Managing user sessions

1) If a new CI instance is associated with a browser what happens if our user clicks on a link in an email which then launches a class and method? Does this count as a GC trigger?

Maybe. Depends on when the session class is loaded. If session garbage collection runs (it doesn't always) it will happen when the session class is loaded i.e. $this->load->library('session');.

2) If browser comms are stateless what exactly is controlling expiry? Is CI somehow testing the cookie on a timer?

Sort of. Cookies are stored by the browser on the client's computer. When a cookie is created it is given a time (a timestamp) setting when it expires. (If set to 0, the cookie will expire when the browser closes.) An expired cookie is not used by the browser. IOW, the browser does the testing.

If the browser has non-expired cookies they are returned to the server with the other requested data. Access to session data is only allowed if one of the cookies is the session cookie that matches expected criteria.

3) If a browser recives a rendered page after logging out from our site (effectively offering a login screen) can I still send flashdata to their screen? ie they still (I think) have an active session.

Yes, if the session is active then flashdata can be accessed. If that's what you want, then the log out routine should not destroy the session.

If they have actually closed that browser tab and I try to send flashdata to their session_id as found in the DB, will it be queued for the next request?

Sounds like you are planning on writing to the session database outside of a user's request to the website. Is that the plan? Let's see.

1. If (big if) you can determine the correct db record to modify and
   
2. If you can correctly modify the record to represent "flash data" and
   
3. If, on the client side, the session has not been closed because $config['sess_expire_on_close'] = true; or
   
4. If the session (cookie) does not expire before the user returns to the site.
   

Then session data should be available when the user returns to the site.

By the way, closing the tab does count as a 'sess_expire_on_close' event. That event requires that the user exit the browser application. At least that's the case for the browsers I use for testing. Older, and/or less "main stream" browser apps might behave differently.

And for the love of all that is right and good upgrade to current version of CI.