Why social login creates duplicate accounts, and how a lock table fixes it
An OAuth callback can fire twice for one sign-in, and a naive handler creates two accounts for one person. Here is why it happens, why checking for an existing user does not fix it, and how claiming the auth code in a lock table does.