docs: rewrite v2.1.7 release notes as combined v2.1.6+v2.1.7 changelog

The original v2.1.7 notes only described the documentation correction
on top of v2.1.6 — assuming readers already knew the v2.1.6 content.
That's brittle: the v2.1.6 release described a lifecycle hook that
turned out not to fire on modern npm, so anyone who reads only the
v2.1.6 notes today gets a misleading picture.

Rewrite v2.1.7 to be the canonical, self-contained release notes for
the entire uninstall-cleanup work landed in v2.1.6 + the v2.1.7
correction:

- Restate the v2.1.6 uninstall feature as the working surface (CLI
  command), without the now-removed automatic-lifecycle claim.
- Carry forward all the v2.1.6 bug fixes (hydrate-emails accountId
  collapse, config-toml splice, app-bind router liveness, runFix
  saveQuotaCache try/catch, dry-run bun.lock safety, --clear-accounts
  loud-fail, stream-failover read race, withStorageLock release,
  removePluginFromList null pre-filter, dry-run launcher load
  deferral).
- Lead the bug-fix list with the honest correction: npm@7+ removed
  the preuninstall lifecycle hook, the dead entry has been pulled
  from package.json, and the recommended manual ordering is documented.
- Update the changelog comparison link from v2.1.5...v2.1.7 to skip
  past the in-between release.

The v2.1.6 file is preserved in git history for completeness; the
docs portal already lists v2.1.7 as Current stable so readers land
on the canonical notes.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: ndycode

docs/releases/v2.1.7.md

@@ -1,18 +1,35 @@
+## New Features
+- Added a `codex-multi-auth uninstall [--dry-run] [--json] [--clear-accounts]` CLI command that reverses every postinstall change: unbinds Codex app runtime rotation, removes OS launchers, strips the plugin entry from `Codex.json`, clears the `node_modules` cache, and conservatively deletes the shared `bun.lock` only when no other Codex plugins remain. (#473, #468)
+
 ## Bug Fixes
-- Honest correction to the v2.1.6 issue #468 fix: `npm@7+` removed the `preuninstall`, `uninstall`, and `postuninstall` lifecycle scripts in 2020, so the lifecycle hook shipped in v2.1.6 never actually fired during `npm uninstall codex-multi-auth`. Stress testing on `npm@11.13.0` confirmed two independent canaries — a synthetic minimal package and the published `codex-multi-auth@2.1.6` — install postinstall fires but uninstall produces zero lifecycle invocations. The CLI subcommand `codex-multi-auth uninstall` was always functional and remains the working remediation; users must run it manually **before** `npm uninstall codex-multi-auth` to avoid residual artifacts. (#468)
+- Honest correction to the v2.1.6 issue #468 fix: `npm@7+` removed the `preuninstall`, `uninstall`, and `postuninstall` lifecycle scripts in 2020, so the lifecycle hook shipped in v2.1.6 never actually fired during `npm uninstall codex-multi-auth`. Stress testing on `npm@11.13.0` confirmed two independent canaries — a synthetic minimal package and the published `codex-multi-auth@2.1.6` — install postinstall fires but uninstall produces zero lifecycle invocations. The dead `preuninstall` entry has been removed from `package.json`; the `scripts/preuninstall.js` source is preserved and still callable directly (`node scripts/preuninstall.js`). To uninstall completely, run the manager's own cleanup before removing the npm package: `codex-multi-auth uninstall` then `npm uninstall -g codex-multi-auth`. (#468)
+- Fixed account-row corruption in `hydrateRuntimeEmails` where multiple accounts sharing `accountId === undefined` collapsed into the same `Map` entry; the patch path now writes back by index so refreshed tokens always land on the originating row. (#473)
+- Fixed `restoreTopLevelModelProvider` and `restoreTopLevelResponseStorage` so a missing-key recovery splices the original line in front of the first `[section]` header instead of appending at tail (which produced invalid TOML when `currentConfig` ended inside a section). (#473)
+- Fixed app-bind reuse of `existingState` so a stale status JSON left by a dead router can no longer trigger a `config.toml` rewrite to a port nothing is listening on; the predicate now requires `router.state === "running"` and a live PID. (#473)
+- Fixed the `runFix` quota cache save so a transient Windows `EBUSY`/`EPERM` after account fixes were already persisted is downgraded to a partial-success warning surfaced via `quotaCacheSaveError` instead of hard-failing the run. The same try/catch was applied to the other `saveQuotaCache` call sites in `runHealthCheck` and the forecast JSON/display branches. (#473)
+- Fixed dry-run output for `codex-multi-auth uninstall` and `scripts/preuninstall.js` so the `bun.lock` decision (would-remove vs would-skip) is computed from the actual `Codex.json` plugin list during preview rather than always reporting "uncertain". (#473)
+- Fixed the `--clear-accounts` flag so it no longer silently no-ops when no clearAccounts handler is wired in the build; the CLI now warns and exits non-zero, preventing the irreversible flag from being mistaken for a successful credential wipe. (#473)
+- Fixed a stream-failover regression where the chunk that arrived to end a stall was dropped because `reader.read()` was issued twice across the soft/hard timeout boundary; the read promise is now hoisted before the timeout split. (#473)
+- Fixed `withStorageLock` to initialize `releaseLock` as a typed no-op so a synchronous Promise constructor throw can no longer leave the storage mutex held. (#473)
+- Fixed `removePluginFromList` in `lib/codex-manager/commands/uninstall.ts` to pre-filter falsy entries with `list.filter(Boolean)`, matching `scripts/install-codex-auth-utils.js` so the two implementations cannot drift on a stray null entry. (#473)
+- Fixed the launcher-load path so dry-run preview no longer requires `scripts/codex-app-launcher.js` to be on disk; the default loader is deferred behind `!dryRun`. (#473)
 
