstream returned HTTP %d", st), false
@@ -0,0 +1,77 @@
 package tools
 import (
 	"bytes"
 	"encoding/json"
 	"strings"
 	"testing"
 )
 func TestEmptyCollection(t *testing.T) {
 	cases := []struct {
 		in   string
 		want bool
 	}{
 		{"", true},
 		{"  \n", true},
 		{"null", true},
 		{"[]", true},
 		{" {}", false},
 		{`{"providerId":"1"}`, false},
 		{`[{"id":1}]`, false},
 	}
 	for _, c := range cases {
 		if got := emptyCollection([]byte(c.in)); got != c.want {
 			t.Errorf("emptyCollection(%q) = %v, want %v", c.in, got, c.want)
 		}
 	}
 }
 func TestDecodeSkimArrayDropsSeasonRequests(t *testing.T) {
 	body := `[
 		{"id":1668,"title":"Reacher","seasonRequests":[{"seasonNumber":1,"episodes":[{"episodeNumber":1,"title":"Pilot"}]}]},
 		{"id":1396,"title":"Breaking Bad"}
 	]`
 	o := &op{warn: []string{}}
 	arr, fail := o.decodeSkimArray(strings.NewReader(body), maxBrowseBody, browseSkipKeys)
 	if fail != nil {
 		t.Fatalf("decode failed: %+v", fail.Error)
 	}
 	if len(arr) != 2 {
 		t.Fatalf("len = %d, want 2", len(arr))
 	}
 	if _, ok := arr[0]["seasonRequests"]; ok {
 		t.Errorf("seasonRequests was not skipped: %v", arr[0])
 	}
 	if arr[0]["title"] != "Reacher" {
 		t.Errorf("title = %v", arr[0]["title"])
 	}
 	if _, ok := arr[1]["seasonRequests"]; ok {
 		t.Errorf("second item unexpectedly has seasonRequests")
 	}
 }
 func TestDecodeSkimArrayBudget(t *testing.T) {
 	item := `{"id":1,"title":"x","seasonRequests":[` + strings.Repeat(`{"e":1},`, 100) + `{"e":2}]}`
 	body := "[" + item + "]"
 	o := &op{warn: []string{}}
 	_, fail := o.decodeSkimArray(strings.NewReader(body), 32, browseSkipKeys)
 	if fail == nil || fail.Error == nil || fail.Error.Code != "UPSTREAM_SCHEMA_MISMATCH" {
 		t.Fatalf("expected budget mismatch, got %+v", fail)
 	}
 }
 func TestSkipJSONValueNested(t *testing.T) {
 	raw := `{"keep":true,"seasonRequests":{"a":[1,{"b":[2,3]}],"c":"x"},"title":"T"}`
 	dec := json.NewDecoder(bytes.NewReader([]byte(raw)))
 	m, err := decodeSkimObject(dec, browseSkipKeys)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if m["title"] != "T" || m["keep"] != true {
 		t.Errorf("kept fields = %v", m)
 	}
 	if _, ok := m["seasonRequests"]; ok {
 		t.Errorf("seasonRequests survived skip: %v", m)
 	}
 }
@@ -4,6 +4,8 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
 	"strings"
 	"sync"
 	"ombi-mcp/internal/ombi"
 )
@@ -70,13 +72,12 @@ func (o *op) discoverBrowse(a *DiscoverArgs) *ToolResult {
 	}
 	pos, amt := bounds(a.Page)
 	path := fmt.Sprintf("/api/v2/Search/%s/%s/%d/%d", mediaSeg, segName, pos, amt)
-	raw, fail := o.call("GET", path, nil, nil)
+	arr, fail := o.callSkimArray(path, maxBrowseBody, browseSkipKeys)
 	if fail != nil {
 		return fail
 	}
-	arr, fail := o.decodeArray(raw)
+	if a.Category == "requested" && len(arr) == 0 {
-	if fail != nil {
+		return o.discoverRequestedFallback(a, media)
 		return fail
 	}
 	items := make([]Media, 0, len(arr))
 	for _, m := range arr {
@@ -88,6 +89,87 @@ func (o *op) discoverBrowse(a *DiscoverArgs) *ToolResult {
 	return o.ok(&MediaPage{Kind: "media_page", Items: items, Page: pg})
 }
 // discoverRequestedFallback uses Ombi's bounded, reliable recent-request
 // feed when its server-paged requested-browse route returns an empty page.
 // The feed has no total or continuation contract, so its paging is local and
 // deliberately reports those values as unknown.
 func (o *op) discoverRequestedFallback(a *DiscoverArgs, media string) *ToolResult {
 	raw, fail := o.call("GET", "/api/v2/Requests/recentlyRequested", nil, nil)
 	if fail != nil {
 		return fail
 	}
 	arr, fail := o.decodeArray(raw)
 	if fail != nil {
 		return fail
 	}
 	wantType := 1 // movie
 	if media == "tv" {
 		wantType = 0
 	}
 	items := make([]Media, 0, len(arr))
 	type pendingTV struct {
 		idx int
 		key tvRecentKey
 	}
 	pending := []pendingTV{}
 	for _, m := range arr {
 		kind, ok := toInt(m["type"])
 		if !ok || kind != wantType {
 			continue
 		}
 		requested := true
 		it := Media{
 			Media:       media,
 			Identifiers: []Identifier{},
 			Title:       jstr(m, "title"),
 			Overview:    jstr(m, "overview"),
 			Available:   jbool(m, "available"),
 			Requested:   &requested,
 		}
 		if y := yearOf(jstr(m, "releaseDate")); y != nil {
 			it.Year = y
 		}
 		it.Identifiers = addID(it.Identifiers, "tmdb", m["mediaId"])
 		if id, ok := toInt(m["requestId"]); ok && id > 0 {
 			kind := "movie"
 			if media == "tv" {
 				// Recent TV requestId is a child request id — resolve
 				// to the parent below; tv_child stays as the truthful
 				// fallback when no parent can be found.
 				kind = "tv_child"
 				pending = append(pending, pendingTV{
 					len(items), tvRecentKey{requestID: id, mediaID: jstr(m, "mediaId")}})
 			}
 			it.RequestTargets = []OutTarget{{Kind: kind, ID: id}}
 		}
 		for _, artwork := range []string{jstr(m, "posterPath"), jstr(m, "background")} {
 			if artwork != "" {
 				it.ArtworkURIs = appendIfMissing(it.ArtworkURIs, artwork)
 			}
 		}
 		items = append(items, it)
 	}
 	if len(pending) > 0 {
 		keys := make([]tvRecentKey, len(pending))
 		for i, p := range pending {
 			keys[i] = p.key
 		}
 		parents := o.resolveRecentTVParents(keys)
 		for i, p := range pending {
 			if pid := jint(parents[i], "id"); pid != nil && *pid > 0 {
 				items[p.idx].RequestTargets = []OutTarget{{Kind: "tv_parent", ID: *pid}}
 			}
 		}
 	}
 	win, _ := localWindow(o, items, a.Page, "media")
 	o.truncated = true
 	o.warnf("requested browse fell back to Ombi's bounded recently-requested feed")
 	offset, limit := bounds(a.Page)
 	pg := &Paging{Offset: offset, Limit: limit, Returned: len(win),
 		Mode: "local", Unit: "media"}
 	return o.ok(&MediaPage{Kind: "media_page", Items: win, Page: pg})
 }
 func (o *op) discoverSimilar(a *DiscoverArgs) *ToolResult {
 	if a.TmdbID == nil || *a.TmdbID < 1 {
 		return o.invalid("tmdb_id", "tmdb_id must be a positive integer")
@@ -146,6 +228,10 @@ func (o *op) discoverCredits(a *DiscoverArgs) *ToolResult {
 	if a.PersonID == nil || *a.PersonID < 1 {
 		return o.invalid("person_id", "person_id must be a positive integer")
 	}
 	personName := strings.TrimSpace(a.PersonName)
 	if personName == "" || len(personName) > 200 {
 		return o.invalid("person_name", "person_name must contain 1 to 200 characters")
 	}
 	var media string
 	switch a.Media {
 	case "movie", "tv":
@@ -162,10 +248,15 @@ func (o *op) discoverCredits(a *DiscoverArgs) *ToolResult {
 	if fail != nil {
 		return fail
 	}
-	// ActorCredits.cast/crew entries are credited works; emit each as a
+	// Ombi's ActorCredits model omits the person's name and, for TV, drops
-	// media record keeping the TMDB id and the person's role as a credit.
+	// TMDB's name fields. Keep each work's roles together, then enrich only
-	items := []Media{}
+	// the requested TV window through the TMDB-keyed details route.
