chore(daily): 2026-09-09 daily update

planning/changelog/2026-09-08.md

@@ -0,0 +1,40 @@
+# Daily changelog — September 08, 2026
+
+**Date:** 2026-09-08
+**PRs merged:** 7
+
+---
+
+## Summary
+
+A backlog-clearing day: the maintainer batch-merged two pending automated daily-update PRs alongside two real fixes (a headless-session leak and a dead settings toggle), an `audit-architecture` fix for an unanchored vault-root path check, and the two weekly automated bot PRs (Gemini model list, UI translations).
+
+## What shipped
+
+### [#1491 chore(daily): 2026-09-08 daily update](https://github.com/allenhutchison/obsidian-gemini/pull/1491)
+
+The automated daily-update run covering 2026-09-07: wrote that day's changelog (a quiet day, no PRs merged), ran a docs audit that found no drift, and confirmed no unlabeled open issues.
+
+### [#1489 fix(agent-view): anchor the dropped-file vault-root check to a folder boundary](https://github.com/allenhutchison/obsidian-gemini/pull/1489)
+
+The Electron file-drop handler in `agent-view-ui.ts` decided whether a dropped OS file lives inside the vault with a bare `startsWith` prefix check and no separator anchor, so a sibling directory merely sharing the vault's path prefix (e.g. `<vault>-backup/Archive/a.md` against a vault at `<vault>`) could resolve to an in-vault file of the same relative path and get silently attached instead of rejected. The fix routes the check through the shared `isPathInFolder()` helper, per the repo's path-containment invariant. Filed directly as a PR by the `audit-architecture` sweep since the fix was a self-contained, four-line, single-file change.
+
+### [#1486 chore(daily): 2026-09-07 daily update](https://github.com/allenhutchison/obsidian-gemini/pull/1486)
+
+The automated daily-update run covering 2026-09-06: wrote that day's changelog (5 merged PRs), ran a docs audit that found no drift, and confirmed no unlabeled open issues. Re-confirmed (not re-fixed) a previously-flagged code bug where `main.ts` defaults `openaiModelName` to a model ID that doesn't match the registry — a code fix, out of scope for the docs-only audit.
+
+### [#1476 fix: release headless and deleted sessions](https://github.com/allenhutchison/obsidian-gemini/pull/1476)
+
+Every scheduled task or agent hook retained its temporary session until plugin unload, since nothing released it after the turn completed. Adds `SessionManager.releaseSession`, called from a `finally` around the headless turn (covering cancellation and failure too), and routes explicit session deletion through the same release path. Also switches new session IDs to Web Crypto UUIDs after CodeQL flagged the old `Math.random()` suffix as insecure now that IDs double as release keys; existing saved session IDs remain valid. Fixes #1460.
+
+### [#1477 fix: remove ineffective system prompt override toggle](https://github.com/allenhutchison/obsidian-gemini/pull/1477)
+
+Removes the "Allow system prompt override" settings toggle and its now-empty Custom Prompts heading — the toggle never actually did anything; the prompt's own `override_system_prompt` frontmatter field was already the sole control. Prunes the corresponding i18n keys across all 20 shipped translations and updates README, the settings reference, and the custom-prompts guide. Fixes #1468.
+
+### [#1487 chore: Update available Gemini models](https://github.com/allenhutchison/obsidian-gemini/pull/1487)
+
+Weekly automated model-list refresh from Google's API.
+
+### [#1488 chore(i18n): Update UI translations](https://github.com/allenhutchison/obsidian-gemini/pull/1488)
+
+Automated regeneration of `src/i18n/` translations for keys whose English source changed since the last run — largely picking up the string removals from #1477.