PERF.64 Website: a session file is written for every anonymous page view (312,607 files, 1.3 GB, 92,632 a day, GC 38 s)

sessions/ holds 312,607 files, 98.8 % under 120 bytes (a CSRF token or nothing), 92,632 written in 24 h and still 7,574 an hour after today's crawler change; the directory inode is 142 MB (a directory never shrinks); session-gc takes 38 s every 6 h (38,589 CSRF-only files removed per run). Every page view is open, flock and write of a file; the per-session lock also serializes one visitor's parallel requests. (FX.136 shortened the lifetime; this removes the cause.) Change: start the session lazily, only when a cc_session cookie arrives or something is written (csrf_token(), flash(), sign-in); a signed double-submit CSRF token needs no session for visitors; then recreate sessions/ once. About 90k fewer file writes a day and GC in a second.