Hi @ekoby,
Thanks for clarifying this. I rolled back to the backup (the ctrl.db file that I had saved before removing the auth policy) and restarted the controller, and the edge-oidc URLs were in the "correct" order.
I thought I had encountered a strange race condition during controller startup, so I restarted the controller about 20 times. Finally, the edge-oidc URLs were again in the wrong order. (Hint: My 'private' setup runs on an ARM machine with four Cortex-A55 cores and four Cortex-A76 cores - this might be relevant when hunting for race conditions.)
It seems that a simple controller restart would have solved this issue! 
Nevertheless, I was able to reproduce to the incorrect state for testing purposes.
I can confirm that the latest 1.9.2 Linux tunneler and the Ziti Desktop Edge 2.53.559 are both working on the 1.7.1 controller with swapped edge-oidc URLs.
Thanks for all your work!