The token exchange left redirect_uri to the OAuth client, which defaults to clientMetadata.redirect_uris[0] — the store id since 722de74. An unpacked build therefore authorized as itself and exchanged as the store, and the PDS refused it: invalid_grant, "The redirect_uri parameter must match the one used in the authorization request". Sign-in was dead for every install that is not the store one, at the last step of the flow. Both halves now take the URI from one place, the id the build is actually running under. A unit test pins it, including that the metadata's first entry is a different id, so the fallback cannot quietly come back.