FX.136 Website: 2.45 million session files; sessions now collected (21 days, empty after a day, CSRF-only after 48 h), none for crawlers

What was wrong (2026-11-08): PHP's session collector is off for the site's own sessions folder (session.gc_probability 0; the system timer only cleans /var/lib/php/sessions), so nothing ever removed a session file. After one month: 2.45 million files, 521,000 empty. A sample showed 99 % of the rest hold only an 83-byte CSRF token: a first visit that rendered a form and never came back. Most come from cookie-less crawls with plain browser user agents (one walks every /roadmap-issues filter permutation, about 4,000 requests an hour in bursts, from Huawei Cloud Singapore), which start a fresh session on every request. In 7 days bots made 103,244 sessions against 73,607 from people.

What changed (owner's choices): SESSION_LIFETIME 21 days; bin/session-gc.php from /etc/cron.d/cadcraft-sessions every 6 hours removes expired sessions, empty ones older than a day, and sessions whose whole content is the CSRF token line after 48 hours (1.47 million removed on the first run); core/bootstrap.php starts no session and sets no visitor cookie for named crawlers, link previewers and scripted HTTP clients arriving without our cookie (curl, wget, headless browsers, the smoke test and empty user agents still get one: the test suites need CSRF and sign-in). Also: MySQL innodb_buffer_pool_size 128 MB to 1 GB (SET PERSIST, online).

Cost accepted: a person who leaves a form open for two days and then submits gets the CSRF 403 and submits again. Not done: stateless CSRF (no session for anonymous visitors) and throttling the roadmap crawl; the owner judged both too likely to break things.