-	seen := map[int]bool{}
+	type creditWork struct {
 		record  map[string]any
 		credits []Credit
 	}
 	works := []creditWork{}
 	byID := map[int]int{}
 	add := func(arr []any, isCrew bool) {
 		for _, v := range arr {
 			cm, ok := v.(map[string]any)
@@ -173,39 +264,92 @@ func (o *op) discoverCredits(a *DiscoverArgs) *ToolResult {
 				continue
 			}
 			id, _ := toInt(cm["id"])
-			if id > 0 && seen[id] {
+			if id < 1 {
 				continue
 			}
-			if id > 0 {
+			cr := Credit{Name: personName, PersonID: a.PersonID}
 				seen[id] = true
 			}
 			it := Media{Media: media, Identifiers: []Identifier{},
 				Title:    jstr(cm, "title", "original_title", "name"),
 				Overview: jstr(cm, "overview")}
 			it.Identifiers = addID(it.Identifiers, "tmdb", cm["id"])
 			if y := yearOf(jstr(cm, "release_date", "first_air_date")); y != nil {
 				it.Year = y
 			}
 			if u := jstr(cm, "poster_path"); u != "" {
 				it.ArtworkURIs = []string{u}
 			}
 			cr := Credit{PersonID: a.PersonID}
 			if isCrew {
 				cr.Role = jstr(cm, "job")
 				cr.Department = jstr(cm, "department")
 			} else {
 				cr.Role = jstr(cm, "character")
 			}
-			if cr.Role != "" || cr.Department != "" {
+			idx, exists := byID[id]
-				it.Credits = []Credit{cr}
+			if !exists {
 				idx = len(works)
 				byID[id] = idx
 				works = append(works, creditWork{record: cm})
 			}
-			items = append(items, it)
+			works[idx].credits = append(works[idx].credits, cr)
 		}
 	}
 	add(jarr(m, "cast"), false)
 	add(jarr(m, "crew"), true)
-	win, pg := localWindow(o, items, a.Page, "media")
+	win, pg := localWindow(o, works, a.Page, "media")
-	return o.ok(&MediaPage{Kind: "media_page", Items: win, Page: pg})
+	items := make([]Media, len(win))
 	projectTV := func(work creditWork) (Media, *ToolResult) {
 		id, _ := toInt(work.record["id"])
 		detailRaw, detailFail := o.call("GET",
 			"/api/v2/Search/tv/moviedb/"+segInt(id), nil, nil)
 		if detailFail != nil {
 			return Media{}, detailFail
 		}
 		detail, detailFail := o.decodeObject(detailRaw)
 		if detailFail != nil {
 			return Media{}, detailFail
 		}
 		it := projectSearchMedia(detail, "tv", "tmdb")
 		it.Identifiers = addID(it.Identifiers, "tmdb", work.record["id"])
 		it.Credits = work.credits
 		return it, nil
 	}
 	if media == "tv" {
 		jobs := make(chan int)
 		failures := make(chan *ToolResult, len(win))
 		workers := len(win)
 		if workers > 8 {
 			workers = 8
 		}
 		var wg sync.WaitGroup
 		for range workers {
 			wg.Add(1)
 			go func() {
 				defer wg.Done()
 				for i := range jobs {
 					it, detailFail := projectTV(win[i])
 					if detailFail != nil {
 						failures <- detailFail
 						continue
 					}
 					items[i] = it
 				}
 			}()
 		}
 		for i := range win {
 			jobs <- i
 		}
 		close(jobs)
 		wg.Wait()
 		if len(failures) > 0 {
 			return <-failures
 		}
 	} else {
 		for i, work := range win {
 			it := Media{Media: "movie", Identifiers: []Identifier{},
 				Title:    jstr(work.record, "title", "original_title"),
 				Overview: jstr(work.record, "overview")}
 			it.Identifiers = addID(it.Identifiers, "tmdb", work.record["id"])
 			if y := yearOf(jstr(work.record, "release_date")); y != nil {
 				it.Year = y
 			}
 			if u := jstr(work.record, "poster_path"); u != "" {
 				it.ArtworkURIs = []string{u}
 			}
 			it.Credits = work.credits
 			items[i] = it
 		}
 	}
 	return o.ok(&MediaPage{Kind: "media_page", Items: items, Page: pg})
 }
 func (o *op) discoverArtistAlbums(a *DiscoverArgs) *ToolResult {
@@ -234,19 +378,27 @@ func (o *op) discoverAdvanced(a *DiscoverArgs) *ToolResult {
 	if f == nil {
 		return o.invalid("filters", "filters object is required")
 	}
 	if f.ReleaseYear != nil && *f.ReleaseYear < 1901 {
 		return o.invalid("filters.release_year",
 			"release_year must be 1901 or later; use decade for earlier periods")
 	}
 	if f.ReleaseYear != nil && f.Decade != nil {
 		if *f.ReleaseYear < *f.Decade || *f.ReleaseYear > *f.Decade+9 {
 			return o.invalid("filters",
 				"release_year %d does not fall inside decade %d", *f.ReleaseYear, *f.Decade)
 		}
 	}
 	if len(f.CompanyIDs) > 0 {
 		return o.invalid("filters.company_ids",
 			"company_ids is unsupported because Ombi does not apply it")
 	}
 	body := ombi.DiscoverModel{
 		Type:           "movie",
 		ReleaseYear:    f.ReleaseYear,
 		Decade:         f.Decade,
 		GenreIDs:       f.GenreIDs,
 		KeywordIDs:     f.KeywordIDs,
 		WatchProviders: f.WatchProviderIDs,
 		Companies:      f.CompanyIDs,
 	}
 	pos, amt := bounds(a.Page)
 	raw, fail := o.call("POST",
@@ -125,37 +125,105 @@ func (o *op) integrationOptions(a *IntegrationArgs) *ToolResult {
 	return o.refsOrScalar(raw, cat)
 }
 type refKeySet struct {
 	id    []string
 	name  []string
 	value []string
 }
 var defaultOptionRefKeys = refKeySet{
 	id:    []string{"id", "value", "key"},
 	name:  []string{"name", "label", "value", "path"},
 	value: nil,
 }
 var optionRefKeys = map[string]refKeySet{
 	"root_folder": {
 		id:    []string{"id"},
 		name:  []string{"path", "name", "label", "value"},
 		value: nil,
 	},
 	"plex_library": {
 		id:    []string{"key", "id"},
 		name:  []string{"title", "name", "label"},
 		value: nil,
 	},
 	"plex_server": {
 		id:    []string{"machineId", "serverId", "id", "machineIdentifier", "key"},
 		name:  []string{"serverName", "name", "title"},
 		value: []string{"serverId", "machineId"},
 	},
 	"emby_info": {
 		id:    []string{"id"},
 		name:  []string{"serverName", "name"},
 		value: nil,
 	},
 	"jellyfin_info": {
 		id:    []string{"id"},
 		name:  []string{"serverName", "name"},
 		value: nil,
 	},
 	"emby_libraries": {
 		id:    []string{"id", "key"},
 		name:  []string{"name", "title"},
 		value: nil,
 	},
 	"jellyfin_libraries": {
 		id:    []string{"id", "key"},
 		name:  []string{"name", "title"},
 		value: nil,
 	},
 }
 func refKeysFor(cat string, defaults refKeySet) refKeySet {
 	if ks, ok := optionRefKeys[cat]; ok {
 		return ks
 	}
 	return defaults
 }
 func isRejectedObject(m map[string]any) (bool, string) {
 	for _, k := range []string{"success", "successful"} {
 		if v, ok := m[k]; ok {
 			if b, ok := v.(bool); ok && !b {
 				msg := jstr(m, "message", "Message", "errorMessage", "ErrorMessage")
 				if msg == "" {
 					msg = "upstream operation was unsuccessful"
 				}
 				return true, sanitizeText(msg, maxSanitizedMsg)
 			}
 		}
 	}
 	return false, ""
 }
 // refsOrScalar projects an option response: arrays become reference
-// items; scalars/objects become single records.
+// items; objects become nested arrays or single records; scalars become
 // single records.
 func (o *op) refsOrScalar(raw []byte, cat string) *ToolResult {
-	if items, fail := o.refArray(raw,
+	topKeys := refKeysFor(cat, defaultOptionRefKeys)
-		[]string{"id", "value", "key"}, []string{"name", "label", "value"}, cat); fail == nil {
+	if items, fail := o.refArray(raw, topKeys.id, topKeys.name, cat); fail == nil {
 		return o.ok(&ReferencePage{Kind: "reference_page",
 			Items: items, Page: singlePage(len(items), "references")})
 	}
-	// Non-array bodies: scalar or single object → one reference.
+	if m, fail := o.decodeObject(raw); fail == nil {
-	if v, fail := o.decodeScalar(raw); fail == nil && v != nil {
+		if rejected, msg := isRejectedObject(m); rejected {
-		r := Reference{Name: cat, Category: cat}
+			return o.fail("UPSTREAM_REJECTED", msg, false)
 		switch t := v.(type) {
 		case string, float64, bool:
 			r.Value = t
 		}
-		return o.ok(&ReferencePage{Kind: "reference_page",
+		// Nested containers (e.g. CouchPotatoProfiles.list, Plex Libraries data, Media Server items)
-			Items: []Reference{r}, Page: singlePage(1, "references")})
+		// project their first array member list.
 		nestedDefaults := refKeySet{
 			id:   []string{"_id", "id", "key", "value"},
 			name: []string{"label", "name", "title", "serverName", "path"},
 		}
-	m, fail := o.decodeObject(raw)
+		nestedKeys := refKeysFor(cat, nestedDefaults)
 	if fail != nil {
 		return fail
 	}
 	// Nested containers (e.g. CouchPotatoProfiles.list) project
 	// their first array member list.
