Every passkey tutorial stops at the happy path: one device, one browser, sign-in works. We went past that on purpose. We built a passkey flow across Android and the web, then tried the things real users do: cancel the sheet, delete a key on one device, swap phones, reject the biometric prompt. This talk is what broke, why the docs did not warn us, and the patterns we landed on for fallback, recovery and cross-platform state.

The slides mostly survive as they are. Change “field notes” to “what we hit”, and “the recovery nightmare” stays because it is a design argument, not a claim of experience.