go-webauthn refuses an assertion whose Backup Eligible flag differs from the stored credential's. The flag was never stored, so it compared against false and every synced passkey (iCloud Keychain, Google Password Manager, 1Password) failed with "Backup Eligible flag inconsistency" - in passwordless sign-in, second-factor sign-in and step-up alike. Registration now stores BackupEligible and BackupState. Rows registered before this have no baseline, so their first verified assertion adopts the signed flag and records it; a recorded value always stands, so a genuine change is still refused.