 		for _, v := range m {
 			if arr, ok := v.([]any); ok {
 				items := []Reference{}
 				for _, e := range arr {
 					if em, ok := e.(map[string]any); ok {
-					items = append(items, refOf(em,
+						items = append(items, o.refOf(em,
-						[]string{"_id", "id", "value"}, []string{"label", "name"}, nil, cat))
+							nestedKeys.id, nestedKeys.name, nestedKeys.value, cat))
 					}
 				}
 				items = capItems(o, items)
@@ -163,10 +231,25 @@ func (o *op) refsOrScalar(raw []byte, cat string) *ToolResult {
 					Items: items, Page: singlePage(len(items), "references")})
 			}
 		}
-	r := refOf(m, []string{"id"}, []string{"name"}, nil, cat)
+		fallbackDefaults := refKeySet{
 			id:   []string{"id"},
 			name: []string{"name", "serverName", "title", "label", "path"},
 		}
 		fallbackKeys := refKeysFor(cat, fallbackDefaults)
 		r := o.refOf(m, fallbackKeys.id, fallbackKeys.name, fallbackKeys.value, cat)
 		return o.ok(&ReferencePage{Kind: "reference_page",
 			Items: []Reference{r}, Page: singlePage(1, "references")})
 	}
 	if v, fail := o.decodeScalar(raw); fail == nil && v != nil {
 		switch t := v.(type) {
 		case string, float64, bool:
 			r := Reference{Name: cat, Category: cat, Value: t}
 			return o.ok(&ReferencePage{Kind: "reference_page",
 				Items: []Reference{r}, Page: singlePage(1, "references")})
 		}
 	}
 	return o.fail("UPSTREAM_SCHEMA_MISMATCH", "upstream response was not a JSON array, object, or scalar", false)
 }
 func (o *op) integrationPlex(a *IntegrationArgs) *ToolResult {
 	var path, cat string
@@ -188,12 +271,39 @@ func (o *op) integrationPlex(a *IntegrationArgs) *ToolResult {
 }
 // refsOrUsers projects a response that may be an array of user-like
-// objects or reference-like objects.
+// objects or reference-like objects, or an object wrapper containing them.
 func (o *op) refsOrUsers(raw []byte, cat string) *ToolResult {
 	arr, fail := o.decodeArray(raw)
 	if fail != nil {
 		m, objFail := o.decodeObject(raw)
 		if objFail != nil {
 			return fail
 		}
 		if rejected, msg := isRejectedObject(m); rejected {
 			return o.fail("UPSTREAM_REJECTED", msg, false)
 		}
 		var innerArr []map[string]any
 		for _, v := range m {
 			if a, ok := v.([]any); ok {
 				innerArr = make([]map[string]any, 0, len(a))
 				for _, elem := range a {
 					if em, ok := elem.(map[string]any); ok {
 						innerArr = append(innerArr, em)
 					}
 				}
 				break
 			}
 		}
 		if innerArr == nil {
 			return fail
 		}
 		arr = innerArr
 	}
 	refKeys := refKeysFor(cat, refKeySet{
 		id:    []string{"id", "machineIdentifier", "key"},
 		name:  []string{"name", "title"},
 		value: nil,
 	})
 	// User-shaped records (id+userName/username/email) → user_page.
 	users := []User{}
 	refs := []Reference{}
@@ -201,8 +311,8 @@ func (o *op) refsOrUsers(raw []byte, cat string) *ToolResult {
 		if jstr(m, "userName", "username", "email") != "" {
 			users = append(users, projectUser(m))
 		} else {
-			refs = append(refs, refOf(m,
+			refs = append(refs, o.refOf(m,
-				[]string{"id", "machineIdentifier", "key"}, []string{"name", "title"}, nil, cat))
+				refKeys.id, refKeys.name, refKeys.value, cat))
 		}
 	}
 	if len(users) > 0 && len(refs) == 0 {
@@ -160,6 +160,10 @@ func (o *op) issuesProviderSummary(a *IssuesArgs) *ToolResult {
 	if fail != nil {
 		return fail
 	}
 	if emptyCollection(raw) {
 		return o.ok(&GroupPage{Kind: "group_page",
 			Items: []Group{}, Page: singlePage(0, "provider_groups")})
 	}
 	m, fail := o.decodeObject(raw)
 	if fail != nil {
 		return fail
@@ -27,6 +27,34 @@ func logFileName(m map[string]any) string {
 	return jstr(m, "fileName", "filename", "name")
 }
 // logFileNames decodes a listing whose elements are bare file names on Ombi
 // 4.53.x. Older deployments that return objects with a name field remain
 // supported. Entries with no usable name are ignored.
 func (o *op) logFileNames(raw []byte) ([]string, *ToolResult) {
 	var els []json.RawMessage
 	if err := json.Unmarshal(raw, &els); err != nil {
 		return nil, o.fail("UPSTREAM_SCHEMA_MISMATCH",
 			"upstream response was not a JSON array: "+sanitizeErr(err), false)
 	}
 	names := []string{}
 	for _, el := range els {
 		var name string
 		if err := json.Unmarshal(el, &name); err == nil {
 			if name != "" {
 				names = append(names, name)
 			}
 			continue
 		}
 		var record map[string]any
 		if err := json.Unmarshal(el, &record); err == nil {
 			if name := logFileName(record); name != "" {
 				names = append(names, name)
 			}
 		}
 	}
 	return names, nil
 }
 // read_logs — list sanitized log file IDs or read a bounded,
 // sanitized slice of a single log file.
 func handleLogs(ctx context.Context, env *Env, raw json.RawMessage) *ToolResult {
@@ -50,16 +78,10 @@ func (o *op) logsList() *ToolResult {
 	if fail != nil {
 		return fail
 	}
-	arr, fail := o.decodeArray(raw)
+	names, fail := o.logFileNames(raw)
 	if fail != nil {
 		return fail
 	}
 	names := []string{}
 	for _, m := range arr {
 		if s := logFileName(m); s != "" {
 			names = append(names, s)
 		}
 	}
 	sort.Strings(names)
 	out := &Logs{Kind: "logs", Files: []LogFile{}}
 	for _, n := range names {
@@ -97,13 +119,13 @@ func (o *op) logsRead(a *LogsArgs) *ToolResult {
 	if fail != nil {
 		return fail
 	}
-	arr, fail := o.decodeArray(raw)
+	names, fail := o.logFileNames(raw)
 	if fail != nil {
 		return fail
 	}
 	name := ""
-	for _, m := range arr {
+	for _, n := range names {
-		if n := logFileName(m); n != "" && logFileID(n) == a.FileID {
+		if logFileID(n) == a.FileID {
 			name = n
 			break
 		}
@@ -119,11 +141,15 @@ func (o *op) logsRead(a *LogsArgs) *ToolResult {
 		raw = raw[:maxLogBodyBytes]
 		o.truncated = true
 	}
-	text := sanitizeText(string(raw), maxLogBodyBytes)
+	// Sanitize individual lines so control characters and unbounded text do
-	lines := strings.Split(text, "\n")
+	// not leak while preserving the upstream line boundaries for pagination.
 	lines := strings.Split(string(raw), "\n")
 	if len(lines) > 0 && lines[len(lines)-1] == "" {
 		lines = lines[:len(lines)-1]
 	}
 	for i := range lines {
 		lines[i] = sanitizeText(lines[i], maxLogBodyBytes)
 	}
 	out := &Logs{Kind: "logs", Lines: []string{}, Offset: &offset}
 	if offset < len(lines) {
 		end := offset + limit
@@ -4,6 +4,8 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
 	"sort"
 	"strings"
 	"ombi-mcp/internal/ombi"
 )
@@ -128,8 +130,22 @@ func (o *op) mediaDetails(a *mediaCallArgs) *ToolResult {
 	if fail != nil {
 		return fail
 	}
 	it := project(m)
 	// #7 request state overlay for tvdb
 	if t.Media == "tv" && t.Provider == "tvdb" {
 		reqVal := jbool(m, "requested")
 		// Upstream sends requestId 0 (not absent) on unrequested shows —
 		// a nil-only check keeps the overlay from ever firing on live.
 		rid := jint(m, "requestId")
 		if (reqVal == nil || !*reqVal) && (rid == nil || *rid == 0) {
 			id, _ := t.idInt()
 			o.overlayTVRequestState(&it, id, jstr(m, "imdbId"))
 		}
 	}
 	return o.ok(&MediaPage{Kind: "media_page",
-		Items: []Media{project(m)}, Page: singlePage(1, "media")})
+		Items: []Media{it}, Page: singlePage(1, "media")})
 }
 func (o *op) mediaByRequest(a *mediaCallArgs) *ToolResult {
@@ -205,23 +221,116 @@ func (o *op) mediaRatings(a *mediaCallArgs) *ToolResult {
 	raw, fail := o.call("GET",
 		fmt.Sprintf("/api/v2/Search/ratings/%s/%s/%d", media, seg(a.Name), *a.Year),
 		nil, nil)
 	if fail != nil && !ratingsFallbackEligible(fail) {
 		return fail
 	}
 	if fail == nil {
 		var m map[string]any
 		if err := json.Unmarshal(raw, &m); err != nil {
 			return o.fail("UPSTREAM_SCHEMA_MISMATCH",
 				fmt.Sprintf("upstream response was not a JSON object: %s", sanitizeErr(err)), false)
 		}
 		if m != nil {
 			if ratings := ratingReferences(m); len(ratings) > 0 {
 				return o.ratingPage(media, a.Name, *a.Year, ratings)
 			}
 		}
 	}
 	// Ombi 4.53.x still exposes the Rotten Tomatoes routes above, but their
 	// private upstream endpoints have been removed. Fall back to rating
 	// metadata already returned by Ombi's normal search providers rather than
 	// turning that dependency failure into an unusable MCP action.
