ahh okay i understand.
when it sees your SR fail the SIO, it rejects. making the credential legacy & relying on the reader having legacy enabled means the reader only looks at the PACs (facility code & card number) and doesn’t bother to check for the SIO.
what if my card’s facility code is different to them?