A passkey login works on the primary domain, but a support subdomain still advertises the old RP ID and users cannot recover sessions there

Passwordless auth is partially deployed, leaving one operational path outside the trust boundary.