 	page, fallbackFail := o.mediaRatingsFromSearch(media, a.Name, *a.Year)
 	if fallbackFail != nil {
 		if fail != nil {
 			return fail
 		}
-	m, fail := o.decodeObject(raw)
+		return fallbackFail
 	if fail != nil {
 		return fail
 	}
-	it := Media{Media: media, Identifiers: []Identifier{}, Title: a.Name, Year: a.Year}
+	return o.ok(page)
-	for k, v := range m {
+}
 func ratingsFallbackEligible(fail *ToolResult) bool {
 	if fail == nil || fail.Error == nil || fail.Error.HTTPStatus == nil {
 		return false
 	}
 	status := *fail.Error.HTTPStatus
 	return status == 404 || status >= 500
 }
 func ratingReferences(m map[string]any) []Reference {
 	keys := make([]string, 0, len(m))
 	for k := range m {
 		keys = append(keys, k)
 	}
 	sort.Strings(keys)
 	refs := []Reference{}
 	for _, k := range keys {
 		v := m[k]
 		if i, ok := toInt(v); ok {
-			it.Ratings = append(it.Ratings, Reference{Name: k, Value: i})
+			refs = append(refs, Reference{Name: k, Value: i})
 		} else if s, ok := v.(string); ok && s != "" {
-			it.Ratings = append(it.Ratings, Reference{Name: k, Value: s})
+			refs = append(refs, Reference{Name: k, Value: s})
 		}
 	}
-	return o.ok(&MediaPage{Kind: "media_page",
+	return refs
-		Items: []Media{it}, Page: singlePage(1, "media")})
+}
 func (o *op) mediaRatingsFromSearch(media, name string, year int) (*MediaPage, *ToolResult) {
 	raw, fail := o.call("GET", "/api/v1/Search/"+media+"/"+seg(name), nil, nil)
 	if fail != nil {
 		return nil, fail
 	}
 	arr, fail := o.decodeArray(raw)
 	if fail != nil {
 		return nil, fail
 	}
 	for _, m := range arr {
 		title := jstr(m, "title", "name")
 		resultYear := yearOf(jstr(m, "releaseDate", "firstAired", "releaseYear"))
 		if !strings.EqualFold(strings.TrimSpace(title), strings.TrimSpace(name)) ||
 			resultYear == nil || *resultYear != year {
 			continue
 		}
 		refs := []Reference{}
 		source := ""
 		if media == "movie" {
 			source = "TMDB"
 			if v, ok := m["voteAverage"].(float64); ok {
 				refs = append(refs, Reference{Name: "tmdb_vote_average", Value: v})
 			}
 			if v, ok := toInt(m["voteCount"]); ok {
 				refs = append(refs, Reference{Name: "tmdb_vote_count", Value: v})
 			}
 		} else {
 			source = "TVMaze"
 			if v, ok := toInt(m["siteRating"]); ok {
 				refs = append(refs, Reference{Name: "tvmaze_site_rating", Value: v})
 			}
 		}
 		o.warnf("Ombi's Rotten Tomatoes ratings endpoint was unavailable; ratings were read from %s search metadata", source)
 		if len(refs) == 0 {
 			o.warnf("the matching %s search result did not include rating metadata", media)
 		}
 		return &MediaPage{Kind: "media_page", Items: []Media{{
 			Media: media, Identifiers: []Identifier{}, Title: title, Year: resultYear, Ratings: refs,
 		}}, Page: singlePage(1, "media")}, nil
 	}
 	o.warnf("Ombi's Rotten Tomatoes ratings endpoint was unavailable and search returned no exact title/year match")
 	return &MediaPage{Kind: "media_page", Items: []Media{{
 		Media: media, Identifiers: []Identifier{}, Title: name, Year: &year, Ratings: []Reference{},
 	}}, Page: singlePage(1, "media")}, nil
 }
 func (o *op) ratingPage(media, title string, year int, ratings []Reference) *ToolResult {
 	return o.ok(&MediaPage{Kind: "media_page", Items: []Media{{
 		Media: media, Identifiers: []Identifier{}, Title: title, Year: &year, Ratings: ratings,
 	}}, Page: singlePage(1, "media")})
 }
 func (o *op) mediaStreaming(a *mediaCallArgs) *ToolResult {
@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"encoding/json"
 	"strconv"
 	"strings"
 	"ombi-mcp/internal/ombi"
 	"ombi-mcp/internal/translate"
@@ -447,6 +448,13 @@ func (o *op) projectRequest(m map[string]any, kind string) Request {
 		r.Identifiers = addID(r.Identifiers, "tmdb", m["externalProviderId"])
 		r.Identifiers = addID(r.Identifiers, "tmdb", m["mediaId"])
 		r.Identifiers = addID(r.Identifiers, "imdb", m["imdbId"])
 		// ChildRequests carries no top-level provider ids — they live
 		// on the embedded parent record.
 		if pr := jobj(m, "parentRequest"); pr != nil {
 			r.Identifiers = addID(r.Identifiers, "tvdb", pr["tvDbId"])
 			r.Identifiers = addID(r.Identifiers, "tmdb", pr["externalProviderId"])
 			r.Identifiers = addID(r.Identifiers, "imdb", pr["imdbId"])
 		}
 	case "album":
 		r.Identifiers = addID(r.Identifiers, "musicbrainz", m["foreignAlbumId"])
 		r.Identifiers = addID(r.Identifiers, "musicbrainz", m["mediaId"])
@@ -604,38 +612,72 @@ func (o *op) projectCalendarEntry(m map[string]any) CalendarEntry {
 // refOf projects one upstream object into a reference record using
 // the first present key from each candidate list.
-func refOf(m map[string]any, idKeys, nameKeys []string, val any, category string) Reference {
+func (o *op) refOf(m map[string]any, idKeys, nameKeys, valueKeys []string, category string) Reference {
 	r := Reference{Category: category}
 	var idRaw any
 	for _, k := range idKeys {
 		if s, ok := toStr(m[k]); ok && s != "" {
 			r.ID = s
 			idRaw = m[k]
 			break
 		}
 	}
 	var firstCorrupted string
 	for _, k := range nameKeys {
 		if s, ok := m[k].(string); ok && s != "" {
 			if !corrupted(s) {
 				r.Name = s
 				firstCorrupted = ""
 				break
 			}
 			if firstCorrupted == "" {
 				firstCorrupted = s
 			}
-	if val == nil {
+		}
-		r.Value = firstScalar(m)
+	}
-	} else {
+	if r.Name == "" && firstCorrupted != "" {
-		r.Value = val
+		r.Name = firstCorrupted
 		if o != nil {
 			o.warnf("upstream %s label appears corrupted (id %q)", category, r.ID)
 		}
 	}
 	if len(valueKeys) > 0 {
 		r.Value = scalarAt(m, valueKeys)
 	} else if idRaw != nil {
 		r.Value = idRaw
 	} else if r.Name != "" {
 		r.Value = r.Name
 	}
 	return r
 }
-// firstScalar returns the first scalar property value in a map for
+func corrupted(s string) bool {
-// fallback reference values; iteration order makes this best-effort,
+	t := strings.TrimSpace(s)
-// so callers should prefer explicit keys where known.
+	if t == "" {
-func firstScalar(m map[string]any) any {
+		return false
-	for _, v := range m {
+	}
 	if strings.ContainsRune(s, '\uFFFD') {
 		return true
 	}
 	for _, r := range t {
 		if r != '?' {
 			return false
 		}
 	}
 	return true
 }
 func scalarAt(m map[string]any, keys []string) any {
 	for _, k := range keys {
 		if v, ok := m[k]; ok {
 			switch v.(type) {
-		case string, float64, bool:
+			case string, float64, bool, int, int64:
 				return v
 			}
 		}
 	}
 	return nil
 }
@@ -145,3 +145,190 @@ func TestProjectRequestListStillUsesEntityID(t *testing.T) {
 		t.Errorf("target.id = %d, want 10", r.Target.ID)
 	}
 }
 func TestMergeTVRequestState(t *testing.T) {
 	it := &Media{
 		Seasons: []SeasonOut{
 			{
 				SeasonNumber: 1,
 				Episodes: []EpisodeOut{
 					{EpisodeNumber: 1},
 					{EpisodeNumber: 2},
 				},
 			},
 		},
 	}
 	parent := map[string]any{
 		"id":     909,
 		"tvDbId": 81189,
 		"childRequests": []any{
 			map[string]any{
 				"seasonRequests": []any{
 					map[string]any{
 						"seasonNumber": 1,
 						"episodes": []any{
 							map[string]any{"episodeNumber": 1, "requested": true, "available": true},
 						},
 					},
 				},
 			},
 		},
 	}
 	matched := mergeTVRequestState(it, parent, 81189, "")
 	if !matched {
 		t.Fatalf("expected match")
 	}
 	if it.Requested == nil || !*it.Requested {
 		t.Errorf("expected media Requested=true")
 	}
 	if len(it.RequestTargets) != 1 || it.RequestTargets[0].ID != 909 {
 		t.Errorf("expected target ID 909")
 	}
 	if it.Seasons[0].Episodes[0].Requested == nil || !*it.Seasons[0].Episodes[0].Requested {
 		t.Errorf("expected ep1 Requested=true")
 	}
 	if it.Seasons[0].Episodes[0].Available == nil || !*it.Seasons[0].Episodes[0].Available {
 		t.Errorf("expected ep1 Available=true")
 	}
 	if it.Seasons[0].Episodes[1].Requested != nil {
 		t.Errorf("expected ep2 Requested=nil")
 	}
 }
 func TestMergeTVRequestStateNoMatch(t *testing.T) {
 	it := &Media{}
 	parent := map[string]any{"tvDbId": 99999}
 	matched := mergeTVRequestState(it, parent, 81189, "")
 	if matched {
 		t.Fatalf("expected no match")
 	}
 	if it.Requested != nil {
 		t.Errorf("expected Requested=nil on no match")
 	}
 }
 func TestTVParentMatchChildIDBeatsProviderID(t *testing.T) {
 	parent := map[string]any{
 		"id": 909, "tvDbId": 259032, "externalProviderId": 118680,
 		"childRequests": []any{
 			map[string]any{
 				"id": 88,
 				"seasonRequests": []any{
 					map[string]any{"childRequestId": 88, "seasonNumber": 1},
 				},
 			},
 		},
 	}
 	if got := tvParentMatch(parent, tvRecentKey{requestID: 88, mediaID: "1396"}); got != tvMatchChild {
 		t.Errorf("real child id must match tier 1, got %d", got)
 	}
 	if got := tvParentMatch(parent, tvRecentKey{requestID: 259032}); got != tvMatchProvider {
 		t.Errorf("provider-shaped child pk falls back to tier 2 without embedded child, got %d", got)
 	}
 	if got := tvParentMatch(parent, tvRecentKey{requestID: 0, mediaID: "118680"}); got != tvMatchProvider {
 		t.Errorf("mediaId provider match = %d, want %d", got, tvMatchProvider)
 	}
 	if got := tvParentMatch(parent, tvRecentKey{requestID: 777, mediaID: "999"}); got != tvMatchNone {
 		t.Errorf("unrelated key matched: %d", got)
 	}
 }
 func TestTVParentMatchProviderShapedChildPK(t *testing.T) {
 	// Live rows: upstream persists the provider id as the child PK, so
 	// childRequests[].id equals tvDbId/externalProviderId.
