silly question but a kratos session contains multiple devices (IP:port combinations). How would this occur? Creating a new browser window does not create a new TCP connection to kratos. what would do such a thing; maybe this is more likely when using kratos for mobile app auth?

I believe we update that array on refresh. But the term "device" is a bit misleading here, as session cannot really leave the device (cookies).