While debugging an unrelated issue I noticed that tramp was initiating a new connection every time save-buffers-kill-emacs ran. I eventually tracked it down to org-persist-gc running on kill-emacs-hook.
It turns out that org-persist--index held a record for a remote file, and the transparency of tramp means that emacs will happily open any number of remote connections to check whether such files exist on exit. This could produce unexpected and quite bad behavior for users that edit many remote org files. It also leaks information that a user has closed emacs over the network even if they have not intentionally made any remote connections. I see a couple potential fixes. - skip gc for remote files - never persist remote files - +only gc remote files when their cache is expired+ I think the last option might be the most reasonable compromise? Er, nope, I was looking at an old/variant cache location that still had :expiry values in the plist, but it looks like the most recent version does not, so we are left with option 1 or option 2. Given that the network latency is likely to dominate accessing such files the time to reparse if we don't persist (option 2) seems like it will be small? I think for option 1 to work safely there would need to be a way to periodically gc remote files, maybe when another file on that remote was accessed so an existing tramp connection would be used? Thoughts? Tom