 	parent := map[string]any{
 		"id": 909, "tvDbId": 259032,
 		"childRequests": []any{
 			map[string]any{"id": 259032},
 		},
 	}
 	if got := tvParentMatch(parent, tvRecentKey{requestID: 259032}); got != tvMatchChild {
 		t.Errorf("provider-shaped child id is still an exact tier-1 match, got %d", got)
 	}
 }
 func TestRefOfDeterministicValue(t *testing.T) {
 	o := &op{}
 	m := map[string]any{
 		"id":       53,
 		"name":     "Thriller",
 		"logoPath": "/x",
 		"enabled":  false,
 	}
 	for i := 0; i < 50; i++ {
 		r := o.refOf(m, []string{"id"}, []string{"name"}, nil, "genre")
 		if r.ID != "53" {
 			t.Fatalf("iteration %d: id = %q, want \"53\"", i, r.ID)
 		}
 		if r.Name != "Thriller" {
 			t.Fatalf("iteration %d: name = %q, want \"Thriller\"", i, r.Name)
 		}
 		if r.Value != 53 {
 			t.Fatalf("iteration %d: value = %v (%T), want 53", i, r.Value, r.Value)
 		}
 	}
 }
 func TestRefOfValueKeysOverride(t *testing.T) {
 	o := &op{}
 	m := map[string]any{
 		"id":        53,
 		"name":      "Thriller",
 		"customVal": "override",
 	}
 	r := o.refOf(m, []string{"id"}, []string{"name"}, []string{"customVal"}, "genre")
 	if r.Value != "override" {
 		t.Fatalf("value = %v, want \"override\"", r.Value)
 	}
 }
 func TestRefOfCorruptedNameSkip(t *testing.T) {
 	o := &op{}
 	m := map[string]any{
 		"id":           1,
 		"english_name": "?????",
 		"name":         "Clean",
 	}
 	r := o.refOf(m, []string{"id"}, []string{"english_name", "name"}, nil, "language")
 	if r.Name != "Clean" {
 		t.Fatalf("name = %q, want \"Clean\"", r.Name)
 	}
 	if len(o.warn) != 0 {
 		t.Fatalf("unexpected warnings: %v", o.warn)
 	}
 	o = &op{}
 	m2 := map[string]any{
 		"id":           2,
 		"english_name": "Bad\uFFFDName",
 		"name":         "CleanAlternate",
 	}
 	r2 := o.refOf(m2, []string{"id"}, []string{"english_name", "name"}, nil, "language")
 	if r2.Name != "CleanAlternate" {
 		t.Fatalf("name = %q, want \"CleanAlternate\"", r2.Name)
 	}
 	if len(o.warn) != 0 {
 		t.Fatalf("unexpected warnings: %v", o.warn)
 	}
 }
 func TestRefOfAllCorruptedEmitsAndWarns(t *testing.T) {
 	o := &op{}
 	m := map[string]any{
 		"id":           "ky",
 		"english_name": "?????",
 		"name":         "?????",
 	}
 	r := o.refOf(m, []string{"id"}, []string{"english_name", "name"}, nil, "language")
 	if r.Name != "?????" {
 		t.Fatalf("name = %q, want \"?????\"", r.Name)
 	}
 	if len(o.warn) == 0 {
 		t.Fatalf("expected warning for corrupted name, got none")
 	}
 	expectedWarn := "upstream language label appears corrupted (id \"ky\")"
 	if o.warn[0] != expectedWarn {
 		t.Fatalf("warn = %q, want %q", o.warn[0], expectedWarn)
 	}
 }
@@ -67,7 +67,7 @@ func (o *op) refArray(raw []byte, idKeys, nameKeys []string, cat string) ([]Refe
 	}
 	items := make([]Reference, 0, len(arr))
 	for _, m := range arr {
-		items = append(items, refOf(m, idKeys, nameKeys, nil, cat))
+		items = append(items, o.refOf(m, idKeys, nameKeys, nil, cat))
 	}
 	return capItems(o, items), nil
 }
@@ -114,7 +114,7 @@ func (o *op) refKeyword(a *ReferenceArgs) *ToolResult {
 	if fail != nil {
 		return fail
 	}
-	r := refOf(m, []string{"id"}, []string{"name"}, nil, "keyword")
+	r := o.refOf(m, []string{"id"}, []string{"name"}, nil, "keyword")
 	return o.ok(&ReferencePage{Kind: "reference_page",
 		Items: []Reference{r}, Page: singlePage(1, "references")})
 }
@@ -7,7 +7,7 @@ import (
 	"strings"
 )
-//go:generate go run ../../tools/schemagen
+//go:generate sh -c "cd ../.. && go run ./tools/schemagen"
 //go:embed schemas.json
 var schemasJSON []byte
@@ -51,7 +51,7 @@ var registry = []ToolDef{
 	{"read_votes", "core", "Global vote list or votes on a request.", true, false, true, true, []string{"vote_page"}, handleVotes},
 	{"read_users", "core", "Self, authorized user lookup, claims, online users, preference read.", true, false, true, true, []string{"user_page", "reference_page"}, handleUsers},
 	{"read_library", "core", "Recent additions, calendar, artwork.", true, false, true, true, []string{"media_page", "calendar_page", "artwork_page"}, handleLibrary},
-	{"read_server", "core", "Status, version, features, news, stats, cron validation.", true, false, true, true, []string{"metrics", "reference_page"}, handleServer},
+	{"read_server", "core", "Status, version, features, stats, cron validation.", true, false, true, true, []string{"metrics", "reference_page"}, handleServer},
 	{"read_integration", "core", "Saved ARR options and authorized media-server metadata.", true, false, true, true, []string{"reference_page", "user_page"}, handleIntegration},
 	{"write_request_create", "core", "One media request or explicit collection request.", false, false, false, true, []string{"mutation"}, handleRequestCreate},
 	{"write_request_subscribe", "core", "Subscribe/unsubscribe.", false, false, false, true, []string{"mutation"}, handleRequestSubscribe},
@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
 	"strings"
 )
 // read_requests — v2 list/status routes, single gets, TV children,
@@ -34,7 +35,10 @@ func handleRequests(ctx context.Context, env *Env, raw json.RawMessage) *ToolRes
 }
 // list maps media+status onto the v2 paged routes. `all` uses the
-// base route, never an /all/ segment. Sort is always requestDate.
+// base route, never an /all/ segment. Sort is always RequestedDate
 // — Ombi's TypeDescriptor lookup is the C# property name, and the
 // RAML example `requestDate` does not match (NullReferenceException
 // on every non-empty page; #10).
 func (o *op) requestsList(a *RequestsListArgs) *ToolResult {
 	var mediaSeg, kind string
 	switch a.Media {
@@ -72,7 +76,7 @@ func (o *op) requestsList(a *RequestsListArgs) *ToolResult {
 	if status != "all" {
 		path += "/" + status
 	}
-	path += fmt.Sprintf("/%d/%d/requestDate/%s", amt, pos, order)
+	path += fmt.Sprintf("/%d/%d/RequestedDate/%s", amt, pos, order)
 	raw, fail := o.call("GET", path, nil, nil)
 	if fail != nil {
 		return fail
@@ -163,6 +167,25 @@ func (o *op) requestsSearch(a *RequestsListArgs) *ToolResult {
 		return o.invalid("media", "media must be movie|tv|album")
 	}
 	raw, fail := o.call("GET", path+seg(a.Query), nil, nil)
 	// #10 tv search fallback
 	if fail != nil && a.Media == "tv" {
 		items := []Request{}
 		q := strings.ToLower(a.Query)
 		_, failScan := o.eachTVRequestParent(func(p map[string]any) bool {
 			if strings.Contains(strings.ToLower(jstr(p, "title")), q) {
 				items = append(items, o.projectRequest(p, kind))
 			}
 			return false
 		})
 		if failScan != nil {
 			return fail // surface the original error
 		}
 		o.warnf("primary tv search route failed; fell back to parent scan")
 		win, pg := localWindow(o, items, a.Page, "requests")
 		return o.ok(&RequestPage{Kind: "request_page", Items: win, Page: pg})
 	}
 	if fail != nil {
 		return fail
 	}
@@ -188,6 +211,11 @@ func (o *op) requestsRecent(a *RequestsListArgs) *ToolResult {
 		return fail
 	}
 	items := []Request{}
 	type pendingTV struct {
 		idx int
 		key tvRecentKey
 	}
 	pending := []pendingTV{}
 	for _, m := range arr {
 		code, label := o.requestTypeTwin(m["type"])
 		kind := "movie"
@@ -203,17 +231,54 @@ func (o *op) requestsRecent(a *RequestsListArgs) *ToolResult {
 			kind = "movie"
 		}
 		r := o.projectRequest(m, kind)
-		// RecentlyRequestedModel.RequestId is the Ombi request id.
