If the TBolt link is disconnected, the machine reboots, or probably even if it sleeps - it is probably necessary to flush the cache.
Reason being that any of the above could mean that either the SSD or the HDD could have been modified during the disconnect. That means that the cache could be out of synch - and the easiest method to resynch is to flush the cache and start over. This is similar to what happens if you pull a disk out of a RAID-5 array and reinsert - that disk has to be completely rewritten. (A hardware/software RAID-5 can tell if the disk was pulled while the array stayed off, and not resynch on every power cycle or reboot.)
The standard method is to defragment the virtual disk from the guest, zero free space from the guest, then defragment the host image (folding any snapshot or linked images to a new base container file).
You're absolutely right that simply defragmenting on the guest alone can make an expandable disk image much worse. Two main reasons for this:
- Even though from the guest the disk may appear very fragmented, on the host image there is temporal locality. As you're writing from the guest, the expanded segments are often close together. This can mean less physical head movement, although from the guest it looks like there would be a lot of head movement.
- The writes from the defragmenting may expand the disk further, and make the real disk more fragmented - and there's nothing to say that two adjacent clusters seen from the guest are on two adjacent cluster on the physical disk.