Alright, so a few updates from additional information I could find.
About Smart Keys
(source link, requires free registration for full article, I've attached it as well)
"...one of the things a Smart Key broadcasts its unique Key ID code, which is burned into its memory at the factory. The other is the Vehicle ID code, which is obtained from the car and burned to the Smart Key during the registration process. Just as a key blank is cut to work with a particular vehicle, the key registration process also alters the Smart Key to “fit” the “lock”."
So this debunks my earlier understanding that nothing is written to the key. Per the above, the key contains two IDs, one native, the other dynamic. The way I see it, the IDs are no different than names. The key has a name its born with (say "Tom"), then your car also has a name (say "Sally") which is written to the key during its registration.
What may give the illusion that the keys are registered to the car alone (and not 2-way) is that your car never gives out any of the names during its (standard) communications. The oscillators in the car broadcast to everyone "state the name of the car you're looking for". When a key is nearby, it will state "I'm looking for Sally". If your car's name is Sally, it says "Hey, I'm Sally, what's your name?". In the response, it has to be one of the names the car has registered into memory (such as "Tom") in order for the full handshake to occur.
I'll bring this up later.
About the ECUs
(source link same as above)
The article is specific to Prius and Camry, but it may also apply to RAV4s.
There appears to be 2 ECUs that require attention:
-The Main Body ECU
-The Immobiliser ECU
The Main Body ECU is the electronic ignition switch where as the Immobiliser ECU is the lockbox that holds the keys. The is a shared security code (referred to as S-Code) between these two units. This is to avoid tampering and ensure that someone doesn't swap one out to try and get the car running with different keys.
Why is this important? During the key registration process, this could explain some of the difficulties experienced. From Part 2 of the article (source link, requires free registration for full article, I've attached it as well)
"If your customer is just adding a Smart Key, there are only two steps.
-Register the new key(s) in the Immobiliser ECU (ID Code Box).
-Register the new key(s) in the Smart Key ECU (Certification ECU)."
...and confirming what we already know:
"When all Smart Keys have been lost
-If all keys are lost, you’ll need to perform a Seed Reset."
(a Seed Reset would require the mentioned passcode)
Used Smart Keys / EBay Smart Keys
(source link same as above, Part 2)
"New Smart Keys come with a Key ID burned in at the factory, but the Vehicle ID is blank. If a customer brings a key in with a Vehicle ID already burned, you will be able to register it in the Immobiliser (ID Code Box). However, you will not be able to register the key to in the Smart Key ECU (Certification ECU) (<-- I called this the Main Body ECU above). In other words, you have a key that will start the car when the inserted in the key slot (<--tapped near the Start Button), but none of the wireless functions will work (I am not sure if this means the keyfob portion, or the remote ability to start the car without pressing the key right up against the Start button)."
Some advice that may work:
"If the numbers and the battery are OK, the next step is to erase all keys from the Immobiliser ECU (ID Code Box) and the Smart Key ECU (using the same key). Then try registering all of the remaining keys, including the new key. Sometimes this works, sometimes it doesn’t."
...whether this requires a Seed Reset or not is unclear.
Some more advice...
"If the erasing all key codes did not solve your wireless registration woes, try a Smart Key (<--Main Body ECU)Reset, followed by an Immobiliser Reset. VERY IMPORTANT – use the suspect key for the resets. When finished, you will have one key registered in the Immobiliser ECU and no keys registered in the Smart Key ECU. Go ahead and register the key in the Smart Key ECU. It should work.
Don’t let failure freak you out. It happens sometimes. If at first you fail, try again. It’s not a one shot only deal (although there may be some sort of limit)."
This makes it seem like the wireless function is simply the keyfob. Some other user posts talked about how the dealership was able to get the car to accept the used key, but the keyfob wouldn't function... so this would seem to align with that.
All of this, could be solved with this:
"The Immobiliser registration always seems to go smoothly. If there’s going to be trouble, it’s likely to occur when registering the key in the Smart Key ECU (wireless registration). The scanner will offer the following advice when registration fails. “Make sure the Smart Cancel Switch is off and the IG ON”. The manual will offer even less."
I haven't seen anyone mention this when programming the keyfob portion and post it here FWIW.
...and some last generic advice (less likely the issue, but could explain why multiple attempts succeed)
"Wireless interference can hamper wireless key registration efforts. Put your cell phone in airplane mode, move the car away from transformers, wireless routers, fluorescent lights, etc.
Rogue keys can be very frustrating. If one of the Smart Keys in the car has a stuck lock or unlock button, it can ruin your day. Remove all but essential keys from the car, and then try again."
Last but not least, there is an entry on Toyota's TIS "Known Bugs" page
that made me chuckle slightly (as if there wasn't enough complexity)
Immobilizer/Smart Key Reset Abnormal Operation
Device(s): Techstream and Techstream Lite (Mongoose VIM)
Description: When performing an Immobilizer or Smart Key Reset, errors or abnormal operation may occur if Java software is not installed, has become corrupt, or version is too old. Installing the latest version of Java (v1.6 - Update 7, minimum) from java.com: Java + You will resolve this issue."
This was also never mentioned, and could also be a cause of issues. FWIW again.