I am experimenting with Observation, and have noticed that in order to receive Events, the Session through which the EvenListener was registered must remain open. (When I logged out, I no longer received Events.)

This is how the JCR API was designed and is per the specification.

My EventListener is forwarding certain JCR events to a JMS queue, for updates to legacy databases. This suggests that the Session will remain open  months between application restarts in production.  That makes me a little nervous. Should I be concerned?

A long-lived session for use only by events is what we've always intended, so no need to worry there. The suggested design pattern is to create a single long-lived session with which you register all of your listeners, and do nothing else with that session. Instead, when your listener receives an event, use a different (often new) session to do the work. If you're just forwarding the event on to JMS (or extracting information from only the events), then you're not really using anything in the session itself; but if you're doing anything more, I'd strongly suggest using a work queue to get off the listener/event thread as quickly as possible. Note that this approach is the same as what is recommended for the reference implementation.