Dogfood finding #3: upsertPerson resolved existing records by id only. The wizard upserts a bootstrap admin AFTER a provider sync has already created a person for the same Tailscale user (no id passed), so the same providerUserId was duplicated into two records. Resolve existing by providerUserId when no id is given; bootstrap Admin group + protectedAt are preserved on the merge. New regression test; full suite 3414/3414.