Session counting exposed fake players

We all know the trick. Pick a session window big enough to swallow every idle tab and accidental visit. Active users go up. Product looks healthy. Nobody asks what "active" actually means until the burn rate forces you to audit. I watched this happen on my own Codenames AI project. The dashboard showed a steady climb. Then I dug into session logs and found most "players" loaded the page, read the rules, and left. Not a single guess. The metric was lying to me because I let it. The real villain here is the default session definition. We set it wide because we want the number to look good. But a user who opens your app and closes it in three seconds is not active. They are curious. Maybe confused. Probably gone forever. So here is the question you should ask every time you look at that graph: which sessions actually had a user interacting? If you do not know the answer, you are optimizing for a lie.