Another day, another odd edge case migration thing to troubleshoot.
Looks like the entryway updates the user's PLC did doc if on a Bluesky PDS, and it does this by a serviceAuth token. If you migrated back, but did not update your verification method when you moved, you can lock yourself out..