With validate_timestamps off, PHP never notices a changed file — which is the point, and which means a deploy that does not clear the cache serves the previous release indefinitely.
$ systemctl reload php7.3-fpm # graceful: finishes in-flight requests
# NOT this, from a web request:
# opcache_reset()
# it clears the cache for the one worker that handled the request.
# with 50 workers that is 2% of the problem solved.
$ php -r 'print_r(opcache_get_status(false));' | grep -E 'used_memory|num_cached'The reload rather than a restart is what avoids dropping connections. There is a second reason it must happen even with timestamp validation on: the realpath cache keys on the symlink target, so a release directory with a new name is a new set of paths and the old ones remain cached until the workers cycle. Checking num_cached_scripts after a deploy is the two-second verification that it worked.