+		if kind == "tv_parent" {
-		// Extra `id` on a TV payload is a provider id and must not
+			// On TV rows RecentlyRequestedModel.requestId is the CHILD
-		// occupy target.id even when requestId is absent.
+			// request id (upstream persists the provider id as the
 			// child PK for new-request children), never the parent id
 			// `get` needs. Zero whatever requestId/`id` projected and
 			// resolve the parent through the v1 parent list; the child
 			// id stays available as an ombi_tv_child identifier.
 			r.Target.ID = 0
 			key := tvRecentKey{mediaID: jstr(m, "mediaId")}
 			if id, ok := toInt(m["requestId"]); ok && id > 0 {
 				key.requestID = id
 				r.Identifiers = addID(r.Identifiers, "ombi_tv_child", id)
 			}
 			pending = append(pending, pendingTV{len(items), key})
 		} else {
 			// RecentlyRequestedModel.requestId is the request id for
 			// movie/album rows; a stray provider `id` must not occupy
 			// the target even when requestId is absent.
 			if id, ok := toInt(m["requestId"]); ok && id > 0 {
 				r.Target.ID = id
 			} else {
 				r.Target.ID = 0
 			}
 		}
 		r.RequestedUserID = jstr(m, "userId")
 		items = append(items, r)
 	}
 	if len(pending) > 0 {
 		keys := make([]tvRecentKey, len(pending))
 		for i, p := range pending {
 			keys[i] = p.key
 		}
 		parents := o.resolveRecentTVParents(keys)
 		for i, p := range pending {
 			r := &items[p.idx]
 			parent, ok := parents[i]
 			pid := jint(parent, "id")
 			if !ok || pid == nil || *pid < 1 {
 				o.warnf("recent tv item %q has no resolvable parent request; target.id left unknown",
 					r.Title)
 				continue
 			}
 			r.Target.ID = *pid
 			r.Identifiers = addID(r.Identifiers, "tvdb", parent["tvDbId"])
 			r.Identifiers = addID(r.Identifiers, "tmdb", parent["externalProviderId"])
 			r.Identifiers = addID(r.Identifiers, "imdb", parent["imdbId"])
 		}
 	}
 	win, pg := localWindow(o, items, a.Page, "requests")
 	return o.ok(&RequestPage{Kind: "request_page", Items: win, Page: pg})
 }
@@ -0,0 +1,266 @@
 package tools
 import (
 	"bytes"
 	"fmt"
 	"strconv"
 )
 // eachTVRequestParent iterates GET /api/v1/Request/tv/{count}/{pos}/1/0/0
 // pages (filters ignored upstream; orderType 1 keeps the path valid).
 // fn(parent) returning true stops the scan. Returns truncated=true when
 // the 10-page cap is hit without exhausting the list.
 func (o *op) eachTVRequestParent(fn func(map[string]any) bool) (truncated bool, err *ToolResult) {
 	count := 100
 	pos := 0
 	pages := 0
 	for pages < 10 {
 		path := fmt.Sprintf("/api/v1/Request/tv/%d/%d/1/0/0", count, pos)
 		raw, fail := o.call("GET", path, nil, nil)
 		if fail != nil {
 			return false, fail
 		}
 		arr, fail := o.decodeTVParentPage(raw)
 		if fail != nil {
 			return false, fail
 		}
 		for _, m := range arr {
 			if fn(m) {
 				return false, nil
 			}
 		}
 		if len(arr) < count {
 			return false, nil // exhausted
 		}
 		pos += count
 		pages++
 	}
 	return true, nil // hit cap
 }
 // decodeTVParentPage decodes one page of the v1 TV parent list. The
 // documented shape is RequestsViewModel<TvRequests> — a
 // {"collection":[...],"total":N} object — but a bare array is tolerated
 // for versions or proxies that unwrap it.
 func (o *op) decodeTVParentPage(raw []byte) ([]map[string]any, *ToolResult) {
 	trim := bytes.TrimSpace(raw)
 	if len(trim) > 0 && trim[0] == '[' {
 		return o.decodeArray(raw)
 	}
 	vm, fail := o.decodeObject(raw)
 	if fail != nil {
 		return nil, fail
 	}
 	if _, present := vm["collection"]; !present {
 		return nil, o.fail("UPSTREAM_SCHEMA_MISMATCH",
 			"tv parent page object lacked a collection", false)
 	}
 	arr := jarr(vm, "collection")
 	out := make([]map[string]any, 0, len(arr))
 	for _, v := range arr {
 		if m, ok := v.(map[string]any); ok {
 			out = append(out, m)
 		}
 	}
 	return out, nil
 }
 // tvRecentKey carries the identity hints one recentlyRequested TV row
 // provides: requestId is the CHILD request id (Ombi builds recent TV
 // rows from child requests and persists the provider id as the child
 // PK for new-request children), mediaId the parent's
 // externalProviderId. The parent request id itself is never sent.
 type tvRecentKey struct {
 	requestID int
 	mediaID   string
 }
 const (
 	tvMatchNone = iota
 	tvMatchChild
 	tvMatchProvider
 )
 // tvParentChildIDs collects the real child request ids a TvRequests
 // parent record embeds: childRequests[].id plus
 // seasonRequests[].childRequestId.
 func tvParentChildIDs(p map[string]any) map[int]bool {
 	ids := map[int]bool{}
 	for _, cr := range jarr(p, "childRequests") {
 		crm, ok := cr.(map[string]any)
 		if !ok {
 			continue
 		}
 		if id := jint(crm, "id"); id != nil && *id > 0 {
 			ids[*id] = true
 		}
 		for _, sr := range jarr(crm, "seasonRequests") {
 			srm, ok := sr.(map[string]any)
 			if !ok {
 				continue
 			}
 			if id := jint(srm, "childRequestId"); id != nil && *id > 0 {
 				ids[*id] = true
 			}
 		}
 	}
 	return ids
 }
 // tvParentProviderIDs collects a parent record's provider ids as a
 // string set so both int requestId and string mediaId keys compare.
 func tvParentProviderIDs(p map[string]any) map[string]bool {
 	ids := map[string]bool{}
 	for _, k := range []string{"tvDbId", "externalProviderId"} {
 		if s, ok := toStr(p[k]); ok && s != "" && s != "0" {
 			ids[s] = true
 		}
 	}
 	return ids
 }
 // tvParentMatch reports how parent record p matches key: tvMatchChild
 // when key.requestID is one of the parent's embedded child request ids
 // (authoritative), tvMatchProvider when requestID/mediaID equals a
 // parent provider id (fallback — covers versions that put the provider
 // id in requestId directly or omit embedded children).
 func tvParentMatch(p map[string]any, k tvRecentKey) int {
 	if k.requestID > 0 && tvParentChildIDs(p)[k.requestID] {
 		return tvMatchChild
 	}
 	provs := tvParentProviderIDs(p)
 	if k.requestID > 0 && provs[strconv.Itoa(k.requestID)] {
 		return tvMatchProvider
 	}
 	if k.mediaID != "" && provs[k.mediaID] {
 		return tvMatchProvider
 	}
 	return tvMatchNone
 }
 // resolveRecentTVParents maps recentlyRequested TV rows onto their
 // parent request records via one bounded parent scan. Child-id matches
 // win over provider-id candidates so an unrelated parent's provider id
 // can never shadow a real child id found later in the scan. Returns
 // row-index → parent record; scan failures degrade to a warning, never
 // an error, since the recent payload itself succeeded.
 func (o *op) resolveRecentTVParents(keys []tvRecentKey) map[int]map[string]any {
 	resolved := map[int]map[string]any{}
 	candidate := map[int]map[string]any{}
 	truncated, fail := o.eachTVRequestParent(func(p map[string]any) bool {
 		for i, k := range keys {
 			if _, done := resolved[i]; done {
 				continue
 			}
 			switch tvParentMatch(p, k) {
 			case tvMatchChild:
 				resolved[i] = p
 				delete(candidate, i)
 			case tvMatchProvider:
 				if _, ok := candidate[i]; !ok {
 					candidate[i] = p
 				}
 			}
 		}
 		return len(resolved) == len(keys)
 	})
 	for i, p := range candidate {
 		if _, ok := resolved[i]; !ok {
 			resolved[i] = p
 		}
 	}
 	switch {
 	case fail != nil:
 		o.warnf("tv parent lookup failed; recent tv targets left unresolved")
 	case truncated:
 		o.warnf("tv parent lookup truncated; some recent tv targets may be unresolved")
 	}
 	return resolved
 }
 // mergeTVRequestState attempts to match and apply request state from a parent record p.
