One other person reached out to me saying they were still seeing a large table despite the session gc settings being (apparently) properly configured. They were going to check in with the host but never reported back any findings.
What's important to reiterate is that it will run the garbage collection rarely if a site doesn't get much traffic. Some of my MODX Cloud sites are flagging this in SiteDash, even though they are properly configured (1 in 1000), simply because they don't get 1000 hits often enough.
If anonymous sessions are disabled, it may also be possible the gc only runs once every 1000 requests when a non-anonymous user hits up the site as no session is initialised. Or you may have similar issues if there's a caching layer in front of MODX (e.g. varnish, cloudflare, etc); only requests that end up hitting MODX/PHP have a chance of running gc.
OK, that makes sense. One question, though. The MODX settings have "session_cookie_lifetime" and "session_gc_maxlifetime". One of my sites had 27000 rows in the session table, but I noticed the oldest one was only 7 days. So, I changed the "session_gc_maxlifetime" to 1 day instead. Now there are only 2,000 rows in the table. That's good, but if session_gc_maxlifetime is less than session_cookie_lifetime, are session cookies still going to last the longer value? "session_cookie_lifetime" affects the amount of time a user's "remember be" login lasts, and I want that to be a much longer time than the garbage collection time. When someone logs in, does the cookie set in the user's browser retain all the settings, or is it just a reference to the session entry in the session table, which will no longer exist after 1 day, the way I have that set now?