simpler

src/PostIt.Tests/SettingsLoadTests.cs

@@ -90,9 +90,9 @@ public class SettingsLoadTests
                     {
                         bool flip = ((workerId + i) & 1) == 0;
                         settings.DarkMode = flip;
-                        settings.Authentication.RedirectUri = flip
+                        settings.Authentication.RedirectUri =
-                            ? global::AuthenticationSettings.DefaultDesktopRedirectUri
+                            global::AuthenticationSettings.DefaultDesktopRedirectUri;
-                            : PostIt.ViewModels.Settings.DefaultLoopbackRedirectUri;
+
                         settings.BusinessApiUrl = flip
                             ? "https://a.example.test/api/v1/"
                             : "https://b.example.test/api/v1/";

src/PostIt/PostIt/ViewModels/Settings.cs

@@ -17,20 +17,6 @@ public partial class Settings : ViewModelBase
 {
     const string SettingsFileName = "postit-settings.json";
 
-    /// <summary>
-    /// Legacy loopback redirect URI. The post-2026.6 production flow
-    /// uses the custom URI scheme (<see cref="DefaultDesktopRedirectUri"/>
-    /// on desktop, <see cref="AndroidRedirectUri"/> on Android) so the
-    /// OS hands the callback to the running instance without a TCP
-    /// listener. The loopback constant stays here so test fixtures
-    /// (which spin up an in-process OidcStubAuthority) keep working,
-    /// but it is no longer used as a default anywhere in production.
-    /// If you are still pointing your production <c>postit-settings.json</c>
-    /// at this URI, switch to <c>postit://callback</c> and remove the
-    /// matching entry from the Yavsc.Org server's allowed redirect URIs.
-    /// </summary>
-    public const string DefaultLoopbackRedirectUri = "http://127.0.0.1:7890/";
-
     /// <summary>
     /// Redirect URI used by the Android app. The corresponding IntentFilter
     /// in <c>PostIt.Android/Properties/AndroidManifest.xml</c> must match.