For some reason, the event came through before the keys did (not enough logging to see why)
One tab did a successful keyshare req to get the key
The other tab raced with this to also to a keyshare req; it ended up requesting it from itself and getting a response from itself.
However, this tab failed to then update the display to decrypt the message, perhaps because of getting confused with self-fulfilling its keyshare request and thinking it didn't need to notify the app about the new inbound session.
Subsequently this got fixed (perhaps when switching room & back again).
https://github.com/matrix-org/riot-web-rageshakes/issues/1972 has full details.