src/atproto/oauth.zig:31-40 (redirectUriRegistered) matches a PAR's redirect_uri against the client metadata's redirect_uris by exact string. for a client whose metadata has application_type native, the reference PDS applies the RFC 8252 loopback exception (packages/pds/src/oauth-provider... client-manager.ts:485-503): a redirect to http://127.0.0.1 or http://[::1] matches a registered loopback URI on any port, because a native app cannot know which port is free until it listens.
observed 2026-09-03 with the pi memory extension: its hosted document lists three fixed ports as a workaround, and a login fails if all three are busy. a per-launch ephemeral port is the intended shape.
suggested: when the fetched metadata says application_type native and both URIs are loopback with the same scheme, path, and query, accept the request regardless of port. the exception applies to loopback IP literals only, not to localhost by name.