Stabilize task persistence, OAuth, recurrence and calendar behavior for next release

docs/HTTP_API.md

@@ -22,12 +22,12 @@ Default port is `8080`.
 
 ## Authentication
 
-Authentication is optional.
+Authentication is required for both HTTP API and MCP requests.
 
-- If `apiAuthToken` is empty, all API requests are accepted.
-- If `apiAuthToken` is set, send `Authorization: Bearer <token>`.
-- Set a token for any workflow where local browser pages, scripts, or other
-  desktop apps are not fully trusted.
+- Send `Authorization: Bearer <token>` using the token in Integrations settings.
+- If `apiAuthToken` is empty at startup, TaskNotes generates and saves a token before starting the server.
+- Clearing the token does not enable unauthenticated access; requests are rejected until a token is configured or generated at the next server start.
+- Existing clients that omitted authentication must be updated to send the token.
 
 Example:
 

docs/calendar-setup.md

@@ -55,6 +55,12 @@ Verify credentials first, then confirm loopback redirect configuration. TaskNote
 
 For Google 403 `access_denied` errors during sign-in, confirm the account is listed as a test user in the Google Auth Platform audience settings while your OAuth app is in testing mode.
 
+**Google `400 redirect_uri_mismatch`**
+
+Check that the credentials entered in TaskNotes belong to an OAuth client of type **Desktop app**, not **Web application**. TaskNotes uses `http://127.0.0.1:<port>` and the operating system chooses the port for each connection attempt. A Web application client configured with a fixed `8080` redirect may work for one attempt but is not compatible with this dynamic-port setup. A `flowName` query parameter is not part of TaskNotes' callback URI and should not be added as a required redirect.
+
+If a Desktop app client still fails, report your TaskNotes and Obsidian versions, operating system, client application type, and only the `redirect_uri` from Google's error details. Do not post the full authorization URL, client secret, authorization code, state, tokens, or exported settings. Adding a test user addresses testing-mode `403 access_denied`, not a redirect mismatch.
+
 **"Failed to fetch events"**
 
 Disconnect and reconnect to refresh OAuth tokens, then re-check provider-side calendar permissions.

docs/features/recurring-tasks.md

@@ -265,7 +265,9 @@ Recurring task logic uses a UTC anchor approach:
 - Display adapts to local timezone
 - Prevents common off-by-one date issues
 
-In other words, calculations stay stable internally while display remains local, which avoids drift when traveling or sharing vaults across timezones.
+The recurrence editor preserves the anchor's calendar date and clock components when opening and saving a rule; it does not reinterpret an existing anchor through the device's timezone. Timed anchors are serialized as `YYYYMMDDTHHMMSSZ`, including seconds. Existing anchors without `Z` are normalized on save using the same clock components, rather than silently shifting their time.
+
+Completing an instance of a **completion-anchored** task moves the anchor to the selected completion day while retaining its existing clock components. Date-only anchors remain date-only. Completing a **scheduled-anchored** task leaves its anchor unchanged. This time-preserving behavior applies to instance completion; explicitly replacing the recurrence rule can still remove or change its time.
 
 ## Backward Compatibility
 

docs/releases/unreleased.md

@@ -32,18 +32,36 @@ When a change has user-facing documentation, include a canonical tasknotes.dev l
 
 -->
 
-## Fixed
-
-- (#1849) Fixed context menus stacking on top of each other. Only one menu stays open at a time, and clicking the same indicator again closes its menu. This previously applied to date fields only, and now covers priority, status, recurrence, reminders, task, ICS event, and batch menus.
-  - Thanks to @3zra47 for reporting and @YBKF for the contribution.
-
 ## Added
 
 - (#2147) Added context-menu actions for recording task completion today, on the scheduled date, on the due date, or on a chosen date. The actions can be grouped in a submenu from Appearance settings. See [Completing Tasks](https://tasknotes.dev/features/task-management/#completing-tasks).
   - Rescheduling a recurring task can reactivate affected completed or skipped instances after confirmation. See [Recurring Tasks](https://tasknotes.dev/features/recurring-tasks/).
+  - Completion-date actions, submenu settings, and rescheduling confirmations are translated into all supported languages.
   - Thanks to @renatomen for the contribution.
 
