Fixed — the device grant never issued a refresh token, or an ID Token.
RFC 8628 is the flow for clients with no browser — CLIs, TVs, headless devices — so they are the ones that most need a session outliving one access token. offline_access was accepted at /oauth/device_authorization, stored on the grant, then dropped at redemption: the branch passed null for both the ID Token and the refresh token while the authorization-code branch beside it issued each under the same conditions.
The effect was a client signed out an hour later with no way back but a fresh user_code, and nothing anywhere saying its requested scope had been ignored.
Both branches now agree. A refresh token is issued when offline_access was granted and not otherwise.