327 days of uptime was the bug
A power cut forced the first reboot in 327 days. A Redis unit someone disabled years ago never came back, and PHP workers started eating a gigabyte of memory per second with memory_limit at 128M.
The disk that filled itself
Homelab box said 100 percent full, du said half the disk was free. Docker was holding open a log file I had rm'd months ago. lsof +L1 untangles the knot.
I blocked Tor exit nodes, then I opened Tor Browser
I deployed a hardened Tor exit node firewall on a SaaS production box, opened Tor Browser to confirm, and the site loaded. The IPv4 fortress was perfect. The IPv6 side door was wide open. This is the script, the punchline, and the rewrite that became TorShield.