 // Returns true if the parent matched (stopping the scan).
 func mergeTVRequestState(it *Media, p map[string]any, tvdbID int, imdbID string) bool {
 	match := false
 	if jint(p, "tvDbId") != nil && *jint(p, "tvDbId") == tvdbID {
 		match = true
 	} else if imdbID != "" && jstr(p, "imdbId") == imdbID {
 		match = true
 	}
 	if !match {
 		return false
 	}
 	bTrue := true
 	it.Requested = &bTrue
 	it.RequestTargets = []OutTarget{{Kind: "tv_parent", ID: *jint(p, "id")}}
 	// Overlay season/episode states
 	childRequests := jarr(p, "childRequests")
 	for _, cr := range childRequests {
 		crm, ok := cr.(map[string]any)
 		if !ok {
 			continue
 		}
 		seasonRequests := jarr(crm, "seasonRequests")
 		for _, sr := range seasonRequests {
 			srm, ok := sr.(map[string]any)
 			if !ok {
 				continue
 			}
 			sNum := jint(srm, "seasonNumber")
 			if sNum == nil {
 				continue
 			}
 			// Find matching season in 'it'
 			var season *SeasonOut
 			for i := range it.Seasons {
 				if it.Seasons[i].SeasonNumber == *sNum {
 					season = &it.Seasons[i]
 					break
 				}
 			}
 			if season == nil {
 				continue
 			}
 			episodes := jarr(srm, "episodes")
 			for _, ep := range episodes {
 				epm, ok := ep.(map[string]any)
 				if !ok {
 					continue
 				}
 				epNum := jint(epm, "episodeNumber")
 				if epNum == nil {
 					continue
 				}
 				// Find matching episode
 				for i := range season.Episodes {
 					if season.Episodes[i].EpisodeNumber == *epNum {
 						season.Episodes[i].Requested = &bTrue
 						if avail := jbool(epm, "available"); avail != nil && *avail {
 							season.Episodes[i].Available = &bTrue
 						}
 						break
 					}
 				}
 			}
 		}
 	}
 	return true
 }
 func (o *op) overlayTVRequestState(it *Media, tvdbID int, imdbID string) {
 	truncated, fail := o.eachTVRequestParent(func(p map[string]any) bool {
 		return mergeTVRequestState(it, p, tvdbID, imdbID)
 	})
 	if fail != nil || truncated {
 		o.warnf("request state scan incomplete: degraded upstream flags kept")
 	}
 }
@@ -117,6 +117,11 @@
              "type": "integer",
              "minimum": 1
            },
            "person_name": {
              "type": "string",
              "minLength": 1,
              "maxLength": 200
            },
            "media": {
              "type": "string",
              "enum": [
@@ -131,6 +136,7 @@
          "required": [
            "action",
            "person_id",
            "person_name",
            "media"
          ],
          "additionalProperties": false
@@ -167,7 +173,7 @@
              "properties": {
                "release_year": {
                  "type": "integer",
-                  "minimum": 1870,
+                  "minimum": 1901,
                  "maximum": 9999
                },
                "decade": {
@@ -205,16 +211,6 @@
                  "minItems": 1,
                  "maxItems": 100,
                  "uniqueItems": true
                },
                "company_ids": {
                  "type": "array",
                  "items": {
                    "type": "integer",
                    "minimum": 1
                  },
                  "minItems": 1,
                  "maxItems": 100,
                  "uniqueItems": true
                }
              },
              "required": [],
@@ -1800,18 +1796,6 @@
          ],
          "additionalProperties": false
        },
        {
          "type": "object",
          "properties": {
            "action": {
              "const": "news"
            }
          },
          "required": [
            "action"
          ],
          "additionalProperties": false
        },
        {
          "type": "object",
          "properties": {
@@ -1852,7 +1836,9 @@
            }
          },
          "required": [
-            "action"
+            "action",
            "from",
            "to"
          ],
          "additionalProperties": false
        },
@@ -1864,6 +1850,7 @@
            },
            "expression": {
              "type": "string",
              "description": "Quartz cron expression — 6 or 7 fields (seconds minutes hours day-of-month month day-of-week [year]); one of the two day fields must be ?",
              "minLength": 1,
              "maxLength": 200
            }
@@ -8,7 +8,7 @@ import (
 	"ombi-mcp/internal/ombi"
 )
-// read_server — status, version, features, news, stats and the
+// read_server — status, version, features, stats and the
 // administrator-gated cron validation. Families: metrics,
 // reference_page.
 func handleServer(ctx context.Context, env *Env, raw json.RawMessage) *ToolResult {
@@ -28,8 +28,6 @@ func handleServer(ctx context.Context, env *Env, raw json.RawMessage) *ToolResul
 		return o.serverUpdateInfo()
 	case "update_check":
 		return o.serverUpdateCheck()
 	case "news":
 		return o.serverNews()
 	case "landing":
 		return o.serverLanding()
 	case "features":
@@ -137,20 +135,6 @@ func (o *op) serverUpdateCheck() *ToolResult {
 		Values: []Metric{metric("update_available", v, "instance", "")}})
 }
 func (o *op) serverNews() *ToolResult {
 	raw, fail := o.call("GET", "/api/v2/System/news", nil, nil)
 	if fail != nil {
 		return fail
 	}
 	items, fail := o.refArray(raw,
 		[]string{"id"}, []string{"title", "name", "headline"}, "news")
 	if fail != nil {
 		return fail
 	}
 	return o.ok(&ReferencePage{Kind: "reference_page",
 		Items: items, Page: singlePage(len(items), "references")})
 }
 func (o *op) serverLanding() *ToolResult {
 	raw, fail := o.call("GET", "/api/v1/LandingPage", nil, nil)
 	if fail != nil {
@@ -196,8 +180,14 @@ func (o *op) serverFeatures() *ToolResult {
 }
 func (o *op) serverStats(a *ServerArgs) *ToolResult {
-	// from <= to must be enforced by the server per the contract.
+	if !nonempty(a.From) || !nonempty(a.To) {
-	if a.From != "" && a.To != "" {
+		field := "from"
 		if nonempty(a.From) {
 			field = "to"
 		}
 		return o.invalid(field, "stats requires both from and to as RFC3339 date-time values")
 	}
 	// from <= to is enforced before the upstream call.
 	f, ferr := time.Parse(time.RFC3339, a.From)
 	t, terr := time.Parse(time.RFC3339, a.To)
 	if ferr != nil || terr != nil {
@@ -206,14 +196,7 @@ func (o *op) serverStats(a *ServerArgs) *ToolResult {
 	if f.After(t) {
 		return o.invalid("from", "from must be on or before to")
 	}
-	}
+	q := map[string]string{"from": a.From, "to": a.To}
 	q := map[string]string{}
 	if a.From != "" {
 		q["from"] = a.From
 	}
 	if a.To != "" {
 		q["to"] = a.To
 	}
 	raw, fail := o.call("GET", "/api/v1/Stats", q, nil)
 	if fail != nil {
 		return fail
@@ -256,5 +239,8 @@ func (o *op) serverCronValidate(a *ServerArgs) *ToolResult {
 	if s := jstr(m, "message"); s != "" {
 		vals = append(vals, metric("message", s, "instance", ""))
 	}
 	if valid, ok := m["success"].(bool); ok && !valid {
 		o.warnf("Ombi validates Quartz cron syntax (6-7 fields: seconds minutes hours day-of-month month day-of-week [year]); use ? for the unused day-of-month/day-of-week field")
 	}
 	return o.ok(&Metrics{Kind: "metrics", Values: vals})
 }
@@ -142,9 +142,37 @@ func revisionOf(raw []byte) string {
 	return hex.EncodeToString(sum[:16])
 }
 func isDigits(s string) bool {
 	if s == "" {
 		return false
 	}
 	for i := 0; i < len(s); i++ {
 		if s[i] < '0' || s[i] > '9' {
 			return false
 		}
 	}
 	return true
 }
 // serverIdentityLeaf reports whether key is a server record identity
 // field directly under /servers/<digits>.
 func serverIdentityLeaf(parentPath, key string) bool {
 	switch key {
 	case "id", "serverId", "machineIdentifier":
 	default:
 		return false
 	}
 	rest, ok := strings.CutPrefix(parentPath, "/servers/")
 	if !ok {
 		return false
 	}
 	return isDigits(rest)
 }
 // flattenSettings walks a decoded settings document emitting one
 // scalar leaf per Change with escaped-JSON-Pointer-style names.
-// Excluded and secret-looking fields land in omitted, never values.