 ## Fixed
 
+- (#2291) Preserved background task updates when saving an older task edit window, including recurring completion history and fields removed by another writer. Thanks to @martin-forge for the fix.
+- (#2294) Stopped plugin startup when an existing settings file cannot be read, preserving it for recovery instead of starting services with default settings. Thanks to @GGlider for reporting settings loss in #1591 and @martin-forge for the fix.
+- (#2322) Fixed metadata edits deleting the saved title when a filename cannot represent it, such as for long titles. Existing title properties are preserved on unrelated edits; this does not recover previously deleted titles. Thanks to @1dezer1 for reporting.
+- (#2255, #2300) Fixed task cards repeatedly disappearing and being restored while scrolling in Reading mode, which could pull the note down to the bottom. Thanks to @logicelf for the diagnosis and @nelsonlove for the fix.
+- (#2318) Kept calendar events chronological when a Base sort is configured, using Base order for tasks at the same time. Thanks to @ky1ejs for reporting #1411 and @martin-forge for the fix.
+- (#2319) Avoided duplicate recurring-task projections when an original occurrence date is already recorded by a calendar move. Completion and skip history remain visible when requested. Moves without recorded original-date metadata are not covered by this fix. Thanks to @martin-forge for the fix.
+- (#2309) Fixed Google calendars enabled through the `primary` alias using the wrong color, ignoring visibility toggles, or losing their calendar name on event cards and linked notes. Thanks to @martin-forge for the fix.
+- (#2279) Fixed Google Calendar authorization stalling when the system browser opens but does not report back that it launched. Authorization now completes or times out independently, and overlapping attempts cannot stop the active connection attempt. Thanks to @DamienDLR for the diagnosis.
+- (#2298, #2299) Kept timed recurrence anchors when saving custom recurrence or completing a completion-anchored instance. Timed anchors are written with `Z`; their clock components, including seconds, are preserved without a device-timezone conversion. Date-only rules and scheduled-anchor completion are unchanged. See [Recurring Tasks](https://tasknotes.dev/features/recurring-tasks/). Thanks to @wellsbk1 for reporting.
+- (#2043, #2055) Fixed tasks created with the default Subtasks view's **+** button missing their project and immediately disappearing from the view. Thanks to @kudrmax for reporting and @ther12k for the initial fix.
+- (#2284) Prevented repeated activation of instant checkbox conversion from creating duplicate TaskNotes while the first conversion is still in progress. Thanks to @doyoonear for reporting.
+- (#2314) Fixed rescheduled ICS recurring events appearing at their original time and cancelled occurrences remaining visible. Thanks to @benschifman for reporting.
+- (#1849) Fixed context menus stacking on top of each other. Only one menu stays open at a time, and clicking the same indicator again closes its menu. This previously applied to date fields only, and now covers priority, status, recurrence, reminders, task, ICS event, and batch menus.
+  - Thanks to @3zra47 for reporting and @YBKF for the contribution.
 - (#2303) Removed the extra space after inline task links on desktop while retaining the task menu on touch devices.
   - Thanks to @nelsonlove for the fix.
+
+## Changed
+
+- (#2316) Clarified the Google OAuth Desktop app setup and redirect-mismatch troubleshooting, including why fixed Web application redirect URLs are not reliable with dynamic callback ports. See [Calendar Setup](https://tasknotes.dev/calendar-setup/). Thanks to @TomaszGaweda for reporting and following up.
+
+## Security
+
+- (#2292) Required authentication for local API/MCP listeners. When no token is configured, TaskNotes generates and saves one before listening. Clients that previously omitted authentication must supply the token from Integrations settings. OAuth callbacks now use an OS-assigned loopback port, accept each authorization state only once, and return fixed pages without reflecting callback text. Thanks to @martin-forge for the hardening.

docs/settings/integrations.md

@@ -95,7 +95,7 @@ HTTP API settings control the local server lifecycle, listening port, and reques
 Changes to API enablement or port require an Obsidian restart to take effect.
 
 !!! warning
-    The HTTP API binds to loopback only and browser CORS is limited to loopback origins. If the authentication token is empty, local API requests are still unauthenticated. Set a token unless your local environment is fully trusted.
+    The HTTP API binds to loopback only and browser CORS is limited to loopback and supported extension origins. Authentication is required for HTTP API and MCP requests. If the token is empty when the server starts, TaskNotes generates and saves one. Copy it into your clients' authentication settings; clearing it does not enable unauthenticated access.
 
 ## Webhooks
 

docs/settings/task-properties.md

@@ -27,7 +27,7 @@ Property keys are YAML/frontmatter keys. TaskNotes can read and write keys that
 The task title property. Configuration options:
 
 - **Property key**: Frontmatter field name (default: `title`)
-- **Store title in filename**: When enabled, the task title is stored in the filename instead of frontmatter. The filename updates when the title changes.
+- **Store title in filename**: When enabled, the task title is stored in the filename instead of frontmatter when the filename can represent it. Long, sanitized, or duplicate filenames may require a title property to preserve the full text. Editing other properties preserves an existing title property. The filename updates when the title changes.
 - **Filename format**: When "Store title in filename" is disabled, choose how filenames are generated:
     - Title-based
     - Zettelkasten-style

i18n.manifest.json

@@ -1215,7 +1215,7 @@
   "settings.integrations.httpApi.port.description": "b6428bfa6964ba7f4e87759cca444726cb674f67",
   "settings.integrations.httpApi.port.placeholder": "7507d41ecbd162a0d6dfdaaa9988a91184351735",
   "settings.integrations.httpApi.authToken.name": "1ba4dadc61225e43b73eaa19ae9c57856129ff60",
-  "settings.integrations.httpApi.authToken.description": "93591c952b15b9261d1b5d5700e04a92329c45bd",
+  "settings.integrations.httpApi.authToken.description": "4645950dc83ea5b5601e58223affbd795b962da4",
   "settings.integrations.httpApi.authToken.placeholder": "dfd8e9adf613d1b2a46dfac755c50174ccecef4c",
   "settings.integrations.httpApi.mcp.enable.name": "9eba0b2f5b88c4347b23d9fa6c942fc6aa0482f8",
   "settings.integrations.httpApi.mcp.enable.description": "8d7793dc5646fed97cd0505769894e69227f59c4",