 ## Documentation
-- Updated `codex-multi-auth uninstall --help` to call out the recommended ordering (run cleanup first, then `npm uninstall`).
-- Added a "Complete Uninstall" section to `docs/troubleshooting.md` documenting the manual workflow and the npm-lifecycle context.
+- Updated `codex-multi-auth uninstall --help` to call out the recommended ordering: run cleanup first, then `npm uninstall`, with the npm@7+ caveat inline.
+- Added a "Complete Uninstall" section to `docs/troubleshooting.md` documenting the manual workflow and explaining why the lifecycle hook approach does not work on modern npm.
 - Added an `uninstall` row to the Repair command toolkit in the root `README.md` with the same caveat.
-- Added `v2.1.7` release notes and refreshed the docs portal and root README release-history links.
+- Added `v2.1.7` release notes (this file, supersedes the v2.1.6 notes which described the now-removed lifecycle hook) and refreshed the docs portal and root README release-history links.
 
 ## Chores
-- Removed the dead `preuninstall` entry from `package.json` so the published manifest no longer claims a hook npm will not run. The `scripts/preuninstall.js` source is preserved and still callable directly (`node scripts/preuninstall.js`) for explicit cleanup workflows.
-- Validated the release with lint, TypeScript, full vitest suite, package budget, build, and end-to-end install/uninstall stress testing against `npm@11.13.0`.
+- Removed the dead `preuninstall` entry from `package.json` so the published manifest no longer claims a hook npm will not run.
+- Hardened the `codex-multi-auth` Codex.json read-modify-write paths with `withFileOperationRetry` (six attempts, exponential backoff with jitter, full Windows error-code set: `EBUSY`/`EPERM`/`EAGAIN`/`ENOTEMPTY`/`EACCES`) on both the CLI uninstall and the standalone preuninstall script.
+- Replaced bare `rmSync` in `afterEach` cleanup of new test files with `removeWithRetry`, matching the project's documented Windows-safety rule in `test/AGENTS.md`.
+- Added regression coverage for the uninstall feature, hydrate-emails index-stable patching, config-toml restore splice (including a CRLF round-trip case), `withStorageLock` mutex release on queued rejection, the saveQuotaCache partial-success warning ordering, the EBUSY retry loop in the uninstall command, the CLI dispatcher branch that wires `--clear-accounts`, the preuninstall concurrency case, and the stream-failover cleanup-error swallow path.
+- Validated the release with lint, TypeScript, full vitest suite, package budget, build, and end-to-end install/uninstall stress testing against `npm@11.13.0` (14 audit checkpoints across cold-start contention, edge cases, sole-plugin/multi-plugin bun.lock safety, corrupted Codex.json safe-fail, real registry install/uninstall, and full CLI command surface).
 
 ## Changelog
 
-Full Changelog: https://github.com/ndycode/codex-multi-auth/compare/v2.1.6...v2.1.7
+Full Changelog: https://github.com/ndycode/codex-multi-auth/compare/v2.1.5...v2.1.7
 
-- Honest correction to the v2.1.6 uninstall hook claim @ndycode
+- #473 fix: add preuninstall hook and uninstall CLI command (#468) @ndycode
+- Honest correction to the v2.1.6 uninstall hook claim, documentation rewrite, and dead lifecycle entry removal @ndycode