+// Excluded and secret-looking fields land in omitted, never values,
 // with a scoped exemption for server identity fields.
 func flattenSettings(v any, path string, out *[]Change, omitted *[]string) {
 	switch t := v.(type) {
 	case map[string]any:
@@ -155,7 +183,7 @@ func flattenSettings(v any, path string, out *[]Change, omitted *[]string) {
 		sort.Strings(keys)
 		for _, k := range keys {
 			child := path + "/" + escapePointer(k)
-			if excludedSettingsFields[k] || secretish(k) {
+			if (excludedSettingsFields[k] || secretish(k)) && !serverIdentityLeaf(path, k) {
 				*omitted = append(*omitted, child)
 				continue
 			}
@@ -165,7 +193,7 @@ func flattenSettings(v any, path string, out *[]Change, omitted *[]string) {
 		for i, e := range t {
 			flattenSettings(e, fmt.Sprintf("%s/%d", path, i), out, omitted)
 		}
-	case string, float64, bool:
+	case string, float64, bool, int, int64:
 		name := path
 		if name == "" {
 			name = "/"
Author	SHA1	Message	Date
gronod	80e01253a2	Fix #10 , #27 and #28 from the read-tools sweep Build and publish / Test and build (linux) (pull_request) Canceled after 0s Details Build and publish / Test and build (windows) (pull_request) Canceled after 0s Details Build and publish / Build and publish Docker image (pull_request) Canceled after 0s Details Build and publish / Test and build (darwin) (pull_request) Canceled after 40s Details Build and publish / Test and build (darwin) (push) Successful in 2m9s Details Build and publish / Test and build (linux) (push) Successful in 2m34s Details Build and publish / Test and build (windows) (push) Successful in 3m11s Details Build and publish / Build and publish Docker image (push) Successful in 1m55s Details v2 request lists sent the RAML example sort field requestDate; Ombi looks up RequestedDate and NullReferenceException'd every non-empty page. Browse now streams TV popular/most-watched payloads and skips the hydrated seasonRequests graph that blew the 8 MiB read budget. provider_summary treats an empty upstream body as an empty group_page.	2026-09-19 20:59:57 +01:00
gronod	958006cff2	Document #12 vote read upstream failures Build and publish / Test and build (darwin) (pull_request) Successful in 1m50s Details Build and publish / Test and build (linux) (pull_request) Successful in 2m21s Details Build and publish / Test and build (windows) (pull_request) Successful in 3m6s Details Build and publish / Build and publish Docker image (pull_request) Successful in 1m53s Details Build and publish / Test and build (darwin) (push) Successful in 2m9s Details Build and publish / Test and build (linux) (push) Successful in 2m31s Details Build and publish / Test and build (windows) (push) Successful in 3m7s Details Build and publish / Build and publish Docker image (push) Successful in 2m15s Details	2026-09-19 18:50:24 +01:00
gronod	7658bc8f39	Fix #8 : fall back to search ratings metadata	2026-09-19 18:48:47 +01:00
gronod	6926a91c80	Fix M7 admin/server wire contracts Build and publish / Test and build (darwin) (pull_request) Successful in 1m52s Details Build and publish / Test and build (linux) (pull_request) Successful in 2m30s Details Build and publish / Test and build (windows) (pull_request) Successful in 3m7s Details Build and publish / Test and build (windows) (push) Successful in 3m7s Details Build and publish / Test and build (darwin) (push) Successful in 1m45s Details Build and publish / Test and build (linux) (push) Successful in 2m12s Details Build and publish / Build and publish Docker image (pull_request) Successful in 1m49s Details Build and publish / Build and publish Docker image (push) Successful in 2m4s Details	2026-09-19 18:36:03 +01:00
gronod	5b1be698d6	Document recent TV identity resolution and add a live callable check Build and publish / Test and build (darwin) (pull_request) Successful in 1m52s Details Build and publish / Test and build (linux) (pull_request) Successful in 2m26s Details Build and publish / Test and build (windows) (pull_request) Successful in 3m6s Details Build and publish / Test and build (windows) (push) Successful in 3m5s Details Build and publish / Test and build (darwin) (push) Successful in 1m48s Details Build and publish / Test and build (linux) (push) Successful in 2m10s Details Build and publish / Build and publish Docker image (pull_request) Successful in 1m52s Details Build and publish / Build and publish Docker image (push) Successful in 2m2s Details The schema contract claimed recent target.id is requestId for every kind — upstream TV rows actually carry a child request id there. The docs now describe the bounded parent-scan resolution, the ombi_tv_child identifier, and the id-0-with-warning degradation. A live test proves a recent tv_parent target is callable via get.	2026-09-19 16:20:03 +01:00
gronod	d07ef4f818	Treat requestId 0 as absent in the TV details overlay gate Upstream Search/tv/info responses send requestId 0 (not a missing field) for shows without a linked request, so the #7 request-state overlay never fired on live instances — requested shows reported requested:false. Now that the parent scan decodes the real collection wrapper, gating on requestId nil-or-0 lets the overlay actually run.	2026-09-19 16:19:02 +01:00
gronod	ff18e60d5a	Resolve discover requested-fallback TV rows to tv_parent targets The recentlyRequested fallback emitted tv_child targets for TV rows while the primary requested-browse path emits tv_parent — and a tv_child target is a dead end for read_requests get/children. Resolve the child request id to the parent via the same bounded scan so both paths agree; rows that fail resolution keep the truthful tv_child target.	2026-09-19 16:18:04 +01:00
gronod	0ce9e2626b	Surface parent provider ids on tv_child projections ChildRequests carries no top-level provider ids upstream — they live on the embedded parentRequest navigation property — so children/list items emitted empty identifiers. Read them from the embedded record; the child target id itself stays the true child PK (provider-shaped for first-request children by upstream design, and callable for child-scoped operations). Mock child rows and the new /Request/tv/{id}/child fixture now match the real wire shape.	2026-09-19 16:16:54 +01:00
gronod	40155b5981	Resolve recent TV rows to real tv_parent request ids Closes #11. Ombi builds recentlyRequested TV rows from child requests, so requestId is a child id — and upstream persists the provider id as the child PK for new-request children, so the value is provider-shaped (TVDB/TMDB) while the parent request id never appears in the payload. Consumers following target into read_requests get hit upstream 500s. TV rows now resolve through one bounded v1 parent scan: an exact child-id match against embedded childRequests (authoritative), then a provider-id fallback against tvDbId/externalProviderId covering versions that put the provider id in requestId directly. The child id is preserved as an ombi_tv_child identifier, provider ids land under tvdb/tmdb/imdb, and unresolvable rows emit target.id 0 with a warning rather than a fabricated or provider-shaped target.	2026-09-19 16:15:18 +01:00
gronod	012f6c0852	Decode the v1 TV parent list's RequestsViewModel wrapper Live Ombi serves GET /api/v1/Request/tv/{count}/{pos}/1/0/0 as {"collection":[...],"total":N}, not a bare array, so decodeArray made every bounded parent scan fail on real instances — the #7 details overlay and the #10 search fallback only worked against the mock's unrealistic bare-array fixture. Decode the documented wrapper shape (tolerating bare arrays) and fix the mock to serve the real shape so tests exercise what production sees.	2026-09-19 16:04:33 +01:00
gronod	6ebcb2fa08	Fix gofmt violations breaking the CI formatting check Build and publish / Test and build (darwin) (push) Successful in 2m23s Details Build and publish / Test and build (linux) (push) Successful in 2m45s Details Build and publish / Test and build (windows) (push) Successful in 3m11s Details Build and publish / Build and publish Docker image (push) Successful in 2m25s Details Blank lines with trailing whitespace in the #10 TV search fallback and bounded-scan helpers caused every Test and build matrix job to fail at Check formatting, masking all downstream steps including Docker publish.	2026-09-19 14:52:50 +01:00
gronod	35723bf3ea	Update docs with M6 findings, specification harmonisation, and verification notes Build and publish / Test and build (linux) (pull_request) Failing after 35s Details Build and publish / Test and build (linux) (push) Failing after 32s Details Build and publish / Test and build (darwin) (pull_request) Failing after 1m11s Details Build and publish / Test and build (darwin) (push) Failing after 1m14s Details Build and publish / Test and build (windows) (pull_request) Failing after 2m50s Details Build and publish / Build and publish Docker image (pull_request) Skipped Details Build and publish / Test and build (windows) (push) Failing after 2m51s Details Build and publish / Build and publish Docker image (push) Skipped Details	2026-09-19 12:53:25 +01:00
gronod	951db61ae7	Fix #18 : Expose saved-server identity leaves in settings projections to allow media server discovery	2026-09-19 12:51:32 +01:00
gronod	0a32b2a187	Fix #16 : Support Plex servers object wrapper and fix sibling option decode paths	2026-09-19 12:47:51 +01:00
gronod	16b0161d73	Fix #17 : Add per-category reference key tables for root folders and service options	2026-09-19 12:45:30 +01:00
gronod	63ef67c8b7	Fix #20 : Make reference projection value deterministic and guard against mojibake labels	2026-09-19 12:44:30 +01:00
gronod	a039ce0276	Update docs with M5 findings and verification Build and publish / Test and build (linux) (push) Failing after 33s Details Build and publish / Test and build (darwin) (push) Failing after 1m4s Details Build and publish / Test and build (windows) (push) Failing after 2m48s Details Build and publish / Build and publish Docker image (push) Skipped Details	2026-09-19 10:42:17 +01:00
gronod	7cf1ece63c	Surface upstream error detail on 5xx responses	2026-09-19 10:42:14 +01:00
gronod	f763d7fdb3	Fix #10 : Add TV search fallback using bounded parent scan	2026-09-19 10:42:11 +01:00
gronod	5e4f8d5d2b	Fix #7 : Overlay TV request state for TVDB using bounded scan	2026-09-19 10:42:08 +01:00
gronod	019caca1b3	Fix M4 discover browse and search contracts Build and publish / Test and build (darwin) (pull_request) Successful in 1m54s Details Build and publish / Test and build (linux) (pull_request) Successful in 2m14s Details Build and publish / Test and build (windows) (pull_request) Successful in 3m6s Details Build and publish / Build and publish Docker image (pull_request) Successful in 1m54s Details Build and publish / Test and build (darwin) (push) Successful in 1m44s Details Build and publish / Test and build (windows) (push) Successful in 3m4s Details Build and publish / Test and build (linux) (push) Successful in 2m4s Details Build and publish / Build and publish Docker image (push) Successful in 1m58s Details	2026-09-19 10:07:10 +01:00