Signing in on a second device killed both sessions
A single column on the user record could only represent one live session, so signing in on a second device silently killed refresh on the first.
It could not have worked
A race, an ordering, one column holding two things. The shape ruled it out before the code ran.
A single column on the user record held a single token id, so an account could structurally only represent one live session. Log in on your phone and your laptop's refresh silently starts failing; log in on the laptop again and the phone dies. It reads as a flaky app rather than a bug, because nothing errors at the moment it happens — the surviving session works fine until its access token expires up to two hours later.
Proven with two curl "devices" before touching anything, fixed with a sessions table and a session id in the token, re-proven with the same script. This was live for months and nobody reported it clearly, because "I got logged out" is what users say about every session problem and it never sounds structural.